diff --git a/config/boards/rockpi-s.conf b/config/boards/rockpi-s.conf index 322062dde0..963bd70c49 100644 --- a/config/boards/rockpi-s.conf +++ b/config/boards/rockpi-s.conf @@ -1,15 +1,76 @@ # Rockchip RK3308 quad core 256-512MB SoC WiFi BOARD_NAME="Rockpi S" -BOARDFAMILY="rockpis" +BOARDFAMILY="rockchip64" BOARD_MAINTAINER="brentr" BOOTCONFIG="rock-pi-s-rk3308_defconfig" + DEFAULT_CONSOLE="serial" MODULES_LEGACY="g_serial" SERIALCON="ttyS0" -KERNEL_TARGET="legacy,current,edge" +KERNEL_TARGET="current,edge" KERNEL_TEST_TARGET="current,edge" BOOT_FDT_FILE="rockchip/rk3308-rock-pi-s.dtb" MODULES_BLACKLIST="rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi gpu_sched lima hantro_vpu panfrost" HAS_VIDEO_OUTPUT="no" BOOTBRANCH_BOARD="tag:v2022.04" BOOTPATCHDIR="u-boot-rockchip64-v2022.04" + +BOOTENV_FILE='rockpis.txt' +OVERLAY_PREFIX='rk3308' + +#comment out line below for an image that will NOT boot from the built-in SDNAND +IDBLOADER_BLOB=$SRC/packages/blobs/rockchip/rk3308_idbloader_ddr589MHz_uart0_m0_v2.06.136sd.bin + +#The SDNAND capabilty IDBLOADER_BLOB requires the U-Boot and Linux serial console on UART0 +#Linux will hang on reboot if the console remains on UART2 + +#Note: IDBLOADER_BLOB is derived from +# https://dl.radxa.com/rockpis/images/loader/rk3308_loader_ddr589MHz_uart0_m0_v2.06.136sd.bin +#by using the rkdeveloptool to "upgrade" the previous DDR_BLOB loader on the SDNAND +#To recreate it, build the image with IDBLOADER_BLOB unset and boot Rock PI-S in MASKROM mode +#On your host (connected to the RockPi-S's USB-C port): +# rdeveloptool db rk3308_loader_ddr589MHz_uart0_m0_v2.06.136sd.bin +# rdeveloptool wl 0 newly_built_image.img +# rdeveloptool ul rk3308_loader_ddr589MHz_uart0_m0_v2.06.136sd.bin #this writes 280 sectors + +#Then, reset the RockPi-S to boot from SDNAND. Using that running image: +# dd if=/dev/mmcblk0 of=rk3308_idbloader_ddr589MHz_uart0_m0_v2.06.136sd.bin skip=64 count=280 + + +function post_family_config___uboot_config() { + + display_alert "$BOARD" "u-boot ${BOOTBRANCH_BOARD} overrides" "info" + unset uboot_custom_postprocess family_tweaks_bsp # disable stuff from rockchip64_common + + BOOTSCRIPT=boot-rockpis.cmd:boot.cmd + + uboot_custom_postprocess() { + + # TODO: remove this diversion from common caused by different loaderimage params + run_host_x86_binary_logged $RKBIN_DIR/tools/loaderimage --pack --uboot ./u-boot-dtb.bin uboot.img 0x600000 --size 1024 1 && + if [ -r "$IDBLOADER_BLOB" ]; then + echo "Installing $IDBLOADER_BLOB" + echo "Capable of booting from built-in SDNAND" + cp $IDBLOADER_BLOB idbloader.bin + else + [ "$IDBLOADER_BLOB" ] && echo "Missing $IDBLOADER_BLOB" + echo "WARNING: This image will not boot from built-in SDNAND" + tools/mkimage -n rk3308 -T rksd -d $RKBIN_DIR/$DDR_BLOB idbloader.bin && + cat $RKBIN_DIR/$MINILOADER_BLOB >> idbloader.bin + fi && + run_host_x86_binary_logged $RKBIN_DIR/tools/trust_merger --replace bl31.elf $RKBIN_DIR/$BL31_BLOB trust.ini + } + + family_tweaks_bsp() { #Install udev script that derives fixed, unique MAC addresses for net interfaces + + #that are assigned random ones -- like RockPI-S's WiFi network interfaces + bsp=$SRC/packages/bsp/rockpis + rules=etc/udev/rules.d + + install -m 755 $bsp/lib/udev/fixEtherAddr $destination/lib/udev && + install -m 644 $bsp/$rules/05-fixMACaddress.rules $destination/$rules + } + + +} + diff --git a/patch/kernel/archive/rockpis-4.4/0001-rockpi-s.patch b/patch/kernel/archive/rockpis-4.4/0001-rockpi-s.patch deleted file mode 100644 index 9ee61f7287..0000000000 --- a/patch/kernel/archive/rockpis-4.4/0001-rockpi-s.patch +++ /dev/null @@ -1,68 +0,0 @@ -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 4cdadc24..45263aa6 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -100,7 +100,7 @@ core-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a - ifeq ($(CONFIG_BUILD_ARM64_APPENDED_DTB_IMAGE),y) - KBUILD_IMAGE := $(subst $\",,$(CONFIG_BUILD_ARM64_APPENDED_KERNEL_IMAGE_NAME)) - else --KBUILD_IMAGE := Image.gz -+KBUILD_IMAGE := Image - endif - - KBUILD_DTBS := dtbs -@@ -121,6 +121,12 @@ zinstall install: vmlinux - %.dtb: scripts - $(Q)$(MAKE) $(build)=$(boot)/dts $(boot)/dts/$@ - -+%.dtbo: | scripts -+ $(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@ -+ -+%.scr: | scripts -+ $(Q)$(MAKE) $(build)=$(boot)/dts ARCH=$(ARCH) $(boot)/dts/$@ -+ - PHONY += dtbs dtbs_install - - dtbs: prepare scripts -diff --git a/arch/arm64/boot/dts/rockchip/rk3308.dtsi b/arch/arm64/boot/dts/rockchip/rk3308.dtsi -index dfa1ae79..2a0d76b4 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3308.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3308.dtsi -@@ -180,7 +180,6 @@ - opp-microvolt-L4 = <1150000 1150000 1340000>; - opp-microvolt-L5 = <1125000 1125000 1340000>; - clock-latency-ns = <40000>; -- status = "disabled"; - }; - opp-1296000000 { - opp-hz = /bits/ 64 <1296000000>; -@@ -192,7 +191,6 @@ - opp-microvolt-L4 = <1200000 1200000 1340000>; - opp-microvolt-L5 = <1175000 1175000 1340000>; - clock-latency-ns = <40000>; -- status = "disabled"; - }; - }; - -diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -index c64afc6a..e039eaa9 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -@@ -7,7 +7,7 @@ - - #include - /* #include "rk3308.dtsi" */ --#include "rk3308k.dtsi" -+#include "rk3308.dtsi" - - / { - model = "Radxa ROCK Pi S"; -@@ -151,7 +151,7 @@ - pinctrl-1 = <&uart4_rts_gpio>; - BT,power_gpio = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>; - BT,wake_host_irq = <&gpio4 RK_PB4 GPIO_ACTIVE_HIGH>; -- status = "okay"; -+ status = "disabled"; - }; - - wireless-wlan { diff --git a/patch/kernel/archive/rockpis-4.4/arm64_increasing_DMA_block_memory_allocation_to_2048.patch b/patch/kernel/archive/rockpis-4.4/arm64_increasing_DMA_block_memory_allocation_to_2048.patch deleted file mode 100644 index 652c75bd3f..0000000000 --- a/patch/kernel/archive/rockpis-4.4/arm64_increasing_DMA_block_memory_allocation_to_2048.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index 3216e09..21bce28 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -44,7 +44,7 @@ static pgprot_t __get_dma_pgprot(unsigned long attrs, pgprot_t prot, - - static struct gen_pool *atomic_pool; - --#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_256K -+#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_2M - static size_t atomic_pool_size __initdata = DEFAULT_DMA_COHERENT_POOL_SIZE; - - static int __init early_coherent_pool(char *p) diff --git a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-disable-dmc.patch b/patch/kernel/archive/rockpis-4.4/board-rockpi-s-disable-dmc.patch deleted file mode 100644 index 1bbb6f05f8..0000000000 --- a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-disable-dmc.patch +++ /dev/null @@ -1,15 +0,0 @@ -DMC is non functional for ROCK Pi S anyway. - -diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -index 4a72ffed8..0eb7cc628 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -@@ -202,7 +202,7 @@ - - &dmc { - center-supply = <&vdd_log>; -- status = "okay"; -+ status = "disabled"; - }; - - &emmc { diff --git a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-enable-uart0.patch b/patch/kernel/archive/rockpis-4.4/board-rockpi-s-enable-uart0.patch deleted file mode 100644 index e46f3b4563..0000000000 --- a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-enable-uart0.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -index 0eb7cc628..d3a8a3c79 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -@@ -342,6 +342,12 @@ - }; - }; - -+&uart0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart0_xfer>; -+ status = "okay"; -+}; -+ - &uart4 { - pinctrl-names = "default"; - pinctrl-0 = <&uart4_xfer &uart4_cts>; diff --git a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-fix-thermal-zones.patch b/patch/kernel/archive/rockpis-4.4/board-rockpi-s-fix-thermal-zones.patch deleted file mode 100644 index 0e5e586f54..0000000000 --- a/patch/kernel/archive/rockpis-4.4/board-rockpi-s-fix-thermal-zones.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -index aa5ce6856..4a72ffed8 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts -@@ -365,12 +365,6 @@ - status = "okay"; - }; - --&thermal_zones { -- soc_thermal { -- thermal-sensors = <&tsadc 0>; -- }; --}; -- - &wdt { - status = "okay"; - }; diff --git a/patch/kernel/archive/rockpis-4.4/compiler-fixes.patch b/patch/kernel/archive/rockpis-4.4/compiler-fixes.patch deleted file mode 100644 index 63f0df717a..0000000000 --- a/patch/kernel/archive/rockpis-4.4/compiler-fixes.patch +++ /dev/null @@ -1,35 +0,0 @@ -diff --git a/Makefile b/Makefile -index adf05079..82d77dda 100644 ---- a/Makefile -+++ b/Makefile -@@ -382,9 +382,17 @@ CHECK = sparse - - # Use the wrapper for the compiler. This wrapper scans for new - # warnings and causes the build to stop upon encountering them. -+ifeq ("$(origin GCC_WRAPPER)", "command line") -+ KGCC_WRAPPER = $(GCC_WRAPPER) -+endif -+ifndef KGCC_WRAPPER -+ KGCC_WRAPPER = 0 -+endif -+ifeq ($(KGCC_WRAPPER),1) - ifneq ($(wildcard $(srctree)/scripts/gcc-wrapper.py),) - CC = $(srctree)/scripts/gcc-wrapper.py $(CROSS_COMPILE)gcc - endif -+endif - - CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \ - -Wbitwise -Wno-return-void $(CF) -@@ -442,10 +450,8 @@ export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE - export HOSTCXX HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS - - export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS LDFLAGS --export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_GCOV --export CFLAGS_KASAN CFLAGS_KASAN_NOSANITIZE --export CFLAGS_KCOV --export KBUILD_AFLAGS AFLAGS_KERNEL AFLAGS_MODULE -+export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_GCOV CFLAGS_KCOV CFLAGS_KASAN -+export KBUILD_AFLAGS AFLAGS_KERNEL AFLAGS_MODULE CFLAGS_KASAN_NOSANITIZE - export KBUILD_AFLAGS_MODULE KBUILD_CFLAGS_MODULE KBUILD_LDFLAGS_MODULE - export KBUILD_AFLAGS_KERNEL KBUILD_CFLAGS_KERNEL - export KBUILD_ARFLAGS diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.228-229.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.228-229.patch deleted file mode 100644 index 376f96f4c6..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.228-229.patch +++ /dev/null @@ -1,3339 +0,0 @@ -diff --git a/Makefile b/Makefile -index 009a36b276f7..99b211904ac5 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 228 -+SUBLEVEL = 229 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-imx/pm-imx5.c b/arch/arm/mach-imx/pm-imx5.c -index 532d4b08276d..fd996187fc5f 100644 ---- a/arch/arm/mach-imx/pm-imx5.c -+++ b/arch/arm/mach-imx/pm-imx5.c -@@ -301,14 +301,14 @@ static int __init imx_suspend_alloc_ocram( - if (!ocram_pool) { - pr_warn("%s: ocram pool unavailable!\n", __func__); - ret = -ENODEV; -- goto put_node; -+ goto put_device; - } - - ocram_base = gen_pool_alloc(ocram_pool, size); - if (!ocram_base) { - pr_warn("%s: unable to alloc ocram!\n", __func__); - ret = -ENOMEM; -- goto put_node; -+ goto put_device; - } - - phys = gen_pool_virt_to_phys(ocram_pool, ocram_base); -@@ -318,6 +318,8 @@ static int __init imx_suspend_alloc_ocram( - if (virt_out) - *virt_out = virt; - -+put_device: -+ put_device(&pdev->dev); - put_node: - of_node_put(node); - -diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c -index 3f62b35fb6f1..815c395a1076 100644 ---- a/arch/arm64/kernel/perf_regs.c -+++ b/arch/arm64/kernel/perf_regs.c -@@ -13,15 +13,34 @@ u64 perf_reg_value(struct pt_regs *regs, int idx) - return 0; - - /* -- * Compat (i.e. 32 bit) mode: -- * - PC has been set in the pt_regs struct in kernel_entry, -- * - Handle SP and LR here. -+ * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but -+ * we're stuck with it for ABI compatability reasons. -+ * -+ * For a 32-bit consumer inspecting a 32-bit task, then it will look at -+ * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h). -+ * These correspond directly to a prefix of the registers saved in our -+ * 'struct pt_regs', with the exception of the PC, so we copy that down -+ * (x15 corresponds to SP_hyp in the architecture). -+ * -+ * So far, so good. -+ * -+ * The oddity arises when a 64-bit consumer looks at a 32-bit task and -+ * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return -+ * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and -+ * PC registers would normally live. The initial idea was to allow a -+ * 64-bit unwinder to unwind a 32-bit task and, although it's not clear -+ * how well that works in practice, somebody might be relying on it. -+ * -+ * At the time we make a sample, we don't know whether the consumer is -+ * 32-bit or 64-bit, so we have to cater for both possibilities. - */ - if (compat_user_mode(regs)) { - if ((u32)idx == PERF_REG_ARM64_SP) - return regs->compat_sp; - if ((u32)idx == PERF_REG_ARM64_LR) - return regs->compat_lr; -+ if (idx == 15) -+ return regs->pc; - } - - if ((u32)idx == PERF_REG_ARM64_SP) -diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S -index c17e8451d997..3fbe420f49c4 100644 ---- a/arch/openrisc/kernel/entry.S -+++ b/arch/openrisc/kernel/entry.S -@@ -1092,13 +1092,13 @@ ENTRY(__sys_clone) - l.movhi r29,hi(sys_clone) - l.ori r29,r29,lo(sys_clone) - l.j _fork_save_extra_regs_and_call -- l.addi r7,r1,0 -+ l.nop - - ENTRY(__sys_fork) - l.movhi r29,hi(sys_fork) - l.ori r29,r29,lo(sys_fork) - l.j _fork_save_extra_regs_and_call -- l.addi r3,r1,0 -+ l.nop - - ENTRY(sys_rt_sigreturn) - l.j _sys_rt_sigreturn -diff --git a/arch/powerpc/include/asm/kprobes.h b/arch/powerpc/include/asm/kprobes.h -index 039b583db029..f0717eedf781 100644 ---- a/arch/powerpc/include/asm/kprobes.h -+++ b/arch/powerpc/include/asm/kprobes.h -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -61,7 +62,7 @@ typedef ppc_opcode_t kprobe_opcode_t; - #define kprobe_lookup_name(name, addr) \ - { \ - char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN]; \ -- char *modsym; \ -+ const char *modsym; \ - bool dot_appended = false; \ - if ((modsym = strchr(name, ':')) != NULL) { \ - modsym++; \ -diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c -index 8dff2b371219..a14d9b008f74 100644 ---- a/arch/powerpc/kernel/machine_kexec.c -+++ b/arch/powerpc/kernel/machine_kexec.c -@@ -113,11 +113,12 @@ void machine_kexec(struct kimage *image) - - void __init reserve_crashkernel(void) - { -- unsigned long long crash_size, crash_base; -+ unsigned long long crash_size, crash_base, total_mem_sz; - int ret; - -+ total_mem_sz = memory_limit ? memory_limit : memblock_phys_mem_size(); - /* use common parsing */ -- ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(), -+ ret = parse_crashkernel(boot_command_line, total_mem_sz, - &crash_size, &crash_base); - if (ret == 0 && crash_size > 0) { - crashk_res.start = crash_base; -@@ -176,6 +177,7 @@ void __init reserve_crashkernel(void) - /* Crash kernel trumps memory limit */ - if (memory_limit && memory_limit <= crashk_res.end) { - memory_limit = crashk_res.end + 1; -+ total_mem_sz = memory_limit; - printk("Adjusted memory limit for crashkernel, now 0x%llx\n", - memory_limit); - } -@@ -184,7 +186,7 @@ void __init reserve_crashkernel(void) - "for crashkernel (System RAM: %ldMB)\n", - (unsigned long)(crash_size >> 20), - (unsigned long)(crashk_res.start >> 20), -- (unsigned long)(memblock_phys_mem_size() >> 20)); -+ (unsigned long)(total_mem_sz >> 20)); - - if (!memblock_is_region_memory(crashk_res.start, crash_size) || - memblock_reserve(crashk_res.start, crash_size)) { -diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h -index 6bc941be6921..166fbd74e316 100644 ---- a/arch/s390/include/asm/syscall.h -+++ b/arch/s390/include/asm/syscall.h -@@ -41,7 +41,17 @@ static inline void syscall_rollback(struct task_struct *task, - static inline long syscall_get_error(struct task_struct *task, - struct pt_regs *regs) - { -- return IS_ERR_VALUE(regs->gprs[2]) ? regs->gprs[2] : 0; -+ unsigned long error = regs->gprs[2]; -+#ifdef CONFIG_COMPAT -+ if (test_tsk_thread_flag(task, TIF_31BIT)) { -+ /* -+ * Sign-extend the value so (int)-EFOO becomes (long)-EFOO -+ * and will match correctly in comparisons. -+ */ -+ error = (long)(int)error; -+ } -+#endif -+ return IS_ERR_VALUE(error) ? error : 0; - } - - static inline long syscall_get_return_value(struct task_struct *task, -diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c -index 396dbdea0cfa..2f4316c14266 100644 ---- a/arch/sparc/kernel/ptrace_32.c -+++ b/arch/sparc/kernel/ptrace_32.c -@@ -167,12 +167,17 @@ static int genregs32_set(struct task_struct *target, - if (ret || !count) - return ret; - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- ®s->y, -+ ®s->npc, - 34 * sizeof(u32), 35 * sizeof(u32)); - if (ret || !count) - return ret; -+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -+ ®s->y, -+ 35 * sizeof(u32), 36 * sizeof(u32)); -+ if (ret || !count) -+ return ret; - return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, -- 35 * sizeof(u32), 38 * sizeof(u32)); -+ 36 * sizeof(u32), 38 * sizeof(u32)); - } - - static int fpregs32_get(struct task_struct *target, -diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c -index c1566170964f..829592d5efe0 100644 ---- a/arch/sparc/kernel/ptrace_64.c -+++ b/arch/sparc/kernel/ptrace_64.c -@@ -534,13 +534,8 @@ static int genregs32_get(struct task_struct *target, - ®, sizeof(reg), 0) - != sizeof(reg)) - return -EFAULT; -- if (access_process_vm(target, -- (unsigned long) u, -- ®, sizeof(reg), 1) -- != sizeof(reg)) -+ if (put_user(reg, u++)) - return -EFAULT; -- pos++; -- u++; - } - } - } -@@ -639,11 +634,7 @@ static int genregs32_set(struct task_struct *target, - } - } else { - for (; count > 0 && pos < 32; count--) { -- if (access_process_vm(target, -- (unsigned long) -- u, -- ®, sizeof(reg), 0) -- != sizeof(reg)) -+ if (get_user(reg, u++)) - return -EFAULT; - if (access_process_vm(target, - (unsigned long) -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index 7c48aa03fe77..5a6cb30b1c62 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -750,6 +750,13 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - void *frame_pointer; - bool skipped = false; - -+ /* -+ * Set a dummy kprobe for avoiding kretprobe recursion. -+ * Since kretprobe never run in kprobe handler, kprobe must not -+ * be running at this point. -+ */ -+ kprobe_busy_begin(); -+ - INIT_HLIST_HEAD(&empty_rp); - kretprobe_hash_lock(current, &head, &flags); - /* fixup registers */ -@@ -825,10 +832,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - orig_ret_address = (unsigned long)ri->ret_addr; - if (ri->rp && ri->rp->handler) { - __this_cpu_write(current_kprobe, &ri->rp->kp); -- get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE; - ri->ret_addr = correct_ret_addr; - ri->rp->handler(ri, regs); -- __this_cpu_write(current_kprobe, NULL); -+ __this_cpu_write(current_kprobe, &kprobe_busy); - } - - recycle_rp_inst(ri, &empty_rp); -@@ -844,6 +850,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - - kretprobe_hash_unlock(current, &flags); - -+ kprobe_busy_end(); -+ - hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { - hlist_del(&ri->hlist); - kfree(ri); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index aac60d1605ff..61fc92f92e0a 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -2162,7 +2162,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - return kvm_mtrr_set_msr(vcpu, msr, data); - case MSR_IA32_APICBASE: - return kvm_set_apic_base(vcpu, msr_info); -- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff: -+ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff: - return kvm_x2apic_msr_write(vcpu, msr, data); - case MSR_IA32_TSCDEADLINE: - kvm_set_lapic_tscdeadline_msr(vcpu, data); -@@ -2432,7 +2432,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_IA32_APICBASE: - msr_info->data = kvm_get_apic_base(vcpu); - break; -- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff: -+ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff: - return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data); - break; - case MSR_IA32_TSCDEADLINE: -diff --git a/crypto/algboss.c b/crypto/algboss.c -index 6e39d9c05b98..5cbc588555ca 100644 ---- a/crypto/algboss.c -+++ b/crypto/algboss.c -@@ -194,8 +194,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval) - if (IS_ERR(thread)) - goto err_put_larval; - -- wait_for_completion_interruptible(&larval->completion); -- - return NOTIFY_STOP; - - err_put_larval: -diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c -index ef3dfc90e817..13c308323e94 100644 ---- a/drivers/acpi/sysfs.c -+++ b/drivers/acpi/sysfs.c -@@ -776,13 +776,13 @@ static void __exit interrupt_stats_exit(void) - } - - static ssize_t --acpi_show_profile(struct device *dev, struct device_attribute *attr, -+acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr, - char *buf) - { - return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile); - } - --static const struct device_attribute pm_profile_attr = -+static const struct kobj_attribute pm_profile_attr = - __ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL); - - static ssize_t hotplug_enabled_show(struct kobject *kobj, -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index fc4bf8ff40ea..17cebfe5acc8 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -56,7 +56,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -6222,7 +6221,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) - /* perform each probe asynchronously */ - for (i = 0; i < host->n_ports; i++) { - struct ata_port *ap = host->ports[i]; -- async_schedule(async_port_probe, ap); -+ ap->cookie = async_schedule(async_port_probe, ap); - } - - return 0; -@@ -6355,11 +6354,11 @@ void ata_host_detach(struct ata_host *host) - { - int i; - -- /* Ensure ata_port probe has completed */ -- async_synchronize_full(); -- -- for (i = 0; i < host->n_ports; i++) -+ for (i = 0; i < host->n_ports; i++) { -+ /* Ensure ata_port probe has completed */ -+ async_synchronize_cookie(host->ports[i]->cookie + 1); - ata_port_detach(host->ports[i]); -+ } - - /* the host is dead now, dissociate ACPI */ - ata_acpi_dissociate(host); -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index 065fcc4be263..f89cb143f1cd 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -638,6 +638,8 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv, - /* temporary section violation during probe() */ - drv->probe = probe; - retval = code = __platform_driver_register(drv, module); -+ if (retval) -+ return retval; - - /* - * Fixup that section violation, being paranoid about code scanning -diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c -index c120d70d3fb3..fc7a20286090 100644 ---- a/drivers/block/ps3disk.c -+++ b/drivers/block/ps3disk.c -@@ -464,7 +464,6 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev) - blk_queue_bounce_limit(queue, BLK_BOUNCE_HIGH); - - blk_queue_max_hw_sectors(queue, dev->bounce_size >> 9); -- blk_queue_segment_boundary(queue, -1UL); - blk_queue_dma_alignment(queue, dev->blk_size-1); - blk_queue_logical_block_size(queue, dev->blk_size); - -diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c -index 95a4dd290f35..d7dd0417ef5e 100644 ---- a/drivers/clk/qcom/gcc-msm8916.c -+++ b/drivers/clk/qcom/gcc-msm8916.c -@@ -270,7 +270,7 @@ static struct clk_pll gpll0 = { - .l_reg = 0x21004, - .m_reg = 0x21008, - .n_reg = 0x2100c, -- .config_reg = 0x21014, -+ .config_reg = 0x21010, - .mode_reg = 0x21000, - .status_reg = 0x2101c, - .status_bit = 17, -@@ -297,7 +297,7 @@ static struct clk_pll gpll1 = { - .l_reg = 0x20004, - .m_reg = 0x20008, - .n_reg = 0x2000c, -- .config_reg = 0x20014, -+ .config_reg = 0x20010, - .mode_reg = 0x20000, - .status_reg = 0x2001c, - .status_bit = 17, -@@ -324,7 +324,7 @@ static struct clk_pll gpll2 = { - .l_reg = 0x4a004, - .m_reg = 0x4a008, - .n_reg = 0x4a00c, -- .config_reg = 0x4a014, -+ .config_reg = 0x4a010, - .mode_reg = 0x4a000, - .status_reg = 0x4a01c, - .status_bit = 17, -@@ -351,7 +351,7 @@ static struct clk_pll bimc_pll = { - .l_reg = 0x23004, - .m_reg = 0x23008, - .n_reg = 0x2300c, -- .config_reg = 0x23014, -+ .config_reg = 0x23010, - .mode_reg = 0x23000, - .status_reg = 0x2301c, - .status_bit = 17, -diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c -index 91c89ac193b9..77ae2d21c488 100644 ---- a/drivers/clk/samsung/clk-exynos5433.c -+++ b/drivers/clk/samsung/clk-exynos5433.c -@@ -1708,7 +1708,8 @@ static struct samsung_gate_clock peric_gate_clks[] __initdata = { - GATE(CLK_SCLK_PCM1, "sclk_pcm1", "sclk_pcm1_peric", - ENABLE_SCLK_PERIC, 7, CLK_SET_RATE_PARENT, 0), - GATE(CLK_SCLK_I2S1, "sclk_i2s1", "sclk_i2s1_peric", -- ENABLE_SCLK_PERIC, 6, CLK_SET_RATE_PARENT, 0), -+ ENABLE_SCLK_PERIC, 6, -+ CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, 0), - GATE(CLK_SCLK_SPI2, "sclk_spi2", "sclk_spi2_peric", ENABLE_SCLK_PERIC, - 5, CLK_SET_RATE_PARENT, 0), - GATE(CLK_SCLK_SPI1, "sclk_spi1", "sclk_spi1_peric", ENABLE_SCLK_PERIC, -diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c -index 9c79af0c03b2..2cec9e83831f 100644 ---- a/drivers/clk/sunxi/clk-sunxi.c -+++ b/drivers/clk/sunxi/clk-sunxi.c -@@ -311,7 +311,7 @@ static void sun6i_a31_get_pll1_factors(u32 *freq, u32 parent_rate, - * Round down the frequency to the closest multiple of either - * 6 or 16 - */ -- u32 round_freq_6 = round_down(freq_mhz, 6); -+ u32 round_freq_6 = rounddown(freq_mhz, 6); - u32 round_freq_16 = round_down(freq_mhz, 16); - - if (round_freq_6 > round_freq_16) -diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c -index dbef218fe5ec..14201c52b44b 100644 ---- a/drivers/clk/ti/composite.c -+++ b/drivers/clk/ti/composite.c -@@ -228,6 +228,7 @@ cleanup: - if (!cclk->comp_clks[i]) - continue; - list_del(&cclk->comp_clks[i]->link); -+ kfree(cclk->comp_clks[i]->parent_names); - kfree(cclk->comp_clks[i]); - } - -diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c -index 341b8c686ec7..4aaaccf95b36 100644 ---- a/drivers/firmware/efi/esrt.c -+++ b/drivers/firmware/efi/esrt.c -@@ -182,7 +182,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num) - rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL, - "%s", name); - if (rc) { -- kfree(entry); -+ kobject_put(&entry->kobj); - return rc; - } - } -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index bb25abba7ad0..51cdff2af8b2 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - -@@ -2647,6 +2648,17 @@ fail: - return ret; - } - -+static int do_get_act_status(struct drm_dp_aux *aux) -+{ -+ int ret; -+ u8 status; -+ -+ ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status); -+ if (ret < 0) -+ return ret; -+ -+ return status; -+} - - /** - * drm_dp_check_act_status() - Check ACT handled status. -@@ -2656,33 +2668,29 @@ fail: - */ - int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr) - { -- u8 status; -- int ret; -- int count = 0; -- -- do { -- ret = drm_dp_dpcd_readb(mgr->aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status); -- -- if (ret < 0) { -- DRM_DEBUG_KMS("failed to read payload table status %d\n", ret); -- goto fail; -- } -- -- if (status & DP_PAYLOAD_ACT_HANDLED) -- break; -- count++; -- udelay(100); -- -- } while (count < 30); -- -- if (!(status & DP_PAYLOAD_ACT_HANDLED)) { -- DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n", status, count); -- ret = -EINVAL; -- goto fail; -+ /* -+ * There doesn't seem to be any recommended retry count or timeout in -+ * the MST specification. Since some hubs have been observed to take -+ * over 1 second to update their payload allocations under certain -+ * conditions, we use a rather large timeout value. -+ */ -+ const int timeout_ms = 3000; -+ int ret, status; -+ -+ ret = readx_poll_timeout(do_get_act_status, mgr->aux, status, -+ status & DP_PAYLOAD_ACT_HANDLED || status < 0, -+ 200, timeout_ms * USEC_PER_MSEC); -+ if (ret < 0 && status >= 0) { -+ DRM_DEBUG_KMS("Failed to get ACT after %dms, last status: %02x\n", -+ timeout_ms, status); -+ return -EINVAL; -+ } else if (status < 0) { -+ DRM_DEBUG_KMS("Failed to read payload table status: %d\n", -+ status); -+ return status; - } -+ - return 0; --fail: -- return ret; - } - EXPORT_SYMBOL(drm_dp_check_act_status); - -diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c -index d18b88b755c3..5c595d9f7e8f 100644 ---- a/drivers/gpu/drm/drm_encoder_slave.c -+++ b/drivers/gpu/drm/drm_encoder_slave.c -@@ -84,7 +84,7 @@ int drm_i2c_encoder_init(struct drm_device *dev, - - err = encoder_drv->encoder_init(client, dev, encoder); - if (err) -- goto fail_unregister; -+ goto fail_module_put; - - if (info->platform_data) - encoder->slave_funcs->set_config(&encoder->base, -@@ -92,9 +92,10 @@ int drm_i2c_encoder_init(struct drm_device *dev, - - return 0; - -+fail_module_put: -+ module_put(module); - fail_unregister: - i2c_unregister_device(client); -- module_put(module); - fail: - return err; - } -diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c -index b2977a181935..e8664a9f1e77 100644 ---- a/drivers/gpu/drm/qxl/qxl_kms.c -+++ b/drivers/gpu/drm/qxl/qxl_kms.c -@@ -199,7 +199,7 @@ static int qxl_device_init(struct qxl_device *qdev, - &(qdev->ram_header->cursor_ring_hdr), - sizeof(struct qxl_command), - QXL_CURSOR_RING_SIZE, -- qdev->io_base + QXL_IO_NOTIFY_CMD, -+ qdev->io_base + QXL_IO_NOTIFY_CURSOR, - false, - &qdev->cursor_event); - -diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c -index c3d531a1114b..14ee1d9a56a7 100644 ---- a/drivers/gpu/drm/radeon/ni_dpm.c -+++ b/drivers/gpu/drm/radeon/ni_dpm.c -@@ -2128,7 +2128,7 @@ static int ni_init_smc_spll_table(struct radeon_device *rdev) - if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) - ret = -EINVAL; - -- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) -+ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) - ret = -EINVAL; - - if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT)) -diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c -index b61db9db3ca5..c85ac178c483 100644 ---- a/drivers/i2c/busses/i2c-piix4.c -+++ b/drivers/i2c/busses/i2c-piix4.c -@@ -647,7 +647,8 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id) - } - - if (dev->vendor == PCI_VENDOR_ID_AMD && -- dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) { -+ (dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS || -+ dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)) { - retval = piix4_setup_sb800(dev, id, 1); - } - -diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c -index 0d351954db02..8fca6e3dd750 100644 ---- a/drivers/i2c/busses/i2c-pxa.c -+++ b/drivers/i2c/busses/i2c-pxa.c -@@ -297,11 +297,10 @@ static void i2c_pxa_scream_blue_murder(struct pxa_i2c *i2c, const char *why) - dev_err(dev, "IBMR: %08x IDBR: %08x ICR: %08x ISR: %08x\n", - readl(_IBMR(i2c)), readl(_IDBR(i2c)), readl(_ICR(i2c)), - readl(_ISR(i2c))); -- dev_dbg(dev, "log: "); -+ dev_err(dev, "log:"); - for (i = 0; i < i2c->irqlogidx; i++) -- pr_debug("[%08x:%08x] ", i2c->isrlog[i], i2c->icrlog[i]); -- -- pr_debug("\n"); -+ pr_cont(" [%03x:%05x]", i2c->isrlog[i], i2c->icrlog[i]); -+ pr_cont("\n"); - } - - #else /* ifdef DEBUG */ -@@ -691,11 +690,9 @@ static inline void i2c_pxa_stop_message(struct pxa_i2c *i2c) - { - u32 icr; - -- /* -- * Clear the STOP and ACK flags -- */ -+ /* Clear the START, STOP, ACK, TB and MA flags */ - icr = readl(_ICR(i2c)); -- icr &= ~(ICR_STOP | ICR_ACKNAK); -+ icr &= ~(ICR_START | ICR_STOP | ICR_ACKNAK | ICR_TB | ICR_MA); - writel(icr, _ICR(i2c)); - } - -diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c -index 616173b7a5e8..c26fdcb7dddf 100644 ---- a/drivers/infiniband/core/mad.c -+++ b/drivers/infiniband/core/mad.c -@@ -2912,6 +2912,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, - DMA_FROM_DEVICE); - if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device, - sg_list.addr))) { -+ kfree(mad_priv); - ret = -ENOMEM; - break; - } -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 5c93582c71cc..634e9284b7be 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1375,7 +1375,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, - if (__set_blocks(n1, n1->keys + n2->keys, - block_bytes(b->c)) > - btree_blocks(new_nodes[i])) -- goto out_nocoalesce; -+ goto out_unlock_nocoalesce; - - keys = n2->keys; - /* Take the key of the node we're getting rid of */ -@@ -1404,7 +1404,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, - - if (__bch_keylist_realloc(&keylist, - bkey_u64s(&new_nodes[i]->key))) -- goto out_nocoalesce; -+ goto out_unlock_nocoalesce; - - bch_btree_node_write(new_nodes[i], &cl); - bch_keylist_add(&keylist, &new_nodes[i]->key); -@@ -1450,6 +1450,10 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, - /* Invalidated our iterator */ - return -EINTR; - -+out_unlock_nocoalesce: -+ for (i = 0; i < nodes; i++) -+ mutex_unlock(&new_nodes[i]->write_lock); -+ - out_nocoalesce: - closure_sync(&cl); - bch_keylist_free(&keylist); -diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c -index 7eec619a6023..3d1457189fa2 100644 ---- a/drivers/mfd/wm8994-core.c -+++ b/drivers/mfd/wm8994-core.c -@@ -690,3 +690,4 @@ module_i2c_driver(wm8994_i2c_driver); - MODULE_DESCRIPTION("Core support for the WM8994 audio CODEC"); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Mark Brown "); -+MODULE_SOFTDEP("pre: wm8994_regulator"); -diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c -index df54475d163b..43bcc19c9068 100644 ---- a/drivers/net/ethernet/atheros/alx/main.c -+++ b/drivers/net/ethernet/atheros/alx/main.c -@@ -872,8 +872,12 @@ out_free_rings: - - static void __alx_stop(struct alx_priv *alx) - { -- alx_halt(alx); - alx_free_irq(alx); -+ -+ cancel_work_sync(&alx->link_check_wk); -+ cancel_work_sync(&alx->reset_wk); -+ -+ alx_halt(alx); - alx_free_rings(alx); - } - -@@ -1406,9 +1410,6 @@ static void alx_remove(struct pci_dev *pdev) - struct alx_priv *alx = pci_get_drvdata(pdev); - struct alx_hw *hw = &alx->hw; - -- cancel_work_sync(&alx->link_check_wk); -- cancel_work_sync(&alx->reset_wk); -- - /* restore permanent mac address */ - alx_set_macaddr(hw, hw->perm_addr); - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 58102e96ac5c..e198427d0f29 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -18182,8 +18182,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, - - rtnl_lock(); - -- /* We probably don't have netdev yet */ -- if (!netdev || !netif_running(netdev)) -+ /* Could be second call or maybe we don't have netdev yet */ -+ if (!netdev || tp->pcierr_recovery || !netif_running(netdev)) - goto done; - - /* We needn't recover from permanent error */ -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index 203f96faf6fb..3bd0bdbdfa0e 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -6270,11 +6270,17 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) - struct net_device *netdev = pci_get_drvdata(pdev); - struct e1000_adapter *adapter = netdev_priv(netdev); - struct e1000_hw *hw = &adapter->hw; -- u32 ctrl, ctrl_ext, rctl, status; -- /* Runtime suspend should only enable wakeup for link changes */ -- u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol; -+ u32 ctrl, ctrl_ext, rctl, status, wufc; - int retval = 0; - -+ /* Runtime suspend should only enable wakeup for link changes */ -+ if (runtime) -+ wufc = E1000_WUFC_LNKC; -+ else if (device_may_wakeup(&pdev->dev)) -+ wufc = adapter->wol; -+ else -+ wufc = 0; -+ - status = er32(STATUS); - if (status & E1000_STATUS_LU) - wufc &= ~E1000_WUFC_LNKC; -@@ -6332,7 +6338,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) - e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw); - } else if ((hw->mac.type == e1000_pch_lpt) || - (hw->mac.type == e1000_pch_spt)) { -- if (!(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC))) -+ if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC))) - /* ULP does not support wake from unicast, multicast - * or broadcast. - */ -diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c -index 1a4729c36aa4..623e4225e7c8 100644 ---- a/drivers/net/hamradio/yam.c -+++ b/drivers/net/hamradio/yam.c -@@ -1160,6 +1160,7 @@ static int __init yam_init_driver(void) - err = register_netdev(dev); - if (err) { - printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name); -+ free_netdev(dev); - goto error; - } - yam_devs[i] = dev; -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index e3f2e6098db4..2dcc8a039d42 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -1396,10 +1396,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - } - - if (pkt_cnt == 0) { -- /* Skip IP alignment psudo header */ -- skb_pull(skb, 2); - skb->len = pkt_len; -- skb_set_tail_pointer(skb, pkt_len); -+ /* Skip IP alignment pseudo header */ -+ skb_pull(skb, 2); -+ skb_set_tail_pointer(skb, skb->len); - skb->truesize = pkt_len + sizeof(struct sk_buff); - ax88179_rx_checksum(skb, pkt_hdr); - return 1; -@@ -1408,8 +1408,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - ax_skb = skb_clone(skb, GFP_ATOMIC); - if (ax_skb) { - ax_skb->len = pkt_len; -- ax_skb->data = skb->data + 2; -- skb_set_tail_pointer(ax_skb, pkt_len); -+ /* Skip IP alignment pseudo header */ -+ skb_pull(ax_skb, 2); -+ skb_set_tail_pointer(ax_skb, ax_skb->len); - ax_skb->truesize = pkt_len + sizeof(struct sk_buff); - ax88179_rx_checksum(ax_skb, pkt_hdr); - usbnet_skb_return(dev, ax_skb); -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index c6a012b5ba39..966b6947e565 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -388,16 +388,6 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist) - - /* Setup initial capable state. Will be updated later */ - link->aspm_capable = link->aspm_support; -- /* -- * If the downstream component has pci bridge function, don't -- * do ASPM for now. -- */ -- list_for_each_entry(child, &linkbus->devices, bus_list) { -- if (pci_pcie_type(child) == PCI_EXP_TYPE_PCI_BRIDGE) { -- link->aspm_disable = ASPM_STATE_ALL; -- break; -- } -- } - - /* Get and check endpoint acceptable latencies */ - list_for_each_entry(child, &linkbus->devices, bus_list) { -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 83ad32b07cc3..ab161bbeb4d4 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -1624,6 +1624,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7520_MCH, quir - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7320_MCH, quirk_pcie_mch); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7525_MCH, quirk_pcie_mch); - -+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_HUAWEI, 0x1610, PCI_CLASS_BRIDGE_PCI, 8, quirk_pcie_mch); - - /* - * It's possible for the MSI to get corrupted if shpc and acpi -diff --git a/drivers/power/smb347-charger.c b/drivers/power/smb347-charger.c -index 072c5189bd6d..0655dbdc7000 100644 ---- a/drivers/power/smb347-charger.c -+++ b/drivers/power/smb347-charger.c -@@ -1141,6 +1141,7 @@ static bool smb347_volatile_reg(struct device *dev, unsigned int reg) - switch (reg) { - case IRQSTAT_A: - case IRQSTAT_C: -+ case IRQSTAT_D: - case IRQSTAT_E: - case IRQSTAT_F: - case STAT_A: -diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h -index 7e70f9298cc1..11f6ebd04545 100644 ---- a/drivers/s390/cio/qdio.h -+++ b/drivers/s390/cio/qdio.h -@@ -376,7 +376,6 @@ static inline int multicast_outbound(struct qdio_q *q) - extern u64 last_ai_time; - - /* prototypes for thin interrupt */ --void qdio_setup_thinint(struct qdio_irq *irq_ptr); - int qdio_establish_thinint(struct qdio_irq *irq_ptr); - void qdio_shutdown_thinint(struct qdio_irq *irq_ptr); - void tiqdio_add_input_queues(struct qdio_irq *irq_ptr); -diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c -index d0090c5c88e7..a64615a10352 100644 ---- a/drivers/s390/cio/qdio_setup.c -+++ b/drivers/s390/cio/qdio_setup.c -@@ -479,7 +479,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data) - setup_queues(irq_ptr, init_data); - - setup_qib(irq_ptr, init_data); -- qdio_setup_thinint(irq_ptr); - set_impl_params(irq_ptr, init_data->qib_param_field_format, - init_data->qib_param_field, - init_data->input_slib_elements, -diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c -index debe69adfc70..aecb6445a567 100644 ---- a/drivers/s390/cio/qdio_thinint.c -+++ b/drivers/s390/cio/qdio_thinint.c -@@ -268,17 +268,19 @@ int __init tiqdio_register_thinints(void) - - int qdio_establish_thinint(struct qdio_irq *irq_ptr) - { -+ int rc; -+ - if (!is_thinint_irq(irq_ptr)) - return 0; -- return set_subchannel_ind(irq_ptr, 0); --} - --void qdio_setup_thinint(struct qdio_irq *irq_ptr) --{ -- if (!is_thinint_irq(irq_ptr)) -- return; - irq_ptr->dsci = get_indicator(); - DBF_HEX(&irq_ptr->dsci, sizeof(void *)); -+ -+ rc = set_subchannel_ind(irq_ptr, 0); -+ if (rc) -+ put_indicator(irq_ptr->dsci); -+ -+ return rc; - } - - void qdio_shutdown_thinint(struct qdio_irq *irq_ptr) -diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c -index deaaf84989cd..be595add8026 100644 ---- a/drivers/scsi/arm/acornscsi.c -+++ b/drivers/scsi/arm/acornscsi.c -@@ -2912,8 +2912,10 @@ static int acornscsi_probe(struct expansion_card *ec, const struct ecard_id *id) - - ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0); - ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0); -- if (!ashost->base || !ashost->fast) -+ if (!ashost->base || !ashost->fast) { -+ ret = -ENOMEM; - goto out_put; -+ } - - host->irq = ec->irq; - ashost->host = host; -diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c -index e26747a1b35a..e7075aae15da 100644 ---- a/drivers/scsi/ibmvscsi/ibmvscsi.c -+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c -@@ -427,6 +427,8 @@ static int ibmvscsi_reenable_crq_queue(struct crq_queue *queue, - int rc = 0; - struct vio_dev *vdev = to_vio_dev(hostdata->dev); - -+ set_adapter_info(hostdata); -+ - /* Re-enable the CRQ */ - do { - if (rc) -diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c -index 680bf6f0ce76..476f46aad54c 100644 ---- a/drivers/scsi/iscsi_boot_sysfs.c -+++ b/drivers/scsi/iscsi_boot_sysfs.c -@@ -319,7 +319,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset, - boot_kobj->kobj.kset = boot_kset->kset; - if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype, - NULL, name, index)) { -- kfree(boot_kobj); -+ kobject_put(&boot_kobj->kobj); - return NULL; - } - boot_kobj->data = data; -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 530b7df21322..315dd25a0c44 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -7315,6 +7315,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - spin_lock_irq(shost->host_lock); - if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) { - spin_unlock_irq(shost->host_lock); -+ if (newnode) -+ lpfc_nlp_put(ndlp); - goto dropit; - } - spin_unlock_irq(shost->host_lock); -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 7af7a0859478..8d52afd1f71d 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -3136,7 +3136,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) - ioc->scsi_lookup = NULL; - } - kfree(ioc->hpr_lookup); -+ ioc->hpr_lookup = NULL; - kfree(ioc->internal_lookup); -+ ioc->internal_lookup = NULL; - if (ioc->chain_lookup) { - for (i = 0; i < ioc->chain_depth; i++) { - if (ioc->chain_lookup[i].chain_buffer) -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index b1233ce6cb47..1cef25ea0da1 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -827,6 +827,7 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, - - atomic_set(&tpg->lport_tpg_enabled, 0); - qlt_stop_phase1(vha->vha_tgt.qla_tgt); -+ qlt_stop_phase2(vha->vha_tgt.qla_tgt); - } - - return count; -@@ -990,6 +991,7 @@ static ssize_t tcm_qla2xxx_npiv_tpg_enable_store(struct config_item *item, - - atomic_set(&tpg->lport_tpg_enabled, 0); - qlt_stop_phase1(vha->vha_tgt.qla_tgt); -+ qlt_stop_phase2(vha->vha_tgt.qla_tgt); - } - - return count; -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 4055cb7c212b..3a9b6b61607e 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -443,7 +443,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, - /* - * vendor strings must be an exact match - */ -- if (vmax != strlen(devinfo->vendor) || -+ if (vmax != strnlen(devinfo->vendor, -+ sizeof(devinfo->vendor)) || - memcmp(devinfo->vendor, vskip, vmax)) - continue; - -@@ -451,7 +452,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, - * @model specifies the full string, and - * must be larger or equal to devinfo->model - */ -- mlen = strlen(devinfo->model); -+ mlen = strnlen(devinfo->model, sizeof(devinfo->model)); - if (mmax < mlen || memcmp(devinfo->model, mskip, mlen)) - continue; - return devinfo; -diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index 5dc288fecace..7dd4d9ded249 100644 ---- a/drivers/scsi/sr.c -+++ b/drivers/scsi/sr.c -@@ -746,7 +746,7 @@ static int sr_probe(struct device *dev) - cd->cdi.disk = disk; - - if (register_cdrom(&cd->cdi)) -- goto fail_put; -+ goto fail_minor; - - /* - * Initialize block layer runtime PM stuffs before the -@@ -764,6 +764,10 @@ static int sr_probe(struct device *dev) - - return 0; - -+fail_minor: -+ spin_lock(&sr_index_lock); -+ clear_bit(minor, sr_index_bits); -+ spin_unlock(&sr_index_lock); - fail_put: - put_disk(disk); - fail_free: -diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c -index 860e1c288ad5..75b47d61318a 100644 ---- a/drivers/staging/sm750fb/sm750.c -+++ b/drivers/staging/sm750fb/sm750.c -@@ -894,6 +894,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index) - fix->visual = FB_VISUAL_PSEUDOCOLOR; - break; - case 16: -+ case 24: - case 32: - fix->visual = FB_VISUAL_TRUECOLOR; - break; -diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c -index acf6d143c753..81f23af8beca 100644 ---- a/drivers/tty/hvc/hvc_console.c -+++ b/drivers/tty/hvc/hvc_console.c -@@ -89,6 +89,8 @@ static LIST_HEAD(hvc_structs); - */ - static DEFINE_SPINLOCK(hvc_structs_lock); - -+/* Mutex to serialize hvc_open */ -+static DEFINE_MUTEX(hvc_open_mutex); - /* - * This value is used to assign a tty->index value to a hvc_struct based - * upon order of exposure via hvc_probe(), when we can not match it to -@@ -333,16 +335,24 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty) - */ - static int hvc_open(struct tty_struct *tty, struct file * filp) - { -- struct hvc_struct *hp = tty->driver_data; -+ struct hvc_struct *hp; - unsigned long flags; - int rc = 0; - -+ mutex_lock(&hvc_open_mutex); -+ -+ hp = tty->driver_data; -+ if (!hp) { -+ rc = -EIO; -+ goto out; -+ } -+ - spin_lock_irqsave(&hp->port.lock, flags); - /* Check and then increment for fast path open. */ - if (hp->port.count++ > 0) { - spin_unlock_irqrestore(&hp->port.lock, flags); - hvc_kick(); -- return 0; -+ goto out; - } /* else count == 0 */ - spin_unlock_irqrestore(&hp->port.lock, flags); - -@@ -371,6 +381,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) - /* Force wakeup of the polling thread */ - hvc_kick(); - -+out: -+ mutex_unlock(&hvc_open_mutex); - return rc; - } - -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 6060c3e8925e..9b2beada2ff3 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -681,11 +681,10 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len, - * FIXME: lock against link layer control transmissions - */ - --static void gsm_data_kick(struct gsm_mux *gsm) -+static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci) - { - struct gsm_msg *msg, *nmsg; - int len; -- int skip_sof = 0; - - list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { - if (gsm->constipated && msg->addr) -@@ -707,18 +706,23 @@ static void gsm_data_kick(struct gsm_mux *gsm) - print_hex_dump_bytes("gsm_data_kick: ", - DUMP_PREFIX_OFFSET, - gsm->txframe, len); -- -- if (gsm->output(gsm, gsm->txframe + skip_sof, -- len - skip_sof) < 0) -+ if (gsm->output(gsm, gsm->txframe, len) < 0) - break; - /* FIXME: Can eliminate one SOF in many more cases */ - gsm->tx_bytes -= msg->len; -- /* For a burst of frames skip the extra SOF within the -- burst */ -- skip_sof = 1; - - list_del(&msg->list); - kfree(msg); -+ -+ if (dlci) { -+ tty_port_tty_wakeup(&dlci->port); -+ } else { -+ int i = 0; -+ -+ for (i = 0; i < NUM_DLCI; i++) -+ if (gsm->dlci[i]) -+ tty_port_tty_wakeup(&gsm->dlci[i]->port); -+ } - } - } - -@@ -770,7 +774,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) - /* Add to the actual output queue */ - list_add_tail(&msg->list, &gsm->tx_list); - gsm->tx_bytes += msg->len; -- gsm_data_kick(gsm); -+ gsm_data_kick(gsm, dlci); - } - - /** -@@ -1231,7 +1235,7 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command, - gsm_control_reply(gsm, CMD_FCON, NULL, 0); - /* Kick the link in case it is idling */ - spin_lock_irqsave(&gsm->tx_lock, flags); -- gsm_data_kick(gsm); -+ gsm_data_kick(gsm, NULL); - spin_unlock_irqrestore(&gsm->tx_lock, flags); - break; - case CMD_FCOFF: -@@ -2429,7 +2433,7 @@ static void gsmld_write_wakeup(struct tty_struct *tty) - /* Queue poll */ - clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - spin_lock_irqsave(&gsm->tx_lock, flags); -- gsm_data_kick(gsm); -+ gsm_data_kick(gsm, NULL); - if (gsm->tx_bytes < TX_THRESH_LO) { - gsm_dlci_data_sweep(gsm); - } -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index 899a77187bde..c5da46f7b909 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -2323,6 +2323,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, - uap->port.fifosize = uap->fifosize; - uap->port.flags = UPF_BOOT_AUTOCONF; - uap->port.line = index; -+ spin_lock_init(&uap->port.lock); - - amba_ports[index] = uap; - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 04fd6c8e3090..515839034dfb 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1684,6 +1684,8 @@ static int acm_reset_resume(struct usb_interface *intf) - - static const struct usb_device_id acm_ids[] = { - /* quirky and broken devices */ -+ { USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */ -+ .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */ - { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */ - .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */ - { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */ -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index 07c3c3449147..c578d64edc15 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -481,7 +481,8 @@ static int usblp_release(struct inode *inode, struct file *file) - usb_autopm_put_interface(usblp->intf); - - if (!usblp->present) /* finish cleanup from disconnect */ -- usblp_cleanup(usblp); -+ usblp_cleanup(usblp); /* any URBs must be dead */ -+ - mutex_unlock(&usblp_mutex); - return 0; - } -@@ -1397,9 +1398,11 @@ static void usblp_disconnect(struct usb_interface *intf) - - usblp_unlink_urbs(usblp); - mutex_unlock(&usblp->mut); -+ usb_poison_anchored_urbs(&usblp->urbs); - - if (!usblp->used) - usblp_cleanup(usblp); -+ - mutex_unlock(&usblp_mutex); - } - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 27d05f0134de..e6e0f786547b 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -73,11 +73,12 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Logitech HD Webcam C270 */ - { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, - -- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ -+ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT }, -+ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT }, - - /* Logitech ConferenceCam CC3000e */ - { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, -diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c -index ea43cb74a6f2..c9590949e4f0 100644 ---- a/drivers/usb/gadget/udc/lpc32xx_udc.c -+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c -@@ -1662,17 +1662,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep, - const struct usb_endpoint_descriptor *desc) - { - struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); -- struct lpc32xx_udc *udc = ep->udc; -+ struct lpc32xx_udc *udc; - u16 maxpacket; - u32 tmp; - unsigned long flags; - - /* Verify EP data */ - if ((!_ep) || (!ep) || (!desc) || -- (desc->bDescriptorType != USB_DT_ENDPOINT)) { -- dev_dbg(udc->dev, "bad ep or descriptor\n"); -+ (desc->bDescriptorType != USB_DT_ENDPOINT)) - return -EINVAL; -- } -+ -+ udc = ep->udc; - maxpacket = usb_endpoint_maxp(desc); - if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) { - dev_dbg(udc->dev, "bad ep descriptor's packet size\n"); -@@ -1920,7 +1920,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) - static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) - { - struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); -- struct lpc32xx_udc *udc = ep->udc; -+ struct lpc32xx_udc *udc; - unsigned long flags; - - if ((!ep) || (ep->hwep_num <= 1)) -@@ -1930,6 +1930,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) - if (ep->is_in) - return -EAGAIN; - -+ udc = ep->udc; - spin_lock_irqsave(&udc->lock, flags); - - if (value == 1) { -diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c -index b1cfa96cc88f..db95eab8b432 100644 ---- a/drivers/usb/gadget/udc/m66592-udc.c -+++ b/drivers/usb/gadget/udc/m66592-udc.c -@@ -1684,7 +1684,7 @@ static int m66592_probe(struct platform_device *pdev) - - err_add_udc: - m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req); -- -+ m66592->ep0_req = NULL; - clean_up3: - if (m66592->pdata->on_chip) { - clk_disable(m66592->clk); -diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c -index 81b6229c7805..4f480059f851 100644 ---- a/drivers/usb/gadget/udc/mv_udc_core.c -+++ b/drivers/usb/gadget/udc/mv_udc_core.c -@@ -2322,7 +2322,8 @@ static int mv_udc_probe(struct platform_device *pdev) - return 0; - - err_create_workqueue: -- destroy_workqueue(udc->qwork); -+ if (udc->qwork) -+ destroy_workqueue(udc->qwork); - err_destroy_dma: - dma_pool_destroy(udc->dtd_pool); - err_free_dma: -diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c -index eb3571ee59e3..08153a48704b 100644 ---- a/drivers/usb/gadget/udc/s3c2410_udc.c -+++ b/drivers/usb/gadget/udc/s3c2410_udc.c -@@ -269,10 +269,6 @@ static void s3c2410_udc_done(struct s3c2410_ep *ep, - static void s3c2410_udc_nuke(struct s3c2410_udc *udc, - struct s3c2410_ep *ep, int status) - { -- /* Sanity check */ -- if (&ep->queue == NULL) -- return; -- - while (!list_empty(&ep->queue)) { - struct s3c2410_request *req; - req = list_entry(ep->queue.next, struct s3c2410_request, -diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c -index 46f5354c534d..3b5a28f43ef9 100644 ---- a/drivers/usb/host/ehci-exynos.c -+++ b/drivers/usb/host/ehci-exynos.c -@@ -199,9 +199,8 @@ skip_phy: - hcd->rsrc_len = resource_size(res); - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(&pdev->dev, "Failed to get IRQ\n"); -- err = -ENODEV; -+ if (irq < 0) { -+ err = irq; - goto fail_io; - } - -diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c -index c7a9b31eeaef..637079a35003 100644 ---- a/drivers/usb/host/ehci-mxc.c -+++ b/drivers/usb/host/ehci-mxc.c -@@ -63,6 +63,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -+ if (irq < 0) -+ return irq; - - hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev)); - if (!hcd) -diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c -index 2a5d2fd76040..33e9ed7fe026 100644 ---- a/drivers/usb/host/ehci-pci.c -+++ b/drivers/usb/host/ehci-pci.c -@@ -229,6 +229,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd) - ehci_info(ehci, "applying MosChip frame-index workaround\n"); - ehci->frame_index_bug = 1; - break; -+ case PCI_VENDOR_ID_HUAWEI: -+ /* Synopsys HC bug */ -+ if (pdev->device == 0xa239) { -+ ehci_info(ehci, "applying Synopsys HC workaround\n"); -+ ehci->has_synopsys_hc_bug = 1; -+ } -+ break; - } - - /* optional debug port, normally in the first BAR */ -diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c -index bd7082f297bb..56200650b46b 100644 ---- a/drivers/usb/host/ehci-platform.c -+++ b/drivers/usb/host/ehci-platform.c -@@ -375,6 +375,11 @@ static int ehci_platform_resume(struct device *dev) - } - - ehci_resume(hcd, priv->reset_on_resume); -+ -+ pm_runtime_disable(dev); -+ pm_runtime_set_active(dev); -+ pm_runtime_enable(dev); -+ - return 0; - } - #endif /* CONFIG_PM_SLEEP */ -diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c -index c2669f185f65..0e5580e6f35c 100644 ---- a/drivers/usb/host/ohci-platform.c -+++ b/drivers/usb/host/ohci-platform.c -@@ -339,6 +339,11 @@ static int ohci_platform_resume(struct device *dev) - } - - ohci_resume(hcd, false); -+ -+ pm_runtime_disable(dev); -+ pm_runtime_set_active(dev); -+ pm_runtime_enable(dev); -+ - return 0; - } - #endif /* CONFIG_PM_SLEEP */ -diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c -index a8b8d8b8d9f3..a960d2bb8dd1 100644 ---- a/drivers/usb/host/ohci-sm501.c -+++ b/drivers/usb/host/ohci-sm501.c -@@ -196,6 +196,7 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev) - struct resource *mem; - - usb_remove_hcd(hcd); -+ iounmap(hcd->regs); - release_mem_region(hcd->rsrc_start, hcd->rsrc_len); - usb_put_hcd(hcd); - dma_release_declared_memory(&pdev->dev); -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index c4c40e9d4247..510fb7853f92 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -249,8 +249,17 @@ static int xhci_plat_resume(struct device *dev) - { - struct usb_hcd *hcd = dev_get_drvdata(dev); - struct xhci_hcd *xhci = hcd_to_xhci(hcd); -+ int ret; -+ -+ ret = xhci_resume(xhci, 0); -+ if (ret) -+ return ret; - -- return xhci_resume(xhci, 0); -+ pm_runtime_disable(dev); -+ pm_runtime_set_active(dev); -+ pm_runtime_enable(dev); -+ -+ return 0; - } - - static const struct dev_pm_ops xhci_plat_pm_ops = { -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index af4e68152776..51d84332eb78 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -1340,6 +1340,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, - xhci->devs[slot_id]->out_ctx, ep_index); - - ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index); -+ ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */ - ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK); - ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size)); - -@@ -4263,6 +4264,9 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd, - mutex_lock(hcd->bandwidth_mutex); - xhci_change_max_exit_latency(xhci, udev, 0); - mutex_unlock(hcd->bandwidth_mutex); -+ readl_poll_timeout(port_array[port_num], pm_val, -+ (pm_val & PORT_PLS_MASK) == XDEV_U0, -+ 100, 10000); - return 0; - } - } -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 0a3aa38b3c96..a7f346529f91 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -706,7 +706,7 @@ struct xhci_ep_ctx { - * 4 - TRB error - * 5-7 - reserved - */ --#define EP_STATE_MASK (0xf) -+#define EP_STATE_MASK (0x7) - #define EP_STATE_DISABLED 0 - #define EP_STATE_RUNNING 1 - #define EP_STATE_HALTED 2 -diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c -index 98a12be76c9c..666b234acca0 100644 ---- a/drivers/vfio/pci/vfio_pci_config.c -+++ b/drivers/vfio/pci/vfio_pci_config.c -@@ -1405,7 +1405,12 @@ static int vfio_cap_init(struct vfio_pci_device *vdev) - if (ret) - return ret; - -- if (cap <= PCI_CAP_ID_MAX) { -+ /* -+ * ID 0 is a NULL capability, conflicting with our fake -+ * PCI_CAP_ID_BASIC. As it has no content, consider it -+ * hidden for now. -+ */ -+ if (cap && cap <= PCI_CAP_ID_MAX) { - len = pci_cap_length[cap]; - if (len == 0xFF) { /* Variable length */ - len = vfio_cap_len(vdev, cap, pos); -@@ -1644,8 +1649,11 @@ void vfio_config_free(struct vfio_pci_device *vdev) - vdev->vconfig = NULL; - kfree(vdev->pci_config_map); - vdev->pci_config_map = NULL; -- kfree(vdev->msi_perm); -- vdev->msi_perm = NULL; -+ if (vdev->msi_perm) { -+ free_perm_bits(vdev->msi_perm); -+ kfree(vdev->msi_perm); -+ vdev->msi_perm = NULL; -+ } - } - - /* -diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c -index daeb645fcea8..519419136ce8 100644 ---- a/drivers/watchdog/da9062_wdt.c -+++ b/drivers/watchdog/da9062_wdt.c -@@ -94,11 +94,6 @@ static int da9062_wdt_update_timeout_register(struct da9062_watchdog *wdt, - unsigned int regval) - { - struct da9062 *chip = wdt->hw; -- int ret; -- -- ret = da9062_reset_watchdog_timer(wdt); -- if (ret) -- return ret; - - return regmap_update_bits(chip->regmap, - DA9062AA_CONTROL_D, -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 26bbaaefdff4..b2ebfd96785b 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1181,10 +1181,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) - */ - if (!for_part) { - ret = devcgroup_inode_permission(bdev->bd_inode, perm); -- if (ret != 0) { -- bdput(bdev); -+ if (ret != 0) - return ret; -- } - } - - restart: -@@ -1253,8 +1251,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) - goto out_clear; - BUG_ON(for_part); - ret = __blkdev_get(whole, mode, 1); -- if (ret) -+ if (ret) { -+ bdput(whole); - goto out_clear; -+ } - bdev->bd_contains = whole; - bdev->bd_part = disk_get_part(disk, partno); - if (!(disk->flags & GENHD_FL_UP) || -@@ -1311,7 +1311,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) - put_disk(disk); - module_put(owner); - out: -- bdput(bdev); - - return ret; - } -@@ -1397,6 +1396,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) - bdput(whole); - } - -+ if (res) -+ bdput(bdev); -+ - return res; - } - EXPORT_SYMBOL(blkdev_get); -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 0fcf42401a5d..087261ca6d46 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1145,6 +1145,12 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, - inode = d_inode(cfile->dentry); - cifsi = CIFS_I(inode); - -+ /* -+ * We zero the range through ioctl, so we need remove the page caches -+ * first, otherwise the data may be inconsistent with the server. -+ */ -+ truncate_pagecache_range(inode, offset, offset + len - 1); -+ - /* if file not oplocked can't be sure whether asking to extend size */ - if (!CIFS_CACHE_READ(cifsi)) - if (keep_size == false) -@@ -1201,6 +1207,12 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, - if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) - return -EOPNOTSUPP; - -+ /* -+ * We implement the punch hole through ioctl, so we need remove the page -+ * caches first, otherwise the data may be inconsistent with the server. -+ */ -+ truncate_pagecache_range(inode, offset, offset + len - 1); -+ - cifs_dbg(FYI, "offset %lld len %lld", offset, len); - - fsctl_buf.FileOffset = cpu_to_le64(offset); -diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h -index 5eff6ea3e27f..63e856d90ed0 100644 ---- a/fs/dlm/dlm_internal.h -+++ b/fs/dlm/dlm_internal.h -@@ -92,7 +92,6 @@ do { \ - __LINE__, __FILE__, #x, jiffies); \ - {do} \ - printk("\n"); \ -- BUG(); \ - panic("DLM: Record message above and reboot.\n"); \ - } \ - } -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 96336830f035..fc2746e14c42 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -2902,7 +2902,7 @@ again: - * in use to avoid freeing it when removing blocks. - */ - if (sbi->s_cluster_ratio > 1) { -- pblk = ext4_ext_pblock(ex) + end - ee_block + 2; -+ pblk = ext4_ext_pblock(ex) + end - ee_block + 1; - partial_cluster = - -(long long) EXT4_B2C(sbi, pblk); - } -diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c -index de7143e2b361..b7b43d00cc6d 100644 ---- a/fs/gfs2/ops_fstype.c -+++ b/fs/gfs2/ops_fstype.c -@@ -916,7 +916,7 @@ fail: - } - - static const match_table_t nolock_tokens = { -- { Opt_jid, "jid=%d\n", }, -+ { Opt_jid, "jid=%d", }, - { Opt_err, NULL }, - }; - -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 7789f0b9b999..4d76e9a97538 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -385,8 +385,6 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write) - if (write) - nfs_zap_mapping(inode, inode->i_mapping); - -- inode_dio_end(inode); -- - if (dreq->iocb) { - long res = (long) dreq->error; - if (!res) -@@ -396,7 +394,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write) - - complete_all(&dreq->completion); - -+ igrab(inode); - nfs_direct_req_release(dreq); -+ inode_dio_end(inode); -+ iput(inode); - } - - static void nfs_direct_readpage_release(struct nfs_page *req) -@@ -537,8 +538,10 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, - * generic layer handle the completion. - */ - if (requested_bytes == 0) { -- inode_dio_end(inode); -+ igrab(inode); - nfs_direct_req_release(dreq); -+ inode_dio_end(inode); -+ iput(inode); - return result < 0 ? result : -EIO; - } - -@@ -939,8 +942,10 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - * generic layer handle the completion. - */ - if (requested_bytes == 0) { -- inode_dio_end(inode); -+ igrab(inode); - nfs_direct_req_release(dreq); -+ inode_dio_end(inode); -+ iput(inode); - return result < 0 ? result : -EIO; - } - -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index dc875cd0e11d..eaa6697d256e 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, struct file *filp) - dprintk("NFS: release(%pD2)\n", filp); - - nfs_inc_stats(inode, NFSIOS_VFSRELEASE); -+ inode_dio_wait(inode); - nfs_file_clear_open_context(filp); - return 0; - } -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index 6506775575aa..17771e157e92 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -855,9 +855,8 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio, - goto out_mds; - - /* Use a direct mapping of ds_idx to pgio mirror_idx */ -- if (WARN_ON_ONCE(pgio->pg_mirror_count != -- FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))) -- goto out_mds; -+ if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)) -+ goto out_eagain; - - for (i = 0; i < pgio->pg_mirror_count; i++) { - ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true); -@@ -869,11 +868,15 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio, - } - - return; -- -+out_eagain: -+ pnfs_generic_pg_cleanup(pgio); -+ pgio->pg_error = -EAGAIN; -+ return; - out_mds: - pnfs_put_lseg(pgio->pg_lseg); - pgio->pg_lseg = NULL; - nfs_pageio_reset_write_mds(pgio); -+ pgio->pg_error = -EAGAIN; - } - - static unsigned int -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 4fa3f0ba9ab3..0a0b41071ed7 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -1096,6 +1096,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) - err = setup_callback_client(clp, &conn, ses); - if (err) { - nfsd4_mark_cb_down(clp, err); -+ if (c) -+ svc_xprt_put(c->cn_xprt); - return; - } - } -diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h -index 540ab5b75dbb..5617ec167a9d 100644 ---- a/fs/ocfs2/ocfs2_fs.h -+++ b/fs/ocfs2/ocfs2_fs.h -@@ -304,7 +304,7 @@ - #define OCFS2_MAX_SLOTS 255 - - /* Slot map indicator for an empty slot */ --#define OCFS2_INVALID_SLOT -1 -+#define OCFS2_INVALID_SLOT ((u16)-1) - - #define OCFS2_VOL_UUID_LEN 16 - #define OCFS2_MAX_VOL_LABEL_LEN 64 -@@ -340,8 +340,8 @@ struct ocfs2_system_inode_info { - enum { - BAD_BLOCK_SYSTEM_INODE = 0, - GLOBAL_INODE_ALLOC_SYSTEM_INODE, -+#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE - SLOT_MAP_SYSTEM_INODE, --#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE - HEARTBEAT_SYSTEM_INODE, - GLOBAL_BITMAP_SYSTEM_INODE, - USER_QUOTA_SYSTEM_INODE, -diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c -index fc6d25f6d444..28cc343bf6e3 100644 ---- a/fs/ocfs2/suballoc.c -+++ b/fs/ocfs2/suballoc.c -@@ -2863,9 +2863,12 @@ int ocfs2_test_inode_bit(struct ocfs2_super *osb, u64 blkno, int *res) - goto bail; - } - -- inode_alloc_inode = -- ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE, -- suballoc_slot); -+ if (suballoc_slot == (u16)OCFS2_INVALID_SLOT) -+ inode_alloc_inode = ocfs2_get_system_file_inode(osb, -+ GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot); -+ else -+ inode_alloc_inode = ocfs2_get_system_file_inode(osb, -+ INODE_ALLOC_SYSTEM_INODE, suballoc_slot); - if (!inode_alloc_inode) { - /* the error code could be inaccurate, but we are not able to - * get the correct one. */ -diff --git a/include/linux/bitops.h b/include/linux/bitops.h -index ce2bb045b3fd..9b9711ea267a 100644 ---- a/include/linux/bitops.h -+++ b/include/linux/bitops.h -@@ -59,7 +59,7 @@ static inline int get_count_order(unsigned int count) - - static __always_inline unsigned long hweight_long(unsigned long w) - { -- return sizeof(w) == 4 ? hweight32(w) : hweight64(w); -+ return sizeof(w) == 4 ? hweight32(w) : hweight64((__u64)w); - } - - /** -diff --git a/include/linux/elfnote.h b/include/linux/elfnote.h -index 278e3ef05336..56c6d9031663 100644 ---- a/include/linux/elfnote.h -+++ b/include/linux/elfnote.h -@@ -53,7 +53,7 @@ - .popsection ; - - #define ELFNOTE(name, type, desc) \ -- ELFNOTE_START(name, type, "") \ -+ ELFNOTE_START(name, type, "a") \ - desc ; \ - ELFNOTE_END - -diff --git a/include/linux/genhd.h b/include/linux/genhd.h -index 5012fcdb4c9e..a27d0aef07f6 100644 ---- a/include/linux/genhd.h -+++ b/include/linux/genhd.h -@@ -727,9 +727,11 @@ static inline sector_t part_nr_sects_read(struct hd_struct *part) - static inline void part_nr_sects_write(struct hd_struct *part, sector_t size) - { - #if BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_SMP) -+ preempt_disable(); - write_seqcount_begin(&part->nr_sects_seq); - part->nr_sects = size; - write_seqcount_end(&part->nr_sects_seq); -+ preempt_enable(); - #elif BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_PREEMPT) - preempt_disable(); - part->nr_sects = size; -diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h -index cb527c78de9f..4db62045f01a 100644 ---- a/include/linux/kprobes.h -+++ b/include/linux/kprobes.h -@@ -366,6 +366,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void) - return this_cpu_ptr(&kprobe_ctlblk); - } - -+extern struct kprobe kprobe_busy; -+void kprobe_busy_begin(void); -+void kprobe_busy_end(void); -+ - int register_kprobe(struct kprobe *p); - void unregister_kprobe(struct kprobe *p); - int register_kprobes(struct kprobe **kps, int num); -diff --git a/include/linux/libata.h b/include/linux/libata.h -index 6428ac4746de..af561d33221d 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - - /* - * Define if arch has non-standard setup. This is a _PCI_ standard -@@ -872,6 +873,8 @@ struct ata_port { - struct timer_list fastdrain_timer; - unsigned long fastdrain_cnt; - -+ async_cookie_t cookie; -+ - int em_message_type; - void *private_data; - -diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h -index 1af616138d1d..5547f1a0f83b 100644 ---- a/include/linux/pci_ids.h -+++ b/include/linux/pci_ids.h -@@ -2496,6 +2496,8 @@ - #define PCI_DEVICE_ID_KORENIX_JETCARDF2 0x1700 - #define PCI_DEVICE_ID_KORENIX_JETCARDF3 0x17ff - -+#define PCI_VENDOR_ID_HUAWEI 0x19e5 -+ - #define PCI_VENDOR_ID_NETRONOME 0x19ee - #define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200 - #define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240 -diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h -index 8c337cd0e1e4..bf03bab93d9e 100644 ---- a/include/net/sctp/constants.h -+++ b/include/net/sctp/constants.h -@@ -357,11 +357,13 @@ typedef enum { - ipv4_is_anycast_6to4(a)) - - /* Flags used for the bind address copy functions. */ --#define SCTP_ADDR6_ALLOWED 0x00000001 /* IPv6 address is allowed by -+#define SCTP_ADDR4_ALLOWED 0x00000001 /* IPv4 address is allowed by - local sock family */ --#define SCTP_ADDR4_PEERSUPP 0x00000002 /* IPv4 address is supported by -+#define SCTP_ADDR6_ALLOWED 0x00000002 /* IPv6 address is allowed by -+ local sock family */ -+#define SCTP_ADDR4_PEERSUPP 0x00000004 /* IPv4 address is supported by - peer */ --#define SCTP_ADDR6_PEERSUPP 0x00000004 /* IPv6 address is supported by -+#define SCTP_ADDR6_PEERSUPP 0x00000008 /* IPv6 address is supported by - peer */ - - /* Reasons to retransmit. */ -diff --git a/include/net/sock.h b/include/net/sock.h -index be5ec94020f1..426a57874964 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1678,7 +1678,6 @@ static inline int sk_tx_queue_get(const struct sock *sk) - - static inline void sk_set_socket(struct sock *sk, struct socket *sock) - { -- sk_tx_queue_clear(sk); - sk->sk_socket = sock; - } - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index f59f49bc2a5d..5bda113a3116 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -561,11 +561,12 @@ static void kprobe_optimizer(struct work_struct *work) - do_free_cleaned_kprobes(); - - mutex_unlock(&module_mutex); -- mutex_unlock(&kprobe_mutex); - - /* Step 5: Kick optimizer again if needed */ - if (!list_empty(&optimizing_list) || !list_empty(&unoptimizing_list)) - kick_kprobe_optimizer(); -+ -+ mutex_unlock(&kprobe_mutex); - } - - /* Wait for completing optimization and unoptimization */ -@@ -1149,6 +1150,26 @@ __releases(hlist_lock) - } - NOKPROBE_SYMBOL(kretprobe_table_unlock); - -+struct kprobe kprobe_busy = { -+ .addr = (void *) get_kprobe, -+}; -+ -+void kprobe_busy_begin(void) -+{ -+ struct kprobe_ctlblk *kcb; -+ -+ preempt_disable(); -+ __this_cpu_write(current_kprobe, &kprobe_busy); -+ kcb = get_kprobe_ctlblk(); -+ kcb->kprobe_status = KPROBE_HIT_ACTIVE; -+} -+ -+void kprobe_busy_end(void) -+{ -+ __this_cpu_write(current_kprobe, NULL); -+ preempt_enable(); -+} -+ - /* - * This function is called from finish_task_switch when task tk becomes dead, - * so that we can recycle any function-return probe instances associated -@@ -1166,6 +1187,8 @@ void kprobe_flush_task(struct task_struct *tk) - /* Early boot. kretprobe_table_locks not yet initialized. */ - return; - -+ kprobe_busy_begin(); -+ - INIT_HLIST_HEAD(&empty_rp); - hash = hash_ptr(tk, KPROBE_HASH_BITS); - head = &kretprobe_inst_table[hash]; -@@ -1179,6 +1202,8 @@ void kprobe_flush_task(struct task_struct *tk) - hlist_del(&ri->hlist); - kfree(ri); - } -+ -+ kprobe_busy_end(); - } - NOKPROBE_SYMBOL(kprobe_flush_task); - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index d81bcc6362ff..14a87c1f3a3a 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -3439,7 +3439,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio) - if (dl_prio(prio)) { - struct task_struct *pi_task = rt_mutex_get_top_task(p); - if (!dl_prio(p->normal_prio) || -- (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) { -+ (pi_task && dl_prio(pi_task->prio) && -+ dl_entity_preempt(&pi_task->dl, &p->dl))) { - p->dl.dl_boosted = 1; - enqueue_flag |= ENQUEUE_REPLENISH; - } else -diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c -index 673756468019..8ac3663e0012 100644 ---- a/kernel/trace/blktrace.c -+++ b/kernel/trace/blktrace.c -@@ -15,6 +15,9 @@ - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - */ -+ -+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -+ - #include - #include - #include -@@ -481,6 +484,16 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, - */ - strreplace(buts->name, '/', '_'); - -+ /* -+ * bdev can be NULL, as with scsi-generic, this is a helpful as -+ * we can be. -+ */ -+ if (q->blk_trace) { -+ pr_warn("Concurrent blktraces are not allowed on %s\n", -+ buts->name); -+ return -EBUSY; -+ } -+ - bt = kzalloc(sizeof(*bt), GFP_KERNEL); - if (!bt) - return -ENOMEM; -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index 78346aba6980..94fca4d687ad 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -204,11 +204,17 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) - - static int trigger_process_regex(struct trace_event_file *file, char *buff) - { -- char *command, *next = buff; -+ char *command, *next; - struct event_command *p; - int ret = -EINVAL; - -+ next = buff = skip_spaces(buff); - command = strsep(&next, ": \t"); -+ if (next) { -+ next = skip_spaces(next); -+ if (!*next) -+ next = NULL; -+ } - command = (command[0] != '!') ? command : command + 1; - - mutex_lock(&trigger_cmd_mutex); -@@ -615,8 +621,14 @@ event_trigger_callback(struct event_command *cmd_ops, - int ret; - - /* separate the trigger from the filter (t:n [if filter]) */ -- if (param && isdigit(param[0])) -+ if (param && isdigit(param[0])) { - trigger = strsep(¶m, " \t"); -+ if (param) { -+ param = skip_spaces(param); -+ if (!*param) -+ param = NULL; -+ } -+ } - - trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger); - -@@ -1185,6 +1197,11 @@ event_enable_trigger_func(struct event_command *cmd_ops, - trigger = strsep(¶m, " \t"); - if (!trigger) - return -EINVAL; -+ if (param) { -+ param = skip_spaces(param); -+ if (!*param) -+ param = NULL; -+ } - - system = strsep(&trigger, ":"); - if (!trigger) -diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c -index 2c13ecc5bb2c..ed1f3df27260 100644 ---- a/lib/zlib_inflate/inffast.c -+++ b/lib/zlib_inflate/inffast.c -@@ -10,17 +10,6 @@ - - #ifndef ASMINF - --/* Allow machine dependent optimization for post-increment or pre-increment. -- Based on testing to date, -- Pre-increment preferred for: -- - PowerPC G3 (Adler) -- - MIPS R5000 (Randers-Pehrson) -- Post-increment preferred for: -- - none -- No measurable difference: -- - Pentium III (Anderson) -- - M68060 (Nikl) -- */ - union uu { - unsigned short us; - unsigned char b[2]; -@@ -38,16 +27,6 @@ get_unaligned16(const unsigned short *p) - return mm.us; - } - --#ifdef POSTINC --# define OFF 0 --# define PUP(a) *(a)++ --# define UP_UNALIGNED(a) get_unaligned16((a)++) --#else --# define OFF 1 --# define PUP(a) *++(a) --# define UP_UNALIGNED(a) get_unaligned16(++(a)) --#endif -- - /* - Decode literal, length, and distance codes and write out the resulting - literal and match bytes until either not enough input or output is -@@ -115,9 +94,9 @@ void inflate_fast(z_streamp strm, unsigned start) - - /* copy state to local variables */ - state = (struct inflate_state *)strm->state; -- in = strm->next_in - OFF; -+ in = strm->next_in; - last = in + (strm->avail_in - 5); -- out = strm->next_out - OFF; -+ out = strm->next_out; - beg = out - (start - strm->avail_out); - end = out + (strm->avail_out - 257); - #ifdef INFLATE_STRICT -@@ -138,9 +117,9 @@ void inflate_fast(z_streamp strm, unsigned start) - input data or output space */ - do { - if (bits < 15) { -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; - } - this = lcode[hold & lmask]; -@@ -150,14 +129,14 @@ void inflate_fast(z_streamp strm, unsigned start) - bits -= op; - op = (unsigned)(this.op); - if (op == 0) { /* literal */ -- PUP(out) = (unsigned char)(this.val); -+ *out++ = (unsigned char)(this.val); - } - else if (op & 16) { /* length base */ - len = (unsigned)(this.val); - op &= 15; /* number of extra bits */ - if (op) { - if (bits < op) { -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; - } - len += (unsigned)hold & ((1U << op) - 1); -@@ -165,9 +144,9 @@ void inflate_fast(z_streamp strm, unsigned start) - bits -= op; - } - if (bits < 15) { -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; - } - this = dcode[hold & dmask]; -@@ -180,10 +159,10 @@ void inflate_fast(z_streamp strm, unsigned start) - dist = (unsigned)(this.val); - op &= 15; /* number of extra bits */ - if (bits < op) { -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; - if (bits < op) { -- hold += (unsigned long)(PUP(in)) << bits; -+ hold += (unsigned long)(*in++) << bits; - bits += 8; - } - } -@@ -205,13 +184,13 @@ void inflate_fast(z_streamp strm, unsigned start) - state->mode = BAD; - break; - } -- from = window - OFF; -+ from = window; - if (write == 0) { /* very common case */ - from += wsize - op; - if (op < len) { /* some from window */ - len -= op; - do { -- PUP(out) = PUP(from); -+ *out++ = *from++; - } while (--op); - from = out - dist; /* rest from output */ - } -@@ -222,14 +201,14 @@ void inflate_fast(z_streamp strm, unsigned start) - if (op < len) { /* some from end of window */ - len -= op; - do { -- PUP(out) = PUP(from); -+ *out++ = *from++; - } while (--op); -- from = window - OFF; -+ from = window; - if (write < len) { /* some from start of window */ - op = write; - len -= op; - do { -- PUP(out) = PUP(from); -+ *out++ = *from++; - } while (--op); - from = out - dist; /* rest from output */ - } -@@ -240,21 +219,21 @@ void inflate_fast(z_streamp strm, unsigned start) - if (op < len) { /* some from window */ - len -= op; - do { -- PUP(out) = PUP(from); -+ *out++ = *from++; - } while (--op); - from = out - dist; /* rest from output */ - } - } - while (len > 2) { -- PUP(out) = PUP(from); -- PUP(out) = PUP(from); -- PUP(out) = PUP(from); -+ *out++ = *from++; -+ *out++ = *from++; -+ *out++ = *from++; - len -= 3; - } - if (len) { -- PUP(out) = PUP(from); -+ *out++ = *from++; - if (len > 1) -- PUP(out) = PUP(from); -+ *out++ = *from++; - } - } - else { -@@ -264,29 +243,29 @@ void inflate_fast(z_streamp strm, unsigned start) - from = out - dist; /* copy direct from output */ - /* minimum length is three */ - /* Align out addr */ -- if (!((long)(out - 1 + OFF) & 1)) { -- PUP(out) = PUP(from); -+ if (!((long)(out - 1) & 1)) { -+ *out++ = *from++; - len--; - } -- sout = (unsigned short *)(out - OFF); -+ sout = (unsigned short *)(out); - if (dist > 2) { - unsigned short *sfrom; - -- sfrom = (unsigned short *)(from - OFF); -+ sfrom = (unsigned short *)(from); - loops = len >> 1; - do - #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -- PUP(sout) = PUP(sfrom); -+ *sout++ = *sfrom++; - #else -- PUP(sout) = UP_UNALIGNED(sfrom); -+ *sout++ = get_unaligned16(sfrom++); - #endif - while (--loops); -- out = (unsigned char *)sout + OFF; -- from = (unsigned char *)sfrom + OFF; -+ out = (unsigned char *)sout; -+ from = (unsigned char *)sfrom; - } else { /* dist == 1 or dist == 2 */ - unsigned short pat16; - -- pat16 = *(sout-1+OFF); -+ pat16 = *(sout-1); - if (dist == 1) { - union uu mm; - /* copy one char pattern to both bytes */ -@@ -296,12 +275,12 @@ void inflate_fast(z_streamp strm, unsigned start) - } - loops = len >> 1; - do -- PUP(sout) = pat16; -+ *sout++ = pat16; - while (--loops); -- out = (unsigned char *)sout + OFF; -+ out = (unsigned char *)sout; - } - if (len & 1) -- PUP(out) = PUP(from); -+ *out++ = *from++; - } - } - else if ((op & 64) == 0) { /* 2nd level distance code */ -@@ -336,8 +315,8 @@ void inflate_fast(z_streamp strm, unsigned start) - hold &= (1U << bits) - 1; - - /* update state and return */ -- strm->next_in = in + OFF; -- strm->next_out = out + OFF; -+ strm->next_in = in; -+ strm->next_out = out; - strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last)); - strm->avail_out = (unsigned)(out < end ? - 257 + (end - out) : 257 - (out - end)); -diff --git a/mm/slab_common.c b/mm/slab_common.c -index 01e7246de8df..5d8c809a3ff7 100644 ---- a/mm/slab_common.c -+++ b/mm/slab_common.c -@@ -1269,7 +1269,7 @@ void kzfree(const void *p) - if (unlikely(ZERO_OR_NULL_PTR(mem))) - return; - ks = ksize(mem); -- memset(mem, 0, ks); -+ memzero_explicit(mem, ks); - kfree(mem); - } - EXPORT_SYMBOL(kzfree); -diff --git a/net/core/dev.c b/net/core/dev.c -index 38e4977eb09d..09115c68f29d 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -82,6 +82,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -185,7 +186,7 @@ static DEFINE_SPINLOCK(napi_hash_lock); - static unsigned int napi_gen_id = NR_CPUS; - static DEFINE_HASHTABLE(napi_hash, 8); - --static seqcount_t devnet_rename_seq; -+static DECLARE_RWSEM(devnet_rename_sem); - - static inline void dev_base_seq_inc(struct net *net) - { -@@ -862,33 +863,28 @@ EXPORT_SYMBOL(dev_get_by_index); - * @net: network namespace - * @name: a pointer to the buffer where the name will be stored. - * @ifindex: the ifindex of the interface to get the name from. -- * -- * The use of raw_seqcount_begin() and cond_resched() before -- * retrying is required as we want to give the writers a chance -- * to complete when CONFIG_PREEMPT is not set. - */ - int netdev_get_name(struct net *net, char *name, int ifindex) - { - struct net_device *dev; -- unsigned int seq; -+ int ret; - --retry: -- seq = raw_seqcount_begin(&devnet_rename_seq); -+ down_read(&devnet_rename_sem); - rcu_read_lock(); -+ - dev = dev_get_by_index_rcu(net, ifindex); - if (!dev) { -- rcu_read_unlock(); -- return -ENODEV; -+ ret = -ENODEV; -+ goto out; - } - - strcpy(name, dev->name); -- rcu_read_unlock(); -- if (read_seqcount_retry(&devnet_rename_seq, seq)) { -- cond_resched(); -- goto retry; -- } - -- return 0; -+ ret = 0; -+out: -+ rcu_read_unlock(); -+ up_read(&devnet_rename_sem); -+ return ret; - } - - /** -@@ -1153,10 +1149,10 @@ int dev_change_name(struct net_device *dev, const char *newname) - if (dev->flags & IFF_UP) - return -EBUSY; - -- write_seqcount_begin(&devnet_rename_seq); -+ down_write(&devnet_rename_sem); - - if (strncmp(newname, dev->name, IFNAMSIZ) == 0) { -- write_seqcount_end(&devnet_rename_seq); -+ up_write(&devnet_rename_sem); - return 0; - } - -@@ -1164,7 +1160,7 @@ int dev_change_name(struct net_device *dev, const char *newname) - - err = dev_get_valid_name(net, dev, newname); - if (err < 0) { -- write_seqcount_end(&devnet_rename_seq); -+ up_write(&devnet_rename_sem); - return err; - } - -@@ -1179,11 +1175,11 @@ rollback: - if (ret) { - memcpy(dev->name, oldname, IFNAMSIZ); - dev->name_assign_type = old_assign_type; -- write_seqcount_end(&devnet_rename_seq); -+ up_write(&devnet_rename_sem); - return ret; - } - -- write_seqcount_end(&devnet_rename_seq); -+ up_write(&devnet_rename_sem); - - netdev_adjacent_rename_links(dev, oldname); - -@@ -1204,7 +1200,7 @@ rollback: - /* err >= 0 after dev_alloc_name() or stores the first errno */ - if (err >= 0) { - err = ret; -- write_seqcount_begin(&devnet_rename_seq); -+ down_write(&devnet_rename_sem); - memcpy(dev->name, oldname, IFNAMSIZ); - memcpy(oldname, newname, IFNAMSIZ); - dev->name_assign_type = old_assign_type; -@@ -3021,7 +3017,7 @@ static void skb_update_prio(struct sk_buff *skb) - DEFINE_PER_CPU(int, xmit_recursion); - EXPORT_SYMBOL(xmit_recursion); - --#define RECURSION_LIMIT 10 -+#define RECURSION_LIMIT 8 - - /** - * dev_loopback_xmit - loop back @skb -@@ -6844,6 +6840,13 @@ int register_netdevice(struct net_device *dev) - rcu_barrier(); - - dev->reg_state = NETREG_UNREGISTERED; -+ /* We should put the kobject that hold in -+ * netdev_unregister_kobject(), otherwise -+ * the net device cannot be freed when -+ * driver calls free_netdev(), because the -+ * kobject is being hold. -+ */ -+ kobject_put(&dev->dev.kobj); - } - /* - * Prevent userspace races by waiting until the network -diff --git a/net/core/sock.c b/net/core/sock.c -index 60b19c3bb0f7..120d5058d81a 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1435,6 +1435,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority, - - sock_update_classid(sk); - sock_update_netprioidx(sk); -+ sk_tx_queue_clear(sk); - } - - return sk; -@@ -1601,6 +1602,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - */ - sk_refcnt_debug_inc(newsk); - sk_set_socket(newsk, NULL); -+ sk_tx_queue_clear(newsk); - newsk->sk_wq = NULL; - - sk_update_clone(sk, newsk); -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 498d5a929d6f..3c1e42d49520 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -776,7 +776,7 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi, - if (fl4.flowi4_scope < RT_SCOPE_LINK) - fl4.flowi4_scope = RT_SCOPE_LINK; - -- if (cfg->fc_table) -+ if (cfg->fc_table && cfg->fc_table != RT_TABLE_MAIN) - tbl = fib_get_table(net, cfg->fc_table); - - if (tbl) -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 20b21f8578e1..3d9761516683 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -98,9 +98,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - __be32 remote, __be32 local, - __be32 key) - { -- unsigned int hash; - struct ip_tunnel *t, *cand = NULL; - struct hlist_head *head; -+ struct net_device *ndev; -+ unsigned int hash; - - hash = ip_tunnel_hash(key, remote); - head = &itn->tunnels[hash]; -@@ -175,8 +176,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, - if (t) - return t; - -- if (itn->fb_tunnel_dev && itn->fb_tunnel_dev->flags & IFF_UP) -- return netdev_priv(itn->fb_tunnel_dev); -+ ndev = READ_ONCE(itn->fb_tunnel_dev); -+ if (ndev && ndev->flags & IFF_UP) -+ return netdev_priv(ndev); - - return NULL; - } -@@ -1160,9 +1162,9 @@ void ip_tunnel_uninit(struct net_device *dev) - struct ip_tunnel_net *itn; - - itn = net_generic(net, tunnel->ip_tnl_net_id); -- /* fb_tunnel_dev will be unregisted in net-exit call. */ -- if (itn->fb_tunnel_dev != dev) -- ip_tunnel_del(itn, netdev_priv(dev)); -+ ip_tunnel_del(itn, netdev_priv(dev)); -+ if (itn->fb_tunnel_dev == dev) -+ WRITE_ONCE(itn->fb_tunnel_dev, NULL); - - dst_cache_reset(&tunnel->dst_cache); - } -diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c -index 448c2615fece..9fb3a5e83a7c 100644 ---- a/net/ipv4/tcp_cubic.c -+++ b/net/ipv4/tcp_cubic.c -@@ -414,6 +414,8 @@ static void hystart_update(struct sock *sk, u32 delay) - - if (hystart_detect & HYSTART_DELAY) { - /* obtain the minimum delay of more than sampling packets */ -+ if (ca->curr_rtt > delay) -+ ca->curr_rtt = delay; - if (ca->sample_cnt < HYSTART_MIN_SAMPLES) { - if (ca->curr_rtt == 0 || ca->curr_rtt > delay) - ca->curr_rtt = delay; -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 64c7265793a5..e2066f2f19b4 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4465,7 +4465,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) - if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, - skb, &fragstolen)) { - coalesce_done: -- tcp_grow_window(sk, skb); -+ /* For non sack flows, do not grow window to force DUPACK -+ * and trigger fast retransmit. -+ */ -+ if (tcp_is_sack(tp)) -+ tcp_grow_window(sk, skb); - kfree_skb_partial(skb, fragstolen); - skb = NULL; - goto add_sack; -@@ -4545,7 +4549,11 @@ add_sack: - tcp_sack_new_ofo_skb(sk, seq, end_seq); - end: - if (skb) { -- tcp_grow_window(sk, skb); -+ /* For non sack flows, do not grow window to force DUPACK -+ * and trigger fast retransmit. -+ */ -+ if (tcp_is_sack(tp)) -+ tcp_grow_window(sk, skb); - skb_set_owner_r(skb, sk); - } - } -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index b25f4ad28b03..546172bfaba1 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -125,6 +125,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev, - int dev_type = (gre_proto == htons(ETH_P_TEB)) ? - ARPHRD_ETHER : ARPHRD_IP6GRE; - int score, cand_score = 4; -+ struct net_device *ndev; - - for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) { - if (!ipv6_addr_equal(local, &t->parms.laddr) || -@@ -227,9 +228,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev, - if (cand) - return cand; - -- dev = ign->fb_tunnel_dev; -- if (dev->flags & IFF_UP) -- return netdev_priv(dev); -+ ndev = READ_ONCE(ign->fb_tunnel_dev); -+ if (ndev && ndev->flags & IFF_UP) -+ return netdev_priv(ndev); - - return NULL; - } -@@ -364,6 +365,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) - struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id); - - ip6gre_tunnel_unlink(ign, t); -+ if (ign->fb_tunnel_dev == dev) -+ WRITE_ONCE(ign->fb_tunnel_dev, NULL); - dst_cache_reset(&t->dst_cache); - dev_put(dev); - } -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 976c8133a281..2d28f0b54494 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -2580,6 +2580,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev) - write_unlock_bh(&idev->lock); - - igmp6_group_dropped(i); -+ ip6_mc_clear_src(i); - ma_put(i); - - write_lock_bh(&idev->lock); -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 239464045697..53c53b1c881c 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -351,8 +351,13 @@ int l2tp_session_register(struct l2tp_session *session, - - spin_lock_bh(&pn->l2tp_session_hlist_lock); - -+ /* IP encap expects session IDs to be globally unique, while -+ * UDP encap doesn't. -+ */ - hlist_for_each_entry(session_walk, g_head, global_hlist) -- if (session_walk->session_id == session->session_id) { -+ if (session_walk->session_id == session->session_id && -+ (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP || -+ tunnel->encap == L2TP_ENCAPTYPE_IP)) { - err = -EEXIST; - goto err_tlock_pnlock; - } -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index 0583e2491770..3231030a73ed 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -379,6 +379,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len, - for (id = 0; id < IPSET_EXT_ID_MAX; id++) { - if (!add_extension(id, cadt_flags, tb)) - continue; -+ if (align < ip_set_extensions[id].align) -+ align = ip_set_extensions[id].align; - len = ALIGN(len, ip_set_extensions[id].align); - set->offset[id] = len; - set->extensions |= ip_set_extensions[id].type; -diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c -index f4aa2ab4713a..eb814ffc0902 100644 ---- a/net/sched/sch_fq.c -+++ b/net/sched/sch_fq.c -@@ -830,24 +830,20 @@ nla_put_failure: - static int fq_dump_stats(struct Qdisc *sch, struct gnet_dump *d) - { - struct fq_sched_data *q = qdisc_priv(sch); -- struct tc_fq_qd_stats st; -- -- sch_tree_lock(sch); -- -- st.gc_flows = q->stat_gc_flows; -- st.highprio_packets = q->stat_internal_packets; -- st.tcp_retrans = q->stat_tcp_retrans; -- st.throttled = q->stat_throttled; -- st.flows_plimit = q->stat_flows_plimit; -- st.pkts_too_long = q->stat_pkts_too_long; -- st.allocation_errors = q->stat_allocation_errors; -- st.time_next_delayed_flow = q->time_next_delayed_flow - ktime_get_ns(); -- st.flows = q->flows; -- st.inactive_flows = q->inactive_flows; -- st.throttled_flows = q->throttled_flows; -- st.pad = 0; -- -- sch_tree_unlock(sch); -+ u64 now = ktime_get_ns(); -+ struct tc_fq_qd_stats st = { -+ .gc_flows = q->stat_gc_flows, -+ .highprio_packets = q->stat_internal_packets, -+ .tcp_retrans = q->stat_tcp_retrans, -+ .throttled = q->stat_throttled, -+ .flows_plimit = q->stat_flows_plimit, -+ .pkts_too_long = q->stat_pkts_too_long, -+ .allocation_errors = q->stat_allocation_errors, -+ .flows = q->flows, -+ .inactive_flows = q->inactive_flows, -+ .throttled_flows = q->throttled_flows, -+ .time_next_delayed_flow = q->time_next_delayed_flow - now, -+ }; - - return gnet_stats_copy_app(d, &st, sizeof(st)); - } -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index 09cd65434748..10c05fa0e6b3 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -329,6 +329,7 @@ void __netdev_watchdog_up(struct net_device *dev) - dev_hold(dev); - } - } -+EXPORT_SYMBOL_GPL(__netdev_watchdog_up); - - static void dev_watchdog_up(struct net_device *dev) - { -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index f24d31f12cb4..aa38578fdfcd 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1575,12 +1575,15 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len) - int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, - sctp_scope_t scope, gfp_t gfp) - { -+ struct sock *sk = asoc->base.sk; - int flags; - - /* Use scoping rules to determine the subset of addresses from - * the endpoint. - */ -- flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0; -+ flags = (PF_INET6 == sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0; -+ if (!inet_v6_ipv6only(sk)) -+ flags |= SCTP_ADDR4_ALLOWED; - if (asoc->peer.ipv4_address) - flags |= SCTP_ADDR4_PEERSUPP; - if (asoc->peer.ipv6_address) -diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c -index 871cdf9567e6..664215448d09 100644 ---- a/net/sctp/bind_addr.c -+++ b/net/sctp/bind_addr.c -@@ -449,6 +449,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest, - * well as the remote peer. - */ - if ((((AF_INET == addr->sa.sa_family) && -+ (flags & SCTP_ADDR4_ALLOWED) && - (flags & SCTP_ADDR4_PEERSUPP))) || - (((AF_INET6 == addr->sa.sa_family) && - (flags & SCTP_ADDR6_ALLOWED) && -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index 9c6c42fd9f8a..b0e401dfe160 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -210,6 +210,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp, - * sock as well as the remote peer. - */ - if ((((AF_INET == addr->a.sa.sa_family) && -+ (copy_flags & SCTP_ADDR4_ALLOWED) && - (copy_flags & SCTP_ADDR4_PEERSUPP))) || - (((AF_INET6 == addr->a.sa.sa_family) && - (copy_flags & SCTP_ADDR6_ALLOWED) && -diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c -index 2e0a6f92e563..8391c2785550 100644 ---- a/net/sunrpc/addr.c -+++ b/net/sunrpc/addr.c -@@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap, - - rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u", - IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id); -- if (unlikely((size_t)rc > sizeof(scopebuf))) -+ if (unlikely((size_t)rc >= sizeof(scopebuf))) - return 0; - - len += rc; -- if (unlikely(len > buflen)) -+ if (unlikely(len >= buflen)) - return 0; - - strcat(buf, scopebuf); -diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c -index 9103dd15511c..12dd5cc499c1 100644 ---- a/net/sunrpc/rpc_pipe.c -+++ b/net/sunrpc/rpc_pipe.c -@@ -1347,6 +1347,7 @@ rpc_gssd_dummy_populate(struct dentry *root, struct rpc_pipe *pipe_data) - q.len = strlen(gssd_dummy_clnt_dir[0].name); - clnt_dentry = d_hash_and_lookup(gssd_dentry, &q); - if (!clnt_dentry) { -+ __rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1); - pipe_dentry = ERR_PTR(-ENOENT); - goto out; - } -diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c -index ed9bbd383f7d..df7ecf9584f6 100644 ---- a/net/sunrpc/xdr.c -+++ b/net/sunrpc/xdr.c -@@ -1031,6 +1031,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, - base = 0; - } else { - base -= buf->head[0].iov_len; -+ subbuf->head[0].iov_base = buf->head[0].iov_base; - subbuf->head[0].iov_len = 0; - } - -@@ -1043,6 +1044,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, - base = 0; - } else { - base -= buf->page_len; -+ subbuf->pages = buf->pages; -+ subbuf->page_base = 0; - subbuf->page_len = 0; - } - -@@ -1054,6 +1057,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, - base = 0; - } else { - base -= buf->tail[0].iov_len; -+ subbuf->tail[0].iov_base = buf->tail[0].iov_base; - subbuf->tail[0].iov_len = 0; - } - -diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include -index e61a5c29b08c..b6f055157b89 100644 ---- a/scripts/Kbuild.include -+++ b/scripts/Kbuild.include -@@ -81,20 +81,21 @@ cc-cross-prefix = \ - fi))) - - # output directory for tests below --TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/) -+TMPOUT = $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/).tmp_$$$$ - - # try-run - # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise) - # Exit code chooses option. "$$TMP" is can be used as temporary file and - # is automatically cleaned up. - try-run = $(shell set -e; \ -- TMP="$(TMPOUT).$$$$.tmp"; \ -- TMPO="$(TMPOUT).$$$$.o"; \ -+ TMP=$(TMPOUT)/tmp; \ -+ TMPO=$(TMPOUT)/tmp.o; \ -+ mkdir -p $(TMPOUT); \ -+ trap "rm -rf $(TMPOUT)" EXIT; \ - if ($(1)) >/dev/null 2>&1; \ - then echo "$(2)"; \ - else echo "$(3)"; \ -- fi; \ -- rm -f "$$TMP" "$$TMPO") -+ fi) - - # as-option - # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,) -diff --git a/scripts/mksysmap b/scripts/mksysmap -index a35acc0d0b82..9aa23d15862a 100755 ---- a/scripts/mksysmap -+++ b/scripts/mksysmap -@@ -41,4 +41,4 @@ - # so we just ignore them to let readprofile continue to work. - # (At least sparc64 has __crc_ in the middle). - --$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( .L\)' > $2 -+$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2 -diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c -index 0a258c0602d1..55c869e0a3a0 100644 ---- a/security/selinux/ss/services.c -+++ b/security/selinux/ss/services.c -@@ -2622,8 +2622,12 @@ err: - if (*names) { - for (i = 0; i < *len; i++) - kfree((*names)[i]); -+ kfree(*names); - } - kfree(*values); -+ *len = 0; -+ *names = NULL; -+ *values = NULL; - goto out; - } - -diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c -index 718d5e3b7806..6c06d0645779 100644 ---- a/sound/isa/wavefront/wavefront_synth.c -+++ b/sound/isa/wavefront/wavefront_synth.c -@@ -1174,7 +1174,10 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header) - "alias for %d\n", - header->number, - header->hdr.a.OriginalSample); -- -+ -+ if (header->number >= WF_MAX_SAMPLE) -+ return -EINVAL; -+ - munge_int32 (header->number, &alias_hdr[0], 2); - munge_int32 (header->hdr.a.OriginalSample, &alias_hdr[2], 2); - munge_int32 (*((unsigned int *)&header->hdr.a.sampleStartOffset), -@@ -1205,6 +1208,9 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header) - int num_samples; - unsigned char *msample_hdr; - -+ if (header->number >= WF_MAX_SAMPLE) -+ return -EINVAL; -+ - msample_hdr = kmalloc(WF_MSAMPLE_BYTES, GFP_KERNEL); - if (! msample_hdr) - return -ENOMEM; -diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c -index ffc000bc1f15..56a873ba08e4 100644 ---- a/sound/soc/fsl/fsl_asrc_dma.c -+++ b/sound/soc/fsl/fsl_asrc_dma.c -@@ -243,6 +243,7 @@ static int fsl_asrc_dma_hw_params(struct snd_pcm_substream *substream, - ret = dmaengine_slave_config(pair->dma_chan[dir], &config_be); - if (ret) { - dev_err(dev, "failed to config DMA channel for Back-End\n"); -+ dma_release_channel(pair->dma_chan[dir]); - return ret; - } - -diff --git a/sound/usb/card.h b/sound/usb/card.h -index 71778ca4b26a..844c68863810 100644 ---- a/sound/usb/card.h -+++ b/sound/usb/card.h -@@ -80,6 +80,10 @@ struct snd_usb_endpoint { - dma_addr_t sync_dma; /* DMA address of syncbuf */ - - unsigned int pipe; /* the data i/o pipe */ -+ unsigned int framesize[2]; /* small/large frame sizes in samples */ -+ unsigned int sample_rem; /* remainder from division fs/fps */ -+ unsigned int sample_accum; /* sample accumulator */ -+ unsigned int fps; /* frames per second */ - unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */ - unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */ - int freqshift; /* how much to shift the feedback value to get Q16.16 */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index 66648b4bdd28..666731317b33 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep) - - /* - * For streaming based on information derived from sync endpoints, -- * prepare_outbound_urb_sizes() will call next_packet_size() to -+ * prepare_outbound_urb_sizes() will call slave_next_packet_size() to - * determine the number of samples to be sent in the next packet. - * -- * For implicit feedback, next_packet_size() is unused. -+ * For implicit feedback, slave_next_packet_size() is unused. - */ --int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) -+int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep) - { - unsigned long flags; - int ret; -@@ -159,6 +159,29 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) - return ret; - } - -+/* -+ * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes() -+ * will call next_packet_size() to determine the number of samples to be -+ * sent in the next packet. -+ */ -+int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) -+{ -+ int ret; -+ -+ if (ep->fill_max) -+ return ep->maxframesize; -+ -+ ep->sample_accum += ep->sample_rem; -+ if (ep->sample_accum >= ep->fps) { -+ ep->sample_accum -= ep->fps; -+ ret = ep->framesize[1]; -+ } else { -+ ret = ep->framesize[0]; -+ } -+ -+ return ret; -+} -+ - static void retire_outbound_urb(struct snd_usb_endpoint *ep, - struct snd_urb_ctx *urb_ctx) - { -@@ -203,6 +226,8 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, - - if (ctx->packet_size[i]) - counts = ctx->packet_size[i]; -+ else if (ep->sync_master) -+ counts = snd_usb_endpoint_slave_next_packet_size(ep); - else - counts = snd_usb_endpoint_next_packet_size(ep); - -@@ -879,10 +904,17 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep, - ep->maxpacksize = fmt->maxpacksize; - ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX); - -- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) -+ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) { - ep->freqn = get_usb_full_speed_rate(rate); -- else -+ ep->fps = 1000; -+ } else { - ep->freqn = get_usb_high_speed_rate(rate); -+ ep->fps = 8000; -+ } -+ -+ ep->sample_rem = rate % ep->fps; -+ ep->framesize[0] = rate / ep->fps; -+ ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps; - - /* calculate the frequency in 16.16 format */ - ep->freqm = ep->freqn; -@@ -941,6 +973,7 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep) - ep->active_mask = 0; - ep->unlink_mask = 0; - ep->phase = 0; -+ ep->sample_accum = 0; - - snd_usb_endpoint_start_quirk(ep); - -diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h -index 584f295d7c77..4aad49cbeb5f 100644 ---- a/sound/usb/endpoint.h -+++ b/sound/usb/endpoint.h -@@ -27,6 +27,7 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep); - void snd_usb_endpoint_free(struct snd_usb_endpoint *ep); - - int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); -+int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep); - int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep); - - void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 9bbe84ce7d07..9b9d653d5e90 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -584,8 +584,9 @@ static int check_matrix_bitmap(unsigned char *bmap, - * if failed, give up and free the control instance. - */ - --int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, -- struct snd_kcontrol *kctl) -+int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, -+ struct snd_kcontrol *kctl, -+ bool is_std_info) - { - struct usb_mixer_interface *mixer = list->mixer; - int err; -@@ -598,6 +599,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, - return err; - } - list->kctl = kctl; -+ list->is_std_info = is_std_info; - list->next_id_elem = mixer->id_elems[list->id]; - mixer->id_elems[list->id] = list; - return 0; -@@ -2330,15 +2332,23 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid) - { - struct usb_mixer_elem_list *list; - -- for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) -+ for_each_mixer_elem(list, mixer, unitid) { -+ struct usb_mixer_elem_info *info; -+ -+ if (!list->is_std_info) -+ continue; -+ info = mixer_elem_list_to_info(list); -+ /* invalidate cache, so the value is read from the device */ -+ info->cached = 0; - snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, - &list->kctl->id); -+ } - } - - static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer, - struct usb_mixer_elem_list *list) - { -- struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list; -+ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); - static char *val_types[] = {"BOOLEAN", "INV_BOOLEAN", - "S8", "U8", "S16", "U16"}; - snd_iprintf(buffer, " Info: id=%i, control=%i, cmask=0x%x, " -@@ -2364,8 +2374,7 @@ static void snd_usb_mixer_proc_read(struct snd_info_entry *entry, - mixer->ignore_ctl_error); - snd_iprintf(buffer, "Card: %s\n", chip->card->longname); - for (unitid = 0; unitid < MAX_ID_ELEMS; unitid++) { -- for (list = mixer->id_elems[unitid]; list; -- list = list->next_id_elem) { -+ for_each_mixer_elem(list, mixer, unitid) { - snd_iprintf(buffer, " Unit: %i\n", list->id); - if (list->kctl) - snd_iprintf(buffer, -@@ -2386,6 +2395,7 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer, - __u8 unitid = (index >> 8) & 0xff; - __u8 control = (value >> 8) & 0xff; - __u8 channel = value & 0xff; -+ unsigned int count = 0; - - if (channel >= MAX_CHANNELS) { - usb_audio_dbg(mixer->chip, -@@ -2394,14 +2404,22 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer, - return; - } - -- for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) { -+ for_each_mixer_elem(list, mixer, unitid) -+ count++; -+ -+ if (count == 0) -+ return; -+ -+ for_each_mixer_elem(list, mixer, unitid) { - struct usb_mixer_elem_info *info; - - if (!list->kctl) - continue; -+ if (!list->is_std_info) -+ continue; - -- info = (struct usb_mixer_elem_info *)list; -- if (info->control != control) -+ info = mixer_elem_list_to_info(list); -+ if (count > 1 && info->control != control) - continue; - - switch (attribute) { -@@ -2620,7 +2638,7 @@ int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer) - - static int restore_mixer_value(struct usb_mixer_elem_list *list) - { -- struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list; -+ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); - int c, err, idx; - - if (cval->cmask) { -@@ -2656,8 +2674,7 @@ int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume) - if (reset_resume) { - /* restore cached mixer values */ - for (id = 0; id < MAX_ID_ELEMS; id++) { -- for (list = mixer->id_elems[id]; list; -- list = list->next_id_elem) { -+ for_each_mixer_elem(list, mixer, id) { - if (list->resume) { - err = list->resume(list); - if (err < 0) -diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h -index 545d99b09706..7d16a9221070 100644 ---- a/sound/usb/mixer.h -+++ b/sound/usb/mixer.h -@@ -48,10 +48,17 @@ struct usb_mixer_elem_list { - struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */ - struct snd_kcontrol *kctl; - unsigned int id; -+ bool is_std_info; - usb_mixer_elem_dump_func_t dump; - usb_mixer_elem_resume_func_t resume; - }; - -+/* iterate over mixer element list of the given unit id */ -+#define for_each_mixer_elem(list, mixer, id) \ -+ for ((list) = (mixer)->id_elems[id]; (list); (list) = (list)->next_id_elem) -+#define mixer_elem_list_to_info(list) \ -+ container_of(list, struct usb_mixer_elem_info, head) -+ - struct usb_mixer_elem_info { - struct usb_mixer_elem_list head; - unsigned int control; /* CS or ICN (high byte) */ -@@ -79,8 +86,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid); - int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval, - int request, int validx, int value_set); - --int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, -- struct snd_kcontrol *kctl); -+int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, -+ struct snd_kcontrol *kctl, -+ bool is_std_info); -+ -+#define snd_usb_mixer_add_control(list, kctl) \ -+ snd_usb_mixer_add_list(list, kctl, true) - - void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list, - struct usb_mixer_interface *mixer, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 723b535ca2ec..9646513f4b4a 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -168,7 +168,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer, - return -ENOMEM; - } - kctl->private_free = snd_usb_mixer_elem_free; -- return snd_usb_mixer_add_control(list, kctl); -+ /* don't use snd_usb_mixer_add_control() here, this is a special list element */ -+ return snd_usb_mixer_add_list(list, kctl, false); - } - - /* -@@ -1167,17 +1168,17 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip, - { - struct usb_mixer_interface *mixer; - struct usb_mixer_elem_info *cval; -- int unitid = 12; /* SamleRate ExtensionUnit ID */ -+ int unitid = 12; /* SampleRate ExtensionUnit ID */ - - list_for_each_entry(mixer, &chip->mixer_list, list) { -- cval = (struct usb_mixer_elem_info *)mixer->id_elems[unitid]; -- if (cval) { -+ if (mixer->id_elems[unitid]) { -+ cval = mixer_elem_list_to_info(mixer->id_elems[unitid]); - snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, - cval->control << 8, - samplerate_id); - snd_usb_mixer_notify_id(mixer, unitid); -+ break; - } -- break; - } - } - -diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c -index 7438e7c4a842..2876cd9b35b3 100644 ---- a/sound/usb/mixer_scarlett.c -+++ b/sound/usb/mixer_scarlett.c -@@ -287,8 +287,7 @@ static int scarlett_ctl_switch_put(struct snd_kcontrol *kctl, - - static int scarlett_ctl_resume(struct usb_mixer_elem_list *list) - { -- struct usb_mixer_elem_info *elem = -- container_of(list, struct usb_mixer_elem_info, head); -+ struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list); - int i; - - for (i = 0; i < elem->channels; i++) -@@ -447,8 +446,7 @@ static int scarlett_ctl_enum_put(struct snd_kcontrol *kctl, - - static int scarlett_ctl_enum_resume(struct usb_mixer_elem_list *list) - { -- struct usb_mixer_elem_info *elem = -- container_of(list, struct usb_mixer_elem_info, head); -+ struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list); - - if (elem->cached) - snd_usb_set_cur_mix_value(elem, 0, 0, *elem->cache_val); -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index f84c55ecd0fb..53d91cae86f9 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -1473,6 +1473,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs, - for (i = 0; i < ctx->packets; i++) { - if (ctx->packet_size[i]) - counts = ctx->packet_size[i]; -+ else if (ep->sync_master) -+ counts = snd_usb_endpoint_slave_next_packet_size(ep); - else - counts = snd_usb_endpoint_next_packet_size(ep); - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index b7a7bf0e566c..47979c9c3e29 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1162,6 +1162,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - static bool is_marantz_denon_dac(unsigned int id) - { - switch (id) { -+ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */ - case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */ - case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */ - case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */ -diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c -index f256fac1e722..74dd196acdac 100644 ---- a/tools/perf/builtin-report.c -+++ b/tools/perf/builtin-report.c -@@ -334,8 +334,7 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report - if (evname != NULL) - ret += fprintf(fp, " of event '%s'", evname); - -- if (symbol_conf.show_ref_callgraph && -- strstr(evname, "call-graph=no")) { -+ if (symbol_conf.show_ref_callgraph && evname && strstr(evname, "call-graph=no")) { - ret += fprintf(fp, ", show reference callgraph"); - } - -diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c -index 5cdfd743447b..900ed4b47899 100644 ---- a/tools/testing/selftests/networking/timestamping/timestamping.c -+++ b/tools/testing/selftests/networking/timestamping/timestamping.c -@@ -332,10 +332,16 @@ int main(int argc, char **argv) - int val; - socklen_t len; - struct timeval next; -+ size_t if_len; - - if (argc < 2) - usage(0); - interface = argv[1]; -+ if_len = strlen(interface); -+ if (if_len >= IFNAMSIZ) { -+ printf("interface name exceeds IFNAMSIZ\n"); -+ exit(1); -+ } - - for (i = 2; i < argc; i++) { - if (!strcasecmp(argv[i], "SO_TIMESTAMP")) -@@ -369,12 +375,12 @@ int main(int argc, char **argv) - bail("socket"); - - memset(&device, 0, sizeof(device)); -- strncpy(device.ifr_name, interface, sizeof(device.ifr_name)); -+ memcpy(device.ifr_name, interface, if_len + 1); - if (ioctl(sock, SIOCGIFADDR, &device) < 0) - bail("getting interface IP address"); - - memset(&hwtstamp, 0, sizeof(hwtstamp)); -- strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name)); -+ memcpy(hwtstamp.ifr_name, interface, if_len + 1); - hwtstamp.ifr_data = (void *)&hwconfig; - memset(&hwconfig, 0, sizeof(hwconfig)); - hwconfig.tx_type = diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.229-230.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.229-230.patch deleted file mode 100644 index 131ab2d59c..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.229-230.patch +++ /dev/null @@ -1,679 +0,0 @@ -diff --git a/Makefile b/Makefile -index 99b211904ac5..847f2537d39d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 229 -+SUBLEVEL = 230 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index 6abd6b41c13d..36472fc266fd 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -2080,6 +2080,7 @@ static void configure_status(void) - - change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX, - status_set); -+ back_to_back_c0_hazard(); - } - - /* configure HWRENA register */ -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index cf3975ee4fd8..c48ddeb6c328 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -130,21 +130,15 @@ EXPORT_SYMBOL_GPL(af_alg_release); - void af_alg_release_parent(struct sock *sk) - { - struct alg_sock *ask = alg_sk(sk); -- unsigned int nokey = ask->nokey_refcnt; -- bool last = nokey && !ask->refcnt; -+ unsigned int nokey = atomic_read(&ask->nokey_refcnt); - - sk = ask->parent; - ask = alg_sk(sk); - -- local_bh_disable(); -- bh_lock_sock(sk); -- ask->nokey_refcnt -= nokey; -- if (!last) -- last = !--ask->refcnt; -- bh_unlock_sock(sk); -- local_bh_enable(); -+ if (nokey) -+ atomic_dec(&ask->nokey_refcnt); - -- if (last) -+ if (atomic_dec_and_test(&ask->refcnt)) - sock_put(sk); - } - EXPORT_SYMBOL_GPL(af_alg_release_parent); -@@ -189,7 +183,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - - err = -EBUSY; - lock_sock(sk); -- if (ask->refcnt | ask->nokey_refcnt) -+ if (atomic_read(&ask->refcnt)) - goto unlock; - - swap(ask->type, type); -@@ -238,7 +232,7 @@ static int alg_setsockopt(struct socket *sock, int level, int optname, - int err = -EBUSY; - - lock_sock(sk); -- if (ask->refcnt) -+ if (atomic_read(&ask->refcnt) != atomic_read(&ask->nokey_refcnt)) - goto unlock; - - type = ask->type; -@@ -305,12 +299,14 @@ int af_alg_accept(struct sock *sk, struct socket *newsock) - - sk2->sk_family = PF_ALG; - -- if (nokey || !ask->refcnt++) -+ if (atomic_inc_return_relaxed(&ask->refcnt) == 1) - sock_hold(sk); -- ask->nokey_refcnt += nokey; -+ if (nokey) { -+ atomic_inc(&ask->nokey_refcnt); -+ atomic_set(&alg_sk(sk2)->nokey_refcnt, 1); -+ } - alg_sk(sk2)->parent = sk; - alg_sk(sk2)->type = type; -- alg_sk(sk2)->nokey_refcnt = nokey; - - newsock->ops = type->ops; - newsock->state = SS_CONNECTED; -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index faea9d728fd2..c50175ad5485 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -528,7 +528,7 @@ static int aead_check_key(struct socket *sock) - struct alg_sock *ask = alg_sk(sk); - - lock_sock(sk); -- if (ask->refcnt) -+ if (!atomic_read(&ask->nokey_refcnt)) - goto unlock_child; - - psk = ask->parent; -@@ -540,11 +540,8 @@ static int aead_check_key(struct socket *sock) - if (!tfm->has_key) - goto unlock; - -- if (!pask->refcnt++) -- sock_hold(psk); -- -- ask->refcnt = 1; -- sock_put(psk); -+ atomic_dec(&pask->nokey_refcnt); -+ atomic_set(&ask->nokey_refcnt, 0); - - err = 0; - -diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c -index 8d8b3eeba725..fd23261f1d16 100644 ---- a/crypto/algif_hash.c -+++ b/crypto/algif_hash.c -@@ -252,7 +252,7 @@ static int hash_check_key(struct socket *sock) - struct alg_sock *ask = alg_sk(sk); - - lock_sock(sk); -- if (ask->refcnt) -+ if (!atomic_read(&ask->nokey_refcnt)) - goto unlock_child; - - psk = ask->parent; -@@ -264,11 +264,8 @@ static int hash_check_key(struct socket *sock) - if (!tfm->has_key) - goto unlock; - -- if (!pask->refcnt++) -- sock_hold(psk); -- -- ask->refcnt = 1; -- sock_put(psk); -+ atomic_dec(&pask->nokey_refcnt); -+ atomic_set(&ask->nokey_refcnt, 0); - - err = 0; - -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index 9bd4691cc5c5..0e200bf5aa82 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -774,7 +774,7 @@ static int skcipher_check_key(struct socket *sock) - struct alg_sock *ask = alg_sk(sk); - - lock_sock(sk); -- if (ask->refcnt) -+ if (!atomic_read(&ask->nokey_refcnt)) - goto unlock_child; - - psk = ask->parent; -@@ -786,11 +786,8 @@ static int skcipher_check_key(struct socket *sock) - if (!tfm->has_key) - goto unlock; - -- if (!pask->refcnt++) -- sock_hold(psk); -- -- ask->refcnt = 1; -- sock_put(psk); -+ atomic_dec(&pask->nokey_refcnt); -+ atomic_set(&ask->nokey_refcnt, 0); - - err = 0; - -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 1e5cd39d0cc2..bdc3efacd0d2 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -757,6 +757,7 @@ out_put_disk: - put_disk(vblk->disk); - out_free_vq: - vdev->config->del_vqs(vdev); -+ kfree(vblk->vqs); - out_free_vblk: - kfree(vblk); - out_free_index: -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index 932ba7676183..5f86075e34da 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -248,6 +248,8 @@ static int get_scrub_rate(struct mem_ctl_info *mci) - - if (pvt->model == 0x60) - amd64_read_pci_cfg(pvt->F2, F15H_M60H_SCRCTRL, &scrubval); -+ else -+ amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval); - } else - amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval); - -diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c -index e27f7e12c05b..9b4ad6c74041 100644 ---- a/drivers/hwmon/acpi_power_meter.c -+++ b/drivers/hwmon/acpi_power_meter.c -@@ -895,7 +895,7 @@ static int acpi_power_meter_add(struct acpi_device *device) - - res = setup_attrs(resource); - if (res) -- goto exit_free; -+ goto exit_free_capability; - - resource->hwmon_dev = hwmon_device_register(&device->dev); - if (IS_ERR(resource->hwmon_dev)) { -@@ -908,6 +908,8 @@ static int acpi_power_meter_add(struct acpi_device *device) - - exit_remove: - remove_attrs(resource); -+exit_free_capability: -+ free_capabilities(resource); - exit_free: - kfree(resource); - exit: -diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c -index f03a71722849..d4bb3d6aaf18 100644 ---- a/drivers/hwmon/max6697.c -+++ b/drivers/hwmon/max6697.c -@@ -46,8 +46,9 @@ static const u8 MAX6697_REG_CRIT[] = { - * Map device tree / platform data register bit map to chip bit map. - * Applies to alert register and over-temperature register. - */ --#define MAX6697_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \ -+#define MAX6697_ALERT_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \ - (((reg) & 0x01) << 6) | ((reg) & 0x80)) -+#define MAX6697_OVERT_MAP_BITS(reg) (((reg) >> 1) | (((reg) & 0x01) << 7)) - - #define MAX6697_REG_STAT(n) (0x44 + (n)) - -@@ -586,12 +587,12 @@ static int max6697_init_chip(struct max6697_data *data, - return ret; - - ret = i2c_smbus_write_byte_data(client, MAX6697_REG_ALERT_MASK, -- MAX6697_MAP_BITS(pdata->alert_mask)); -+ MAX6697_ALERT_MAP_BITS(pdata->alert_mask)); - if (ret < 0) - return ret; - - ret = i2c_smbus_write_byte_data(client, MAX6697_REG_OVERT_MASK, -- MAX6697_MAP_BITS(pdata->over_temperature_mask)); -+ MAX6697_OVERT_MAP_BITS(pdata->over_temperature_mask)); - if (ret < 0) - return ret; - -diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c -index e370804ec8bc..3a9db4626cb6 100644 ---- a/drivers/i2c/algos/i2c-algo-pca.c -+++ b/drivers/i2c/algos/i2c-algo-pca.c -@@ -326,7 +326,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap, - DEB2("BUS ERROR - SDA Stuck low\n"); - pca_reset(adap); - goto out; -- case 0x90: /* Bus error - SCL stuck low */ -+ case 0x78: /* Bus error - SCL stuck low (PCA9665) */ -+ case 0x90: /* Bus error - SCL stuck low (PCA9564) */ - DEB2("BUS ERROR - SCL Stuck low\n"); - pca_reset(adap); - goto out; -diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c -index bc92a498ec03..9f19aa950bb1 100644 ---- a/drivers/usb/misc/usbtest.c -+++ b/drivers/usb/misc/usbtest.c -@@ -2703,6 +2703,7 @@ static void usbtest_disconnect(struct usb_interface *intf) - - usb_set_intfdata(intf, NULL); - dev_dbg(&intf->dev, "disconnect\n"); -+ kfree(dev->buf); - kfree(dev); - } - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 972475eeb2dd..b1125778b908 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -926,7 +926,7 @@ static noinline int cow_file_range(struct inode *inode, - u64 alloc_hint = 0; - u64 num_bytes; - unsigned long ram_size; -- u64 disk_num_bytes; -+ u64 min_alloc_size; - u64 cur_alloc_size; - u64 blocksize = root->sectorsize; - struct btrfs_key ins; -@@ -942,7 +942,6 @@ static noinline int cow_file_range(struct inode *inode, - - num_bytes = ALIGN(end - start + 1, blocksize); - num_bytes = max(blocksize, num_bytes); -- disk_num_bytes = num_bytes; - - /* if this is a small write inside eof, kick off defrag */ - if (num_bytes < 64 * 1024 && -@@ -969,18 +968,33 @@ static noinline int cow_file_range(struct inode *inode, - } - } - -- BUG_ON(disk_num_bytes > -- btrfs_super_total_bytes(root->fs_info->super_copy)); -+ BUG_ON(num_bytes > btrfs_super_total_bytes(root->fs_info->super_copy)); - - alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); - btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0); - -- while (disk_num_bytes > 0) { -+ /* -+ * Relocation relies on the relocated extents to have exactly the same -+ * size as the original extents. Normally writeback for relocation data -+ * extents follows a NOCOW path because relocation preallocates the -+ * extents. However, due to an operation such as scrub turning a block -+ * group to RO mode, it may fallback to COW mode, so we must make sure -+ * an extent allocated during COW has exactly the requested size and can -+ * not be split into smaller extents, otherwise relocation breaks and -+ * fails during the stage where it updates the bytenr of file extent -+ * items. -+ */ -+ if (root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID) -+ min_alloc_size = num_bytes; -+ else -+ min_alloc_size = root->sectorsize; -+ -+ while (num_bytes > 0) { - unsigned long op; - -- cur_alloc_size = disk_num_bytes; -+ cur_alloc_size = num_bytes; - ret = btrfs_reserve_extent(root, cur_alloc_size, -- root->sectorsize, 0, alloc_hint, -+ min_alloc_size, 0, alloc_hint, - &ins, 1, 1); - if (ret < 0) - goto out_unlock; -@@ -1033,7 +1047,7 @@ static noinline int cow_file_range(struct inode *inode, - goto out_drop_extent_cache; - } - -- if (disk_num_bytes < cur_alloc_size) -+ if (num_bytes < cur_alloc_size) - break; - - /* we're not doing compressed IO, don't unlock the first -@@ -1050,8 +1064,10 @@ static noinline int cow_file_range(struct inode *inode, - start + ram_size - 1, locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - op); -- disk_num_bytes -= cur_alloc_size; -- num_bytes -= cur_alloc_size; -+ if (num_bytes < cur_alloc_size) -+ num_bytes = 0; -+ else -+ num_bytes -= cur_alloc_size; - alloc_hint = ins.objectid + ins.offset; - start += cur_alloc_size; - } -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 21ddfd77966e..f4ef8d6ea8ed 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -4203,9 +4203,12 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) - vol_info->retry = master_tcon->retry; - vol_info->nocase = master_tcon->nocase; - vol_info->local_lease = master_tcon->local_lease; -+ vol_info->resilient = master_tcon->use_resilient; -+ vol_info->persistent = master_tcon->use_persistent; - vol_info->no_linux_ext = !master_tcon->unix_ext; - vol_info->sectype = master_tcon->ses->sectype; - vol_info->sign = master_tcon->ses->sign; -+ vol_info->seal = master_tcon->seal; - - rc = cifs_set_vol_auth(vol_info, master_tcon->ses); - if (rc) { -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index c18c26a78453..a002e289a544 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -1737,6 +1737,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, - FILE_UNIX_BASIC_INFO *info_buf_target; - unsigned int xid; - int rc, tmprc; -+ bool new_target = d_really_is_negative(target_dentry); - - if (flags & ~RENAME_NOREPLACE) - return -EINVAL; -@@ -1813,8 +1814,13 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, - */ - - unlink_target: -- /* Try unlinking the target dentry if it's not negative */ -- if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) { -+ /* -+ * If the target dentry was created during the rename, try -+ * unlinking it if it's not negative -+ */ -+ if (new_target && -+ d_really_is_positive(target_dentry) && -+ (rc == -EACCES || rc == -EEXIST)) { - if (d_is_dir(target_dentry)) - tmprc = cifs_rmdir(target_dir, target_dentry); - else -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index a2bfd7843f18..4bb6b98782e9 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -30,8 +30,8 @@ struct alg_sock { - - struct sock *parent; - -- unsigned int refcnt; -- unsigned int nokey_refcnt; -+ atomic_t refcnt; -+ atomic_t nokey_refcnt; - - const struct af_alg_type *type; - void *private; -diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h -index c9e4731cf10b..7fc36ebc5de3 100644 ---- a/include/linux/sched/sysctl.h -+++ b/include/linux/sched/sysctl.h -@@ -81,6 +81,7 @@ extern unsigned int sysctl_sched_cfs_bandwidth_slice; - extern unsigned int sysctl_sched_autogroup_enabled; - #endif - -+extern int sysctl_sched_rr_timeslice; - extern int sched_rr_timeslice; - - extern int sched_rr_handler(struct ctl_table *table, int write, -diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c -index 9c939c6bf21c..321ccdbb7364 100644 ---- a/kernel/debug/debug_core.c -+++ b/kernel/debug/debug_core.c -@@ -488,6 +488,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, - arch_kgdb_ops.disable_hw_break(regs); - - acquirelock: -+ rcu_read_lock(); - /* - * Interrupts will be restored by the 'trap return' code, except when - * single stepping. -@@ -542,6 +543,7 @@ return_normal: - atomic_dec(&slaves_in_kgdb); - dbg_touch_watchdogs(); - local_irq_restore(flags); -+ rcu_read_unlock(); - return 0; - } - cpu_relax(); -@@ -560,6 +562,7 @@ return_normal: - raw_spin_unlock(&dbg_master_lock); - dbg_touch_watchdogs(); - local_irq_restore(flags); -+ rcu_read_unlock(); - - goto acquirelock; - } -@@ -677,6 +680,7 @@ kgdb_restore: - raw_spin_unlock(&dbg_master_lock); - dbg_touch_watchdogs(); - local_irq_restore(flags); -+ rcu_read_unlock(); - - return kgdb_info[cpu].ret_state; - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 14a87c1f3a3a..4a0a754f24c8 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -8266,8 +8266,9 @@ int sched_rr_handler(struct ctl_table *table, int write, - /* make sure that internally we keep jiffies */ - /* also, writing zero resets timeslice to default */ - if (!ret && write) { -- sched_rr_timeslice = sched_rr_timeslice <= 0 ? -- RR_TIMESLICE : msecs_to_jiffies(sched_rr_timeslice); -+ sched_rr_timeslice = -+ sysctl_sched_rr_timeslice <= 0 ? RR_TIMESLICE : -+ msecs_to_jiffies(sysctl_sched_rr_timeslice); - } - mutex_unlock(&mutex); - return ret; -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 801b4ec40702..5ee5740635f3 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -9,6 +9,7 @@ - #include - - int sched_rr_timeslice = RR_TIMESLICE; -+int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; - - static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun); - -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index c2dddd335d06..ecbb1b764a82 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -412,7 +412,7 @@ static struct ctl_table kern_table[] = { - }, - { - .procname = "sched_rr_timeslice_ms", -- .data = &sched_rr_timeslice, -+ .data = &sysctl_sched_rr_timeslice, - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = sched_rr_handler, -diff --git a/mm/slub.c b/mm/slub.c -index bb5237c67cbc..a3870034bfcc 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -5305,7 +5305,8 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) - */ - if (buffer) - buf = buffer; -- else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf)) -+ else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf) && -+ !IS_ENABLED(CONFIG_SLUB_STATS)) - buf = mbuf; - else { - buffer = (char *) get_zeroed_page(GFP_KERNEL); -diff --git a/mm/swap_state.c b/mm/swap_state.c -index d504adb7fa5f..9e587464e634 100644 ---- a/mm/swap_state.c -+++ b/mm/swap_state.c -@@ -19,6 +19,7 @@ - #include - - #include -+#include "internal.h" - - /* - * swapper_space is a fiction, retained to simplify the path through -@@ -319,7 +320,7 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask, - /* - * call radix_tree_preload() while we can wait. - */ -- err = radix_tree_maybe_preload(gfp_mask & GFP_KERNEL); -+ err = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK); - if (err) - break; - -diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c -index 9511af04dc81..15495b956855 100644 ---- a/net/netfilter/nf_conntrack_h323_main.c -+++ b/net/netfilter/nf_conntrack_h323_main.c -@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = { - { - .name = "Q.931", - .me = THIS_MODULE, -+ .data_len = sizeof(struct nf_ct_h323_master), - .tuple.src.l3num = AF_INET6, - .tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT), - .tuple.dst.protonum = IPPROTO_TCP, -diff --git a/sound/usb/card.h b/sound/usb/card.h -index 844c68863810..71778ca4b26a 100644 ---- a/sound/usb/card.h -+++ b/sound/usb/card.h -@@ -80,10 +80,6 @@ struct snd_usb_endpoint { - dma_addr_t sync_dma; /* DMA address of syncbuf */ - - unsigned int pipe; /* the data i/o pipe */ -- unsigned int framesize[2]; /* small/large frame sizes in samples */ -- unsigned int sample_rem; /* remainder from division fs/fps */ -- unsigned int sample_accum; /* sample accumulator */ -- unsigned int fps; /* frames per second */ - unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */ - unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */ - int freqshift; /* how much to shift the feedback value to get Q16.16 */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index 666731317b33..66648b4bdd28 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep) - - /* - * For streaming based on information derived from sync endpoints, -- * prepare_outbound_urb_sizes() will call slave_next_packet_size() to -+ * prepare_outbound_urb_sizes() will call next_packet_size() to - * determine the number of samples to be sent in the next packet. - * -- * For implicit feedback, slave_next_packet_size() is unused. -+ * For implicit feedback, next_packet_size() is unused. - */ --int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep) -+int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) - { - unsigned long flags; - int ret; -@@ -159,29 +159,6 @@ int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep) - return ret; - } - --/* -- * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes() -- * will call next_packet_size() to determine the number of samples to be -- * sent in the next packet. -- */ --int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) --{ -- int ret; -- -- if (ep->fill_max) -- return ep->maxframesize; -- -- ep->sample_accum += ep->sample_rem; -- if (ep->sample_accum >= ep->fps) { -- ep->sample_accum -= ep->fps; -- ret = ep->framesize[1]; -- } else { -- ret = ep->framesize[0]; -- } -- -- return ret; --} -- - static void retire_outbound_urb(struct snd_usb_endpoint *ep, - struct snd_urb_ctx *urb_ctx) - { -@@ -226,8 +203,6 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, - - if (ctx->packet_size[i]) - counts = ctx->packet_size[i]; -- else if (ep->sync_master) -- counts = snd_usb_endpoint_slave_next_packet_size(ep); - else - counts = snd_usb_endpoint_next_packet_size(ep); - -@@ -904,17 +879,10 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep, - ep->maxpacksize = fmt->maxpacksize; - ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX); - -- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) { -+ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) - ep->freqn = get_usb_full_speed_rate(rate); -- ep->fps = 1000; -- } else { -+ else - ep->freqn = get_usb_high_speed_rate(rate); -- ep->fps = 8000; -- } -- -- ep->sample_rem = rate % ep->fps; -- ep->framesize[0] = rate / ep->fps; -- ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps; - - /* calculate the frequency in 16.16 format */ - ep->freqm = ep->freqn; -@@ -973,7 +941,6 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep) - ep->active_mask = 0; - ep->unlink_mask = 0; - ep->phase = 0; -- ep->sample_accum = 0; - - snd_usb_endpoint_start_quirk(ep); - -diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h -index 4aad49cbeb5f..584f295d7c77 100644 ---- a/sound/usb/endpoint.h -+++ b/sound/usb/endpoint.h -@@ -27,7 +27,6 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep); - void snd_usb_endpoint_free(struct snd_usb_endpoint *ep); - - int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); --int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep); - int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep); - - void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index 53d91cae86f9..f84c55ecd0fb 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -1473,8 +1473,6 @@ static void prepare_playback_urb(struct snd_usb_substream *subs, - for (i = 0; i < ctx->packets; i++) { - if (ctx->packet_size[i]) - counts = ctx->packet_size[i]; -- else if (ep->sync_master) -- counts = snd_usb_endpoint_slave_next_packet_size(ep); - else - counts = snd_usb_endpoint_next_packet_size(ep); - diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.230-231.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.230-231.patch deleted file mode 100644 index fc5b825e3d..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.230-231.patch +++ /dev/null @@ -1,1715 +0,0 @@ -diff --git a/Makefile b/Makefile -index 847f2537d39d..46178c83906c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 230 -+SUBLEVEL = 231 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h -index 8ee9113b2f8b..b060eb8ad91b 100644 ---- a/arch/arc/include/asm/elf.h -+++ b/arch/arc/include/asm/elf.h -@@ -27,7 +27,7 @@ - #define R_ARC_S25W_PCREL 0x11 - - /*to set parameters in the core dumps */ --#define ELF_ARCH EM_ARCOMPACT -+#define ELF_ARCH EM_ARC_INUSE - #define ELF_CLASS ELFCLASS32 - - #ifdef CONFIG_CPU_BIG_ENDIAN -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index db1eee5fe502..5e3f1edf5a29 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -168,7 +168,6 @@ END(EV_Extension) - tracesys: - ; save EFA in case tracer wants the PC of traced task - ; using ERET won't work since next-PC has already committed -- lr r12, [efa] - GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 - st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address - -@@ -211,15 +210,9 @@ tracesys_exit: - ; Breakpoint TRAP - ; --------------------------------------------- - trap_with_param: -- -- ; stop_pc info by gdb needs this info -- lr r0, [efa] -+ mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc - mov r1, sp - -- ; Now that we have read EFA, it is safe to do "fake" rtie -- ; and get out of CPU exception mode -- FAKE_RET_FROM_EXCPN -- - ; Save callee regs in case gdb wants to have a look - ; SP will grow up by size of CALLEE Reg-File - ; NOTE: clobbers r12 -@@ -246,6 +239,10 @@ ENTRY(EV_Trap) - - EXCEPTION_PROLOGUE - -+ lr r12, [efa] -+ -+ FAKE_RET_FROM_EXCPN -+ - ;============ TRAP 1 :breakpoints - ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) - bmsk.f 0, r9, 7 -@@ -253,9 +250,6 @@ ENTRY(EV_Trap) - - ;============ TRAP (no param): syscall top level - -- ; First return from Exception to pure K mode (Exception/IRQs renabled) -- FAKE_RET_FROM_EXCPN -- - ; If syscall tracing ongoing, invoke pre-post-hooks - GET_CURR_THR_INFO_FLAGS r10 - btst r10, TIF_SYSCALL_TRACE -diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c -index f72743dc070d..606c21760f23 100644 ---- a/arch/arm64/kernel/kgdb.c -+++ b/arch/arm64/kernel/kgdb.c -@@ -238,7 +238,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) - if (user_mode(regs)) - return DBG_HOOK_ERROR; - -- kgdb_handle_exception(1, SIGTRAP, 0, regs); -+ kgdb_handle_exception(0, SIGTRAP, 0, regs); - return DBG_HOOK_HANDLED; - } - -diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c -index 345978cc105b..fbb99c430f13 100644 ---- a/arch/mips/kernel/time.c -+++ b/arch/mips/kernel/time.c -@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq; - static int cpufreq_callback(struct notifier_block *nb, - unsigned long val, void *data) - { -- struct cpufreq_freqs *freq = data; -- struct cpumask *cpus = freq->policy->cpus; -- unsigned long lpj; - int cpu; -+ struct cpufreq_freqs *freq = data; - - /* - * Skip lpj numbers adjustment if the CPU-freq transition is safe for -@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notifier_block *nb, - } - } - -+ cpu = freq->cpu; - /* - * Adjust global lpj variable and per-CPU udelay_val number in - * accordance with the new CPU frequency. -@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notifier_block *nb, - glb_lpj_ref_freq, - freq->new); - -- for_each_cpu(cpu, cpus) { -- lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu), -- per_cpu(pcp_lpj_ref_freq, cpu), -- freq->new); -- cpu_data[cpu].udelay_val = (unsigned int)lpj; -- } -+ cpu_data[cpu].udelay_val = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu), -+ per_cpu(pcp_lpj_ref_freq, cpu), freq->new); - } - - return NOTIFY_OK; -diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h -index 7d9c5917da2b..737bc0a39463 100644 ---- a/arch/s390/include/asm/kvm_host.h -+++ b/arch/s390/include/asm/kvm_host.h -@@ -29,12 +29,12 @@ - #define KVM_USER_MEM_SLOTS 32 - - /* -- * These seem to be used for allocating ->chip in the routing table, -- * which we don't use. 4096 is an out-of-thin-air value. If we need -- * to look at ->chip later on, we'll need to revisit this. -+ * These seem to be used for allocating ->chip in the routing table, which we -+ * don't use. 1 is as small as we can get to reduce the needed memory. If we -+ * need to look at ->chip later on, we'll need to revisit this. - */ - #define KVM_NR_IRQCHIPS 1 --#define KVM_IRQCHIP_NUM_PINS 4096 -+#define KVM_IRQCHIP_NUM_PINS 1 - #define KVM_HALT_POLL_NS_DEFAULT 0 - - #define SIGP_CTRL_C 0x80 -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index a5b533aea958..2ff0fe32c015 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -3679,7 +3679,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu, - nonleaf_bit8_rsvd | rsvd_bits(7, 7) | - rsvd_bits(maxphyaddr, 51); - rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd | -- nonleaf_bit8_rsvd | gbpages_bit_rsvd | -+ gbpages_bit_rsvd | - rsvd_bits(maxphyaddr, 51); - rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd | - rsvd_bits(maxphyaddr, 51); -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 5e0e29ee31d1..226ccb7891d4 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -2155,6 +2155,7 @@ static struct virtio_device_id id_table[] = { - { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID }, - { 0 }, - }; -+MODULE_DEVICE_TABLE(virtio, id_table); - - static unsigned int features[] = { - VIRTIO_CONSOLE_F_SIZE, -@@ -2167,6 +2168,7 @@ static struct virtio_device_id rproc_serial_id_table[] = { - #endif - { 0 }, - }; -+MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table); - - static unsigned int rproc_serial_features[] = { - }; -@@ -2319,6 +2321,5 @@ static void __exit fini(void) - module_init(init); - module_exit(fini); - --MODULE_DEVICE_TABLE(virtio, id_table); - MODULE_DESCRIPTION("Virtio console driver"); - MODULE_LICENSE("GPL"); -diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c -index 915eec3cc279..c2bb8486d174 100644 ---- a/drivers/dma/fsl-edma.c -+++ b/drivers/dma/fsl-edma.c -@@ -671,6 +671,13 @@ static irqreturn_t fsl_edma_tx_handler(int irq, void *dev_id) - fsl_chan = &fsl_edma->chans[ch]; - - spin_lock(&fsl_chan->vchan.lock); -+ -+ if (!fsl_chan->edesc) { -+ /* terminate_all called before */ -+ spin_unlock(&fsl_chan->vchan.lock); -+ continue; -+ } -+ - if (!fsl_chan->edesc->iscyclic) { - list_del(&fsl_chan->edesc->vdesc.node); - vchan_cookie_complete(&fsl_chan->edesc->vdesc); -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index 2ccf81168d1e..e7a245d7bdbc 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -5554,6 +5554,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) - if (!rdev->pm.dpm.ps) - return -ENOMEM; - power_state_offset = (u8 *)state_array->states; -+ rdev->pm.dpm.num_ps = 0; - for (i = 0; i < state_array->ucNumEntries; i++) { - u8 *idx; - power_state = (union pplib_power_state *)power_state_offset; -@@ -5563,10 +5564,8 @@ static int ci_parse_power_table(struct radeon_device *rdev) - if (!rdev->pm.power_state[i].clock_info) - return -EINVAL; - ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); -- if (ps == NULL) { -- kfree(rdev->pm.dpm.ps); -+ if (ps == NULL) - return -ENOMEM; -- } - rdev->pm.dpm.ps[i].ps_priv = ps; - ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], - non_clock_info, -@@ -5588,8 +5587,8 @@ static int ci_parse_power_table(struct radeon_device *rdev) - k++; - } - power_state_offset += 2 + power_state->v2.ucNumDPMLevels; -+ rdev->pm.dpm.num_ps = i + 1; - } -- rdev->pm.dpm.num_ps = state_array->ucNumEntries; - - /* fill in the vce power states */ - for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) { -diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c -index d6fa496d0ca2..d15e824e39df 100644 ---- a/drivers/hid/hid-magicmouse.c -+++ b/drivers/hid/hid-magicmouse.c -@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd - __set_bit(MSC_RAW, input->mscbit); - } - -+ /* -+ * hid-input may mark device as using autorepeat, but neither -+ * the trackpad, nor the mouse actually want it. -+ */ -+ __clear_bit(EV_REP, input->evbit); -+ - return 0; - } - -diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c -index 952fe692d764..0ddb0677e9c8 100644 ---- a/drivers/hwmon/emc2103.c -+++ b/drivers/hwmon/emc2103.c -@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct device *dev, struct device_attribute *da, - } - - result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg); -- if (result) { -+ if (result < 0) { - count = result; - goto err; - } -diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c -index eef3aa6007f1..ffd8f9772096 100644 ---- a/drivers/i2c/busses/i2c-eg20t.c -+++ b/drivers/i2c/busses/i2c-eg20t.c -@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = { - { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, }, - {0,} - }; -+MODULE_DEVICE_TABLE(pci, pch_pcidev_id); - - static irqreturn_t pch_i2c_handler(int irq, void *pData); - -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index fd1e79013cf8..bdc42923523e 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -429,6 +429,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "076804U"), - }, - }, -+ { -+ /* Lenovo XiaoXin Air 12 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "80UN"), -+ }, -+ }, - { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c -index 6c9fc11efb87..e77185e143ab 100644 ---- a/drivers/message/fusion/mptscsih.c -+++ b/drivers/message/fusion/mptscsih.c -@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state); - int mptscsih_resume(struct pci_dev *pdev); - #endif - --#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE -- - - /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ - /* -@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR - /* Copy the sense received into the scsi command block. */ - req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); - sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC)); -- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc)); -+ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC); - - /* Log SMART data (asc = 0x5D, non-IM case only) if required. - */ -diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c -index e2474af7386a..ae0f6a1a4be0 100644 ---- a/drivers/misc/atmel-ssc.c -+++ b/drivers/misc/atmel-ssc.c -@@ -13,7 +13,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -21,7 +21,7 @@ - #include - - /* Serialize access to ssc_list and user count */ --static DEFINE_SPINLOCK(user_lock); -+static DEFINE_MUTEX(user_lock); - static LIST_HEAD(ssc_list); - - struct ssc_device *ssc_request(unsigned int ssc_num) -@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num) - int ssc_valid = 0; - struct ssc_device *ssc; - -- spin_lock(&user_lock); -+ mutex_lock(&user_lock); - list_for_each_entry(ssc, &ssc_list, list) { - if (ssc->pdev->dev.of_node) { - if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc") -@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned int ssc_num) - } - - if (!ssc_valid) { -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - pr_err("ssc: ssc%d platform device is missing\n", ssc_num); - return ERR_PTR(-ENODEV); - } - - if (ssc->user) { -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - dev_dbg(&ssc->pdev->dev, "module busy\n"); - return ERR_PTR(-EBUSY); - } - ssc->user++; -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - - clk_prepare(ssc->clk); - -@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc) - { - bool disable_clk = true; - -- spin_lock(&user_lock); -+ mutex_lock(&user_lock); - if (ssc->user) - ssc->user--; - else { - disable_clk = false; - dev_dbg(&ssc->pdev->dev, "device already free\n"); - } -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - - if (disable_clk) - clk_unprepare(ssc->clk); -@@ -194,9 +194,9 @@ static int ssc_probe(struct platform_device *pdev) - return -ENXIO; - } - -- spin_lock(&user_lock); -+ mutex_lock(&user_lock); - list_add_tail(&ssc->list, &ssc_list); -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - - platform_set_drvdata(pdev, ssc); - -@@ -210,9 +210,9 @@ static int ssc_remove(struct platform_device *pdev) - { - struct ssc_device *ssc = platform_get_drvdata(pdev); - -- spin_lock(&user_lock); -+ mutex_lock(&user_lock); - list_del(&ssc->list); -- spin_unlock(&user_lock); -+ mutex_unlock(&user_lock); - - return 0; - } -diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c -index 864c2dc728a9..4457adb16916 100644 ---- a/drivers/misc/mei/bus.c -+++ b/drivers/misc/mei/bus.c -@@ -626,9 +626,8 @@ static int mei_cl_device_remove(struct device *dev) - ret = cldrv->remove(cldev); - - module_put(THIS_MODULE); -- dev->driver = NULL; -- return ret; - -+ return ret; - } - - static ssize_t name_show(struct device *dev, struct device_attribute *a, -diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c -index d125d19a35e4..8278158715c1 100644 ---- a/drivers/mtd/nand/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/brcmnand/brcmnand.c -@@ -455,8 +455,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl) - } else { - ctrl->cs_offsets = brcmnand_cs_offsets; - -- /* v5.0 and earlier has a different CS0 offset layout */ -- if (ctrl->nand_version <= 0x0500) -+ /* v3.3-5.0 have a different CS0 offset layout */ -+ if (ctrl->nand_version >= 0x0303 && -+ ctrl->nand_version <= 0x0500) - ctrl->cs0_offsets = brcmnand_cs_offsets_cs0; - } - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c -index 3eebb57975e3..dd2c64e2db5c 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c -@@ -295,6 +295,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp) - } - } - -+ bp->pf.active_vfs = 0; - kfree(bp->pf.vf); - bp->pf.vf = NULL; - } -@@ -535,7 +536,6 @@ void bnxt_sriov_disable(struct bnxt *bp) - - bnxt_free_vf_resources(bp); - -- bp->pf.active_vfs = 0; - bp->pf.max_pf_rx_rings = bp->pf.max_rx_rings; - bp->pf.max_pf_tx_rings = bp->pf.max_tx_rings; - } -diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -index fd6492fd3dc0..9d07fa318ac3 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -@@ -3093,7 +3093,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, - drv_fw = &fw_info->fw_hdr; - - /* Read the header of the firmware on the card */ -- ret = -t4_read_flash(adap, FLASH_FW_START, -+ ret = t4_read_flash(adap, FLASH_FW_START, - sizeof(*card_fw) / sizeof(uint32_t), - (uint32_t *)card_fw, 1); - if (ret == 0) { -@@ -3122,8 +3122,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, - should_install_fs_fw(adap, card_fw_usable, - be32_to_cpu(fs_fw->fw_ver), - be32_to_cpu(card_fw->fw_ver))) { -- ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, -- fw_size, 0); -+ ret = t4_fw_upgrade(adap, adap->mbox, fw_data, -+ fw_size, 0); - if (ret != 0) { - dev_err(adap->pdev_dev, - "failed to install firmware: %d\n", ret); -@@ -3154,7 +3154,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, - FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), - FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), - FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); -- ret = EINVAL; -+ ret = -EINVAL; - goto bye; - } - -diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c -index b6b8aec73b28..e4299852974e 100644 ---- a/drivers/net/usb/smsc95xx.c -+++ b/drivers/net/usb/smsc95xx.c -@@ -1136,11 +1136,14 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) - - /* Init all registers */ - ret = smsc95xx_reset(dev); -+ if (ret) -+ goto free_pdata; - - /* detect device revision as different features may be available */ - ret = smsc95xx_read_reg(dev, ID_REV, &val); - if (ret < 0) -- return ret; -+ goto free_pdata; -+ - val >>= 16; - - if ((val == ID_REV_CHIP_ID_9500A_) || (val == ID_REV_CHIP_ID_9530_) || -@@ -1157,6 +1160,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) - dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM; - dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; - return 0; -+ -+free_pdata: -+ kfree(pdata); -+ return ret; - } - - static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c -index e51f1a577897..e2ed30b03af5 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.c -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c -@@ -639,9 +639,9 @@ err: - - static void ath9k_hif_usb_rx_cb(struct urb *urb) - { -- struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -- struct hif_device_usb *hif_dev = rx_buf->hif_dev; -- struct sk_buff *skb = rx_buf->skb; -+ struct sk_buff *skb = (struct sk_buff *) urb->context; -+ struct hif_device_usb *hif_dev = -+ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); - int ret; - - if (!skb) -@@ -681,15 +681,14 @@ resubmit: - return; - free: - kfree_skb(skb); -- kfree(rx_buf); - } - - static void ath9k_hif_usb_reg_in_cb(struct urb *urb) - { -- struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -- struct hif_device_usb *hif_dev = rx_buf->hif_dev; -- struct sk_buff *skb = rx_buf->skb; -+ struct sk_buff *skb = (struct sk_buff *) urb->context; - struct sk_buff *nskb; -+ struct hif_device_usb *hif_dev = -+ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); - int ret; - - if (!skb) -@@ -747,7 +746,6 @@ resubmit: - return; - free: - kfree_skb(skb); -- kfree(rx_buf); - urb->context = NULL; - } - -@@ -793,7 +791,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) - init_usb_anchor(&hif_dev->mgmt_submitted); - - for (i = 0; i < MAX_TX_URB_NUM; i++) { -- tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL); -+ tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL); - if (!tx_buf) - goto err; - -@@ -830,9 +828,8 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) - - static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - { -- struct rx_buf *rx_buf = NULL; -- struct sk_buff *skb = NULL; - struct urb *urb = NULL; -+ struct sk_buff *skb = NULL; - int i, ret; - - init_usb_anchor(&hif_dev->rx_submitted); -@@ -840,12 +837,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - - for (i = 0; i < MAX_RX_URB_NUM; i++) { - -- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); -- if (!rx_buf) { -- ret = -ENOMEM; -- goto err_rxb; -- } -- - /* Allocate URB */ - urb = usb_alloc_urb(0, GFP_KERNEL); - if (urb == NULL) { -@@ -860,14 +851,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - goto err_skb; - } - -- rx_buf->hif_dev = hif_dev; -- rx_buf->skb = skb; -- - usb_fill_bulk_urb(urb, hif_dev->udev, - usb_rcvbulkpipe(hif_dev->udev, - USB_WLAN_RX_PIPE), - skb->data, MAX_RX_BUF_SIZE, -- ath9k_hif_usb_rx_cb, rx_buf); -+ ath9k_hif_usb_rx_cb, skb); - - /* Anchor URB */ - usb_anchor_urb(urb, &hif_dev->rx_submitted); -@@ -893,8 +881,6 @@ err_submit: - err_skb: - usb_free_urb(urb); - err_urb: -- kfree(rx_buf); --err_rxb: - ath9k_hif_usb_dealloc_rx_urbs(hif_dev); - return ret; - } -@@ -906,21 +892,14 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev) - - static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) - { -- struct rx_buf *rx_buf = NULL; -- struct sk_buff *skb = NULL; - struct urb *urb = NULL; -+ struct sk_buff *skb = NULL; - int i, ret; - - init_usb_anchor(&hif_dev->reg_in_submitted); - - for (i = 0; i < MAX_REG_IN_URB_NUM; i++) { - -- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); -- if (!rx_buf) { -- ret = -ENOMEM; -- goto err_rxb; -- } -- - /* Allocate URB */ - urb = usb_alloc_urb(0, GFP_KERNEL); - if (urb == NULL) { -@@ -935,14 +914,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) - goto err_skb; - } - -- rx_buf->hif_dev = hif_dev; -- rx_buf->skb = skb; -- - usb_fill_int_urb(urb, hif_dev->udev, - usb_rcvintpipe(hif_dev->udev, - USB_REG_IN_PIPE), - skb->data, MAX_REG_IN_BUF_SIZE, -- ath9k_hif_usb_reg_in_cb, rx_buf, 1); -+ ath9k_hif_usb_reg_in_cb, skb, 1); - - /* Anchor URB */ - usb_anchor_urb(urb, &hif_dev->reg_in_submitted); -@@ -968,8 +944,6 @@ err_submit: - err_skb: - usb_free_urb(urb); - err_urb: -- kfree(rx_buf); --err_rxb: - ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); - return ret; - } -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h -index 835264c36595..a95cdf562611 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.h -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h -@@ -84,11 +84,6 @@ struct tx_buf { - struct list_head list; - }; - --struct rx_buf { -- struct sk_buff *skb; -- struct hif_device_usb *hif_dev; --}; -- - #define HIF_USB_TX_STOP BIT(0) - #define HIF_USB_TX_FLUSH BIT(1) - -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index 3709088d4d24..7969f5484aee 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -635,15 +635,20 @@ err_find_dev: - static int spidev_release(struct inode *inode, struct file *filp) - { - struct spidev_data *spidev; -+ int dofree; - - mutex_lock(&device_list_lock); - spidev = filp->private_data; - filp->private_data = NULL; - -+ spin_lock_irq(&spidev->spi_lock); -+ /* ... after we unbound from the underlying device? */ -+ dofree = (spidev->spi == NULL); -+ spin_unlock_irq(&spidev->spi_lock); -+ - /* last close? */ - spidev->users--; - if (!spidev->users) { -- int dofree; - - kfree(spidev->tx_buffer); - spidev->tx_buffer = NULL; -@@ -651,19 +656,14 @@ static int spidev_release(struct inode *inode, struct file *filp) - kfree(spidev->rx_buffer); - spidev->rx_buffer = NULL; - -- spin_lock_irq(&spidev->spi_lock); -- if (spidev->spi) -- spidev->speed_hz = spidev->spi->max_speed_hz; -- -- /* ... after we unbound from the underlying device? */ -- dofree = (spidev->spi == NULL); -- spin_unlock_irq(&spidev->spi_lock); -- - if (dofree) - kfree(spidev); -+ else -+ spidev->speed_hz = spidev->spi->max_speed_hz; - } - #ifdef CONFIG_SPI_SLAVE -- spi_slave_abort(spidev->spi); -+ if (!dofree) -+ spi_slave_abort(spidev->spi); - #endif - mutex_unlock(&device_list_lock); - -@@ -769,13 +769,13 @@ static int spidev_remove(struct spi_device *spi) - { - struct spidev_data *spidev = spi_get_drvdata(spi); - -+ /* prevent new opens */ -+ mutex_lock(&device_list_lock); - /* make sure ops on existing fds can abort cleanly */ - spin_lock_irq(&spidev->spi_lock); - spidev->spi = NULL; - spin_unlock_irq(&spidev->spi_lock); - -- /* prevent new opens */ -- mutex_lock(&device_list_lock); - list_del(&spidev->device_entry); - device_destroy(spidev_class, spidev->devt); - clear_bit(MINOR(spidev->devt), minors); -diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c -index 63991c49ff23..79a8799b1262 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1500.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c -@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, - unsigned int lo_mask = data[5] << shift; - unsigned int chan_mask = hi_mask | lo_mask; - unsigned int old_mask = (1 << shift) - 1; -- unsigned int pm = devpriv->pm[trig] & old_mask; -- unsigned int pt = devpriv->pt[trig] & old_mask; -- unsigned int pp = devpriv->pp[trig] & old_mask; -+ unsigned int pm; -+ unsigned int pt; -+ unsigned int pp; - - if (trig > 1) { - dev_dbg(dev->class_dev, -@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, - return -EINVAL; - } - -+ pm = devpriv->pm[trig] & old_mask; -+ pt = devpriv->pt[trig] & old_mask; -+ pp = devpriv->pp[trig] & old_mask; -+ - switch (data[2]) { - case COMEDI_DIGITAL_TRIG_DISABLE: - /* clear trigger configuration */ -diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c -index f598ecddc8a7..b58a504240c4 100644 ---- a/drivers/uio/uio_pdrv_genirq.c -+++ b/drivers/uio/uio_pdrv_genirq.c -@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev) - if (!uioinfo->irq) { - ret = platform_get_irq(pdev, 0); - uioinfo->irq = ret; -- if (ret == -ENXIO && pdev->dev.of_node) -+ if (ret == -ENXIO) - uioinfo->irq = UIO_IRQ_NONE; - else if (ret < 0) { - dev_err(&pdev->dev, "failed to get IRQ\n"); -diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c -index 7311ed61e99a..029c8bc54b7a 100644 ---- a/drivers/usb/c67x00/c67x00-sched.c -+++ b/drivers/usb/c67x00/c67x00-sched.c -@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status) - c67x00_release_urb(c67x00, urb); - usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); - spin_unlock(&c67x00->lock); -- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); -+ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status); - spin_lock(&c67x00->lock); - } - -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index dee22d8effda..e104c99b3a1f 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -1122,6 +1122,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci) - enable_irq(ci->irq); - } - -+/* -+ * Handle the wakeup interrupt triggered by extcon connector -+ * We need to call ci_irq again for extcon since the first -+ * interrupt (wakeup int) only let the controller be out of -+ * low power mode, but not handle any interrupts. -+ */ -+static void ci_extcon_wakeup_int(struct ci_hdrc *ci) -+{ -+ struct ci_hdrc_cable *cable_id, *cable_vbus; -+ u32 otgsc = hw_read_otgsc(ci, ~0); -+ -+ cable_id = &ci->platdata->id_extcon; -+ cable_vbus = &ci->platdata->vbus_extcon; -+ -+ if (!IS_ERR(cable_id->edev) && ci->is_otg && -+ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) -+ ci_irq(ci->irq, ci); -+ -+ if (!IS_ERR(cable_vbus->edev) && ci->is_otg && -+ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) -+ ci_irq(ci->irq, ci); -+} -+ - static int ci_controller_resume(struct device *dev) - { - struct ci_hdrc *ci = dev_get_drvdata(dev); -@@ -1148,6 +1171,7 @@ static int ci_controller_resume(struct device *dev) - enable_irq(ci->irq); - if (ci_otg_is_fsm_mode(ci)) - ci_otg_fsm_wakeup_by_srp(ci); -+ ci_extcon_wakeup_int(ci); - } - - return 0; -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index d6fcead91b32..c095cde55329 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -185,6 +185,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); - - /*-------------------------------------------------------------------*/ - -+static const int pipetypes[4] = { -+ PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT -+}; -+ -+/** -+ * usb_urb_ep_type_check - sanity check of endpoint in the given urb -+ * @urb: urb to be checked -+ * -+ * This performs a light-weight sanity check for the endpoint in the -+ * given urb. It returns 0 if the urb contains a valid endpoint, otherwise -+ * a negative error code. -+ */ -+int usb_urb_ep_type_check(const struct urb *urb) -+{ -+ const struct usb_host_endpoint *ep; -+ -+ ep = usb_pipe_endpoint(urb->dev, urb->pipe); -+ if (!ep) -+ return -EINVAL; -+ if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) -+ return -EINVAL; -+ return 0; -+} -+EXPORT_SYMBOL_GPL(usb_urb_ep_type_check); -+ - /** - * usb_submit_urb - issue an asynchronous transfer request for an endpoint - * @urb: pointer to the urb describing the request -@@ -324,9 +349,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); - */ - int usb_submit_urb(struct urb *urb, gfp_t mem_flags) - { -- static int pipetypes[4] = { -- PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT -- }; - int xfertype, max; - struct usb_device *dev; - struct usb_host_endpoint *ep; -@@ -445,7 +467,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) - */ - - /* Check that the pipe's type matches the endpoint's type */ -- if (usb_pipetype(urb->pipe) != pipetypes[xfertype]) -+ if (usb_urb_ep_type_check(urb)) - dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", - usb_pipetype(urb->pipe), pipetypes[xfertype]); - -diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c -index 56200650b46b..bd7082f297bb 100644 ---- a/drivers/usb/host/ehci-platform.c -+++ b/drivers/usb/host/ehci-platform.c -@@ -375,11 +375,6 @@ static int ehci_platform_resume(struct device *dev) - } - - ehci_resume(hcd, priv->reset_on_resume); -- -- pm_runtime_disable(dev); -- pm_runtime_set_active(dev); -- pm_runtime_enable(dev); -- - return 0; - } - #endif /* CONFIG_PM_SLEEP */ -diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c -index 0e5580e6f35c..c2669f185f65 100644 ---- a/drivers/usb/host/ohci-platform.c -+++ b/drivers/usb/host/ohci-platform.c -@@ -339,11 +339,6 @@ static int ohci_platform_resume(struct device *dev) - } - - ohci_resume(hcd, false); -- -- pm_runtime_disable(dev); -- pm_runtime_set_active(dev); -- pm_runtime_enable(dev); -- - return 0; - } - #endif /* CONFIG_PM_SLEEP */ -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 510fb7853f92..c4c40e9d4247 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -249,17 +249,8 @@ static int xhci_plat_resume(struct device *dev) - { - struct usb_hcd *hcd = dev_get_drvdata(dev); - struct xhci_hcd *xhci = hcd_to_xhci(hcd); -- int ret; -- -- ret = xhci_resume(xhci, 0); -- if (ret) -- return ret; - -- pm_runtime_disable(dev); -- pm_runtime_set_active(dev); -- pm_runtime_enable(dev); -- -- return 0; -+ return xhci_resume(xhci, 0); - } - - static const struct dev_pm_ops xhci_plat_pm_ops = { -diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c -index e8a8c4fa944f..3ec59c2b4f65 100644 ---- a/drivers/usb/serial/ch341.c -+++ b/drivers/usb/serial/ch341.c -@@ -71,6 +71,7 @@ - - static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x4348, 0x5523) }, -+ { USB_DEVICE(0x1a86, 0x7522) }, - { USB_DEVICE(0x1a86, 0x7523) }, - { USB_DEVICE(0x1a86, 0x5523) }, - { }, -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index e92cd1eceefa..2c6587b5c329 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -63,6 +63,7 @@ static const struct usb_device_id id_table_earthmate[] = { - - static const struct usb_device_id id_table_cyphidcomrs232[] = { - { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, -+ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, - { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, - { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, - { } /* Terminating entry */ -@@ -77,6 +78,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, - { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, - { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, -+ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, - { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, - { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, - { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) }, -diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h -index 119d2e17077b..6d9820bffc20 100644 ---- a/drivers/usb/serial/cypress_m8.h -+++ b/drivers/usb/serial/cypress_m8.h -@@ -24,6 +24,9 @@ - #define VENDOR_ID_CYPRESS 0x04b4 - #define PRODUCT_ID_CYPHIDCOM 0x5500 - -+/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ -+#define VENDOR_ID_SAI 0x17dd -+ - /* FRWD Dongle - a GPS sports watch */ - #define VENDOR_ID_FRWD 0x6737 - #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001 -diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c -index 7ed7d33d6c10..1a966f25b3ef 100644 ---- a/drivers/usb/serial/iuu_phoenix.c -+++ b/drivers/usb/serial/iuu_phoenix.c -@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct usb_serial_port *port, - struct iuu_private *priv = usb_get_serial_port_data(port); - unsigned long flags; - -- if (count > 256) -- return -ENOMEM; -- - spin_lock_irqsave(&priv->lock, flags); - -+ count = min(count, 256 - priv->writelen); -+ if (count == 0) -+ goto out; -+ - /* fill the buffer */ - memcpy(priv->writebuf + priv->writelen, buf, count); - priv->writelen += count; -+out: - spin_unlock_irqrestore(&priv->lock, flags); - - return count; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 326e7109b8f8..52b1092ed57e 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -248,6 +248,7 @@ static void option_instat_callback(struct urb *urb); - /* These Quectel products use Quectel's vendor ID */ - #define QUECTEL_PRODUCT_EC21 0x0121 - #define QUECTEL_PRODUCT_EC25 0x0125 -+#define QUECTEL_PRODUCT_EG95 0x0195 - #define QUECTEL_PRODUCT_BG96 0x0296 - #define QUECTEL_PRODUCT_EP06 0x0306 - -@@ -1095,6 +1096,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), - .driver_info = RSVD(4) }, -+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), -+ .driver_info = RSVD(4) }, - { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), - .driver_info = RSVD(4) }, - { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), -@@ -2019,6 +2022,9 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) | RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ - .driver_info = RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ -+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ -+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 2c86c472f670..42b7409d4cc5 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4861,25 +4861,28 @@ err: - static void check_buffer_tree_ref(struct extent_buffer *eb) - { - int refs; -- /* the ref bit is tricky. We have to make sure it is set -- * if we have the buffer dirty. Otherwise the -- * code to free a buffer can end up dropping a dirty -- * page -+ /* -+ * The TREE_REF bit is first set when the extent_buffer is added -+ * to the radix tree. It is also reset, if unset, when a new reference -+ * is created by find_extent_buffer. - * -- * Once the ref bit is set, it won't go away while the -- * buffer is dirty or in writeback, and it also won't -- * go away while we have the reference count on the -- * eb bumped. -+ * It is only cleared in two cases: freeing the last non-tree -+ * reference to the extent_buffer when its STALE bit is set or -+ * calling releasepage when the tree reference is the only reference. - * -- * We can't just set the ref bit without bumping the -- * ref on the eb because free_extent_buffer might -- * see the ref bit and try to clear it. If this happens -- * free_extent_buffer might end up dropping our original -- * ref by mistake and freeing the page before we are able -- * to add one more ref. -+ * In both cases, care is taken to ensure that the extent_buffer's -+ * pages are not under io. However, releasepage can be concurrently -+ * called with creating new references, which is prone to race -+ * conditions between the calls to check_buffer_tree_ref in those -+ * codepaths and clearing TREE_REF in try_release_extent_buffer. - * -- * So bump the ref count first, then set the bit. If someone -- * beat us to it, drop the ref we added. -+ * The actual lifetime of the extent_buffer in the radix tree is -+ * adequately protected by the refcount, but the TREE_REF bit and -+ * its corresponding reference are not. To protect against this -+ * class of races, we call check_buffer_tree_ref from the codepaths -+ * which trigger io after they set eb->io_pages. Note that once io is -+ * initiated, TREE_REF can no longer be cleared, so that is the -+ * moment at which any such race is best fixed. - */ - refs = atomic_read(&eb->refs); - if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) -@@ -5346,6 +5349,11 @@ int read_extent_buffer_pages(struct extent_io_tree *tree, - clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags); - eb->read_mirror = 0; - atomic_set(&eb->io_pages, num_reads); -+ /* -+ * It is possible for releasepage to clear the TREE_REF bit before we -+ * set io_pages. See check_buffer_tree_ref for a more detailed comment. -+ */ -+ check_buffer_tree_ref(eb); - for (i = start_i; i < num_pages; i++) { - page = eb->pages[i]; - if (!PageUptodate(page)) { -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 6ce6754168e0..f7d025d1684c 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - static const struct file_operations fuse_direct_io_file_operations; - -@@ -2517,7 +2518,16 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, - struct iovec *iov = iov_page; - - iov->iov_base = (void __user *)arg; -- iov->iov_len = _IOC_SIZE(cmd); -+ -+ switch (cmd) { -+ case FS_IOC_GETFLAGS: -+ case FS_IOC_SETFLAGS: -+ iov->iov_len = sizeof(int); -+ break; -+ default: -+ iov->iov_len = _IOC_SIZE(cmd); -+ break; -+ } - - if (_IOC_DIR(cmd) & _IOC_WRITE) { - in_iov = iov; -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 02bffcc611c3..55ea5d625cdf 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(struct urb *urb) - return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT; - } - -+int usb_urb_ep_type_check(const struct urb *urb); -+ - void *usb_alloc_coherent(struct usb_device *dev, size_t size, - gfp_t mem_flags, dma_addr_t *dma); - void usb_free_coherent(struct usb_device *dev, size_t size, -diff --git a/include/net/dst.h b/include/net/dst.h -index 2e6e3a14a21a..dc1f26da3c61 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -470,7 +470,15 @@ static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, co - static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst, - struct sk_buff *skb) - { -- struct neighbour *n = dst->ops->neigh_lookup(dst, skb, NULL); -+ struct neighbour *n = NULL; -+ -+ /* The packets from tunnel devices (eg bareudp) may have only -+ * metadata in the dst pointer of skb. Hence a pointer check of -+ * neigh_lookup is needed. -+ */ -+ if (dst->ops->neigh_lookup) -+ n = dst->ops->neigh_lookup(dst, skb, NULL); -+ - return IS_ERR(n) ? NULL : n; - } - -diff --git a/include/net/genetlink.h b/include/net/genetlink.h -index 43c0e771f417..351766331519 100644 ---- a/include/net/genetlink.h -+++ b/include/net/genetlink.h -@@ -33,12 +33,6 @@ struct genl_info; - * do additional, common, filtering and return an error - * @post_doit: called after an operation's doit callback, it may - * undo operations done by pre_doit, for example release locks -- * @mcast_bind: a socket bound to the given multicast group (which -- * is given as the offset into the groups array) -- * @mcast_unbind: a socket was unbound from the given multicast group. -- * Note that unbind() will not be called symmetrically if the -- * generic netlink family is removed while there are still open -- * sockets. - * @attrbuf: buffer to store parsed attributes - * @family_list: family list - * @mcgrps: multicast groups used by this family (private) -@@ -61,8 +55,6 @@ struct genl_family { - void (*post_doit)(const struct genl_ops *ops, - struct sk_buff *skb, - struct genl_info *info); -- int (*mcast_bind)(struct net *net, int group); -- void (*mcast_unbind)(struct net *net, int group); - struct nlattr ** attrbuf; /* private */ - const struct genl_ops * ops; /* private */ - const struct genl_multicast_group *mcgrps; /* private */ -diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h -index a5c6e6da3d3d..57872c8f1151 100644 ---- a/include/sound/compress_driver.h -+++ b/include/sound/compress_driver.h -@@ -71,6 +71,7 @@ struct snd_compr_runtime { - * @direction: stream direction, playback/recording - * @metadata_set: metadata set flag, true when set - * @next_track: has userspace signal next track transition, true when set -+ * @partial_drain: undergoing partial_drain for stream, true when set - * @private_data: pointer to DSP private data - */ - struct snd_compr_stream { -@@ -81,6 +82,7 @@ struct snd_compr_stream { - enum snd_compr_direction direction; - bool metadata_set; - bool next_track; -+ bool partial_drain; - void *private_data; - }; - -@@ -178,7 +180,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) - if (snd_BUG_ON(!stream)) - return; - -- stream->runtime->state = SNDRV_PCM_STATE_SETUP; -+ /* for partial_drain case we are back to running state on success */ -+ if (stream->partial_drain) { -+ stream->runtime->state = SNDRV_PCM_STATE_RUNNING; -+ stream->partial_drain = false; /* clear this flag as well */ -+ } else { -+ stream->runtime->state = SNDRV_PCM_STATE_SETUP; -+ } - - wake_up(&stream->runtime->sleep); - } -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 971e31e47bfd..15952d0e340b 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -5939,7 +5939,15 @@ static int detach_tasks(struct lb_env *env) - if (!can_migrate_task(p, env)) - goto next; - -- load = task_h_load(p); -+ /* -+ * Depending of the number of CPUs and tasks and the -+ * cgroup hierarchy, task_h_load() can return a null -+ * value. Make sure that env->imbalance decreases -+ * otherwise detach_tasks() will stop only after -+ * detaching up to loop_max tasks. -+ */ -+ load = max_t(unsigned long, task_h_load(p), 1); -+ - - if (sched_feat(LB_MIN) && load < 16 && !env->sd->nr_balance_failed) - goto next; -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 82c878224bfc..a3abd136b8e7 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -802,6 +802,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - RT_SCOPE_UNIVERSE, sk->sk_protocol, - inet_sk_flowi_flags(sk), faddr, saddr, 0, 0); - -+ fl4.fl4_icmp_type = user_icmph.type; -+ fl4.fl4_icmp_code = user_icmph.code; -+ - security_sk_classify_flow(sk, flowi4_to_flowi(&fl4)); - rt = ip_route_output_flow(net, &fl4, sk); - if (IS_ERR(rt)) { -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 2ceda7ddaed5..4080cf1a369d 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2259,6 +2259,9 @@ int tcp_disconnect(struct sock *sk, int flags) - tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; - tp->snd_cwnd_cnt = 0; - tp->window_clamp = 0; -+ if (icsk->icsk_ca_ops->release) -+ icsk->icsk_ca_ops->release(sk); -+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); - tcp_set_ca_state(sk, TCP_CA_Open); - tcp_clear_retrans(tp); - tp->total_retrans = 0; -@@ -2593,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - - #ifdef CONFIG_TCP_MD5SIG - case TCP_MD5SIG: -- if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) -- err = tp->af_specific->md5_parse(sk, optval, optlen); -- else -- err = -EINVAL; -+ err = tp->af_specific->md5_parse(sk, optval, optlen); - break; - #endif - case TCP_USER_TIMEOUT: -@@ -3085,9 +3085,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data); - - int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key) - { -+ u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */ - struct scatterlist sg; - -- sg_init_one(&sg, key->key, key->keylen); -+ sg_init_one(&sg, key->key, keylen); -+ -+ /* tcp_md5_do_add() might change key->key under us */ - return crypto_hash_update(&hp->md5_desc, &sg, key->keylen); - } - EXPORT_SYMBOL(tcp_md5_hash_key); -diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c -index aafe68134763..f6b64efc22e8 100644 ---- a/net/ipv4/tcp_cong.c -+++ b/net/ipv4/tcp_cong.c -@@ -201,7 +201,7 @@ static void tcp_reinit_congestion_control(struct sock *sk, - icsk->icsk_ca_ops = ca; - icsk->icsk_ca_setsockopt = 1; - -- if (sk->sk_state != TCP_CLOSE) -+ if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) - tcp_init_congestion_control(sk); - } - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 12d4d2758caf..3826745a160e 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -931,9 +931,18 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, - - key = tcp_md5_do_lookup(sk, addr, family); - if (key) { -- /* Pre-existing entry - just update that one. */ -+ /* Pre-existing entry - just update that one. -+ * Note that the key might be used concurrently. -+ */ - memcpy(key->key, newkey, newkeylen); -- key->keylen = newkeylen; -+ -+ /* Pairs with READ_ONCE() in tcp_md5_hash_key(). -+ * Also note that a reader could catch new key->keylen value -+ * but old key->key[], this is the reason we use __GFP_ZERO -+ * at sock_kmalloc() time below these lines. -+ */ -+ WRITE_ONCE(key->keylen, newkeylen); -+ - return 0; - } - -@@ -950,7 +959,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, - rcu_assign_pointer(tp->md5sig_info, md5sig); - } - -- key = sock_kmalloc(sk, sizeof(*key), gfp); -+ key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO); - if (!key) - return -ENOMEM; - if (!tcp_alloc_md5sig_pool()) { -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 53c53b1c881c..653892ea8f14 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1139,6 +1139,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, - - /* Queue the packet to IP for output */ - skb->ignore_df = 1; -+ skb_dst_drop(skb); - #if IS_ENABLED(CONFIG_IPV6) - if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped) - error = inet6_csk_xmit(tunnel->sock, skb, NULL); -@@ -1203,10 +1204,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len - goto out_unlock; - } - -- /* Get routing info from the tunnel socket */ -- skb_dst_drop(skb); -- skb_dst_set(skb, sk_dst_check(sk, 0)); -- - inet = inet_sk(sk); - fl = &inet->cork.fl; - switch (tunnel->encap) { -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 69f1558dfcb7..f613a1007107 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) - - if (!sock_flag(sk, SOCK_ZAPPED)) - goto out; -+ if (!addr->sllc_arphrd) -+ addr->sllc_arphrd = ARPHRD_ETHER; -+ if (addr->sllc_arphrd != ARPHRD_ETHER) -+ goto out; - rc = -ENODEV; - if (sk->sk_bound_dev_if) { - llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); -@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) - if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) - goto out; - rc = -EAFNOSUPPORT; -- if (unlikely(addr->sllc_family != AF_LLC)) -+ if (!addr->sllc_arphrd) -+ addr->sllc_arphrd = ARPHRD_ETHER; -+ if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER)) - goto out; - rc = -ENODEV; - rcu_read_lock(); - if (sk->sk_bound_dev_if) { - llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); - if (llc->dev) { -- if (!addr->sllc_arphrd) -- addr->sllc_arphrd = llc->dev->type; - if (is_zero_ether_addr(addr->sllc_mac)) - memcpy(addr->sllc_mac, llc->dev->dev_addr, - IFHWADDRLEN); -diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c -index d681dbaf00c1..3fc00c320a9f 100644 ---- a/net/netlink/genetlink.c -+++ b/net/netlink/genetlink.c -@@ -1007,63 +1007,11 @@ static struct genl_multicast_group genl_ctrl_groups[] = { - { .name = "notify", }, - }; - --static int genl_bind(struct net *net, int group) --{ -- int i, err = -ENOENT; -- -- down_read(&cb_lock); -- for (i = 0; i < GENL_FAM_TAB_SIZE; i++) { -- struct genl_family *f; -- -- list_for_each_entry(f, genl_family_chain(i), family_list) { -- if (group >= f->mcgrp_offset && -- group < f->mcgrp_offset + f->n_mcgrps) { -- int fam_grp = group - f->mcgrp_offset; -- -- if (!f->netnsok && net != &init_net) -- err = -ENOENT; -- else if (f->mcast_bind) -- err = f->mcast_bind(net, fam_grp); -- else -- err = 0; -- break; -- } -- } -- } -- up_read(&cb_lock); -- -- return err; --} -- --static void genl_unbind(struct net *net, int group) --{ -- int i; -- -- down_read(&cb_lock); -- for (i = 0; i < GENL_FAM_TAB_SIZE; i++) { -- struct genl_family *f; -- -- list_for_each_entry(f, genl_family_chain(i), family_list) { -- if (group >= f->mcgrp_offset && -- group < f->mcgrp_offset + f->n_mcgrps) { -- int fam_grp = group - f->mcgrp_offset; -- -- if (f->mcast_unbind) -- f->mcast_unbind(net, fam_grp); -- break; -- } -- } -- } -- up_read(&cb_lock); --} -- - static int __net_init genl_pernet_init(struct net *net) - { - struct netlink_kernel_cfg cfg = { - .input = genl_rcv, - .flags = NL_CFG_F_NONROOT_RECV, -- .bind = genl_bind, -- .unbind = genl_unbind, - }; - - /* we'll bump the group number right afterwards */ -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 07f5017cbea2..e788c7e1929b 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -699,6 +699,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) - - retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); - if (!retval) { -+ /* clear flags and stop any drain wait */ -+ stream->partial_drain = false; -+ stream->metadata_set = false; - snd_compr_drain_notify(stream); - stream->runtime->total_bytes_available = 0; - stream->runtime->total_bytes_transferred = 0; -@@ -809,6 +812,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) - if (stream->next_track == false) - return -EPERM; - -+ stream->partial_drain = true; - retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN); - if (retval) { - pr_debug("Partial drain returned failure\n"); -diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c -index 42920a243328..3f94746d587a 100644 ---- a/sound/drivers/opl3/opl3_synth.c -+++ b/sound/drivers/opl3/opl3_synth.c -@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw, struct file *file, - { - struct snd_dm_fm_info info; - -+ memset(&info, 0, sizeof(info)); -+ - info.fm_mode = opl3->fm_mode; - info.rhythm = opl3->rhythm; - if (copy_to_user(argp, &info, sizeof(struct snd_dm_fm_info))) -diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c -index 12d87204e373..7ac92d188f4f 100644 ---- a/sound/pci/hda/hda_auto_parser.c -+++ b/sound/pci/hda/hda_auto_parser.c -@@ -76,6 +76,12 @@ static int compare_input_type(const void *ap, const void *bp) - if (a->type != b->type) - return (int)(a->type - b->type); - -+ /* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */ -+ if (a->is_headset_mic && b->is_headphone_mic) -+ return -1; /* don't swap */ -+ else if (a->is_headphone_mic && b->is_headset_mic) -+ return 1; /* swap */ -+ - /* In case one has boost and the other one has not, - pick the one with boost first. */ - return (int)(b->has_boost_on_pin - a->has_boost_on_pin); -diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c -index f518fbbe88de..4250d26166a0 100644 ---- a/sound/usb/line6/capture.c -+++ b/sound/usb/line6/capture.c -@@ -269,6 +269,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) - urb->interval = LINE6_ISO_INTERVAL; - urb->error_count = 0; - urb->complete = audio_in_callback; -+ if (usb_urb_ep_type_check(urb)) -+ return -EINVAL; - } - - return 0; -diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c -index 97ed593f6010..500f0b455be9 100644 ---- a/sound/usb/line6/playback.c -+++ b/sound/usb/line6/playback.c -@@ -423,6 +423,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm) - urb->interval = LINE6_ISO_INTERVAL; - urb->error_count = 0; - urb->complete = audio_out_callback; -+ if (usb_urb_ep_type_check(urb)) -+ return -EINVAL; - } - - return 0; -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index b21b76690b31..5c4a3d6c4234 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -1475,6 +1475,8 @@ void snd_usbmidi_disconnect(struct list_head *p) - spin_unlock_irq(&umidi->disc_lock); - up_write(&umidi->disc_rwsem); - -+ del_timer_sync(&umidi->error_timer); -+ - for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { - struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; - if (ep->out) -@@ -1501,7 +1503,6 @@ void snd_usbmidi_disconnect(struct list_head *p) - ep->in = NULL; - } - } -- del_timer_sync(&umidi->error_timer); - } - EXPORT_SYMBOL(snd_usbmidi_disconnect); - -@@ -2258,16 +2259,22 @@ void snd_usbmidi_input_stop(struct list_head *p) - } - EXPORT_SYMBOL(snd_usbmidi_input_stop); - --static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) -+static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, -+ struct snd_usb_midi_in_endpoint *ep) - { - unsigned int i; -+ unsigned long flags; - - if (!ep) - return; - for (i = 0; i < INPUT_URBS; ++i) { - struct urb *urb = ep->urbs[i]; -- urb->dev = ep->umidi->dev; -- snd_usbmidi_submit_urb(urb, GFP_KERNEL); -+ spin_lock_irqsave(&umidi->disc_lock, flags); -+ if (!atomic_read(&urb->use_count)) { -+ urb->dev = ep->umidi->dev; -+ snd_usbmidi_submit_urb(urb, GFP_ATOMIC); -+ } -+ spin_unlock_irqrestore(&umidi->disc_lock, flags); - } - } - -@@ -2283,7 +2290,7 @@ void snd_usbmidi_input_start(struct list_head *p) - if (umidi->input_running || !umidi->opened[1]) - return; - for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) -- snd_usbmidi_input_start_ep(umidi->endpoints[i].in); -+ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); - umidi->input_running = 1; - } - EXPORT_SYMBOL(snd_usbmidi_input_start); -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index c892b4d1e733..ec56ce382061 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - } - }, - -+/* -+ * MacroSilicon MS2109 based HDMI capture cards -+ * -+ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch. -+ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if -+ * they pretend to be 96kHz mono as a workaround for stereo being broken -+ * by that... -+ * -+ * They also have swapped L-R channels, but that's for userspace to deal -+ * with. -+ */ -+{ -+ USB_DEVICE(0x534d, 0x2109), -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .vendor_name = "MacroSilicon", -+ .product_name = "MS2109", -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = &(const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_ALIGN_TRANSFER, -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_STANDARD_MIXER, -+ }, -+ { -+ .ifnum = 3, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S16_LE, -+ .channels = 2, -+ .iface = 3, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .attributes = 0, -+ .endpoint = 0x82, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC | -+ USB_ENDPOINT_SYNC_ASYNC, -+ .rates = SNDRV_PCM_RATE_CONTINUOUS, -+ .rate_min = 48000, -+ .rate_max = 48000, -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, -+ - #undef USB_DEVICE_VENDOR_SPEC -diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c -index 6ce624cb7001..699c0ec5b9bf 100644 ---- a/tools/perf/util/stat.c -+++ b/tools/perf/util/stat.c -@@ -318,8 +318,10 @@ int perf_stat_process_counter(struct perf_stat_config *config, - * interval mode, otherwise overall avg running - * averages will be shown for each interval. - */ -- if (config->interval) -- init_stats(ps->res_stats); -+ if (config->interval) { -+ for (i = 0; i < 3; i++) -+ init_stats(&ps->res_stats[i]); -+ } - - if (counter->per_pkg) - zero_per_pkg(counter); diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.231-232.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.231-232.patch deleted file mode 100644 index 8390421a46..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.231-232.patch +++ /dev/null @@ -1,1690 +0,0 @@ -diff --git a/Makefile b/Makefile -index 46178c83906c..47a0a6c8272b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 231 -+SUBLEVEL = 232 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -607,7 +607,7 @@ ifeq ($(cc-name),clang) - ifneq ($(CROSS_COMPILE),) - CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%)) - GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit)) --CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR) -+CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) - GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) - endif - ifneq ($(GCC_TOOLCHAIN),) -diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c -index 8e7675e5ce4a..77fbcabcd9e3 100644 ---- a/arch/arm64/kernel/debug-monitors.c -+++ b/arch/arm64/kernel/debug-monitors.c -@@ -387,14 +387,14 @@ void user_rewind_single_step(struct task_struct *task) - * If single step is active for this thread, then set SPSR.SS - * to 1 to avoid returning to the active-pending state. - */ -- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) -+ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) - set_regs_spsr_ss(task_pt_regs(task)); - } - NOKPROBE_SYMBOL(user_rewind_single_step); - - void user_fastforward_single_step(struct task_struct *task) - { -- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) -+ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) - clear_regs_spsr_ss(task_pt_regs(task)); - } - -diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h -index 1d109990a022..cb2590821707 100644 ---- a/arch/parisc/include/asm/atomic.h -+++ b/arch/parisc/include/asm/atomic.h -@@ -208,6 +208,8 @@ atomic64_set(atomic64_t *v, s64 i) - _atomic_spin_unlock_irqrestore(v, flags); - } - -+#define atomic64_set_release(v, i) atomic64_set((v), (i)) -+ - static __inline__ s64 - atomic64_read(const atomic64_t *v) - { -diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c -index 31fad2cbd734..8fc842dae3b3 100644 ---- a/arch/x86/kernel/fpu/signal.c -+++ b/arch/x86/kernel/fpu/signal.c -@@ -317,10 +317,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) - sanitize_restored_xstate(tsk, &env, xfeatures, fx_only); - } - -+ local_bh_disable(); - fpu->fpstate_active = 1; -- preempt_disable(); - fpu__restore(fpu); -- preempt_enable(); -+ local_bh_enable(); - - return err; - } else { -diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S -index d258f59564e1..3b40c98bbbd4 100644 ---- a/arch/x86/math-emu/wm_sqrt.S -+++ b/arch/x86/math-emu/wm_sqrt.S -@@ -208,7 +208,7 @@ sqrt_stage_2_finish: - - #ifdef PARANOID - /* It should be possible to get here only if the arg is ffff....ffff */ -- cmp $0xffffffff,FPU_fsqrt_arg_1 -+ cmpl $0xffffffff,FPU_fsqrt_arg_1 - jnz sqrt_stage_2_error - #endif /* PARANOID */ - -diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c -index 49ccbd9022f6..92f5a259e251 100644 ---- a/arch/xtensa/kernel/setup.c -+++ b/arch/xtensa/kernel/setup.c -@@ -716,7 +716,8 @@ c_start(struct seq_file *f, loff_t *pos) - static void * - c_next(struct seq_file *f, void *v, loff_t *pos) - { -- return NULL; -+ ++*pos; -+ return c_start(f, pos); - } - - static void -diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c -index e2dd9109df63..00f17b5ec9c9 100644 ---- a/arch/xtensa/kernel/xtensa_ksyms.c -+++ b/arch/xtensa/kernel/xtensa_ksyms.c -@@ -82,13 +82,13 @@ void __xtensa_libgcc_window_spill(void) - } - EXPORT_SYMBOL(__xtensa_libgcc_window_spill); - --unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v) -+unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v) - { - BUG(); - } - EXPORT_SYMBOL(__sync_fetch_and_and_4); - --unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v) -+unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v) - { - BUG(); - } -diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c -index 3f0a7e262d69..ad5712f68c3e 100644 ---- a/drivers/base/regmap/regmap-debugfs.c -+++ b/drivers/base/regmap/regmap-debugfs.c -@@ -194,6 +194,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from, - if (*ppos < 0 || !count) - return -EINVAL; - -+ if (count > (PAGE_SIZE << (MAX_ORDER - 1))) -+ count = PAGE_SIZE << (MAX_ORDER - 1); -+ - buf = kmalloc(count, GFP_KERNEL); - if (!buf) - return -ENOMEM; -@@ -342,6 +345,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file, - if (*ppos < 0 || !count) - return -EINVAL; - -+ if (count > (PAGE_SIZE << (MAX_ORDER - 1))) -+ count = PAGE_SIZE << (MAX_ORDER - 1); -+ - buf = kmalloc(count, GFP_KERNEL); - if (!buf) - return -ENOMEM; -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 77cabde977ed..4a4efc6f54b5 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -1106,7 +1106,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) - - /* If the user didn't specify a name match any */ - if (data) -- return (*r)->name == data; -+ return !strcmp((*r)->name, data); - else - return 1; - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c -index 954f5b76bfcf..d44965f805fe 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c -@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry, - if (retries) - udelay(400); - -- /* transaction request, wait up to 1ms for it to complete */ -+ /* transaction request, wait up to 2ms for it to complete */ - nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl); - -- timeout = 1000; -+ timeout = 2000; - do { - ctrl = nvkm_rd32(device, 0x00e4e4 + base); - udelay(1); -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c -index bed231b56dbd..7cac8fe372b6 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c -@@ -118,10 +118,10 @@ gm204_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry, - if (retries) - udelay(400); - -- /* transaction request, wait up to 1ms for it to complete */ -+ /* transaction request, wait up to 2ms for it to complete */ - nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl); - -- timeout = 1000; -+ timeout = 2000; - do { - ctrl = nvkm_rd32(device, 0x00d954 + base); - udelay(1); -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 8ba9eadc2079..3fb9cbdac3bf 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -215,7 +215,7 @@ io_error: - - static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg) - { -- u16 v; -+ u16 v = 0; - __gm_phy_read(hw, port, reg, &v); - return v; - } -diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c -index 7405f537beca..8531a7201968 100644 ---- a/drivers/net/ethernet/smsc/smc91x.c -+++ b/drivers/net/ethernet/smsc/smc91x.c -@@ -2289,7 +2289,7 @@ static int smc_drv_probe(struct platform_device *pdev) - ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, - "power", 0, 0, 100); - if (ret) -- return ret; -+ goto out_free_netdev; - - /* - * Optional reset GPIO configured? Minimum 100 ns reset needed -@@ -2298,7 +2298,7 @@ static int smc_drv_probe(struct platform_device *pdev) - ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, - "reset", 0, 0, 100); - if (ret) -- return ret; -+ goto out_free_netdev; - - /* - * Need to wait for optional EEPROM to load, max 750 us according -diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c -index 313e006f74fe..6f3519123eb6 100644 ---- a/drivers/net/hippi/rrunner.c -+++ b/drivers/net/hippi/rrunner.c -@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev) - rrpriv->info = NULL; - } - if (rrpriv->rx_ctrl) { -- pci_free_consistent(pdev, sizeof(struct ring_ctrl), -+ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl), - rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); - rrpriv->rx_ctrl = NULL; - } -diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c -index 847c9fc10f9a..0da80adc545a 100644 ---- a/drivers/net/phy/dp83640.c -+++ b/drivers/net/phy/dp83640.c -@@ -1335,6 +1335,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) - dp83640->hwts_rx_en = 1; - dp83640->layer = PTP_CLASS_L4; - dp83640->version = PTP_CLASS_V1; -+ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; - break; - case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: - case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: -@@ -1342,6 +1343,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) - dp83640->hwts_rx_en = 1; - dp83640->layer = PTP_CLASS_L4; - dp83640->version = PTP_CLASS_V2; -+ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; - break; - case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: - case HWTSTAMP_FILTER_PTP_V2_L2_SYNC: -@@ -1349,6 +1351,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) - dp83640->hwts_rx_en = 1; - dp83640->layer = PTP_CLASS_L2; - dp83640->version = PTP_CLASS_V2; -+ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; - break; - case HWTSTAMP_FILTER_PTP_V2_EVENT: - case HWTSTAMP_FILTER_PTP_V2_SYNC: -@@ -1356,6 +1359,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) - dp83640->hwts_rx_en = 1; - dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2; - dp83640->version = PTP_CLASS_V2; -+ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; - break; - default: - return -ERANGE; -diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c -index 6b1d03b73eeb..6b734c7ffec3 100644 ---- a/drivers/net/usb/ax88172a.c -+++ b/drivers/net/usb/ax88172a.c -@@ -245,6 +245,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) - ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf); - if (ret < ETH_ALEN) { - netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); -+ ret = -EIO; - goto free; - } - memcpy(dev->net->dev_addr, buf, ETH_ALEN); -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index 6676607164d6..f5657783fad4 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev) - dev->netdev_ops = &lapbeth_netdev_ops; - dev->destructor = free_netdev; - dev->type = ARPHRD_X25; -- dev->hard_header_len = 3; - dev->mtu = 1000; - dev->addr_len = 0; - } -@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev) - if (!ndev) - goto out; - -+ /* When transmitting data: -+ * first this driver removes a pseudo header of 1 byte, -+ * then the lapb module prepends an LAPB header of at most 3 bytes, -+ * then this driver prepends a length field of 2 bytes, -+ * then the underlying Ethernet device prepends its own header. -+ */ -+ ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; -+ - lapbeth = netdev_priv(ndev); - lapbeth->axdev = ndev; - -diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c -index cd39025d2abf..022487d90aa3 100644 ---- a/drivers/net/wan/x25_asy.c -+++ b/drivers/net/wan/x25_asy.c -@@ -186,7 +186,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl) - netif_wake_queue(sl->dev); - } - --/* Send one completely decapsulated IP datagram to the IP layer. */ -+/* Send an LAPB frame to the LAPB module to process. */ - - static void x25_asy_bump(struct x25_asy *sl) - { -@@ -198,13 +198,12 @@ static void x25_asy_bump(struct x25_asy *sl) - count = sl->rcount; - dev->stats.rx_bytes += count; - -- skb = dev_alloc_skb(count+1); -+ skb = dev_alloc_skb(count); - if (skb == NULL) { - netdev_warn(sl->dev, "memory squeeze, dropping packet\n"); - dev->stats.rx_dropped++; - return; - } -- skb_push(skb, 1); /* LAPB internal control */ - memcpy(skb_put(skb, count), sl->rbuff, count); - skb->protocol = x25_type_trans(skb, sl->dev); - err = lapb_data_received(skb->dev, skb); -@@ -212,7 +211,6 @@ static void x25_asy_bump(struct x25_asy *sl) - kfree_skb(skb); - printk(KERN_DEBUG "x25_asy: data received err - %d\n", err); - } else { -- netif_rx(skb); - dev->stats.rx_packets++; - } - } -@@ -358,12 +356,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb, - */ - - /* -- * Called when I frame data arrives. We did the work above - throw it -- * at the net layer. -+ * Called when I frame data arrive. We add a pseudo header for upper -+ * layers and pass it to upper layers. - */ - - static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb) - { -+ if (skb_cow(skb, 1)) { -+ kfree_skb(skb); -+ return NET_RX_DROP; -+ } -+ skb_push(skb, 1); -+ skb->data[0] = X25_IFACE_DATA; -+ -+ skb->protocol = x25_type_trans(skb, dev); -+ - return netif_rx(skb); - } - -@@ -655,7 +662,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s) - switch (s) { - case X25_END: - if (!test_and_clear_bit(SLF_ERROR, &sl->flags) && -- sl->rcount > 2) -+ sl->rcount >= 2) - x25_asy_bump(sl); - clear_bit(SLF_ESCAPE, &sl->flags); - sl->rcount = 0; -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c -index e2ed30b03af5..76d91859cfde 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.c -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c -@@ -639,9 +639,9 @@ err: - - static void ath9k_hif_usb_rx_cb(struct urb *urb) - { -- struct sk_buff *skb = (struct sk_buff *) urb->context; -- struct hif_device_usb *hif_dev = -- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); -+ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -+ struct hif_device_usb *hif_dev = rx_buf->hif_dev; -+ struct sk_buff *skb = rx_buf->skb; - int ret; - - if (!skb) -@@ -681,14 +681,15 @@ resubmit: - return; - free: - kfree_skb(skb); -+ kfree(rx_buf); - } - - static void ath9k_hif_usb_reg_in_cb(struct urb *urb) - { -- struct sk_buff *skb = (struct sk_buff *) urb->context; -+ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -+ struct hif_device_usb *hif_dev = rx_buf->hif_dev; -+ struct sk_buff *skb = rx_buf->skb; - struct sk_buff *nskb; -- struct hif_device_usb *hif_dev = -- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); - int ret; - - if (!skb) -@@ -728,11 +729,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) - return; - } - -+ rx_buf->skb = nskb; -+ - usb_fill_int_urb(urb, hif_dev->udev, - usb_rcvintpipe(hif_dev->udev, - USB_REG_IN_PIPE), - nskb->data, MAX_REG_IN_BUF_SIZE, -- ath9k_hif_usb_reg_in_cb, nskb, 1); -+ ath9k_hif_usb_reg_in_cb, rx_buf, 1); - } - - resubmit: -@@ -746,6 +749,7 @@ resubmit: - return; - free: - kfree_skb(skb); -+ kfree(rx_buf); - urb->context = NULL; - } - -@@ -791,7 +795,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) - init_usb_anchor(&hif_dev->mgmt_submitted); - - for (i = 0; i < MAX_TX_URB_NUM; i++) { -- tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL); -+ tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL); - if (!tx_buf) - goto err; - -@@ -828,8 +832,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) - - static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - { -- struct urb *urb = NULL; -+ struct rx_buf *rx_buf = NULL; - struct sk_buff *skb = NULL; -+ struct urb *urb = NULL; - int i, ret; - - init_usb_anchor(&hif_dev->rx_submitted); -@@ -837,6 +842,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - - for (i = 0; i < MAX_RX_URB_NUM; i++) { - -+ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); -+ if (!rx_buf) { -+ ret = -ENOMEM; -+ goto err_rxb; -+ } -+ - /* Allocate URB */ - urb = usb_alloc_urb(0, GFP_KERNEL); - if (urb == NULL) { -@@ -851,11 +862,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) - goto err_skb; - } - -+ rx_buf->hif_dev = hif_dev; -+ rx_buf->skb = skb; -+ - usb_fill_bulk_urb(urb, hif_dev->udev, - usb_rcvbulkpipe(hif_dev->udev, - USB_WLAN_RX_PIPE), - skb->data, MAX_RX_BUF_SIZE, -- ath9k_hif_usb_rx_cb, skb); -+ ath9k_hif_usb_rx_cb, rx_buf); - - /* Anchor URB */ - usb_anchor_urb(urb, &hif_dev->rx_submitted); -@@ -881,6 +895,8 @@ err_submit: - err_skb: - usb_free_urb(urb); - err_urb: -+ kfree(rx_buf); -+err_rxb: - ath9k_hif_usb_dealloc_rx_urbs(hif_dev); - return ret; - } -@@ -892,14 +908,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev) - - static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) - { -- struct urb *urb = NULL; -+ struct rx_buf *rx_buf = NULL; - struct sk_buff *skb = NULL; -+ struct urb *urb = NULL; - int i, ret; - - init_usb_anchor(&hif_dev->reg_in_submitted); - - for (i = 0; i < MAX_REG_IN_URB_NUM; i++) { - -+ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); -+ if (!rx_buf) { -+ ret = -ENOMEM; -+ goto err_rxb; -+ } -+ - /* Allocate URB */ - urb = usb_alloc_urb(0, GFP_KERNEL); - if (urb == NULL) { -@@ -914,11 +937,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) - goto err_skb; - } - -+ rx_buf->hif_dev = hif_dev; -+ rx_buf->skb = skb; -+ - usb_fill_int_urb(urb, hif_dev->udev, - usb_rcvintpipe(hif_dev->udev, - USB_REG_IN_PIPE), - skb->data, MAX_REG_IN_BUF_SIZE, -- ath9k_hif_usb_reg_in_cb, skb, 1); -+ ath9k_hif_usb_reg_in_cb, rx_buf, 1); - - /* Anchor URB */ - usb_anchor_urb(urb, &hif_dev->reg_in_submitted); -@@ -944,6 +970,8 @@ err_submit: - err_skb: - usb_free_urb(urb); - err_urb: -+ kfree(rx_buf); -+err_rxb: - ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); - return ret; - } -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h -index a95cdf562611..835264c36595 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.h -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h -@@ -84,6 +84,11 @@ struct tx_buf { - struct list_head list; - }; - -+struct rx_buf { -+ struct sk_buff *skb; -+ struct hif_device_usb *hif_dev; -+}; -+ - #define HIF_USB_TX_STOP BIT(0) - #define HIF_USB_TX_FLUSH BIT(1) - -diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h -index 7bfea47dbb47..f63417197a62 100644 ---- a/drivers/pinctrl/pinctrl-amd.h -+++ b/drivers/pinctrl/pinctrl-amd.h -@@ -249,7 +249,7 @@ static const struct amd_pingroup kerncz_groups[] = { - { - .name = "uart0", - .pins = uart0_pins, -- .npins = 9, -+ .npins = 5, - }, - { - .name = "uart1", -diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c -index 319868f3f674..083cd11ce7d7 100644 ---- a/drivers/scsi/scsi_transport_spi.c -+++ b/drivers/scsi/scsi_transport_spi.c -@@ -353,7 +353,7 @@ store_spi_transport_##field(struct device *dev, \ - struct spi_transport_attrs *tp \ - = (struct spi_transport_attrs *)&starget->starget_data; \ - \ -- if (i->f->set_##field) \ -+ if (!i->f->set_##field) \ - return -EINVAL; \ - val = simple_strtoul(buf, NULL, 0); \ - if (val > tp->max_##field) \ -diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c -index ccd1a91290bf..536a135cd00b 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1032.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c -@@ -115,14 +115,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, - unsigned int *data) - { - struct apci1032_private *devpriv = dev->private; -- unsigned int shift, oldmask; -+ unsigned int shift, oldmask, himask, lomask; - - switch (data[0]) { - case INSN_CONFIG_DIGITAL_TRIG: - if (data[1] != 0) - return -EINVAL; - shift = data[3]; -- oldmask = (1U << shift) - 1; -+ if (shift < 32) { -+ oldmask = (1U << shift) - 1; -+ himask = data[4] << shift; -+ lomask = data[5] << shift; -+ } else { -+ oldmask = 0xffffffffu; -+ himask = 0; -+ lomask = 0; -+ } - switch (data[2]) { - case COMEDI_DIGITAL_TRIG_DISABLE: - devpriv->ctrl = 0; -@@ -145,8 +153,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, - devpriv->mode2 &= oldmask; - } - /* configure specified channels */ -- devpriv->mode1 |= data[4] << shift; -- devpriv->mode2 |= data[5] << shift; -+ devpriv->mode1 |= himask; -+ devpriv->mode2 |= lomask; - break; - case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS: - if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA | -@@ -163,8 +171,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, - devpriv->mode2 &= oldmask; - } - /* configure specified channels */ -- devpriv->mode1 |= data[4] << shift; -- devpriv->mode2 |= data[5] << shift; -+ devpriv->mode1 |= himask; -+ devpriv->mode2 |= lomask; - break; - default: - return -EINVAL; -diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c -index 79a8799b1262..c4e36fb6df9d 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1500.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c -@@ -461,13 +461,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, - struct apci1500_private *devpriv = dev->private; - unsigned int trig = data[1]; - unsigned int shift = data[3]; -- unsigned int hi_mask = data[4] << shift; -- unsigned int lo_mask = data[5] << shift; -- unsigned int chan_mask = hi_mask | lo_mask; -- unsigned int old_mask = (1 << shift) - 1; -+ unsigned int hi_mask; -+ unsigned int lo_mask; -+ unsigned int chan_mask; -+ unsigned int old_mask; - unsigned int pm; - unsigned int pt; - unsigned int pp; -+ unsigned int invalid_chan; - - if (trig > 1) { - dev_dbg(dev->class_dev, -@@ -475,7 +476,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, - return -EINVAL; - } - -- if (chan_mask > 0xffff) { -+ if (shift <= 16) { -+ hi_mask = data[4] << shift; -+ lo_mask = data[5] << shift; -+ old_mask = (1U << shift) - 1; -+ invalid_chan = (data[4] | data[5]) >> (16 - shift); -+ } else { -+ hi_mask = 0; -+ lo_mask = 0; -+ old_mask = 0xffff; -+ invalid_chan = data[4] | data[5]; -+ } -+ chan_mask = hi_mask | lo_mask; -+ -+ if (invalid_chan) { - dev_dbg(dev->class_dev, "invalid digital trigger channel\n"); - return -EINVAL; - } -diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c -index f1ccfbd4c578..340e55c69263 100644 ---- a/drivers/staging/comedi/drivers/addi_apci_1564.c -+++ b/drivers/staging/comedi/drivers/addi_apci_1564.c -@@ -288,14 +288,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, - unsigned int *data) - { - struct apci1564_private *devpriv = dev->private; -- unsigned int shift, oldmask; -+ unsigned int shift, oldmask, himask, lomask; - - switch (data[0]) { - case INSN_CONFIG_DIGITAL_TRIG: - if (data[1] != 0) - return -EINVAL; - shift = data[3]; -- oldmask = (1U << shift) - 1; -+ if (shift < 32) { -+ oldmask = (1U << shift) - 1; -+ himask = data[4] << shift; -+ lomask = data[5] << shift; -+ } else { -+ oldmask = 0xffffffffu; -+ himask = 0; -+ lomask = 0; -+ } - switch (data[2]) { - case COMEDI_DIGITAL_TRIG_DISABLE: - devpriv->ctrl = 0; -@@ -319,8 +327,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, - devpriv->mode2 &= oldmask; - } - /* configure specified channels */ -- devpriv->mode1 |= data[4] << shift; -- devpriv->mode2 |= data[5] << shift; -+ devpriv->mode1 |= himask; -+ devpriv->mode2 |= lomask; - break; - case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS: - if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA | -@@ -337,8 +345,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, - devpriv->mode2 &= oldmask; - } - /* configure specified channels */ -- devpriv->mode1 |= data[4] << shift; -- devpriv->mode2 |= data[5] << shift; -+ devpriv->mode1 |= himask; -+ devpriv->mode2 |= lomask; - break; - default: - return -EINVAL; -diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c -index 62a817e4cd64..5b904cf07bd1 100644 ---- a/drivers/staging/comedi/drivers/ni_6527.c -+++ b/drivers/staging/comedi/drivers/ni_6527.c -@@ -341,7 +341,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev, - case COMEDI_DIGITAL_TRIG_ENABLE_EDGES: - /* check shift amount */ - shift = data[3]; -- if (shift >= s->n_chan) { -+ if (shift >= 32) { - mask = 0; - rising = 0; - falling = 0; -diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c -index 8abf3f87a2d5..6da5c66bb3d5 100644 ---- a/drivers/staging/wlan-ng/prism2usb.c -+++ b/drivers/staging/wlan-ng/prism2usb.c -@@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface, - const struct usb_device_id *id) - { - struct usb_device *dev; -- -+ const struct usb_endpoint_descriptor *epd; -+ const struct usb_host_interface *iface_desc = interface->cur_altsetting; - wlandevice_t *wlandev = NULL; - hfa384x_t *hw = NULL; - int result = 0; - -+ if (iface_desc->desc.bNumEndpoints != 2) { -+ result = -ENODEV; -+ goto failed; -+ } -+ -+ result = -EINVAL; -+ epd = &iface_desc->endpoint[1].desc; -+ if (!usb_endpoint_is_bulk_in(epd)) -+ goto failed; -+ epd = &iface_desc->endpoint[2].desc; -+ if (!usb_endpoint_is_bulk_out(epd)) -+ goto failed; -+ - dev = interface_to_usbdev(interface); - wlandev = create_wlan(); - if (wlandev == NULL) { -diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c -index 39126460c1f5..e9ea9005a984 100644 ---- a/drivers/tty/serial/8250/8250_core.c -+++ b/drivers/tty/serial/8250/8250_core.c -@@ -530,6 +530,7 @@ static void __init serial8250_isa_init_ports(void) - */ - up->mcr_mask = ~ALPHA_KLUDGE_MCR; - up->mcr_force = ALPHA_KLUDGE_MCR; -+ serial8250_set_defaults(up); - } - - /* chain base port ops to support Remote Supervisor Adapter */ -@@ -553,7 +554,6 @@ static void __init serial8250_isa_init_ports(void) - port->membase = old_serial_port[i].iomem_base; - port->iotype = old_serial_port[i].io_type; - port->regshift = old_serial_port[i].iomem_reg_shift; -- serial8250_set_defaults(up); - - port->irqflags |= irqflag; - if (serial8250_isa_config != NULL) -diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c -index 035810bbcd02..470ccf729d59 100644 ---- a/drivers/tty/serial/8250/8250_mtk.c -+++ b/drivers/tty/serial/8250/8250_mtk.c -@@ -47,8 +47,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, - struct uart_8250_port *up = - container_of(port, struct uart_8250_port, port); - -+ /* -+ * Store the requested baud rate before calling the generic 8250 -+ * set_termios method. Standard 8250 port expects bauds to be -+ * no higher than (uartclk / 16) so the baud will be clamped if it -+ * gets out of that bound. Mediatek 8250 port supports speed -+ * higher than that, therefore we'll get original baud rate back -+ * after calling the generic set_termios method and recalculate -+ * the speed later in this method. -+ */ -+ baud = tty_termios_baud_rate(termios); -+ - serial8250_do_set_termios(port, termios, old); - -+ tty_termios_encode_baud_rate(termios, baud, baud); -+ - /* - * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS) - * -@@ -91,6 +104,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, - */ - spin_lock_irqsave(&port->lock, flags); - -+ /* -+ * Update the per-port timeout. -+ */ -+ uart_update_timeout(port, termios->c_cflag, baud); -+ - /* set DLAB we have cval saved in up->lcr from the call to the core */ - serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB); - serial_dl_write(up, quot); -diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c -index 594639e5cbf8..78168e1827b5 100644 ---- a/drivers/usb/gadget/udc/gr_udc.c -+++ b/drivers/usb/gadget/udc/gr_udc.c -@@ -2001,9 +2001,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) - - if (num == 0) { - _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); -+ if (!_req) -+ return -ENOMEM; -+ - buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); -- if (!_req || !buf) { -- /* possible _req freed by gr_probe via gr_remove */ -+ if (!buf) { -+ gr_free_request(&ep->ep, _req); - return -ENOMEM; - } - -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index 81c5d07a2af1..228bfa19b745 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1221,6 +1221,7 @@ static int __btrfs_find_all_roots(struct btrfs_trans_handle *trans, - if (ret < 0 && ret != -ENOENT) { - ulist_free(tmp); - ulist_free(*roots); -+ *roots = NULL; - return ret; - } - node = ulist_next(tmp, &uiter); -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 55ce6543050d..dcae0cf4924b 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -6693,6 +6693,14 @@ int btrfs_read_chunk_tree(struct btrfs_root *root) - mutex_lock(&uuid_mutex); - lock_chunks(root); - -+ /* -+ * It is possible for mount and umount to race in such a way that -+ * we execute this code path, but open_fs_devices failed to clear -+ * total_rw_bytes. We certainly want it cleared before reading the -+ * device items, so clear it here. -+ */ -+ root->fs_info->fs_devices->total_rw_bytes = 0; -+ - /* - * Read all device items, and then all the chunk items. All - * device items are found before any chunk item (their object id -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index a002e289a544..c18c26a78453 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -1737,7 +1737,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, - FILE_UNIX_BASIC_INFO *info_buf_target; - unsigned int xid; - int rc, tmprc; -- bool new_target = d_really_is_negative(target_dentry); - - if (flags & ~RENAME_NOREPLACE) - return -EINVAL; -@@ -1814,13 +1813,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, - */ - - unlink_target: -- /* -- * If the target dentry was created during the rename, try -- * unlinking it if it's not negative -- */ -- if (new_target && -- d_really_is_positive(target_dentry) && -- (rc == -EACCES || rc == -EEXIST)) { -+ /* Try unlinking the target dentry if it's not negative */ -+ if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) { - if (d_is_dir(target_dentry)) - tmprc = cifs_rmdir(target_dir, target_dentry); - else -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 4d76e9a97538..7789f0b9b999 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -385,6 +385,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write) - if (write) - nfs_zap_mapping(inode, inode->i_mapping); - -+ inode_dio_end(inode); -+ - if (dreq->iocb) { - long res = (long) dreq->error; - if (!res) -@@ -394,10 +396,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write) - - complete_all(&dreq->completion); - -- igrab(inode); - nfs_direct_req_release(dreq); -- inode_dio_end(inode); -- iput(inode); - } - - static void nfs_direct_readpage_release(struct nfs_page *req) -@@ -538,10 +537,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, - * generic layer handle the completion. - */ - if (requested_bytes == 0) { -- igrab(inode); -- nfs_direct_req_release(dreq); - inode_dio_end(inode); -- iput(inode); -+ nfs_direct_req_release(dreq); - return result < 0 ? result : -EIO; - } - -@@ -942,10 +939,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - * generic layer handle the completion. - */ - if (requested_bytes == 0) { -- igrab(inode); -- nfs_direct_req_release(dreq); - inode_dio_end(inode); -- iput(inode); -+ nfs_direct_req_release(dreq); - return result < 0 ? result : -EIO; - } - -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index eaa6697d256e..dc875cd0e11d 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp) - dprintk("NFS: release(%pD2)\n", filp); - - nfs_inc_stats(inode, NFSIOS_VFSRELEASE); -- inode_dio_wait(inode); - nfs_file_clear_open_context(filp); - return 0; - } -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index d98ba57ef01a..c167bdaafc50 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -793,6 +793,8 @@ xfs_bmap_extents_to_btree( - *logflagsp = 0; - if ((error = xfs_alloc_vextent(&args))) { - xfs_iroot_realloc(ip, -1, whichfork); -+ ASSERT(ifp->if_broot == NULL); -+ XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS); - xfs_btree_del_cursor(cur, XFS_BTREE_ERROR); - return error; - } -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index 085da1707cea..b9e591582be9 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -211,7 +211,8 @@ struct tcp_sock { - u8 reord; /* reordering detected */ - } rack; - u16 advmss; /* Advertised MSS */ -- u8 unused; -+ u8 tlp_retrans:1, /* TLP is a retransmission */ -+ unused_1:7; - u8 nonagle : 4,/* Disable Nagle algorithm? */ - thin_lto : 1,/* Use linear timeouts for thin streams */ - thin_dupack : 1,/* Fast retransmit on first dupack */ -@@ -225,7 +226,7 @@ struct tcp_sock { - syn_data_acked:1,/* data in SYN is acked by SYN-ACK */ - save_syn:1, /* Save headers of SYN packet */ - is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */ -- u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */ -+ u32 tlp_high_seq; /* snd_nxt at the time of TLP */ - - /* RTT measurement */ - u32 srtt_us; /* smoothed round trip time << 3 in usecs */ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index feff3ba98cc9..388ce03155b4 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -3940,7 +3940,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value); - static int __perf_read_group_add(struct perf_event *leader, - u64 read_format, u64 *values) - { -+ struct perf_event_context *ctx = leader->ctx; - struct perf_event *sub; -+ unsigned long flags; - int n = 1; /* skip @nr */ - int ret; - -@@ -3970,12 +3972,15 @@ static int __perf_read_group_add(struct perf_event *leader, - if (read_format & PERF_FORMAT_ID) - values[n++] = primary_event_id(leader); - -+ raw_spin_lock_irqsave(&ctx->lock, flags); -+ - list_for_each_entry(sub, &leader->sibling_list, group_entry) { - values[n++] += perf_event_count(sub); - if (read_format & PERF_FORMAT_ID) - values[n++] = primary_event_id(sub); - } - -+ raw_spin_unlock_irqrestore(&ctx->lock, flags); - return 0; - } - -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index e7dabb254404..d937fbbc3642 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -1875,7 +1875,7 @@ static void handle_swbp(struct pt_regs *regs) - if (!uprobe) { - if (is_swbp > 0) { - /* No matching uprobe; signal SIGTRAP. */ -- send_sig(SIGTRAP, current, 0); -+ force_sig(SIGTRAP, current); - } else { - /* - * Either we raced with uprobe_unregister() or we can't -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index cb98a1889c8c..617feca8d094 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -4889,7 +4889,6 @@ static void __mem_cgroup_clear_mc(void) - if (!mem_cgroup_is_root(mc.to)) - page_counter_uncharge(&mc.to->memory, mc.moved_swap); - -- mem_cgroup_id_get_many(mc.to, mc.moved_swap); - css_put_many(&mc.to->css, mc.moved_swap); - - mc.moved_swap = 0; -@@ -5067,7 +5066,8 @@ put: /* get_mctgt_type() gets the page */ - ent = target.ent; - if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) { - mc.precharge--; -- /* we fixup refcnts and charges later. */ -+ mem_cgroup_id_get_many(mc.to, 1); -+ /* we fixup other refcnts and charges later. */ - mc.moved_swap++; - } - break; -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 02be8ee23271..64fede18aa33 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -1191,7 +1191,10 @@ static int __must_check ax25_connect(struct socket *sock, - if (addr_len > sizeof(struct sockaddr_ax25) && - fsa->fsa_ax25.sax25_ndigis != 0) { - /* Valid number of digipeaters ? */ -- if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) { -+ if (fsa->fsa_ax25.sax25_ndigis < 1 || -+ fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS || -+ addr_len < sizeof(struct sockaddr_ax25) + -+ sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { - err = -EINVAL; - goto out_release; - } -@@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; - - /* Valid number of digipeaters ? */ -- if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) { -+ if (usax->sax25_ndigis < 1 || -+ usax->sax25_ndigis > AX25_MAX_DIGIS || -+ addr_len < sizeof(struct sockaddr_ax25) + -+ sizeof(ax25_address) * usax->sax25_ndigis) { - err = -EINVAL; - goto out; - } -diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c -index 579d351f6ddd..c976fd132c3b 100644 ---- a/net/core/net-sysfs.c -+++ b/net/core/net-sysfs.c -@@ -999,7 +999,7 @@ static ssize_t show_trans_timeout(struct netdev_queue *queue, - trans_timeout = queue->trans_timeout; - spin_unlock_irq(&queue->_xmit_lock); - -- return sprintf(buf, "%lu", trans_timeout); -+ return sprintf(buf, fmt_ulong, trans_timeout); - } - - #ifdef CONFIG_XPS -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index e2066f2f19b4..9215ee1de494 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3517,10 +3517,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq) - } - } - --/* This routine deals with acks during a TLP episode. -- * We mark the end of a TLP episode on receiving TLP dupack or when -- * ack is after tlp_high_seq. -- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe. -+/* This routine deals with acks during a TLP episode and ends an episode by -+ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack - */ - static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) - { -@@ -3529,7 +3527,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) - if (before(ack, tp->tlp_high_seq)) - return; - -- if (flag & FLAG_DSACKING_ACK) { -+ if (!tp->tlp_retrans) { -+ /* TLP of new data has been acknowledged */ -+ tp->tlp_high_seq = 0; -+ } else if (flag & FLAG_DSACKING_ACK) { - /* This DSACK means original and TLP probe arrived; no loss */ - tp->tlp_high_seq = 0; - } else if (after(ack, tp->tlp_high_seq)) { -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 6c8966dcf612..b218138874cc 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2271,6 +2271,11 @@ void tcp_send_loss_probe(struct sock *sk) - int pcount; - int mss = tcp_current_mss(sk); - -+ /* At most one outstanding TLP */ -+ if (tp->tlp_high_seq) -+ goto rearm_timer; -+ -+ tp->tlp_retrans = 0; - skb = tcp_send_head(sk); - if (skb) { - if (tcp_snd_wnd_test(tp, skb, mss)) { -@@ -2293,10 +2298,6 @@ void tcp_send_loss_probe(struct sock *sk) - return; - } - -- /* At most one outstanding TLP retransmission. */ -- if (tp->tlp_high_seq) -- goto rearm_timer; -- - if (skb_still_in_host_queue(sk, skb)) - goto rearm_timer; - -@@ -2317,10 +2318,12 @@ void tcp_send_loss_probe(struct sock *sk) - if (__tcp_retransmit_skb(sk, skb)) - goto rearm_timer; - -+ tp->tlp_retrans = 1; -+ -+probe_sent: - /* Record snd_nxt for loss detection. */ - tp->tlp_high_seq = tp->snd_nxt; - --probe_sent: - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSSPROBES); - /* Reset s.t. tcp_rearm_rto will restart timer from now */ - inet_csk(sk)->icsk_pending = 0; -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index bb306996c15e..5464fd210230 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1558,7 +1558,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - /* - * UDP-Lite specific tests, ignored on UDP sockets - */ -- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { -+ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { - - /* - * MIB statistics other than incrementing the error count are -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 546172bfaba1..6efe6b101d3f 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -1355,15 +1355,16 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head) - static int __net_init ip6gre_init_net(struct net *net) - { - struct ip6gre_net *ign = net_generic(net, ip6gre_net_id); -+ struct net_device *ndev; - int err; - -- ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", -- NET_NAME_UNKNOWN, -- ip6gre_tunnel_setup); -- if (!ign->fb_tunnel_dev) { -+ ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", -+ NET_NAME_UNKNOWN, ip6gre_tunnel_setup); -+ if (!ndev) { - err = -ENOMEM; - goto err_alloc_dev; - } -+ ign->fb_tunnel_dev = ndev; - dev_net_set(ign->fb_tunnel_dev, net); - /* FB netdevice is special: we have one, and only one per netns. - * Allowing to move it to another netns is clearly unsafe. -@@ -1383,7 +1384,7 @@ static int __net_init ip6gre_init_net(struct net *net) - return 0; - - err_reg_dev: -- ip6gre_dev_free(ign->fb_tunnel_dev); -+ ip6gre_dev_free(ndev); - err_alloc_dev: - return err; - } -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 73f111206e36..79c583004575 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -672,7 +672,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - /* - * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c). - */ -- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { -+ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { - - if (up->pcrlen == 0) { /* full coverage was set */ - net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n", -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index a74a6ff18f91..886dce84e70c 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1963,6 +1963,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) - - static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) - { -+ struct ieee80211_hdr *hdr = (void *)rx->skb->data; - struct sk_buff *skb = rx->skb; - struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); - -@@ -1973,6 +1974,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) - if (status->flag & RX_FLAG_DECRYPTED) - return 0; - -+ /* check mesh EAPOL frames first */ -+ if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) && -+ ieee80211_is_data(fc))) { -+ struct ieee80211s_hdr *mesh_hdr; -+ u16 hdr_len = ieee80211_hdrlen(fc); -+ u16 ethertype_offset; -+ __be16 ethertype; -+ -+ if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr)) -+ goto drop_check; -+ -+ /* make sure fixed part of mesh header is there, also checks skb len */ -+ if (!pskb_may_pull(rx->skb, hdr_len + 6)) -+ goto drop_check; -+ -+ mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len); -+ ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) + -+ sizeof(rfc1042_header); -+ -+ if (skb_copy_bits(rx->skb, ethertype_offset, ðertype, 2) == 0 && -+ ethertype == rx->sdata->control_port_protocol) -+ return 0; -+ } -+ -+drop_check: - /* Drop unencrypted frames if key is set. */ - if (unlikely(!ieee80211_has_protected(fc) && - !ieee80211_is_any_nullfunc(fc) && -diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c -index 14c4e12c47b0..a1997f9a447a 100644 ---- a/net/rxrpc/ar-output.c -+++ b/net/rxrpc/ar-output.c -@@ -533,7 +533,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, - /* this should be in poll */ - sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); - -- if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) -+ if (sk->sk_shutdown & SEND_SHUTDOWN) - return -EPIPE; - - more = msg->msg_flags & MSG_MORE; -diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c -index b92beded7459..cb9affdb1e87 100644 ---- a/net/rxrpc/ar-recvmsg.c -+++ b/net/rxrpc/ar-recvmsg.c -@@ -78,7 +78,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - release_sock(&rx->sk); - if (continue_call) - rxrpc_put_call(continue_call); -- return -ENODATA; -+ return -EAGAIN; - } - } - -diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh -index 4f5e76f76b9d..003968cb04d4 100755 ---- a/scripts/decode_stacktrace.sh -+++ b/scripts/decode_stacktrace.sh -@@ -63,8 +63,8 @@ parse_symbol() { - return - fi - -- # Strip out the base of the path -- code=${code#$basepath/} -+ # Strip out the base of the path on each line -+ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") - - # In the case of inlines, move everything to same line - code=${code//$'\n'/' '} -diff --git a/sound/core/info.c b/sound/core/info.c -index 358a6947342d..8a6fa8fd0aab 100644 ---- a/sound/core/info.c -+++ b/sound/core/info.c -@@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len) - { - int c = -1; - -- if (snd_BUG_ON(!buffer || !buffer->buffer)) -+ if (snd_BUG_ON(!buffer)) -+ return 1; -+ if (!buffer->buffer) - return 1; - if (len <= 0 || buffer->stop || buffer->error) - return 1; -diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h -index 3f1b0f1df809..e4e31e82311d 100644 ---- a/sound/soc/codecs/rt5670.h -+++ b/sound/soc/codecs/rt5670.h -@@ -760,7 +760,7 @@ - #define RT5670_PWR_VREF2_BIT 4 - #define RT5670_PWR_FV2 (0x1 << 3) - #define RT5670_PWR_FV2_BIT 3 --#define RT5670_LDO_SEL_MASK (0x3) -+#define RT5670_LDO_SEL_MASK (0x7) - #define RT5670_LDO_SEL_SFT 0 - - /* Power Management for Analog 2 (0x64) */ -diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c -index 20f0e27918dd..acd460303d1a 100644 ---- a/tools/perf/builtin-script.c -+++ b/tools/perf/builtin-script.c -@@ -1245,7 +1245,7 @@ static int is_directory(const char *base_path, const struct dirent *dent) - char path[PATH_MAX]; - struct stat st; - -- sprintf(path, "%s/%s", base_path, dent->d_name); -+ scnprintf(path, PATH_MAX, "%s/%s", base_path, dent->d_name); - if (stat(path, &st)) - return 0; - -@@ -1426,8 +1426,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused, - return -1; - - for_each_lang(scripts_path, scripts_dir, lang_dirent) { -- snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -- lang_dirent->d_name); -+ scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -+ lang_dirent->d_name); - lang_dir = opendir(lang_path); - if (!lang_dir) - continue; -@@ -1436,8 +1436,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused, - script_root = get_script_root(script_dirent, REPORT_SUFFIX); - if (script_root) { - desc = script_desc__findnew(script_root); -- snprintf(script_path, MAXPATHLEN, "%s/%s", -- lang_path, script_dirent->d_name); -+ scnprintf(script_path, MAXPATHLEN, "%s/%s", -+ lang_path, script_dirent->d_name); - read_script_info(desc, script_path); - free(script_root); - } -@@ -1473,7 +1473,7 @@ static int check_ev_match(char *dir_name, char *scriptname, - int match, len; - FILE *fp; - -- sprintf(filename, "%s/bin/%s-record", dir_name, scriptname); -+ scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, scriptname); - - fp = fopen(filename, "r"); - if (!fp) -@@ -1549,8 +1549,8 @@ int find_scripts(char **scripts_array, char **scripts_path_array) - } - - for_each_lang(scripts_path, scripts_dir, lang_dirent) { -- snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path, -- lang_dirent->d_name); -+ scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path, -+ lang_dirent->d_name); - #ifdef NO_LIBPERL - if (strstr(lang_path, "perl")) - continue; -@@ -1605,8 +1605,8 @@ static char *get_script_path(const char *script_root, const char *suffix) - return NULL; - - for_each_lang(scripts_path, scripts_dir, lang_dirent) { -- snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -- lang_dirent->d_name); -+ scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -+ lang_dirent->d_name); - lang_dir = opendir(lang_path); - if (!lang_dir) - continue; -@@ -1617,8 +1617,8 @@ static char *get_script_path(const char *script_root, const char *suffix) - free(__script_root); - closedir(lang_dir); - closedir(scripts_dir); -- snprintf(script_path, MAXPATHLEN, "%s/%s", -- lang_path, script_dirent->d_name); -+ scnprintf(script_path, MAXPATHLEN, "%s/%s", -+ lang_path, script_dirent->d_name); - return strdup(script_path); - } - free(__script_root); -diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c -index 79547c225c14..9c81fbfb16d2 100644 ---- a/tools/perf/tests/attr.c -+++ b/tools/perf/tests/attr.c -@@ -147,8 +147,8 @@ static int run_dir(const char *d, const char *perf) - if (verbose) - vcnt++; - -- snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", -- d, d, perf, vcnt, v); -+ scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", -+ d, d, perf, vcnt, v); - - return system(cmd) ? TEST_FAIL : TEST_OK; - } -diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c -index faa04e9d5d5f..b776831ceeea 100644 ---- a/tools/perf/tests/pmu.c -+++ b/tools/perf/tests/pmu.c -@@ -95,7 +95,7 @@ static char *test_format_dir_get(void) - struct test_format *format = &test_formats[i]; - FILE *file; - -- snprintf(name, PATH_MAX, "%s/%s", dir, format->name); -+ scnprintf(name, PATH_MAX, "%s/%s", dir, format->name); - - file = fopen(name, "w"); - if (!file) -diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c -index 1dd1949b0e79..1e1c37a17355 100644 ---- a/tools/perf/util/annotate.c -+++ b/tools/perf/util/annotate.c -@@ -1077,7 +1077,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize) - struct dso *dso = map->dso; - char *filename = dso__build_id_filename(dso, NULL, 0); - bool free_filename = true; -- char command[PATH_MAX * 2]; -+ char *command; - FILE *file; - int err = 0; - char symfs_filename[PATH_MAX]; -@@ -1192,7 +1192,7 @@ fallback: - strcpy(symfs_filename, tmp); - } - -- snprintf(command, sizeof(command), -+ err = asprintf(&command, - "%s %s%s --start-address=0x%016" PRIx64 - " --stop-address=0x%016" PRIx64 - " -l -d %s %s -C %s 2>/dev/null|grep -v %s|expand", -@@ -1205,6 +1205,11 @@ fallback: - symbol_conf.annotate_src ? "-S" : "", - symfs_filename, filename); - -+ if (err < 0) { -+ pr_err("Failure allocating memory for the command to run\n"); -+ goto out_remove_tmp; -+ } -+ - pr_debug("Executing: %s\n", command); - - file = popen(command, "r"); -@@ -1214,7 +1219,7 @@ fallback: - * If we were using debug info should retry with - * original binary. - */ -- goto out_remove_tmp; -+ goto out_free_command; - } - - nline = 0; -@@ -1237,6 +1242,9 @@ fallback: - - pclose(file); - -+out_free_command: -+ free(command); -+ - out_remove_tmp: - if (dso__needs_decompress(dso)) - unlink(symfs_filename); -diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c -index 32e12ecfe9c5..a32f0b34e3ed 100644 ---- a/tools/perf/util/cgroup.c -+++ b/tools/perf/util/cgroup.c -@@ -64,7 +64,7 @@ static int open_cgroup(char *name) - if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1)) - return -1; - -- snprintf(path, PATH_MAX, "%s/%s", mnt, name); -+ scnprintf(path, PATH_MAX, "%s/%s", mnt, name); - - fd = open(path, O_RDONLY); - if (fd == -1) -diff --git a/tools/perf/util/pager.c b/tools/perf/util/pager.c -index 53ef006a951c..b301d779c4af 100644 ---- a/tools/perf/util/pager.c -+++ b/tools/perf/util/pager.c -@@ -16,10 +16,13 @@ static void pager_preexec(void) - * have real input - */ - fd_set in; -+ fd_set exception; - - FD_ZERO(&in); -+ FD_ZERO(&exception); - FD_SET(0, &in); -- select(1, &in, NULL, &in, NULL); -+ FD_SET(0, &exception); -+ select(1, &in, NULL, &exception, NULL); - - setenv("LESS", "FRSX", 0); - } -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index 9351738df703..849ad278dd5d 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -194,8 +194,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config) - - for_each_event(sys_dirent, evt_dir, evt_dirent) { - -- snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path, -- evt_dirent->d_name); -+ scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path, -+ evt_dirent->d_name); - fd = open(evt_path, O_RDONLY); - if (fd < 0) - continue; -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index 4f650ebd564a..5245fbd09106 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -302,7 +302,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) - if (pmu_alias_info_file(name)) - continue; - -- snprintf(path, PATH_MAX, "%s/%s", dir, name); -+ scnprintf(path, PATH_MAX, "%s/%s", dir, name); - - file = fopen(path, "r"); - if (!file) { -diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c -index 0195b7e8c54a..4f05424096b6 100644 ---- a/tools/perf/util/probe-event.c -+++ b/tools/perf/util/probe-event.c -@@ -122,7 +122,7 @@ static struct symbol *__find_kernel_function(u64 addr, struct map **mapp) - return machine__find_kernel_function(host_machine, addr, mapp, NULL); - } - --static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) -+static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap) - { - /* kmap->ref_reloc_sym should be set if host_machine is initialized */ - struct kmap *kmap; -@@ -134,6 +134,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) - kmap = map__kmap(map); - if (!kmap) - return NULL; -+ -+ if (pmap) -+ *pmap = map; -+ - return kmap->ref_reloc_sym; - } - -@@ -145,7 +149,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr, - struct map *map; - - /* ref_reloc_sym is just a label. Need a special fix*/ -- reloc_sym = kernel_get_ref_reloc_sym(); -+ reloc_sym = kernel_get_ref_reloc_sym(NULL); - if (reloc_sym && strcmp(name, reloc_sym->name) == 0) - *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr; - else { -@@ -618,6 +622,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs, - bool uprobe) - { - struct ref_reloc_sym *reloc_sym; -+ struct map *map; - char *tmp; - int i, skipped = 0; - -@@ -628,7 +633,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs, - if (module) - return add_module_to_probe_trace_events(tevs, ntevs, module); - -- reloc_sym = kernel_get_ref_reloc_sym(); -+ reloc_sym = kernel_get_ref_reloc_sym(&map); - if (!reloc_sym) { - pr_warning("Relocated base symbol is not found!\n"); - return -EINVAL; -@@ -637,9 +642,13 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs, - for (i = 0; i < ntevs; i++) { - if (!tevs[i].point.address || tevs[i].point.retprobe) - continue; -- /* If we found a wrong one, mark it by NULL symbol */ -+ /* -+ * If we found a wrong one, mark it by NULL symbol. -+ * Since addresses in debuginfo is same as objdump, we need -+ * to convert it to addresses on memory. -+ */ - if (kprobe_warn_out_range(tevs[i].point.symbol, -- tevs[i].point.address)) { -+ map__objdump_2mem(map, tevs[i].point.address))) { - tmp = NULL; - skipped++; - } else { -@@ -2553,7 +2562,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, - - /* Note that the symbols in the kmodule are not relocated */ - if (!pev->uprobes && !pp->retprobe && !pev->target) { -- reloc_sym = kernel_get_ref_reloc_sym(); -+ reloc_sym = kernel_get_ref_reloc_sym(NULL); - if (!reloc_sym) { - pr_warning("Relocated base symbol is not found!\n"); - ret = -EINVAL; -diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c -index b4db3f48e3b0..2853d4728ab9 100644 ---- a/tools/perf/util/srcline.c -+++ b/tools/perf/util/srcline.c -@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data) - bfd_vma pc, vma; - bfd_size_type size; - struct a2l_data *a2l = data; -+ flagword flags; - - if (a2l->found) - return; - -- if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0) -+#ifdef bfd_get_section_flags -+ flags = bfd_get_section_flags(abfd, section); -+#else -+ flags = bfd_section_flags(section); -+#endif -+ if ((flags & SEC_ALLOC) == 0) - return; - - pc = a2l->addr; -+#ifdef bfd_get_section_vma - vma = bfd_get_section_vma(abfd, section); -+#else -+ vma = bfd_section_vma(section); -+#endif -+#ifdef bfd_get_section_size - size = bfd_get_section_size(section); -+#else -+ size = bfd_section_size(section); -+#endif - - if (pc < vma || pc >= vma + size) - return; diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.232-233-changed.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.232-233-changed.patch deleted file mode 100644 index 0c6a9a4230..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.232-233-changed.patch +++ /dev/null @@ -1,4015 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio -index 0439c2aaf7419..f20c783cb5c03 100644 ---- a/Documentation/ABI/testing/sysfs-bus-iio -+++ b/Documentation/ABI/testing/sysfs-bus-iio -@@ -1470,7 +1470,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw - KernelVersion: 4.3 - Contact: linux-iio@vger.kernel.org - Description: -- Raw (unscaled no offset etc.) percentage reading of a substance. -+ Raw (unscaled no offset etc.) reading of a substance. Units -+ after application of scale and offset are percents. - - What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw - What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw -diff --git a/Makefile b/Makefile -index 47a0a6c8272bf..8f363a3bcaf81 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 232 -+SUBLEVEL = 233 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h -index a89b4076cde47..72821b4721add 100644 ---- a/arch/arm/include/asm/percpu.h -+++ b/arch/arm/include/asm/percpu.h -@@ -16,6 +16,8 @@ - #ifndef _ASM_ARM_PERCPU_H_ - #define _ASM_ARM_PERCPU_H_ - -+#include -+ - /* - * Same as asm-generic/percpu.h, except that we store the per cpu offset - * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7 -diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c -index abcbea1ae30ba..78c6be1b27145 100644 ---- a/arch/arm/kernel/hw_breakpoint.c -+++ b/arch/arm/kernel/hw_breakpoint.c -@@ -688,6 +688,12 @@ static void disable_single_step(struct perf_event *bp) - arch_install_hw_breakpoint(bp); - } - -+static int watchpoint_fault_on_uaccess(struct pt_regs *regs, -+ struct arch_hw_breakpoint *info) -+{ -+ return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER; -+} -+ - static void watchpoint_handler(unsigned long addr, unsigned int fsr, - struct pt_regs *regs) - { -@@ -747,16 +753,27 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr, - } - - pr_debug("watchpoint fired: address = 0x%x\n", info->trigger); -+ -+ /* -+ * If we triggered a user watchpoint from a uaccess routine, -+ * then handle the stepping ourselves since userspace really -+ * can't help us with this. -+ */ -+ if (watchpoint_fault_on_uaccess(regs, info)) -+ goto step; -+ - perf_bp_event(wp, regs); - - /* -- * If no overflow handler is present, insert a temporary -- * mismatch breakpoint so we can single-step over the -- * watchpoint trigger. -+ * Defer stepping to the overflow handler if one is installed. -+ * Otherwise, insert a temporary mismatch breakpoint so that -+ * we can single-step over the watchpoint trigger. - */ -- if (!wp->overflow_handler) -- enable_single_step(wp, instruction_pointer(regs)); -+ if (wp->overflow_handler) -+ goto unlock; - -+step: -+ enable_single_step(wp, instruction_pointer(regs)); - unlock: - rcu_read_unlock(); - } -diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c -index 92b72375c4c72..6e8a50de40e2b 100644 ---- a/arch/arm/kernel/stacktrace.c -+++ b/arch/arm/kernel/stacktrace.c -@@ -19,6 +19,19 @@ - * A simple function epilogue looks like this: - * ldm sp, {fp, sp, pc} - * -+ * When compiled with clang, pc and sp are not pushed. A simple function -+ * prologue looks like this when built with clang: -+ * -+ * stmdb {..., fp, lr} -+ * add fp, sp, #x -+ * sub sp, sp, #y -+ * -+ * A simple function epilogue looks like this when built with clang: -+ * -+ * sub sp, fp, #x -+ * ldm {..., fp, pc} -+ * -+ * - * Note that with framepointer enabled, even the leaf functions have the same - * prologue and epilogue, therefore we can ignore the LR value in this case. - */ -@@ -31,6 +44,16 @@ int notrace unwind_frame(struct stackframe *frame) - low = frame->sp; - high = ALIGN(low, THREAD_SIZE); - -+#ifdef CONFIG_CC_IS_CLANG -+ /* check current frame pointer is within bounds */ -+ if (fp < low + 4 || fp > high - 4) -+ return -EINVAL; -+ -+ frame->sp = frame->fp; -+ frame->fp = *(unsigned long *)(fp); -+ frame->pc = frame->lr; -+ frame->lr = *(unsigned long *)(fp + 4); -+#else - /* check current frame pointer is within bounds */ - if (fp < low + 12 || fp > high - 4) - return -EINVAL; -@@ -39,6 +62,7 @@ int notrace unwind_frame(struct stackframe *frame) - frame->fp = *(unsigned long *)(fp - 12); - frame->sp = *(unsigned long *)(fp - 8); - frame->pc = *(unsigned long *)(fp - 4); -+#endif - - return 0; - } -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index 84eefbc2b4f93..5923f2ca510be 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -393,13 +393,13 @@ static void __init at91_pm_sram_init(void) - sram_pool = gen_pool_get(&pdev->dev, NULL); - if (!sram_pool) { - pr_warn("%s: sram pool unavailable!\n", __func__); -- return; -+ goto out_put_device; - } - - sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz); - if (!sram_base) { - pr_warn("%s: unable to alloc sram!\n", __func__); -- return; -+ goto out_put_device; - } - - sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base); -@@ -407,12 +407,17 @@ static void __init at91_pm_sram_init(void) - at91_pm_suspend_in_sram_sz, false); - if (!at91_suspend_sram_fn) { - pr_warn("SRAM: Could not map\n"); -- return; -+ goto out_put_device; - } - - /* Copy the pm suspend handler to SRAM */ - at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn, - &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz); -+ return; -+ -+out_put_device: -+ put_device(&pdev->dev); -+ return; - } - - static void __init at91_pm_init(void) -diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c -index c378ab0c24317..93f2245c97750 100644 ---- a/arch/arm/mach-socfpga/pm.c -+++ b/arch/arm/mach-socfpga/pm.c -@@ -60,14 +60,14 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!ocram_pool) { - pr_warn("%s: ocram pool unavailable!\n", __func__); - ret = -ENODEV; -- goto put_node; -+ goto put_device; - } - - ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz); - if (!ocram_base) { - pr_warn("%s: unable to alloc ocram!\n", __func__); - ret = -ENOMEM; -- goto put_node; -+ goto put_device; - } - - ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); -@@ -78,7 +78,7 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!suspend_ocram_base) { - pr_warn("%s: __arm_ioremap_exec failed!\n", __func__); - ret = -ENOMEM; -- goto put_node; -+ goto put_device; - } - - /* Copy the code that puts DDR in self refresh to ocram */ -@@ -92,6 +92,8 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!socfpga_sdram_self_refresh_in_ocram) - ret = -EFAULT; - -+put_device: -+ put_device(&pdev->dev); - put_node: - of_node_put(np); - -diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c -index 4d2adfb32a2ab..358ca965cf824 100644 ---- a/arch/m68k/mac/iop.c -+++ b/arch/m68k/mac/iop.c -@@ -173,7 +173,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8 - - static __inline__ void iop_stop(volatile struct mac_iop *iop) - { -- iop->status_ctrl &= ~IOP_RUN; -+ iop->status_ctrl = IOP_AUTOINC; - } - - static __inline__ void iop_start(volatile struct mac_iop *iop) -@@ -181,14 +181,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop) - iop->status_ctrl = IOP_RUN | IOP_AUTOINC; - } - --static __inline__ void iop_bypass(volatile struct mac_iop *iop) --{ -- iop->status_ctrl |= IOP_BYPASS; --} -- - static __inline__ void iop_interrupt(volatile struct mac_iop *iop) - { -- iop->status_ctrl |= IOP_IRQ; -+ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC; - } - - static int iop_alive(volatile struct mac_iop *iop) -@@ -239,7 +234,6 @@ void __init iop_preinit(void) - } else { - iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA; - } -- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87; - iop_scc_present = 1; - } else { - iop_base[IOP_NUM_SCC] = NULL; -@@ -251,7 +245,7 @@ void __init iop_preinit(void) - } else { - iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA; - } -- iop_base[IOP_NUM_ISM]->status_ctrl = 0; -+ iop_stop(iop_base[IOP_NUM_ISM]); - iop_ism_present = 1; - } else { - iop_base[IOP_NUM_ISM] = NULL; -@@ -416,7 +410,8 @@ static void iop_handle_send(uint iop_num, uint chan) - iop_free_msg(msg2); - - iop_send_queue[iop_num][chan] = msg; -- if (msg) iop_do_send(msg); -+ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) -+ iop_do_send(msg); - } - - /* -@@ -497,16 +492,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata, - - if (!(q = iop_send_queue[iop_num][chan])) { - iop_send_queue[iop_num][chan] = msg; -+ iop_do_send(msg); - } else { - while (q->next) q = q->next; - q->next = msg; - } - -- if (iop_readb(iop_base[iop_num], -- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) { -- iop_do_send(msg); -- } -- - return 0; - } - -diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c -index cf3eb61fad121..68da7613874aa 100644 ---- a/arch/mips/kernel/topology.c -+++ b/arch/mips/kernel/topology.c -@@ -19,7 +19,7 @@ static int __init topology_init(void) - for_each_present_cpu(i) { - struct cpu *c = &per_cpu(cpu_devices, i); - -- c->hotpluggable = 1; -+ c->hotpluggable = !!i; - ret = register_cpu(c, i); - if (ret) - printk(KERN_WARNING "topology_init: register_cpu %d " -diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h -index 2cedefddba37f..61c78205a1d36 100644 ---- a/arch/powerpc/include/asm/percpu.h -+++ b/arch/powerpc/include/asm/percpu.h -@@ -9,8 +9,6 @@ - - #ifdef CONFIG_SMP - --#include -- - #define __my_cpu_offset local_paca->data_offset - - #endif /* CONFIG_SMP */ -@@ -18,4 +16,6 @@ - - #include - -+#include -+ - #endif /* _ASM_POWERPC_PERCPU_H_ */ -diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c -index b457bfa284360..05c17429e5442 100644 ---- a/arch/powerpc/kernel/vdso.c -+++ b/arch/powerpc/kernel/vdso.c -@@ -702,7 +702,7 @@ int vdso_getcpu_init(void) - node = cpu_to_node(cpu); - WARN_ON_ONCE(node > 0xffff); - -- val = (cpu & 0xfff) | ((node & 0xffff) << 16); -+ val = (cpu & 0xffff) | ((node & 0xffff) << 16); - mtspr(SPRN_SPRG_VDSO_WRITE, val); - get_paca()->sprg_vdso = val; - -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index 0e65d52eb56d3..2025e772fc9c9 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -29,7 +29,7 @@ static bool rtas_hp_event; - unsigned long pseries_memory_block_size(void) - { - struct device_node *np; -- unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE; -+ u64 memblock_size = MIN_MEMORY_BLOCK_SIZE; - struct resource r; - - np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); -diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c -index f1147caebacf0..af69fb7fef7c7 100644 ---- a/arch/sh/boards/mach-landisk/setup.c -+++ b/arch/sh/boards/mach-landisk/setup.c -@@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup); - - static void __init landisk_setup(char **cmdline_p) - { -+ /* I/O port identity mapping */ -+ __set_io_port_base(0); -+ - /* LED ON */ - __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); - -diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S -index 5a9017ba26aba..3b0aa0ae43b4b 100644 ---- a/arch/sh/kernel/entry-common.S -+++ b/arch/sh/kernel/entry-common.S -@@ -203,7 +203,7 @@ syscall_trace_entry: - mov.l @(OFF_R7,r15), r7 ! arg3 - mov.l @(OFF_R3,r15), r3 ! syscall_nr - ! -- mov.l 2f, r10 ! Number of syscalls -+ mov.l 6f, r10 ! Number of syscalls - cmp/hs r10, r3 - bf syscall_call - mov #-ENOSYS, r0 -@@ -348,7 +348,7 @@ ENTRY(system_call) - tst r9, r8 - bf syscall_trace_entry - ! -- mov.l 2f, r8 ! Number of syscalls -+ mov.l 6f, r8 ! Number of syscalls - cmp/hs r8, r3 - bt syscall_badsys - ! -@@ -387,7 +387,7 @@ syscall_exit: - #if !defined(CONFIG_CPU_SH2) - 1: .long TRA - #endif --2: .long NR_syscalls -+6: .long NR_syscalls - 3: .long sys_call_table - 7: .long do_syscall_trace_enter - 8: .long do_syscall_trace_leave -diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c -index 4e3b8a587c882..01a1ab8483ac5 100644 ---- a/arch/x86/kernel/i8259.c -+++ b/arch/x86/kernel/i8259.c -@@ -204,7 +204,7 @@ spurious_8259A_irq: - * lets ACK and report it. [once per IRQ] - */ - if (!(spurious_irq_mask & irqmask)) { -- printk(KERN_DEBUG -+ printk_deferred(KERN_DEBUG - "spurious 8259A interrupt: IRQ%d.\n", irq); - spurious_irq_mask |= irqmask; - } -diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c -index 4c2836dc825be..47d8a85c90ff5 100644 ---- a/drivers/acpi/acpica/exprep.c -+++ b/drivers/acpi/acpica/exprep.c -@@ -502,10 +502,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info) - (u8)access_byte_width; - } - } -- /* An additional reference for the container */ -- -- acpi_ut_add_reference(obj_desc->field.region_obj); -- - ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, - "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n", - obj_desc->field.start_field_bit_offset, -diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c -index 1638312e3d8f9..9f8b088e21d7e 100644 ---- a/drivers/acpi/acpica/utdelete.c -+++ b/drivers/acpi/acpica/utdelete.c -@@ -590,11 +590,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) - next_object = object->buffer_field.buffer_obj; - break; - -- case ACPI_TYPE_LOCAL_REGION_FIELD: -- -- next_object = object->field.region_obj; -- break; -- - case ACPI_TYPE_LOCAL_BANK_FIELD: - - next_object = object->bank_field.bank_obj; -@@ -635,6 +630,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) - } - break; - -+ case ACPI_TYPE_LOCAL_REGION_FIELD: - case ACPI_TYPE_REGION: - default: - -diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c -index 480fa6ffbc090..04fca6db273ef 100644 ---- a/drivers/atm/atmtcp.c -+++ b/drivers/atm/atmtcp.c -@@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf) - return -EMEDIUMTYPE; - } - dev_data = PRIV(dev); -- if (!dev_data->persist) return 0; -+ if (!dev_data->persist) { -+ atm_dev_put(dev); -+ return 0; -+ } - dev_data->persist = 0; -- if (PRIV(dev)->vcc) return 0; -+ if (PRIV(dev)->vcc) { -+ atm_dev_put(dev); -+ return 0; -+ } - kfree(dev_data); - atm_dev_put(dev); - atm_dev_deregister(dev); -diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c -index 76afc841232cf..3d11f5adb355e 100644 ---- a/drivers/char/agp/intel-gtt.c -+++ b/drivers/char/agp/intel-gtt.c -@@ -303,8 +303,10 @@ static int intel_gtt_setup_scratch_page(void) - if (intel_private.needs_dmar) { - dma_addr = pci_map_page(intel_private.pcidev, page, 0, - PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); -- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) -+ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) { -+ __free_page(page); - return -EINVAL; -+ } - - intel_private.scratch_page_dma = dma_addr; - } else -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 661ed5ec546e5..7bb1e423eb190 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -923,6 +923,7 @@ void add_interrupt_randomness(int irq, int irq_flags) - - fast_mix(fast_pool); - add_interrupt_bench(cycles); -+ this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]); - - if ((fast_pool->count < 64) && - !time_after(now, fast_pool->last + HZ)) -diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c -index c5eaa9d162476..9af2d0dcd6a0f 100644 ---- a/drivers/clk/sirf/clk-atlas6.c -+++ b/drivers/clk/sirf/clk-atlas6.c -@@ -137,7 +137,7 @@ static void __init atlas6_clk_init(struct device_node *np) - - for (i = pll1; i < maxclk; i++) { - atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]); -- BUG_ON(!atlas6_clks[i]); -+ BUG_ON(IS_ERR(atlas6_clks[i])); - } - clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu"); - clk_register_clkdev(atlas6_clks[io], NULL, "io"); -diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c -index c48f181e89415..923bb1988973b 100644 ---- a/drivers/crypto/qat/qat_common/qat_uclo.c -+++ b/drivers/crypto/qat/qat_common/qat_uclo.c -@@ -307,13 +307,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle - } - return 0; - out_err: -+ /* Do not free the list head unless we allocated it. */ -+ tail_old = tail_old->next; -+ if (flag) { -+ kfree(*init_tab_base); -+ *init_tab_base = NULL; -+ } -+ - while (tail_old) { - mem_init = tail_old->next; - kfree(tail_old); - tail_old = mem_init; - } -- if (flag) -- kfree(*init_tab_base); - return -ENOMEM; - } - -diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c -index fb68a06ad6837..18991cfec2af4 100644 ---- a/drivers/edac/edac_device_sysfs.c -+++ b/drivers/edac/edac_device_sysfs.c -@@ -280,6 +280,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev) - - /* Error exit stack */ - err_kobj_reg: -+ kobject_put(&edac_dev->kobj); - module_put(edac_dev->owner); - - err_mod_get: -diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c -index 24d877f6e5775..c56128402bc67 100644 ---- a/drivers/edac/edac_pci_sysfs.c -+++ b/drivers/edac/edac_pci_sysfs.c -@@ -394,7 +394,7 @@ static int edac_pci_main_kobj_setup(void) - - /* Error unwind statck */ - kobject_init_and_add_fail: -- kfree(edac_pci_top_main_kobj); -+ kobject_put(edac_pci_top_main_kobj); - - kzalloc_fail: - module_put(THIS_MODULE); -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index 5fe34a9df3e6b..179ad7c35ae33 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -91,7 +91,7 @@ struct gpio_desc *of_get_named_gpiod_flags(struct device_node *np, - &gg_data.gpiospec); - if (ret) { - pr_debug("%s: can't parse '%s' property of node '%s[%d]'\n", -- __func__, propname, np->full_name, index); -+ __func__, propname, np ? np->full_name : NULL, index); - return ERR_PTR(ret); - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index e35e603710b4d..5bf98f0195fbd 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -428,9 +428,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - return n ? -EFAULT : 0; - } - case AMDGPU_INFO_DEV_INFO: { -- struct drm_amdgpu_info_device dev_info = {}; -+ struct drm_amdgpu_info_device dev_info; - struct amdgpu_cu_info cu_info; - -+ memset(&dev_info, 0, sizeof(dev_info)); - dev_info.device_id = dev->pdev->device; - dev_info.chip_rev = adev->rev_id; - dev_info.external_rev = adev->external_rev_id; -diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c -index 3bcf8e6a85b35..5b0fdcd0b63fd 100644 ---- a/drivers/gpu/drm/drm_debugfs.c -+++ b/drivers/gpu/drm/drm_debugfs.c -@@ -290,13 +290,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, - - buf[len] = '\0'; - -- if (!strcmp(buf, "on")) -+ if (sysfs_streq(buf, "on")) - connector->force = DRM_FORCE_ON; -- else if (!strcmp(buf, "digital")) -+ else if (sysfs_streq(buf, "digital")) - connector->force = DRM_FORCE_ON_DIGITAL; -- else if (!strcmp(buf, "off")) -+ else if (sysfs_streq(buf, "off")) - connector->force = DRM_FORCE_OFF; -- else if (!strcmp(buf, "unspecified")) -+ else if (sysfs_streq(buf, "unspecified")) - connector->force = DRM_FORCE_UNSPECIFIED; - else - return -EINVAL; -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index 9147113139beb..67d5ead98a363 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -652,9 +652,6 @@ err: - * @file_priv: drm file-private structure - * - * Open an object using the global name, returning a handle and the size. -- * -- * This handle (of course) holds a reference to the object, so the object -- * will not go away until the handle is deleted. - */ - int - drm_gem_open_ioctl(struct drm_device *dev, void *data, -@@ -679,14 +676,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, - - /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ - ret = drm_gem_handle_create_tail(file_priv, obj, &handle); -- drm_gem_object_unreference_unlocked(obj); - if (ret) -- return ret; -+ goto err; - - args->handle = handle; - args->size = obj->size; - -- return 0; -+err: -+ drm_gem_object_unreference_unlocked(obj); -+ return ret; - } - - /** -diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c -index 91a61d2cca889..a90840e391100 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_drm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c -@@ -805,8 +805,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) - - /* need to bring up power immediately if opening device */ - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - get_task_comm(tmpname, current); - snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); -@@ -894,8 +896,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - long ret; - - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) { - case DRM_NOUVEAU_NVIF: -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index 343476d157266..edb3a23ded5d5 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -566,6 +566,7 @@ fini: - drm_fb_helper_fini(&fbcon->helper); - free: - kfree(fbcon); -+ drm->fbcon = NULL; - return ret; - } - -diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index ae560f5977fca..e5db2a385cb65 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_gem.c -+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -42,8 +42,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (WARN_ON(ret < 0 && ret != -EACCES)) -+ if (WARN_ON(ret < 0 && ret != -EACCES)) { -+ pm_runtime_put_autosuspend(dev); - return; -+ } - - if (gem->import_attach) - drm_prime_gem_destroy(gem, nvbo->bo.sg); -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index ecad4d7c6cd17..64b23bdebd1d1 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -920,7 +920,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = { - static const struct panel_desc lg_lb070wv8 = { - .modes = &lg_lb070wv8_mode, - .num_modes = 1, -- .bpc = 16, -+ .bpc = 8, - .size = { - .width = 151, - .height = 91, -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index e7a245d7bdbcb..8e1bf9ed8efff 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -4345,7 +4345,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev, - table->mc_reg_table_entry[k].mc_data[j] |= 0x100; - } - j++; -- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) -+ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) - return -EINVAL; - - if (!pi->mem_gddr5) { -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index 4572bfba017c5..17c73b8c90e71 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -660,8 +660,10 @@ radeon_crtc_set_config(struct drm_mode_set *set) - dev = set->crtc->dev; - - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - ret = drm_crtc_helper_set_config(set); - -diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c -index 5b6a6f5b3619e..401403a3ea50c 100644 ---- a/drivers/gpu/drm/radeon/radeon_drv.c -+++ b/drivers/gpu/drm/radeon/radeon_drv.c -@@ -527,8 +527,10 @@ long radeon_drm_ioctl(struct file *filp, - long ret; - dev = file_priv->minor->dev; - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - ret = drm_ioctl(filp, cmd, arg); - -diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c -index d290a8a09036e..41caf7da90548 100644 ---- a/drivers/gpu/drm/radeon/radeon_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_kms.c -@@ -631,8 +631,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - file_priv->driver_priv = NULL; - - r = pm_runtime_get_sync(dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return r; -+ } - - /* new gpu have virtual address space support */ - if (rdev->family >= CHIP_CAYMAN) { -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c -index 0af8bed7ce1ee..08d8f608be632 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c -@@ -177,12 +177,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) - int i; - - for (i = 0; i < timings->num_timings; i++) { -- struct drm_display_mode *mode = drm_mode_create(dev); -+ struct drm_display_mode *mode; - struct videomode vm; - - if (videomode_from_timings(timings, &vm, i)) - break; - -+ mode = drm_mode_create(dev); -+ if (!mode) -+ break; -+ - drm_display_mode_from_videomode(&vm, mode); - - mode->type = DRM_MODE_TYPE_DRIVER; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index 9b97f70fbb3df..0b7427d474feb 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -2086,7 +2086,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, - ++i; - } - -- if (i != unit) { -+ if (&con->head == &dev_priv->dev->mode_config.connector_list) { - DRM_ERROR("Could not find initial display unit.\n"); - return -EINVAL; - } -@@ -2108,13 +2108,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, - break; - } - -- if (mode->type & DRM_MODE_TYPE_PREFERRED) -- *p_mode = mode; -- else { -+ if (&mode->head == &con->modes) { - WARN_ONCE(true, "Could not find initial preferred mode.\n"); - *p_mode = list_first_entry(&con->modes, - struct drm_display_mode, - head); -+ } else { -+ *p_mode = mode; - } - - return 0; -diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c -index 6d32e6da3110d..84deed6571bdf 100644 ---- a/drivers/i2c/busses/i2c-cadence.c -+++ b/drivers/i2c/busses/i2c-cadence.c -@@ -378,10 +378,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) - * Check for the message size against FIFO depth and set the - * 'hold bus' bit if it is greater than FIFO depth. - */ -- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) -+ if (id->recv_count > CDNS_I2C_FIFO_DEPTH) - ctrl_reg |= CDNS_I2C_CR_HOLD; -- else -- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; - - cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); - -@@ -438,11 +436,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id) - * Check for the message size against FIFO depth and set the - * 'hold bus' bit if it is greater than FIFO depth. - */ -- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) -+ if (id->send_count > CDNS_I2C_FIFO_DEPTH) - ctrl_reg |= CDNS_I2C_CR_HOLD; -- else -- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; -- - cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); - - /* Clear the interrupts in interrupt status register. */ -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index dfe1a53ce4ad3..ddfb08a3e6c20 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -386,13 +386,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); - } - -- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); -+ /* Clear SSR, too, because of old STOPs to other clients than us */ -+ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); - } - - /* master sent stop */ - if (ssr_filtered & SSR) { - i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); -- rcar_i2c_write(priv, ICSIER, SAR | SSR); -+ rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); - } - -@@ -541,7 +542,7 @@ static int rcar_reg_slave(struct i2c_client *slave) - priv->slave = slave; - rcar_i2c_write(priv, ICSAR, slave->addr); - rcar_i2c_write(priv, ICSSR, 0); -- rcar_i2c_write(priv, ICSIER, SAR | SSR); -+ rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSCR, SIE | SDBS); - - return 0; -diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c -index 11c32ac8234b2..779d0b9341c0d 100644 ---- a/drivers/input/mouse/sentelic.c -+++ b/drivers/input/mouse/sentelic.c -@@ -454,7 +454,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data, - - fsp_reg_write_enable(psmouse, false); - -- return count; -+ return retval; - } - - PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg); -diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c -index 9bc20e2119a35..82bf208295f4b 100644 ---- a/drivers/iommu/omap-iommu-debug.c -+++ b/drivers/iommu/omap-iommu-debug.c -@@ -101,8 +101,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf, - mutex_lock(&iommu_debug_lock); - - bytes = omap_iommu_dump_ctx(obj, p, count); -+ if (bytes < 0) -+ goto err; - bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes); - -+err: - mutex_unlock(&iommu_debug_lock); - kfree(buf); - -diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c -index 48872997d6b4b..533b255c27cd6 100644 ---- a/drivers/leds/leds-lm355x.c -+++ b/drivers/leds/leds-lm355x.c -@@ -177,18 +177,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip) - /* input and output pins configuration */ - switch (chip->type) { - case CHIP_LM3554: -- reg_val = pdata->pin_tx2 | pdata->ntc_pin; -+ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin; - ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val); - if (ret < 0) - goto out; -- reg_val = pdata->pass_mode; -+ reg_val = (u32)pdata->pass_mode; - ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val); - if (ret < 0) - goto out; - break; - - case CHIP_LM3556: -- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; -+ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin | -+ (u32)pdata->pass_mode; - ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val); - if (ret < 0) - goto out; -diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c -index 158eae17031c4..1440436214291 100644 ---- a/drivers/md/bcache/bset.c -+++ b/drivers/md/bcache/bset.c -@@ -317,7 +317,7 @@ int bch_btree_keys_alloc(struct btree_keys *b, unsigned page_order, gfp_t gfp) - - b->page_order = page_order; - -- t->data = (void *) __get_free_pages(gfp, b->page_order); -+ t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order); - if (!t->data) - goto err; - -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 634e9284b7bee..122d975220945 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -795,7 +795,7 @@ int bch_btree_cache_alloc(struct cache_set *c) - mutex_init(&c->verify_lock); - - c->verify_ondisk = (void *) -- __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c))); -+ __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c))); - - c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL); - -diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c -index 6f9db98f2dfd7..1d798938e9dfd 100644 ---- a/drivers/md/bcache/journal.c -+++ b/drivers/md/bcache/journal.c -@@ -838,8 +838,8 @@ int bch_journal_alloc(struct cache_set *c) - j->w[1].c = c; - - if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) || -- !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) || -- !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS))) -+ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) || -+ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS))) - return -ENOMEM; - - return 0; -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index df8f1e69077f6..f7f8fb079d2a9 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1469,7 +1469,7 @@ void bch_cache_set_unregister(struct cache_set *c) - } - - #define alloc_bucket_pages(gfp, c) \ -- ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) -+ ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c)))) - - struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) - { -@@ -1778,7 +1778,14 @@ found: - sysfs_create_link(&c->kobj, &ca->kobj, buf)) - goto err; - -- if (ca->sb.seq > c->sb.seq) { -+ /* -+ * A special case is both ca->sb.seq and c->sb.seq are 0, -+ * such condition happens on a new created cache device whose -+ * super block is never flushed yet. In this case c->sb.version -+ * and other members should be updated too, otherwise we will -+ * have a mistaken super block version in cache set. -+ */ -+ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { - c->sb.version = ca->sb.version; - memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); - c->sb.flags = ca->sb.flags; -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index f061c81e15e1e..99cd843351c2b 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3345,6 +3345,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, - * is missing/faulty, then we need to read everything we can. - */ - if (sh->raid_conf->level != 6 && -+ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW && - sh->sector < sh->raid_conf->mddev->recovery_cp) - /* reconstruct-write isn't being forced */ - return 0; -@@ -4479,7 +4480,7 @@ static void handle_stripe(struct stripe_head *sh) - * or to load a block that is being partially written. - */ - if (s.to_read || s.non_overwrite -- || (conf->level == 6 && s.to_write && s.failed) -+ || (s.to_write && s.failed) - || (s.syncing && (s.uptodate + s.compute < disks)) - || s.replacing - || s.expanding) -diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c -index 247f0e7cb5f7f..5d634706a7eaa 100644 ---- a/drivers/media/firewire/firedtv-fw.c -+++ b/drivers/media/firewire/firedtv-fw.c -@@ -271,6 +271,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) - - name_len = fw_csr_string(unit->directory, CSR_MODEL, - name, sizeof(name)); -+ if (name_len < 0) -+ return name_len; - for (i = ARRAY_SIZE(model_names); --i; ) - if (strlen(model_names[i]) <= name_len && - strncmp(name, model_names[i], name_len) == 0) -diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c -index c1aa888af7054..83864a99d3a66 100644 ---- a/drivers/media/pci/cx23885/cx23888-ir.c -+++ b/drivers/media/pci/cx23885/cx23888-ir.c -@@ -1179,8 +1179,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev) - return -ENOMEM; - - spin_lock_init(&state->rx_kfifo_lock); -- if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL)) -+ if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, -+ GFP_KERNEL)) { -+ kfree(state); - return -ENOMEM; -+ } - - state->dev = dev; - sd = &state->sd; -diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c -index 4f5586a4cbffa..31cc7d94064e3 100644 ---- a/drivers/media/platform/exynos4-is/media-dev.c -+++ b/drivers/media/platform/exynos4-is/media-dev.c -@@ -1172,6 +1172,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) - - pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, - PINCTRL_STATE_IDLE); -+ if (IS_ERR(pctl->state_idle)) -+ return PTR_ERR(pctl->state_idle); -+ - return 0; - } - -diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c -index c9e8845de1b1d..c3336a2cbe145 100644 ---- a/drivers/media/platform/omap3isp/isppreview.c -+++ b/drivers/media/platform/omap3isp/isppreview.c -@@ -2285,7 +2285,7 @@ static int preview_init_entities(struct isp_prev_device *prev) - me->ops = &preview_media_ops; - ret = media_entity_init(me, PREV_PADS_NUM, pads, 0); - if (ret < 0) -- return ret; -+ goto error_handler_free; - - preview_init_formats(sd, NULL); - -@@ -2331,6 +2331,8 @@ error_video_out: - omap3isp_video_cleanup(&prev->video_in); - error_video_in: - media_entity_cleanup(&prev->subdev.entity); -+error_handler_free: -+ v4l2_ctrl_handler_free(&prev->ctrls); - return ret; - } - -diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c -index 672831d5ee32e..97a69cd6f1278 100644 ---- a/drivers/mfd/dln2.c -+++ b/drivers/mfd/dln2.c -@@ -294,7 +294,11 @@ static void dln2_rx(struct urb *urb) - len = urb->actual_length - sizeof(struct dln2_header); - - if (handle == DLN2_HANDLE_EVENT) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&dln2->event_cb_lock, flags); - dln2_run_event_callbacks(dln2, id, echo, data, len); -+ spin_unlock_irqrestore(&dln2->event_cb_lock, flags); - } else { - /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ - if (dln2_transfer_complete(dln2, urb, handle, echo)) -diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c -index 02006f7109a80..ce292d7766db2 100644 ---- a/drivers/misc/cxl/sysfs.c -+++ b/drivers/misc/cxl/sysfs.c -@@ -539,7 +539,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c - rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type, - &afu->dev.kobj, "cr%i", cr->cr); - if (rc) -- goto err; -+ goto err1; - - rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr); - if (rc) -@@ -555,9 +555,6 @@ err2: - err1: - kobject_put(&cr->kobj); - return ERR_PTR(rc); --err: -- kfree(cr); -- return ERR_PTR(rc); - } - - void cxl_sysfs_afu_remove(struct cxl_afu *afu) -diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c -index 0d244dac1ccb3..ce87d9506f6a4 100644 ---- a/drivers/mtd/mtdchar.c -+++ b/drivers/mtd/mtdchar.c -@@ -372,9 +372,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd, - uint32_t retlen; - int ret = 0; - -- if (!(file->f_mode & FMODE_WRITE)) -- return -EPERM; -- - if (length > 4096) - return -EINVAL; - -@@ -608,6 +605,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) - return -EFAULT; - } - -+ /* -+ * Check the file mode to require "dangerous" commands to have write -+ * permissions. -+ */ -+ switch (cmd) { -+ /* "safe" commands */ -+ case MEMGETREGIONCOUNT: -+ case MEMGETREGIONINFO: -+ case MEMGETINFO: -+ case MEMREADOOB: -+ case MEMREADOOB64: -+ case MEMLOCK: -+ case MEMUNLOCK: -+ case MEMISLOCKED: -+ case MEMGETOOBSEL: -+ case MEMGETBADBLOCK: -+ case MEMSETBADBLOCK: -+ case OTPSELECT: -+ case OTPGETREGIONCOUNT: -+ case OTPGETREGIONINFO: -+ case OTPLOCK: -+ case ECCGETLAYOUT: -+ case ECCGETSTATS: -+ case MTDFILEMODE: -+ case BLKPG: -+ case BLKRRPART: -+ break; -+ -+ /* "dangerous" commands */ -+ case MEMERASE: -+ case MEMERASE64: -+ case MEMWRITEOOB: -+ case MEMWRITEOOB64: -+ case MEMWRITE: -+ if (!(file->f_mode & FMODE_WRITE)) -+ return -EPERM; -+ break; -+ -+ default: -+ return -ENOTTY; -+ } -+ - switch (cmd) { - case MEMGETREGIONCOUNT: - if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) -@@ -655,9 +694,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) - { - struct erase_info *erase; - -- if(!(file->f_mode & FMODE_WRITE)) -- return -EPERM; -- - erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); - if (!erase) - ret = -ENOMEM; -@@ -982,9 +1018,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) - ret = 0; - break; - } -- -- default: -- ret = -ENOTTY; - } - - return ret; -@@ -1028,6 +1061,11 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd, - struct mtd_oob_buf32 buf; - struct mtd_oob_buf32 __user *buf_user = argp; - -+ if (!(file->f_mode & FMODE_WRITE)) { -+ ret = -EPERM; -+ break; -+ } -+ - if (copy_from_user(&buf, argp, sizeof(buf))) - ret = -EFAULT; - else -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 426abfce1c3ff..a4aa4d10ca700 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -5137,9 +5137,18 @@ static void igb_reset_task(struct work_struct *work) - struct igb_adapter *adapter; - adapter = container_of(work, struct igb_adapter, reset_task); - -+ rtnl_lock(); -+ /* If we're already down or resetting, just bail */ -+ if (test_bit(__IGB_DOWN, &adapter->state) || -+ test_bit(__IGB_RESETTING, &adapter->state)) { -+ rtnl_unlock(); -+ return; -+ } -+ - igb_dump(adapter); - netdev_err(adapter->netdev, "Reset adapter\n"); - igb_reinit_locked(adapter); -+ rtnl_unlock(); - } - - /** -diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c -index 97f0d93caf994..085aaad902937 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/core.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c -@@ -1208,9 +1208,10 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb, - break; - } - } -- rcu_read_unlock(); -- if (!found) -+ if (!found) { -+ rcu_read_unlock(); - goto drop; -+ } - - pcpu_stats = this_cpu_ptr(mlxsw_core->pcpu_stats); - u64_stats_update_begin(&pcpu_stats->syncp); -@@ -1221,6 +1222,7 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb, - u64_stats_update_end(&pcpu_stats->syncp); - - rxl->func(skb, local_port, rxl_item->priv); -+ rcu_read_unlock(); - return; - - drop: -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 5b6320f9c935f..460b29ac5fd86 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1291,6 +1291,7 @@ static void ravb_tx_timeout_work(struct work_struct *work) - struct ravb_private *priv = container_of(work, struct ravb_private, - work); - struct net_device *ndev = priv->ndev; -+ int error; - - netif_tx_stop_all_queues(ndev); - -@@ -1298,15 +1299,36 @@ static void ravb_tx_timeout_work(struct work_struct *work) - ravb_ptp_stop(ndev); - - /* Wait for DMA stopping */ -- ravb_stop_dma(ndev); -+ if (ravb_stop_dma(ndev)) { -+ /* If ravb_stop_dma() fails, the hardware is still operating -+ * for TX and/or RX. So, this should not call the following -+ * functions because ravb_dmac_init() is possible to fail too. -+ * Also, this should not retry ravb_stop_dma() again and again -+ * here because it's possible to wait forever. So, this just -+ * re-enables the TX and RX and skip the following -+ * re-initialization procedure. -+ */ -+ ravb_rcv_snd_enable(ndev); -+ goto out; -+ } - - ravb_ring_free(ndev, RAVB_BE); - ravb_ring_free(ndev, RAVB_NC); - - /* Device init */ -- ravb_dmac_init(ndev); -+ error = ravb_dmac_init(ndev); -+ if (error) { -+ /* If ravb_dmac_init() fails, descriptors are freed. So, this -+ * should return here to avoid re-enabling the TX and RX in -+ * ravb_emac_init(). -+ */ -+ netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n", -+ __func__, error); -+ return; -+ } - ravb_emac_init(ndev); - -+out: - /* Initialise PTP Clock driver */ - ravb_ptp_init(ndev, priv->pdev); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -index 15aabffd21a8b..ee5a7c05a0e67 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -@@ -360,6 +360,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - plat_dat->has_gmac = true; - plat_dat->bsp_priv = gmac; - plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; -+ plat_dat->multicast_filter_bins = 0; - - return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -index b535f6c378386..ac08031c481fa 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -@@ -146,6 +146,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw, - value = GMAC_FRAME_FILTER_PR; - } else if (dev->flags & IFF_ALLMULTI) { - value = GMAC_FRAME_FILTER_PM; /* pass all multi */ -+ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) { -+ /* Fall back to all multicast if we've no filter */ -+ value = GMAC_FRAME_FILTER_PM; - } else if (!netdev_mc_empty(dev)) { - struct netdev_hw_addr *ha; - -diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c -index 8e53211aedd82..53600e28d93b7 100644 ---- a/drivers/net/ethernet/toshiba/spider_net.c -+++ b/drivers/net/ethernet/toshiba/spider_net.c -@@ -297,8 +297,8 @@ spider_net_free_chain(struct spider_net_card *card, - descr = descr->next; - } while (descr != chain->ring); - -- dma_free_coherent(&card->pdev->dev, chain->num_desc, -- chain->hwring, chain->dma_addr); -+ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr), -+ chain->hwring, chain->dma_addr); - } - - /** -diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c -index 4bde5e728fe0a..fd8692b477c96 100644 ---- a/drivers/net/phy/mdio-bcm-unimac.c -+++ b/drivers/net/phy/mdio-bcm-unimac.c -@@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) - return -ENOMEM; - - r = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!r) -+ return -EINVAL; - - /* Just ioremap, as this MDIO block is usually integrated into an - * Ethernet MAC controller register range -diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c -index cbbff16d438f5..efd4bf06f6ada 100644 ---- a/drivers/net/usb/hso.c -+++ b/drivers/net/usb/hso.c -@@ -2280,12 +2280,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs, - - minor = get_free_serial_index(); - if (minor < 0) -- goto exit; -+ goto exit2; - - /* register our minor number */ - serial->parent->dev = tty_port_register_device_attr(&serial->port, - tty_drv, minor, &serial->parent->interface->dev, - serial->parent, hso_serial_dev_groups); -+ if (IS_ERR(serial->parent->dev)) -+ goto exit2; - dev = serial->parent->dev; - - /* fill in specific data for later use */ -@@ -2335,6 +2337,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs, - return 0; - exit: - hso_serial_tty_unregister(serial); -+exit2: - hso_serial_common_free(serial); - return -1; - } -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 75a3865a80d23..1439863e9061d 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -251,10 +251,6 @@ struct lan78xx_net { - struct tasklet_struct bh; - struct delayed_work wq; - -- struct usb_host_endpoint *ep_blkin; -- struct usb_host_endpoint *ep_blkout; -- struct usb_host_endpoint *ep_intr; -- - int msg_enable; - - struct urb *urb_intr; -@@ -2180,77 +2176,12 @@ netdev_tx_t lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net) - return NETDEV_TX_OK; - } - --int lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf) --{ -- int tmp; -- struct usb_host_interface *alt = NULL; -- struct usb_host_endpoint *in = NULL, *out = NULL; -- struct usb_host_endpoint *status = NULL; -- -- for (tmp = 0; tmp < intf->num_altsetting; tmp++) { -- unsigned ep; -- -- in = NULL; -- out = NULL; -- status = NULL; -- alt = intf->altsetting + tmp; -- -- for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) { -- struct usb_host_endpoint *e; -- int intr = 0; -- -- e = alt->endpoint + ep; -- switch (e->desc.bmAttributes) { -- case USB_ENDPOINT_XFER_INT: -- if (!usb_endpoint_dir_in(&e->desc)) -- continue; -- intr = 1; -- /* FALLTHROUGH */ -- case USB_ENDPOINT_XFER_BULK: -- break; -- default: -- continue; -- } -- if (usb_endpoint_dir_in(&e->desc)) { -- if (!intr && !in) -- in = e; -- else if (intr && !status) -- status = e; -- } else { -- if (!out) -- out = e; -- } -- } -- if (in && out) -- break; -- } -- if (!alt || !in || !out) -- return -EINVAL; -- -- dev->pipe_in = usb_rcvbulkpipe(dev->udev, -- in->desc.bEndpointAddress & -- USB_ENDPOINT_NUMBER_MASK); -- dev->pipe_out = usb_sndbulkpipe(dev->udev, -- out->desc.bEndpointAddress & -- USB_ENDPOINT_NUMBER_MASK); -- dev->ep_intr = status; -- -- return 0; --} -- - static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) - { - struct lan78xx_priv *pdata = NULL; - int ret; - int i; - -- ret = lan78xx_get_endpoints(dev, intf); -- if (ret) { -- netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n", -- ret); -- return ret; -- } -- - dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); - - pdata = (struct lan78xx_priv *)(dev->data[0]); -@@ -2926,6 +2857,7 @@ static const struct net_device_ops lan78xx_netdev_ops = { - static int lan78xx_probe(struct usb_interface *intf, - const struct usb_device_id *id) - { -+ struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr; - struct lan78xx_net *dev; - struct net_device *netdev; - struct usb_device *udev; -@@ -2969,6 +2901,34 @@ static int lan78xx_probe(struct usb_interface *intf, - netdev->watchdog_timeo = TX_TIMEOUT_JIFFIES; - netdev->ethtool_ops = &lan78xx_ethtool_ops; - -+ if (intf->cur_altsetting->desc.bNumEndpoints < 3) { -+ ret = -ENODEV; -+ goto out2; -+ } -+ -+ dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE); -+ ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in); -+ if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) { -+ ret = -ENODEV; -+ goto out2; -+ } -+ -+ dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE); -+ ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out); -+ if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) { -+ ret = -ENODEV; -+ goto out2; -+ } -+ -+ ep_intr = &intf->cur_altsetting->endpoint[2]; -+ if (!usb_endpoint_is_int_in(&ep_intr->desc)) { -+ ret = -ENODEV; -+ goto out2; -+ } -+ -+ dev->pipe_intr = usb_rcvintpipe(dev->udev, -+ usb_endpoint_num(&ep_intr->desc)); -+ - ret = lan78xx_bind(dev, intf); - if (ret < 0) - goto out2; -@@ -2978,18 +2938,7 @@ static int lan78xx_probe(struct usb_interface *intf, - netdev->mtu = dev->hard_mtu - netdev->hard_header_len; - netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER); - -- dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0; -- dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1; -- dev->ep_intr = (intf->cur_altsetting)->endpoint + 2; -- -- dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE); -- dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE); -- -- dev->pipe_intr = usb_rcvintpipe(dev->udev, -- dev->ep_intr->desc.bEndpointAddress & -- USB_ENDPOINT_NUMBER_MASK); -- period = dev->ep_intr->desc.bInterval; -- -+ period = ep_intr->desc.bInterval; - maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0); - buf = kmalloc(maxp, GFP_KERNEL); - if (buf) { -@@ -3001,6 +2950,7 @@ static int lan78xx_probe(struct usb_interface *intf, - usb_fill_int_urb(dev->urb_intr, dev->udev, - dev->pipe_intr, buf, maxp, - intr_complete, dev, period); -+ dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; - } - } - -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index c12f2984d7eff..50ede6b8b874d 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -921,6 +921,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, - struct vxlan_fdb *f; - int err; - -+ rcu_read_lock(); - hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) { - struct vxlan_rdst *rd; - -@@ -933,12 +934,15 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, - cb->nlh->nlmsg_seq, - RTM_NEWNEIGH, - NLM_F_MULTI, rd); -- if (err < 0) -+ if (err < 0) { -+ rcu_read_unlock(); - goto out; -+ } - skip: - ++idx; - } - } -+ rcu_read_unlock(); - } - out: - return idx; -@@ -2070,7 +2074,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - return; - } - -- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); -+ tos = ip_tunnel_ecn_encap(tos, old_iph, skb); - ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); - err = vxlan_xmit_skb(rt, sk, skb, fl4.saddr, - dst->sin.sin_addr.s_addr, tos, ttl, df, -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index f5657783fad4e..6eb0f7a85e531 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -160,6 +160,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, - if (!netif_running(dev)) - goto drop; - -+ /* There should be a pseudo header of 1 byte added by upper layers. -+ * Check to make sure it is there before reading it. -+ */ -+ if (skb->len < 1) -+ goto drop; -+ - switch (skb->data[0]) { - case X25_IFACE_DATA: - break; -@@ -308,6 +314,7 @@ static void lapbeth_setup(struct net_device *dev) - dev->netdev_ops = &lapbeth_netdev_ops; - dev->destructor = free_netdev; - dev->type = ARPHRD_X25; -+ dev->hard_header_len = 0; - dev->mtu = 1000; - dev->addr_len = 0; - } -@@ -334,7 +341,8 @@ static int lapbeth_new_device(struct net_device *dev) - * then this driver prepends a length field of 2 bytes, - * then the underlying Ethernet device prepends its own header. - */ -- ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; -+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len -+ + dev->needed_headroom; - - lapbeth = netdev_priv(ndev); - lapbeth->axdev = ndev; -diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c -index 257b6ee51e54b..1af216aa5adae 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_hst.c -+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c -@@ -175,6 +175,7 @@ static int htc_config_pipe_credits(struct htc_target *target) - time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); - if (!time_left) { - dev_err(target->dev, "HTC credit config timeout\n"); -+ kfree_skb(skb); - return -ETIMEDOUT; - } - -@@ -211,6 +212,7 @@ static int htc_setup_complete(struct htc_target *target) - time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); - if (!time_left) { - dev_err(target->dev, "HTC start timeout\n"); -+ kfree_skb(skb); - return -ETIMEDOUT; - } - -@@ -284,6 +286,7 @@ int htc_connect_service(struct htc_target *target, - if (!time_left) { - dev_err(target->dev, "Service connection timeout for: %d\n", - service_connreq->service_id); -+ kfree_skb(skb); - return -ETIMEDOUT; - } - -diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c -index 8f14897ae5a33..f100533eb7adc 100644 ---- a/drivers/net/wireless/ath/ath9k/wmi.c -+++ b/drivers/net/wireless/ath/ath9k/wmi.c -@@ -340,6 +340,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, - ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", - wmi_cmd_to_name(cmd_id)); - mutex_unlock(&wmi->op_mutex); -+ kfree_skb(skb); - return -ETIMEDOUT; - } - -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -index 4320c4cae53e1..7eb9f31dde1a2 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -@@ -30,7 +30,7 @@ - #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008 - - #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */ --#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002 -+#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004 - - #define BRCMF_STA_WME 0x00000002 /* WMM association */ - #define BRCMF_STA_AUTHE 0x00000008 /* Authenticated */ -diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c -index 544ab3750ea6e..c56febdae1349 100644 ---- a/drivers/net/wireless/iwlegacy/common.c -+++ b/drivers/net/wireless/iwlegacy/common.c -@@ -4294,8 +4294,8 @@ il_apm_init(struct il_priv *il) - * power savings, even without L1. - */ - if (il->cfg->set_l0s) { -- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); -- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { -+ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); -+ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) { - /* L1-ASPM enabled; disable(!) L0S */ - il_set_bit(il, CSR_GIO_REG, - CSR_GIO_REG_VAL_L0S_ENABLED); -diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c -index 9ac7aa2431b41..9e3853c8a22da 100644 ---- a/drivers/net/wireless/mwifiex/sta_cmdresp.c -+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c -@@ -592,6 +592,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, - { - struct host_cmd_ds_802_11_key_material *key = - &resp->params.key_material; -+ int len; -+ -+ len = le16_to_cpu(key->key_param_set.key_len); -+ if (len > sizeof(key->key_param_set.key)) -+ return -EINVAL; - - if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { - if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { -@@ -605,9 +610,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, - - memset(priv->aes_key.key_param_set.key, 0, - sizeof(key->key_param_set.key)); -- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; -- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, -- le16_to_cpu(priv->aes_key.key_param_set.key_len)); -+ priv->aes_key.key_param_set.key_len = cpu_to_le16(len); -+ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len); - - return 0; - } -@@ -622,9 +626,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - struct host_cmd_ds_command *resp) - { - struct host_cmd_ds_802_11_key_material_v2 *key_v2; -- __le16 len; -+ int len; - - key_v2 = &resp->params.key_material_v2; -+ -+ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); -+ if (len > WLAN_KEY_LEN_CCMP) -+ return -EINVAL; -+ - if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { - if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { - mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); -@@ -640,10 +649,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, - WLAN_KEY_LEN_CCMP); - priv->aes_key_v2.key_param_set.key_params.aes.key_len = -- key_v2->key_param_set.key_params.aes.key_len; -- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; -+ cpu_to_le16(len); - memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, -- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len)); -+ key_v2->key_param_set.key_params.aes.key, len); - - return 0; - } -diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c -index c98630394a1a2..26bf3e2b750d6 100644 ---- a/drivers/net/wireless/ti/wl1251/event.c -+++ b/drivers/net/wireless/ti/wl1251/event.c -@@ -80,7 +80,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl, - break; - } - -- return 0; -+ return ret; - } - - static void wl1251_event_mbox_dump(struct event_mailbox *mbox) -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 02b6a6c108400..7d4c0c46a889d 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -62,6 +62,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644); - MODULE_PARM_DESC(max_queues, - "Maximum number of queues per virtual interface"); - -+#define XENNET_TIMEOUT (5 * HZ) -+ - static const struct ethtool_ops xennet_ethtool_ops; - - struct netfront_cb { -@@ -1349,12 +1351,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) - - netif_carrier_off(netdev); - -- xenbus_switch_state(dev, XenbusStateInitialising); -- wait_event(module_wq, -- xenbus_read_driver_state(dev->otherend) != -- XenbusStateClosed && -- xenbus_read_driver_state(dev->otherend) != -- XenbusStateUnknown); -+ do { -+ xenbus_switch_state(dev, XenbusStateInitialising); -+ err = wait_event_timeout(module_wq, -+ xenbus_read_driver_state(dev->otherend) != -+ XenbusStateClosed && -+ xenbus_read_driver_state(dev->otherend) != -+ XenbusStateUnknown, XENNET_TIMEOUT); -+ } while (!err); -+ - return netdev; - - exit: -@@ -2166,28 +2171,43 @@ static const struct attribute_group xennet_dev_group = { - }; - #endif /* CONFIG_SYSFS */ - --static int xennet_remove(struct xenbus_device *dev) -+static void xennet_bus_close(struct xenbus_device *dev) - { -- struct netfront_info *info = dev_get_drvdata(&dev->dev); -- -- dev_dbg(&dev->dev, "%s\n", dev->nodename); -+ int ret; - -- if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { -+ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) -+ return; -+ do { - xenbus_switch_state(dev, XenbusStateClosing); -- wait_event(module_wq, -- xenbus_read_driver_state(dev->otherend) == -- XenbusStateClosing || -- xenbus_read_driver_state(dev->otherend) == -- XenbusStateUnknown); -+ ret = wait_event_timeout(module_wq, -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateClosing || -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateClosed || -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateUnknown, -+ XENNET_TIMEOUT); -+ } while (!ret); -+ -+ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) -+ return; - -+ do { - xenbus_switch_state(dev, XenbusStateClosed); -- wait_event(module_wq, -- xenbus_read_driver_state(dev->otherend) == -- XenbusStateClosed || -- xenbus_read_driver_state(dev->otherend) == -- XenbusStateUnknown); -- } -+ ret = wait_event_timeout(module_wq, -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateClosed || -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateUnknown, -+ XENNET_TIMEOUT); -+ } while (!ret); -+} -+ -+static int xennet_remove(struct xenbus_device *dev) -+{ -+ struct netfront_info *info = dev_get_drvdata(&dev->dev); - -+ xennet_bus_close(dev); - xennet_disconnect_backend(info); - - if (info->netdev->reg_state == NETREG_REGISTERED) -diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c -index 0d866ca295e3f..cafab107ba9bc 100644 ---- a/drivers/nfc/s3fwrn5/core.c -+++ b/drivers/nfc/s3fwrn5/core.c -@@ -209,6 +209,7 @@ int s3fwrn5_recv_frame(struct nci_dev *ndev, struct sk_buff *skb, - case S3FWRN5_MODE_FW: - return s3fwrn5_fw_recv_frame(ndev, skb); - default: -+ kfree_skb(skb); - return -ENODEV; - } - } -diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c -index f3b9746157f81..b854de39c7ffa 100644 ---- a/drivers/parisc/sba_iommu.c -+++ b/drivers/parisc/sba_iommu.c -@@ -1277,7 +1277,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num) - ** (one that doesn't overlap memory or LMMIO space) in the - ** IBASE and IMASK registers. - */ -- ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE); -+ ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL; - iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; - - if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { -diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c -index 572ca192cb1fd..6727471ea5b40 100644 ---- a/drivers/pci/hotplug/acpiphp_glue.c -+++ b/drivers/pci/hotplug/acpiphp_glue.c -@@ -136,13 +136,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev) - struct acpiphp_context *context; - - acpi_lock_hp_context(); -+ - context = acpiphp_get_context(adev); -- if (!context || context->func.parent->is_going_away) { -- acpi_unlock_hp_context(); -- return NULL; -+ if (!context) -+ goto unlock; -+ -+ if (context->func.parent->is_going_away) { -+ acpiphp_put_context(context); -+ context = NULL; -+ goto unlock; - } -+ - get_bridge(context->func.parent); - acpiphp_put_context(context); -+ -+unlock: - acpi_unlock_hp_context(); - return context; - } -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 966b6947e5656..a098f8324afd0 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -807,6 +807,7 @@ static int pcie_aspm_get_policy(char *buffer, struct kernel_param *kp) - cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]); - else - cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); -+ cnt += sprintf(buffer + cnt, "\n"); - return cnt; - } - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index ab161bbeb4d41..bdaeccafa261b 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -2273,6 +2273,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_ - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi); - -+static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev) -+{ -+ dev_info(&dev->dev, "Disabling ASPM L0s/L1\n"); -+ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1); -+} -+ -+/* -+ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the -+ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected; -+ * disable both L0s and L1 for now to be safe. -+ */ -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1); -+ - /* - * The APC bridge device in AMD 780 family northbridges has some random - * OEM subsystem ID in its vendor ID register (erratum 18), so instead -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index 73d8d47ea465a..17714793c08e4 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -1071,7 +1071,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, - - /* If pinconf isn't supported, don't parse properties in below. */ - if (!PCS_HAS_PINCONF) -- return 0; -+ return -ENOTSUPP; - - /* cacluate how much properties are supported in current node */ - for (i = 0; i < ARRAY_SIZE(prop2); i++) { -@@ -1083,7 +1083,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, - nconfs++; - } - if (!nconfs) -- return 0; -+ return -ENOTSUPP; - - func->conf = devm_kzalloc(pcs->dev, - sizeof(struct pcs_conf_vals) * nconfs, -@@ -1196,9 +1196,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs, - - if (PCS_HAS_PINCONF) { - res = pcs_parse_pinconf(pcs, np, function, map); -- if (res) -+ if (res == 0) -+ *num_maps = 2; -+ else if (res == -ENOTSUPP) -+ *num_maps = 1; -+ else - goto free_pingroups; -- *num_maps = 2; - } else { - *num_maps = 1; - } -diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c -index 63c57dc82ac1d..4eda5065b5bbc 100644 ---- a/drivers/power/88pm860x_battery.c -+++ b/drivers/power/88pm860x_battery.c -@@ -436,7 +436,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) - int ret; - int data; - int bat_remove; -- int soc; -+ int soc = 0; - - /* measure enable on GPADC1 */ - data = MEAS1_GP1; -@@ -499,7 +499,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) - } - mutex_unlock(&info->lock); - -- calc_soc(info, OCV_MODE_ACTIVE, &soc); -+ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc); -+ if (ret < 0) -+ goto out; - - data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG); - bat_remove = data & BAT_WU_LOG; -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index 97211f7f0cf02..ed4b0f6e2d6ad 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -1669,6 +1669,10 @@ static void qeth_bridge_state_change(struct qeth_card *card, - int extrasize; - - QETH_CARD_TEXT(card, 2, "brstchng"); -+ if (qports->num_entries == 0) { -+ QETH_CARD_TEXT(card, 2, "BPempty"); -+ return; -+ } - if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) { - QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length); - return; -diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c -index faa1bee07c8ac..0c83a155ceebc 100644 ---- a/drivers/scsi/arm/cumana_2.c -+++ b/drivers/scsi/arm/cumana_2.c -@@ -454,7 +454,7 @@ static int cumanascsi2_probe(struct expansion_card *ec, - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_release: - fas216_release(host); -diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c -index a8ad6880dd914..cf01442d91363 100644 ---- a/drivers/scsi/arm/eesox.c -+++ b/drivers/scsi/arm/eesox.c -@@ -575,7 +575,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id) - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_remove: - fas216_remove(host); -diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c -index 5e1b73e1b743e..b6724ba9b36e7 100644 ---- a/drivers/scsi/arm/powertec.c -+++ b/drivers/scsi/arm/powertec.c -@@ -382,7 +382,7 @@ static int powertecscsi_probe(struct expansion_card *ec, - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_release: - fas216_release(host); -diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c -index 555367f002282..18ed4b44bc513 100644 ---- a/drivers/scsi/mesh.c -+++ b/drivers/scsi/mesh.c -@@ -1044,6 +1044,8 @@ static void handle_error(struct mesh_state *ms) - while ((in_8(&mr->bus_status1) & BS1_RST) != 0) - udelay(1); - printk("done\n"); -+ if (ms->dma_started) -+ halt_dma(ms); - handle_reset(ms); - /* request_q is empty, no point in mesh_start() */ - return; -@@ -1356,7 +1358,8 @@ static void halt_dma(struct mesh_state *ms) - ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd), - ms->tgts[ms->conn_tgt].data_goes_out); - } -- scsi_dma_unmap(cmd); -+ if (cmd) -+ scsi_dma_unmap(cmd); - ms->dma_started = 0; - } - -@@ -1711,6 +1714,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd) - - spin_lock_irqsave(ms->host->host_lock, flags); - -+ if (ms->dma_started) -+ halt_dma(ms); -+ - /* Reset the controller & dbdma channel */ - out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */ - out_8(&mr->exception, 0xff); /* clear all exception bits */ -diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c -index e9bd8d4abca00..f09a74d79c9eb 100644 ---- a/drivers/usb/gadget/udc/bdc/bdc_core.c -+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c -@@ -286,6 +286,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) - * in that case reinit is passed as 1 - */ - if (reinit) { -+ int i; - /* Enable interrupts */ - temp = bdc_readl(bdc->regs, BDC_BDCSC); - temp |= BDC_GIE; -@@ -295,6 +296,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) - /* Initialize SRR to 0 */ - memset(bdc->srr.sr_bds, 0, - NUM_SR_ENTRIES * sizeof(struct bdc_bd)); -+ /* clear ep flags to avoid post disconnect stops/deconfigs */ -+ for (i = 1; i < bdc->num_eps; ++i) -+ bdc->bdc_ep_array[i]->flags = 0; - } else { - /* One time initiaization only */ - /* Enable status report function pointers */ -diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c -index 3a65272fbed86..9f5f18891ba85 100644 ---- a/drivers/usb/gadget/udc/bdc/bdc_ep.c -+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c -@@ -621,7 +621,6 @@ int bdc_ep_enable(struct bdc_ep *ep) - } - bdc_dbg_bd_list(bdc, ep); - /* only for ep0: config ep is called for ep0 from connect event */ -- ep->flags |= BDC_EP_ENABLED; - if (ep->ep_num == 1) - return ret; - -@@ -767,10 +766,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req) - __func__, ep->name, start_bdi, end_bdi); - dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n", - ep, (void *)ep->usb_ep.desc); -- /* Stop the ep to see where the HW is ? */ -- ret = bdc_stop_ep(bdc, ep->ep_num); -- /* if there is an issue with stopping ep, then no need to go further */ -- if (ret) -+ /* if still connected, stop the ep to see where the HW is ? */ -+ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) { -+ ret = bdc_stop_ep(bdc, ep->ep_num); -+ /* if there is an issue, then no need to go further */ -+ if (ret) -+ return 0; -+ } else - return 0; - - /* -@@ -1921,7 +1923,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep) - __func__, ep->name, ep->flags); - - if (!(ep->flags & BDC_EP_ENABLED)) { -- dev_warn(bdc->dev, "%s is already disabled\n", ep->name); -+ if (bdc->gadget.speed != USB_SPEED_UNKNOWN) -+ dev_warn(bdc->dev, "%s is already disabled\n", -+ ep->name); - return 0; - } - spin_lock_irqsave(&bdc->lock, flags); -diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c -index 3a8d056a5d16b..48dd0da21e2b4 100644 ---- a/drivers/usb/gadget/udc/net2280.c -+++ b/drivers/usb/gadget/udc/net2280.c -@@ -3712,8 +3712,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id) - return 0; - - done: -- if (dev) -+ if (dev) { - net2280_remove(pdev); -+ kfree(dev); -+ } - return retval; - } - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8388f88ce6356..0afea511eb376 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -2051,12 +2051,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, - #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) - - static int ftdi_process_packet(struct usb_serial_port *port, -- struct ftdi_private *priv, char *packet, int len) -+ struct ftdi_private *priv, unsigned char *buf, int len) - { -+ unsigned char status; - int i; -- char status; - char flag; -- char *ch; - - if (len < 2) { - dev_dbg(&port->dev, "malformed packet\n"); -@@ -2066,7 +2065,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, - /* Compare new line status to the old one, signal if different/ - N.B. packet may be processed more than once, but differences - are only processed once. */ -- status = packet[0] & FTDI_STATUS_B0_MASK; -+ status = buf[0] & FTDI_STATUS_B0_MASK; - if (status != priv->prev_status) { - char diff_status = status ^ priv->prev_status; - -@@ -2092,13 +2091,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, - } - - /* save if the transmitter is empty or not */ -- if (packet[1] & FTDI_RS_TEMT) -+ if (buf[1] & FTDI_RS_TEMT) - priv->transmit_empty = 1; - else - priv->transmit_empty = 0; - -- len -= 2; -- if (!len) -+ if (len == 2) - return 0; /* status only */ - - /* -@@ -2106,40 +2104,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, - * data payload to avoid over-reporting. - */ - flag = TTY_NORMAL; -- if (packet[1] & FTDI_RS_ERR_MASK) { -+ if (buf[1] & FTDI_RS_ERR_MASK) { - /* Break takes precedence over parity, which takes precedence - * over framing errors */ -- if (packet[1] & FTDI_RS_BI) { -+ if (buf[1] & FTDI_RS_BI) { - flag = TTY_BREAK; - port->icount.brk++; - usb_serial_handle_break(port); -- } else if (packet[1] & FTDI_RS_PE) { -+ } else if (buf[1] & FTDI_RS_PE) { - flag = TTY_PARITY; - port->icount.parity++; -- } else if (packet[1] & FTDI_RS_FE) { -+ } else if (buf[1] & FTDI_RS_FE) { - flag = TTY_FRAME; - port->icount.frame++; - } - /* Overrun is special, not associated with a char */ -- if (packet[1] & FTDI_RS_OE) { -+ if (buf[1] & FTDI_RS_OE) { - port->icount.overrun++; - tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); - } - } - -- port->icount.rx += len; -- ch = packet + 2; -+ port->icount.rx += len - 2; - - if (port->port.console && port->sysrq) { -- for (i = 0; i < len; i++, ch++) { -- if (!usb_serial_handle_sysrq_char(port, *ch)) -- tty_insert_flip_char(&port->port, *ch, flag); -+ for (i = 2; i < len; i++) { -+ if (usb_serial_handle_sysrq_char(port, buf[i])) -+ continue; -+ tty_insert_flip_char(&port->port, buf[i], flag); - } - } else { -- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len); -+ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag, -+ len - 2); - } - -- return len; -+ return len - 2; - } - - static void ftdi_process_read_urb(struct urb *urb) -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index c59e6d4a8a612..11fb4d78e2dbc 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -159,6 +159,7 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ - {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ - {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ -+ {DEVICE_SWI(0x1199, 0x9062)}, /* Sierra Wireless EM7305 QDL */ - {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */ - {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ - {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ -diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c -index dbfe4eecf12e5..05d1d36a56654 100644 ---- a/drivers/video/console/bitblit.c -+++ b/drivers/video/console/bitblit.c -@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - region.color = 0; - region.rop = ROP_COPY; - -- if (rw && !bottom_only) { -+ if ((int) rw > 0 && !bottom_only) { - region.dx = info->var.xoffset + rs; - region.dy = 0; - region.width = rw; -@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - info->fbops->fb_fillrect(info, ®ion); - } - -- if (bh) { -+ if ((int) bh > 0) { - region.dx = info->var.xoffset; - region.dy = info->var.yoffset + bs; - region.width = rs; -diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c -index 5a3cbf6dff4d9..34da8bba9273a 100644 ---- a/drivers/video/console/fbcon_ccw.c -+++ b/drivers/video/console/fbcon_ccw.c -@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, - region.color = 0; - region.rop = ROP_COPY; - -- if (rw && !bottom_only) { -+ if ((int) rw > 0 && !bottom_only) { - region.dx = 0; - region.dy = info->var.yoffset; - region.height = rw; -@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, - info->fbops->fb_fillrect(info, ®ion); - } - -- if (bh) { -+ if ((int) bh > 0) { - region.dx = info->var.xoffset + bs; - region.dy = 0; - region.height = info->var.yres_virtual; -diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c -index e7ee44db4e98b..0b552b3fc22ab 100644 ---- a/drivers/video/console/fbcon_cw.c -+++ b/drivers/video/console/fbcon_cw.c -@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, - region.color = 0; - region.rop = ROP_COPY; - -- if (rw && !bottom_only) { -+ if ((int) rw > 0 && !bottom_only) { - region.dx = 0; - region.dy = info->var.yoffset + rs; - region.height = rw; -@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, - info->fbops->fb_fillrect(info, ®ion); - } - -- if (bh) { -+ if ((int) bh > 0) { - region.dx = info->var.xoffset; - region.dy = info->var.yoffset; - region.height = info->var.yres; -diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c -index 19e3714abfe8f..7f62efe2da526 100644 ---- a/drivers/video/console/fbcon_ud.c -+++ b/drivers/video/console/fbcon_ud.c -@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, - region.color = 0; - region.rop = ROP_COPY; - -- if (rw && !bottom_only) { -+ if ((int) rw > 0 && !bottom_only) { - region.dy = 0; - region.dx = info->var.xoffset; - region.width = rw; -@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, - info->fbops->fb_fillrect(info, ®ion); - } - -- if (bh) { -+ if ((int) bh > 0) { - region.dy = info->var.yoffset; - region.dx = info->var.xoffset; - region.height = bh; -diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c -index bb4e96255974a..bd0c6e53bec19 100644 ---- a/drivers/video/console/newport_con.c -+++ b/drivers/video/console/newport_con.c -@@ -31,6 +31,8 @@ - #include - #include - -+#define NEWPORT_LEN 0x10000 -+ - #define FONT_DATA ((unsigned char *)font_vga_8x16.data) - - /* borrowed from fbcon.c */ -@@ -42,6 +44,7 @@ - static unsigned char *font_data[MAX_NR_CONSOLES]; - - static struct newport_regs *npregs; -+static unsigned long newport_addr; - - static int logo_active; - static int topscan; -@@ -743,7 +746,6 @@ const struct consw newport_con = { - static int newport_probe(struct gio_device *dev, - const struct gio_device_id *id) - { -- unsigned long newport_addr; - int err; - - if (!dev->resource.start) -@@ -753,7 +755,7 @@ static int newport_probe(struct gio_device *dev, - return -EBUSY; /* we only support one Newport as console */ - - newport_addr = dev->resource.start + 0xF0000; -- if (!request_mem_region(newport_addr, 0x10000, "Newport")) -+ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport")) - return -ENODEV; - - npregs = (struct newport_regs *)/* ioremap cannot fail */ -@@ -761,6 +763,11 @@ static int newport_probe(struct gio_device *dev, - console_lock(); - err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1); - console_unlock(); -+ -+ if (err) { -+ iounmap((void *)npregs); -+ release_mem_region(newport_addr, NEWPORT_LEN); -+ } - return err; - } - -@@ -768,6 +775,7 @@ static void newport_remove(struct gio_device *dev) - { - give_up_console(&newport_con); - iounmap((void *)npregs); -+ release_mem_region(newport_addr, NEWPORT_LEN); - } - - static struct gio_device_id newport_ids[] = { -diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c -index e5231dd55e6ed..edf0af8dd0a42 100644 ---- a/drivers/video/console/vgacon.c -+++ b/drivers/video/console/vgacon.c -@@ -220,6 +220,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count) - p = (void *) (c->vc_origin + t * c->vc_size_row); - - while (count--) { -+ if ((vgacon_scrollback_tail + c->vc_size_row) > -+ vgacon_scrollback_size) -+ vgacon_scrollback_tail = 0; -+ - scr_memcpyw(vgacon_scrollback + vgacon_scrollback_tail, - p, c->vc_size_row); - vgacon_scrollback_cnt++; -diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c -index db023a97d1eae..e243254a57214 100644 ---- a/drivers/video/fbdev/neofb.c -+++ b/drivers/video/fbdev/neofb.c -@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info) - #else - printk(KERN_ERR - "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n"); -+ kfree(info->monspecs.modedb); - return -1; - #endif - default: -diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c -index 589ac7e754130..c8ee58e0ae3ec 100644 ---- a/drivers/video/fbdev/sm712fb.c -+++ b/drivers/video/fbdev/sm712fb.c -@@ -1428,6 +1428,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb, - static void smtc_unmap_smem(struct smtcfb_info *sfb) - { - if (sfb && sfb->fb->screen_base) { -+ if (sfb->chip_id == 0x720) -+ sfb->fb->screen_base -= 0x00200000; - iounmap(sfb->fb->screen_base); - sfb->fb->screen_base = NULL; - } -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index d6f5a74df9738..dff07318d1fb5 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -623,11 +623,13 @@ static int add_ballooned_pages(int nr_pages) - if (xen_hotplug_unpopulated) { - st = reserve_additional_memory(); - if (st != BP_ECANCELED) { -+ int rc; -+ - mutex_unlock(&balloon_mutex); -- wait_event(balloon_wq, -+ rc = wait_event_interruptible(balloon_wq, - !list_empty(&ballooned_pages)); - mutex_lock(&balloon_mutex); -- return 0; -+ return rc ? -ENOMEM : 0; - } - } - -@@ -683,6 +685,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages) - out_undo: - mutex_unlock(&balloon_mutex); - free_xenballooned_pages(pgno, pages); -+ /* -+ * NB: free_xenballooned_pages will only subtract pgno pages, but since -+ * target_unpopulated is incremented with nr_pages at the start we need -+ * to remove the remaining ones also, or accounting will be screwed. -+ */ -+ balloon_stats.target_unpopulated -= nr_pages - pgno; - return ret; - } - EXPORT_SYMBOL(alloc_xenballooned_pages); -diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c -index 1e9bb8db7b48b..3a56f4fa59f95 100644 ---- a/fs/9p/v9fs.c -+++ b/fs/9p/v9fs.c -@@ -457,10 +457,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses) - } - - #ifdef CONFIG_9P_FSCACHE -- if (v9ses->fscache) { -+ if (v9ses->fscache) - v9fs_cache_session_put_cookie(v9ses); -- kfree(v9ses->cachetag); -- } -+ kfree(v9ses->cachetag); - #endif - kfree(v9ses->uname); - kfree(v9ses->aname); -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 42b7409d4cc55..2f9f738ecf84a 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4437,6 +4437,8 @@ int try_release_extent_mapping(struct extent_map_tree *map, - - /* once for us */ - free_extent_map(em); -+ -+ cond_resched(); /* Allow large-extent preemption. */ - } - } - return try_release_extent_state(map, tree, page, mask); -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index e5351d9a8dfbe..05b1b0f99f0bc 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -2158,7 +2158,7 @@ out: - static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, - struct btrfs_free_space *info, bool update_stat) - { -- struct btrfs_free_space *left_info; -+ struct btrfs_free_space *left_info = NULL; - struct btrfs_free_space *right_info; - bool merged = false; - u64 offset = info->offset; -@@ -2173,7 +2173,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, - if (right_info && rb_prev(&right_info->offset_index)) - left_info = rb_entry(rb_prev(&right_info->offset_index), - struct btrfs_free_space, offset_index); -- else -+ else if (!right_info) - left_info = tree_search_offset(ctl, offset - 1, 0, 0); - - if (right_info && !right_info->bitmap) { -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 3779a660988a5..820d3b5bc4150 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3733,11 +3733,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, - log->fs_info->csum_root, - ds + cs, ds + cs + cl - 1, - &ordered_sums, 0); -- if (ret) { -- btrfs_release_path(dst_path); -- kfree(ins_data); -- return ret; -- } -+ if (ret) -+ break; - } - } - } -@@ -3750,7 +3747,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, - * we have to do this after the loop above to avoid changing the - * log tree while trying to change the log tree. - */ -- ret = 0; - while (!list_empty(&ordered_sums)) { - struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, - struct btrfs_ordered_sum, -diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c -index b14bb2c460426..499f54f99891c 100644 ---- a/fs/dlm/lockspace.c -+++ b/fs/dlm/lockspace.c -@@ -626,6 +626,9 @@ static int new_lockspace(const char *name, const char *cluster, - wait_event(ls->ls_recover_lock_wait, - test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags)); - -+ /* let kobject handle freeing of ls if there's an error */ -+ do_unreg = 1; -+ - ls->ls_kobj.kset = dlm_kset; - error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL, - "%s", ls->ls_name); -@@ -633,9 +636,6 @@ static int new_lockspace(const char *name, const char *cluster, - goto out_recoverd; - kobject_uevent(&ls->ls_kobj, KOBJ_ADD); - -- /* let kobject handle freeing of ls if there's an error */ -- do_unreg = 1; -- - /* This uevent triggers dlm_controld in userspace to add us to the - group of nodes that are members of this lockspace (managed by the - cluster infrastructure.) Once it's done that, it tells us who the -diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c -index efe5fb21c5332..d9ef354b821a2 100644 ---- a/fs/ext2/ialloc.c -+++ b/fs/ext2/ialloc.c -@@ -79,6 +79,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir) - if (dir) - le16_add_cpu(&desc->bg_used_dirs_count, -1); - spin_unlock(sb_bgl_lock(EXT2_SB(sb), group)); -+ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter); - if (dir) - percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter); - mark_buffer_dirty(bh); -@@ -525,7 +526,7 @@ got: - goto fail; - } - -- percpu_counter_add(&sbi->s_freeinodes_counter, -1); -+ percpu_counter_dec(&sbi->s_freeinodes_counter); - if (S_ISDIR(mode)) - percpu_counter_inc(&sbi->s_dirs_counter); - -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 8e7997010ba12..881601691bd4a 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3353,6 +3353,13 @@ static ssize_t ext4_direct_IO(struct kiocb *iocb, struct iov_iter *iter, - size_t count = iov_iter_count(iter); - ssize_t ret; - -+ if (iov_iter_rw(iter) == READ) { -+ loff_t size = i_size_read(inode); -+ -+ if (offset >= size) -+ return 0; -+ } -+ - #ifdef CONFIG_EXT4_FS_ENCRYPTION - if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode)) - return 0; -diff --git a/fs/minix/inode.c b/fs/minix/inode.c -index 086cd0a61e801..8d9bc0344cf32 100644 ---- a/fs/minix/inode.c -+++ b/fs/minix/inode.c -@@ -155,6 +155,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) - return 0; - } - -+static bool minix_check_superblock(struct minix_sb_info *sbi) -+{ -+ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) -+ return false; -+ -+ /* -+ * s_max_size must not exceed the block mapping limitation. This check -+ * is only needed for V1 filesystems, since V2/V3 support an extra level -+ * of indirect blocks which places the limit well above U32_MAX. -+ */ -+ if (sbi->s_version == MINIX_V1 && -+ sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) -+ return false; -+ -+ return true; -+} -+ - static int minix_fill_super(struct super_block *s, void *data, int silent) - { - struct buffer_head *bh; -@@ -233,11 +250,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) - } else - goto out_no_fs; - -+ if (!minix_check_superblock(sbi)) -+ goto out_illegal_sb; -+ - /* - * Allocate the buffer map to keep the superblock small. - */ -- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) -- goto out_illegal_sb; - i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh); - map = kzalloc(i, GFP_KERNEL); - if (!map) -@@ -472,6 +490,13 @@ static struct inode *V1_minix_iget(struct inode *inode) - iget_failed(inode); - return ERR_PTR(-EIO); - } -+ if (raw_inode->i_nlinks == 0) { -+ printk("MINIX-fs: deleted inode referenced: %lu\n", -+ inode->i_ino); -+ brelse(bh); -+ iget_failed(inode); -+ return ERR_PTR(-ESTALE); -+ } - inode->i_mode = raw_inode->i_mode; - i_uid_write(inode, raw_inode->i_uid); - i_gid_write(inode, raw_inode->i_gid); -@@ -505,6 +530,13 @@ static struct inode *V2_minix_iget(struct inode *inode) - iget_failed(inode); - return ERR_PTR(-EIO); - } -+ if (raw_inode->i_nlinks == 0) { -+ printk("MINIX-fs: deleted inode referenced: %lu\n", -+ inode->i_ino); -+ brelse(bh); -+ iget_failed(inode); -+ return ERR_PTR(-ESTALE); -+ } - inode->i_mode = raw_inode->i_mode; - i_uid_write(inode, raw_inode->i_uid); - i_gid_write(inode, raw_inode->i_gid); -diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c -index a731cabf1540e..3816427e89382 100644 ---- a/fs/minix/itree_common.c -+++ b/fs/minix/itree_common.c -@@ -74,6 +74,7 @@ static int alloc_branch(struct inode *inode, - int n = 0; - int i; - int parent = minix_new_block(inode); -+ int err = -ENOSPC; - - branch[0].key = cpu_to_block(parent); - if (parent) for (n = 1; n < num; n++) { -@@ -84,6 +85,11 @@ static int alloc_branch(struct inode *inode, - break; - branch[n].key = cpu_to_block(nr); - bh = sb_getblk(inode->i_sb, parent); -+ if (!bh) { -+ minix_free_block(inode, nr); -+ err = -ENOMEM; -+ break; -+ } - lock_buffer(bh); - memset(bh->b_data, 0, bh->b_size); - branch[n].bh = bh; -@@ -102,7 +108,7 @@ static int alloc_branch(struct inode *inode, - bforget(branch[i].bh); - for (i = 0; i < n; i++) - minix_free_block(inode, block_to_cpu(branch[i].key)); -- return -ENOSPC; -+ return err; - } - - static inline int splice_branch(struct inode *inode, -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 0308b56896382..ca1702cefb852 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -4916,8 +4916,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, - return ret; - if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) - return -ENOENT; -- if (buflen < label.len) -- return -ERANGE; - return 0; - } - -@@ -6296,10 +6294,6 @@ static size_t nfs4_xattr_list_nfs4_acl(const struct xattr_handler *handler, - } - - #ifdef CONFIG_NFS_V4_SECURITY_LABEL --static inline int nfs4_server_supports_labels(struct nfs_server *server) --{ -- return server->caps & NFS_CAP_SECURITY_LABEL; --} - - static int nfs4_xattr_set_nfs4_label(const struct xattr_handler *handler, - struct dentry *dentry, const char *key, -@@ -6321,29 +6315,34 @@ static int nfs4_xattr_get_nfs4_label(const struct xattr_handler *handler, - return -EOPNOTSUPP; - } - --static size_t nfs4_xattr_list_nfs4_label(const struct xattr_handler *handler, -- struct dentry *dentry, char *list, -- size_t list_len, const char *name, -- size_t name_len) -+static ssize_t -+nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len) - { -- size_t len = 0; -+ int len = 0; - -- if (nfs_server_capable(d_inode(dentry), NFS_CAP_SECURITY_LABEL)) { -- len = security_inode_listsecurity(d_inode(dentry), NULL, 0); -- if (list && len <= list_len) -- security_inode_listsecurity(d_inode(dentry), list, len); -+ if (nfs_server_capable(inode, NFS_CAP_SECURITY_LABEL)) { -+ len = security_inode_listsecurity(inode, list, list_len); -+ if (list_len && len > list_len) -+ return -ERANGE; - } - return len; - } - - static const struct xattr_handler nfs4_xattr_nfs4_label_handler = { - .prefix = XATTR_SECURITY_PREFIX, -- .list = nfs4_xattr_list_nfs4_label, - .get = nfs4_xattr_get_nfs4_label, - .set = nfs4_xattr_set_nfs4_label, - }; --#endif - -+#else -+ -+static ssize_t -+nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len) -+{ -+ return 0; -+} -+ -+#endif - - /* - * nfs_fhget will use either the mounted_on_fileid or the fileid -@@ -8773,6 +8772,24 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { - #endif - }; - -+ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) -+{ -+ ssize_t error, error2; -+ -+ error = generic_listxattr(dentry, list, size); -+ if (error < 0) -+ return error; -+ if (list) { -+ list += error; -+ size -= error; -+ } -+ -+ error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size); -+ if (error2 < 0) -+ return error2; -+ return error + error2; -+} -+ - static const struct inode_operations nfs4_dir_inode_operations = { - .create = nfs_create, - .lookup = nfs_lookup, -@@ -8789,7 +8806,7 @@ static const struct inode_operations nfs4_dir_inode_operations = { - .setattr = nfs_setattr, - .getxattr = generic_getxattr, - .setxattr = generic_setxattr, -- .listxattr = generic_listxattr, -+ .listxattr = nfs4_listxattr, - .removexattr = generic_removexattr, - }; - -@@ -8799,7 +8816,7 @@ static const struct inode_operations nfs4_file_inode_operations = { - .setattr = nfs_setattr, - .getxattr = generic_getxattr, - .setxattr = generic_setxattr, -- .listxattr = generic_listxattr, -+ .listxattr = nfs4_listxattr, - .removexattr = generic_removexattr, - }; - -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 15cd9db6d616d..28c1b765e4444 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -4158,7 +4158,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, - goto out_overflow; - if (len < NFS4_MAXLABELLEN) { - if (label) { -- memcpy(label->label, p, len); -+ if (label->len) { -+ if (label->len < len) -+ return -ERANGE; -+ memcpy(label->label, p, len); -+ } - label->len = len; - label->pi = pi; - label->lfs = lfs; -diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h -index 2495066a9ca3f..9e7f39b17e679 100644 ---- a/fs/ocfs2/ocfs2.h -+++ b/fs/ocfs2/ocfs2.h -@@ -337,8 +337,8 @@ struct ocfs2_super - spinlock_t osb_lock; - u32 s_next_generation; - unsigned long osb_flags; -- s16 s_inode_steal_slot; -- s16 s_meta_steal_slot; -+ u16 s_inode_steal_slot; -+ u16 s_meta_steal_slot; - atomic_t s_num_inodes_stolen; - atomic_t s_num_meta_stolen; - -diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c -index 28cc343bf6e3b..41a67c9b37e02 100644 ---- a/fs/ocfs2/suballoc.c -+++ b/fs/ocfs2/suballoc.c -@@ -895,9 +895,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type) - { - spin_lock(&osb->osb_lock); - if (type == INODE_ALLOC_SYSTEM_INODE) -- osb->s_inode_steal_slot = slot; -+ osb->s_inode_steal_slot = (u16)slot; - else if (type == EXTENT_ALLOC_SYSTEM_INODE) -- osb->s_meta_steal_slot = slot; -+ osb->s_meta_steal_slot = (u16)slot; - spin_unlock(&osb->osb_lock); - } - -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index 4f5141350af86..d97403bb36226 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -96,7 +96,7 @@ struct mount_options - unsigned long commit_interval; - unsigned long mount_opt; - unsigned int atime_quantum; -- signed short slot; -+ unsigned short slot; - int localalloc_opt; - unsigned int resv_level; - int dir_resv_level; -@@ -1372,7 +1372,7 @@ static int ocfs2_parse_options(struct super_block *sb, - goto bail; - } - if (option) -- mopt->slot = (s16)option; -+ mopt->slot = (u16)option; - break; - case Opt_commit: - option = 0; -diff --git a/fs/ufs/super.c b/fs/ufs/super.c -index 10f364490833e..be68b48de1cc6 100644 ---- a/fs/ufs/super.c -+++ b/fs/ufs/super.c -@@ -99,7 +99,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene - struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; - struct inode *inode; - -- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) -+ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) - return ERR_PTR(-ESTALE); - - inode = ufs_iget(sb, ino); -diff --git a/fs/xattr.c b/fs/xattr.c -index 09441c396798d..5ba5565609eed 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -735,6 +735,8 @@ generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size) - - if (!buffer) { - for_each_xattr_handler(handlers, handler) { -+ if (!handler->list) -+ continue; - size += handler->list(handler, dentry, NULL, 0, - NULL, 0); - } -@@ -742,6 +744,8 @@ generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size) - char *buf = buffer; - - for_each_xattr_handler(handlers, handler) { -+ if (!handler->list) -+ continue; - size = handler->list(handler, dentry, buf, buffer_size, - NULL, 0); - if (size > buffer_size) -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index 01a5ecfedfcf1..445a3f2f871fb 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -779,9 +779,8 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args) - ASSERT(blkno == 0); - error = xfs_attr3_leaf_create(args, blkno, &bp); - if (error) { -- error = xfs_da_shrink_inode(args, 0, bp); -- bp = NULL; -- if (error) -+ /* xfs_attr3_leaf_create may not have instantiated a block */ -+ if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0)) - goto out; - xfs_idata_realloc(dp, size, XFS_ATTR_FORK); /* try to put */ - memcpy(ifp->if_u1.if_data, tmpbuffer, size); /* it back */ -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index 27dbab59f034c..d86ac620f0aac 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -317,8 +317,8 @@ enum { - - #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK) - #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) --#define QI_DEV_EIOTLB_GLOB(g) ((u64)g) --#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) -+#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1) -+#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32) - #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) - #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) - #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \ -diff --git a/include/linux/prandom.h b/include/linux/prandom.h -new file mode 100644 -index 0000000000000..aa16e6468f91e ---- /dev/null -+++ b/include/linux/prandom.h -@@ -0,0 +1,78 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+/* -+ * include/linux/prandom.h -+ * -+ * Include file for the fast pseudo-random 32-bit -+ * generation. -+ */ -+#ifndef _LINUX_PRANDOM_H -+#define _LINUX_PRANDOM_H -+ -+#include -+#include -+ -+u32 prandom_u32(void); -+void prandom_bytes(void *buf, size_t nbytes); -+void prandom_seed(u32 seed); -+void prandom_reseed_late(void); -+ -+struct rnd_state { -+ __u32 s1, s2, s3, s4; -+}; -+ -+DECLARE_PER_CPU(struct rnd_state, net_rand_state); -+ -+u32 prandom_u32_state(struct rnd_state *state); -+void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); -+void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); -+ -+#define prandom_init_once(pcpu_state) \ -+ DO_ONCE(prandom_seed_full_state, (pcpu_state)) -+ -+/** -+ * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro) -+ * @ep_ro: right open interval endpoint -+ * -+ * Returns a pseudo-random number that is in interval [0, ep_ro). Note -+ * that the result depends on PRNG being well distributed in [0, ~0U] -+ * u32 space. Here we use maximally equidistributed combined Tausworthe -+ * generator, that is, prandom_u32(). This is useful when requesting a -+ * random index of an array containing ep_ro elements, for example. -+ * -+ * Returns: pseudo-random number in interval [0, ep_ro) -+ */ -+static inline u32 prandom_u32_max(u32 ep_ro) -+{ -+ return (u32)(((u64) prandom_u32() * ep_ro) >> 32); -+} -+ -+/* -+ * Handle minimum values for seeds -+ */ -+static inline u32 __seed(u32 x, u32 m) -+{ -+ return (x < m) ? x + m : x; -+} -+ -+/** -+ * prandom_seed_state - set seed for prandom_u32_state(). -+ * @state: pointer to state structure to receive the seed. -+ * @seed: arbitrary 64-bit value to use as a seed. -+ */ -+static inline void prandom_seed_state(struct rnd_state *state, u64 seed) -+{ -+ u32 i = (seed >> 32) ^ (seed << 10) ^ seed; -+ -+ state->s1 = __seed(i, 2U); -+ state->s2 = __seed(i, 8U); -+ state->s3 = __seed(i, 16U); -+ state->s4 = __seed(i, 128U); -+} -+ -+/* Pseudo random number generator from numerical recipes. */ -+static inline u32 next_pseudo_random32(u32 seed) -+{ -+ return seed * 1664525 + 1013904223; -+} -+ -+#endif -diff --git a/include/linux/random.h b/include/linux/random.h -index 9c29122037f95..2fa4207fd0677 100644 ---- a/include/linux/random.h -+++ b/include/linux/random.h -@@ -37,61 +37,12 @@ unsigned int get_random_int(void); - unsigned long get_random_long(void); - unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len); - --u32 prandom_u32(void); --void prandom_bytes(void *buf, size_t nbytes); --void prandom_seed(u32 seed); --void prandom_reseed_late(void); -- --struct rnd_state { -- __u32 s1, s2, s3, s4; --}; -- --u32 prandom_u32_state(struct rnd_state *state); --void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); --void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); -- --#define prandom_init_once(pcpu_state) \ -- DO_ONCE(prandom_seed_full_state, (pcpu_state)) -- --/** -- * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro) -- * @ep_ro: right open interval endpoint -- * -- * Returns a pseudo-random number that is in interval [0, ep_ro). Note -- * that the result depends on PRNG being well distributed in [0, ~0U] -- * u32 space. Here we use maximally equidistributed combined Tausworthe -- * generator, that is, prandom_u32(). This is useful when requesting a -- * random index of an array containing ep_ro elements, for example. -- * -- * Returns: pseudo-random number in interval [0, ep_ro) -- */ --static inline u32 prandom_u32_max(u32 ep_ro) --{ -- return (u32)(((u64) prandom_u32() * ep_ro) >> 32); --} -- - /* -- * Handle minimum values for seeds -+ * This is designed to be standalone for just prandom -+ * users, but for now we include it from -+ * for legacy reasons. - */ --static inline u32 __seed(u32 x, u32 m) --{ -- return (x < m) ? x + m : x; --} -- --/** -- * prandom_seed_state - set seed for prandom_u32_state(). -- * @state: pointer to state structure to receive the seed. -- * @seed: arbitrary 64-bit value to use as a seed. -- */ --static inline void prandom_seed_state(struct rnd_state *state, u64 seed) --{ -- u32 i = (seed >> 32) ^ (seed << 10) ^ seed; -- -- state->s1 = __seed(i, 2U); -- state->s2 = __seed(i, 8U); -- state->s3 = __seed(i, 16U); -- state->s4 = __seed(i, 128U); --} -+#include - - #ifdef CONFIG_ARCH_RANDOM - # include -@@ -122,10 +73,4 @@ static inline int arch_has_random_seed(void) - } - #endif - --/* Pseudo random number generator from numerical recipes. */ --static inline u32 next_pseudo_random32(u32 seed) --{ -- return seed * 1664525 + 1013904223; --} -- - #endif /* _LINUX_RANDOM_H */ -diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h -index 27e32b2b602fc..d7875d312f1f9 100644 ---- a/include/linux/tracepoint.h -+++ b/include/linux/tracepoint.h -@@ -328,7 +328,7 @@ extern void syscall_unregfunc(void); - static const char *___tp_str __tracepoint_string = str; \ - ___tp_str; \ - }) --#define __tracepoint_string __attribute__((section("__tracepoint_str"))) -+#define __tracepoint_string __attribute__((section("__tracepoint_str"), used)) - #else - /* - * tracepoint_string() is used to save the string address for userspace -diff --git a/include/net/addrconf.h b/include/net/addrconf.h -index 27a1833c7b00f..efe48a27b7aba 100644 ---- a/include/net/addrconf.h -+++ b/include/net/addrconf.h -@@ -239,6 +239,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, - const struct in6_addr *addr); - int ipv6_sock_ac_drop(struct sock *sk, int ifindex, - const struct in6_addr *addr); -+void __ipv6_sock_ac_close(struct sock *sk); - void ipv6_sock_ac_close(struct sock *sk); - - int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr); -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 5bda113a3116c..9241a29a1f9de 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -2029,6 +2029,13 @@ static void kill_kprobe(struct kprobe *p) - * the original probed function (which will be freed soon) any more. - */ - arch_remove_kprobe(p); -+ -+ /* -+ * The module is going away. We should disarm the kprobe which -+ * is using ftrace. -+ */ -+ if (kprobe_ftrace(p)) -+ disarm_kprobe_ftrace(p); - } - - /* Disable one kprobe */ -diff --git a/kernel/time/timer.c b/kernel/time/timer.c -index 3d7588a2e97c6..43bee4993187c 100644 ---- a/kernel/time/timer.c -+++ b/kernel/time/timer.c -@@ -42,6 +42,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1431,6 +1432,13 @@ void update_process_times(int user_tick) - #endif - scheduler_tick(); - run_posix_cpu_timers(p); -+ -+ /* The current CPU might make use of net randoms without receiving IRQs -+ * to renew them often enough. Let's update the net_rand_state from a -+ * non-constant value that's not affine to the number of calls to make -+ * sure it's updated when there's some activity (we don't care in idle). -+ */ -+ this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick); - } - - /* -diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c -index c6368ae93fe6e..f50d63f67899a 100644 ---- a/lib/dynamic_debug.c -+++ b/lib/dynamic_debug.c -@@ -85,22 +85,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = { - { _DPRINTK_FLAGS_NONE, '_' }, - }; - -+struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; }; -+ - /* format a string into buf[] which describes the _ddebug's flags */ --static char *ddebug_describe_flags(struct _ddebug *dp, char *buf, -- size_t maxlen) -+static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb) - { -- char *p = buf; -+ char *p = fb->buf; - int i; - -- BUG_ON(maxlen < 6); - for (i = 0; i < ARRAY_SIZE(opt_array); ++i) -- if (dp->flags & opt_array[i].flag) -+ if (flags & opt_array[i].flag) - *p++ = opt_array[i].opt_char; -- if (p == buf) -+ if (p == fb->buf) - *p++ = '_'; - *p = '\0'; - -- return buf; -+ return fb->buf; - } - - #define vpr_info(fmt, ...) \ -@@ -142,7 +142,7 @@ static int ddebug_change(const struct ddebug_query *query, - struct ddebug_table *dt; - unsigned int newflags; - unsigned int nfound = 0; -- char flagbuf[10]; -+ struct flagsbuf fbuf; - - /* search for matching ddebugs */ - mutex_lock(&ddebug_lock); -@@ -192,8 +192,7 @@ static int ddebug_change(const struct ddebug_query *query, - vpr_info("changed %s:%d [%s]%s =%s\n", - trim_prefix(dp->filename), dp->lineno, - dt->mod_name, dp->function, -- ddebug_describe_flags(dp, flagbuf, -- sizeof(flagbuf))); -+ ddebug_describe_flags(dp->flags, &fbuf)); - } - } - mutex_unlock(&ddebug_lock); -@@ -777,7 +776,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) - { - struct ddebug_iter *iter = m->private; - struct _ddebug *dp = p; -- char flagsbuf[10]; -+ struct flagsbuf flags; - - vpr_info("called m=%p p=%p\n", m, p); - -@@ -790,7 +789,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) - seq_printf(m, "%s:%u [%s]%s =%s \"", - trim_prefix(dp->filename), dp->lineno, - iter->table->mod_name, dp->function, -- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf))); -+ ddebug_describe_flags(dp->flags, &flags)); - seq_escape(m, dp->format, "\t\r\n\""); - seq_puts(m, "\"\n"); - -diff --git a/lib/random32.c b/lib/random32.c -index 12111910ccd07..8072ccd9eed58 100644 ---- a/lib/random32.c -+++ b/lib/random32.c -@@ -47,7 +47,7 @@ static inline void prandom_state_selftest(void) - } - #endif - --static DEFINE_PER_CPU(struct rnd_state, net_rand_state); -+DEFINE_PER_CPU(struct rnd_state, net_rand_state); - - /** - * prandom_u32_state - seeded pseudo-random number generator. -diff --git a/mm/mmap.c b/mm/mmap.c -index a24e424770012..135cccce41f88 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2954,6 +2954,7 @@ void exit_mmap(struct mm_struct *mm) - if (vma->vm_flags & VM_ACCOUNT) - nr_accounted += vma_pages(vma); - vma = remove_vma(vma); -+ cond_resched(); - } - vm_unacct_memory(nr_accounted); - } -diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c -index 2f68ffda3715b..eab058f93ec97 100644 ---- a/net/9p/trans_fd.c -+++ b/net/9p/trans_fd.c -@@ -793,20 +793,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) - return -ENOMEM; - - ts->rd = fget(rfd); -+ if (!ts->rd) -+ goto out_free_ts; -+ if (!(ts->rd->f_mode & FMODE_READ)) -+ goto out_put_rd; - ts->wr = fget(wfd); -- if (!ts->rd || !ts->wr) { -- if (ts->rd) -- fput(ts->rd); -- if (ts->wr) -- fput(ts->wr); -- kfree(ts); -- return -EIO; -- } -+ if (!ts->wr) -+ goto out_put_rd; -+ if (!(ts->wr->f_mode & FMODE_WRITE)) -+ goto out_put_wr; - - client->trans = ts; - client->status = Connected; - - return 0; -+ -+out_put_wr: -+ fput(ts->wr); -+out_put_rd: -+ fput(ts->rd); -+out_free_ts: -+ kfree(ts); -+ return -EIO; - } - - static int p9_socket_open(struct p9_client *client, struct socket *csocket) -diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c -index 4cd6b8d811ffa..11602902884ba 100644 ---- a/net/bluetooth/6lowpan.c -+++ b/net/bluetooth/6lowpan.c -@@ -57,6 +57,7 @@ static bool enable_6lowpan; - /* We are listening incoming connections via this channel - */ - static struct l2cap_chan *listen_chan; -+static DEFINE_MUTEX(set_lock); - - struct lowpan_peer { - struct list_head list; -@@ -1195,12 +1196,14 @@ static void do_enable_set(struct work_struct *work) - - enable_6lowpan = set_enable->flag; - -+ mutex_lock(&set_lock); - if (listen_chan) { - l2cap_chan_close(listen_chan, 0); - l2cap_chan_put(listen_chan); - } - - listen_chan = bt_6lowpan_listen(); -+ mutex_unlock(&set_lock); - - kfree(set_enable); - } -@@ -1252,11 +1255,13 @@ static ssize_t lowpan_control_write(struct file *fp, - if (ret == -EINVAL) - return ret; - -+ mutex_lock(&set_lock); - if (listen_chan) { - l2cap_chan_close(listen_chan, 0); - l2cap_chan_put(listen_chan); - listen_chan = NULL; - } -+ mutex_unlock(&set_lock); - - if (conn) { - struct lowpan_peer *peer; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 1d957c7f17836..16cf5633eae3e 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -2094,7 +2094,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) - - BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - -- if (!num_rsp) -+ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) - return; - - if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) -@@ -3609,6 +3609,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, - struct inquiry_info_with_rssi_and_pscan_mode *info; - info = (void *) (skb->data + 1); - -+ if (skb->len < num_rsp * sizeof(*info) + 1) -+ goto unlock; -+ - for (; num_rsp; num_rsp--, info++) { - u32 flags; - -@@ -3630,6 +3633,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, - } else { - struct inquiry_info_with_rssi *info = (void *) (skb->data + 1); - -+ if (skb->len < num_rsp * sizeof(*info) + 1) -+ goto unlock; -+ - for (; num_rsp; num_rsp--, info++) { - u32 flags; - -@@ -3650,6 +3656,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, - } - } - -+unlock: - hci_dev_unlock(hdev); - } - -@@ -3812,7 +3819,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, - - BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - -- if (!num_rsp) -+ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) - return; - - if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 09b01b888583e..9ec666dbdfc75 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -1696,7 +1696,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb) - while ((l = leaf_walk_rcu(&tp, key)) != NULL) { - struct key_vector *local_l = NULL, *local_tp; - -- hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) { -+ hlist_for_each_entry(fa, &l->leaf, fa_list) { - struct fib_alias *new_fa; - - if (local_tb->tb_id != fa->tb_id) -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 5464fd2102302..0d9f9d6251245 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1589,8 +1589,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - } - } - -- if (rcu_access_pointer(sk->sk_filter) && -- udp_lib_checksum_complete(skb)) -+ if (udp_lib_checksum_complete(skb)) - goto csum_error; - - if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) { -diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c -index 514ac259f5433..b831e9b2e9063 100644 ---- a/net/ipv6/anycast.c -+++ b/net/ipv6/anycast.c -@@ -170,7 +170,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) - return 0; - } - --void ipv6_sock_ac_close(struct sock *sk) -+void __ipv6_sock_ac_close(struct sock *sk) - { - struct ipv6_pinfo *np = inet6_sk(sk); - struct net_device *dev = NULL; -@@ -178,10 +178,7 @@ void ipv6_sock_ac_close(struct sock *sk) - struct net *net = sock_net(sk); - int prev_index; - -- if (!np->ipv6_ac_list) -- return; -- -- rtnl_lock(); -+ ASSERT_RTNL(); - pac = np->ipv6_ac_list; - np->ipv6_ac_list = NULL; - -@@ -198,6 +195,16 @@ void ipv6_sock_ac_close(struct sock *sk) - sock_kfree_s(sk, pac, sizeof(*pac)); - pac = next; - } -+} -+ -+void ipv6_sock_ac_close(struct sock *sk) -+{ -+ struct ipv6_pinfo *np = inet6_sk(sk); -+ -+ if (!np->ipv6_ac_list) -+ return; -+ rtnl_lock(); -+ __ipv6_sock_ac_close(sk); - rtnl_unlock(); - } - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index f072a4c4575c6..96563990d6544 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -972,26 +972,28 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - - /* NBMA tunnel */ - if (ipv6_addr_any(&t->parms.raddr)) { -- struct in6_addr *addr6; -- struct neighbour *neigh; -- int addr_type; -+ if (skb->protocol == htons(ETH_P_IPV6)) { -+ struct in6_addr *addr6; -+ struct neighbour *neigh; -+ int addr_type; - -- if (!skb_dst(skb)) -- goto tx_err_link_failure; -+ if (!skb_dst(skb)) -+ goto tx_err_link_failure; - -- neigh = dst_neigh_lookup(skb_dst(skb), -- &ipv6_hdr(skb)->daddr); -- if (!neigh) -- goto tx_err_link_failure; -+ neigh = dst_neigh_lookup(skb_dst(skb), -+ &ipv6_hdr(skb)->daddr); -+ if (!neigh) -+ goto tx_err_link_failure; - -- addr6 = (struct in6_addr *)&neigh->primary_key; -- addr_type = ipv6_addr_type(addr6); -+ addr6 = (struct in6_addr *)&neigh->primary_key; -+ addr_type = ipv6_addr_type(addr6); - -- if (addr_type == IPV6_ADDR_ANY) -- addr6 = &ipv6_hdr(skb)->daddr; -+ if (addr_type == IPV6_ADDR_ANY) -+ addr6 = &ipv6_hdr(skb)->daddr; - -- memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); -- neigh_release(neigh); -+ memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); -+ neigh_release(neigh); -+ } - } else if (!fl6->flowi6_mark) - dst = dst_cache_get(&t->dst_cache); - -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 416b3660f818b..4a75013a2ede0 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -207,6 +207,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, - - fl6_free_socklist(sk); - __ipv6_sock_mc_close(sk); -+ __ipv6_sock_ac_close(sk); - - /* - * Sock is moving from IPv6 to IPv4 (sk_prot), so -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 79c583004575a..be570cd7c9aed 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -686,10 +686,8 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - } - } - -- if (rcu_access_pointer(sk->sk_filter)) { -- if (udp_lib_checksum_complete(skb)) -- goto csum_error; -- } -+ if (udp_lib_checksum_complete(skb)) -+ goto csum_error; - - if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) { - UDP6_INC_STATS_BH(sock_net(sk), -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index cf3917c6da0a6..8360fda24bca0 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1766,6 +1766,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev) - ieee80211_stop_mesh(sdata); - mutex_lock(&sdata->local->mtx); - ieee80211_vif_release_channel(sdata); -+ kfree(sdata->u.mesh.ie); - mutex_unlock(&sdata->local->mtx); - - return 0; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index a1f6cd1a496b5..bbddab248c489 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -906,7 +906,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - might_sleep(); - lockdep_assert_held(&local->sta_mtx); - -- while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { -+ if (sta->sta_state == IEEE80211_STA_AUTHORIZED) { - ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); - WARN_ON_ONCE(ret); - } -diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c -index e386e6c90b179..574af981806fa 100644 ---- a/net/nfc/rawsock.c -+++ b/net/nfc/rawsock.c -@@ -344,10 +344,13 @@ static int rawsock_create(struct net *net, struct socket *sock, - if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW)) - return -ESOCKTNOSUPPORT; - -- if (sock->type == SOCK_RAW) -+ if (sock->type == SOCK_RAW) { -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - sock->ops = &rawsock_raw_ops; -- else -+ } else { - sock->ops = &rawsock_ops; -+ } - - sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern); - if (!sk) -diff --git a/net/rds/recv.c b/net/rds/recv.c -index 6275de19689c2..9bf812509e0e9 100644 ---- a/net/rds/recv.c -+++ b/net/rds/recv.c -@@ -301,12 +301,13 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc, - int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr) - { - struct rds_notifier *notifier; -- struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */ -+ struct rds_rdma_notify cmsg; - unsigned int count = 0, max_messages = ~0U; - unsigned long flags; - LIST_HEAD(copy); - int err = 0; - -+ memset(&cmsg, 0, sizeof(cmsg)); /* fill holes with zero */ - - /* put_cmsg copies to user space and thus may sleep. We can't do this - * with rs_lock held, so first grab as many notifications as we can stuff -diff --git a/net/socket.c b/net/socket.c -index 88086d18c2086..1392461d391ad 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -456,7 +456,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) - if (f.file) { - sock = sock_from_file(f.file, err); - if (likely(sock)) { -- *fput_needed = f.flags; -+ *fput_needed = f.flags & FDPUT_FPUT; - return sock; - } - fdput(f); -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index c6c168f20b0f2..55de35c4434a8 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -10180,13 +10180,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) - if (!wdev->netdev && !wdev->p2p_started) - return -ENETDOWN; - } -- -- if (!vcmd->doit) -- return -EOPNOTSUPP; - } else { - wdev = NULL; - } - -+ if (!vcmd->doit) -+ return -EOPNOTSUPP; -+ - if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { - data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); - len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); -diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c -index 6b5af65f491fb..a3163645b5bd3 100644 ---- a/net/x25/x25_subr.c -+++ b/net/x25/x25_subr.c -@@ -368,6 +368,12 @@ void x25_disconnect(struct sock *sk, int reason, unsigned char cause, - sk->sk_state_change(sk); - sock_set_flag(sk, SOCK_DEAD); - } -+ if (x25->neighbour) { -+ read_lock_bh(&x25_list_lock); -+ x25_neigh_put(x25->neighbour); -+ x25->neighbour = NULL; -+ read_unlock_bh(&x25_list_lock); -+ } - } - - /* -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 716433e630529..d37c1963e8ca3 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -1513,8 +1513,6 @@ static int smack_inode_getsecurity(const struct inode *inode, - * @inode: the object - * @buffer: where they go - * @buffer_size: size of buffer -- * -- * Returns 0 on success, -EINVAL otherwise - */ - static int smack_inode_listsecurity(struct inode *inode, char *buffer, - size_t buffer_size) -diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c -index d186d24ac6490..df082648eb0aa 100644 ---- a/security/smack/smackfs.c -+++ b/security/smack/smackfs.c -@@ -918,7 +918,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - } - - ret = sscanf(rule, "%d", &maplevel); -- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) -+ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL) - goto out; - - rule += SMK_DIGITLEN; -@@ -939,6 +939,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - - for (i = 0; i < catlen; i++) { - rule += SMK_DIGITLEN; -+ if (rule > data + count) { -+ rc = -EOVERFLOW; -+ goto out; -+ } - ret = sscanf(rule, "%u", &cat); - if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) - goto out; -@@ -2791,7 +2795,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file) - static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, - size_t count, loff_t *ppos) - { -- struct task_smack *tsp = current_security(); - char *data; - int rc; - LIST_HEAD(list_tmp); -@@ -2821,11 +2824,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, - kfree(data); - - if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) { -+ struct cred *new; -+ struct task_smack *tsp; -+ -+ new = prepare_creds(); -+ if (!new) { -+ rc = -ENOMEM; -+ goto out; -+ } -+ tsp = new->security; - smk_destroy_label_list(&tsp->smk_relabel); - list_splice(&list_tmp, &tsp->smk_relabel); -+ commit_creds(new); - return count; - } -- -+out: - smk_destroy_label_list(&list_tmp); - return rc; - } -diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c -index cb23899100eed..8044775999eda 100644 ---- a/sound/core/seq/oss/seq_oss.c -+++ b/sound/core/seq/oss/seq_oss.c -@@ -180,10 +180,16 @@ static long - odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { - struct seq_oss_devinfo *dp; -+ long rc; -+ - dp = file->private_data; - if (snd_BUG_ON(!dp)) - return -ENXIO; -- return snd_seq_oss_ioctl(dp, cmd, arg); -+ -+ mutex_lock(®ister_mutex); -+ rc = snd_seq_oss_ioctl(dp, cmd, arg); -+ mutex_unlock(®ister_mutex); -+ return rc; - } - - #ifdef CONFIG_COMPAT -diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c -index d73ee11a32bd0..db14ee43e461a 100644 ---- a/sound/pci/echoaudio/echoaudio.c -+++ b/sound/pci/echoaudio/echoaudio.c -@@ -2215,7 +2215,6 @@ static int snd_echo_resume(struct device *dev) - if (err < 0) { - kfree(commpage_bak); - dev_err(dev, "resume init_hw err=%d\n", err); -- snd_echo_free(chip); - return err; - } - -@@ -2242,7 +2241,6 @@ static int snd_echo_resume(struct device *dev) - if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, - KBUILD_MODNAME, chip)) { - dev_err(chip->card->dev, "cannot grab irq\n"); -- snd_echo_free(chip); - return -EBUSY; - } - chip->irq = pci->irq; -diff --git a/sound/usb/card.h b/sound/usb/card.h -index 71778ca4b26aa..b24f2efea1cb4 100644 ---- a/sound/usb/card.h -+++ b/sound/usb/card.h -@@ -125,6 +125,7 @@ struct snd_usb_substream { - unsigned int tx_length_quirk:1; /* add length specifier to transfers */ - unsigned int fmt_type; /* USB audio format type (1-3) */ - unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ -+ unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */ - - unsigned int running: 1; /* running status */ - -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 9646513f4b4ad..d0cd3ae0804d8 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -195,6 +195,7 @@ static const struct rc_config { - { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ - { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ -+ { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ - }; - -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index f84c55ecd0fb4..c97d9a537f763 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -1302,6 +1302,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs, - // continue; - } - bytes = urb->iso_frame_desc[i].actual_length; -+ if (subs->stream_offset_adj > 0) { -+ unsigned int adj = min(subs->stream_offset_adj, bytes); -+ cp += adj; -+ bytes -= adj; -+ subs->stream_offset_adj -= adj; -+ } - frames = bytes / stride; - if (!subs->txfr_quirk) - bytes = frames * stride; -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index ec56ce3820619..689fd3103e5b6 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3335,7 +3335,13 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - * with. - */ - { -- USB_DEVICE(0x534d, 0x2109), -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -+ USB_DEVICE_ID_MATCH_INT_CLASS | -+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, -+ .idVendor = 0x534d, -+ .idProduct = 0x2109, -+ .bInterfaceClass = USB_CLASS_AUDIO, -+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { - .vendor_name = "MacroSilicon", - .product_name = "MS2109", -@@ -3374,5 +3380,61 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - } - } - }, -+{ -+ /* -+ * PIONEER DJ DDJ-RB -+ * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed -+ * The feedback for the output is the dummy input. -+ */ -+ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e), -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S24_3LE, -+ .channels = 4, -+ .iface = 0, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .endpoint = 0x01, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC| -+ USB_ENDPOINT_SYNC_ASYNC, -+ .rates = SNDRV_PCM_RATE_44100, -+ .rate_min = 44100, -+ .rate_max = 44100, -+ .nr_rates = 1, -+ .rate_table = (unsigned int[]) { 44100 } -+ } -+ }, -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S24_3LE, -+ .channels = 2, -+ .iface = 0, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .endpoint = 0x82, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC| -+ USB_ENDPOINT_SYNC_ASYNC| -+ USB_ENDPOINT_USAGE_IMPLICIT_FB, -+ .rates = SNDRV_PCM_RATE_44100, -+ .rate_min = 44100, -+ .rate_max = 44100, -+ .nr_rates = 1, -+ .rate_table = (unsigned int[]) { 44100 } -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, - - #undef USB_DEVICE_VENDOR_SPEC -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 47979c9c3e290..59529a9cab614 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1122,6 +1122,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, - case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */ - set_format_emu_quirk(subs, fmt); - break; -+ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ -+ subs->stream_offset_adj = 2; -+ break; - } - } - -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index 3b23102230c03..1ffc32fd3a9eb 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -95,6 +95,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, - subs->tx_length_quirk = as->chip->tx_length_quirk; - subs->speed = snd_usb_get_speed(subs->dev); - subs->pkt_offset_adj = 0; -+ subs->stream_offset_adj = 0; - - snd_usb_set_pcm_ops(as->pcm, stream); - -diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c -index 9954b069b3ca2..86455408c7e12 100644 ---- a/tools/lib/traceevent/event-parse.c -+++ b/tools/lib/traceevent/event-parse.c -@@ -2752,6 +2752,7 @@ process_dynamic_array_len(struct event_format *event, struct print_arg *arg, - if (read_expected(EVENT_DELIM, ")") < 0) - goto out_err; - -+ free_token(token); - type = read_token(&token); - *tok = token; - diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.233-234.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.233-234.patch deleted file mode 100644 index 2762e22cc3..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.233-234.patch +++ /dev/null @@ -1,934 +0,0 @@ -diff --git a/Makefile b/Makefile -index 8f363a3bcaf81..573b646a19936 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 233 -+SUBLEVEL = 234 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h -index ff4049155c840..355aec0867f4d 100644 ---- a/arch/alpha/include/asm/io.h -+++ b/arch/alpha/include/asm/io.h -@@ -491,10 +491,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) - } - #endif - --#define ioread16be(p) be16_to_cpu(ioread16(p)) --#define ioread32be(p) be32_to_cpu(ioread32(p)) --#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p)) --#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p)) -+#define ioread16be(p) swab16(ioread16(p)) -+#define ioread32be(p) swab32(ioread32(p)) -+#define iowrite16be(v,p) iowrite16(swab16(v), (p)) -+#define iowrite32be(v,p) iowrite32(swab32(v), (p)) - - #define inb_p inb - #define inw_p inw -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index e0267532bd4e0..edd392fdc14bb 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -300,14 +300,6 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp, - next = kvm_pgd_addr_end(addr, end); - if (!pgd_none(*pgd)) - unmap_puds(kvm, pgd, addr, next); -- /* -- * If we are dealing with a large range in -- * stage2 table, release the kvm->mmu_lock -- * to prevent starvation and lockup detector -- * warnings. -- */ -- if (kvm && (next != end)) -- cond_resched_lock(&kvm->mmu_lock); - } while (pgd++, addr = next, addr != end); - } - -diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h -index 3177ce8331d69..baee0c77b9818 100644 ---- a/arch/m68k/include/asm/m53xxacr.h -+++ b/arch/m68k/include/asm/m53xxacr.h -@@ -88,9 +88,9 @@ - * coherency though in all cases. And for copyback caches we will need - * to push cached data as well. - */ --#define CACHE_INIT CACR_CINVA --#define CACHE_INVALIDATE CACR_CINVA --#define CACHE_INVALIDATED CACR_CINVA -+#define CACHE_INIT (CACHE_MODE + CACR_CINVA - CACR_EC) -+#define CACHE_INVALIDATE (CACHE_MODE + CACR_CINVA) -+#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA) - - #define ACR0_MODE ((CONFIG_RAMBASE & 0xff000000) + \ - (0x000f0000) + \ -diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c -index d1f860ca03ade..101c202c813c8 100644 ---- a/arch/powerpc/mm/fault.c -+++ b/arch/powerpc/mm/fault.c -@@ -192,6 +192,9 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, int fault) - return MM_FAULT_CONTINUE; - } - -+// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE -+#define SIGFRAME_MAX_SIZE (4096 + 128) -+ - /* - * For 600- and 800-family processors, the error_code parameter is DSISR - * for a data fault, SRR1 for an instruction fault. For 400-family processors -@@ -341,7 +344,7 @@ retry: - /* - * N.B. The POWER/Open ABI allows programs to access up to - * 288 bytes below the stack pointer. -- * The kernel signal delivery code writes up to about 1.5kB -+ * The kernel signal delivery code writes up to about 4kB - * below the stack pointer (r1) before decrementing it. - * The exec code can write slightly over 640kB to the stack - * before setting the user r1. Thus we allow the stack to -@@ -365,7 +368,7 @@ retry: - * between the last mapped region and the stack will - * expand the stack rather than segfaulting. - */ -- if (address + 2048 < uregs->gpr[1] && !store_update_sp) -+ if (address + SIGFRAME_MAX_SIZE < uregs->gpr[1] && !store_update_sp) - goto bad_area; - } - if (expand_stack(vma, address)) -diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c -index 31ca56e593f58..b9dc2ef64ed88 100644 ---- a/drivers/gpu/drm/imx/imx-ldb.c -+++ b/drivers/gpu/drm/imx/imx-ldb.c -@@ -305,6 +305,7 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder) - { - struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder); - struct imx_ldb *ldb = imx_ldb_ch->ldb; -+ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; - int mux, ret; - - /* -@@ -321,14 +322,14 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder) - - drm_panel_disable(imx_ldb_ch->panel); - -- if (imx_ldb_ch == &ldb->channel[0]) -+ if (imx_ldb_ch == &ldb->channel[0] || dual) - ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK; -- else if (imx_ldb_ch == &ldb->channel[1]) -+ if (imx_ldb_ch == &ldb->channel[1] || dual) - ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK; - - regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl); - -- if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) { -+ if (dual) { - clk_disable_unprepare(ldb->clk[0]); - clk_disable_unprepare(ldb->clk[1]); - } -diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c -index ad18dab0ac476..5bd9633541b07 100644 ---- a/drivers/input/mouse/psmouse-base.c -+++ b/drivers/input/mouse/psmouse-base.c -@@ -1911,7 +1911,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp) - { - int type = *((unsigned int *)kp->arg); - -- return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name); -+ return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name); - } - - static int __init psmouse_init(void) -diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c -index e9674b40007c1..6107c469efa07 100644 ---- a/drivers/media/pci/ttpci/budget-core.c -+++ b/drivers/media/pci/ttpci/budget-core.c -@@ -386,20 +386,25 @@ static int budget_register(struct budget *budget) - ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend); - - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - budget->mem_frontend.source = DMX_MEMORY_FE; - ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend); - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend); - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx); - - return 0; -+ -+err_release_dmx: -+ dvb_dmxdev_release(&budget->dmxdev); -+ dvb_dmx_release(&budget->demux); -+ return ret; - } - - static void budget_unregister(struct budget *budget) -diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c -index c2c68988e38ac..9884b34d6f406 100644 ---- a/drivers/media/platform/davinci/vpss.c -+++ b/drivers/media/platform/davinci/vpss.c -@@ -519,19 +519,31 @@ static void vpss_exit(void) - - static int __init vpss_init(void) - { -+ int ret; -+ - if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control")) - return -EBUSY; - - oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4); - if (unlikely(!oper_cfg.vpss_regs_base2)) { -- release_mem_region(VPSS_CLK_CTRL, 4); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto err_ioremap; - } - - writel(VPSS_CLK_CTRL_VENCCLKEN | -- VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); -+ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); -+ -+ ret = platform_driver_register(&vpss_driver); -+ if (ret) -+ goto err_pd_register; -+ -+ return 0; - -- return platform_driver_register(&vpss_driver); -+err_pd_register: -+ iounmap(oper_cfg.vpss_regs_base2); -+err_ioremap: -+ release_mem_region(VPSS_CLK_CTRL, 4); -+ return ret; - } - subsys_initcall(vpss_init); - module_exit(vpss_exit); -diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c -index 880a9068ca126..ef06af4e3611d 100644 ---- a/drivers/scsi/libfc/fc_disc.c -+++ b/drivers/scsi/libfc/fc_disc.c -@@ -595,8 +595,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, - mutex_lock(&disc->disc_mutex); - if (PTR_ERR(fp) == -FC_EX_CLOSED) - goto out; -- if (IS_ERR(fp)) -- goto redisc; -+ if (IS_ERR(fp)) { -+ mutex_lock(&disc->disc_mutex); -+ fc_disc_restart(disc); -+ mutex_unlock(&disc->disc_mutex); -+ goto out; -+ } - - cp = fc_frame_payload_get(fp, sizeof(*cp)); - if (!cp) -@@ -621,7 +625,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, - new_rdata->disc_id = disc->disc_id; - lport->tt.rport_login(new_rdata); - } -- goto out; -+ goto free_fp; - } - rdata->disc_id = disc->disc_id; - lport->tt.rport_login(rdata); -@@ -635,6 +639,8 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, - redisc: - fc_disc_restart(disc); - } -+free_fp: -+ fc_frame_free(fp); - out: - mutex_unlock(&disc->disc_mutex); - kref_put(&rdata->kref, lport->tt.rport_destroy); -diff --git a/drivers/video/fbdev/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c -index 9200a8668b498..a57c3a5f4bf8b 100644 ---- a/drivers/video/fbdev/omap2/dss/dss.c -+++ b/drivers/video/fbdev/omap2/dss/dss.c -@@ -843,7 +843,7 @@ static const struct dss_features omap34xx_dss_feats = { - }; - - static const struct dss_features omap3630_dss_feats = { -- .fck_div_max = 32, -+ .fck_div_max = 31, - .dss_fck_multiplier = 1, - .parent_clk_name = "dpll4_ck", - .dpi_select_source = &dss_dpi_select_source_omap2_omap3, -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index a01a41a412693..6b3565feddb21 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -603,6 +603,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx) - { - struct vring_virtqueue *vq = to_vvq(_vq); - -+ if (unlikely(vq->broken)) -+ return false; -+ - virtio_mb(vq->weak_barriers); - return (u16)last_used_idx != virtio16_to_cpu(_vq->vdev, vq->vring.used->idx); - } -diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c -index 2048aad91add8..2b12ef019ae02 100644 ---- a/drivers/watchdog/f71808e_wdt.c -+++ b/drivers/watchdog/f71808e_wdt.c -@@ -642,9 +642,9 @@ static int __init watchdog_init(int sioaddr) - * into the module have been registered yet. - */ - watchdog.sioaddr = sioaddr; -- watchdog.ident.options = WDIOC_SETTIMEOUT -- | WDIOF_MAGICCLOSE -- | WDIOF_KEEPALIVEPING; -+ watchdog.ident.options = WDIOF_MAGICCLOSE -+ | WDIOF_KEEPALIVEPING -+ | WDIOF_CARDRESET; - - snprintf(watchdog.ident.identity, - sizeof(watchdog.ident.identity), "%s watchdog", -diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c -index 5f6b77ea34fb5..128375ff80b8c 100644 ---- a/drivers/xen/preempt.c -+++ b/drivers/xen/preempt.c -@@ -31,7 +31,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall); - asmlinkage __visible void xen_maybe_preempt_hcall(void) - { - if (unlikely(__this_cpu_read(xen_in_preemptible_hcall) -- && need_resched())) { -+ && need_resched() && !preempt_count())) { - /* - * Clear flag as we may be rescheduled on a different - * cpu. -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 0b06d4942da77..8fb9a1e0048be 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -4096,6 +4096,8 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size); - /* super.c */ - int btrfs_parse_options(struct btrfs_root *root, char *options); - int btrfs_sync_fs(struct super_block *sb, int wait); -+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -+ u64 subvol_objectid); - - #ifdef CONFIG_PRINTK - __printf(2, 3) -diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c -index 2513a7f533342..92f80ed642194 100644 ---- a/fs/btrfs/export.c -+++ b/fs/btrfs/export.c -@@ -55,9 +55,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, - return type; - } - --static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -- u64 root_objectid, u32 generation, -- int check_generation) -+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -+ u64 root_objectid, u32 generation, -+ int check_generation) - { - struct btrfs_fs_info *fs_info = btrfs_sb(sb); - struct btrfs_root *root; -@@ -150,7 +150,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh, - return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1); - } - --static struct dentry *btrfs_get_parent(struct dentry *child) -+struct dentry *btrfs_get_parent(struct dentry *child) - { - struct inode *dir = d_inode(child); - struct btrfs_root *root = BTRFS_I(dir)->root; -diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h -index 074348a95841f..7a305e5549991 100644 ---- a/fs/btrfs/export.h -+++ b/fs/btrfs/export.h -@@ -16,4 +16,9 @@ struct btrfs_fid { - u64 parent_root_objectid; - } __attribute__ ((packed)); - -+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -+ u64 root_objectid, u32 generation, -+ int check_generation); -+struct dentry *btrfs_get_parent(struct dentry *child); -+ - #endif -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index 404051bf5cba9..77e6ce0e1e351 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -843,8 +843,8 @@ out: - return error; - } - --static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -- u64 subvol_objectid) -+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -+ u64 subvol_objectid) - { - struct btrfs_root *root = fs_info->tree_root; - struct btrfs_root *fs_root; -@@ -1120,6 +1120,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) - struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb); - struct btrfs_root *root = info->tree_root; - char *compress_type; -+ const char *subvol_name; - - if (btrfs_test_opt(root, DEGRADED)) - seq_puts(seq, ",degraded"); -@@ -1204,8 +1205,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) - #endif - seq_printf(seq, ",subvolid=%llu", - BTRFS_I(d_inode(dentry))->root->root_key.objectid); -- seq_puts(seq, ",subvol="); -- seq_dentry(seq, dentry, " \t\n\\"); -+ subvol_name = btrfs_get_subvol_name_from_objectid(info, -+ BTRFS_I(d_inode(dentry))->root->root_key.objectid); -+ if (!IS_ERR(subvol_name)) { -+ seq_puts(seq, ",subvol="); -+ seq_escape(seq, subvol_name, " \t\n\\"); -+ kfree(subvol_name); -+ } - return 0; - } - -@@ -1323,8 +1329,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid, - goto out; - } - } -- subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb), -- subvol_objectid); -+ subvol_name = btrfs_get_subvol_name_from_objectid( -+ btrfs_sb(mnt->mnt_sb), subvol_objectid); - if (IS_ERR(subvol_name)) { - root = ERR_CAST(subvol_name); - subvol_name = NULL; -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 240d9ceb8d0c6..b8959d0d4c723 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -1719,9 +1719,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - * not already there, and calling reverse_path_check() - * during ep_insert(). - */ -- if (list_empty(&epi->ffd.file->f_tfile_llink)) -+ if (list_empty(&epi->ffd.file->f_tfile_llink)) { -+ get_file(epi->ffd.file); - list_add(&epi->ffd.file->f_tfile_llink, - &tfile_check_list); -+ } - } - } - mutex_unlock(&ep->mtx); -@@ -1765,6 +1767,7 @@ static void clear_tfile_check_list(void) - file = list_first_entry(&tfile_check_list, struct file, - f_tfile_llink); - list_del_init(&file->f_tfile_llink); -+ fput(file); - } - INIT_LIST_HEAD(&tfile_check_list); - } -@@ -1902,13 +1905,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - mutex_lock(&epmutex); - if (is_file_epoll(tf.file)) { - error = -ELOOP; -- if (ep_loop_check(ep, tf.file) != 0) { -- clear_tfile_check_list(); -+ if (ep_loop_check(ep, tf.file) != 0) - goto error_tgt_fput; -- } -- } else -+ } else { -+ get_file(tf.file); - list_add(&tf.file->f_tfile_llink, - &tfile_check_list); -+ } - mutex_lock_nested(&ep->mtx, 0); - if (is_file_epoll(tf.file)) { - tep = tf.file->private_data; -@@ -1932,8 +1935,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - error = ep_insert(ep, &epds, tf.file, fd, full_check); - } else - error = -EEXIST; -- if (full_check) -- clear_tfile_check_list(); - break; - case EPOLL_CTL_DEL: - if (epi) -@@ -1954,8 +1955,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - mutex_unlock(&ep->mtx); - - error_tgt_fput: -- if (full_check) -+ if (full_check) { -+ clear_tfile_check_list(); - mutex_unlock(&epmutex); -+ } - - fdput(tf); - error_fput: -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 566a8b08ccdd6..061b026e464c5 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1226,19 +1226,18 @@ static void dx_insert_block(struct dx_frame *frame, u32 hash, ext4_lblk_t block) - } - - /* -- * NOTE! unlike strncmp, ext4_match returns 1 for success, 0 for failure. -+ * Test whether a directory entry matches the filename being searched for. - * -- * `len <= EXT4_NAME_LEN' is guaranteed by caller. -- * `de != NULL' is guaranteed by caller. -+ * Return: %true if the directory entry matches, otherwise %false. - */ --static inline int ext4_match(struct ext4_filename *fname, -- struct ext4_dir_entry_2 *de) -+static inline bool ext4_match(const struct ext4_filename *fname, -+ const struct ext4_dir_entry_2 *de) - { - const void *name = fname_name(fname); - u32 len = fname_len(fname); - - if (!de->inode) -- return 0; -+ return false; - - #ifdef CONFIG_EXT4_FS_ENCRYPTION - if (unlikely(!name)) { -@@ -1270,48 +1269,31 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, - struct ext4_dir_entry_2 * de; - char * dlimit; - int de_len; -- int res; - - de = (struct ext4_dir_entry_2 *)search_buf; - dlimit = search_buf + buf_size; - while ((char *) de < dlimit) { - /* this code is executed quadratically often */ - /* do minimal checking `by hand' */ -- if ((char *) de + de->name_len <= dlimit) { -- res = ext4_match(fname, de); -- if (res < 0) { -- res = -1; -- goto return_result; -- } -- if (res > 0) { -- /* found a match - just to be sure, do -- * a full check */ -- if (ext4_check_dir_entry(dir, NULL, de, bh, -- bh->b_data, -- bh->b_size, offset)) { -- res = -1; -- goto return_result; -- } -- *res_dir = de; -- res = 1; -- goto return_result; -- } -- -+ if ((char *) de + de->name_len <= dlimit && -+ ext4_match(fname, de)) { -+ /* found a match - just to be sure, do -+ * a full check */ -+ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf, -+ buf_size, offset)) -+ return -1; -+ *res_dir = de; -+ return 1; - } - /* prevent looping on a bad block */ - de_len = ext4_rec_len_from_disk(de->rec_len, - dir->i_sb->s_blocksize); -- if (de_len <= 0) { -- res = -1; -- goto return_result; -- } -+ if (de_len <= 0) -+ return -1; - offset += de_len; - de = (struct ext4_dir_entry_2 *) ((char *) de + de_len); - } -- -- res = 0; --return_result: -- return res; -+ return 0; - } - - static int is_dx_internal_node(struct inode *dir, ext4_lblk_t block, -@@ -1748,7 +1730,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - blocksize, hinfo, map); - map -= count; - dx_sort_map(map, count); -- /* Split the existing block in the middle, size-wise */ -+ /* Ensure that neither split block is over half full */ - size = 0; - move = 0; - for (i = count-1; i >= 0; i--) { -@@ -1758,8 +1740,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - size += map[i].size; - move++; - } -- /* map index at which we will split */ -- split = count - move; -+ /* -+ * map index at which we will split -+ * -+ * If the sum of active entries didn't exceed half the block size, just -+ * split it in half by count; each resulting block will have at least -+ * half the space free. -+ */ -+ if (i > 0) -+ split = count - move; -+ else -+ split = count/2; -+ - hash2 = map[split].hash; - continued = hash2 == map[split - 1].hash; - dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n", -@@ -1824,24 +1816,15 @@ int ext4_find_dest_de(struct inode *dir, struct inode *inode, - int nlen, rlen; - unsigned int offset = 0; - char *top; -- int res; - - de = (struct ext4_dir_entry_2 *)buf; - top = buf + buf_size - reclen; - while ((char *) de <= top) { - if (ext4_check_dir_entry(dir, NULL, de, bh, -- buf, buf_size, offset)) { -- res = -EFSCORRUPTED; -- goto return_result; -- } -- /* Provide crypto context and crypto buffer to ext4 match */ -- res = ext4_match(fname, de); -- if (res < 0) -- goto return_result; -- if (res > 0) { -- res = -EEXIST; -- goto return_result; -- } -+ buf, buf_size, offset)) -+ return -EFSCORRUPTED; -+ if (ext4_match(fname, de)) -+ return -EEXIST; - nlen = EXT4_DIR_REC_LEN(de->name_len); - rlen = ext4_rec_len_from_disk(de->rec_len, buf_size); - if ((de->inode ? rlen - nlen : rlen) >= reclen) -@@ -1849,15 +1832,11 @@ int ext4_find_dest_de(struct inode *dir, struct inode *inode, - de = (struct ext4_dir_entry_2 *)((char *)de + rlen); - offset += rlen; - } -- - if ((char *) de > top) -- res = -ENOSPC; -- else { -- *dest_de = de; -- res = 0; -- } --return_result: -- return res; -+ return -ENOSPC; -+ -+ *dest_de = de; -+ return 0; - } - - int ext4_insert_dentry(struct inode *dir, -@@ -2343,7 +2322,7 @@ int ext4_generic_delete_entry(handle_t *handle, - de = (struct ext4_dir_entry_2 *)entry_buf; - while (i < buf_size - csum_size) { - if (ext4_check_dir_entry(dir, NULL, de, bh, -- bh->b_data, bh->b_size, i)) -+ entry_buf, buf_size, i)) - return -EFSCORRUPTED; - if (de == de_del) { - if (pde) -diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c -index e273171696972..7a3368929245d 100644 ---- a/fs/jffs2/dir.c -+++ b/fs/jffs2/dir.c -@@ -588,10 +588,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry) - int ret; - uint32_t now = get_seconds(); - -+ mutex_lock(&f->sem); - for (fd = f->dents ; fd; fd = fd->next) { -- if (fd->ino) -+ if (fd->ino) { -+ mutex_unlock(&f->sem); - return -ENOTEMPTY; -+ } - } -+ mutex_unlock(&f->sem); - - ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name, - dentry->d_name.len, f, now); -diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c -index f86f51f99aceb..1dcadd22b440d 100644 ---- a/fs/romfs/storage.c -+++ b/fs/romfs/storage.c -@@ -221,10 +221,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos, - size_t limit; - - limit = romfs_maxsize(sb); -- if (pos >= limit) -+ if (pos >= limit || buflen > limit - pos) - return -EIO; -- if (buflen > limit - pos) -- buflen = limit - pos; - - #ifdef CONFIG_ROMFS_ON_MTD - if (sb->s_mtd) -diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h -index be692e59938db..c457b010c623d 100644 ---- a/fs/xfs/xfs_sysfs.h -+++ b/fs/xfs/xfs_sysfs.h -@@ -44,9 +44,11 @@ xfs_sysfs_init( - struct xfs_kobj *parent_kobj, - const char *name) - { -+ struct kobject *parent; -+ -+ parent = parent_kobj ? &parent_kobj->kobject : NULL; - init_completion(&kobj->complete); -- return kobject_init_and_add(&kobj->kobject, ktype, -- &parent_kobj->kobject, "%s", name); -+ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name); - } - - static inline void -diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c -index ce78534a047ee..bb8de2dddabe2 100644 ---- a/fs/xfs/xfs_trans_dquot.c -+++ b/fs/xfs/xfs_trans_dquot.c -@@ -662,7 +662,7 @@ xfs_trans_dqresv( - } - } - if (ninos > 0) { -- total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos; -+ total_count = dqp->q_res_icount + ninos; - timer = be32_to_cpu(dqp->q_core.d_itimer); - warns = be16_to_cpu(dqp->q_core.d_iwarns); - warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit; -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 03cf5526e4456..2b17d2fca4299 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1123,6 +1123,10 @@ void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma, - * followed by taking the mmap_sem for writing before modifying the - * vmas or anything the coredump pretends not to change from under it. - * -+ * It also has to be called when mmgrab() is used in the context of -+ * the process, but then the mm_count refcount is transferred outside -+ * the context of the process to run down_write() on that pinned mm. -+ * - * NOTE: find_extend_vma() called from GUP context is the only place - * that can modify the "mm" (notably the vm_start/end) under mmap_sem - * for reading and outside the context of the process, so it is also -diff --git a/include/net/sock.h b/include/net/sock.h -index 426a57874964c..31198b32d9122 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -779,6 +779,8 @@ static inline int sk_memalloc_socks(void) - { - return static_key_false(&memalloc_socks); - } -+ -+void __receive_sock(struct file *file); - #else - - static inline int sk_memalloc_socks(void) -@@ -786,6 +788,8 @@ static inline int sk_memalloc_socks(void) - return 0; - } - -+static inline void __receive_sock(struct file *file) -+{ } - #endif - - static inline gfp_t sk_gfp_atomic(const struct sock *sk, gfp_t gfp_mask) -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 465786cd6490e..f38d24bb8a1bc 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2136,7 +2136,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm, - - static inline int khugepaged_test_exit(struct mm_struct *mm) - { -- return atomic_read(&mm->mm_users) == 0; -+ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm); - } - - int __khugepaged_enter(struct mm_struct *mm) -@@ -2149,7 +2149,7 @@ int __khugepaged_enter(struct mm_struct *mm) - return -ENOMEM; - - /* __khugepaged_exit() must not run from under us */ -- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm); -+ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm); - if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) { - free_mm_slot(mm_slot); - return 0; -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 3a1501e854832..baac9a09ec0a1 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -4257,6 +4257,7 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) - return false; - } - -+#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a)) - /* - * Determine if start,end range within vma could be mapped by shared pmd. - * If yes, adjust start and end to cover range associated with possible -@@ -4265,25 +4266,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) - void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, - unsigned long *start, unsigned long *end) - { -- unsigned long check_addr = *start; -+ unsigned long a_start, a_end; - - if (!(vma->vm_flags & VM_MAYSHARE)) - return; - -- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) { -- unsigned long a_start = check_addr & PUD_MASK; -- unsigned long a_end = a_start + PUD_SIZE; -+ /* Extend the range to be PUD aligned for a worst case scenario */ -+ a_start = ALIGN_DOWN(*start, PUD_SIZE); -+ a_end = ALIGN(*end, PUD_SIZE); - -- /* -- * If sharing is possible, adjust start/end if necessary. -- */ -- if (range_in_vma(vma, a_start, a_end)) { -- if (a_start < *start) -- *start = a_start; -- if (a_end > *end) -- *end = a_end; -- } -- } -+ /* -+ * Intersect the range with the vma range, since pmd sharing won't be -+ * across vma after all -+ */ -+ *start = max(vma->vm_start, a_start); -+ *end = min(vma->vm_end, a_end); - } - - /* -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index df589416ace6c..14bab5fa1b656 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -843,6 +843,11 @@ static void free_pcppages_bulk(struct zone *zone, int count, - if (nr_scanned) - __mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned); - -+ /* -+ * Ensure proper count is passed which otherwise would stuck in the -+ * below while (list_empty(list)) loop. -+ */ -+ count = min(pcp->count, count); - while (to_free) { - struct page *page; - struct list_head *list; -@@ -6285,7 +6290,7 @@ int __meminit init_per_zone_wmark_min(void) - setup_per_zone_inactive_ratio(); - return 0; - } --core_initcall(init_per_zone_wmark_min) -+postcore_initcall(init_per_zone_wmark_min) - - /* - * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so -diff --git a/net/compat.c b/net/compat.c -index d676840104556..20c5e5f215f23 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -284,6 +284,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) - break; - } - /* Bump the usage count and install the file. */ -+ __receive_sock(fp[i]); - fd_install(new_fd, get_file(fp[i])); - } - -diff --git a/net/core/sock.c b/net/core/sock.c -index 120d5058d81ae..82f9a7dbea6fe 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2275,6 +2275,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * - } - EXPORT_SYMBOL(sock_no_mmap); - -+/* -+ * When a file is received (via SCM_RIGHTS, etc), we must bump the -+ * various sock-based usage counts. -+ */ -+void __receive_sock(struct file *file) -+{ -+ struct socket *sock; -+ int error; -+ -+ /* -+ * The resulting value of "error" is ignored here since we only -+ * need to take action when the file is a socket and testing -+ * "sock" for NULL is sufficient. -+ */ -+ sock = sock_from_file(file, &error); -+ if (sock) { -+ sock_update_netprioidx(sock->sk); -+ sock_update_classid(sock->sk); -+ } -+} -+ - ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags) - { - ssize_t res; -diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -index 1d9dfb92b3b48..edb244331e6e9 100644 ---- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c -+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -@@ -338,7 +338,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, - - ret_val = power_up_sst(stream); - if (ret_val < 0) -- return ret_val; -+ goto out_power_up; - - /* Make sure, that the period size is always even */ - snd_pcm_hw_constraint_step(substream->runtime, 0, -@@ -347,8 +347,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, - return snd_pcm_hw_constraint_integer(runtime, - SNDRV_PCM_HW_PARAM_PERIODS); - out_ops: -- kfree(stream); - mutex_unlock(&sst_lock); -+out_power_up: -+ kfree(stream); - return ret_val; - } - -diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c -index c694f10d004cc..1b73537af91db 100644 ---- a/tools/perf/util/probe-finder.c -+++ b/tools/perf/util/probe-finder.c -@@ -1274,7 +1274,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg, - tf.ntevs = 0; - - ret = debuginfo__find_probes(dbg, &tf.pf); -- if (ret < 0) { -+ if (ret < 0 || tf.ntevs == 0) { - for (i = 0; i < tf.ntevs; i++) - clear_probe_trace_event(&tf.tevs[i]); - zfree(tevs); diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.234-235.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.234-235.patch deleted file mode 100644 index 87c263d3df..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.234-235.patch +++ /dev/null @@ -1,2129 +0,0 @@ -diff --git a/Makefile b/Makefile -index 573b646a19936..a32490d4471f3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 234 -+SUBLEVEL = 235 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c -index 530a36f465ced..afcc86726448e 100644 ---- a/arch/mips/vdso/genvdso.c -+++ b/arch/mips/vdso/genvdso.c -@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (fstat(fd, &stat) != 0) { - fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name, - path, strerror(errno)); -+ close(fd); - return NULL; - } - -@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (addr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name, - path, strerror(errno)); -+ close(fd); - return NULL; - } - -@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) { - fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name, - path); -+ close(fd); - return NULL; - } - -@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size) - default: - fprintf(stderr, "%s: '%s' has invalid ELF class\n", - program_name, path); -+ close(fd); - return NULL; - } - -@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size) - default: - fprintf(stderr, "%s: '%s' has invalid ELF data order\n", - program_name, path); -+ close(fd); - return NULL; - } - -@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size) - fprintf(stderr, - "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n", - program_name, path); -+ close(fd); - return NULL; - } else if (swap_uint16(ehdr->e_type) != ET_DYN) { - fprintf(stderr, - "%s: '%s' has invalid ELF type (expected ET_DYN)\n", - program_name, path); -+ close(fd); - return NULL; - } - - *_size = stat.st_size; -+ close(fd); - return addr; - } - -@@ -284,10 +292,12 @@ int main(int argc, char **argv) - /* Calculate and write symbol offsets to */ - if (!get_symbols(dbg_vdso_path, dbg_vdso)) { - unlink(out_path); -+ fclose(out_file); - return EXIT_FAILURE; - } - - fprintf(out_file, "};\n"); -+ fclose(out_file); - - return EXIT_SUCCESS; - } -diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig -index 429fc59d2a476..9acca9c79ef62 100644 ---- a/arch/powerpc/platforms/cell/Kconfig -+++ b/arch/powerpc/platforms/cell/Kconfig -@@ -50,6 +50,7 @@ config SPU_FS - tristate "SPU file system" - default m - depends on PPC_CELL -+ depends on COREDUMP - select SPU_BASE - select MEMORY_HOTPLUG - help -diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c -index 9e817c1b78087..1fa8e492ce27d 100644 ---- a/arch/powerpc/platforms/pseries/ras.c -+++ b/arch/powerpc/platforms/pseries/ras.c -@@ -90,7 +90,6 @@ static void handle_system_shutdown(char event_modifier) - pr_emerg("Loss of power reported by firmware, system is " - "running on UPS/battery"); - pr_emerg("Check RTAS error log for details"); -- orderly_poweroff(true); - break; - - case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS: -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 64b59552e7444..ddc9dd971674c 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -2344,17 +2344,21 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) - */ - void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) - { -- if (fwnode) { -- struct fwnode_handle *fn = dev->fwnode; -+ struct fwnode_handle *fn = dev->fwnode; - -+ if (fwnode) { - if (fwnode_is_primary(fn)) - fn = fn->secondary; - - fwnode->secondary = fn; - dev->fwnode = fwnode; - } else { -- dev->fwnode = fwnode_is_primary(dev->fwnode) ? -- dev->fwnode->secondary : NULL; -+ if (fwnode_is_primary(fn)) { -+ dev->fwnode = fn->secondary; -+ fn->secondary = NULL; -+ } else { -+ dev->fwnode = NULL; -+ } - } - } - EXPORT_SYMBOL_GPL(set_primary_fwnode); -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 8efdb823826c8..79724fd0a8989 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1361,13 +1361,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) - } - - /* -- * If a device configured to wake up the system from sleep states -- * has been suspended at run time and there's a resume request pending -- * for it, this is equivalent to the device signaling wakeup, so the -- * system suspend operation should be aborted. -+ * Wait for possible runtime PM transitions of the device in progress -+ * to complete and if there's a runtime resume request pending for it, -+ * resume it before proceeding with invoking the system-wide suspend -+ * callbacks for it. -+ * -+ * If the system-wide suspend callbacks below change the configuration -+ * of the device, they must disable runtime PM for it or otherwise -+ * ensure that its runtime-resume callbacks will not be confused by that -+ * change in case they are invoked going forward. - */ -- if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) -- pm_wakeup_event(dev, 0); -+ pm_runtime_barrier(dev); - - if (pm_wakeup_pending()) { - dev->power.direct_complete = false; -diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c -index 18d77ace4813c..30f83fb6b145a 100644 ---- a/drivers/edac/ie31200_edac.c -+++ b/drivers/edac/ie31200_edac.c -@@ -131,6 +131,8 @@ - #define IE31200_PAGES(n) (n << (28 - PAGE_SHIFT)) - - static int nr_channels; -+static struct pci_dev *mci_pdev; -+static int ie31200_registered = 1; - - struct ie31200_priv { - void __iomem *window; -@@ -456,12 +458,16 @@ fail_free: - static int ie31200_init_one(struct pci_dev *pdev, - const struct pci_device_id *ent) - { -- edac_dbg(0, "MC:\n"); -+ int rc; - -+ edac_dbg(0, "MC:\n"); - if (pci_enable_device(pdev) < 0) - return -EIO; -+ rc = ie31200_probe1(pdev, ent->driver_data); -+ if (rc == 0 && !mci_pdev) -+ mci_pdev = pci_dev_get(pdev); - -- return ie31200_probe1(pdev, ent->driver_data); -+ return rc; - } - - static void ie31200_remove_one(struct pci_dev *pdev) -@@ -470,6 +476,8 @@ static void ie31200_remove_one(struct pci_dev *pdev) - struct ie31200_priv *priv; - - edac_dbg(0, "\n"); -+ pci_dev_put(mci_pdev); -+ mci_pdev = NULL; - mci = edac_mc_del_mc(&pdev->dev); - if (!mci) - return; -@@ -515,17 +523,53 @@ static struct pci_driver ie31200_driver = { - - static int __init ie31200_init(void) - { -+ int pci_rc, i; -+ - edac_dbg(3, "MC:\n"); - /* Ensure that the OPSTATE is set correctly for POLL or NMI */ - opstate_init(); - -- return pci_register_driver(&ie31200_driver); -+ pci_rc = pci_register_driver(&ie31200_driver); -+ if (pci_rc < 0) -+ goto fail0; -+ -+ if (!mci_pdev) { -+ ie31200_registered = 0; -+ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) { -+ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor, -+ ie31200_pci_tbl[i].device, -+ NULL); -+ if (mci_pdev) -+ break; -+ } -+ if (!mci_pdev) { -+ edac_dbg(0, "ie31200 pci_get_device fail\n"); -+ pci_rc = -ENODEV; -+ goto fail1; -+ } -+ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]); -+ if (pci_rc < 0) { -+ edac_dbg(0, "ie31200 init fail\n"); -+ pci_rc = -ENODEV; -+ goto fail1; -+ } -+ } -+ return 0; -+ -+fail1: -+ pci_unregister_driver(&ie31200_driver); -+fail0: -+ pci_dev_put(mci_pdev); -+ -+ return pci_rc; - } - - static void __exit ie31200_exit(void) - { - edac_dbg(3, "MC:\n"); - pci_unregister_driver(&ie31200_driver); -+ if (!ie31200_registered) -+ ie31200_remove_one(mci_pdev); - } - - module_init(ie31200_init); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index 1f0e6ede120c4..1b3fda2331bee 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (encoder) { -@@ -863,8 +865,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = amdgpu_connector_best_single_encoder(connector); -@@ -986,8 +990,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { -@@ -1360,8 +1366,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -index c555781685ea8..d3ee8f19f1ef9 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -@@ -296,7 +296,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) - - ret = pm_runtime_get_sync(dev->dev); - if (ret < 0) -- return ret; -+ goto out; - - ret = drm_crtc_helper_set_config(set); - -@@ -311,7 +311,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) - take the current one */ - if (active && !adev->have_disp_power_ref) { - adev->have_disp_power_ref = true; -- return ret; -+ goto out; - } - /* if we have no active crtcs, then drop the power ref - we got before */ -@@ -320,6 +320,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) - adev->have_disp_power_ref = false; - } - -+out: - /* drop the power reference we got coming in here */ - pm_runtime_put_autosuspend(dev->dev); - return ret; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 8d6668cedf6db..eb3c54e1f1ca8 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -443,11 +443,12 @@ long amdgpu_drm_ioctl(struct file *filp, - dev = file_priv->minor->dev; - ret = pm_runtime_get_sync(dev->dev); - if (ret < 0) -- return ret; -+ goto out; - - ret = drm_ioctl(filp, cmd, arg); - - pm_runtime_mark_last_busy(dev->dev); -+out: - pm_runtime_put_autosuspend(dev->dev); - return ret; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index 5bf98f0195fbd..6025c69871a86 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -522,7 +522,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - - r = pm_runtime_get_sync(dev->dev); - if (r < 0) -- return r; -+ goto pm_put; - - fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); - if (unlikely(!fpriv)) -@@ -540,6 +540,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - file_priv->driver_priv = fpriv; - - pm_runtime_mark_last_busy(dev->dev); -+pm_put: - pm_runtime_put_autosuspend(dev->dev); - return 0; - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 2acbd43f9a531..965489b20429c 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -841,8 +841,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - - ret = kobject_init_and_add(dev->kobj_node, &node_type, - sys_props.kobj_nodes, "%d", id); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(dev->kobj_node); - return ret; -+ } - - dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node); - if (!dev->kobj_mem) -@@ -885,8 +887,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(mem->kobj, &mem_type, - dev->kobj_mem, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(mem->kobj); - return ret; -+ } - - mem->attr.name = "properties"; - mem->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -904,8 +908,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(cache->kobj, &cache_type, - dev->kobj_cache, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(cache->kobj); - return ret; -+ } - - cache->attr.name = "properties"; - cache->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -923,8 +929,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(iolink->kobj, &iolink_type, - dev->kobj_iolink, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(iolink->kobj); - return ret; -+ } - - iolink->attr.name = "properties"; - iolink->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -976,8 +984,10 @@ static int kfd_topology_update_sysfs(void) - ret = kobject_init_and_add(sys_props.kobj_topology, - &sysprops_type, &kfd_device->kobj, - "topology"); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(sys_props.kobj_topology); - return ret; -+ } - - sys_props.kobj_nodes = kobject_create_and_add("nodes", - sys_props.kobj_topology); -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c -index 1855b475cc0b2..42be04813b682 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.c -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c -@@ -263,8 +263,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) - pm_runtime_get_noresume(dev->dev); - } else { - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return conn_status; -+ } - } - - nv_encoder = nouveau_connector_ddc_detect(connector); -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index edb3a23ded5d5..11183839f6fad 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -184,8 +184,10 @@ nouveau_fbcon_open(struct fb_info *info, int user) - struct nouveau_fbdev *fbcon = info->par; - struct nouveau_drm *drm = nouveau_drm(fbcon->dev); - int ret = pm_runtime_get_sync(drm->dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put(drm->dev->dev); - return ret; -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index bebcef2ce6b88..a9f1d99bb6f99 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -886,8 +886,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (encoder) { -@@ -1021,8 +1023,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = radeon_best_single_encoder(connector); -@@ -1158,8 +1162,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = radeon_best_single_encoder(connector); -@@ -1241,8 +1247,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (radeon_connector->detected_hpd_without_ddc) { -@@ -1681,8 +1689,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && radeon_check_hpd_status_unchanged(connector)) { -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index dbdd265075daf..7bce23a43907e 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -554,12 +554,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, - - switch (cmd) { - case HIDIOCGUSAGE: -+ if (uref->usage_index >= field->report_count) -+ goto inval; - uref->value = field->value[uref->usage_index]; - if (copy_to_user(user_arg, uref, sizeof(*uref))) - goto fault; - goto goodreturn; - - case HIDIOCSUSAGE: -+ if (uref->usage_index >= field->report_count) -+ goto inval; - field->value[uref->usage_index] = uref->value; - goto goodreturn; - -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index ddfb08a3e6c20..00b3178c36a7a 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -393,6 +393,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - /* master sent stop */ - if (ssr_filtered & SSR) { - i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); -+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ - rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); - } -diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c -index f89364951ebdf..fb13cc3c591da 100644 ---- a/drivers/media/pci/ttpci/av7110.c -+++ b/drivers/media/pci/ttpci/av7110.c -@@ -426,14 +426,15 @@ static void debiirq(unsigned long cookie) - case DATA_CI_GET: - { - u8 *data = av7110->debi_virt; -+ u8 data_0 = data[0]; - -- if ((data[0] < 2) && data[2] == 0xff) { -+ if (data_0 < 2 && data[2] == 0xff) { - int flags = 0; - if (data[5] > 0) - flags |= CA_CI_MODULE_PRESENT; - if (data[5] > 5) - flags |= CA_CI_MODULE_READY; -- av7110->ci_slot[data[0]].flags = flags; -+ av7110->ci_slot[data_0].flags = flags; - } else - ci_get_data(&av7110->ci_rbuffer, - av7110->debi_virt, -diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c -index c1e573b7cc6fb..50122ac2ac028 100644 ---- a/drivers/media/platform/davinci/vpif_capture.c -+++ b/drivers/media/platform/davinci/vpif_capture.c -@@ -1417,8 +1417,6 @@ probe_out: - /* Unregister video device */ - video_unregister_device(&ch->video_dev); - } -- kfree(vpif_obj.sd); -- v4l2_device_unregister(&vpif_obj.v4l2_dev); - - return err; - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index e31b4c7d2522b..aaf75d5e6e480 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1940,7 +1940,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev, - int ret; - - ret = bond_release(bond_dev, slave_dev); -- if (ret == 0 && !bond_has_slaves(bond)) { -+ if (ret == 0 && !bond_has_slaves(bond) && -+ bond_dev->reg_state != NETREG_UNREGISTERING) { - bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; - netdev_info(bond_dev, "Destroying bond %s\n", - bond_dev->name); -@@ -4057,13 +4058,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) - return ret; - } - -+static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed) -+{ -+ if (speed == 0 || speed == SPEED_UNKNOWN) -+ speed = slave->speed; -+ else -+ speed = min(speed, slave->speed); -+ -+ return speed; -+} -+ - static int bond_ethtool_get_settings(struct net_device *bond_dev, - struct ethtool_cmd *ecmd) - { - struct bonding *bond = netdev_priv(bond_dev); -- unsigned long speed = 0; - struct list_head *iter; - struct slave *slave; -+ u32 speed = 0; - - ecmd->duplex = DUPLEX_UNKNOWN; - ecmd->port = PORT_OTHER; -@@ -4075,8 +4086,13 @@ static int bond_ethtool_get_settings(struct net_device *bond_dev, - */ - bond_for_each_slave(bond, slave, iter) { - if (bond_slave_can_tx(slave)) { -- if (slave->speed != SPEED_UNKNOWN) -- speed += slave->speed; -+ if (slave->speed != SPEED_UNKNOWN) { -+ if (BOND_MODE(bond) == BOND_MODE_BROADCAST) -+ speed = bond_mode_bcast_speed(slave, -+ speed); -+ else -+ speed += slave->speed; -+ } - if (ecmd->duplex == DUPLEX_UNKNOWN && - slave->duplex != DUPLEX_UNKNOWN) - ecmd->duplex = slave->duplex; -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 37cc1f838dd8b..96310e2ee5458 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -845,8 +845,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) - continue; - - err = gfar_parse_group(child, priv, model); -- if (err) -+ if (err) { -+ of_node_put(child); - goto err_grp_init; -+ } - } - } else { /* SQ_SG_MODE */ - err = gfar_parse_group(np, priv, model); -diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c -index b4d5f53c97d35..b7a122a1b89a1 100644 ---- a/drivers/net/ipvlan/ipvlan_main.c -+++ b/drivers/net/ipvlan/ipvlan_main.c -@@ -87,12 +87,21 @@ static void ipvlan_port_destroy(struct net_device *dev) - static struct lock_class_key ipvlan_netdev_xmit_lock_key; - static struct lock_class_key ipvlan_netdev_addr_lock_key; - -+#define IPVLAN_ALWAYS_ON_OFLOADS \ -+ (NETIF_F_SG | NETIF_F_HW_CSUM | \ -+ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL) -+ -+#define IPVLAN_ALWAYS_ON \ -+ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED) -+ - #define IPVLAN_FEATURES \ - (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ - NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \ - NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \ - NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER) - -+ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */ -+ - #define IPVLAN_STATE_MASK \ - ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT)) - -@@ -117,7 +126,9 @@ static int ipvlan_init(struct net_device *dev) - dev->state = (dev->state & ~IPVLAN_STATE_MASK) | - (phy_dev->state & IPVLAN_STATE_MASK); - dev->features = phy_dev->features & IPVLAN_FEATURES; -- dev->features |= NETIF_F_LLTX; -+ dev->features |= IPVLAN_ALWAYS_ON; -+ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES; -+ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS; - dev->gso_max_size = phy_dev->gso_max_size; - dev->hard_header_len = phy_dev->hard_header_len; - -@@ -201,7 +212,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev, - { - struct ipvl_dev *ipvlan = netdev_priv(dev); - -- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES); -+ features |= NETIF_F_ALL_FOR_ALL; -+ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES); -+ features = netdev_increment_features(ipvlan->phy_dev->features, -+ features, features); -+ features |= IPVLAN_ALWAYS_ON; -+ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON); -+ -+ return features; - } - - static void ipvlan_change_rx_flags(struct net_device *dev, int change) -@@ -590,9 +608,8 @@ static int ipvlan_device_event(struct notifier_block *unused, - - case NETDEV_FEAT_CHANGE: - list_for_each_entry(ipvlan, &port->ipvlans, pnode) { -- ipvlan->dev->features = dev->features & IPVLAN_FEATURES; - ipvlan->dev->gso_max_size = dev->gso_max_size; -- netdev_features_change(ipvlan->dev); -+ netdev_update_features(ipvlan->dev); - } - break; - -diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h -index 713c2bcea1782..8ec5c579d7fa8 100644 ---- a/drivers/net/wireless/ath/ath10k/hw.h -+++ b/drivers/net/wireless/ath/ath10k/hw.h -@@ -429,7 +429,7 @@ enum ath10k_hw_rate_cck { - - #define TARGET_10_4_TX_DBG_LOG_SIZE 1024 - #define TARGET_10_4_NUM_WDS_ENTRIES 32 --#define TARGET_10_4_DMA_BURST_SIZE 0 -+#define TARGET_10_4_DMA_BURST_SIZE 1 - #define TARGET_10_4_MAC_AGGR_DELIM 0 - #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1 - #define TARGET_10_4_VOW_CONFIG 0 -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c -index 9408c1f8e3977..f01ef8ecfaf39 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.c -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c -@@ -755,8 +755,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw) - - usb_anchor_urb(urb, &rtlusb->rx_submitted); - err = usb_submit_urb(urb, GFP_KERNEL); -- if (err) -+ if (err) { -+ usb_unanchor_urb(urb); -+ usb_free_urb(urb); - goto err_out; -+ } - usb_free_urb(urb); - } - return 0; -diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c -index 429d34c348b9f..01a343ad7155c 100644 ---- a/drivers/pci/slot.c -+++ b/drivers/pci/slot.c -@@ -303,13 +303,16 @@ placeholder: - slot_name = make_slot_name(name); - if (!slot_name) { - err = -ENOMEM; -+ kfree(slot); - goto err; - } - - err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL, - "%s", slot_name); -- if (err) -+ if (err) { -+ kobject_put(&slot->kobj); - goto err; -+ } - - INIT_LIST_HEAD(&slot->list); - list_add(&slot->list, &parent->slots); -@@ -328,7 +331,6 @@ out: - mutex_unlock(&pci_slot_mutex); - return slot; - err: -- kfree(slot); - slot = ERR_PTR(err); - goto out; - } -diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c -index 8ecc956ecb59c..370a3a2c6de73 100644 ---- a/drivers/s390/cio/css.c -+++ b/drivers/s390/cio/css.c -@@ -529,6 +529,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) - rc = css_evaluate_known_subchannel(sch, 1); - if (rc == -EAGAIN) - css_schedule_eval(sch->schid); -+ /* -+ * The loop might take long time for platforms with lots of -+ * known devices. Allow scheduling here. -+ */ -+ cond_resched(); - } - return 0; - } -diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c -index 3bc610d160f57..53afdbe17d71d 100644 ---- a/drivers/scsi/fcoe/fcoe_ctlr.c -+++ b/drivers/scsi/fcoe/fcoe_ctlr.c -@@ -264,9 +264,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new) - WARN_ON(!fcf_dev); - new->fcf_dev = NULL; - fcoe_fcf_device_delete(fcf_dev); -- kfree(new); - mutex_unlock(&cdev->lock); - } -+ kfree(new); - } - - /** -diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c -index 861c57bc4520a..72248712949e0 100644 ---- a/drivers/scsi/lpfc/lpfc_vport.c -+++ b/drivers/scsi/lpfc/lpfc_vport.c -@@ -615,27 +615,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport) - vport->port_state < LPFC_VPORT_READY) - return -EAGAIN; - } -+ - /* -- * This is a bit of a mess. We want to ensure the shost doesn't get -- * torn down until we're done with the embedded lpfc_vport structure. -- * -- * Beyond holding a reference for this function, we also need a -- * reference for outstanding I/O requests we schedule during delete -- * processing. But once we scsi_remove_host() we can no longer obtain -- * a reference through scsi_host_get(). -- * -- * So we take two references here. We release one reference at the -- * bottom of the function -- after delinking the vport. And we -- * release the other at the completion of the unreg_vpi that get's -- * initiated after we've disposed of all other resources associated -- * with the port. -+ * Take early refcount for outstanding I/O requests we schedule during -+ * delete processing for unreg_vpi. Always keep this before -+ * scsi_remove_host() as we can no longer obtain a reference through -+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. - */ - if (!scsi_host_get(shost)) - return VPORT_INVAL; -- if (!scsi_host_get(shost)) { -- scsi_host_put(shost); -- return VPORT_INVAL; -- } -+ - lpfc_free_sysfs_attr(vport); - - lpfc_debugfs_terminate(vport); -@@ -783,8 +772,9 @@ skip_logo: - if (!(vport->vpi_state & LPFC_VPI_REGISTERED) || - lpfc_mbx_unreg_vpi(vport)) - scsi_host_put(shost); -- } else -+ } else { - scsi_host_put(shost); -+ } - - lpfc_free_vpi(phba, vport->vpi); - vport->work_port_events = 0; -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index de10b461ec7ef..4903640316480 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -3192,7 +3192,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.set_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_set_fnode; - } - - idx = ev->u.set_flashnode.flashnode_idx; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index d15cd7a02f9b4..d7a0a64f64536 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -575,6 +575,7 @@ unblock_reqs: - int ufshcd_hold(struct ufs_hba *hba, bool async) - { - int rc = 0; -+ bool flush_result; - unsigned long flags; - - if (!ufshcd_is_clkgating_allowed(hba)) -@@ -601,7 +602,9 @@ start: - break; - } - spin_unlock_irqrestore(hba->host->host_lock, flags); -- flush_work(&hba->clk_gating.ungate_work); -+ flush_result = flush_work(&hba->clk_gating.ungate_work); -+ if (hba->clk_gating.is_suspended && !flush_result) -+ goto out; - spin_lock_irqsave(hba->host->host_lock, flags); - goto start; - } -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index c43c942e1f876..bccde58bc5e30 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -590,7 +590,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) - struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; - struct tcmu_cmd *cmd; - -- tcmu_flush_dcache_range(entry, sizeof(*entry)); -+ /* -+ * Flush max. up to end of cmd ring since current entry might -+ * be a padding that is shorter than sizeof(*entry) -+ */ -+ size_t ring_left = head_to_end(udev->cmdr_last_cleaned, -+ udev->cmdr_size); -+ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ? -+ ring_left : sizeof(*entry)); - - if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) { - UPDATE_HEAD(udev->cmdr_last_cleaned, -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index d42d66b72d5a8..fef1b9335f604 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -1902,6 +1902,10 @@ int serial8250_do_startup(struct uart_port *port) - - if (port->irq) { - unsigned char iir1; -+ -+ if (port->irqflags & IRQF_SHARED) -+ disable_irq_nosync(port->irq); -+ - /* - * Test for UARTs that do not reassert THRE when the - * transmitter is idle and the interrupt has already -@@ -1911,8 +1915,6 @@ int serial8250_do_startup(struct uart_port *port) - * allow register changes to become visible. - */ - spin_lock_irqsave(&port->lock, flags); -- if (up->port.irqflags & IRQF_SHARED) -- disable_irq_nosync(port->irq); - - wait_for_xmitr(up, UART_LSR_THRE); - serial_port_out_sync(port, UART_IER, UART_IER_THRI); -@@ -1924,9 +1926,10 @@ int serial8250_do_startup(struct uart_port *port) - iir = serial_port_in(port, UART_IIR); - serial_port_out(port, UART_IER, 0); - -+ spin_unlock_irqrestore(&port->lock, flags); -+ - if (port->irqflags & IRQF_SHARED) - enable_irq(port->irq); -- spin_unlock_irqrestore(&port->lock, flags); - - /* - * If the interrupt is not reasserted, or we otherwise -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index c5da46f7b9093..562f2a40e083c 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -2332,7 +2332,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, - - static int pl011_register_port(struct uart_amba_port *uap) - { -- int ret; -+ int ret, i; - - /* Ensure interrupts from this UART are masked and cleared */ - writew(0, uap->port.membase + UART011_IMSC); -@@ -2343,6 +2343,9 @@ static int pl011_register_port(struct uart_amba_port *uap) - if (ret < 0) { - dev_err(uap->port.dev, - "Failed to register AMBA-PL011 driver\n"); -+ for (i = 0; i < ARRAY_SIZE(amba_ports); i++) -+ if (amba_ports[i] == uap) -+ amba_ports[i] = NULL; - return ret; - } - } -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 8d485f82443ed..70a51d0bc6044 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1719,9 +1719,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, - ourport->tx_irq = ret + 1; - } - -- ret = platform_get_irq(platdev, 1); -- if (ret > 0) -- ourport->tx_irq = ret; -+ if (!s3c24xx_serial_has_interrupt_mask(port)) { -+ ret = platform_get_irq(platdev, 1); -+ if (ret > 0) -+ ourport->tx_irq = ret; -+ } - /* - * DMA is currently supported only on DT platforms, if DMA properties - * are specified. -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 4785ae061b659..0e4f54832fc79 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -864,7 +864,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - unsigned int old_rows, old_row_size; - unsigned int new_cols, new_rows, new_row_size, new_screen_size; - unsigned int user; -- unsigned short *newscreen; -+ unsigned short *oldscreen, *newscreen; - - WARN_CONSOLE_UNLOCKED(); - -@@ -946,10 +946,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (new_scr_end > new_origin) - scr_memsetw((void *)new_origin, vc->vc_video_erase_char, - new_scr_end - new_origin); -- kfree(vc->vc_screenbuf); -+ oldscreen = vc->vc_screenbuf; - vc->vc_screenbuf = newscreen; - vc->vc_screenbuf_size = new_screen_size; - set_origin(vc); -+ kfree(oldscreen); - - /* do part of a reset_terminal() */ - vc->vc_top = 0; -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index 9353789e43372..b0f0771a57298 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -896,12 +896,22 @@ int vt_ioctl(struct tty_struct *tty, - console_lock(); - vcp = vc_cons[i].d; - if (vcp) { -+ int ret; -+ int save_scan_lines = vcp->vc_scan_lines; -+ int save_font_height = vcp->vc_font.height; -+ - if (v.v_vlin) - vcp->vc_scan_lines = v.v_vlin; - if (v.v_clin) - vcp->vc_font.height = v.v_clin; - vcp->vc_resize_user = 1; -- vc_resize(vcp, v.v_cols, v.v_rows); -+ ret = vc_resize(vcp, v.v_cols, v.v_rows); -+ if (ret) { -+ vcp->vc_scan_lines = save_scan_lines; -+ vcp->vc_font.height = save_font_height; -+ console_unlock(); -+ return ret; -+ } - } - console_unlock(); - } -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index e6e0f786547bf..eed7c8d8e3d4f 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -299,6 +299,8 @@ static const struct usb_device_id usb_quirk_list[] = { - - { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, - -+ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* DJI CineSSD */ - { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c -index 6865b919403f7..2ed062a2e93b4 100644 ---- a/drivers/usb/host/ohci-exynos.c -+++ b/drivers/usb/host/ohci-exynos.c -@@ -166,9 +166,8 @@ skip_phy: - hcd->rsrc_len = resource_size(res); - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(&pdev->dev, "Failed to get IRQ\n"); -- err = -ENODEV; -+ if (irq < 0) { -+ err = irq; - goto fail_io; - } - -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 3ef80c2c0dcc1..6891738278bcb 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -599,15 +599,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, - { - u32 pls = status_reg & PORT_PLS_MASK; - -- /* resume state is a xHCI internal state. -- * Do not report it to usb core, instead, pretend to be U3, -- * thus usb core knows it's not ready for transfer -- */ -- if (pls == XDEV_RESUME) { -- *status |= USB_SS_PORT_LS_U3; -- return; -- } -- - /* When the CAS bit is set then warm reset - * should be performed on port - */ -@@ -629,6 +620,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, - */ - pls |= USB_PORT_STAT_CONNECTION; - } else { -+ /* -+ * Resume state is an xHCI internal state. Do not report it to -+ * usb core, instead, pretend to be U3, thus usb core knows -+ * it's not ready for transfer. -+ */ -+ if (pls == XDEV_RESUME) { -+ *status |= USB_SS_PORT_LS_U3; -+ return; -+ } -+ - /* - * If CAS bit isn't set but the Port is already at - * Compliance Mode, fake a connection so the USB core -diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c -index 383fa007348f4..bda82e63c1a93 100644 ---- a/drivers/usb/misc/lvstest.c -+++ b/drivers/usb/misc/lvstest.c -@@ -396,7 +396,7 @@ static int lvs_rh_probe(struct usb_interface *intf, - USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT); - if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) { - dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret); -- return ret; -+ return ret < 0 ? ret : -EINVAL; - } - - /* submit urb to poll interrupt endpoint */ -diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c -index 22da70fada5e5..971f1165dc4bb 100644 ---- a/drivers/usb/misc/sisusbvga/sisusb.c -+++ b/drivers/usb/misc/sisusbvga/sisusb.c -@@ -790,7 +790,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, - u8 swap8, fromkern = kernbuffer ? 1 : 0; - u16 swap16; - u32 swap32, flag = (length >> 28) & 1; -- char buf[4]; -+ u8 buf[4]; - - /* if neither kernbuffer not userbuffer are given, assume - * data in obuf -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index 44c6ced5d4422..b17aeaafbb7c3 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -510,7 +510,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, - prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE); - dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__, - dev->cntl_buffer[0]); -- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL); -+ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC); - if (retval >= 0) - timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); - finish_wait(&dev->waitq, &wait); -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index ccf2d50e0d2e3..2c2ac15d25549 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2213,7 +2213,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, - "JMicron", - "USB to ATA/ATAPI Bridge", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, -- US_FL_BROKEN_FUA ), -+ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ), - - /* Reported by Andrey Rahmatullin */ - UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index cb0af57aad6eb..b7171c19fca20 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -40,6 +40,13 @@ - * and don't forget to CC: the USB development list - */ - -+/* Reported-by: Till Dörges */ -+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999, -+ "Sony", -+ "PSZ-HA*", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_REPORT_OPCODES), -+ - /* Reported-by: Julian Groß */ - UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999, - "LaCie", -@@ -155,6 +162,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_BROKEN_FUA), - -+/* Reported-by: Thinh Nguyen */ -+UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, -+ "PNY", -+ "Pro Elite SSD", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* Reported-by: Hans de Goede */ - UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, - "VIA", -diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c -index c03c5b9602bb3..fe0663787b3c9 100644 ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -2117,6 +2117,9 @@ static void updatescrollmode(struct display *p, - } - } - -+#define PITCH(w) (((w) + 7) >> 3) -+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ -+ - static int fbcon_resize(struct vc_data *vc, unsigned int width, - unsigned int height, unsigned int user) - { -@@ -2126,6 +2129,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, - struct fb_var_screeninfo var = info->var; - int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; - -+ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { -+ int size; -+ int pitch = PITCH(vc->vc_font.width); -+ -+ /* -+ * If user font, ensure that a possible change to user font -+ * height or width will not allow a font data out-of-bounds access. -+ * NOTE: must use original charcount in calculation as font -+ * charcount can change and cannot be used to determine the -+ * font data allocated size. -+ */ -+ if (pitch <= 0) -+ return -EINVAL; -+ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data)); -+ if (size > FNTSIZE(vc->vc_font.data)) -+ return -EINVAL; -+ } -+ - virt_w = FBCON_SWAP(ops->rotate, width, height); - virt_h = FBCON_SWAP(ops->rotate, height, width); - virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width, -@@ -2587,7 +2608,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne - int size; - int i, csum; - u8 *new_data, *data = font->data; -- int pitch = (font->width+7) >> 3; -+ int pitch = PITCH(font->width); - - /* Is there a reason why fbconsole couldn't handle any charcount >256? - * If not this check should be changed to charcount < 256 */ -@@ -2603,7 +2624,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne - if (fbcon_invalid_charcount(info, charcount)) - return -EINVAL; - -- size = h * pitch * charcount; -+ size = CALC_FONTSZ(h, pitch, charcount); - - new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); - -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 878a40950a3a1..e4dd991e2888b 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn) - /* Get info for IRQ */ - struct irq_info *info_for_irq(unsigned irq) - { -- return irq_get_handler_data(irq); -+ return irq_get_chip_data(irq); - } - - /* Constructors for packed IRQ information. */ -@@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq) - info->type = IRQT_UNBOUND; - info->refcnt = -1; - -- irq_set_handler_data(irq, info); -+ irq_set_chip_data(irq, info); - - list_add_tail(&info->list, &xen_irq_list_head); - } -@@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) - - static void xen_free_irq(unsigned irq) - { -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (WARN_ON(!info)) - return; - - list_del(&info->list); - -- irq_set_handler_data(irq, NULL); -+ irq_set_chip_data(irq, NULL); - - WARN_ON(info->refcnt > 0); - -@@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); - static void __unbind_from_irq(unsigned int irq) - { - int evtchn = evtchn_from_irq(irq); -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (info->refcnt > 0) { - info->refcnt--; -@@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, - - void unbind_from_irqhandler(unsigned int irq, void *dev_id) - { -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (WARN_ON(!info)) - return; -@@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int evtchn) - if (irq == -1) - return -ENOENT; - -- info = irq_get_handler_data(irq); -+ info = irq_get_chip_data(irq); - - if (!info) - return -ENOENT; -@@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn) - if (irq == -1) - goto done; - -- info = irq_get_handler_data(irq); -+ info = irq_get_chip_data(irq); - - if (!info) - goto done; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 820d3b5bc4150..8f0f91de436d5 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3169,11 +3169,13 @@ fail: - btrfs_free_path(path); - out_unlock: - mutex_unlock(&BTRFS_I(dir)->log_mutex); -- if (ret == -ENOSPC) { -+ if (err == -ENOSPC) { - btrfs_set_log_full_commit(root->fs_info, trans); -- ret = 0; -- } else if (ret < 0) -- btrfs_abort_transaction(trans, root, ret); -+ err = 0; -+ } else if (err < 0 && err != -ENOENT) { -+ /* ENOENT can be returned if the entry hasn't been fsynced yet */ -+ btrfs_abort_transaction(trans, root, err); -+ } - - btrfs_end_log_trans(root); - -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index a5de8e22629ba..b7fd7d69be075 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -3428,6 +3428,9 @@ static void delayed_work(struct work_struct *work) - dout("mdsc delayed_work\n"); - ceph_check_delayed_caps(mdsc); - -+ if (mdsc->stopping) -+ return; -+ - mutex_lock(&mdsc->mutex); - renew_interval = mdsc->mdsmap->m_session_timeout >> 2; - renew_caps = time_after_eq(jiffies, HZ*renew_interval + -@@ -3752,7 +3755,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc) - static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) - { - dout("stop\n"); -- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */ -+ /* -+ * Make sure the delayed work stopped before releasing -+ * the resources. -+ * -+ * Because the cancel_delayed_work_sync() will only -+ * guarantee that the work finishes executing. But the -+ * delayed work will re-arm itself again after that. -+ */ -+ flush_delayed_work(&mdsc->delayed_work); -+ - if (mdsc->mdsmap) - ceph_mdsmap_destroy(mdsc->mdsmap); - kfree(mdsc->sessions); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index a2a2405571ccc..66a9c9dab8316 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -45,7 +45,6 @@ struct wb_completion { - struct wb_writeback_work { - long nr_pages; - struct super_block *sb; -- unsigned long *older_than_this; - enum writeback_sync_modes sync_mode; - unsigned int tagged_writepages:1; - unsigned int for_kupdate:1; -@@ -160,7 +159,9 @@ static void inode_io_list_del_locked(struct inode *inode, - struct bdi_writeback *wb) - { - assert_spin_locked(&wb->list_lock); -+ assert_spin_locked(&inode->i_lock); - -+ inode->i_state &= ~I_SYNC_QUEUED; - list_del_init(&inode->i_io_list); - wb_io_lists_depopulated(wb); - } -@@ -1034,7 +1035,9 @@ void inode_io_list_del(struct inode *inode) - struct bdi_writeback *wb; - - wb = inode_to_wb_and_lock_list(inode); -+ spin_lock(&inode->i_lock); - inode_io_list_del_locked(inode, wb); -+ spin_unlock(&inode->i_lock); - spin_unlock(&wb->list_lock); - } - -@@ -1047,8 +1050,10 @@ void inode_io_list_del(struct inode *inode) - * the case then the inode must have been redirtied while it was being written - * out and we don't reset its dirtied_when. - */ --static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) -+static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb) - { -+ assert_spin_locked(&inode->i_lock); -+ - if (!list_empty(&wb->b_dirty)) { - struct inode *tail; - -@@ -1057,6 +1062,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) - inode->dirtied_when = jiffies; - } - inode_io_list_move_locked(inode, wb, &wb->b_dirty); -+ inode->i_state &= ~I_SYNC_QUEUED; -+} -+ -+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) -+{ -+ spin_lock(&inode->i_lock); -+ redirty_tail_locked(inode, wb); -+ spin_unlock(&inode->i_lock); - } - - /* -@@ -1095,16 +1108,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t) - #define EXPIRE_DIRTY_ATIME 0x0001 - - /* -- * Move expired (dirtied before work->older_than_this) dirty inodes from -+ * Move expired (dirtied before dirtied_before) dirty inodes from - * @delaying_queue to @dispatch_queue. - */ - static int move_expired_inodes(struct list_head *delaying_queue, - struct list_head *dispatch_queue, -- int flags, -- struct wb_writeback_work *work) -+ int flags, unsigned long dirtied_before) - { -- unsigned long *older_than_this = NULL; -- unsigned long expire_time; - LIST_HEAD(tmp); - struct list_head *pos, *node; - struct super_block *sb = NULL; -@@ -1112,21 +1122,17 @@ static int move_expired_inodes(struct list_head *delaying_queue, - int do_sb_sort = 0; - int moved = 0; - -- if ((flags & EXPIRE_DIRTY_ATIME) == 0) -- older_than_this = work->older_than_this; -- else if (!work->for_sync) { -- expire_time = jiffies - (dirtytime_expire_interval * HZ); -- older_than_this = &expire_time; -- } - while (!list_empty(delaying_queue)) { - inode = wb_inode(delaying_queue->prev); -- if (older_than_this && -- inode_dirtied_after(inode, *older_than_this)) -+ if (inode_dirtied_after(inode, dirtied_before)) - break; - list_move(&inode->i_io_list, &tmp); - moved++; -+ spin_lock(&inode->i_lock); - if (flags & EXPIRE_DIRTY_ATIME) -- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state); -+ inode->i_state |= I_DIRTY_TIME_EXPIRED; -+ inode->i_state |= I_SYNC_QUEUED; -+ spin_unlock(&inode->i_lock); - if (sb_is_blkdev_sb(inode->i_sb)) - continue; - if (sb && sb != inode->i_sb) -@@ -1164,18 +1170,22 @@ out: - * | - * +--> dequeue for IO - */ --static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work) -+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work, -+ unsigned long dirtied_before) - { - int moved; -+ unsigned long time_expire_jif = dirtied_before; - - assert_spin_locked(&wb->list_lock); - list_splice_init(&wb->b_more_io, &wb->b_io); -- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work); -+ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before); -+ if (!work->for_sync) -+ time_expire_jif = jiffies - dirtytime_expire_interval * HZ; - moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io, -- EXPIRE_DIRTY_ATIME, work); -+ EXPIRE_DIRTY_ATIME, time_expire_jif); - if (moved) - wb_io_lists_populated(wb); -- trace_writeback_queue_io(wb, work, moved); -+ trace_writeback_queue_io(wb, work, dirtied_before, moved); - } - - static int write_inode(struct inode *inode, struct writeback_control *wbc) -@@ -1269,7 +1279,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * writeback is not making progress due to locked - * buffers. Skip this inode for now. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - return; - } - -@@ -1289,7 +1299,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * retrying writeback of the dirty page/inode - * that cannot be performed immediately. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - } - } else if (inode->i_state & I_DIRTY) { - /* -@@ -1297,10 +1307,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * such as delayed allocation during submission or metadata - * updates after data IO completion. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - } else if (inode->i_state & I_DIRTY_TIME) { - inode->dirtied_when = jiffies; - inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); -+ inode->i_state &= ~I_SYNC_QUEUED; - } else { - /* The inode is clean. Remove from writeback lists. */ - inode_io_list_del_locked(inode, wb); -@@ -1543,8 +1554,8 @@ static long writeback_sb_inodes(struct super_block *sb, - */ - spin_lock(&inode->i_lock); - if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) { -+ redirty_tail_locked(inode, wb); - spin_unlock(&inode->i_lock); -- redirty_tail(inode, wb); - continue; - } - if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) { -@@ -1685,7 +1696,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, - blk_start_plug(&plug); - spin_lock(&wb->list_lock); - if (list_empty(&wb->b_io)) -- queue_io(wb, &work); -+ queue_io(wb, &work, jiffies); - __writeback_inodes_wb(wb, &work); - spin_unlock(&wb->list_lock); - blk_finish_plug(&plug); -@@ -1705,7 +1716,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, - * takes longer than a dirty_writeback_interval interval, then leave a - * one-second gap. - * -- * older_than_this takes precedence over nr_to_write. So we'll only write back -+ * dirtied_before takes precedence over nr_to_write. So we'll only write back - * all dirty pages if they are all attached to "old" mappings. - */ - static long wb_writeback(struct bdi_writeback *wb, -@@ -1713,14 +1724,11 @@ static long wb_writeback(struct bdi_writeback *wb, - { - unsigned long wb_start = jiffies; - long nr_pages = work->nr_pages; -- unsigned long oldest_jif; -+ unsigned long dirtied_before = jiffies; - struct inode *inode; - long progress; - struct blk_plug plug; - -- oldest_jif = jiffies; -- work->older_than_this = &oldest_jif; -- - blk_start_plug(&plug); - spin_lock(&wb->list_lock); - for (;;) { -@@ -1754,14 +1762,14 @@ static long wb_writeback(struct bdi_writeback *wb, - * safe. - */ - if (work->for_kupdate) { -- oldest_jif = jiffies - -+ dirtied_before = jiffies - - msecs_to_jiffies(dirty_expire_interval * 10); - } else if (work->for_background) -- oldest_jif = jiffies; -+ dirtied_before = jiffies; - - trace_writeback_start(wb, work); - if (list_empty(&wb->b_io)) -- queue_io(wb, work); -+ queue_io(wb, work, dirtied_before); - if (work->sb) - progress = writeback_sb_inodes(work->sb, wb, work); - else -@@ -2128,11 +2136,12 @@ void __mark_inode_dirty(struct inode *inode, int flags) - inode->i_state |= flags; - - /* -- * If the inode is being synced, just update its dirty state. -- * The unlocker will place the inode on the appropriate -- * superblock list, based upon its state. -+ * If the inode is queued for writeback by flush worker, just -+ * update its dirty state. Once the flush worker is done with -+ * the inode it will place it on the appropriate superblock -+ * list, based upon its state. - */ -- if (inode->i_state & I_SYNC) -+ if (inode->i_state & I_SYNC_QUEUED) - goto out_unlock_inode; - - /* -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index 3233e5ac9774f..ce2bf9d74224c 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1906,6 +1906,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) - */ - static void __jbd2_journal_unfile_buffer(struct journal_head *jh) - { -+ J_ASSERT_JH(jh, jh->b_transaction != NULL); -+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); -+ - __jbd2_journal_temp_unlink_buffer(jh); - jh->b_transaction = NULL; - jbd2_journal_put_journal_head(jh); -@@ -1997,6 +2000,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, - { - struct buffer_head *head; - struct buffer_head *bh; -+ bool has_write_io_error = false; - int ret = 0; - - J_ASSERT(PageLocked(page)); -@@ -2021,11 +2025,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, - jbd_unlock_bh_state(bh); - if (buffer_jbd(bh)) - goto busy; -+ -+ /* -+ * If we free a metadata buffer which has been failed to -+ * write out, the jbd2 checkpoint procedure will not detect -+ * this failure and may lead to filesystem inconsistency -+ * after cleanup journal tail. -+ */ -+ if (buffer_write_io_error(bh)) { -+ pr_err("JBD2: Error while async write back metadata bh %llu.", -+ (unsigned long long)bh->b_blocknr); -+ has_write_io_error = true; -+ } - } while ((bh = bh->b_this_page) != head); - - ret = try_to_free_buffers(page); - - busy: -+ if (has_write_io_error) -+ jbd2_journal_abort(journal, -EIO); -+ - return ret; - } - -@@ -2453,6 +2472,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) - - was_dirty = test_clear_buffer_jbddirty(bh); - __jbd2_journal_temp_unlink_buffer(jh); -+ -+ /* -+ * b_transaction must be set, otherwise the new b_transaction won't -+ * be holding jh reference -+ */ -+ J_ASSERT_JH(jh, jh->b_transaction != NULL); -+ - /* - * We set b_transaction here because b_next_transaction will inherit - * our jh reference and thus __jbd2_journal_file_buffer() must not -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 842a6a28b0e89..cdcef9b3bc60a 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -1882,6 +1882,10 @@ struct super_operations { - * wb stat updates to grab mapping->tree_lock. See - * inode_switch_wb_work_fn() for details. - * -+ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists. -+ * Used to detect that mark_inode_dirty() should not move -+ * inode between dirty lists. -+ * - * Q: What is the difference between I_WILL_FREE and I_FREEING? - */ - #define I_DIRTY_SYNC (1 << 0) -@@ -1899,9 +1903,9 @@ struct super_operations { - #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP) - #define I_LINKABLE (1 << 10) - #define I_DIRTY_TIME (1 << 11) --#define __I_DIRTY_TIME_EXPIRED 12 --#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED) -+#define I_DIRTY_TIME_EXPIRED (1 << 12) - #define I_WB_SWITCH (1 << 13) -+#define I_SYNC_QUEUED (1 << 17) - - #define I_DIRTY (I_DIRTY_SYNC | I_DIRTY_DATASYNC | I_DIRTY_PAGES) - #define I_DIRTY_ALL (I_DIRTY | I_DIRTY_TIME) -diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h -index fff846b512e6e..2609b1c3549e2 100644 ---- a/include/trace/events/writeback.h -+++ b/include/trace/events/writeback.h -@@ -390,8 +390,9 @@ DEFINE_WBC_EVENT(wbc_writepage); - TRACE_EVENT(writeback_queue_io, - TP_PROTO(struct bdi_writeback *wb, - struct wb_writeback_work *work, -+ unsigned long dirtied_before, - int moved), -- TP_ARGS(wb, work, moved), -+ TP_ARGS(wb, work, dirtied_before, moved), - TP_STRUCT__entry( - __array(char, name, 32) - __field(unsigned long, older) -@@ -401,19 +402,17 @@ TRACE_EVENT(writeback_queue_io, - __dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb)) - ), - TP_fast_assign( -- unsigned long *older_than_this = work->older_than_this; - strncpy(__entry->name, dev_name(wb->bdi->dev), 32); -- __entry->older = older_than_this ? *older_than_this : 0; -- __entry->age = older_than_this ? -- (jiffies - *older_than_this) * 1000 / HZ : -1; -+ __entry->older = dirtied_before; -+ __entry->age = (jiffies - dirtied_before) * 1000 / HZ; - __entry->moved = moved; - __entry->reason = work->reason; - __trace_wb_assign_cgroup(__get_str(cgroup), wb); - ), - TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup=%s", - __entry->name, -- __entry->older, /* older_than_this in jiffies */ -- __entry->age, /* older_than_this in relative milliseconds */ -+ __entry->older, /* dirtied_before in jiffies */ -+ __entry->age, /* dirtied_before in relative milliseconds */ - __entry->moved, - __print_symbolic(__entry->reason, WB_WORK_REASON), - __get_str(cgroup) -diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c -index 35b34eccdd109..9484f934aa349 100644 ---- a/kernel/locking/lockdep_proc.c -+++ b/kernel/locking/lockdep_proc.c -@@ -423,7 +423,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt) - seq_time(m, lt->min); - seq_time(m, lt->max); - seq_time(m, lt->total); -- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0); -+ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0); - } - - static void seq_stats(struct seq_file *m, struct lock_stat_data *data) -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 4e944fe986271..e87ec3659ef61 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -4370,8 +4370,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) - skb = skb_share_check(skb, GFP_ATOMIC); - if (unlikely(!skb)) - goto err_free; -- -- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) -+ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ -+ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) - goto err_free; - - vhdr = (struct vlan_hdr *)skb->data; -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index 8d2e54c4bda6b..0975a28f8686c 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -250,8 +250,9 @@ err_out: - static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - struct tipc_nl_compat_msg *msg) - { -- int err; -+ struct nlmsghdr *nlh; - struct sk_buff *arg; -+ int err; - - if (msg->req_type && (!msg->req_size || - !TLV_CHECK_TYPE(msg->req, msg->req_type))) -@@ -280,6 +281,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - return -ENOMEM; - } - -+ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI); -+ if (!nlh) { -+ kfree_skb(arg); -+ kfree_skb(msg->rep); -+ msg->rep = NULL; -+ return -EMSGSIZE; -+ } -+ nlmsg_end(arg, nlh); -+ - err = __tipc_nl_compat_dumpit(cmd, msg, arg); - if (err) { - kfree_skb(msg->rep); -diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c -index 2706f271a83b0..8a174c170e0aa 100644 ---- a/sound/pci/cs46xx/cs46xx_lib.c -+++ b/sound/pci/cs46xx/cs46xx_lib.c -@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned - rate = 48000 / 9; - - /* -- * We can not capture at at rate greater than the Input Rate (48000). -+ * We can not capture at a rate greater than the Input Rate (48000). - * Return an error if an attempt is made to stray outside that limit. - */ - if (rate > 48000) -diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c -index 7488e1b7a7707..4e726d39b05d1 100644 ---- a/sound/pci/cs46xx/dsp_spos_scb_lib.c -+++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c -@@ -1742,7 +1742,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip) - struct dsp_spos_instance * ins = chip->dsp_spos_instance; - - if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) { -- /* remove AsynchFGTxSCB and and PCMSerialInput_II */ -+ /* remove AsynchFGTxSCB and PCMSerialInput_II */ - cs46xx_dsp_disable_spdif_out (chip); - - /* save state */ -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 825d9b27dbe12..4962a9d8a572b 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -3496,7 +3496,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save); - * @nid: NID to check / update - * - * Check whether the given NID is in the amp list. If it's in the list, -- * check the current AMP status, and update the the power-status according -+ * check the current AMP status, and update the power-status according - * to the mute status. - * - * This function is supposed to be set or called from the check_power_status -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 869c322ddae31..7cd1047a4edf3 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -837,7 +837,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, - } - } - --/* sync power of each widget in the the given path */ -+/* sync power of each widget in the given path */ - static hda_nid_t path_power_update(struct hda_codec *codec, - struct nid_path *path, - bool allow_powerdown) -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index d1a6d20ace0da..80b72d0702c5e 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -862,7 +862,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec, - static struct snd_kcontrol_new beep_vol_ctl = - HDA_CODEC_VOLUME(NULL, 0, 0, 0); - -- /* check for mute support for the the amp */ -+ /* check for mute support for the amp */ - if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) { - const struct snd_kcontrol_new *temp; - if (spec->anabeep_nid == nid) -diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c -index 3919aed39ca03..5e52086d7b986 100644 ---- a/sound/pci/ice1712/prodigy192.c -+++ b/sound/pci/ice1712/prodigy192.c -@@ -31,7 +31,7 @@ - * Experimentally I found out that only a combination of - * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 - - * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct -- * sampling rate. That means the the FPGA doubles the -+ * sampling rate. That means that the FPGA doubles the - * MCK01 rate. - * - * Copyright (c) 2003 Takashi Iwai -diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c -index 4cf3200e988b0..df44135e1b0c9 100644 ---- a/sound/pci/oxygen/xonar_dg.c -+++ b/sound/pci/oxygen/xonar_dg.c -@@ -39,7 +39,7 @@ - * GPIO 4 <- headphone detect - * GPIO 5 -> enable ADC analog circuit for the left channel - * GPIO 6 -> enable ADC analog circuit for the right channel -- * GPIO 7 -> switch green rear output jack between CS4245 and and the first -+ * GPIO 7 -> switch green rear output jack between CS4245 and the first - * channel of CS4361 (mechanical relay) - * GPIO 8 -> enable output to speakers - * -diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c -index fef3b9a21a667..e441e23a37e4f 100644 ---- a/sound/soc/tegra/tegra30_ahub.c -+++ b/sound/soc/tegra/tegra30_ahub.c -@@ -656,8 +656,10 @@ static int tegra30_ahub_resume(struct device *dev) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(dev); - return ret; -+ } - ret = regcache_sync(ahub->regmap_ahub); - ret |= regcache_sync(ahub->regmap_apbif); - pm_runtime_put(dev); -diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c -index 8e55583aa104e..516f37896092c 100644 ---- a/sound/soc/tegra/tegra30_i2s.c -+++ b/sound/soc/tegra/tegra30_i2s.c -@@ -552,8 +552,10 @@ static int tegra30_i2s_resume(struct device *dev) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(dev); - return ret; -+ } - ret = regcache_sync(i2s->regmap); - pm_runtime_put(dev); - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 689fd3103e5b6..a917b7e02d312 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3331,8 +3331,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - * they pretend to be 96kHz mono as a workaround for stereo being broken - * by that... - * -- * They also have swapped L-R channels, but that's for userspace to deal -- * with. -+ * They also have an issue with initial stream alignment that causes the -+ * channels to be swapped and out of phase, which is dealt with in quirks.c. - */ - { - .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -index 94110b1dcd3d8..031baa43646fb 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -@@ -91,8 +91,6 @@ int back_to_back_ebbs(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -index 7c57a8d79535d..361e0be9df9ae 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -@@ -42,8 +42,6 @@ int cycles(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -index ecf5ee3283a3e..fe7d0dc2a1a26 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -@@ -99,8 +99,6 @@ int cycles_with_freeze(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - printf("EBBs while frozen %d\n", ebbs_while_frozen); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -index c0faba520b35c..b9b30f974b5ea 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -index 9729d9f902187..4154498bc5dc5 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -@@ -398,8 +398,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -index a991d2ea8d0a1..174e4f4dae6c0 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - FAIL_IF(ebb_state.stats.ebb_count == 0); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -index eb8acb78bc6c1..531083accfcad 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -@@ -75,7 +75,6 @@ static int test_body(void) - ebb_freeze_pmcs(); - ebb_global_disable(); - -- count_pmc(4, sample_period); - mtspr(SPRN_PMC4, 0xdead); - - dump_summary_ebb_state(); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -index 6ff8c8ff27d66..035c02273cd49 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -@@ -70,13 +70,6 @@ int multi_counter(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- count_pmc(2, sample_period); -- count_pmc(3, sample_period); -- count_pmc(4, sample_period); -- count_pmc(5, sample_period); -- count_pmc(6, sample_period); -- - dump_ebb_state(); - - for (i = 0; i < 6; i++) -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -index 037cb6154f360..3e9d4ac965c85 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -@@ -61,8 +61,6 @@ static int cycles_child(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_summary_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -index c5fa64790c22e..d90891fe96a32 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -@@ -82,8 +82,6 @@ static int test_body(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - if (mmcr0_mismatch) -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -index 30e1ac62e8cb4..8ca92b9ee5b01 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -@@ -76,8 +76,6 @@ int pmc56_overflow(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(2, sample_period); -- - dump_ebb_state(); - - printf("PMC5/6 overflow %d\n", pmc56_overflowed); diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.235-236-changed.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.235-236-changed.patch deleted file mode 100644 index edf469e594..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.235-236-changed.patch +++ /dev/null @@ -1,2361 +0,0 @@ -diff --git a/Documentation/filesystems/affs.txt b/Documentation/filesystems/affs.txt -index 71b63c2b98410..a8f1a58e36922 100644 ---- a/Documentation/filesystems/affs.txt -+++ b/Documentation/filesystems/affs.txt -@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows: - - - R maps to r for user, group and others. On directories, R implies x. - -- - If both W and D are allowed, w will be set. -+ - W maps to w. - - - E maps to x. - -- - H and P are always retained and ignored under Linux. -+ - D is ignored. - -- - A is always reset when a file is written to. -+ - H, S and P are always retained and ignored under Linux. -+ -+ - A is cleared when a file is written to. - - User id and group id will be used unless set[gu]id are given as mount - options. Since most of the Amiga file systems are single user systems -@@ -111,11 +113,13 @@ Linux -> Amiga: - - The Linux rwxrwxrwx file mode is handled as follows: - -- - r permission will set R for user, group and others. -+ - r permission will allow R for user, group and others. -+ -+ - w permission will allow W for user, group and others. - -- - w permission will set W and D for user, group and others. -+ - x permission of the user will allow E for plain files. - -- - x permission of the user will set E for plain files. -+ - D will be allowed for user, group and others. - - - All other flags (suid, sgid, ...) are ignored and will - not be retained. -diff --git a/Makefile b/Makefile -index a32490d4471f3..b954cb21fddc7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 235 -+SUBLEVEL = 236 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h -index 6d6556ca24aa2..f715419a72cf0 100644 ---- a/arch/s390/include/asm/percpu.h -+++ b/arch/s390/include/asm/percpu.h -@@ -28,7 +28,7 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ old__, new__, prev__; \ - pcp_op_T__ *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - prev__ = *ptr__; \ - do { \ -@@ -36,7 +36,7 @@ - new__ = old__ op (val); \ - prev__ = cmpxchg(ptr__, old__, new__); \ - } while (prev__ != old__); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - new__; \ - }) - -@@ -67,7 +67,7 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - if (__builtin_constant_p(val__) && \ - ((szcast)val__ > -129) && ((szcast)val__ < 128)) { \ -@@ -83,7 +83,7 @@ - : [val__] "d" (val__) \ - : "cc"); \ - } \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - } - - #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int) -@@ -94,14 +94,14 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - asm volatile( \ - op " %[old__],%[val__],%[ptr__]\n" \ - : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ - : [val__] "d" (val__) \ - : "cc"); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - old__ + val__; \ - }) - -@@ -113,14 +113,14 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - asm volatile( \ - op " %[old__],%[val__],%[ptr__]\n" \ - : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ - : [val__] "d" (val__) \ - : "cc"); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - } - - #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, "lan") -@@ -135,10 +135,10 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ ret__; \ - pcp_op_T__ *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - ret__ = cmpxchg(ptr__, oval, nval); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -@@ -151,10 +151,10 @@ - ({ \ - typeof(pcp) *ptr__; \ - typeof(pcp) ret__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - ret__ = xchg(ptr__, nval); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -@@ -170,11 +170,11 @@ - typeof(pcp1) *p1__; \ - typeof(pcp2) *p2__; \ - int ret__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - p1__ = raw_cpu_ptr(&(pcp1)); \ - p2__ = raw_cpu_ptr(&(pcp2)); \ - ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c -index 941ace0521306..5276074d0e364 100644 ---- a/drivers/dma/at_hdmac.c -+++ b/drivers/dma/at_hdmac.c -@@ -1817,6 +1817,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, - return NULL; - - dmac_pdev = of_find_device_by_node(dma_spec->np); -+ if (!dmac_pdev) -+ return NULL; - - dma_cap_zero(mask); - dma_cap_set(DMA_SLAVE, mask); -diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c -index 1e1f2986eba8f..86c591481dfe9 100644 ---- a/drivers/dma/of-dma.c -+++ b/drivers/dma/of-dma.c -@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, - return NULL; - - chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); -- if (chan) { -- chan->router = ofdma->dma_router; -- chan->route_data = route_data; -- } else { -+ if (IS_ERR_OR_NULL(chan)) { - ofdma->dma_router->route_free(ofdma->dma_router->dev, - route_data); -+ } else { -+ chan->router = ofdma->dma_router; -+ chan->route_data = route_data; - } - - /* -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 799c182c3eacc..9aa57b37381a9 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2629,6 +2629,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, - while (burst != (1 << desc->rqcfg.brst_size)) - desc->rqcfg.brst_size++; - -+ desc->rqcfg.brst_len = get_burst_len(desc, len); - /* - * If burst size is smaller than bus width then make sure we only - * transfer one at a time to avoid a burst stradling an MFIFO entry. -@@ -2636,7 +2637,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, - if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) - desc->rqcfg.brst_len = 1; - -- desc->rqcfg.brst_len = get_burst_len(desc, len); - desc->bytes_requested = len; - - desc->txd.flags = flags; -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 325adbef134cc..9425c789b0974 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1367,6 +1367,17 @@ static void hid_output_field(const struct hid_device *hid, - } - } - -+/* -+ * Compute the size of a report. -+ */ -+static size_t hid_compute_report_size(struct hid_report *report) -+{ -+ if (report->size) -+ return ((report->size - 1) >> 3) + 1; -+ -+ return 0; -+} -+ - /* - * Create a report. 'data' has to be allocated using - * hid_alloc_report_buf() so that it has proper size. -@@ -1379,7 +1390,7 @@ void hid_output_report(struct hid_report *report, __u8 *data) - if (report->id > 0) - *data++ = report->id; - -- memset(data, 0, ((report->size - 1) >> 3) + 1); -+ memset(data, 0, hid_compute_report_size(report)); - for (n = 0; n < report->maxfield; n++) - hid_output_field(report->device, report->field[n], data); - } -@@ -1506,7 +1517,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, - csize--; - } - -- rsize = ((report->size - 1) >> 3) + 1; -+ rsize = hid_compute_report_size(report); - - if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE) - rsize = HID_MAX_BUFFER_SIZE - 1; -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 3331bf8ad85e6..c033d12070c3d 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -994,6 +994,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - } - - mapped: -+ /* Mapping failed, bail out */ -+ if (!bit) -+ return; -+ - if (device->driver->input_mapped && - device->driver->input_mapped(device, hidinput, field, usage, - &bit, &max) < 0) { -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 56c4a81d3ea24..5187f3975c655 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -569,6 +569,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, - case HID_UP_BUTTON: - code = BTN_MOUSE + ((usage->hid - 1) & HID_USAGE); - hid_map_usage(hi, usage, bit, max, EV_KEY, code); -+ if (!*bit) -+ return -1; - input_set_capability(hi->input, EV_KEY, code); - return 1; - -diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c -index 0af7fd311979d..587fc5c686b3c 100644 ---- a/drivers/hwmon/applesmc.c -+++ b/drivers/hwmon/applesmc.c -@@ -758,15 +758,18 @@ static ssize_t applesmc_light_show(struct device *dev, - } - - ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length); -+ if (ret) -+ goto out; - /* newer macbooks report a single 10-bit bigendian value */ - if (data_length == 10) { - left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2; - goto out; - } - left = buffer[2]; -+ -+ ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); - if (ret) - goto out; -- ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); - right = buffer[2]; - - out: -@@ -814,12 +817,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev, - sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr)); - - ret = applesmc_read_key(newkey, buffer, 2); -- speed = ((buffer[0] << 8 | buffer[1]) >> 2); -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); -+ -+ speed = ((buffer[0] << 8 | buffer[1]) >> 2); -+ return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); - } - - static ssize_t applesmc_store_fan_speed(struct device *dev, -@@ -854,12 +856,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev, - u8 buffer[2]; - - ret = applesmc_read_key(FANS_MANUAL, buffer, 2); -- manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); -+ -+ manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; -+ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); - } - - static ssize_t applesmc_store_fan_manual(struct device *dev, -@@ -875,10 +876,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev, - return -EINVAL; - - ret = applesmc_read_key(FANS_MANUAL, buffer, 2); -- val = (buffer[0] << 8 | buffer[1]); - if (ret) - goto out; - -+ val = (buffer[0] << 8 | buffer[1]); -+ - if (input) - val = val | (0x01 << to_index(attr)); - else -@@ -954,13 +956,12 @@ static ssize_t applesmc_key_count_show(struct device *dev, - u32 count; - - ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4); -- count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + -- ((u32)buffer[2]<<8) + buffer[3]; -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); -+ -+ count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + -+ ((u32)buffer[2]<<8) + buffer[3]; -+ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); - } - - static ssize_t applesmc_key_at_index_read_show(struct device *dev, -diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c -index ac596928f6b40..ce125ec23d2a5 100644 ---- a/drivers/iommu/intel_irq_remapping.c -+++ b/drivers/iommu/intel_irq_remapping.c -@@ -486,12 +486,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu) - - /* Enable interrupt-remapping */ - iommu->gcmd |= DMA_GCMD_IRE; -- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */ - writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); -- - IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, - readl, (sts & DMA_GSTS_IRES), sts); - -+ /* Block compatibility-format MSIs */ -+ if (sts & DMA_GSTS_CFIS) { -+ iommu->gcmd &= ~DMA_GCMD_CFI; -+ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); -+ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, -+ readl, !(sts & DMA_GSTS_CFIS), sts); -+ } -+ - /* - * With CFI clear in the Global Command register, we should be - * protected from dangerous (i.e. compatibility) interrupts -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index 905badc6cb179..216675b96e029 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -501,12 +501,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd, - CACHE_MAX_CONCURRENT_LOCKS); - if (IS_ERR(cmd->bm)) { - DMERR("could not create block manager"); -- return PTR_ERR(cmd->bm); -+ r = PTR_ERR(cmd->bm); -+ cmd->bm = NULL; -+ return r; - } - - r = __open_or_format_metadata(cmd, may_format_device); -- if (r) -+ if (r) { - dm_block_manager_destroy(cmd->bm); -+ cmd->bm = NULL; -+ } - - return r; - } -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 2711aa965445c..266d366fc2f08 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -700,12 +700,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f - THIN_MAX_CONCURRENT_LOCKS); - if (IS_ERR(pmd->bm)) { - DMERR("could not create block manager"); -- return PTR_ERR(pmd->bm); -+ r = PTR_ERR(pmd->bm); -+ pmd->bm = NULL; -+ return r; - } - - r = __open_or_format_metadata(pmd, format_device); -- if (r) -+ if (r) { - dm_block_manager_destroy(pmd->bm); -+ pmd->bm = NULL; -+ } - - return r; - } -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index a3949c1a0c234..2da1c22946450 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -4612,18 +4612,18 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - } - } - -- bnxt_enable_napi(bp); -- - rc = bnxt_init_nic(bp, irq_re_init); - if (rc) { - netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); -- goto open_err; -+ goto open_err_irq; - } - -+ bnxt_enable_napi(bp); -+ - if (link_re_init) { - rc = bnxt_update_phy_setting(bp); - if (rc) -- goto open_err; -+ netdev_warn(bp->dev, "failed to update phy settings\n"); - } - - if (irq_re_init) { -@@ -4644,9 +4644,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - - return 0; - --open_err: -- bnxt_disable_napi(bp); -- - open_err_irq: - bnxt_del_napi(bp); - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index 45bd628eaf3aa..416fb16686a61 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -991,6 +991,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data) - if (rc != 0) - return rc; - -+ if (!dir_entries || !entry_length) -+ return -EIO; -+ - /* Insert 2 bytes of directory info (count and size of entries) */ - if (len < 2) - return -EINVAL; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index e198427d0f292..2ee2b6e858283 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -7203,8 +7203,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp) - - static inline void tg3_reset_task_cancel(struct tg3 *tp) - { -- cancel_work_sync(&tp->reset_task); -- tg3_flag_clear(tp, RESET_TASK_PENDING); -+ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags)) -+ cancel_work_sync(&tp->reset_task); - tg3_flag_clear(tp, TX_RECOVERY_PENDING); - } - -@@ -11176,18 +11176,27 @@ static void tg3_reset_task(struct work_struct *work) - - tg3_halt(tp, RESET_KIND_SHUTDOWN, 0); - err = tg3_init_hw(tp, true); -- if (err) -+ if (err) { -+ tg3_full_unlock(tp); -+ tp->irq_sync = 0; -+ tg3_napi_enable(tp); -+ /* Clear this flag so that tg3_reset_task_cancel() will not -+ * call cancel_work_sync() and wait forever. -+ */ -+ tg3_flag_clear(tp, RESET_TASK_PENDING); -+ dev_close(tp->dev); - goto out; -+ } - - tg3_netif_start(tp); - --out: - tg3_full_unlock(tp); - - if (!err) - tg3_phy_start(tp); - - tg3_flag_clear(tp, RESET_TASK_PENDING); -+out: - rtnl_unlock(); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c -index 53833c06696fb..00a105c63567f 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mr.c -+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c -@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) - goto err_out; - - for (i = 0; i <= buddy->max_order; ++i) { -- s = BITS_TO_LONGS(1 << (buddy->max_order - i)); -+ s = BITS_TO_LONGS(1UL << (buddy->max_order - i)); - buddy->bits[i] = kcalloc(s, sizeof (long), GFP_KERNEL | __GFP_NOWARN); - if (!buddy->bits[i]) { - buddy->bits[i] = vzalloc(s * sizeof(long)); -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 460b29ac5fd86..d5bf0f2753079 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1214,12 +1214,64 @@ static const struct ethtool_ops ravb_ethtool_ops = { - .get_ts_info = ravb_get_ts_info, - }; - -+/* MDIO bus init function */ -+static int ravb_mdio_init(struct ravb_private *priv) -+{ -+ struct platform_device *pdev = priv->pdev; -+ struct device *dev = &pdev->dev; -+ int error; -+ -+ /* Bitbang init */ -+ priv->mdiobb.ops = &bb_ops; -+ -+ /* MII controller setting */ -+ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -+ if (!priv->mii_bus) -+ return -ENOMEM; -+ -+ /* Hook up MII support for ethtool */ -+ priv->mii_bus->name = "ravb_mii"; -+ priv->mii_bus->parent = dev; -+ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -+ pdev->name, pdev->id); -+ -+ /* Register MDIO bus */ -+ error = of_mdiobus_register(priv->mii_bus, dev->of_node); -+ if (error) -+ goto out_free_bus; -+ -+ return 0; -+ -+out_free_bus: -+ free_mdio_bitbang(priv->mii_bus); -+ return error; -+} -+ -+/* MDIO bus release function */ -+static int ravb_mdio_release(struct ravb_private *priv) -+{ -+ /* Unregister mdio bus */ -+ mdiobus_unregister(priv->mii_bus); -+ -+ /* Free bitbang info */ -+ free_mdio_bitbang(priv->mii_bus); -+ -+ return 0; -+} -+ - /* Network device open function for Ethernet AVB */ - static int ravb_open(struct net_device *ndev) - { - struct ravb_private *priv = netdev_priv(ndev); - int error; - -+ /* MDIO bus init */ -+ error = ravb_mdio_init(priv); -+ if (error) { -+ netdev_err(ndev, "failed to initialize MDIO\n"); -+ return error; -+ } -+ - napi_enable(&priv->napi[RAVB_BE]); - napi_enable(&priv->napi[RAVB_NC]); - -@@ -1268,6 +1320,7 @@ out_free_irq: - out_napi_off: - napi_disable(&priv->napi[RAVB_NC]); - napi_disable(&priv->napi[RAVB_BE]); -+ ravb_mdio_release(priv); - return error; - } - -@@ -1561,6 +1614,8 @@ static int ravb_close(struct net_device *ndev) - ravb_ring_free(ndev, RAVB_BE); - ravb_ring_free(ndev, RAVB_NC); - -+ ravb_mdio_release(priv); -+ - return 0; - } - -@@ -1664,51 +1719,6 @@ static const struct net_device_ops ravb_netdev_ops = { - .ndo_change_mtu = eth_change_mtu, - }; - --/* MDIO bus init function */ --static int ravb_mdio_init(struct ravb_private *priv) --{ -- struct platform_device *pdev = priv->pdev; -- struct device *dev = &pdev->dev; -- int error; -- -- /* Bitbang init */ -- priv->mdiobb.ops = &bb_ops; -- -- /* MII controller setting */ -- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -- if (!priv->mii_bus) -- return -ENOMEM; -- -- /* Hook up MII support for ethtool */ -- priv->mii_bus->name = "ravb_mii"; -- priv->mii_bus->parent = dev; -- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -- pdev->name, pdev->id); -- -- /* Register MDIO bus */ -- error = of_mdiobus_register(priv->mii_bus, dev->of_node); -- if (error) -- goto out_free_bus; -- -- return 0; -- --out_free_bus: -- free_mdio_bitbang(priv->mii_bus); -- return error; --} -- --/* MDIO bus release function */ --static int ravb_mdio_release(struct ravb_private *priv) --{ -- /* Unregister mdio bus */ -- mdiobus_unregister(priv->mii_bus); -- -- /* Free bitbang info */ -- free_mdio_bitbang(priv->mii_bus); -- -- return 0; --} -- - static const struct of_device_id ravb_match_table[] = { - { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, - { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, -@@ -1847,13 +1857,6 @@ static int ravb_probe(struct platform_device *pdev) - eth_hw_addr_random(ndev); - } - -- /* MDIO bus init */ -- error = ravb_mdio_init(priv); -- if (error) { -- dev_err(&pdev->dev, "failed to initialize MDIO\n"); -- goto out_dma_free; -- } -- - netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); - netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); - -@@ -1873,8 +1876,6 @@ static int ravb_probe(struct platform_device *pdev) - out_napi_del: - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -- ravb_mdio_release(priv); --out_dma_free: - dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, - priv->desc_bat_dma); - out_release: -@@ -1899,7 +1900,6 @@ static int ravb_remove(struct platform_device *pdev) - unregister_netdev(ndev); - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -- ravb_mdio_release(priv); - pm_runtime_disable(&pdev->dev); - free_netdev(ndev); - platform_set_drvdata(pdev, NULL); -diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c -index 2092ef6431f20..712765976a221 100644 ---- a/drivers/net/usb/asix_common.c -+++ b/drivers/net/usb/asix_common.c -@@ -251,7 +251,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal) - - netdev_dbg(dev->net, "asix_get_phy_addr()\n"); - -- if (ret < 0) { -+ if (ret < 2) { - netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret); - goto out; - } -diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c -index 0b4bdd39106b0..fb18801d0fe7b 100644 ---- a/drivers/net/usb/dm9601.c -+++ b/drivers/net/usb/dm9601.c -@@ -624,6 +624,10 @@ static const struct usb_device_id products[] = { - USB_DEVICE(0x0a46, 0x1269), /* DM9621A USB to Fast Ethernet Adapter */ - .driver_info = (unsigned long)&dm9601_info, - }, -+ { -+ USB_DEVICE(0x0586, 0x3427), /* ZyXEL Keenetic Plus DSL xDSL modem */ -+ .driver_info = (unsigned long)&dm9601_info, -+ }, - {}, // END - }; - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 4391430e25273..14eca1f80ce36 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -14,7 +14,9 @@ - #include - #include - #include -+#include - #include -+#include - #include - #include - #include -@@ -48,11 +50,104 @@ - struct qmi_wwan_state { - struct usb_driver *subdriver; - atomic_t pmcount; -- unsigned long unused; -+ unsigned long flags; - struct usb_interface *control; - struct usb_interface *data; - }; - -+enum qmi_wwan_flags { -+ QMI_WWAN_FLAG_RAWIP = 1 << 0, -+}; -+ -+enum qmi_wwan_quirks { -+ QMI_WWAN_QUIRK_DTR = 1 << 0, /* needs "set DTR" request */ -+}; -+ -+static void qmi_wwan_netdev_setup(struct net_device *net) -+{ -+ struct usbnet *dev = netdev_priv(net); -+ struct qmi_wwan_state *info = (void *)&dev->data; -+ -+ if (info->flags & QMI_WWAN_FLAG_RAWIP) { -+ net->header_ops = NULL; /* No header */ -+ net->type = ARPHRD_NONE; -+ net->hard_header_len = 0; -+ net->addr_len = 0; -+ net->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; -+ netdev_dbg(net, "mode: raw IP\n"); -+ } else if (!net->header_ops) { /* don't bother if already set */ -+ ether_setup(net); -+ netdev_dbg(net, "mode: Ethernet\n"); -+ } -+ -+ /* recalculate buffers after changing hard_header_len */ -+ usbnet_change_mtu(net, net->mtu); -+} -+ -+static ssize_t raw_ip_show(struct device *d, struct device_attribute *attr, char *buf) -+{ -+ struct usbnet *dev = netdev_priv(to_net_dev(d)); -+ struct qmi_wwan_state *info = (void *)&dev->data; -+ -+ return sprintf(buf, "%c\n", info->flags & QMI_WWAN_FLAG_RAWIP ? 'Y' : 'N'); -+} -+ -+static ssize_t raw_ip_store(struct device *d, struct device_attribute *attr, const char *buf, size_t len) -+{ -+ struct usbnet *dev = netdev_priv(to_net_dev(d)); -+ struct qmi_wwan_state *info = (void *)&dev->data; -+ bool enable; -+ int ret; -+ -+ if (strtobool(buf, &enable)) -+ return -EINVAL; -+ -+ /* no change? */ -+ if (enable == (info->flags & QMI_WWAN_FLAG_RAWIP)) -+ return len; -+ -+ if (!rtnl_trylock()) -+ return restart_syscall(); -+ -+ /* we don't want to modify a running netdev */ -+ if (netif_running(dev->net)) { -+ netdev_err(dev->net, "Cannot change a running device\n"); -+ ret = -EBUSY; -+ goto err; -+ } -+ -+ /* let other drivers deny the change */ -+ ret = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, dev->net); -+ ret = notifier_to_errno(ret); -+ if (ret) { -+ netdev_err(dev->net, "Type change was refused\n"); -+ goto err; -+ } -+ -+ if (enable) -+ info->flags |= QMI_WWAN_FLAG_RAWIP; -+ else -+ info->flags &= ~QMI_WWAN_FLAG_RAWIP; -+ qmi_wwan_netdev_setup(dev->net); -+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev->net); -+ ret = len; -+err: -+ rtnl_unlock(); -+ return ret; -+} -+ -+static DEVICE_ATTR_RW(raw_ip); -+ -+static struct attribute *qmi_wwan_sysfs_attrs[] = { -+ &dev_attr_raw_ip.attr, -+ NULL, -+}; -+ -+static struct attribute_group qmi_wwan_sysfs_attr_group = { -+ .name = "qmi", -+ .attrs = qmi_wwan_sysfs_attrs, -+}; -+ - /* default ethernet address used by the modem */ - static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3}; - -@@ -80,6 +175,8 @@ static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 0xc6, 0x00, 0x00, 0x00}; - */ - static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - { -+ struct qmi_wwan_state *info = (void *)&dev->data; -+ bool rawip = info->flags & QMI_WWAN_FLAG_RAWIP; - __be16 proto; - - /* This check is no longer done by usbnet */ -@@ -94,15 +191,25 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - proto = htons(ETH_P_IPV6); - break; - case 0x00: -+ if (rawip) -+ return 0; - if (is_multicast_ether_addr(skb->data)) - return 1; - /* possibly bogus destination - rewrite just in case */ - skb_reset_mac_header(skb); - goto fix_dest; - default: -+ if (rawip) -+ return 0; - /* pass along other packets without modifications */ - return 1; - } -+ if (rawip) { -+ skb->dev = dev->net; /* normally set by eth_type_trans */ -+ skb->protocol = proto; -+ return 1; -+ } -+ - if (skb_headroom(skb) < ETH_HLEN) - return 0; - skb_push(skb, ETH_HLEN); -@@ -223,6 +330,20 @@ err: - return rv; - } - -+/* Send CDC SetControlLineState request, setting or clearing the DTR. -+ * "Required for Autoconnect and 9x30 to wake up" according to the -+ * GobiNet driver. The requirement has been verified on an MDM9230 -+ * based Sierra Wireless MC7455 -+ */ -+static int qmi_wwan_change_dtr(struct usbnet *dev, bool on) -+{ -+ u8 intf = dev->intf->cur_altsetting->desc.bInterfaceNumber; -+ -+ return usbnet_write_cmd(dev, USB_CDC_REQ_SET_CONTROL_LINE_STATE, -+ USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE, -+ on ? 0x01 : 0x00, intf, NULL, 0); -+} -+ - static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf) - { - int status = -1; -@@ -257,7 +378,10 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf) - "bogus CDC Union: master=%u, slave=%u\n", - cdc_union->bMasterInterface0, - cdc_union->bSlaveInterface0); -- goto err; -+ -+ /* ignore and continue... */ -+ cdc_union = NULL; -+ info->data = intf; - } - } - -@@ -280,6 +404,29 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf) - usb_driver_release_interface(driver, info->data); - } - -+ /* disabling remote wakeup on MDM9x30 devices has the same -+ * effect as clearing DTR. The device will not respond to QMI -+ * requests until we set DTR again. This is similar to a -+ * QMI_CTL SYNC request, clearing a lot of firmware state -+ * including the client ID allocations. -+ * -+ * Our usage model allows a session to span multiple -+ * open/close events, so we must prevent the firmware from -+ * clearing out state the clients might need. -+ * -+ * MDM9x30 is the first QMI chipset with USB3 support. Abuse -+ * this fact to enable the quirk for all USB3 devices. -+ * -+ * There are also chipsets with the same "set DTR" requirement -+ * but without USB3 support. Devices based on these chips -+ * need a quirk flag in the device ID table. -+ */ -+ if (dev->driver_info->data & QMI_WWAN_QUIRK_DTR || -+ le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) { -+ qmi_wwan_manage_power(dev, 1); -+ qmi_wwan_change_dtr(dev, true); -+ } -+ - /* Never use the same address on both ends of the link, even if the - * buggy firmware told us to. Or, if device is assigned the well-known - * buggy firmware MAC address, replace it with a random address, -@@ -294,6 +441,7 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf) - dev->net->dev_addr[0] &= 0xbf; /* clear "IP" bit */ - } - dev->net->netdev_ops = &qmi_wwan_netdev_ops; -+ dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group; - err: - return status; - } -@@ -307,6 +455,12 @@ static void qmi_wwan_unbind(struct usbnet *dev, struct usb_interface *intf) - if (info->subdriver && info->subdriver->disconnect) - info->subdriver->disconnect(info->control); - -+ /* disable MDM9x30 quirk */ -+ if (le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) { -+ qmi_wwan_change_dtr(dev, false); -+ qmi_wwan_manage_power(dev, 0); -+ } -+ - /* allow user to unbind using either control or data */ - if (intf == info->control) - other = info->data; -@@ -381,6 +535,16 @@ static const struct driver_info qmi_wwan_info = { - .rx_fixup = qmi_wwan_rx_fixup, - }; - -+static const struct driver_info qmi_wwan_info_quirk_dtr = { -+ .description = "WWAN/QMI device", -+ .flags = FLAG_WWAN, -+ .bind = qmi_wwan_bind, -+ .unbind = qmi_wwan_unbind, -+ .manage_power = qmi_wwan_manage_power, -+ .rx_fixup = qmi_wwan_rx_fixup, -+ .data = QMI_WWAN_QUIRK_DTR, -+}; -+ - #define HUAWEI_VENDOR_ID 0x12D1 - - /* map QMI/wwan function by a fixed interface number */ -@@ -388,6 +552,11 @@ static const struct driver_info qmi_wwan_info = { - USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \ - .driver_info = (unsigned long)&qmi_wwan_info - -+/* devices requiring "set DTR" quirk */ -+#define QMI_QUIRK_SET_DTR(vend, prod, num) \ -+ USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \ -+ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr -+ - /* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */ - #define QMI_GOBI1K_DEVICE(vend, prod) \ - QMI_FIXED_INTF(vend, prod, 3) -@@ -717,6 +886,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ - {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ - {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ -+ {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */ - {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ - {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ - {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ -@@ -750,8 +920,11 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ - {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ - {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ -+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ - {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ -- {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ -+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ - {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ - {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ - {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ -@@ -762,16 +935,22 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ - {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ - {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ -+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ -+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)}, /* Cinterion PHxx,PXxx (2 RmNet) */ -+ {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)}, /* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/ - {QMI_FIXED_INTF(0x413c, 0x81a2, 8)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81a3, 8)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81b1, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ -+ {QMI_FIXED_INTF(0x413c, 0x81b3, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ - {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ - {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ - {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ - {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */ -+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ -+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ - - /* 4. Gobi 1000 devices */ - {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ -diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -index d255d33da9eb3..02e71d461d5c5 100644 ---- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -+++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -@@ -49,20 +49,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = { - - /* - * Temperature values in milli degree celsius -- * ADC code values from 530 to 923 -+ * ADC code values from 13 to 107, see TRM -+ * "18.4.10.2.3 ADC Codes Versus Temperature". - */ - static const int - omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = { -- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000, -- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000, -- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000, -- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000, -- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000, -- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000, -- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000, -- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000, -- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000, -- 117000, 118000, 120000, 122000, 123000, -+ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -+ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000, -+ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000, -+ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500, -+ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000, -+ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000, -+ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000, -+ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000, -+ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000, -+ 115000, 117000, 118500, 120000, 122000, 123500, 125000, - }; - - /* OMAP4430 data */ -diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -index 6f2de3a3356d4..86850082b24b9 100644 ---- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -+++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -@@ -67,9 +67,13 @@ - * and thresholds for OMAP4430. - */ - --/* ADC conversion table limits */ --#define OMAP4430_ADC_START_VALUE 0 --#define OMAP4430_ADC_END_VALUE 127 -+/* -+ * ADC conversion table limits. Ignore values outside the TRM listed -+ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter -+ * "18.4.10.2.3 ADC Codes Versus Temperature". -+ */ -+#define OMAP4430_ADC_START_VALUE 13 -+#define OMAP4430_ADC_END_VALUE 107 - /* bandgap clock limits (no control on 4430) */ - #define OMAP4430_MAX_FREQ 32768 - #define OMAP4430_MIN_FREQ 32768 -diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c -index df27cefb2fa35..266f446ba331c 100644 ---- a/drivers/xen/xenbus/xenbus_client.c -+++ b/drivers/xen/xenbus/xenbus_client.c -@@ -384,8 +384,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr, - int i, j; - - for (i = 0; i < nr_pages; i++) { -- err = gnttab_grant_foreign_access(dev->otherend_id, -- virt_to_gfn(vaddr), 0); -+ unsigned long gfn; -+ -+ if (is_vmalloc_addr(vaddr)) -+ gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr)); -+ else -+ gfn = virt_to_gfn(vaddr); -+ -+ err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0); - if (err < 0) { - xenbus_dev_fatal(dev, err, - "granting access to ring page"); -diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c -index 5fa92bc790ef7..c1b344e56e855 100644 ---- a/fs/affs/amigaffs.c -+++ b/fs/affs/amigaffs.c -@@ -390,23 +390,23 @@ prot_to_mode(u32 prot) - umode_t mode = 0; - - if (!(prot & FIBF_NOWRITE)) -- mode |= S_IWUSR; -+ mode |= 0200; - if (!(prot & FIBF_NOREAD)) -- mode |= S_IRUSR; -+ mode |= 0400; - if (!(prot & FIBF_NOEXECUTE)) -- mode |= S_IXUSR; -+ mode |= 0100; - if (prot & FIBF_GRP_WRITE) -- mode |= S_IWGRP; -+ mode |= 0020; - if (prot & FIBF_GRP_READ) -- mode |= S_IRGRP; -+ mode |= 0040; - if (prot & FIBF_GRP_EXECUTE) -- mode |= S_IXGRP; -+ mode |= 0010; - if (prot & FIBF_OTR_WRITE) -- mode |= S_IWOTH; -+ mode |= 0002; - if (prot & FIBF_OTR_READ) -- mode |= S_IROTH; -+ mode |= 0004; - if (prot & FIBF_OTR_EXECUTE) -- mode |= S_IXOTH; -+ mode |= 0001; - - return mode; - } -@@ -417,24 +417,51 @@ mode_to_prot(struct inode *inode) - u32 prot = AFFS_I(inode)->i_protect; - umode_t mode = inode->i_mode; - -- if (!(mode & S_IXUSR)) -+ /* -+ * First, clear all RWED bits for owner, group, other. -+ * Then, recalculate them afresh. -+ * -+ * We'll always clear the delete-inhibit bit for the owner, as that is -+ * the classic single-user mode AmigaOS protection bit and we need to -+ * stay compatible with all scenarios. -+ * -+ * Since multi-user AmigaOS is an extension, we'll only set the -+ * delete-allow bit if any of the other bits in the same user class -+ * (group/other) are used. -+ */ -+ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD -+ | FIBF_NOWRITE | FIBF_NODELETE -+ | FIBF_GRP_EXECUTE | FIBF_GRP_READ -+ | FIBF_GRP_WRITE | FIBF_GRP_DELETE -+ | FIBF_OTR_EXECUTE | FIBF_OTR_READ -+ | FIBF_OTR_WRITE | FIBF_OTR_DELETE); -+ -+ /* Classic single-user AmigaOS flags. These are inverted. */ -+ if (!(mode & 0100)) - prot |= FIBF_NOEXECUTE; -- if (!(mode & S_IRUSR)) -+ if (!(mode & 0400)) - prot |= FIBF_NOREAD; -- if (!(mode & S_IWUSR)) -+ if (!(mode & 0200)) - prot |= FIBF_NOWRITE; -- if (mode & S_IXGRP) -+ -+ /* Multi-user extended flags. Not inverted. */ -+ if (mode & 0010) - prot |= FIBF_GRP_EXECUTE; -- if (mode & S_IRGRP) -+ if (mode & 0040) - prot |= FIBF_GRP_READ; -- if (mode & S_IWGRP) -+ if (mode & 0020) - prot |= FIBF_GRP_WRITE; -- if (mode & S_IXOTH) -+ if (mode & 0070) -+ prot |= FIBF_GRP_DELETE; -+ -+ if (mode & 0001) - prot |= FIBF_OTR_EXECUTE; -- if (mode & S_IROTH) -+ if (mode & 0004) - prot |= FIBF_OTR_READ; -- if (mode & S_IWOTH) -+ if (mode & 0002) - prot |= FIBF_OTR_WRITE; -+ if (mode & 0007) -+ prot |= FIBF_OTR_DELETE; - - AFFS_I(inode)->i_protect = prot; - } -diff --git a/fs/affs/file.c b/fs/affs/file.c -index 659c579c4588b..38e0fd4caf2bb 100644 ---- a/fs/affs/file.c -+++ b/fs/affs/file.c -@@ -426,6 +426,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping, - return ret; - } - -+static int affs_write_end(struct file *file, struct address_space *mapping, -+ loff_t pos, unsigned int len, unsigned int copied, -+ struct page *page, void *fsdata) -+{ -+ struct inode *inode = mapping->host; -+ int ret; -+ -+ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata); -+ -+ /* Clear Archived bit on file writes, as AmigaOS would do */ -+ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { -+ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; -+ mark_inode_dirty(inode); -+ } -+ -+ return ret; -+} -+ - static sector_t _affs_bmap(struct address_space *mapping, sector_t block) - { - return generic_block_bmap(mapping,block,affs_get_block); -@@ -435,7 +453,7 @@ const struct address_space_operations affs_aops = { - .readpage = affs_readpage, - .writepage = affs_writepage, - .write_begin = affs_write_begin, -- .write_end = generic_write_end, -+ .write_end = affs_write_end, - .direct_IO = affs_direct_IO, - .bmap = _affs_bmap - }; -@@ -793,6 +811,12 @@ done: - if (tmp > inode->i_size) - inode->i_size = AFFS_I(inode)->mmu_private = tmp; - -+ /* Clear Archived bit on file writes, as AmigaOS would do */ -+ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { -+ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; -+ mark_inode_dirty(inode); -+ } -+ - err_first_bh: - unlock_page(page); - page_cache_release(page); -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 8eac5f75bca36..3fa0515d76851 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -1372,7 +1372,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path, - btrfs_tree_read_unlock_blocking(eb); - free_extent_buffer(eb); - -- extent_buffer_get(eb_rewin); -+ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin), -+ eb_rewin, btrfs_header_level(eb_rewin)); - btrfs_tree_read_lock(eb_rewin); - __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm); - WARN_ON(btrfs_header_nritems(eb_rewin) > -@@ -1441,8 +1442,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - - if (!eb) - return NULL; -- extent_buffer_get(eb); -- btrfs_tree_read_lock(eb); - if (old_root) { - btrfs_set_header_bytenr(eb, eb->start); - btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV); -@@ -1450,6 +1449,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - btrfs_set_header_level(eb, old_root->level); - btrfs_set_header_generation(eb, old_generation); - } -+ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb, -+ btrfs_header_level(eb)); -+ btrfs_tree_read_lock(eb); - if (tm) - __tree_mod_log_rewind(root->fs_info, eb, time_seq, tm); - else -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 2f9f738ecf84a..97a80238fdee3 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -5431,9 +5431,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv, - } - } - --int read_extent_buffer_to_user(const struct extent_buffer *eb, -- void __user *dstv, -- unsigned long start, unsigned long len) -+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, -+ void __user *dstv, -+ unsigned long start, unsigned long len) - { - size_t cur; - size_t offset; -@@ -5454,7 +5454,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb, - - cur = min(len, (PAGE_CACHE_SIZE - offset)); - kaddr = page_address(page); -- if (copy_to_user(dst, kaddr + offset, cur)) { -+ if (probe_user_write(dst, kaddr + offset, cur)) { - ret = -EFAULT; - break; - } -diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h -index 751435967724e..9631be7fc9e24 100644 ---- a/fs/btrfs/extent_io.h -+++ b/fs/btrfs/extent_io.h -@@ -313,9 +313,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv, - void read_extent_buffer(const struct extent_buffer *eb, void *dst, - unsigned long start, - unsigned long len); --int read_extent_buffer_to_user(const struct extent_buffer *eb, -- void __user *dst, unsigned long start, -- unsigned long len); -+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, -+ void __user *dst, unsigned long start, -+ unsigned long len); - void write_extent_buffer(struct extent_buffer *eb, const void *src, - unsigned long start, unsigned long len); - void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src, -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 245a50f490f63..91a45ef69152d 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2017,9 +2017,14 @@ static noinline int copy_to_sk(struct btrfs_root *root, - sh.len = item_len; - sh.transid = found_transid; - -- /* copy search result header */ -- if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) { -- ret = -EFAULT; -+ /* -+ * Copy search result header. If we fault then loop again so we -+ * can fault in the pages and -EFAULT there if there's a -+ * problem. Otherwise we'll fault and then copy the buffer in -+ * properly this next time through -+ */ -+ if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) { -+ ret = 0; - goto out; - } - -@@ -2027,10 +2032,14 @@ static noinline int copy_to_sk(struct btrfs_root *root, - - if (item_len) { - char __user *up = ubuf + *sk_offset; -- /* copy the item */ -- if (read_extent_buffer_to_user(leaf, up, -- item_off, item_len)) { -- ret = -EFAULT; -+ /* -+ * Copy the item, same behavior as above, but reset the -+ * * sk_offset so we copy the full thing again. -+ */ -+ if (read_extent_buffer_to_user_nofault(leaf, up, -+ item_off, item_len)) { -+ ret = 0; -+ *sk_offset -= sizeof(sh); - goto out; - } - -@@ -2120,6 +2129,10 @@ static noinline int search_ioctl(struct inode *inode, - key.offset = sk->min_offset; - - while (1) { -+ ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset); -+ if (ret) -+ break; -+ - ret = btrfs_search_forward(root, &key, path, sk->min_transid); - if (ret != 0) { - if (ret > 0) -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index dcae0cf4924b7..2d10b818399b1 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -4065,6 +4065,7 @@ static int btrfs_uuid_scan_kthread(void *data) - goto skip; - } - update_tree: -+ btrfs_release_path(path); - if (!btrfs_is_empty_uuid(root_item.uuid)) { - ret = btrfs_uuid_tree_add(trans, fs_info->uuid_root, - root_item.uuid, -@@ -4090,6 +4091,7 @@ update_tree: - } - - skip: -+ btrfs_release_path(path); - if (trans) { - ret = btrfs_end_transaction(trans, fs_info->uuid_root); - trans = NULL; -@@ -4097,7 +4099,6 @@ skip: - break; - } - -- btrfs_release_path(path); - if (key.offset < (u64)-1) { - key.offset++; - } else if (key.type < BTRFS_ROOT_ITEM_KEY) { -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index c8222bfe1e566..3e6ebe40f06fb 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -1433,6 +1433,7 @@ const struct file_operations ceph_file_fops = { - .mmap = ceph_mmap, - .fsync = ceph_fsync, - .lock = ceph_lock, -+ .setlease = simple_nosetlease, - .flock = ceph_flock, - .splice_read = generic_file_splice_read, - .splice_write = iter_file_splice_write, -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index b8959d0d4c723..e5324642023d6 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -1720,9 +1720,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - * during ep_insert(). - */ - if (list_empty(&epi->ffd.file->f_tfile_llink)) { -- get_file(epi->ffd.file); -- list_add(&epi->ffd.file->f_tfile_llink, -- &tfile_check_list); -+ if (get_file_rcu(epi->ffd.file)) -+ list_add(&epi->ffd.file->f_tfile_llink, -+ &tfile_check_list); - } - } - } -diff --git a/include/linux/hid.h b/include/linux/hid.h -index 2149f650982ea..d93ba6014e3c5 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -866,34 +866,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { - * @max: maximal valid usage->code to consider later (out parameter) - * @type: input event type (EV_KEY, EV_REL, ...) - * @c: code which corresponds to this usage and type -+ * -+ * The value pointed to by @bit will be set to NULL if either @type is -+ * an unhandled event type, or if @c is out of range for @type. This -+ * can be used as an error condition. - */ - static inline void hid_map_usage(struct hid_input *hidinput, - struct hid_usage *usage, unsigned long **bit, int *max, -- __u8 type, __u16 c) -+ __u8 type, unsigned int c) - { - struct input_dev *input = hidinput->input; -- -- usage->type = type; -- usage->code = c; -+ unsigned long *bmap = NULL; -+ unsigned int limit = 0; - - switch (type) { - case EV_ABS: -- *bit = input->absbit; -- *max = ABS_MAX; -+ bmap = input->absbit; -+ limit = ABS_MAX; - break; - case EV_REL: -- *bit = input->relbit; -- *max = REL_MAX; -+ bmap = input->relbit; -+ limit = REL_MAX; - break; - case EV_KEY: -- *bit = input->keybit; -- *max = KEY_MAX; -+ bmap = input->keybit; -+ limit = KEY_MAX; - break; - case EV_LED: -- *bit = input->ledbit; -- *max = LED_MAX; -+ bmap = input->ledbit; -+ limit = LED_MAX; - break; - } -+ -+ if (unlikely(c > limit || !bmap)) { -+ pr_warn_ratelimited("%s: Invalid code %d type %d\n", -+ input->name, c, type); -+ *bit = NULL; -+ return; -+ } -+ -+ usage->type = type; -+ usage->code = c; -+ *max = limit; -+ *bit = bmap; - } - - /** -@@ -907,7 +922,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, - __u8 type, __u16 c) - { - hid_map_usage(hidinput, usage, bit, max, type, c); -- clear_bit(c, *bit); -+ if (*bit) -+ clear_bit(usage->code, *bit); - } - - /** -diff --git a/include/linux/log2.h b/include/linux/log2.h -index c373295f359fa..cca606609e1bc 100644 ---- a/include/linux/log2.h -+++ b/include/linux/log2.h -@@ -159,7 +159,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) - #define roundup_pow_of_two(n) \ - ( \ - __builtin_constant_p(n) ? ( \ -- (n == 1) ? 1 : \ -+ ((n) == 1) ? 1 : \ - (1UL << (ilog2((n) - 1) + 1)) \ - ) : \ - __roundup_pow_of_two(n) \ -diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h -index 15c7b5420d8aa..c82dcea216b15 100644 ---- a/include/linux/uaccess.h -+++ b/include/linux/uaccess.h -@@ -90,6 +90,17 @@ static inline unsigned long __copy_from_user_nocache(void *to, - extern long probe_kernel_read(void *dst, const void *src, size_t size); - extern long __probe_kernel_read(void *dst, const void *src, size_t size); - -+/* -+ * probe_user_read(): safely attempt to read from a location in user space -+ * @dst: pointer to the buffer that shall take the data -+ * @src: address to read from -+ * @size: size of the data chunk -+ * -+ * Safely read from address @src to the buffer at @dst. If a kernel fault -+ * happens, handle that and return -EFAULT. -+ */ -+extern long probe_user_read(void *dst, const void __user *src, size_t size); -+ - /* - * probe_kernel_write(): safely attempt to write to a location - * @dst: address to write to -@@ -102,7 +113,22 @@ extern long __probe_kernel_read(void *dst, const void *src, size_t size); - extern long notrace probe_kernel_write(void *dst, const void *src, size_t size); - extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size); - -+/* -+ * probe_user_write(): safely attempt to write to a location in user space -+ * @dst: address to write to -+ * @src: pointer to the data that shall be written -+ * @size: size of the data chunk -+ * -+ * Safely write to address @dst from the buffer at @src. If a kernel fault -+ * happens, handle that and return -EFAULT. -+ */ -+extern long notrace probe_user_write(void __user *dst, const void *src, size_t size); -+extern long notrace __probe_user_write(void __user *dst, const void *src, size_t size); -+ - extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); -+extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr, -+ long count); -+extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count); - - /** - * probe_kernel_address(): safely attempt to read from a location -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index 72599bbc82558..a77a37c6349d9 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -319,5 +319,9 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, - int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, - char __user *optval, unsigned int optlen); - -+/* update the fast reuse flag when adding a socket */ -+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, -+ struct sock *sk); -+ - struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu); - #endif /* _INET_CONNECTION_SOCK_H */ -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index b96df7499600f..bee9031a40066 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -74,6 +74,8 @@ struct nft_regs { - static inline void nft_data_copy(u32 *dst, const struct nft_data *src, - unsigned int len) - { -+ if (len % NFT_REG32_SIZE) -+ dst[len / NFT_REG32_SIZE] = 0; - memcpy(dst, src, len); - } - -diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h -index d8c8a7c9d88a7..b0a1c33d4a153 100644 ---- a/include/uapi/linux/netfilter/nf_tables.h -+++ b/include/uapi/linux/netfilter/nf_tables.h -@@ -111,7 +111,7 @@ enum nf_tables_msg_types { - * @NFTA_LIST_ELEM: list element (NLA_NESTED) - */ - enum nft_list_attributes { -- NFTA_LIST_UNPEC, -+ NFTA_LIST_UNSPEC, - NFTA_LIST_ELEM, - __NFTA_LIST_MAX - }; -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index baac9a09ec0a1..44970b17f4fe7 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2812,6 +2812,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array) - } - - #ifdef CONFIG_SYSCTL -+static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write, -+ void *buffer, size_t *length, -+ loff_t *ppos, unsigned long *out) -+{ -+ struct ctl_table dup_table; -+ -+ /* -+ * In order to avoid races with __do_proc_doulongvec_minmax(), we -+ * can duplicate the @table and alter the duplicate of it. -+ */ -+ dup_table = *table; -+ dup_table.data = out; -+ -+ return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos); -+} -+ - static int hugetlb_sysctl_handler_common(bool obey_mempolicy, - struct ctl_table *table, int write, - void __user *buffer, size_t *length, loff_t *ppos) -@@ -2823,9 +2839,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, - if (!hugepages_supported()) - return -ENOTSUPP; - -- table->data = &tmp; -- table->maxlen = sizeof(unsigned long); -- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); -+ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, -+ &tmp); - if (ret) - goto out; - -@@ -2869,9 +2884,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, - if (write && hstate_is_gigantic(h)) - return -EINVAL; - -- table->data = &tmp; -- table->maxlen = sizeof(unsigned long); -- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); -+ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, -+ &tmp); - if (ret) - goto out; - -diff --git a/mm/maccess.c b/mm/maccess.c -index d159b1c96e484..18717e893a758 100644 ---- a/mm/maccess.c -+++ b/mm/maccess.c -@@ -5,8 +5,32 @@ - #include - #include - -+static __always_inline long -+probe_read_common(void *dst, const void __user *src, size_t size) -+{ -+ long ret; -+ -+ pagefault_disable(); -+ ret = __copy_from_user_inatomic(dst, src, size); -+ pagefault_enable(); -+ -+ return ret ? -EFAULT : 0; -+} -+ -+static __always_inline long -+probe_write_common(void __user *dst, const void *src, size_t size) -+{ -+ long ret; -+ -+ pagefault_disable(); -+ ret = __copy_to_user_inatomic(dst, src, size); -+ pagefault_enable(); -+ -+ return ret ? -EFAULT : 0; -+} -+ - /** -- * probe_kernel_read(): safely attempt to read from a location -+ * probe_kernel_read(): safely attempt to read from a kernel-space location - * @dst: pointer to the buffer that shall take the data - * @src: address to read from - * @size: size of the data chunk -@@ -29,16 +53,40 @@ long __probe_kernel_read(void *dst, const void *src, size_t size) - mm_segment_t old_fs = get_fs(); - - set_fs(KERNEL_DS); -- pagefault_disable(); -- ret = __copy_from_user_inatomic(dst, -- (__force const void __user *)src, size); -- pagefault_enable(); -+ ret = probe_read_common(dst, (__force const void __user *)src, size); - set_fs(old_fs); - -- return ret ? -EFAULT : 0; -+ return ret; - } - EXPORT_SYMBOL_GPL(probe_kernel_read); - -+/** -+ * probe_user_read(): safely attempt to read from a user-space location -+ * @dst: pointer to the buffer that shall take the data -+ * @src: address to read from. This must be a user address. -+ * @size: size of the data chunk -+ * -+ * Safely read from user address @src to the buffer at @dst. If a kernel fault -+ * happens, handle that and return -EFAULT. -+ */ -+ -+long __weak probe_user_read(void *dst, const void __user *src, size_t size) -+ __attribute__((alias("__probe_user_read"))); -+ -+long __probe_user_read(void *dst, const void __user *src, size_t size) -+{ -+ long ret = -EFAULT; -+ mm_segment_t old_fs = get_fs(); -+ -+ set_fs(USER_DS); -+ if (access_ok(VERIFY_READ, src, size)) -+ ret = probe_read_common(dst, src, size); -+ set_fs(old_fs); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(probe_user_read); -+ - /** - * probe_kernel_write(): safely attempt to write to a location - * @dst: address to write to -@@ -48,6 +96,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read); - * Safely write to address @dst from the buffer at @src. If a kernel fault - * happens, handle that and return -EFAULT. - */ -+ - long __weak probe_kernel_write(void *dst, const void *src, size_t size) - __attribute__((alias("__probe_kernel_write"))); - -@@ -57,15 +106,40 @@ long __probe_kernel_write(void *dst, const void *src, size_t size) - mm_segment_t old_fs = get_fs(); - - set_fs(KERNEL_DS); -- pagefault_disable(); -- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); -- pagefault_enable(); -+ ret = probe_write_common((__force void __user *)dst, src, size); - set_fs(old_fs); - -- return ret ? -EFAULT : 0; -+ return ret; - } - EXPORT_SYMBOL_GPL(probe_kernel_write); - -+/** -+ * probe_user_write(): safely attempt to write to a user-space location -+ * @dst: address to write to -+ * @src: pointer to the data that shall be written -+ * @size: size of the data chunk -+ * -+ * Safely write to address @dst from the buffer at @src. If a kernel fault -+ * happens, handle that and return -EFAULT. -+ */ -+ -+long __weak probe_user_write(void __user *dst, const void *src, size_t size) -+ __attribute__((alias("__probe_user_write"))); -+ -+long __probe_user_write(void __user *dst, const void *src, size_t size) -+{ -+ long ret = -EFAULT; -+ mm_segment_t old_fs = get_fs(); -+ -+ set_fs(USER_DS); -+ if (access_ok(VERIFY_WRITE, dst, size)) -+ ret = probe_write_common(dst, src, size); -+ set_fs(old_fs); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(probe_user_write); -+ - /** - * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address. - * @dst: Destination address, in kernel space. This buffer must be at -@@ -106,3 +180,76 @@ long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count) - - return ret ? -EFAULT : src - unsafe_addr; - } -+ -+/** -+ * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user -+ * address. -+ * @dst: Destination address, in kernel space. This buffer must be at -+ * least @count bytes long. -+ * @unsafe_addr: Unsafe user address. -+ * @count: Maximum number of bytes to copy, including the trailing NUL. -+ * -+ * Copies a NUL-terminated string from unsafe user address to kernel buffer. -+ * -+ * On success, returns the length of the string INCLUDING the trailing NUL. -+ * -+ * If access fails, returns -EFAULT (some data may have been copied -+ * and the trailing NUL added). -+ * -+ * If @count is smaller than the length of the string, copies @count-1 bytes, -+ * sets the last byte of @dst buffer to NUL and returns @count. -+ */ -+long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr, -+ long count) -+{ -+ mm_segment_t old_fs = get_fs(); -+ long ret; -+ -+ if (unlikely(count <= 0)) -+ return 0; -+ -+ set_fs(USER_DS); -+ pagefault_disable(); -+ ret = strncpy_from_user(dst, unsafe_addr, count); -+ pagefault_enable(); -+ set_fs(old_fs); -+ -+ if (ret >= count) { -+ ret = count; -+ dst[ret - 1] = '\0'; -+ } else if (ret > 0) { -+ ret++; -+ } -+ -+ return ret; -+} -+ -+/** -+ * strnlen_unsafe_user: - Get the size of a user string INCLUDING final NUL. -+ * @unsafe_addr: The string to measure. -+ * @count: Maximum count (including NUL) -+ * -+ * Get the size of a NUL-terminated string in user space without pagefault. -+ * -+ * Returns the size of the string INCLUDING the terminating NUL. -+ * -+ * If the string is too long, returns a number larger than @count. User -+ * has to check the return value against "> count". -+ * On exception (or invalid count), returns 0. -+ * -+ * Unlike strnlen_user, this can be used from IRQ handler etc. because -+ * it disables pagefaults. -+ */ -+long strnlen_unsafe_user(const void __user *unsafe_addr, long count) -+{ -+ mm_segment_t old_fs = get_fs(); -+ int ret; -+ -+ set_fs(USER_DS); -+ pagefault_disable(); -+ ret = strnlen_user(unsafe_addr, count); -+ pagefault_enable(); -+ set_fs(old_fs); -+ -+ return ret; -+} -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 14bab5fa1b656..3570aaf2a6204 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -835,7 +835,6 @@ static void free_pcppages_bulk(struct zone *zone, int count, - { - int migratetype = 0; - int batch_free = 0; -- int to_free = count; - unsigned long nr_scanned; - - spin_lock(&zone->lock); -@@ -848,7 +847,7 @@ static void free_pcppages_bulk(struct zone *zone, int count, - * below while (list_empty(list)) loop. - */ - count = min(pcp->count, count); -- while (to_free) { -+ while (count) { - struct page *page; - struct list_head *list; - -@@ -868,7 +867,7 @@ static void free_pcppages_bulk(struct zone *zone, int count, - - /* This is the only non-empty list. Free them all. */ - if (batch_free == MIGRATE_PCPTYPES) -- batch_free = to_free; -+ batch_free = count; - - do { - int mt; /* migratetype of the to-be-freed page */ -@@ -886,7 +885,7 @@ static void free_pcppages_bulk(struct zone *zone, int count, - - __free_one_page(page, page_to_pfn(page), zone, 0, mt); - trace_mm_page_pcpu_drain(page, 0, mt); -- } while (--to_free && --batch_free && !list_empty(list)); -+ } while (--count && --batch_free && !list_empty(list)); - } - spin_unlock(&zone->lock); - } -diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c -index cea7fdeac5aa2..9aa5daa551273 100644 ---- a/net/batman-adv/bridge_loop_avoidance.c -+++ b/net/batman-adv/bridge_loop_avoidance.c -@@ -380,7 +380,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac, - skb->len + ETH_HLEN); - soft_iface->last_rx = jiffies; - -- netif_rx(skb); -+ if (in_interrupt()) -+ netif_rx(skb); -+ else -+ netif_rx_ni(skb); - out: - if (primary_if) - batadv_hardif_free_ref(primary_if); -diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c -index a88b529b7ca08..5fdb88f72b68f 100644 ---- a/net/batman-adv/gateway_client.c -+++ b/net/batman-adv/gateway_client.c -@@ -757,8 +757,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, - - chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; - /* store the client address if the message is going to a client */ -- if (ret == BATADV_DHCP_TO_CLIENT && -- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { -+ if (ret == BATADV_DHCP_TO_CLIENT) { -+ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) -+ return BATADV_DHCP_NO; -+ - /* check if the DHCP packet carries an Ethernet DHCP */ - p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; - if (*p != BATADV_DHCP_HTYPE_ETHERNET) -diff --git a/net/core/dev.c b/net/core/dev.c -index 09115c68f29dc..59157e9686fb2 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4849,13 +4849,14 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi, - pr_err_once("netif_napi_add() called with weight %d on device %s\n", - weight, dev->name); - napi->weight = weight; -- list_add(&napi->dev_list, &dev->napi_list); - napi->dev = dev; - #ifdef CONFIG_NETPOLL - spin_lock_init(&napi->poll_lock); - napi->poll_owner = -1; - #endif - set_bit(NAPI_STATE_SCHED, &napi->state); -+ set_bit(NAPI_STATE_NPSVC, &napi->state); -+ list_add_rcu(&napi->dev_list, &dev->napi_list); - } - EXPORT_SYMBOL(netif_napi_add); - -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 0d7c2cc1ff09d..f2610f8f171ca 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -178,7 +178,7 @@ static void poll_napi(struct net_device *dev) - { - struct napi_struct *napi; - -- list_for_each_entry(napi, &dev->napi_list, dev_list) { -+ list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) { - if (napi->poll_owner != smp_processor_id() && - spin_trylock(&napi->poll_lock)) { - poll_one_napi(napi); -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 6c9158805b57d..9678dd8d70c3f 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -87,6 +87,31 @@ int inet_csk_bind_conflict(const struct sock *sk, - } - EXPORT_SYMBOL_GPL(inet_csk_bind_conflict); - -+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, -+ struct sock *sk) -+{ -+ kuid_t uid = sock_i_uid(sk); -+ -+ if (hlist_empty(&tb->owners)) { -+ if (sk->sk_reuse && sk->sk_state != TCP_LISTEN) -+ tb->fastreuse = 1; -+ else -+ tb->fastreuse = 0; -+ if (sk->sk_reuseport) { -+ tb->fastreuseport = 1; -+ tb->fastuid = uid; -+ } else -+ tb->fastreuseport = 0; -+ } else { -+ if (tb->fastreuse && -+ (!sk->sk_reuse || sk->sk_state == TCP_LISTEN)) -+ tb->fastreuse = 0; -+ if (tb->fastreuseport && -+ (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid))) -+ tb->fastreuseport = 0; -+ } -+} -+ - /* Obtain a reference to a local port for the given sock, - * if snum is zero it means select any available local port. - */ -@@ -216,24 +241,9 @@ tb_not_found: - if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep, - net, head, snum)) == NULL) - goto fail_unlock; -- if (hlist_empty(&tb->owners)) { -- if (sk->sk_reuse && sk->sk_state != TCP_LISTEN) -- tb->fastreuse = 1; -- else -- tb->fastreuse = 0; -- if (sk->sk_reuseport) { -- tb->fastreuseport = 1; -- tb->fastuid = uid; -- } else -- tb->fastreuseport = 0; -- } else { -- if (tb->fastreuse && -- (!sk->sk_reuse || sk->sk_state == TCP_LISTEN)) -- tb->fastreuse = 0; -- if (tb->fastreuseport && -- (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid))) -- tb->fastreuseport = 0; -- } -+ -+ inet_csk_update_fastreuse(tb, sk); -+ - success: - if (!inet_csk(sk)->icsk_bind_hash) - inet_bind_hash(sk, tb, snum); -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index ccc5980797fcd..738cd5c822b1b 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -160,6 +160,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child) - return -ENOMEM; - } - } -+ inet_csk_update_fastreuse(tb, child); - } - inet_bind_hash(child, tb, port); - spin_unlock(&head->lock); -diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c -index 09b4b07eb6764..ab3e7b14de09b 100644 ---- a/net/netfilter/nft_payload.c -+++ b/net/netfilter/nft_payload.c -@@ -74,7 +74,9 @@ static void nft_payload_eval(const struct nft_expr *expr, - u32 *dest = ®s->data[priv->dreg]; - int offset; - -- dest[priv->len / NFT_REG32_SIZE] = 0; -+ if (priv->len % NFT_REG32_SIZE) -+ dest[priv->len / NFT_REG32_SIZE] = 0; -+ - switch (priv->base) { - case NFT_PAYLOAD_LL_HEADER: - if (!skb_mac_header_was_set(skb)) -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 5803d0807e9a2..62ba9a49c1265 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -6206,8 +6206,6 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - - pr_debug("%s: begins, snum:%d\n", __func__, snum); - -- local_bh_disable(); -- - if (snum == 0) { - /* Search for an available port. */ - int low, high, remaining, index; -@@ -6226,20 +6224,21 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - continue; - index = sctp_phashfn(sock_net(sk), rover); - head = &sctp_port_hashtable[index]; -- spin_lock(&head->lock); -+ spin_lock_bh(&head->lock); - sctp_for_each_hentry(pp, &head->chain) - if ((pp->port == rover) && - net_eq(sock_net(sk), pp->net)) - goto next; - break; - next: -- spin_unlock(&head->lock); -+ spin_unlock_bh(&head->lock); -+ cond_resched(); - } while (--remaining > 0); - - /* Exhausted local port range during search? */ - ret = 1; - if (remaining <= 0) -- goto fail; -+ return ret; - - /* OK, here is the one we will use. HEAD (the port - * hash table list entry) is non-NULL and we hold it's -@@ -6254,7 +6253,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - * port iterator, pp being NULL. - */ - head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)]; -- spin_lock(&head->lock); -+ spin_lock_bh(&head->lock); - sctp_for_each_hentry(pp, &head->chain) { - if ((pp->port == snum) && net_eq(pp->net, sock_net(sk))) - goto pp_found; -@@ -6338,10 +6337,7 @@ success: - ret = 0; - - fail_unlock: -- spin_unlock(&head->lock); -- --fail: -- local_bh_enable(); -+ spin_unlock_bh(&head->lock); - return ret; - } - -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 437ec52d5e71f..474923175b108 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -2383,6 +2383,9 @@ int regulatory_hint_user(const char *alpha2, - if (WARN_ON(!alpha2)) - return -EINVAL; - -+ if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2)) -+ return -EINVAL; -+ - request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL); - if (!request) - return -ENOMEM; -diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl -index 6ac6550d751c1..8835a4775d205 100755 ---- a/scripts/checkpatch.pl -+++ b/scripts/checkpatch.pl -@@ -2195,8 +2195,8 @@ sub process { - - # Check if the commit log has what seems like a diff which can confuse patch - if ($in_commit_log && !$commit_log_has_diff && -- (($line =~ m@^\s+diff\b.*a/[\w/]+@ && -- $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) || -+ (($line =~ m@^\s+diff\b.*a/([\w/]+)@ && -+ $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) || - $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ || - $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) { - ERROR("DIFF_IN_COMMIT_MSG", -diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c -index 3788906421a73..fe27034f28460 100644 ---- a/sound/core/oss/mulaw.c -+++ b/sound/core/oss/mulaw.c -@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug, - snd_BUG(); - return -EINVAL; - } -- if (snd_BUG_ON(!snd_pcm_format_linear(format->format))) -- return -ENXIO; -+ if (!snd_pcm_format_linear(format->format)) -+ return -EINVAL; - - err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", - src_format, dst_format, -diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c -index 1f33b7a1fca4c..659e8224a4dee 100644 ---- a/sound/firewire/digi00x/digi00x.c -+++ b/sound/firewire/digi00x/digi00x.c -@@ -13,7 +13,9 @@ MODULE_AUTHOR("Takashi Sakamoto "); - MODULE_LICENSE("GPL v2"); - - #define VENDOR_DIGIDESIGN 0x00a07e --#define MODEL_DIGI00X 0x000002 -+#define MODEL_CONSOLE 0x000001 -+#define MODEL_RACK 0x000002 -+#define SPEC_VERSION 0x000001 - - static int name_card(struct snd_dg00x *dg00x) - { -@@ -75,6 +77,8 @@ static int snd_dg00x_probe(struct fw_unit *unit, - spin_lock_init(&dg00x->lock); - init_waitqueue_head(&dg00x->hwdep_wait); - -+ dg00x->is_console = entry->model_id == MODEL_CONSOLE; -+ - err = name_card(dg00x); - if (err < 0) - goto error; -@@ -136,9 +140,19 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = { - /* Both of 002/003 use the same ID. */ - { - .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_VERSION | -+ IEEE1394_MATCH_MODEL_ID, -+ .vendor_id = VENDOR_DIGIDESIGN, -+ .version = SPEC_VERSION, -+ .model_id = MODEL_CONSOLE, -+ }, -+ { -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_VERSION | - IEEE1394_MATCH_MODEL_ID, - .vendor_id = VENDOR_DIGIDESIGN, -- .model_id = MODEL_DIGI00X, -+ .version = SPEC_VERSION, -+ .model_id = MODEL_RACK, - }, - {} - }; -diff --git a/sound/firewire/digi00x/digi00x.h b/sound/firewire/digi00x/digi00x.h -index 907e739936777..d641a0cf077a3 100644 ---- a/sound/firewire/digi00x/digi00x.h -+++ b/sound/firewire/digi00x/digi00x.h -@@ -57,6 +57,7 @@ struct snd_dg00x { - /* For asynchronous MIDI controls. */ - struct snd_rawmidi_substream *in_control; - struct snd_fw_async_midi_port out_control; -+ bool is_console; - }; - - #define DG00X_ADDR_BASE 0xffffe0000000ull -diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c -index ee0bc18395088..a4143f45c7f7a 100644 ---- a/sound/firewire/tascam/tascam.c -+++ b/sound/firewire/tascam/tascam.c -@@ -172,11 +172,39 @@ static void snd_tscm_remove(struct fw_unit *unit) - } - - static const struct ieee1394_device_id snd_tscm_id_table[] = { -+ // Tascam, FW-1884. - { - .match_flags = IEEE1394_MATCH_VENDOR_ID | -- IEEE1394_MATCH_SPECIFIER_ID, -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, - .vendor_id = 0x00022e, - .specifier_id = 0x00022e, -+ .version = 0x800000, -+ }, -+ // Tascam, FE-8 (.version = 0x800001) -+ // This kernel module doesn't support FE-8 because the most of features -+ // can be implemented in userspace without any specific support of this -+ // module. -+ // -+ // .version = 0x800002 is unknown. -+ // -+ // Tascam, FW-1082. -+ { -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, -+ .vendor_id = 0x00022e, -+ .specifier_id = 0x00022e, -+ .version = 0x800003, -+ }, -+ // Tascam, FW-1804. -+ { -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, -+ .vendor_id = 0x00022e, -+ .specifier_id = 0x00022e, -+ .version = 0x800004, - }, - /* FE-08 requires reverse-engineering because it just has faders. */ - {} -diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c -index d3cd95633ee2c..e7ee51b7aa6b0 100644 ---- a/sound/pci/ca0106/ca0106_main.c -+++ b/sound/pci/ca0106/ca0106_main.c -@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id, - else - /* Power down */ - chip->spi_dac_reg[reg] |= bit; -- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]); -+ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0) -+ return -ENXIO; - } - return 0; - } -diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt -index e630a7d2c3483..e4eee57ad2299 100644 ---- a/tools/perf/Documentation/perf-record.txt -+++ b/tools/perf/Documentation/perf-record.txt -@@ -33,6 +33,10 @@ OPTIONS - - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a - hexadecimal event descriptor. - -+ - a symbolic or raw PMU event followed by an optional colon -+ and a list of event modifiers, e.g., cpu-cycles:p. See the -+ linkperf:perf-list[1] man page for details on event modifiers. -+ - - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where - 'param1', 'param2', etc are defined as formats for the PMU in - /sys/bus/event_sources/devices//format/*. -diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt -index 90c3558c2c12f..ee7fe04fc4b6c 100644 ---- a/tools/perf/Documentation/perf-stat.txt -+++ b/tools/perf/Documentation/perf-stat.txt -@@ -32,6 +32,10 @@ OPTIONS - - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a - hexadecimal event descriptor. - -+ - a symbolic or raw PMU event followed by an optional colon -+ and a list of event modifiers, e.g., cpu-cycles:p. See the -+ linkperf:perf-list[1] man page for details on event modifiers. -+ - - a symbolically formed event like 'pmu/param1=0x3,param2/' where - param1 and param2 are defined as formats for the PMU in - /sys/bus/event_sources/devices//format/* diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.236-237.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.236-237.patch deleted file mode 100644 index 9472d2063b..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.236-237.patch +++ /dev/null @@ -1,2002 +0,0 @@ -diff --git a/Makefile b/Makefile -index b954cb21fddc7..003334dad3c3f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 236 -+SUBLEVEL = 237 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi -index cce9e50acf68a..b648b1b253c5e 100644 ---- a/arch/arm/boot/dts/socfpga_arria10.dtsi -+++ b/arch/arm/boot/dts/socfpga_arria10.dtsi -@@ -652,7 +652,7 @@ - timer3: timer3@ffd00100 { - compatible = "snps,dw-apb-timer"; - interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>; -- reg = <0xffd01000 0x100>; -+ reg = <0xffd00100 0x100>; - clocks = <&l4_sys_free_clk>; - clock-names = "timer"; - }; -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 596cbda9cb3d3..9d8bc19edc48e 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -817,6 +817,7 @@ config SNI_RM - select I8253 - select I8259 - select ISA -+ select MIPS_L1_CACHE_SHIFT_6 - select SWAP_IO_SPACE if CPU_BIG_ENDIAN - select SYS_HAS_CPU_R4X00 - select SYS_HAS_CPU_R5000 -diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c -index f9407e1704762..c6af7047eb0d2 100644 ---- a/arch/mips/sni/a20r.c -+++ b/arch/mips/sni/a20r.c -@@ -143,7 +143,10 @@ static struct platform_device sc26xx_pdev = { - }, - }; - --static u32 a20r_ack_hwint(void) -+/* -+ * Trigger chipset to update CPU's CAUSE IP field -+ */ -+static u32 a20r_update_cause_ip(void) - { - u32 status = read_c0_status(); - -@@ -205,12 +208,14 @@ static void a20r_hwint(void) - int irq; - - clear_c0_status(IE_IRQ0); -- status = a20r_ack_hwint(); -+ status = a20r_update_cause_ip(); - cause = read_c0_cause(); - - irq = ffs(((cause & status) >> 8) & 0xf8); - if (likely(irq > 0)) - do_IRQ(SNI_A20R_IRQ_BASE + irq - 1); -+ -+ a20r_update_cause_ip(); - set_c0_status(IE_IRQ0); - } - -diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig -index 8f94782eb9071..dc57fa11c687f 100644 ---- a/arch/powerpc/configs/pasemi_defconfig -+++ b/arch/powerpc/configs/pasemi_defconfig -@@ -115,7 +115,6 @@ CONFIG_FB_NVIDIA=y - CONFIG_FB_NVIDIA_I2C=y - CONFIG_FB_RADEON=y - # CONFIG_LCD_CLASS_DEVICE is not set --CONFIG_VGACON_SOFT_SCROLLBACK=y - CONFIG_LOGO=y - CONFIG_SOUND=y - CONFIG_SND=y -diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig -index e5d2c3dc07f1d..c82bda4d27df3 100644 ---- a/arch/powerpc/configs/ppc6xx_defconfig -+++ b/arch/powerpc/configs/ppc6xx_defconfig -@@ -797,7 +797,6 @@ CONFIG_FB_TRIDENT=m - CONFIG_FB_SM501=m - CONFIG_FB_IBM_GXT4500=y - CONFIG_LCD_PLATFORM=m --CONFIG_VGACON_SOFT_SCROLLBACK=y - CONFIG_FRAMEBUFFER_CONSOLE=y - CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y - CONFIG_LOGO=y -diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c -index 41a7d9d49a5a3..3d3e8795e934f 100644 ---- a/arch/powerpc/kernel/dma-iommu.c -+++ b/arch/powerpc/kernel/dma-iommu.c -@@ -99,7 +99,8 @@ static u64 dma_iommu_get_required_mask(struct device *dev) - if (!tbl) - return 0; - -- mask = 1ULL < (fls_long(tbl->it_offset + tbl->it_size) - 1); -+ mask = 1ULL << (fls_long(tbl->it_offset + tbl->it_size) + -+ tbl->it_page_shift - 1); - mask += mask - 1; - - return mask; -diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig -index 028be48c88397..a628b2474e6d4 100644 ---- a/arch/x86/configs/i386_defconfig -+++ b/arch/x86/configs/i386_defconfig -@@ -218,7 +218,6 @@ CONFIG_FB_MODE_HELPERS=y - CONFIG_FB_TILEBLITTING=y - CONFIG_FB_EFI=y - # CONFIG_LCD_CLASS_DEVICE is not set --CONFIG_VGACON_SOFT_SCROLLBACK=y - CONFIG_LOGO=y - # CONFIG_LOGO_LINUX_MONO is not set - # CONFIG_LOGO_LINUX_VGA16 is not set -@@ -248,6 +247,7 @@ CONFIG_USB_HIDDEV=y - CONFIG_USB=y - CONFIG_USB_ANNOUNCE_NEW_DEVICES=y - CONFIG_USB_MON=y -+CONFIG_USB_XHCI_HCD=y - CONFIG_USB_EHCI_HCD=y - CONFIG_USB_EHCI_TT_NEWSCHED=y - CONFIG_USB_OHCI_HCD=y -diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig -index cb5b3ab5beecc..649f7d604b12a 100644 ---- a/arch/x86/configs/x86_64_defconfig -+++ b/arch/x86/configs/x86_64_defconfig -@@ -212,7 +212,6 @@ CONFIG_FB_MODE_HELPERS=y - CONFIG_FB_TILEBLITTING=y - CONFIG_FB_EFI=y - # CONFIG_LCD_CLASS_DEVICE is not set --CONFIG_VGACON_SOFT_SCROLLBACK=y - CONFIG_LOGO=y - # CONFIG_LOGO_LINUX_MONO is not set - # CONFIG_LOGO_LINUX_VGA16 is not set -@@ -242,6 +241,7 @@ CONFIG_USB_HIDDEV=y - CONFIG_USB=y - CONFIG_USB_ANNOUNCE_NEW_DEVICES=y - CONFIG_USB_MON=y -+CONFIG_USB_XHCI_HCD=y - CONFIG_USB_EHCI_HCD=y - CONFIG_USB_EHCI_TT_NEWSCHED=y - CONFIG_USB_OHCI_HCD=y -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 22da8f87bd641..6646edaa5123c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -8235,6 +8235,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) - (exit_reason != EXIT_REASON_EXCEPTION_NMI && - exit_reason != EXIT_REASON_EPT_VIOLATION && - exit_reason != EXIT_REASON_PML_FULL && -+ exit_reason != EXIT_REASON_APIC_ACCESS && - exit_reason != EXIT_REASON_TASK_SWITCH)) { - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV; -diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c -index 04b39d0da8681..70708608ab1e7 100644 ---- a/drivers/atm/firestream.c -+++ b/drivers/atm/firestream.c -@@ -1009,6 +1009,7 @@ static int fs_open(struct atm_vcc *atm_vcc) - error = make_rate (pcr, r, &tmc0, NULL); - if (error) { - kfree(tc); -+ kfree(vcc); - return error; - } - } -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index e0699a20859f7..445ca973edd6d 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -3945,6 +3945,9 @@ static ssize_t rbd_image_refresh(struct device *dev, - struct rbd_device *rbd_dev = dev_to_rbd_dev(dev); - int ret; - -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ - ret = rbd_dev_refresh(rbd_dev); - if (ret) - return ret; -@@ -5404,6 +5407,9 @@ static ssize_t do_rbd_add(struct bus_type *bus, - bool read_only; - int rc; - -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ - if (!try_module_get(THIS_MODULE)) - return -ENODEV; - -@@ -5548,6 +5554,9 @@ static ssize_t do_rbd_remove(struct bus_type *bus, - bool already = false; - int ret; - -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ - ret = kstrtoul(buf, 10, &ul); - if (ret) - return ret; -diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c -index 3a9db4626cb60..1886588b9ea3e 100644 ---- a/drivers/i2c/algos/i2c-algo-pca.c -+++ b/drivers/i2c/algos/i2c-algo-pca.c -@@ -50,8 +50,22 @@ static void pca_reset(struct i2c_algo_pca_data *adap) - pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IPRESET); - pca_outw(adap, I2C_PCA_IND, 0xA5); - pca_outw(adap, I2C_PCA_IND, 0x5A); -+ -+ /* -+ * After a reset we need to re-apply any configuration -+ * (calculated in pca_init) to get the bus in a working state. -+ */ -+ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IMODE); -+ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.mode); -+ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLL); -+ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.tlow); -+ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLH); -+ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.thi); -+ -+ pca_set_con(adap, I2C_PCA_CON_ENSIO); - } else { - adap->reset_chip(adap->data); -+ pca_set_con(adap, I2C_PCA_CON_ENSIO | adap->bus_settings.clock_freq); - } - } - -@@ -435,13 +449,14 @@ static int pca_init(struct i2c_adapter *adap) - " Use the nominal frequency.\n", adap->name); - } - -- pca_reset(pca_data); -- - clock = pca_clock(pca_data); - printk(KERN_INFO "%s: Clock frequency is %dkHz\n", - adap->name, freqs[clock]); - -- pca_set_con(pca_data, I2C_PCA_CON_ENSIO | clock); -+ /* Store settings as these will be needed when the PCA chip is reset */ -+ pca_data->bus_settings.clock_freq = clock; -+ -+ pca_reset(pca_data); - } else { - int clock; - int mode; -@@ -508,19 +523,15 @@ static int pca_init(struct i2c_adapter *adap) - thi = tlow * min_thi / min_tlow; - } - -+ /* Store settings as these will be needed when the PCA chip is reset */ -+ pca_data->bus_settings.mode = mode; -+ pca_data->bus_settings.tlow = tlow; -+ pca_data->bus_settings.thi = thi; -+ - pca_reset(pca_data); - - printk(KERN_INFO - "%s: Clock frequency is %dHz\n", adap->name, clock * 100); -- -- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_IMODE); -- pca_outw(pca_data, I2C_PCA_IND, mode); -- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLL); -- pca_outw(pca_data, I2C_PCA_IND, tlow); -- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLH); -- pca_outw(pca_data, I2C_PCA_IND, thi); -- -- pca_set_con(pca_data, I2C_PCA_CON_ENSIO); - } - udelay(500); /* 500 us for oscillator to stabilise */ - -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index ec7ddf8673497..e5e231b6476e7 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -198,6 +198,14 @@ struct bmc150_accel_data { - struct mutex mutex; - u8 fifo_mode, watermark; - s16 buffer[8]; -+ /* -+ * Ensure there is sufficient space and correct alignment for -+ * the timestamp if enabled -+ */ -+ struct { -+ __le16 channels[3]; -+ s64 ts __aligned(8); -+ } scan; - u8 bw_bits; - u32 slope_dur; - u32 slope_thres; -@@ -924,15 +932,16 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev, - * now. - */ - for (i = 0; i < count; i++) { -- u16 sample[8]; - int j, bit; - - j = 0; - for_each_set_bit(bit, indio_dev->active_scan_mask, - indio_dev->masklength) -- memcpy(&sample[j++], &buffer[i * 3 + bit], 2); -+ memcpy(&data->scan.channels[j++], &buffer[i * 3 + bit], -+ sizeof(data->scan.channels[0])); - -- iio_push_to_buffers_with_timestamp(indio_dev, sample, tstamp); -+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, -+ tstamp); - - tstamp += sample_period; - } -diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c -index 1eccc2dcf14cd..d44c1b3a131cf 100644 ---- a/drivers/iio/accel/mma8452.c -+++ b/drivers/iio/accel/mma8452.c -@@ -96,6 +96,12 @@ struct mma8452_data { - u8 ctrl_reg1; - u8 data_cfg; - const struct mma_chip_info *chip_info; -+ -+ /* Ensure correct alignment of time stamp when present */ -+ struct { -+ __be16 channels[3]; -+ s64 ts __aligned(8); -+ } buffer; - }; - - /** -@@ -700,14 +706,13 @@ static irqreturn_t mma8452_trigger_handler(int irq, void *p) - struct iio_poll_func *pf = p; - struct iio_dev *indio_dev = pf->indio_dev; - struct mma8452_data *data = iio_priv(indio_dev); -- u8 buffer[16]; /* 3 16-bit channels + padding + ts */ - int ret; - -- ret = mma8452_read(data, (__be16 *)buffer); -+ ret = mma8452_read(data, data->buffer.channels); - if (ret < 0) - goto done; - -- iio_push_to_buffers_with_timestamp(indio_dev, buffer, -+ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer, - iio_get_time_ns()); - - done: -diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c -index 3555122008b44..26fc1021a2c27 100644 ---- a/drivers/iio/adc/mcp3422.c -+++ b/drivers/iio/adc/mcp3422.c -@@ -98,16 +98,12 @@ static int mcp3422_update_config(struct mcp3422 *adc, u8 newconfig) - { - int ret; - -- mutex_lock(&adc->lock); -- - ret = i2c_master_send(adc->i2c, &newconfig, 1); - if (ret > 0) { - adc->config = newconfig; - ret = 0; - } - -- mutex_unlock(&adc->lock); -- - return ret; - } - -@@ -140,6 +136,8 @@ static int mcp3422_read_channel(struct mcp3422 *adc, - u8 config; - u8 req_channel = channel->channel; - -+ mutex_lock(&adc->lock); -+ - if (req_channel != MCP3422_CHANNEL(adc->config)) { - config = adc->config; - config &= ~MCP3422_CHANNEL_MASK; -@@ -147,12 +145,18 @@ static int mcp3422_read_channel(struct mcp3422 *adc, - config &= ~MCP3422_PGA_MASK; - config |= MCP3422_PGA_VALUE(adc->pga[req_channel]); - ret = mcp3422_update_config(adc, config); -- if (ret < 0) -+ if (ret < 0) { -+ mutex_unlock(&adc->lock); - return ret; -+ } - msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]); - } - -- return mcp3422_read(adc, value, &config); -+ ret = mcp3422_read(adc, value, &config); -+ -+ mutex_unlock(&adc->lock); -+ -+ return ret; - } - - static int mcp3422_read_raw(struct iio_dev *iio, -diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c -index b9d1e5c58ec54..9f5825f4fc0ee 100644 ---- a/drivers/iio/light/ltr501.c -+++ b/drivers/iio/light/ltr501.c -@@ -1218,13 +1218,16 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p) - struct iio_poll_func *pf = p; - struct iio_dev *indio_dev = pf->indio_dev; - struct ltr501_data *data = iio_priv(indio_dev); -- u16 buf[8]; -+ struct { -+ u16 channels[3]; -+ s64 ts __aligned(8); -+ } scan; - __le16 als_buf[2]; - u8 mask = 0; - int j = 0; - int ret, psdata; - -- memset(buf, 0, sizeof(buf)); -+ memset(&scan, 0, sizeof(scan)); - - /* figure out which data needs to be ready */ - if (test_bit(0, indio_dev->active_scan_mask) || -@@ -1243,9 +1246,9 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p) - if (ret < 0) - return ret; - if (test_bit(0, indio_dev->active_scan_mask)) -- buf[j++] = le16_to_cpu(als_buf[1]); -+ scan.channels[j++] = le16_to_cpu(als_buf[1]); - if (test_bit(1, indio_dev->active_scan_mask)) -- buf[j++] = le16_to_cpu(als_buf[0]); -+ scan.channels[j++] = le16_to_cpu(als_buf[0]); - } - - if (mask & LTR501_STATUS_PS_RDY) { -@@ -1253,10 +1256,10 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p) - &psdata, 2); - if (ret < 0) - goto done; -- buf[j++] = psdata & LTR501_PS_DATA_MASK; -+ scan.channels[j++] = psdata & LTR501_PS_DATA_MASK; - } - -- iio_push_to_buffers_with_timestamp(indio_dev, buf, iio_get_time_ns()); -+ iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns()); - - done: - iio_trigger_notify_done(indio_dev->trig); -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index bdc42923523e8..e5799639fb544 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -552,6 +552,14 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), - }, - }, -+ { -+ /* Entroware Proteus */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Entroware"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"), -+ }, -+ }, - { } - }; - -@@ -752,6 +760,14 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), - }, - }, -+ { -+ /* Entroware Proteus */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Entroware"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c -index 3f20808b5ff82..f8ed079d8bc3e 100644 ---- a/drivers/net/wan/hdlc_cisco.c -+++ b/drivers/net/wan/hdlc_cisco.c -@@ -377,6 +377,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr) - memcpy(&state(hdlc)->settings, &new_settings, size); - spin_lock_init(&state(hdlc)->lock); - dev->header_ops = &cisco_header_ops; -+ dev->hard_header_len = sizeof(struct hdlc_header); - dev->type = ARPHRD_CISCO; - netif_dormant_on(dev); - return 0; -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index 6eb0f7a85e531..c6db9a4e7c457 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) - - skb->dev = dev = lapbeth->ethdev; - -+ skb_reset_network_header(skb); -+ - dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0); - - dev_queue_xmit(skb); -@@ -343,6 +345,7 @@ static int lapbeth_new_device(struct net_device *dev) - */ - ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len - + dev->needed_headroom; -+ ndev->needed_tailroom = dev->needed_tailroom; - - lapbeth = netdev_priv(ndev); - lapbeth->axdev = ndev; -diff --git a/drivers/rapidio/Kconfig b/drivers/rapidio/Kconfig -index 3e3be57e9a1a1..4d0c1a40a6e65 100644 ---- a/drivers/rapidio/Kconfig -+++ b/drivers/rapidio/Kconfig -@@ -25,7 +25,7 @@ config RAPIDIO_ENABLE_RX_TX_PORTS - config RAPIDIO_DMA_ENGINE - bool "DMA Engine support for RapidIO" - depends on RAPIDIO -- select DMADEVICES -+ depends on DMADEVICES - select DMA_ENGINE - help - Say Y here if you want to use DMA Engine frameork for RapidIO data -diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c -index 6f5e2720ffad1..68b33abeaa5fa 100644 ---- a/drivers/scsi/libsas/sas_ata.c -+++ b/drivers/scsi/libsas/sas_ata.c -@@ -224,7 +224,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) - task->num_scatter = si; - } - -- task->data_dir = qc->dma_dir; -+ if (qc->tf.protocol == ATA_PROT_NODATA) -+ task->data_dir = DMA_NONE; -+ else -+ task->data_dir = qc->dma_dir; - task->scatter = qc->sg; - task->ata_task.retry_count = 1; - task->task_state_flags = SAS_TASK_STATE_PENDING; -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 315dd25a0c44e..5be938b47f48b 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3841,7 +3841,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - out: - if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { - spin_lock_irq(shost->host_lock); -- ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); -+ if (mbox) -+ ndlp->nlp_flag &= ~NLP_ACC_REGLOGIN; -+ ndlp->nlp_flag &= ~NLP_RM_DFLT_RPI; - spin_unlock_irq(shost->host_lock); - - /* If the node is not being used by another discovery thread, -diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c -index 3862d8b1defe3..ee6c941123e10 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.c -+++ b/drivers/scsi/pm8001/pm8001_sas.c -@@ -792,7 +792,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, - - res = pm8001_tag_alloc(pm8001_ha, &ccb_tag); - if (res) -- return res; -+ goto ex_err; - ccb = &pm8001_ha->ccb_info[ccb_tag]; - ccb->device = pm8001_dev; - ccb->ccb_tag = ccb_tag; -diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c -index 3903f681ef6c6..2772c7179a61f 100644 ---- a/drivers/staging/wlan-ng/hfa384x_usb.c -+++ b/drivers/staging/wlan-ng/hfa384x_usb.c -@@ -530,13 +530,8 @@ static void hfa384x_usb_defer(struct work_struct *data) - ----------------------------------------------------------------*/ - void hfa384x_create(hfa384x_t *hw, struct usb_device *usb) - { -- memset(hw, 0, sizeof(hfa384x_t)); - hw->usb = usb; - -- /* set up the endpoints */ -- hw->endp_in = usb_rcvbulkpipe(usb, 1); -- hw->endp_out = usb_sndbulkpipe(usb, 2); -- - /* Set up the waitq */ - init_waitqueue_head(&hw->cmdq); - -diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c -index 6da5c66bb3d5c..f4276943dc972 100644 ---- a/drivers/staging/wlan-ng/prism2usb.c -+++ b/drivers/staging/wlan-ng/prism2usb.c -@@ -60,23 +60,14 @@ static int prism2sta_probe_usb(struct usb_interface *interface, - const struct usb_device_id *id) - { - struct usb_device *dev; -- const struct usb_endpoint_descriptor *epd; -- const struct usb_host_interface *iface_desc = interface->cur_altsetting; -+ struct usb_endpoint_descriptor *bulk_in, *bulk_out; -+ struct usb_host_interface *iface_desc = interface->cur_altsetting; - wlandevice_t *wlandev = NULL; - hfa384x_t *hw = NULL; - int result = 0; - -- if (iface_desc->desc.bNumEndpoints != 2) { -- result = -ENODEV; -- goto failed; -- } -- -- result = -EINVAL; -- epd = &iface_desc->endpoint[1].desc; -- if (!usb_endpoint_is_bulk_in(epd)) -- goto failed; -- epd = &iface_desc->endpoint[2].desc; -- if (!usb_endpoint_is_bulk_out(epd)) -+ result = usb_find_common_endpoints(iface_desc, &bulk_in, &bulk_out, NULL, NULL); -+ if (result) - goto failed; - - dev = interface_to_usbdev(interface); -@@ -95,6 +86,8 @@ static int prism2sta_probe_usb(struct usb_interface *interface, - } - - /* Initialize the hw data */ -+ hw->endp_in = usb_rcvbulkpipe(dev, bulk_in->bEndpointAddress); -+ hw->endp_out = usb_sndbulkpipe(dev, bulk_out->bEndpointAddress); - hfa384x_create(hw, dev); - hw->wlandev = wlandev; - -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index 63e54beed196b..f10bcd0563c06 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -1139,7 +1139,7 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t) - } - - void iscsi_target_login_sess_out(struct iscsi_conn *conn, -- struct iscsi_np *np, bool zero_tsih, bool new_sess) -+ bool zero_tsih, bool new_sess) - { - if (!new_sess) - goto old_sess_out; -@@ -1161,7 +1161,6 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn, - conn->sess = NULL; - - old_sess_out: -- iscsi_stop_login_thread_timer(np); - /* - * If login negotiation fails check if the Time2Retain timer - * needs to be restarted. -@@ -1407,8 +1406,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - new_sess_out: - new_sess = true; - old_sess_out: -+ iscsi_stop_login_thread_timer(np); - tpg_np = conn->tpg_np; -- iscsi_target_login_sess_out(conn, np, zero_tsih, new_sess); -+ iscsi_target_login_sess_out(conn, zero_tsih, new_sess); - new_sess = false; - - if (tpg) { -diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h -index b597aa2c61a1c..e9daabbb4f545 100644 ---- a/drivers/target/iscsi/iscsi_target_login.h -+++ b/drivers/target/iscsi/iscsi_target_login.h -@@ -14,8 +14,7 @@ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32); - extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *); - extern int iscsit_start_kthreads(struct iscsi_conn *); - extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); --extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *, -- bool, bool); -+extern void iscsi_target_login_sess_out(struct iscsi_conn *, bool, bool); - extern int iscsi_target_login_thread(void *); - - #endif /*** ISCSI_TARGET_LOGIN_H ***/ -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 58c629aec73ca..31c3e37c41e52 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -547,12 +547,11 @@ static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned in - - static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login) - { -- struct iscsi_np *np = login->np; - bool zero_tsih = login->zero_tsih; - - iscsi_remove_failed_auth_entry(conn); - iscsi_target_nego_release(conn); -- iscsi_target_login_sess_out(conn, np, zero_tsih, true); -+ iscsi_target_login_sess_out(conn, zero_tsih, true); - } - - static void iscsi_target_login_timeout(unsigned long data) -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index b032add927224..72f6cde146b5c 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -5904,6 +5904,17 @@ static struct pci_device_id serial_pci_tbl[] = { - 0, - 0, pbn_exar_XR17V358 }, - -+ /* -+ * Realtek RealManage -+ */ -+ { PCI_VENDOR_ID_REALTEK, 0x816a, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, pbn_b0_1_115200 }, -+ -+ { PCI_VENDOR_ID_REALTEK, 0x816b, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, pbn_b0_1_115200 }, -+ - /* Fintek PCI serial cards */ - { PCI_DEVICE(0x1c29, 0x1104), .driver_data = pbn_fintek_4 }, - { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 }, -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index c578d64edc153..71c2ae4b81067 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -840,6 +840,11 @@ static ssize_t usblp_read(struct file *file, char __user *buffer, size_t len, lo - if (rv < 0) - return rv; - -+ if (!usblp->present) { -+ count = -ENODEV; -+ goto done; -+ } -+ - if ((avail = usblp->rstatus) < 0) { - printk(KERN_ERR "usblp%d: error %d reading from printer\n", - usblp->minor, (int)avail); -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index f083ecfddd1b1..e568325cb6e15 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -1141,6 +1141,34 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf, - } - } - -+/* -+ * usb_disable_device_endpoints -- Disable all endpoints for a device -+ * @dev: the device whose endpoints are being disabled -+ * @skip_ep0: 0 to disable endpoint 0, 1 to skip it. -+ */ -+static void usb_disable_device_endpoints(struct usb_device *dev, int skip_ep0) -+{ -+ struct usb_hcd *hcd = bus_to_hcd(dev->bus); -+ int i; -+ -+ if (hcd->driver->check_bandwidth) { -+ /* First pass: Cancel URBs, leave endpoint pointers intact. */ -+ for (i = skip_ep0; i < 16; ++i) { -+ usb_disable_endpoint(dev, i, false); -+ usb_disable_endpoint(dev, i + USB_DIR_IN, false); -+ } -+ /* Remove endpoints from the host controller internal state */ -+ mutex_lock(hcd->bandwidth_mutex); -+ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); -+ mutex_unlock(hcd->bandwidth_mutex); -+ } -+ /* Second pass: remove endpoint pointers */ -+ for (i = skip_ep0; i < 16; ++i) { -+ usb_disable_endpoint(dev, i, true); -+ usb_disable_endpoint(dev, i + USB_DIR_IN, true); -+ } -+} -+ - /** - * usb_disable_device - Disable all the endpoints for a USB device - * @dev: the device whose endpoints are being disabled -@@ -1200,22 +1227,8 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0) - - dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__, - skip_ep0 ? "non-ep0" : "all"); -- if (hcd->driver->check_bandwidth) { -- /* First pass: Cancel URBs, leave endpoint pointers intact. */ -- for (i = skip_ep0; i < 16; ++i) { -- usb_disable_endpoint(dev, i, false); -- usb_disable_endpoint(dev, i + USB_DIR_IN, false); -- } -- /* Remove endpoints from the host controller internal state */ -- mutex_lock(hcd->bandwidth_mutex); -- usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); -- mutex_unlock(hcd->bandwidth_mutex); -- /* Second pass: remove endpoint pointers */ -- } -- for (i = skip_ep0; i < 16; ++i) { -- usb_disable_endpoint(dev, i, true); -- usb_disable_endpoint(dev, i + USB_DIR_IN, true); -- } -+ -+ usb_disable_device_endpoints(dev, skip_ep0); - } - - /** -@@ -1458,6 +1471,9 @@ EXPORT_SYMBOL_GPL(usb_set_interface); - * The caller must own the device lock. - * - * Return: Zero on success, else a negative error code. -+ * -+ * If this routine fails the device will probably be in an unusable state -+ * with endpoints disabled, and interfaces only partially enabled. - */ - int usb_reset_configuration(struct usb_device *dev) - { -@@ -1473,10 +1489,7 @@ int usb_reset_configuration(struct usb_device *dev) - * calls during probe() are fine - */ - -- for (i = 1; i < 16; ++i) { -- usb_disable_endpoint(dev, i, true); -- usb_disable_endpoint(dev, i + USB_DIR_IN, true); -- } -+ usb_disable_device_endpoints(dev, 1); /* skip ep0*/ - - config = dev->actconfig; - retval = 0; -@@ -1489,34 +1502,10 @@ int usb_reset_configuration(struct usb_device *dev) - mutex_unlock(hcd->bandwidth_mutex); - return -ENOMEM; - } -- /* Make sure we have enough bandwidth for each alternate setting 0 */ -- for (i = 0; i < config->desc.bNumInterfaces; i++) { -- struct usb_interface *intf = config->interface[i]; -- struct usb_host_interface *alt; - -- alt = usb_altnum_to_altsetting(intf, 0); -- if (!alt) -- alt = &intf->altsetting[0]; -- if (alt != intf->cur_altsetting) -- retval = usb_hcd_alloc_bandwidth(dev, NULL, -- intf->cur_altsetting, alt); -- if (retval < 0) -- break; -- } -- /* If not, reinstate the old alternate settings */ -+ /* xHCI adds all endpoints in usb_hcd_alloc_bandwidth */ -+ retval = usb_hcd_alloc_bandwidth(dev, config, NULL, NULL); - if (retval < 0) { --reset_old_alts: -- for (i--; i >= 0; i--) { -- struct usb_interface *intf = config->interface[i]; -- struct usb_host_interface *alt; -- -- alt = usb_altnum_to_altsetting(intf, 0); -- if (!alt) -- alt = &intf->altsetting[0]; -- if (alt != intf->cur_altsetting) -- usb_hcd_alloc_bandwidth(dev, NULL, -- alt, intf->cur_altsetting); -- } - usb_enable_lpm(dev); - mutex_unlock(hcd->bandwidth_mutex); - return retval; -@@ -1525,8 +1514,12 @@ reset_old_alts: - USB_REQ_SET_CONFIGURATION, 0, - config->desc.bConfigurationValue, 0, - NULL, 0, USB_CTRL_SET_TIMEOUT); -- if (retval < 0) -- goto reset_old_alts; -+ if (retval < 0) { -+ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL); -+ usb_enable_lpm(dev); -+ mutex_unlock(hcd->bandwidth_mutex); -+ return retval; -+ } - mutex_unlock(hcd->bandwidth_mutex); - - /* re-init hc/hcd interface/endpoint state */ -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index eed7c8d8e3d4f..dd72e85f2e176 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -236,6 +236,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Generic RTL8153 based ethernet adapters */ - { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* SONiX USB DEVICE Touchpad */ -+ { USB_DEVICE(0x0c45, 0x7056), .driver_info = -+ USB_QUIRK_IGNORE_REMOTE_WAKEUP }, -+ - /* Action Semiconductor flash disk */ - { USB_DEVICE(0x10d6, 0x2200), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index 36e5098e4e6f6..415e9cf407ba5 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -76,6 +76,89 @@ MODULE_PARM_DESC(autosuspend, "default autosuspend delay"); - #endif - - -+/** -+ * usb_find_common_endpoints() -- look up common endpoint descriptors -+ * @alt: alternate setting to search -+ * @bulk_in: pointer to descriptor pointer, or NULL -+ * @bulk_out: pointer to descriptor pointer, or NULL -+ * @int_in: pointer to descriptor pointer, or NULL -+ * @int_out: pointer to descriptor pointer, or NULL -+ * -+ * Search the alternate setting's endpoint descriptors for the first bulk-in, -+ * bulk-out, interrupt-in and interrupt-out endpoints and return them in the -+ * provided pointers (unless they are NULL). -+ * -+ * If a requested endpoint is not found, the corresponding pointer is set to -+ * NULL. -+ * -+ * Return: Zero if all requested descriptors were found, or -ENXIO otherwise. -+ */ -+int usb_find_common_endpoints(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **bulk_in, -+ struct usb_endpoint_descriptor **bulk_out, -+ struct usb_endpoint_descriptor **int_in, -+ struct usb_endpoint_descriptor **int_out) -+{ -+ struct usb_endpoint_descriptor *epd; -+ int i; -+ -+ if (bulk_in) -+ *bulk_in = NULL; -+ if (bulk_out) -+ *bulk_out = NULL; -+ if (int_in) -+ *int_in = NULL; -+ if (int_out) -+ *int_out = NULL; -+ -+ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { -+ epd = &alt->endpoint[i].desc; -+ -+ switch (usb_endpoint_type(epd)) { -+ case USB_ENDPOINT_XFER_BULK: -+ if (usb_endpoint_dir_in(epd)) { -+ if (bulk_in && !*bulk_in) { -+ *bulk_in = epd; -+ break; -+ } -+ } else { -+ if (bulk_out && !*bulk_out) { -+ *bulk_out = epd; -+ break; -+ } -+ } -+ -+ continue; -+ case USB_ENDPOINT_XFER_INT: -+ if (usb_endpoint_dir_in(epd)) { -+ if (int_in && !*int_in) { -+ *int_in = epd; -+ break; -+ } -+ } else { -+ if (int_out && !*int_out) { -+ *int_out = epd; -+ break; -+ } -+ } -+ -+ continue; -+ default: -+ continue; -+ } -+ -+ if ((!bulk_in || *bulk_in) && -+ (!bulk_out || *bulk_out) && -+ (!int_in || *int_in) && -+ (!int_out || *int_out)) { -+ return 0; -+ } -+ } -+ -+ return -ENXIO; -+} -+EXPORT_SYMBOL_GPL(usb_find_common_endpoints); -+ - /** - * usb_find_alt_setting() - Given a configuration, find the alternate setting - * for the given interface. -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index f7661d9750fdc..330e05acf5f75 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c -index 086a7115d263c..4dc93547e9278 100644 ---- a/drivers/usb/host/ehci-hub.c -+++ b/drivers/usb/host/ehci-hub.c -@@ -27,7 +27,6 @@ - */ - - /*-------------------------------------------------------------------------*/ --#include - - #define PORT_WAKE_BITS (PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E) - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 0afea511eb376..25e76d4c15054 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -708,6 +708,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_MTIUSBCONVERTER_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, - { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 32a40ab9a3852..c33e06752b5f0 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -159,6 +159,7 @@ - #define XSENS_AWINDA_DONGLE_PID 0x0102 - #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ - #define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ -+#define XSENS_MTIUSBCONVERTER_PID 0x0301 /* MTi USB converter */ - #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ - - /* Xsens devices using FTDI VID */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 52b1092ed57ed..8cff50ef4fd14 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1808,6 +1808,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ - .driver_info = RSVD(7) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index 698ba127b6352..34dcd2e1b4fe9 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -646,8 +646,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd, - if (devinfo->resetting) { - cmnd->result = DID_ERROR << 16; - cmnd->scsi_done(cmnd); -- spin_unlock_irqrestore(&devinfo->lock, flags); -- return 0; -+ goto zombie; - } - - /* Find a free uas-tag */ -@@ -682,6 +681,16 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd, - cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB); - - err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC); -+ /* -+ * in case of fatal errors the SCSI layer is peculiar -+ * a command that has finished is a success for the purpose -+ * of queueing, no matter how fatal the error -+ */ -+ if (err == -ENODEV) { -+ cmnd->result = DID_ERROR << 16; -+ cmnd->scsi_done(cmnd); -+ goto zombie; -+ } - if (err) { - /* If we did nothing, give up now */ - if (cmdinfo->state & SUBMIT_STATUS_URB) { -@@ -692,6 +701,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd, - } - - devinfo->cmnd[idx] = cmnd; -+zombie: - spin_unlock_irqrestore(&devinfo->lock, flags); - return 0; - } -diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig -index 38da6e2991491..c31715019cb43 100644 ---- a/drivers/video/console/Kconfig -+++ b/drivers/video/console/Kconfig -@@ -22,31 +22,6 @@ config VGA_CONSOLE - - Say Y. - --config VGACON_SOFT_SCROLLBACK -- bool "Enable Scrollback Buffer in System RAM" -- depends on VGA_CONSOLE -- default n -- help -- The scrollback buffer of the standard VGA console is located in -- the VGA RAM. The size of this RAM is fixed and is quite small. -- If you require a larger scrollback buffer, this can be placed in -- System RAM which is dynamically allocated during initialization. -- Placing the scrollback buffer in System RAM will slightly slow -- down the console. -- -- If you want this feature, say 'Y' here and enter the amount of -- RAM to allocate for this buffer. If unsure, say 'N'. -- --config VGACON_SOFT_SCROLLBACK_SIZE -- int "Scrollback Buffer Size (in KB)" -- depends on VGACON_SOFT_SCROLLBACK -- range 1 1024 -- default "64" -- help -- Enter the amount of System RAM to allocate for the scrollback -- buffer. Each 64KB will give you approximately 16 80x25 -- screenfuls of scrollback buffer -- - config MDA_CONSOLE - depends on !M68K && !PARISC && ISA - tristate "MDA text console (dual-headed)" -diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c -index 05d1d36a56654..a7ab8323304da 100644 ---- a/drivers/video/console/bitblit.c -+++ b/drivers/video/console/bitblit.c -@@ -234,7 +234,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, - } - - static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg) -+ int fg, int bg) - { - struct fb_cursor cursor; - struct fbcon_ops *ops = info->fbcon_par; -@@ -247,15 +247,6 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode, - - cursor.set = 0; - -- if (softback_lines) { -- if (y + softback_lines >= vc->vc_rows) { -- mode = CM_ERASE; -- ops->cursor_flash = 0; -- return; -- } else -- y += softback_lines; -- } -- - c = scr_readw((u16 *) vc->vc_pos); - attribute = get_attribute(info, c); - src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height)); -diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c -index fe0663787b3c9..e57fa26bcff19 100644 ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -101,12 +101,6 @@ static int logo_lines; - /* logo_shown is an index to vc_cons when >= 0; otherwise follows FBCON_LOGO - enums. */ - static int logo_shown = FBCON_LOGO_CANSHOW; --/* Software scrollback */ --static int fbcon_softback_size = 32768; --static unsigned long softback_buf, softback_curr; --static unsigned long softback_in; --static unsigned long softback_top, softback_end; --static int softback_lines; - /* console mappings */ - static int first_fb_vc; - static int last_fb_vc = MAX_NR_CONSOLES - 1; -@@ -140,8 +134,6 @@ static int fbcon_has_sysfs; - - static const struct consw fb_con; - --#define CM_SOFTBACK (8) -- - #define advance_row(p, delta) (unsigned short *)((unsigned long)(p) + (delta) * vc->vc_size_row) - - static int fbcon_set_origin(struct vc_data *); -@@ -171,7 +163,6 @@ static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx, - static int fbcon_switch(struct vc_data *vc); - static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch); - static int fbcon_set_palette(struct vc_data *vc, unsigned char *table); --static int fbcon_scrolldelta(struct vc_data *vc, int lines); - - /* - * Internal routines -@@ -350,18 +341,6 @@ static int get_color(struct vc_data *vc, struct fb_info *info, - return color; - } - --static void fbcon_update_softback(struct vc_data *vc) --{ -- int l = fbcon_softback_size / vc->vc_size_row; -- -- if (l > 5) -- softback_end = softback_buf + l * vc->vc_size_row; -- else -- /* Smaller scrollback makes no sense, and 0 would screw -- the operation totally */ -- softback_top = 0; --} -- - static void fb_flashcursor(struct work_struct *work) - { - struct fb_info *info = container_of(work, struct fb_info, queue); -@@ -391,7 +370,7 @@ static void fb_flashcursor(struct work_struct *work) - c = scr_readw((u16 *) vc->vc_pos); - mode = (!ops->cursor_flash || ops->cursor_state.enable) ? - CM_ERASE : CM_DRAW; -- ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1), -+ ops->cursor(vc, info, mode, get_color(vc, info, c, 1), - get_color(vc, info, c, 0)); - console_unlock(); - } -@@ -451,13 +430,7 @@ static int __init fb_console_setup(char *this_opt) - } - - if (!strncmp(options, "scrollback:", 11)) { -- options += 11; -- if (*options) { -- fbcon_softback_size = simple_strtoul(options, &options, 0); -- if (*options == 'k' || *options == 'K') { -- fbcon_softback_size *= 1024; -- } -- } -+ pr_warn("Ignoring scrollback size option\n"); - continue; - } - -@@ -962,31 +935,6 @@ static const char *fbcon_startup(void) - p->con_rotate = initial_rotation; - set_blitting_type(vc, info); - -- if (info->fix.type != FB_TYPE_TEXT) { -- if (fbcon_softback_size) { -- if (!softback_buf) { -- softback_buf = -- (unsigned long) -- kmalloc(fbcon_softback_size, -- GFP_KERNEL); -- if (!softback_buf) { -- fbcon_softback_size = 0; -- softback_top = 0; -- } -- } -- } else { -- if (softback_buf) { -- kfree((void *) softback_buf); -- softback_buf = 0; -- softback_top = 0; -- } -- } -- if (softback_buf) -- softback_in = softback_top = softback_curr = -- softback_buf; -- softback_lines = 0; -- } -- - /* Setup default font */ - if (!p->fontdata && !vc->vc_font.data) { - if (!fontname[0] || !(font = find_font(fontname))) -@@ -1149,9 +1097,6 @@ static void fbcon_init(struct vc_data *vc, int init) - if (logo) - fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows); - -- if (vc == svc && softback_buf) -- fbcon_update_softback(vc); -- - if (ops->rotate_font && ops->rotate_font(info, vc)) { - ops->rotate = FB_ROTATE_UR; - set_blitting_type(vc, info); -@@ -1311,7 +1256,6 @@ static void fbcon_cursor(struct vc_data *vc, int mode) - { - struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; - struct fbcon_ops *ops = info->fbcon_par; -- int y; - int c = scr_readw((u16 *) vc->vc_pos); - - ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms); -@@ -1325,16 +1269,8 @@ static void fbcon_cursor(struct vc_data *vc, int mode) - fbcon_add_cursor_timer(info); - - ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1; -- if (mode & CM_SOFTBACK) { -- mode &= ~CM_SOFTBACK; -- y = softback_lines; -- } else { -- if (softback_lines) -- fbcon_set_origin(vc); -- y = 0; -- } - -- ops->cursor(vc, info, mode, y, get_color(vc, info, c, 1), -+ ops->cursor(vc, info, mode, get_color(vc, info, c, 1), - get_color(vc, info, c, 0)); - } - -@@ -1405,8 +1341,6 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, - - if (CON_IS_VISIBLE(vc)) { - update_screen(vc); -- if (softback_buf) -- fbcon_update_softback(vc); - } - } - -@@ -1544,99 +1478,6 @@ static __inline__ void ypan_down_redraw(struct vc_data *vc, int t, int count) - scrollback_current = 0; - } - --static void fbcon_redraw_softback(struct vc_data *vc, struct display *p, -- long delta) --{ -- int count = vc->vc_rows; -- unsigned short *d, *s; -- unsigned long n; -- int line = 0; -- -- d = (u16 *) softback_curr; -- if (d == (u16 *) softback_in) -- d = (u16 *) vc->vc_origin; -- n = softback_curr + delta * vc->vc_size_row; -- softback_lines -= delta; -- if (delta < 0) { -- if (softback_curr < softback_top && n < softback_buf) { -- n += softback_end - softback_buf; -- if (n < softback_top) { -- softback_lines -= -- (softback_top - n) / vc->vc_size_row; -- n = softback_top; -- } -- } else if (softback_curr >= softback_top -- && n < softback_top) { -- softback_lines -= -- (softback_top - n) / vc->vc_size_row; -- n = softback_top; -- } -- } else { -- if (softback_curr > softback_in && n >= softback_end) { -- n += softback_buf - softback_end; -- if (n > softback_in) { -- n = softback_in; -- softback_lines = 0; -- } -- } else if (softback_curr <= softback_in && n > softback_in) { -- n = softback_in; -- softback_lines = 0; -- } -- } -- if (n == softback_curr) -- return; -- softback_curr = n; -- s = (u16 *) softback_curr; -- if (s == (u16 *) softback_in) -- s = (u16 *) vc->vc_origin; -- while (count--) { -- unsigned short *start; -- unsigned short *le; -- unsigned short c; -- int x = 0; -- unsigned short attr = 1; -- -- start = s; -- le = advance_row(s, 1); -- do { -- c = scr_readw(s); -- if (attr != (c & 0xff00)) { -- attr = c & 0xff00; -- if (s > start) { -- fbcon_putcs(vc, start, s - start, -- line, x); -- x += s - start; -- start = s; -- } -- } -- if (c == scr_readw(d)) { -- if (s > start) { -- fbcon_putcs(vc, start, s - start, -- line, x); -- x += s - start + 1; -- start = s + 1; -- } else { -- x++; -- start++; -- } -- } -- s++; -- d++; -- } while (s < le); -- if (s > start) -- fbcon_putcs(vc, start, s - start, line, x); -- line++; -- if (d == (u16 *) softback_end) -- d = (u16 *) softback_buf; -- if (d == (u16 *) softback_in) -- d = (u16 *) vc->vc_origin; -- if (s == (u16 *) softback_end) -- s = (u16 *) softback_buf; -- if (s == (u16 *) softback_in) -- s = (u16 *) vc->vc_origin; -- } --} -- - static void fbcon_redraw_move(struct vc_data *vc, struct display *p, - int line, int count, int dy) - { -@@ -1776,31 +1617,6 @@ static void fbcon_redraw(struct vc_data *vc, struct display *p, - } - } - --static inline void fbcon_softback_note(struct vc_data *vc, int t, -- int count) --{ -- unsigned short *p; -- -- if (vc->vc_num != fg_console) -- return; -- p = (unsigned short *) (vc->vc_origin + t * vc->vc_size_row); -- -- while (count) { -- scr_memcpyw((u16 *) softback_in, p, vc->vc_size_row); -- count--; -- p = advance_row(p, 1); -- softback_in += vc->vc_size_row; -- if (softback_in == softback_end) -- softback_in = softback_buf; -- if (softback_in == softback_top) { -- softback_top += vc->vc_size_row; -- if (softback_top == softback_end) -- softback_top = softback_buf; -- } -- } -- softback_curr = softback_in; --} -- - static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir, - int count) - { -@@ -1823,8 +1639,6 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir, - case SM_UP: - if (count > vc->vc_rows) /* Maximum realistic size */ - count = vc->vc_rows; -- if (softback_top) -- fbcon_softback_note(vc, t, count); - if (logo_shown >= 0) - goto redraw_up; - switch (p->scrollmode) { -@@ -2129,7 +1943,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, - struct fb_var_screeninfo var = info->var; - int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; - -- if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { -+ if (p->userfont && FNTSIZE(vc->vc_font.data)) { - int size; - int pitch = PITCH(vc->vc_font.width); - -@@ -2195,14 +2009,6 @@ static int fbcon_switch(struct vc_data *vc) - info = registered_fb[con2fb_map[vc->vc_num]]; - ops = info->fbcon_par; - -- if (softback_top) { -- if (softback_lines) -- fbcon_set_origin(vc); -- softback_top = softback_curr = softback_in = softback_buf; -- softback_lines = 0; -- fbcon_update_softback(vc); -- } -- - if (logo_shown >= 0) { - struct vc_data *conp2 = vc_cons[logo_shown].d; - -@@ -2536,9 +2342,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, - int cnt; - char *old_data = NULL; - -- if (CON_IS_VISIBLE(vc) && softback_lines) -- fbcon_set_origin(vc); -- - resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); - if (p->userfont) - old_data = vc->vc_font.data; -@@ -2564,8 +2367,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, - cols /= w; - rows /= h; - vc_resize(vc, cols, rows); -- if (CON_IS_VISIBLE(vc) && softback_buf) -- fbcon_update_softback(vc); - } else if (CON_IS_VISIBLE(vc) - && vc->vc_mode == KD_TEXT) { - fbcon_clear_margins(vc, 0); -@@ -2723,19 +2524,7 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table) - - static u16 *fbcon_screen_pos(struct vc_data *vc, int offset) - { -- unsigned long p; -- int line; -- -- if (vc->vc_num != fg_console || !softback_lines) -- return (u16 *) (vc->vc_origin + offset); -- line = offset / vc->vc_size_row; -- if (line >= softback_lines) -- return (u16 *) (vc->vc_origin + offset - -- softback_lines * vc->vc_size_row); -- p = softback_curr + offset; -- if (p >= softback_end) -- p += softback_buf - softback_end; -- return (u16 *) p; -+ return (u16 *) (vc->vc_origin + offset); - } - - static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos, -@@ -2749,22 +2538,7 @@ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos, - - x = offset % vc->vc_cols; - y = offset / vc->vc_cols; -- if (vc->vc_num == fg_console) -- y += softback_lines; - ret = pos + (vc->vc_cols - x) * 2; -- } else if (vc->vc_num == fg_console && softback_lines) { -- unsigned long offset = pos - softback_curr; -- -- if (pos < softback_curr) -- offset += softback_end - softback_buf; -- offset /= 2; -- x = offset % vc->vc_cols; -- y = offset / vc->vc_cols; -- ret = pos + (vc->vc_cols - x) * 2; -- if (ret == softback_end) -- ret = softback_buf; -- if (ret == softback_in) -- ret = vc->vc_origin; - } else { - /* Should not happen */ - x = y = 0; -@@ -2792,107 +2566,11 @@ static void fbcon_invert_region(struct vc_data *vc, u16 * p, int cnt) - a = ((a) & 0x88ff) | (((a) & 0x7000) >> 4) | - (((a) & 0x0700) << 4); - scr_writew(a, p++); -- if (p == (u16 *) softback_end) -- p = (u16 *) softback_buf; -- if (p == (u16 *) softback_in) -- p = (u16 *) vc->vc_origin; - } - } - --static int fbcon_scrolldelta(struct vc_data *vc, int lines) --{ -- struct fb_info *info = registered_fb[con2fb_map[fg_console]]; -- struct fbcon_ops *ops = info->fbcon_par; -- struct display *disp = &fb_display[fg_console]; -- int offset, limit, scrollback_old; -- -- if (softback_top) { -- if (vc->vc_num != fg_console) -- return 0; -- if (vc->vc_mode != KD_TEXT || !lines) -- return 0; -- if (logo_shown >= 0) { -- struct vc_data *conp2 = vc_cons[logo_shown].d; -- -- if (conp2->vc_top == logo_lines -- && conp2->vc_bottom == conp2->vc_rows) -- conp2->vc_top = 0; -- if (logo_shown == vc->vc_num) { -- unsigned long p, q; -- int i; -- -- p = softback_in; -- q = vc->vc_origin + -- logo_lines * vc->vc_size_row; -- for (i = 0; i < logo_lines; i++) { -- if (p == softback_top) -- break; -- if (p == softback_buf) -- p = softback_end; -- p -= vc->vc_size_row; -- q -= vc->vc_size_row; -- scr_memcpyw((u16 *) q, (u16 *) p, -- vc->vc_size_row); -- } -- softback_in = softback_curr = p; -- update_region(vc, vc->vc_origin, -- logo_lines * vc->vc_cols); -- } -- logo_shown = FBCON_LOGO_CANSHOW; -- } -- fbcon_cursor(vc, CM_ERASE | CM_SOFTBACK); -- fbcon_redraw_softback(vc, disp, lines); -- fbcon_cursor(vc, CM_DRAW | CM_SOFTBACK); -- return 0; -- } -- -- if (!scrollback_phys_max) -- return -ENOSYS; -- -- scrollback_old = scrollback_current; -- scrollback_current -= lines; -- if (scrollback_current < 0) -- scrollback_current = 0; -- else if (scrollback_current > scrollback_max) -- scrollback_current = scrollback_max; -- if (scrollback_current == scrollback_old) -- return 0; -- -- if (fbcon_is_inactive(vc, info)) -- return 0; -- -- fbcon_cursor(vc, CM_ERASE); -- -- offset = disp->yscroll - scrollback_current; -- limit = disp->vrows; -- switch (disp->scrollmode) { -- case SCROLL_WRAP_MOVE: -- info->var.vmode |= FB_VMODE_YWRAP; -- break; -- case SCROLL_PAN_MOVE: -- case SCROLL_PAN_REDRAW: -- limit -= vc->vc_rows; -- info->var.vmode &= ~FB_VMODE_YWRAP; -- break; -- } -- if (offset < 0) -- offset += limit; -- else if (offset >= limit) -- offset -= limit; -- -- ops->var.xoffset = 0; -- ops->var.yoffset = offset * vc->vc_font.height; -- ops->update_start(info); -- -- if (!scrollback_current) -- fbcon_cursor(vc, CM_DRAW); -- return 0; --} -- - static int fbcon_set_origin(struct vc_data *vc) - { -- if (softback_lines) -- fbcon_scrolldelta(vc, softback_lines); - return 0; - } - -@@ -2956,8 +2634,6 @@ static void fbcon_modechanged(struct fb_info *info) - - fbcon_set_palette(vc, color_table); - update_screen(vc); -- if (softback_buf) -- fbcon_update_softback(vc); - } - } - -@@ -3378,7 +3054,6 @@ static const struct consw fb_con = { - .con_font_default = fbcon_set_def_font, - .con_font_copy = fbcon_copy_font, - .con_set_palette = fbcon_set_palette, -- .con_scrolldelta = fbcon_scrolldelta, - .con_set_origin = fbcon_set_origin, - .con_invert_region = fbcon_invert_region, - .con_screen_pos = fbcon_screen_pos, -@@ -3587,9 +3262,6 @@ static void fbcon_exit(void) - if (fbcon_has_exited) - return; - -- kfree((void *)softback_buf); -- softback_buf = 0UL; -- - for (i = 0; i < FB_MAX; i++) { - int pending = 0; - -diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h -index 7aaa4eabbba05..5ebdccd070eb8 100644 ---- a/drivers/video/console/fbcon.h -+++ b/drivers/video/console/fbcon.h -@@ -62,7 +62,7 @@ struct fbcon_ops { - void (*clear_margins)(struct vc_data *vc, struct fb_info *info, - int bottom_only); - void (*cursor)(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg); -+ int fg, int bg); - int (*update_start)(struct fb_info *info); - int (*rotate_font)(struct fb_info *info, struct vc_data *vc); - struct fb_var_screeninfo var; /* copy of the current fb_var_screeninfo */ -diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c -index 34da8bba9273a..5867027520058 100644 ---- a/drivers/video/console/fbcon_ccw.c -+++ b/drivers/video/console/fbcon_ccw.c -@@ -219,7 +219,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, - } - - static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg) -+ int fg, int bg) - { - struct fb_cursor cursor; - struct fbcon_ops *ops = info->fbcon_par; -@@ -236,15 +236,6 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode, - - cursor.set = 0; - -- if (softback_lines) { -- if (y + softback_lines >= vc->vc_rows) { -- mode = CM_ERASE; -- ops->cursor_flash = 0; -- return; -- } else -- y += softback_lines; -- } -- - c = scr_readw((u16 *) vc->vc_pos); - attribute = get_attribute(info, c); - src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width)); -diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c -index 0b552b3fc22ab..f5a1134049f83 100644 ---- a/drivers/video/console/fbcon_cw.c -+++ b/drivers/video/console/fbcon_cw.c -@@ -202,7 +202,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, - } - - static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg) -+ int fg, int bg) - { - struct fb_cursor cursor; - struct fbcon_ops *ops = info->fbcon_par; -@@ -219,15 +219,6 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode, - - cursor.set = 0; - -- if (softback_lines) { -- if (y + softback_lines >= vc->vc_rows) { -- mode = CM_ERASE; -- ops->cursor_flash = 0; -- return; -- } else -- y += softback_lines; -- } -- - c = scr_readw((u16 *) vc->vc_pos); - attribute = get_attribute(info, c); - src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width)); -diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c -index 7f62efe2da526..cf8dac9ca2bbf 100644 ---- a/drivers/video/console/fbcon_ud.c -+++ b/drivers/video/console/fbcon_ud.c -@@ -249,7 +249,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, - } - - static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg) -+ int fg, int bg) - { - struct fb_cursor cursor; - struct fbcon_ops *ops = info->fbcon_par; -@@ -267,15 +267,6 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode, - - cursor.set = 0; - -- if (softback_lines) { -- if (y + softback_lines >= vc->vc_rows) { -- mode = CM_ERASE; -- ops->cursor_flash = 0; -- return; -- } else -- y += softback_lines; -- } -- - c = scr_readw((u16 *) vc->vc_pos); - attribute = get_attribute(info, c); - src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height)); -diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c -index 15e8e1a89c45d..3c0b242dba5f0 100644 ---- a/drivers/video/console/tileblit.c -+++ b/drivers/video/console/tileblit.c -@@ -80,7 +80,7 @@ static void tile_clear_margins(struct vc_data *vc, struct fb_info *info, - } - - static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode, -- int softback_lines, int fg, int bg) -+ int fg, int bg) - { - struct fb_tilecursor cursor; - int use_sw = (vc->vc_cursor_type & 0x10); -diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c -index 283d335a759fe..1acdb41a8a7c3 100644 ---- a/drivers/video/fbdev/vga16fb.c -+++ b/drivers/video/fbdev/vga16fb.c -@@ -1122,7 +1122,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i - char oldop = setop(0); - char oldsr = setsr(0); - char oldmask = selectmask(); -- const char *cdat = image->data; -+ const unsigned char *cdat = image->data; - u32 dx = image->dx; - char __iomem *where; - int y; -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 91a45ef69152d..67366515a29d2 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2129,7 +2129,8 @@ static noinline int search_ioctl(struct inode *inode, - key.offset = sk->min_offset; - - while (1) { -- ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset); -+ ret = fault_in_pages_writeable(ubuf + sk_offset, -+ *buf_size - sk_offset); - if (ret) - break; - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index ca1702cefb852..64d15c2662db6 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -6171,7 +6171,12 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, - err = nfs4_set_lock_state(state, fl); - if (err != 0) - return err; -- err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); -+ do { -+ err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); -+ if (err != -NFS4ERR_DELAY) -+ break; -+ ssleep(1); -+ } while (err == -NFS4ERR_DELAY); - return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err); - } - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index 445a3f2f871fb..da8747b870df3 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -514,8 +514,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args) - ASSERT(ifp->if_flags & XFS_IFINLINE); - } - xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK); -- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data; -- hdr->count = 0; -+ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data; -+ memset(hdr, 0, sizeof(*hdr)); - hdr->totsize = cpu_to_be16(sizeof(*hdr)); - xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA); - } -diff --git a/include/linux/i2c-algo-pca.h b/include/linux/i2c-algo-pca.h -index a3c3ecd59f08c..7a43afd273655 100644 ---- a/include/linux/i2c-algo-pca.h -+++ b/include/linux/i2c-algo-pca.h -@@ -52,6 +52,20 @@ - #define I2C_PCA_CON_SI 0x08 /* Serial Interrupt */ - #define I2C_PCA_CON_CR 0x07 /* Clock Rate (MASK) */ - -+/** -+ * struct pca_i2c_bus_settings - The configured PCA i2c bus settings -+ * @mode: Configured i2c bus mode -+ * @tlow: Configured SCL LOW period -+ * @thi: Configured SCL HIGH period -+ * @clock_freq: The configured clock frequency -+ */ -+struct pca_i2c_bus_settings { -+ int mode; -+ int tlow; -+ int thi; -+ int clock_freq; -+}; -+ - struct i2c_algo_pca_data { - void *data; /* private low level data */ - void (*write_byte) (void *data, int reg, int val); -@@ -63,6 +77,7 @@ struct i2c_algo_pca_data { - * For PCA9665, use the frequency you want here. */ - unsigned int i2c_clock; - unsigned int chip; -+ struct pca_i2c_bus_settings bus_settings; - }; - - int i2c_pca_add_bus(struct i2c_adapter *); -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 55ea5d625cdf3..6ea595997df25 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -97,6 +97,41 @@ enum usb_interface_condition { - USB_INTERFACE_UNBINDING, - }; - -+int __must_check -+usb_find_common_endpoints(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **bulk_in, -+ struct usb_endpoint_descriptor **bulk_out, -+ struct usb_endpoint_descriptor **int_in, -+ struct usb_endpoint_descriptor **int_out); -+ -+static inline int __must_check -+usb_find_bulk_in_endpoint(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **bulk_in) -+{ -+ return usb_find_common_endpoints(alt, bulk_in, NULL, NULL, NULL); -+} -+ -+static inline int __must_check -+usb_find_bulk_out_endpoint(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **bulk_out) -+{ -+ return usb_find_common_endpoints(alt, NULL, bulk_out, NULL, NULL); -+} -+ -+static inline int __must_check -+usb_find_int_in_endpoint(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **int_in) -+{ -+ return usb_find_common_endpoints(alt, NULL, NULL, int_in, NULL); -+} -+ -+static inline int __must_check -+usb_find_int_out_endpoint(struct usb_host_interface *alt, -+ struct usb_endpoint_descriptor **int_out) -+{ -+ return usb_find_common_endpoints(alt, NULL, NULL, NULL, int_out); -+} -+ - /** - * struct usb_interface - what usb device drivers talk to - * @altsetting: array of interface structures, one for each alternate -diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c -index 46a18e72bce61..6d5ef6220afe7 100644 ---- a/kernel/gcov/gcc_4_7.c -+++ b/kernel/gcov/gcc_4_7.c -@@ -18,7 +18,9 @@ - #include - #include "gcov.h" - --#if (__GNUC__ >= 7) -+#if (__GNUC__ >= 10) -+#define GCOV_COUNTERS 8 -+#elif (__GNUC__ >= 7) - #define GCOV_COUNTERS 9 - #elif (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1) - #define GCOV_COUNTERS 10 -diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c -index c89626b2afffb..696381a516341 100644 ---- a/net/sunrpc/rpcb_clnt.c -+++ b/net/sunrpc/rpcb_clnt.c -@@ -977,8 +977,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr, - p = xdr_inline_decode(xdr, len); - if (unlikely(p == NULL)) - goto out_fail; -- dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid, -- req->rq_task->tk_msg.rpc_proc->p_name, (char *)p); -+ dprintk("RPC: %5u RPCB_%s reply: %*pE\n", req->rq_task->tk_pid, -+ req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p); - - if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len, - sap, sizeof(address)) == 0) -diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c -index e361024eabb63..020ec48f39048 100644 ---- a/sound/hda/hdac_device.c -+++ b/sound/hda/hdac_device.c -@@ -123,6 +123,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init); - void snd_hdac_device_exit(struct hdac_device *codec) - { - pm_runtime_put_noidle(&codec->dev); -+ /* keep balance of runtime PM child_count in parent device */ -+ pm_runtime_set_suspended(&codec->dev); - snd_hdac_bus_remove_device(codec->bus, codec); - kfree(codec->vendor_name); - kfree(codec->chip_name); -diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c -index b776831ceeeac..4ca6d4dc86612 100644 ---- a/tools/perf/tests/pmu.c -+++ b/tools/perf/tests/pmu.c -@@ -169,6 +169,7 @@ int test__pmu(void) - ret = 0; - } while (0); - -+ perf_pmu__del_formats(&formats); - test_format_dir_put(format); - return ret; - } -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index 5245fbd091067..8d99b6d9c36ae 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -921,6 +921,17 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to) - set_bit(b, bits); - } - -+void perf_pmu__del_formats(struct list_head *formats) -+{ -+ struct perf_pmu_format *fmt, *tmp; -+ -+ list_for_each_entry_safe(fmt, tmp, formats, list) { -+ list_del(&fmt->list); -+ free(fmt->name); -+ free(fmt); -+ } -+} -+ - static int sub_non_neg(int a, int b) - { - if (b > a) -diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h -index 5d7e84466bee5..6789b1efc7d6e 100644 ---- a/tools/perf/util/pmu.h -+++ b/tools/perf/util/pmu.h -@@ -66,6 +66,7 @@ int perf_pmu__new_format(struct list_head *list, char *name, - int config, unsigned long *bits); - void perf_pmu__set_format(unsigned long *bits, long from, long to); - int perf_pmu__format_parse(char *dir, struct list_head *head); -+void perf_pmu__del_formats(struct list_head *formats); - - struct perf_pmu *perf_pmu__scan(struct perf_pmu *pmu); - diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.237-238.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.237-238.patch deleted file mode 100644 index feef36622e..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.237-238.patch +++ /dev/null @@ -1,2701 +0,0 @@ -diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl -index d7fcdc5a43792..9b55778ab024f 100644 ---- a/Documentation/DocBook/libata.tmpl -+++ b/Documentation/DocBook/libata.tmpl -@@ -324,7 +324,7 @@ Many legacy IDE drivers use ata_bmdma_status() as the bmdma_status() hook. - - High-level taskfile hooks - --void (*qc_prep) (struct ata_queued_cmd *qc); -+enum ata_completion_errors (*qc_prep) (struct ata_queued_cmd *qc); - int (*qc_issue) (struct ata_queued_cmd *qc); - - -diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt -index e045e90a0924b..0f03b8228d080 100644 ---- a/Documentation/devicetree/bindings/sound/wm8994.txt -+++ b/Documentation/devicetree/bindings/sound/wm8994.txt -@@ -14,9 +14,15 @@ Required properties: - - #gpio-cells : Must be 2. The first cell is the pin number and the - second cell is used to specify optional parameters (currently unused). - -- - AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, CPVDD-supply, -- SPKVDD1-supply, SPKVDD2-supply : power supplies for the device, as covered -- in Documentation/devicetree/bindings/regulator/regulator.txt -+ - power supplies for the device, as covered in -+ Documentation/devicetree/bindings/regulator/regulator.txt, depending -+ on compatible: -+ - for wlf,wm1811 and wlf,wm8958: -+ AVDD1-supply, AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, -+ DCVDD-supply, CPVDD-supply, SPKVDD1-supply, SPKVDD2-supply -+ - for wlf,wm8994: -+ AVDD1-supply, AVDD2-supply, DBVDD-supply, DCVDD-supply, CPVDD-supply, -+ SPKVDD1-supply, SPKVDD2-supply - - Optional properties: - -@@ -68,11 +74,11 @@ codec: wm8994@1a { - - lineout1-se; - -+ AVDD1-supply = <®ulator>; - AVDD2-supply = <®ulator>; - CPVDD-supply = <®ulator>; -- DBVDD1-supply = <®ulator>; -- DBVDD2-supply = <®ulator>; -- DBVDD3-supply = <®ulator>; -+ DBVDD-supply = <®ulator>; -+ DCVDD-supply = <®ulator>; - SPKVDD1-supply = <®ulator>; - SPKVDD2-supply = <®ulator>; - }; -diff --git a/Makefile b/Makefile -index 003334dad3c3f..209fe98a591cd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 237 -+SUBLEVEL = 238 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c -index e90fe903613ea..4e5f04d333188 100644 ---- a/arch/m68k/q40/config.c -+++ b/arch/m68k/q40/config.c -@@ -303,6 +303,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll) - { - int tmp = Q40_RTC_CTRL; - -+ pll->pll_ctrl = 0; - pll->pll_value = tmp & Q40_RTC_PLL_MASK; - if (tmp & Q40_RTC_PLL_SIGN) - pll->pll_value = -pll->pll_value; -diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h -index abee2bfd10dc1..cea0bbb71590f 100644 ---- a/arch/mips/include/asm/cpu-type.h -+++ b/arch/mips/include/asm/cpu-type.h -@@ -46,6 +46,7 @@ static inline int __pure __get_cpu_type(const int cpu_type) - case CPU_34K: - case CPU_1004K: - case CPU_74K: -+ case CPU_1074K: - case CPU_M14KC: - case CPU_M14KEC: - case CPU_INTERAPTIV: -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index 47692c78d09c5..fdc5e76e1f6b0 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -513,7 +513,7 @@ static struct notifier_block kdump_mem_nb = { - /* - * Make sure that the area behind memory_end is protected - */ --static void reserve_memory_end(void) -+static void __init reserve_memory_end(void) - { - #ifdef CONFIG_CRASH_DUMP - if (ipl_info.type == IPL_TYPE_FCP_DUMP && -@@ -531,7 +531,7 @@ static void reserve_memory_end(void) - /* - * Make sure that oldmem, where the dump is stored, is protected - */ --static void reserve_oldmem(void) -+static void __init reserve_oldmem(void) - { - #ifdef CONFIG_CRASH_DUMP - if (OLDMEM_BASE) -@@ -543,7 +543,7 @@ static void reserve_oldmem(void) - /* - * Make sure that oldmem, where the dump is stored, is protected - */ --static void remove_oldmem(void) -+static void __init remove_oldmem(void) - { - #ifdef CONFIG_CRASH_DUMP - if (OLDMEM_BASE) -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index 664e8505ccd63..2f84887e8934c 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -275,7 +275,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear); - * combination with microcode which triggers a CPU buffer flush when the - * instruction is executed. - */ --static inline void mds_clear_cpu_buffers(void) -+static __always_inline void mds_clear_cpu_buffers(void) - { - static const u16 ds = __KERNEL_DS; - -@@ -296,7 +296,7 @@ static inline void mds_clear_cpu_buffers(void) - * - * Clear CPU buffers if the corresponding static key is enabled - */ --static inline void mds_user_clear_cpu_buffers(void) -+static __always_inline void mds_user_clear_cpu_buffers(void) - { - if (static_branch_likely(&mds_user_clear)) - mds_clear_cpu_buffers(); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 61fc92f92e0a0..ef920da075184 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -4013,10 +4013,13 @@ long kvm_arch_vm_ioctl(struct file *filp, - r = -EFAULT; - if (copy_from_user(&u.ps, argp, sizeof u.ps)) - goto out; -+ mutex_lock(&kvm->lock); - r = -ENXIO; - if (!kvm->arch.vpit) -- goto out; -+ goto set_pit_out; - r = kvm_vm_ioctl_set_pit(kvm, &u.ps); -+set_pit_out: -+ mutex_unlock(&kvm->lock); - break; - } - case KVM_GET_PIT2: { -@@ -4036,10 +4039,13 @@ long kvm_arch_vm_ioctl(struct file *filp, - r = -EFAULT; - if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) - goto out; -+ mutex_lock(&kvm->lock); - r = -ENXIO; - if (!kvm->arch.vpit) -- goto out; -+ goto set_pit2_out; - r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2); -+set_pit2_out: -+ mutex_unlock(&kvm->lock); - break; - } - case KVM_REINJECT_CONTROL: { -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 43f20328f830e..3096c087b7328 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -943,29 +943,21 @@ void acpi_ec_unblock_transactions_early(void) - /* -------------------------------------------------------------------------- - Event Management - -------------------------------------------------------------------------- */ --static struct acpi_ec_query_handler * --acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler) --{ -- if (handler) -- kref_get(&handler->kref); -- return handler; --} -- - static struct acpi_ec_query_handler * - acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value) - { - struct acpi_ec_query_handler *handler; -- bool found = false; - - mutex_lock(&ec->mutex); - list_for_each_entry(handler, &ec->list, node) { - if (value == handler->query_bit) { -- found = true; -- break; -+ kref_get(&handler->kref); -+ mutex_unlock(&ec->mutex); -+ return handler; - } - } - mutex_unlock(&ec->mutex); -- return found ? acpi_ec_get_query_handler(handler) : NULL; -+ return NULL; - } - - static void acpi_ec_query_handler_release(struct kref *kref) -diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c -index ed6a30cd681a0..98581ae397c12 100644 ---- a/drivers/ata/acard-ahci.c -+++ b/drivers/ata/acard-ahci.c -@@ -72,7 +72,7 @@ struct acard_sg { - __le32 size; /* bit 31 (EOT) max==0x10000 (64k) */ - }; - --static void acard_ahci_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc); - static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc); - static int acard_ahci_port_start(struct ata_port *ap); - static int acard_ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); -@@ -257,7 +257,7 @@ static unsigned int acard_ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl) - return si; - } - --static void acard_ahci_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct ahci_port_priv *pp = ap->private_data; -@@ -295,6 +295,8 @@ static void acard_ahci_qc_prep(struct ata_queued_cmd *qc) - opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH; - - ahci_fill_cmd_slot(pp, qc->tag, opts); -+ -+ return AC_ERR_OK; - } - - static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index 1241cecfcfcad..48338da2ecdfa 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -71,7 +71,7 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val); - static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc); - static int ahci_port_start(struct ata_port *ap); - static void ahci_port_stop(struct ata_port *ap); --static void ahci_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc); - static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc); - static void ahci_freeze(struct ata_port *ap); - static void ahci_thaw(struct ata_port *ap); -@@ -1535,7 +1535,7 @@ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc) - return sata_pmp_qc_defer_cmd_switch(qc); - } - --static void ahci_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct ahci_port_priv *pp = ap->private_data; -@@ -1571,6 +1571,8 @@ static void ahci_qc_prep(struct ata_queued_cmd *qc) - opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH; - - ahci_fill_cmd_slot(pp, qc->tag, opts); -+ -+ return AC_ERR_OK; - } - - static void ahci_fbs_dec_intr(struct ata_port *ap) -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 17cebfe5acc82..8ed3f6d75ff13 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4713,7 +4713,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc) - return ATA_DEFER_LINK; - } - --void ata_noop_qc_prep(struct ata_queued_cmd *qc) { } -+enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc) -+{ -+ return AC_ERR_OK; -+} - - /** - * ata_sg_init - Associate command with scatter-gather table. -@@ -5126,7 +5129,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc) - return; - } - -- ap->ops->qc_prep(qc); -+ qc->err_mask |= ap->ops->qc_prep(qc); -+ if (unlikely(qc->err_mask)) -+ goto err; - trace_ata_qc_issue(qc); - qc->err_mask |= ap->ops->qc_issue(qc); - if (unlikely(qc->err_mask)) -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 1d8901fc0bfa9..0c69bc1d30c62 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -2741,12 +2741,14 @@ static void ata_bmdma_fill_sg_dumb(struct ata_queued_cmd *qc) - * LOCKING: - * spin_lock_irqsave(host lock) - */ --void ata_bmdma_qc_prep(struct ata_queued_cmd *qc) -+enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc) - { - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - ata_bmdma_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep); - -@@ -2759,12 +2761,14 @@ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep); - * LOCKING: - * spin_lock_irqsave(host lock) - */ --void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc) -+enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc) - { - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - ata_bmdma_fill_sg_dumb(qc); -+ -+ return AC_ERR_OK; - } - EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep); - -diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c -index e3d4b059fcd14..f1a20d1a65be0 100644 ---- a/drivers/ata/pata_macio.c -+++ b/drivers/ata/pata_macio.c -@@ -507,7 +507,7 @@ static int pata_macio_cable_detect(struct ata_port *ap) - return ATA_CBL_PATA40; - } - --static void pata_macio_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc) - { - unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE); - struct ata_port *ap = qc->ap; -@@ -520,7 +520,7 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc) - __func__, qc, qc->flags, write, qc->dev->devno); - - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - table = (struct dbdma_cmd *) priv->dma_table_cpu; - -@@ -565,6 +565,8 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc) - table->command = cpu_to_le16(DBDMA_STOP); - - dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi); -+ -+ return AC_ERR_OK; - } - - -diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c -index f6c46e9a4dc0f..d7186a503e358 100644 ---- a/drivers/ata/pata_pxa.c -+++ b/drivers/ata/pata_pxa.c -@@ -59,25 +59,27 @@ static void pxa_ata_dma_irq(void *d) - /* - * Prepare taskfile for submission. - */ --static void pxa_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors pxa_qc_prep(struct ata_queued_cmd *qc) - { - struct pata_pxa_data *pd = qc->ap->private_data; - struct dma_async_tx_descriptor *tx; - enum dma_transfer_direction dir; - - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - dir = (qc->dma_dir == DMA_TO_DEVICE ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM); - tx = dmaengine_prep_slave_sg(pd->dma_chan, qc->sg, qc->n_elem, dir, - DMA_PREP_INTERRUPT); - if (!tx) { - ata_dev_err(qc->dev, "prep_slave_sg() failed\n"); -- return; -+ return AC_ERR_OK; - } - tx->callback = pxa_ata_dma_irq; - tx->callback_param = pd; - pd->dma_cookie = dmaengine_submit(tx); -+ -+ return AC_ERR_OK; - } - - /* -diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c -index 64d682c6ee57e..11da13bea2c93 100644 ---- a/drivers/ata/pdc_adma.c -+++ b/drivers/ata/pdc_adma.c -@@ -132,7 +132,7 @@ static int adma_ata_init_one(struct pci_dev *pdev, - const struct pci_device_id *ent); - static int adma_port_start(struct ata_port *ap); - static void adma_port_stop(struct ata_port *ap); --static void adma_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc); - static unsigned int adma_qc_issue(struct ata_queued_cmd *qc); - static int adma_check_atapi_dma(struct ata_queued_cmd *qc); - static void adma_freeze(struct ata_port *ap); -@@ -311,7 +311,7 @@ static int adma_fill_sg(struct ata_queued_cmd *qc) - return i; - } - --static void adma_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc) - { - struct adma_port_priv *pp = qc->ap->private_data; - u8 *buf = pp->pkt; -@@ -322,7 +322,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc) - - adma_enter_reg_mode(qc->ap); - if (qc->tf.protocol != ATA_PROT_DMA) -- return; -+ return AC_ERR_OK; - - buf[i++] = 0; /* Response flags */ - buf[i++] = 0; /* reserved */ -@@ -387,6 +387,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc) - printk("%s\n", obuf); - } - #endif -+ return AC_ERR_OK; - } - - static inline void adma_packet_start(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c -index a723ae9297831..100b5a3621ef3 100644 ---- a/drivers/ata/sata_fsl.c -+++ b/drivers/ata/sata_fsl.c -@@ -513,7 +513,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc, - return num_prde; - } - --static void sata_fsl_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors sata_fsl_qc_prep(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct sata_fsl_port_priv *pp = ap->private_data; -@@ -559,6 +559,8 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc) - - VPRINTK("SATA FSL : xx_qc_prep, di = 0x%x, ttl = %d, num_prde = %d\n", - desc_info, ttl_dwords, num_prde); -+ -+ return AC_ERR_OK; - } - - static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c -index e81a8217f1ff7..349a175f02675 100644 ---- a/drivers/ata/sata_inic162x.c -+++ b/drivers/ata/sata_inic162x.c -@@ -472,7 +472,7 @@ static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc) - prd[-1].flags |= PRD_END; - } - --static void inic_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc) - { - struct inic_port_priv *pp = qc->ap->private_data; - struct inic_pkt *pkt = pp->pkt; -@@ -532,6 +532,8 @@ static void inic_qc_prep(struct ata_queued_cmd *qc) - inic_fill_sg(prd, qc); - - pp->cpb_tbl[0] = pp->pkt_dma; -+ -+ return AC_ERR_OK; - } - - static unsigned int inic_qc_issue(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c -index 729f26322095e..5718dc94c90cb 100644 ---- a/drivers/ata/sata_mv.c -+++ b/drivers/ata/sata_mv.c -@@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val) - static int mv_port_start(struct ata_port *ap); - static void mv_port_stop(struct ata_port *ap); - static int mv_qc_defer(struct ata_queued_cmd *qc); --static void mv_qc_prep(struct ata_queued_cmd *qc); --static void mv_qc_prep_iie(struct ata_queued_cmd *qc); -+static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc); - static unsigned int mv_qc_issue(struct ata_queued_cmd *qc); - static int mv_hardreset(struct ata_link *link, unsigned int *class, - unsigned long deadline); -@@ -2046,7 +2046,7 @@ static void mv_rw_multi_errata_sata24(struct ata_queued_cmd *qc) - * LOCKING: - * Inherited from caller. - */ --static void mv_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct mv_port_priv *pp = ap->private_data; -@@ -2058,15 +2058,15 @@ static void mv_qc_prep(struct ata_queued_cmd *qc) - switch (tf->protocol) { - case ATA_PROT_DMA: - if (tf->command == ATA_CMD_DSM) -- return; -+ return AC_ERR_OK; - /* fall-thru */ - case ATA_PROT_NCQ: - break; /* continue below */ - case ATA_PROT_PIO: - mv_rw_multi_errata_sata24(qc); -- return; -+ return AC_ERR_OK; - default: -- return; -+ return AC_ERR_OK; - } - - /* Fill in command request block -@@ -2113,12 +2113,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc) - * non-NCQ mode are: [RW] STREAM DMA and W DMA FUA EXT, none - * of which are defined/used by Linux. If we get here, this - * driver needs work. -- * -- * FIXME: modify libata to give qc_prep a return value and -- * return error here. - */ -- BUG_ON(tf->command); -- break; -+ ata_port_err(ap, "%s: unsupported command: %.2x\n", __func__, -+ tf->command); -+ return AC_ERR_INVALID; - } - mv_crqb_pack_cmd(cw++, tf->nsect, ATA_REG_NSECT, 0); - mv_crqb_pack_cmd(cw++, tf->hob_lbal, ATA_REG_LBAL, 0); -@@ -2131,8 +2129,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc) - mv_crqb_pack_cmd(cw++, tf->command, ATA_REG_CMD, 1); /* last */ - - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - mv_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - - /** -@@ -2147,7 +2147,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc) - * LOCKING: - * Inherited from caller. - */ --static void mv_qc_prep_iie(struct ata_queued_cmd *qc) -+static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct mv_port_priv *pp = ap->private_data; -@@ -2158,9 +2158,9 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc) - - if ((tf->protocol != ATA_PROT_DMA) && - (tf->protocol != ATA_PROT_NCQ)) -- return; -+ return AC_ERR_OK; - if (tf->command == ATA_CMD_DSM) -- return; /* use bmdma for this */ -+ return AC_ERR_OK; /* use bmdma for this */ - - /* Fill in Gen IIE command request block */ - if (!(tf->flags & ATA_TFLAG_WRITE)) -@@ -2201,8 +2201,10 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc) - ); - - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - mv_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - - /** -diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c -index 734f563b8d37b..bb098c4ae1775 100644 ---- a/drivers/ata/sata_nv.c -+++ b/drivers/ata/sata_nv.c -@@ -313,7 +313,7 @@ static void nv_ck804_freeze(struct ata_port *ap); - static void nv_ck804_thaw(struct ata_port *ap); - static int nv_adma_slave_config(struct scsi_device *sdev); - static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc); --static void nv_adma_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc); - static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc); - static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance); - static void nv_adma_irq_clear(struct ata_port *ap); -@@ -335,7 +335,7 @@ static void nv_mcp55_freeze(struct ata_port *ap); - static void nv_swncq_error_handler(struct ata_port *ap); - static int nv_swncq_slave_config(struct scsi_device *sdev); - static int nv_swncq_port_start(struct ata_port *ap); --static void nv_swncq_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc); - static void nv_swncq_fill_sg(struct ata_queued_cmd *qc); - static unsigned int nv_swncq_qc_issue(struct ata_queued_cmd *qc); - static void nv_swncq_irq_clear(struct ata_port *ap, u16 fis); -@@ -1382,7 +1382,7 @@ static int nv_adma_use_reg_mode(struct ata_queued_cmd *qc) - return 1; - } - --static void nv_adma_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc) - { - struct nv_adma_port_priv *pp = qc->ap->private_data; - struct nv_adma_cpb *cpb = &pp->cpb[qc->tag]; -@@ -1394,7 +1394,7 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc) - (qc->flags & ATA_QCFLAG_DMAMAP)); - nv_adma_register_mode(qc->ap); - ata_bmdma_qc_prep(qc); -- return; -+ return AC_ERR_OK; - } - - cpb->resp_flags = NV_CPB_RESP_DONE; -@@ -1426,6 +1426,8 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc) - cpb->ctl_flags = ctl_flags; - wmb(); - cpb->resp_flags = 0; -+ -+ return AC_ERR_OK; - } - - static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc) -@@ -1989,17 +1991,19 @@ static int nv_swncq_port_start(struct ata_port *ap) - return 0; - } - --static void nv_swncq_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc) - { - if (qc->tf.protocol != ATA_PROT_NCQ) { - ata_bmdma_qc_prep(qc); -- return; -+ return AC_ERR_OK; - } - - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - nv_swncq_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - - static void nv_swncq_fill_sg(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c -index 0fa211e2831cd..8ad8b376a642c 100644 ---- a/drivers/ata/sata_promise.c -+++ b/drivers/ata/sata_promise.c -@@ -155,7 +155,7 @@ static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 va - static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); - static int pdc_common_port_start(struct ata_port *ap); - static int pdc_sata_port_start(struct ata_port *ap); --static void pdc_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc); - static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf); - static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf); - static int pdc_check_atapi_dma(struct ata_queued_cmd *qc); -@@ -649,7 +649,7 @@ static void pdc_fill_sg(struct ata_queued_cmd *qc) - prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT); - } - --static void pdc_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc) - { - struct pdc_port_priv *pp = qc->ap->private_data; - unsigned int i; -@@ -681,6 +681,8 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc) - default: - break; - } -+ -+ return AC_ERR_OK; - } - - static int pdc_is_sataii_tx4(unsigned long flags) -diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c -index af987a4f33d19..80ff3bbfc8269 100644 ---- a/drivers/ata/sata_qstor.c -+++ b/drivers/ata/sata_qstor.c -@@ -116,7 +116,7 @@ static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val); - static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); - static int qs_port_start(struct ata_port *ap); - static void qs_host_stop(struct ata_host *host); --static void qs_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc); - static unsigned int qs_qc_issue(struct ata_queued_cmd *qc); - static int qs_check_atapi_dma(struct ata_queued_cmd *qc); - static void qs_freeze(struct ata_port *ap); -@@ -276,7 +276,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc) - return si; - } - --static void qs_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc) - { - struct qs_port_priv *pp = qc->ap->private_data; - u8 dflags = QS_DF_PORD, *buf = pp->pkt; -@@ -288,7 +288,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc) - - qs_enter_reg_mode(qc->ap); - if (qc->tf.protocol != ATA_PROT_DMA) -- return; -+ return AC_ERR_OK; - - nelem = qs_fill_sg(qc); - -@@ -311,6 +311,8 @@ static void qs_qc_prep(struct ata_queued_cmd *qc) - - /* frame information structure (FIS) */ - ata_tf_to_fis(&qc->tf, 0, 1, &buf[32]); -+ -+ return AC_ERR_OK; - } - - static inline void qs_packet_start(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c -index 21b80f5ee0920..4199f7a39be0b 100644 ---- a/drivers/ata/sata_rcar.c -+++ b/drivers/ata/sata_rcar.c -@@ -551,12 +551,14 @@ static void sata_rcar_bmdma_fill_sg(struct ata_queued_cmd *qc) - prd[si - 1].addr |= cpu_to_le32(SATA_RCAR_DTEND); - } - --static void sata_rcar_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors sata_rcar_qc_prep(struct ata_queued_cmd *qc) - { - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - sata_rcar_bmdma_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - - static void sata_rcar_bmdma_setup(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c -index 29bcff086bced..73156a301912f 100644 ---- a/drivers/ata/sata_sil.c -+++ b/drivers/ata/sata_sil.c -@@ -119,7 +119,7 @@ static void sil_dev_config(struct ata_device *dev); - static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val); - static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val); - static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed); --static void sil_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc); - static void sil_bmdma_setup(struct ata_queued_cmd *qc); - static void sil_bmdma_start(struct ata_queued_cmd *qc); - static void sil_bmdma_stop(struct ata_queued_cmd *qc); -@@ -333,12 +333,14 @@ static void sil_fill_sg(struct ata_queued_cmd *qc) - last_prd->flags_len |= cpu_to_le32(ATA_PRD_EOT); - } - --static void sil_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc) - { - if (!(qc->flags & ATA_QCFLAG_DMAMAP)) -- return; -+ return AC_ERR_OK; - - sil_fill_sg(qc); -+ -+ return AC_ERR_OK; - } - - static unsigned char sil_get_device_cache_line(struct pci_dev *pdev) -diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c -index 4b1995e2d044b..ffa3bf724054d 100644 ---- a/drivers/ata/sata_sil24.c -+++ b/drivers/ata/sata_sil24.c -@@ -336,7 +336,7 @@ static void sil24_dev_config(struct ata_device *dev); - static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val); - static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val); - static int sil24_qc_defer(struct ata_queued_cmd *qc); --static void sil24_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc); - static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc); - static bool sil24_qc_fill_rtf(struct ata_queued_cmd *qc); - static void sil24_pmp_attach(struct ata_port *ap); -@@ -840,7 +840,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc) - return ata_std_qc_defer(qc); - } - --static void sil24_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc) - { - struct ata_port *ap = qc->ap; - struct sil24_port_priv *pp = ap->private_data; -@@ -884,6 +884,8 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc) - - if (qc->flags & ATA_QCFLAG_DMAMAP) - sil24_fill_sg(qc, sge); -+ -+ return AC_ERR_OK; - } - - static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc) -diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c -index fab504fd9cfd7..a7cd2c7ee1388 100644 ---- a/drivers/ata/sata_sx4.c -+++ b/drivers/ata/sata_sx4.c -@@ -218,7 +218,7 @@ static void pdc_error_handler(struct ata_port *ap); - static void pdc_freeze(struct ata_port *ap); - static void pdc_thaw(struct ata_port *ap); - static int pdc_port_start(struct ata_port *ap); --static void pdc20621_qc_prep(struct ata_queued_cmd *qc); -+static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc); - static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf); - static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf); - static unsigned int pdc20621_dimm_init(struct ata_host *host); -@@ -546,7 +546,7 @@ static void pdc20621_nodata_prep(struct ata_queued_cmd *qc) - VPRINTK("ata pkt buf ofs %u, mmio copied\n", i); - } - --static void pdc20621_qc_prep(struct ata_queued_cmd *qc) -+static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc) - { - switch (qc->tf.protocol) { - case ATA_PROT_DMA: -@@ -558,6 +558,8 @@ static void pdc20621_qc_prep(struct ata_queued_cmd *qc) - default: - break; - } -+ -+ return AC_ERR_OK; - } - - static void __pdc20621_push_hdma(struct ata_queued_cmd *qc, -diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c -index ad591a2f7c822..340a1ee79d280 100644 ---- a/drivers/atm/eni.c -+++ b/drivers/atm/eni.c -@@ -2242,7 +2242,7 @@ static int eni_init_one(struct pci_dev *pci_dev, - - rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32)); - if (rc < 0) -- goto out; -+ goto err_disable; - - rc = -ENOMEM; - eni_dev = kmalloc(sizeof(struct eni_dev), GFP_KERNEL); -diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c -index 100cd1de9939d..59e1e94d12c01 100644 ---- a/drivers/char/tlclk.c -+++ b/drivers/char/tlclk.c -@@ -777,17 +777,21 @@ static int __init tlclk_init(void) - { - int ret; - -+ telclk_interrupt = (inb(TLCLK_REG7) & 0x0f); -+ -+ alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL); -+ if (!alarm_events) { -+ ret = -ENOMEM; -+ goto out1; -+ } -+ - ret = register_chrdev(tlclk_major, "telco_clock", &tlclk_fops); - if (ret < 0) { - printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major); -+ kfree(alarm_events); - return ret; - } - tlclk_major = ret; -- alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL); -- if (!alarm_events) { -- ret = -ENOMEM; -- goto out1; -- } - - /* Read telecom clock IRQ number (Set by BIOS) */ - if (!request_region(TLCLK_BASE, 8, "telco_clock")) { -@@ -796,7 +800,6 @@ static int __init tlclk_init(void) - ret = -EBUSY; - goto out2; - } -- telclk_interrupt = (inb(TLCLK_REG7) & 0x0f); - - if (0x0F == telclk_interrupt ) { /* not MCPBL0010 ? */ - printk(KERN_ERR "telclk_interrupt = 0x%x non-mcpbl0010 hw.\n", -@@ -837,8 +840,8 @@ out3: - release_region(TLCLK_BASE, 8); - out2: - kfree(alarm_events); --out1: - unregister_chrdev(tlclk_major, "telco_clock"); -+out1: - return ret; - } - -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index 3e6a22658b63b..d4cc1a1ac1f73 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -543,6 +543,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance) - */ - while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) { - ibmvtpm_crq_process(crq, ibmvtpm); -+ wake_up_interruptible(&ibmvtpm->crq_queue.wq); - crq->valid = 0; - smp_wmb(); - } -@@ -589,6 +590,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - } - - crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr); -+ init_waitqueue_head(&crq_q->wq); - ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr, - CRQ_RES_BUF_SIZE, - DMA_BIDIRECTIONAL); -@@ -641,6 +643,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - if (rc) - goto init_irq_cleanup; - -+ if (!wait_event_timeout(ibmvtpm->crq_queue.wq, -+ ibmvtpm->rtce_buf != NULL, -+ HZ)) { -+ dev_err(dev, "CRQ response timed out\n"); -+ goto init_irq_cleanup; -+ } -+ - return tpm_chip_register(chip); - init_irq_cleanup: - do { -diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h -index 6af92890518f8..1a8c3b698f104 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.h -+++ b/drivers/char/tpm/tpm_ibmvtpm.h -@@ -31,6 +31,7 @@ struct ibmvtpm_crq_queue { - struct ibmvtpm_crq *crq_addr; - u32 index; - u32 num_entry; -+ wait_queue_head_t wq; - }; - - struct ibmvtpm_dev { -diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c -index 64a2e02b87d78..0b0de6a049afb 100644 ---- a/drivers/devfreq/tegra-devfreq.c -+++ b/drivers/devfreq/tegra-devfreq.c -@@ -79,6 +79,8 @@ - - #define KHZ 1000 - -+#define KHZ_MAX (ULONG_MAX / KHZ) -+ - /* Assume that the bus is saturated if the utilization is 25% */ - #define BUS_SATURATION_RATIO 25 - -@@ -179,7 +181,7 @@ struct tegra_actmon_emc_ratio { - }; - - static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = { -- { 1400000, ULONG_MAX }, -+ { 1400000, KHZ_MAX }, - { 1200000, 750000 }, - { 1100000, 600000 }, - { 1000000, 500000 }, -diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c -index b5cf5d36de2b4..68c460a2b16ea 100644 ---- a/drivers/dma/tegra20-apb-dma.c -+++ b/drivers/dma/tegra20-apb-dma.c -@@ -1207,8 +1207,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc) - - dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id); - -- if (tdc->busy) -- tegra_dma_terminate_all(dc); -+ tegra_dma_terminate_all(dc); - - spin_lock_irqsave(&tdc->lock, flags); - list_splice_init(&tdc->pending_sg_req, &sg_req_list); -diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c -index 1b50e6c13fb3f..5fbf99d600587 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atom.c -+++ b/drivers/gpu/drm/amd/amdgpu/atom.c -@@ -748,8 +748,8 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg) - cjiffies = jiffies; - if (time_after(cjiffies, ctx->last_jump_jiffies)) { - cjiffies -= ctx->last_jump_jiffies; -- if ((jiffies_to_msecs(cjiffies) > 5000)) { -- DRM_ERROR("atombios stuck in loop for more than 5secs aborting\n"); -+ if ((jiffies_to_msecs(cjiffies) > 10000)) { -+ DRM_ERROR("atombios stuck in loop for more than 10secs aborting\n"); - ctx->abort = true; - } - } else { -diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c -index 7d47b3d5cc0d0..54d554d720004 100644 ---- a/drivers/gpu/drm/gma500/cdv_intel_display.c -+++ b/drivers/gpu/drm/gma500/cdv_intel_display.c -@@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit, - struct gma_crtc *gma_crtc = to_gma_crtc(crtc); - struct gma_clock_t clock; - -+ memset(&clock, 0, sizeof(clock)); -+ - switch (refclk) { - case 27000: - if (target < 200000) { -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 3e4d3d5560bf1..6315f77b4a58c 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -1295,13 +1295,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, - if (copy_from_user(&cmd, inbuf, sizeof(cmd))) - return -EFAULT; - -+ if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE)) -+ return -EINVAL; -+ - ctx = ucma_get_ctx(file, cmd.id); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); - -- if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE)) -- return -EINVAL; -- - optval = memdup_user((void __user *) (unsigned long) cmd.optval, - cmd.optlen); - if (IS_ERR(optval)) { -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index 7fe7df56fa334..f0939fc1cfe55 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -547,6 +547,7 @@ struct cache_set { - */ - wait_queue_head_t btree_cache_wait; - struct task_struct *btree_cache_alloc_lock; -+ spinlock_t btree_cannibalize_lock; - - /* - * When we free a btree node, we increment the gen of the bucket the -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 122d975220945..bdf6071c1b184 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -841,15 +841,17 @@ out: - - static int mca_cannibalize_lock(struct cache_set *c, struct btree_op *op) - { -- struct task_struct *old; -- -- old = cmpxchg(&c->btree_cache_alloc_lock, NULL, current); -- if (old && old != current) { -+ spin_lock(&c->btree_cannibalize_lock); -+ if (likely(c->btree_cache_alloc_lock == NULL)) { -+ c->btree_cache_alloc_lock = current; -+ } else if (c->btree_cache_alloc_lock != current) { - if (op) - prepare_to_wait(&c->btree_cache_wait, &op->wait, - TASK_UNINTERRUPTIBLE); -+ spin_unlock(&c->btree_cannibalize_lock); - return -EINTR; - } -+ spin_unlock(&c->btree_cannibalize_lock); - - return 0; - } -@@ -884,10 +886,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op, - */ - static void bch_cannibalize_unlock(struct cache_set *c) - { -+ spin_lock(&c->btree_cannibalize_lock); - if (c->btree_cache_alloc_lock == current) { - c->btree_cache_alloc_lock = NULL; - wake_up(&c->btree_cache_wait); - } -+ spin_unlock(&c->btree_cannibalize_lock); - } - - static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op, -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index f7f8fb079d2a9..d73f9ea776861 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1511,6 +1511,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) - sema_init(&c->sb_write_mutex, 1); - mutex_init(&c->bucket_lock); - init_waitqueue_head(&c->btree_cache_wait); -+ spin_lock_init(&c->btree_cannibalize_lock); - init_waitqueue_head(&c->bucket_wait); - init_waitqueue_head(&c->gc_wait); - sema_init(&c->uuid_write_mutex, 1); -diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c -index 119d47596ac81..b81887c4f72a9 100644 ---- a/drivers/media/dvb-frontends/tda10071.c -+++ b/drivers/media/dvb-frontends/tda10071.c -@@ -483,10 +483,11 @@ static int tda10071_read_status(struct dvb_frontend *fe, enum fe_status *status) - goto error; - - if (dev->delivery_system == SYS_DVBS) { -- dev->dvbv3_ber = buf[0] << 24 | buf[1] << 16 | -- buf[2] << 8 | buf[3] << 0; -- dev->post_bit_error += buf[0] << 24 | buf[1] << 16 | -- buf[2] << 8 | buf[3] << 0; -+ u32 bit_error = buf[0] << 24 | buf[1] << 16 | -+ buf[2] << 8 | buf[3] << 0; -+ -+ dev->dvbv3_ber = bit_error; -+ dev->post_bit_error += bit_error; - c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER; - c->post_bit_error.stat[0].uvalue = dev->post_bit_error; - dev->block_error += buf[4] << 8 | buf[5] << 0; -diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c -index 4857c467e76cd..4490786936a02 100644 ---- a/drivers/media/usb/go7007/go7007-usb.c -+++ b/drivers/media/usb/go7007/go7007-usb.c -@@ -1052,6 +1052,7 @@ static int go7007_usb_probe(struct usb_interface *intf, - struct go7007_usb *usb; - const struct go7007_usb_board *board; - struct usb_device *usbdev = interface_to_usbdev(intf); -+ struct usb_host_endpoint *ep; - unsigned num_i2c_devs; - char *name; - int video_pipe, i, v_urb_len; -@@ -1147,7 +1148,8 @@ static int go7007_usb_probe(struct usb_interface *intf, - if (usb->intr_urb->transfer_buffer == NULL) - goto allocfail; - -- if (go->board_id == GO7007_BOARDID_SENSORAY_2250) -+ ep = usb->usbdev->ep_in[4]; -+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) - usb_fill_bulk_urb(usb->intr_urb, usb->usbdev, - usb_rcvbulkpipe(usb->usbdev, 4), - usb->intr_urb->transfer_buffer, 2*sizeof(u16), -diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c -index 215bb5eeb5acf..c57e375fad6ed 100644 ---- a/drivers/mfd/mfd-core.c -+++ b/drivers/mfd/mfd-core.c -@@ -31,6 +31,11 @@ int mfd_cell_enable(struct platform_device *pdev) - const struct mfd_cell *cell = mfd_get_cell(pdev); - int err = 0; - -+ if (!cell->enable) { -+ dev_dbg(&pdev->dev, "No .enable() call-back registered\n"); -+ return 0; -+ } -+ - /* only call enable hook if the cell wasn't previously enabled */ - if (atomic_inc_return(cell->usage_count) == 1) - err = cell->enable(pdev); -@@ -48,6 +53,11 @@ int mfd_cell_disable(struct platform_device *pdev) - const struct mfd_cell *cell = mfd_get_cell(pdev); - int err = 0; - -+ if (!cell->disable) { -+ dev_dbg(&pdev->dev, "No .disable() call-back registered\n"); -+ return 0; -+ } -+ - /* only disable if no other clients are using it */ - if (atomic_dec_return(cell->usage_count) == 0) - err = cell->disable(pdev); -diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c -index 972935f1b2f7e..3a3da0eeef1fb 100644 ---- a/drivers/mtd/chips/cfi_cmdset_0002.c -+++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -724,7 +724,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd) - kfree(mtd->eraseregions); - kfree(mtd); - kfree(cfi->cmdset_priv); -- kfree(cfi->cfiq); - return NULL; - } - -diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c -index 08f62987cc37c..ffbc9b304beb2 100644 ---- a/drivers/mtd/cmdlinepart.c -+++ b/drivers/mtd/cmdlinepart.c -@@ -228,12 +228,29 @@ static int mtdpart_setup_real(char *s) - struct cmdline_mtd_partition *this_mtd; - struct mtd_partition *parts; - int mtd_id_len, num_parts; -- char *p, *mtd_id; -+ char *p, *mtd_id, *semicol; -+ -+ /* -+ * Replace the first ';' by a NULL char so strrchr can work -+ * properly. -+ */ -+ semicol = strchr(s, ';'); -+ if (semicol) -+ *semicol = '\0'; - - mtd_id = s; - -- /* fetch */ -- p = strchr(s, ':'); -+ /* -+ * fetch . We use strrchr to ignore all ':' that could -+ * be present in the MTD name, only the last one is interpreted -+ * as an / separator. -+ */ -+ p = strrchr(s, ':'); -+ -+ /* Restore the ';' now. */ -+ if (semicol) -+ *semicol = ';'; -+ - if (!p) { - pr_err("no mtd-id\n"); - return -EINVAL; -diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c -index 235ec7992b4cf..e46b11847082a 100644 ---- a/drivers/mtd/nand/omap_elm.c -+++ b/drivers/mtd/nand/omap_elm.c -@@ -421,6 +421,7 @@ static int elm_probe(struct platform_device *pdev) - pm_runtime_enable(&pdev->dev); - if (pm_runtime_get_sync(&pdev->dev) < 0) { - ret = -EINVAL; -+ pm_runtime_put_sync(&pdev->dev); - pm_runtime_disable(&pdev->dev); - dev_err(&pdev->dev, "can't enable clock\n"); - return ret; -diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c -index f958188207fd6..e57aca6239f8e 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_main.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c -@@ -568,8 +568,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter) - WARN_ON(in_interrupt()); - while (test_and_set_bit(__E1000_RESETTING, &adapter->flags)) - msleep(1); -- e1000_down(adapter); -- e1000_up(adapter); -+ -+ /* only run the task if not already down */ -+ if (!test_bit(__E1000_DOWN, &adapter->flags)) { -+ e1000_down(adapter); -+ e1000_up(adapter); -+ } -+ - clear_bit(__E1000_RESETTING, &adapter->flags); - } - -@@ -1456,10 +1461,15 @@ static int e1000_close(struct net_device *netdev) - struct e1000_hw *hw = &adapter->hw; - int count = E1000_CHECK_RESET_COUNT; - -- while (test_bit(__E1000_RESETTING, &adapter->flags) && count--) -+ while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--) - usleep_range(10000, 20000); - -- WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags)); -+ WARN_ON(count < 0); -+ -+ /* signal that we're down so that the reset task will no longer run */ -+ set_bit(__E1000_DOWN, &adapter->flags); -+ clear_bit(__E1000_RESETTING, &adapter->flags); -+ - e1000_down(adapter); - e1000_power_down_phy(adapter); - e1000_free_irq(adapter); -diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c -index 4842344a96f1d..a2559f213daed 100644 ---- a/drivers/net/wan/hdlc_ppp.c -+++ b/drivers/net/wan/hdlc_ppp.c -@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, - } - - for (opt = data; len; len -= opt[1], opt += opt[1]) { -- if (len < 2 || len < opt[1]) { -- dev->stats.rx_errors++; -- kfree(out); -- return; /* bad packet, drop silently */ -- } -+ if (len < 2 || opt[1] < 2 || len < opt[1]) -+ goto err_out; - - if (pid == PID_LCP) - switch (opt[0]) { -@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, - continue; /* MRU always OK and > 1500 bytes? */ - - case LCP_OPTION_ACCM: /* async control character map */ -+ if (opt[1] < sizeof(valid_accm)) -+ goto err_out; - if (!memcmp(opt, valid_accm, - sizeof(valid_accm))) - continue; -@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, - } - break; - case LCP_OPTION_MAGIC: -+ if (len < 6) -+ goto err_out; - if (opt[1] != 6 || (!opt[2] && !opt[3] && - !opt[4] && !opt[5])) - break; /* reject invalid magic number */ -@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, - ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data); - - kfree(out); -+ return; -+ -+err_out: -+ dev->stats.rx_errors++; -+ kfree(out); - } - - static int ppp_rx(struct sk_buff *skb) -diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c -index 5bf22057459e6..bc6330b437958 100644 ---- a/drivers/net/wireless/ath/ar5523/ar5523.c -+++ b/drivers/net/wireless/ath/ar5523/ar5523.c -@@ -1774,6 +1774,8 @@ static struct usb_device_id ar5523_id_table[] = { - AR5523_DEVICE_UX(0x0846, 0x4300), /* Netgear / WG111U */ - AR5523_DEVICE_UG(0x0846, 0x4250), /* Netgear / WG111T */ - AR5523_DEVICE_UG(0x0846, 0x5f00), /* Netgear / WPN111 */ -+ AR5523_DEVICE_UG(0x083a, 0x4506), /* SMC / EZ Connect -+ SMCWUSBT-G2 */ - AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / AR5523_1 */ - AR5523_DEVICE_UX(0x157e, 0x3205), /* Umedia / AR5523_2 */ - AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / TEW444UBEU */ -diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h -index 9a5eb9ed89215..233af2292366d 100644 ---- a/drivers/net/wireless/mwifiex/fw.h -+++ b/drivers/net/wireless/mwifiex/fw.h -@@ -848,7 +848,7 @@ struct mwifiex_tkip_param { - struct mwifiex_aes_param { - u8 pn[WPA_PN_SIZE]; - __le16 key_len; -- u8 key[WLAN_KEY_LEN_CCMP]; -+ u8 key[WLAN_KEY_LEN_CCMP_256]; - } __packed; - - struct mwifiex_wapi_param { -diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c -index 9e3853c8a22da..32b0b06b74f1d 100644 ---- a/drivers/net/wireless/mwifiex/sta_cmdresp.c -+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c -@@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - key_v2 = &resp->params.key_material_v2; - - len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); -- if (len > WLAN_KEY_LEN_CCMP) -+ if (len > sizeof(key_v2->key_param_set.key_params.aes.key)) - return -EINVAL; - - if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { -@@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - return 0; - - memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, -- WLAN_KEY_LEN_CCMP); -+ sizeof(key_v2->key_param_set.key_params.aes.key)); - priv->aes_key_v2.key_param_set.key_params.aes.key_len = - cpu_to_le16(len); - memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, -diff --git a/drivers/phy/phy-s5pv210-usb2.c b/drivers/phy/phy-s5pv210-usb2.c -index 004d320767e4d..bb36cfd4e3e90 100644 ---- a/drivers/phy/phy-s5pv210-usb2.c -+++ b/drivers/phy/phy-s5pv210-usb2.c -@@ -142,6 +142,10 @@ static void s5pv210_phy_pwr(struct samsung_usb2_phy_instance *inst, bool on) - udelay(10); - rst &= ~rstbits; - writel(rst, drv->reg_phy + S5PV210_UPHYRST); -+ /* The following delay is necessary for the reset sequence to be -+ * completed -+ */ -+ udelay(80); - } else { - pwr = readl(drv->reg_phy + S5PV210_UPHYPWR); - pwr |= phypwr; -diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c -index de33801ca31ea..0614d05a990a6 100644 ---- a/drivers/scsi/aacraid/aachba.c -+++ b/drivers/scsi/aacraid/aachba.c -@@ -1938,13 +1938,13 @@ static int aac_read(struct scsi_cmnd * scsicmd) - scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | - SAM_STAT_CHECK_CONDITION; - set_sense(&dev->fsa_dev[cid].sense_data, -- HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE, -+ ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE, - ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0); - memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data, - min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data), - SCSI_SENSE_BUFFERSIZE)); - scsicmd->scsi_done(scsicmd); -- return 1; -+ return 0; - } - - dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n", -@@ -2035,13 +2035,13 @@ static int aac_write(struct scsi_cmnd * scsicmd) - scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | - SAM_STAT_CHECK_CONDITION; - set_sense(&dev->fsa_dev[cid].sense_data, -- HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE, -+ ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE, - ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0); - memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data, - min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data), - SCSI_SENSE_BUFFERSIZE)); - scsicmd->scsi_done(scsicmd); -- return 1; -+ return 0; - } - - dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n", -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 7a94c2d352390..97c0d79a2601f 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -15445,6 +15445,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf) - list_add_tail(&iocbq->list, &first_iocbq->list); - } - } -+ /* Free the sequence's header buffer */ -+ if (!first_iocbq) -+ lpfc_in_buf_free(vport->phba, &seq_dmabuf->dbuf); -+ - return first_iocbq; - } - -diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c -index e9ea9005a984e..f24fa99da69f5 100644 ---- a/drivers/tty/serial/8250/8250_core.c -+++ b/drivers/tty/serial/8250/8250_core.c -@@ -1037,8 +1037,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up) - - ret = uart_add_one_port(&serial8250_reg, - &uart->port); -- if (ret == 0) -- ret = uart->port.line; -+ if (ret) -+ goto err; -+ -+ ret = uart->port.line; - } else { - dev_info(uart->port.dev, - "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n", -@@ -1052,6 +1054,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up) - mutex_unlock(&serial_mutex); - - return ret; -+ -+err: -+ uart->port.dev = NULL; -+ mutex_unlock(&serial_mutex); -+ return ret; - } - EXPORT_SYMBOL(serial8250_register_8250_port); - -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index c4383573cf668..0377b35d62b80 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -1188,11 +1188,11 @@ static int omap8250_probe(struct platform_device *pdev) - spin_lock_init(&priv->rx_dma_lock); - - device_init_wakeup(&pdev->dev, true); -+ pm_runtime_enable(&pdev->dev); - pm_runtime_use_autosuspend(&pdev->dev); - pm_runtime_set_autosuspend_delay(&pdev->dev, -1); - - pm_runtime_irq_safe(&pdev->dev); -- pm_runtime_enable(&pdev->dev); - - pm_runtime_get_sync(&pdev->dev); - -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 70a51d0bc6044..42aa37515e9bd 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1151,14 +1151,14 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport, - struct s3c24xx_uart_info *info = ourport->info; - struct clk *clk; - unsigned long rate; -- unsigned int cnt, baud, quot, clk_sel, best_quot = 0; -+ unsigned int cnt, baud, quot, best_quot = 0; - char clkname[MAX_CLK_NAME_LENGTH]; - int calc_deviation, deviation = (1 << 30) - 1; - -- clk_sel = (ourport->cfg->clk_sel) ? ourport->cfg->clk_sel : -- ourport->info->def_clk_sel; - for (cnt = 0; cnt < info->num_clks; cnt++) { -- if (!(clk_sel & (1 << cnt))) -+ /* Keep selected clock if provided */ -+ if (ourport->cfg->clk_sel && -+ !(ourport->cfg->clk_sel & (1 << cnt))) - continue; - - sprintf(clkname, "clk_uart_baud%d", cnt); -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 0e4f54832fc79..01aeffcdf9849 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -2484,7 +2484,7 @@ static void console_callback(struct work_struct *ignored) - if (scrollback_delta) { - struct vc_data *vc = vc_cons[fg_console].d; - clear_selection(); -- if (vc->vc_mode == KD_TEXT) -+ if (vc->vc_mode == KD_TEXT && vc->vc_sw->con_scrolldelta) - vc->vc_sw->con_scrolldelta(vc, scrollback_delta); - scrollback_delta = 0; - } -diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c -index 849806a75f1ce..b29610899c9f6 100644 ---- a/drivers/usb/host/ehci-mv.c -+++ b/drivers/usb/host/ehci-mv.c -@@ -196,12 +196,10 @@ static int mv_ehci_probe(struct platform_device *pdev) - hcd->rsrc_len = resource_size(r); - hcd->regs = ehci_mv->op_regs; - -- hcd->irq = platform_get_irq(pdev, 0); -- if (!hcd->irq) { -- dev_err(&pdev->dev, "Cannot get irq."); -- retval = -ENODEV; -+ retval = platform_get_irq(pdev, 0); -+ if (retval < 0) - goto err_disable_clk; -- } -+ hcd->irq = retval; - - ehci = hcd_to_ehci(hcd); - ehci->caps = (struct ehci_caps *) ehci_mv->cap_regs; -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 7a82735d53087..8276ef7f3e834 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -255,6 +255,19 @@ static void vfio_pci_release(void *device_data) - if (!(--vdev->refcnt)) { - vfio_spapr_pci_eeh_release(vdev->pdev); - vfio_pci_disable(vdev); -+ mutex_lock(&vdev->igate); -+ if (vdev->err_trigger) { -+ eventfd_ctx_put(vdev->err_trigger); -+ vdev->err_trigger = NULL; -+ } -+ mutex_unlock(&vdev->igate); -+ -+ mutex_lock(&vdev->igate); -+ if (vdev->req_trigger) { -+ eventfd_ctx_put(vdev->req_trigger); -+ vdev->req_trigger = NULL; -+ } -+ mutex_unlock(&vdev->igate); - } - - mutex_unlock(&driver_lock); -diff --git a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c -index 8b6f6d5fdd68b..43186fa8a13c9 100644 ---- a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c -+++ b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c -@@ -194,7 +194,7 @@ static int __init omapdss_boot_init(void) - dss = of_find_matching_node(NULL, omapdss_of_match); - - if (dss == NULL || !of_device_is_available(dss)) -- return 0; -+ goto put_node; - - omapdss_walk_device(dss, true); - -@@ -221,6 +221,8 @@ static int __init omapdss_boot_init(void) - kfree(n); - } - -+put_node: -+ of_node_put(dss); - return 0; - } - -diff --git a/fs/block_dev.c b/fs/block_dev.c -index b2ebfd96785b7..a71d442ef7d0e 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1515,6 +1515,16 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) - struct gendisk *disk = bdev->bd_disk; - struct block_device *victim = NULL; - -+ /* -+ * Sync early if it looks like we're the last one. If someone else -+ * opens the block device between now and the decrement of bd_openers -+ * then we did a sync that we didn't need to, but that's not the end -+ * of the world and we want to avoid long (could be several minute) -+ * syncs while holding the mutex. -+ */ -+ if (bdev->bd_openers == 1) -+ sync_blockdev(bdev); -+ - mutex_lock_nested(&bdev->bd_mutex, for_part); - if (for_part) - bdev->bd_part_count--; -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index 3d0497421e62b..49e693232916f 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -1777,12 +1777,24 @@ ack: - if (mutex_trylock(&session->s_mutex) == 0) { - dout("inverting session/ino locks on %p\n", - session); -+ session = ceph_get_mds_session(session); - spin_unlock(&ci->i_ceph_lock); - if (took_snap_rwsem) { - up_read(&mdsc->snap_rwsem); - took_snap_rwsem = 0; - } -- mutex_lock(&session->s_mutex); -+ if (session) { -+ mutex_lock(&session->s_mutex); -+ ceph_put_mds_session(session); -+ } else { -+ /* -+ * Because we take the reference while -+ * holding the i_ceph_lock, it should -+ * never be NULL. Throw a warning if it -+ * ever is. -+ */ -+ WARN_ON_ONCE(true); -+ } - goto retry; - } - } -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 8142f6bf3d310..fc265f4b839ae 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -850,7 +850,6 @@ static int fuse_check_page(struct page *page) - { - if (page_mapcount(page) || - page->mapping != NULL || -- page_count(page) != 1 || - (page->flags & PAGE_FLAGS_CHECK_AT_PREP & - ~(1 << PG_locked | - 1 << PG_referenced | -diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c -index 97be412153328..9213a9e046ae0 100644 ---- a/fs/ubifs/io.c -+++ b/fs/ubifs/io.c -@@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum) - int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, - int offs, int quiet, int must_chk_crc) - { -- int err = -EINVAL, type, node_len; -+ int err = -EINVAL, type, node_len, dump_node = 1; - uint32_t crc, node_crc, magic; - const struct ubifs_ch *ch = buf; - -@@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, - out_len: - if (!quiet) - ubifs_err(c, "bad node length %d", node_len); -+ if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ) -+ dump_node = 0; - out: - if (!quiet) { - ubifs_err(c, "bad node at LEB %d:%d", lnum, offs); -- ubifs_dump_node(c, buf); -+ if (dump_node) { -+ ubifs_dump_node(c, buf); -+ } else { -+ int safe_len = min3(node_len, c->leb_size - offs, -+ (int)UBIFS_MAX_DATA_NODE_SZ); -+ pr_err("\tprevent out-of-bounds memory access\n"); -+ pr_err("\ttruncated data node length %d\n", safe_len); -+ pr_err("\tcorrupted data node:\n"); -+ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1, -+ buf, safe_len, 0); -+ } - dump_stack(); - } - return err; -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index da8747b870df3..4539ff4d351f9 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -1326,7 +1326,9 @@ xfs_attr3_leaf_add_work( - for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) { - if (ichdr->freemap[i].base == tmp) { - ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t); -- ichdr->freemap[i].size -= sizeof(xfs_attr_leaf_entry_t); -+ ichdr->freemap[i].size -= -+ min_t(uint16_t, ichdr->freemap[i].size, -+ sizeof(xfs_attr_leaf_entry_t)); - } - } - ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index); -diff --git a/include/linux/libata.h b/include/linux/libata.h -index af561d33221d6..ec49344f7555d 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -500,6 +500,7 @@ enum hsm_task_states { - }; - - enum ata_completion_errors { -+ AC_ERR_OK = 0, /* no error */ - AC_ERR_DEV = (1 << 0), /* device reported error */ - AC_ERR_HSM = (1 << 1), /* host state machine violation */ - AC_ERR_TIMEOUT = (1 << 2), /* timeout */ -@@ -896,9 +897,9 @@ struct ata_port_operations { - /* - * Command execution - */ -- int (*qc_defer)(struct ata_queued_cmd *qc); -- int (*check_atapi_dma)(struct ata_queued_cmd *qc); -- void (*qc_prep)(struct ata_queued_cmd *qc); -+ int (*qc_defer)(struct ata_queued_cmd *qc); -+ int (*check_atapi_dma)(struct ata_queued_cmd *qc); -+ enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc); - unsigned int (*qc_issue)(struct ata_queued_cmd *qc); - bool (*qc_fill_rtf)(struct ata_queued_cmd *qc); - -@@ -1190,7 +1191,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode); - extern const char *ata_mode_string(unsigned long xfer_mask); - extern unsigned long ata_id_xfermask(const u16 *id); - extern int ata_std_qc_defer(struct ata_queued_cmd *qc); --extern void ata_noop_qc_prep(struct ata_queued_cmd *qc); -+extern enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc); - extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg, - unsigned int n_elem); - extern unsigned int ata_dev_classify(const struct ata_taskfile *tf); -@@ -1881,9 +1882,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops; - .sg_tablesize = LIBATA_MAX_PRD, \ - .dma_boundary = ATA_DMA_BOUNDARY - --extern void ata_bmdma_qc_prep(struct ata_queued_cmd *qc); -+extern enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc); - extern unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc); --extern void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc); -+extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc); - extern unsigned int ata_bmdma_port_intr(struct ata_port *ap, - struct ata_queued_cmd *qc); - extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance); -diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h -index 676d3d2a1a0a9..d8bae7cb86f39 100644 ---- a/include/linux/mtd/map.h -+++ b/include/linux/mtd/map.h -@@ -307,7 +307,7 @@ void map_destroy(struct mtd_info *mtd); - ({ \ - int i, ret = 1; \ - for (i = 0; i < map_words(map); i++) { \ -- if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) { \ -+ if (((val1).x[i] & (val2).x[i]) != (val3).x[i]) { \ - ret = 0; \ - break; \ - } \ -diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h -index e0582106ef4fa..a10f363784178 100644 ---- a/include/linux/seqlock.h -+++ b/include/linux/seqlock.h -@@ -242,6 +242,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s) - * usual consistency guarantee. It is one wmb cheaper, because we can - * collapse the two back-to-back wmb()s. - * -+ * Note that, writes surrounding the barrier should be declared atomic (e.g. -+ * via WRITE_ONCE): a) to ensure the writes become visible to other threads -+ * atomically, avoiding compiler optimizations; b) to document which writes are -+ * meant to propagate to the reader critical section. This is necessary because -+ * neither writes before and after the barrier are enclosed in a seq-writer -+ * critical section that would ensure readers are aware of ongoing writes. -+ * - * seqcount_t seq; - * bool X = true, Y = false; - * -@@ -261,11 +268,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s) - * - * void write(void) - * { -- * Y = true; -+ * WRITE_ONCE(Y, true); - * - * raw_write_seqcount_barrier(seq); - * -- * X = false; -+ * WRITE_ONCE(X, false); - * } - */ - static inline void raw_write_seqcount_barrier(seqcount_t *s) -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 735ff1525f485..95feb153fe9a8 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -1438,6 +1438,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_) - return list_->qlen; - } - -+/** -+ * skb_queue_len_lockless - get queue length -+ * @list_: list to measure -+ * -+ * Return the length of an &sk_buff queue. -+ * This variant can be used in lockless contexts. -+ */ -+static inline __u32 skb_queue_len_lockless(const struct sk_buff_head *list_) -+{ -+ return READ_ONCE(list_->qlen); -+} -+ - /** - * __skb_queue_head_init - initialize non-spinlock portions of sk_buff_head - * @list: queue to initialize -@@ -1641,7 +1653,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list) - { - struct sk_buff *next, *prev; - -- list->qlen--; -+ WRITE_ONCE(list->qlen, list->qlen - 1); - next = skb->next; - prev = skb->prev; - skb->next = skb->prev = NULL; -@@ -2651,7 +2663,7 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len) - * is untouched. Otherwise it is extended. Returns zero on - * success. The skb is freed on error. - */ --static inline int skb_put_padto(struct sk_buff *skb, unsigned int len) -+static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len) - { - unsigned int size = skb->len; - -diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c -index f45a9a5d3e47a..af453f3c2b3dd 100644 ---- a/kernel/audit_watch.c -+++ b/kernel/audit_watch.c -@@ -316,8 +316,6 @@ static void audit_update_watch(struct audit_parent *parent, - if (oentry->rule.exe) - audit_remove_mark(oentry->rule.exe); - -- audit_watch_log_rule_change(r, owatch, "updated_rules"); -- - call_rcu(&oentry->rcu, audit_free_rule_rcu); - } - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 9241a29a1f9de..33c37dbc56a05 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -2012,6 +2012,9 @@ static void kill_kprobe(struct kprobe *p) - { - struct kprobe *kp; - -+ if (WARN_ON_ONCE(kprobe_gone(p))) -+ return; -+ - p->flags |= KPROBE_FLAG_GONE; - if (kprobe_aggrprobe(p)) { - /* -@@ -2032,9 +2035,10 @@ static void kill_kprobe(struct kprobe *p) - - /* - * The module is going away. We should disarm the kprobe which -- * is using ftrace. -+ * is using ftrace, because ftrace framework is still available at -+ * MODULE_STATE_GOING notification. - */ -- if (kprobe_ftrace(p)) -+ if (kprobe_ftrace(p) && !kprobe_disabled(p) && !kprobes_all_disarmed) - disarm_kprobe_ftrace(p); - } - -@@ -2154,7 +2158,10 @@ static int kprobes_module_callback(struct notifier_block *nb, - mutex_lock(&kprobe_mutex); - for (i = 0; i < KPROBE_TABLE_SIZE; i++) { - head = &kprobe_table[i]; -- hlist_for_each_entry_rcu(p, head, hlist) -+ hlist_for_each_entry_rcu(p, head, hlist) { -+ if (kprobe_gone(p)) -+ continue; -+ - if (within_module_init((unsigned long)p->addr, mod) || - (checkcore && - within_module_core((unsigned long)p->addr, mod))) { -@@ -2165,6 +2172,7 @@ static int kprobes_module_callback(struct notifier_block *nb, - */ - kill_kprobe(p); - } -+ } - } - mutex_unlock(&kprobe_mutex); - return NOTIFY_DONE; -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index e53a976ca28ea..b55dfb3e801f9 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -2032,6 +2032,9 @@ static int __init console_setup(char *str) - char *s, *options, *brl_options = NULL; - int idx; - -+ if (str[0] == 0) -+ return 1; -+ - if (_braille_console_setup(&str, &brl_options)) - return 1; - -diff --git a/kernel/sys.c b/kernel/sys.c -index 1855f1bf113e4..e98664039cb23 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -1183,11 +1183,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) - - SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) - { -- struct oldold_utsname tmp = {}; -+ struct oldold_utsname tmp; - - if (!name) - return -EFAULT; - -+ memset(&tmp, 0, sizeof(tmp)); -+ - down_read(&uts_sem); - memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN); - memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index e4c6f89b6b11f..89ed01911a9a2 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -2823,8 +2823,11 @@ static int referenced_filters(struct dyn_ftrace *rec) - int cnt = 0; - - for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) { -- if (ops_references_rec(ops, rec)) -- cnt++; -+ if (ops_references_rec(ops, rec)) { -+ cnt++; -+ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) -+ rec->flags |= FTRACE_FL_REGS; -+ } - } - - return cnt; -@@ -2874,7 +2877,7 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs) - p = &pg->records[i]; - if (test) - cnt += referenced_filters(p); -- p->flags = cnt; -+ p->flags += cnt; - - /* - * Do the initial record conversion from mcount jump -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 06efd18bf3e38..e4a0c0308b507 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -2271,6 +2271,9 @@ int trace_array_printk(struct trace_array *tr, - if (!(global_trace.trace_flags & TRACE_ITER_PRINTK)) - return 0; - -+ if (!tr) -+ return -ENOENT; -+ - va_start(ap, fmt); - ret = trace_array_vprintk(tr, ip, fmt, ap); - va_end(ap); -@@ -7260,7 +7263,7 @@ __init static int tracer_alloc_buffers(void) - goto out_free_buffer_mask; - - /* Only allocate trace_printk buffers if a trace_printk exists */ -- if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt) -+ if (&__stop___trace_bprintk_fmt != &__start___trace_bprintk_fmt) - /* Must be called before global_trace.buffer is allocated */ - trace_printk_init_buffers(); - -diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h -index ee7b94a4810af..246db27dbdc99 100644 ---- a/kernel/trace/trace_entries.h -+++ b/kernel/trace/trace_entries.h -@@ -178,7 +178,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry, - - F_STRUCT( - __field( int, size ) -- __dynamic_array(unsigned long, caller ) -+ __array( unsigned long, caller, FTRACE_STACK_ENTRIES ) - ), - - F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n" -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index bd4c0bb61ad72..9d6e755d17546 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -755,6 +755,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set) - char *event = NULL, *sub = NULL, *match; - int ret; - -+ if (!tr) -+ return -ENOENT; - /* - * The buf format can be : - * *: means any event by that name. -diff --git a/lib/string.c b/lib/string.c -index c7cf65ac42ad7..c9983dc01e727 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -235,6 +235,30 @@ ssize_t strscpy(char *dest, const char *src, size_t count) - EXPORT_SYMBOL(strscpy); - #endif - -+/** -+ * stpcpy - copy a string from src to dest returning a pointer to the new end -+ * of dest, including src's %NUL-terminator. May overrun dest. -+ * @dest: pointer to end of string being copied into. Must be large enough -+ * to receive copy. -+ * @src: pointer to the beginning of string being copied from. Must not overlap -+ * dest. -+ * -+ * stpcpy differs from strcpy in a key way: the return value is a pointer -+ * to the new %NUL-terminating character in @dest. (For strcpy, the return -+ * value is a pointer to the start of @dest). This interface is considered -+ * unsafe as it doesn't perform bounds checking of the inputs. As such it's -+ * not recommended for usage. Instead, its definition is provided in case -+ * the compiler lowers other libcalls to stpcpy. -+ */ -+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src); -+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src) -+{ -+ while ((*dest++ = *src++) != '\0') -+ /* nothing */; -+ return --dest; -+} -+EXPORT_SYMBOL(stpcpy); -+ - #ifndef __HAVE_ARCH_STRCAT - /** - * strcat - Append one %NUL-terminated string to another -diff --git a/mm/filemap.c b/mm/filemap.c -index f217120973ebe..3d0a0e409cbf5 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -2313,6 +2313,14 @@ filler: - unlock_page(page); - goto out; - } -+ -+ /* -+ * A previous I/O error may have been due to temporary -+ * failures. -+ * Clear page error before actual read, PG_error will be -+ * set again if read page fails. -+ */ -+ ClearPageError(page); - goto filler; - - out: -diff --git a/mm/mmap.c b/mm/mmap.c -index 135cccce41f88..d48a654cbd237 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -1993,6 +1993,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - info.low_limit = mm->mmap_base; - info.high_limit = TASK_SIZE; - info.align_mask = 0; -+ info.align_offset = 0; - return vm_unmapped_area(&info); - } - #endif -@@ -2034,6 +2035,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - info.low_limit = max(PAGE_SIZE, mmap_min_addr); - info.high_limit = mm->mmap_base; - info.align_mask = 0; -+ info.align_offset = 0; - addr = vm_unmapped_area(&info); - - /* -diff --git a/mm/pagewalk.c b/mm/pagewalk.c -index c2cbd26201696..a024667a9c041 100644 ---- a/mm/pagewalk.c -+++ b/mm/pagewalk.c -@@ -14,9 +14,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, - err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk); - if (err) - break; -- addr += PAGE_SIZE; -- if (addr == end) -+ if (addr >= end - PAGE_SIZE) - break; -+ addr += PAGE_SIZE; - pte++; - } - -diff --git a/net/atm/lec.c b/net/atm/lec.c -index e4afac94ff158..a38680e194436 100644 ---- a/net/atm/lec.c -+++ b/net/atm/lec.c -@@ -1290,6 +1290,12 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry) - entry->vcc = NULL; - } - if (entry->recv_vcc) { -+ struct atm_vcc *vcc = entry->recv_vcc; -+ struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc); -+ -+ kfree(vpriv); -+ vcc->user_back = NULL; -+ - entry->recv_vcc->push = entry->old_recv_push; - vcc_release_async(entry->recv_vcc, -EPIPE); - entry->recv_vcc = NULL; -diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c -index 9aa5daa551273..1267cbb1a329a 100644 ---- a/net/batman-adv/bridge_loop_avoidance.c -+++ b/net/batman-adv/bridge_loop_avoidance.c -@@ -73,11 +73,12 @@ static inline u32 batadv_choose_claim(const void *data, u32 size) - /* return the index of the backbone gateway */ - static inline u32 batadv_choose_backbone_gw(const void *data, u32 size) - { -- const struct batadv_bla_claim *claim = (struct batadv_bla_claim *)data; -+ const struct batadv_bla_backbone_gw *gw; - u32 hash = 0; - -- hash = jhash(&claim->addr, sizeof(claim->addr), hash); -- hash = jhash(&claim->vid, sizeof(claim->vid), hash); -+ gw = (struct batadv_bla_backbone_gw *)data; -+ hash = jhash(&gw->orig, sizeof(gw->orig), hash); -+ hash = jhash(&gw->vid, sizeof(gw->vid), hash); - - return hash % size; - } -diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c -index b3e8b0e3073c2..e470410abb44d 100644 ---- a/net/batman-adv/routing.c -+++ b/net/batman-adv/routing.c -@@ -782,6 +782,10 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, - vid = batadv_get_vid(skb, hdr_len); - ethhdr = (struct ethhdr *)(skb->data + hdr_len); - -+ /* do not reroute multicast frames in a unicast header */ -+ if (is_multicast_ether_addr(ethhdr->h_dest)) -+ return true; -+ - /* check if the destination client was served by this node and it is now - * roaming. In this case, it means that the node has got a ROAM_ADV - * message and that it knows the new destination in the mesh to re-route -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 16cf5633eae3e..03319ab8a7c6e 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -41,12 +41,27 @@ - - /* Handle HCI Event packets */ - --static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb) -+static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb, -+ u8 *new_status) - { - __u8 status = *((__u8 *) skb->data); - - BT_DBG("%s status 0x%2.2x", hdev->name, status); - -+ /* It is possible that we receive Inquiry Complete event right -+ * before we receive Inquiry Cancel Command Complete event, in -+ * which case the latter event should have status of Command -+ * Disallowed (0x0c). This should not be treated as error, since -+ * we actually achieve what Inquiry Cancel wants to achieve, -+ * which is to end the last Inquiry session. -+ */ -+ if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) { -+ bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command"); -+ status = 0x00; -+ } -+ -+ *new_status = status; -+ - if (status) - return; - -@@ -2758,7 +2773,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb, - - switch (*opcode) { - case HCI_OP_INQUIRY_CANCEL: -- hci_cc_inquiry_cancel(hdev, skb); -+ hci_cc_inquiry_cancel(hdev, skb, status); - break; - - case HCI_OP_PERIODIC_INQ: -@@ -5230,6 +5245,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) - u8 status = 0, event = hdr->evt, req_evt = 0; - u16 opcode = HCI_OP_NOP; - -+ if (!event) { -+ bt_dev_warn(hdev, "Received unexpected HCI Event 00000000"); -+ goto done; -+ } -+ - if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) { - struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data; - opcode = __le16_to_cpu(cmd_hdr->opcode); -@@ -5441,6 +5461,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) - req_complete_skb(hdev, status, opcode, orig_skb); - } - -+done: - kfree_skb(orig_skb); - kfree_skb(skb); - hdev->stat.evt_rx++; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 0e31bbe1256cd..f2db50da8ce2e 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -403,6 +403,9 @@ static void l2cap_chan_timeout(struct work_struct *work) - BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); - - mutex_lock(&conn->chan_lock); -+ /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling -+ * this work. No need to call l2cap_chan_hold(chan) here again. -+ */ - l2cap_chan_lock(chan); - - if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) -@@ -415,12 +418,12 @@ static void l2cap_chan_timeout(struct work_struct *work) - - l2cap_chan_close(chan, reason); - -- l2cap_chan_unlock(chan); -- - chan->ops->close(chan); -- mutex_unlock(&conn->chan_lock); - -+ l2cap_chan_unlock(chan); - l2cap_chan_put(chan); -+ -+ mutex_unlock(&conn->chan_lock); - } - - struct l2cap_chan *l2cap_chan_create(void) -@@ -1714,9 +1717,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) - - l2cap_chan_del(chan, err); - -- l2cap_chan_unlock(chan); -- - chan->ops->close(chan); -+ -+ l2cap_chan_unlock(chan); - l2cap_chan_put(chan); - } - -@@ -4093,7 +4096,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, - return 0; - } - -- if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) { -+ if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && -+ chan->state != BT_CONNECTED) { - cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, - chan->dcid); - goto unlock; -@@ -4316,6 +4320,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, - return 0; - } - -+ l2cap_chan_hold(chan); - l2cap_chan_lock(chan); - - rsp.dcid = cpu_to_le16(chan->scid); -@@ -4324,12 +4329,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, - - chan->ops->set_shutdown(chan); - -- l2cap_chan_hold(chan); - l2cap_chan_del(chan, ECONNRESET); - -- l2cap_chan_unlock(chan); -- - chan->ops->close(chan); -+ -+ l2cap_chan_unlock(chan); - l2cap_chan_put(chan); - - mutex_unlock(&conn->chan_lock); -@@ -4361,20 +4365,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, - return 0; - } - -+ l2cap_chan_hold(chan); - l2cap_chan_lock(chan); - - if (chan->state != BT_DISCONN) { - l2cap_chan_unlock(chan); -+ l2cap_chan_put(chan); - mutex_unlock(&conn->chan_lock); - return 0; - } - -- l2cap_chan_hold(chan); - l2cap_chan_del(chan, 0); - -- l2cap_chan_unlock(chan); -- - chan->ops->close(chan); -+ -+ l2cap_chan_unlock(chan); - l2cap_chan_put(chan); - - mutex_unlock(&conn->chan_lock); -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index d9bbbded49ef8..e562385d9440e 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1038,7 +1038,7 @@ done: - } - - /* Kill socket (only if zapped and orphan) -- * Must be called on unlocked socket. -+ * Must be called on unlocked socket, with l2cap channel lock. - */ - static void l2cap_sock_kill(struct sock *sk) - { -@@ -1189,6 +1189,7 @@ static int l2cap_sock_release(struct socket *sock) - { - struct sock *sk = sock->sk; - int err; -+ struct l2cap_chan *chan; - - BT_DBG("sock %p, sk %p", sock, sk); - -@@ -1198,9 +1199,17 @@ static int l2cap_sock_release(struct socket *sock) - bt_sock_unlink(&l2cap_sk_list, sk); - - err = l2cap_sock_shutdown(sock, 2); -+ chan = l2cap_pi(sk)->chan; -+ -+ l2cap_chan_hold(chan); -+ l2cap_chan_lock(chan); - - sock_orphan(sk); - l2cap_sock_kill(sk); -+ -+ l2cap_chan_unlock(chan); -+ l2cap_chan_put(chan); -+ - return err; - } - -@@ -1218,12 +1227,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) - BT_DBG("child chan %p state %s", chan, - state_to_string(chan->state)); - -+ l2cap_chan_hold(chan); - l2cap_chan_lock(chan); -+ - __clear_chan_timer(chan); - l2cap_chan_close(chan, ECONNRESET); -- l2cap_chan_unlock(chan); -- - l2cap_sock_kill(sk); -+ -+ l2cap_chan_unlock(chan); -+ l2cap_chan_put(chan); - } - } - -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 9849f1f4cf4f7..40d33431bc585 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -2798,6 +2798,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos) - *pos = cpu+1; - return per_cpu_ptr(tbl->stats, cpu); - } -+ (*pos)++; - return NULL; - } - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index d940c9e0eb024..0355f125d8361 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -73,6 +73,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1597,7 +1598,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, - if (IS_ERR(rt)) - return; - -- inet_sk(sk)->tos = arg->tos; -+ inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK; - - sk->sk_priority = skb->priority; - sk->sk_protocol = ip_hdr(skb)->protocol; -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 542f6e0f438f1..ea1c319100a5d 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -271,6 +271,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos) - *pos = cpu+1; - return &per_cpu(rt_cache_stat, cpu); - } -+ (*pos)++; - return NULL; - - } -diff --git a/net/key/af_key.c b/net/key/af_key.c -index d2ec620319d76..76a008b1cbe5f 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -1873,6 +1873,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms - if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { - struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; - -+ if ((xfilter->sadb_x_filter_splen >= -+ (sizeof(xfrm_address_t) << 3)) || -+ (xfilter->sadb_x_filter_dplen >= -+ (sizeof(xfrm_address_t) << 3))) { -+ mutex_unlock(&pfk->dump_lock); -+ return -EINVAL; -+ } - filter = kmalloc(sizeof(*filter), GFP_KERNEL); - if (filter == NULL) { - mutex_unlock(&pfk->dump_lock); -diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c -index 2b8e80c721db1..a7cd031656801 100644 ---- a/net/sunrpc/svc_xprt.c -+++ b/net/sunrpc/svc_xprt.c -@@ -97,8 +97,17 @@ void svc_unreg_xprt_class(struct svc_xprt_class *xcl) - } - EXPORT_SYMBOL_GPL(svc_unreg_xprt_class); - --/* -- * Format the transport list for printing -+/** -+ * svc_print_xprts - Format the transport list for printing -+ * @buf: target buffer for formatted address -+ * @maxlen: length of target buffer -+ * -+ * Fills in @buf with a string containing a list of transport names, each name -+ * terminated with '\n'. If the buffer is too small, some entries may be -+ * missing, but it is guaranteed that all lines in the output buffer are -+ * complete. -+ * -+ * Returns positive length of the filled-in string. - */ - int svc_print_xprts(char *buf, int maxlen) - { -@@ -111,9 +120,9 @@ int svc_print_xprts(char *buf, int maxlen) - list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) { - int slen; - -- sprintf(tmpstr, "%s %d\n", xcl->xcl_name, xcl->xcl_max_payload); -- slen = strlen(tmpstr); -- if (len + slen > maxlen) -+ slen = snprintf(tmpstr, sizeof(tmpstr), "%s %d\n", -+ xcl->xcl_name, xcl->xcl_max_payload); -+ if (slen >= sizeof(tmpstr) || len + slen >= maxlen) - break; - len += slen; - strcat(buf, tmpstr); -diff --git a/net/tipc/msg.c b/net/tipc/msg.c -index 67bddcb2ff466..fc1aa8bcb185d 100644 ---- a/net/tipc/msg.c -+++ b/net/tipc/msg.c -@@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) - if (fragid == FIRST_FRAGMENT) { - if (unlikely(head)) - goto err; -- if (unlikely(skb_unclone(frag, GFP_ATOMIC))) -+ frag = skb_unshare(frag, GFP_ATOMIC); -+ if (unlikely(!frag)) - goto err; - head = *headbuf = frag; - *buf = NULL; -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index b5e2ef242efe7..ac78c5ac82846 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -191,11 +191,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk) - return unix_peer(osk) == NULL || unix_our_peer(sk, osk); - } - --static inline int unix_recvq_full(struct sock const *sk) -+static inline int unix_recvq_full(const struct sock *sk) - { - return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog; - } - -+static inline int unix_recvq_full_lockless(const struct sock *sk) -+{ -+ return skb_queue_len_lockless(&sk->sk_receive_queue) > -+ READ_ONCE(sk->sk_max_ack_backlog); -+} -+ - struct sock *unix_peer_get(struct sock *s) - { - struct sock *peer; -@@ -1792,7 +1798,8 @@ restart_locked: - * - unix_peer(sk) == sk by time of get but disconnected before lock - */ - if (other != sk && -- unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { -+ unlikely(unix_peer(other) != sk && -+ unix_recvq_full_lockless(other))) { - if (timeo) { - timeo = unix_wait_for_peer(other, timeo); - -diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c -index c02da25d7b631..7778e28cce9d7 100644 ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -1370,6 +1370,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx) - *idx = cpu + 1; - return &per_cpu(avc_cache_stats, cpu); - } -+ (*idx)++; - return NULL; - } - -diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c -index 0e81ea89a5965..e3f68a76d90eb 100644 ---- a/sound/hda/hdac_bus.c -+++ b/sound/hda/hdac_bus.c -@@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work) - struct hdac_driver *drv; - unsigned int rp, caddr, res; - -+ spin_lock_irq(&bus->reg_lock); - while (bus->unsol_rp != bus->unsol_wp) { - rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE; - bus->unsol_rp = rp; -@@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work) - codec = bus->caddr_tbl[caddr & 0x0f]; - if (!codec || !codec->dev.driver) - continue; -+ spin_unlock_irq(&bus->reg_lock); - drv = drv_to_hdac_driver(codec->dev.driver); - if (drv->unsol_event) - drv->unsol_event(codec, res); -+ spin_lock_irq(&bus->reg_lock); - } -+ spin_unlock_irq(&bus->reg_lock); - } - - /** -diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c -index 7a32abbe0cef8..4bdcb7443b1f5 100644 ---- a/sound/pci/asihpi/hpioctl.c -+++ b/sound/pci/asihpi/hpioctl.c -@@ -346,7 +346,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev, - struct hpi_message hm; - struct hpi_response hr; - struct hpi_adapter adapter; -- struct hpi_pci pci; -+ struct hpi_pci pci = { 0 }; - - memset(&adapter, 0, sizeof(adapter)); - -@@ -502,7 +502,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev, - return 0; - - err: -- for (idx = 0; idx < HPI_MAX_ADAPTER_MEM_SPACES; idx++) { -+ while (--idx >= 0) { - if (pci.ap_mem_base[idx]) { - iounmap(pci.ap_mem_base[idx]); - pci.ap_mem_base[idx] = NULL; -diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c -index dbfdfe99c69df..231c7d97333c7 100644 ---- a/sound/soc/kirkwood/kirkwood-dma.c -+++ b/sound/soc/kirkwood/kirkwood-dma.c -@@ -136,7 +136,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream) - err = request_irq(priv->irq, kirkwood_dma_irq, IRQF_SHARED, - "kirkwood-i2s", priv); - if (err) -- return -EBUSY; -+ return err; - - /* - * Enable Error interrupts. We're only ack'ing them but -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 5c4a3d6c42341..934540042bc2e 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -1803,6 +1803,28 @@ static int snd_usbmidi_create_endpoints(struct snd_usb_midi *umidi, - return 0; - } - -+static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor( -+ struct usb_host_endpoint *hostep) -+{ -+ unsigned char *extra = hostep->extra; -+ int extralen = hostep->extralen; -+ -+ while (extralen > 3) { -+ struct usb_ms_endpoint_descriptor *ms_ep = -+ (struct usb_ms_endpoint_descriptor *)extra; -+ -+ if (ms_ep->bLength > 3 && -+ ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT && -+ ms_ep->bDescriptorSubtype == UAC_MS_GENERAL) -+ return ms_ep; -+ if (!extra[0]) -+ break; -+ extralen -= extra[0]; -+ extra += extra[0]; -+ } -+ return NULL; -+} -+ - /* - * Returns MIDIStreaming device capabilities. - */ -@@ -1840,11 +1862,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, - ep = get_ep_desc(hostep); - if (!usb_endpoint_xfer_bulk(ep) && !usb_endpoint_xfer_int(ep)) - continue; -- ms_ep = (struct usb_ms_endpoint_descriptor *)hostep->extra; -- if (hostep->extralen < 4 || -- ms_ep->bLength < 4 || -- ms_ep->bDescriptorType != USB_DT_CS_ENDPOINT || -- ms_ep->bDescriptorSubtype != UAC_MS_GENERAL) -+ ms_ep = find_usb_ms_endpoint_descriptor(hostep); -+ if (!ms_ep) - continue; - if (usb_endpoint_dir_out(ep)) { - if (endpoints[epidx].out_ep) { -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 2070c02de3af5..ea55cb6b614f4 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -1390,6 +1390,7 @@ struct kcore_copy_info { - u64 first_symbol; - u64 last_symbol; - u64 first_module; -+ u64 first_module_symbol; - u64 last_module_symbol; - struct phdr_data kernel_map; - struct phdr_data modules_map; -@@ -1404,6 +1405,8 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type, - return 0; - - if (strchr(name, '[')) { -+ if (!kci->first_module_symbol || start < kci->first_module_symbol) -+ kci->first_module_symbol = start; - if (start > kci->last_module_symbol) - kci->last_module_symbol = start; - return 0; -@@ -1528,6 +1531,10 @@ static int kcore_copy__calc_maps(struct kcore_copy_info *kci, const char *dir, - kci->etext += page_size; - } - -+ if (kci->first_module_symbol && -+ (!kci->first_module || kci->first_module_symbol < kci->first_module)) -+ kci->first_module = kci->first_module_symbol; -+ - kci->first_module = round_down(kci->first_module, page_size); - - if (kci->last_module_symbol) { -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 82f3a9d78cab4..ba8e8840b94b2 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -3392,7 +3392,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, - void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - struct kvm_io_device *dev) - { -- int i; -+ int i, j; - struct kvm_io_bus *new_bus, *bus; - - bus = kvm->buses[bus_idx]; -@@ -3409,17 +3409,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, - - new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * - sizeof(struct kvm_io_range)), GFP_KERNEL); -- if (!new_bus) { -+ if (new_bus) { -+ memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); -+ new_bus->dev_count--; -+ memcpy(new_bus->range + i, bus->range + i + 1, -+ (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); -+ } else { - pr_err("kvm: failed to shrink bus, removing it completely\n"); -- goto broken; -+ for (j = 0; j < bus->dev_count; j++) { -+ if (j == i) -+ continue; -+ kvm_iodevice_destructor(bus->range[j].dev); -+ } - } - -- memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); -- new_bus->dev_count--; -- memcpy(new_bus->range + i, bus->range + i + 1, -- (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); -- --broken: - rcu_assign_pointer(kvm->buses[bus_idx], new_bus); - synchronize_srcu_expedited(&kvm->srcu); - kfree(bus); diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.238-239.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.238-239.patch deleted file mode 100644 index bc1e212ecc..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.238-239.patch +++ /dev/null @@ -1,1487 +0,0 @@ -diff --git a/Makefile b/Makefile -index 209fe98a591cd..74072b5a958b2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 238 -+SUBLEVEL = 239 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index 04a923186081f..6bb3a425bbd3e 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -285,7 +285,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) - drv->bus->name, __func__, drv->name, dev_name(dev)); - if (!list_empty(&dev->devres_head)) { - dev_crit(dev, "Resources present before probing\n"); -- return -EBUSY; -+ ret = -EBUSY; -+ goto done; - } - - dev->driver = drv; -@@ -363,7 +364,7 @@ probe_failed: - ret = 0; - done: - atomic_dec(&probe_count); -- wake_up(&probe_waitqueue); -+ wake_up_all(&probe_waitqueue); - return ret; - } - -diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c -index 6c8e45e007c84..8edbb20ccff5e 100644 ---- a/drivers/clk/samsung/clk-exynos4.c -+++ b/drivers/clk/samsung/clk-exynos4.c -@@ -1059,7 +1059,7 @@ static struct samsung_gate_clock exynos4210_gate_clks[] __initdata = { - GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0), - GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0), - GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0), -- GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0), -+ GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), - GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0, - CLK_IGNORE_UNUSED, 0), - GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0, -@@ -1100,7 +1100,7 @@ static struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = { - 0), - GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), - GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), -- GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), -+ GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), - GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, - CLK_IGNORE_UNUSED, 0), - GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0, -diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c -index d1d585ddb9ab7..dd19805d587de 100644 ---- a/drivers/gpio/gpio-tc3589x.c -+++ b/drivers/gpio/gpio-tc3589x.c -@@ -157,7 +157,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d) - continue; - - tc3589x_gpio->oldregs[i][j] = new; -- tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new); -+ tc3589x_reg_write(tc3589x, regmap[i] + j, new); - } - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -index d3ee8f19f1ef9..5ff941bbfb5bc 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -@@ -311,7 +311,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set) - take the current one */ - if (active && !adev->have_disp_power_ref) { - adev->have_disp_power_ref = true; -- goto out; -+ return ret; - } - /* if we have no active crtcs, then drop the power ref - we got before */ -diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c -index b167ab25310a3..34a35e927fc6d 100644 ---- a/drivers/i2c/busses/i2c-cpm.c -+++ b/drivers/i2c/busses/i2c-cpm.c -@@ -74,6 +74,9 @@ struct i2c_ram { - char res1[4]; /* Reserved */ - ushort rpbase; /* Relocation pointer */ - char res2[2]; /* Reserved */ -+ /* The following elements are only for CPM2 */ -+ char res3[4]; /* Reserved */ -+ uint sdmatmp; /* Internal */ - }; - - #define I2COM_START 0x80 -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index e5799639fb544..82ff44637ed78 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -797,6 +797,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { - DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"), - }, - }, -+ { -+ /* Acer Aspire 5 A515 */ -+ .matches = { -+ DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"), -+ DMI_MATCH(DMI_BOARD_VENDOR, "PK"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c -index 29a31eb9ace3e..02df8d9dc842a 100644 ---- a/drivers/iommu/exynos-iommu.c -+++ b/drivers/iommu/exynos-iommu.c -@@ -1158,13 +1158,17 @@ static int exynos_iommu_of_xlate(struct device *dev, - return -ENODEV; - - data = platform_get_drvdata(sysmmu); -- if (!data) -+ if (!data) { -+ put_device(&sysmmu->dev); - return -ENODEV; -+ } - - if (!owner) { - owner = kzalloc(sizeof(*owner), GFP_KERNEL); -- if (!owner) -+ if (!owner) { -+ put_device(&sysmmu->dev); - return -ENOMEM; -+ } - - INIT_LIST_HEAD(&owner->controllers); - dev->archdata.iommu = owner; -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 8406f346b0be5..09864226428b2 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -4427,18 +4427,14 @@ int nand_scan(struct mtd_info *mtd, int maxchips) - EXPORT_SYMBOL(nand_scan); - - /** -- * nand_release - [NAND Interface] Free resources held by the NAND device -- * @mtd: MTD device structure -+ * nand_cleanup - [NAND Interface] Free resources held by the NAND device -+ * @chip: NAND chip object - */ --void nand_release(struct mtd_info *mtd) -+void nand_cleanup(struct nand_chip *chip) - { -- struct nand_chip *chip = mtd->priv; -- - if (chip->ecc.mode == NAND_ECC_SOFT_BCH) - nand_bch_free((struct nand_bch_control *)chip->ecc.priv); - -- mtd_device_unregister(mtd); -- - /* Free bad block table memory */ - kfree(chip->bbt); - if (!(chip->options & NAND_OWN_BUFFERS)) -@@ -4449,6 +4445,18 @@ void nand_release(struct mtd_info *mtd) - & NAND_BBT_DYNAMICSTRUCT) - kfree(chip->badblock_pattern); - } -+EXPORT_SYMBOL_GPL(nand_cleanup); -+ -+/** -+ * nand_release - [NAND Interface] Unregister the MTD device and free resources -+ * held by the NAND device -+ * @mtd: MTD device structure -+ */ -+void nand_release(struct mtd_info *mtd) -+{ -+ mtd_device_unregister(mtd); -+ nand_cleanup(mtd->priv); -+} - EXPORT_SYMBOL_GPL(nand_release); - - static int __init nand_base_init(void) -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index aaf75d5e6e480..5811235a64c89 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1132,6 +1132,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev, - - bond_dev->type = slave_dev->type; - bond_dev->hard_header_len = slave_dev->hard_header_len; -+ bond_dev->needed_headroom = slave_dev->needed_headroom; - bond_dev->addr_len = slave_dev->addr_len; - - memcpy(bond_dev->broadcast, slave_dev->broadcast, -diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c -index cadcee645f74e..11ce50a057998 100644 ---- a/drivers/net/ethernet/dec/tulip/de2104x.c -+++ b/drivers/net/ethernet/dec/tulip/de2104x.c -@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi - #define DSL CONFIG_DE2104X_DSL - #endif - --#define DE_RX_RING_SIZE 64 -+#define DE_RX_RING_SIZE 128 - #define DE_TX_RING_SIZE 64 - #define DE_RING_BYTES \ - ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index d5bf0f2753079..460b29ac5fd86 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1214,64 +1214,12 @@ static const struct ethtool_ops ravb_ethtool_ops = { - .get_ts_info = ravb_get_ts_info, - }; - --/* MDIO bus init function */ --static int ravb_mdio_init(struct ravb_private *priv) --{ -- struct platform_device *pdev = priv->pdev; -- struct device *dev = &pdev->dev; -- int error; -- -- /* Bitbang init */ -- priv->mdiobb.ops = &bb_ops; -- -- /* MII controller setting */ -- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -- if (!priv->mii_bus) -- return -ENOMEM; -- -- /* Hook up MII support for ethtool */ -- priv->mii_bus->name = "ravb_mii"; -- priv->mii_bus->parent = dev; -- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -- pdev->name, pdev->id); -- -- /* Register MDIO bus */ -- error = of_mdiobus_register(priv->mii_bus, dev->of_node); -- if (error) -- goto out_free_bus; -- -- return 0; -- --out_free_bus: -- free_mdio_bitbang(priv->mii_bus); -- return error; --} -- --/* MDIO bus release function */ --static int ravb_mdio_release(struct ravb_private *priv) --{ -- /* Unregister mdio bus */ -- mdiobus_unregister(priv->mii_bus); -- -- /* Free bitbang info */ -- free_mdio_bitbang(priv->mii_bus); -- -- return 0; --} -- - /* Network device open function for Ethernet AVB */ - static int ravb_open(struct net_device *ndev) - { - struct ravb_private *priv = netdev_priv(ndev); - int error; - -- /* MDIO bus init */ -- error = ravb_mdio_init(priv); -- if (error) { -- netdev_err(ndev, "failed to initialize MDIO\n"); -- return error; -- } -- - napi_enable(&priv->napi[RAVB_BE]); - napi_enable(&priv->napi[RAVB_NC]); - -@@ -1320,7 +1268,6 @@ out_free_irq: - out_napi_off: - napi_disable(&priv->napi[RAVB_NC]); - napi_disable(&priv->napi[RAVB_BE]); -- ravb_mdio_release(priv); - return error; - } - -@@ -1614,8 +1561,6 @@ static int ravb_close(struct net_device *ndev) - ravb_ring_free(ndev, RAVB_BE); - ravb_ring_free(ndev, RAVB_NC); - -- ravb_mdio_release(priv); -- - return 0; - } - -@@ -1719,6 +1664,51 @@ static const struct net_device_ops ravb_netdev_ops = { - .ndo_change_mtu = eth_change_mtu, - }; - -+/* MDIO bus init function */ -+static int ravb_mdio_init(struct ravb_private *priv) -+{ -+ struct platform_device *pdev = priv->pdev; -+ struct device *dev = &pdev->dev; -+ int error; -+ -+ /* Bitbang init */ -+ priv->mdiobb.ops = &bb_ops; -+ -+ /* MII controller setting */ -+ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -+ if (!priv->mii_bus) -+ return -ENOMEM; -+ -+ /* Hook up MII support for ethtool */ -+ priv->mii_bus->name = "ravb_mii"; -+ priv->mii_bus->parent = dev; -+ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -+ pdev->name, pdev->id); -+ -+ /* Register MDIO bus */ -+ error = of_mdiobus_register(priv->mii_bus, dev->of_node); -+ if (error) -+ goto out_free_bus; -+ -+ return 0; -+ -+out_free_bus: -+ free_mdio_bitbang(priv->mii_bus); -+ return error; -+} -+ -+/* MDIO bus release function */ -+static int ravb_mdio_release(struct ravb_private *priv) -+{ -+ /* Unregister mdio bus */ -+ mdiobus_unregister(priv->mii_bus); -+ -+ /* Free bitbang info */ -+ free_mdio_bitbang(priv->mii_bus); -+ -+ return 0; -+} -+ - static const struct of_device_id ravb_match_table[] = { - { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, - { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, -@@ -1857,6 +1847,13 @@ static int ravb_probe(struct platform_device *pdev) - eth_hw_addr_random(ndev); - } - -+ /* MDIO bus init */ -+ error = ravb_mdio_init(priv); -+ if (error) { -+ dev_err(&pdev->dev, "failed to initialize MDIO\n"); -+ goto out_dma_free; -+ } -+ - netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); - netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); - -@@ -1876,6 +1873,8 @@ static int ravb_probe(struct platform_device *pdev) - out_napi_del: - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -+ ravb_mdio_release(priv); -+out_dma_free: - dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, - priv->desc_bat_dma); - out_release: -@@ -1900,6 +1899,7 @@ static int ravb_remove(struct platform_device *pdev) - unregister_netdev(ndev); - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -+ ravb_mdio_release(priv); - pm_runtime_disable(&pdev->dev); - free_netdev(ndev); - platform_set_drvdata(pdev, NULL); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index fbf701e5f1e9f..6fe441696882d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -616,23 +616,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, - struct stmmac_priv *priv = netdev_priv(dev); - int ret; - -- if (!edata->eee_enabled) { -+ if (!priv->dma_cap.eee) -+ return -EOPNOTSUPP; -+ -+ if (!edata->eee_enabled) - stmmac_disable_eee_mode(priv); -- } else { -- /* We are asking for enabling the EEE but it is safe -- * to verify all by invoking the eee_init function. -- * In case of failure it will return an error. -- */ -- edata->eee_enabled = stmmac_eee_init(priv); -- if (!edata->eee_enabled) -- return -EOPNOTSUPP; -- } - - ret = phy_ethtool_set_eee(dev->phydev, edata); - if (ret) - return ret; - -- priv->eee_enabled = edata->eee_enabled; - priv->tx_lpi_timer = edata->tx_lpi_timer; - return 0; - } -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index d0943415aeff1..2ed1453b92241 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -285,7 +285,7 @@ inst_rollback: - for (i--; i >= 0; i--) - __team_option_inst_del_option(team, dst_opts[i]); - -- i = option_count - 1; -+ i = option_count; - alloc_rollback: - for (i--; i >= 0; i--) - kfree(dst_opts[i]); -@@ -2038,6 +2038,7 @@ static void team_setup_by_port(struct net_device *dev, - dev->header_ops = port_dev->header_ops; - dev->type = port_dev->type; - dev->hard_header_len = port_dev->hard_header_len; -+ dev->needed_headroom = port_dev->needed_headroom; - dev->addr_len = port_dev->addr_len; - dev->mtu = port_dev->mtu; - memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); -diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c -index 524a47a281207..b20b380d91bf6 100644 ---- a/drivers/net/usb/rndis_host.c -+++ b/drivers/net/usb/rndis_host.c -@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen) - dev_dbg(&info->control->dev, - "rndis response error, code %d\n", retval); - } -- msleep(20); -+ msleep(40); - } - dev_dbg(&info->control->dev, "rndis response timeout\n"); - return -ETIMEDOUT; -diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c -index 58b1e18fdd64d..7230f1e8210ff 100644 ---- a/drivers/net/usb/rtl8150.c -+++ b/drivers/net/usb/rtl8150.c -@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg) - return 1; - } - --static inline void set_ethernet_addr(rtl8150_t * dev) -+static void set_ethernet_addr(rtl8150_t *dev) - { -- u8 node_id[6]; -+ u8 node_id[ETH_ALEN]; -+ int ret; -+ -+ ret = get_registers(dev, IDR, sizeof(node_id), node_id); - -- get_registers(dev, IDR, sizeof(node_id), node_id); -- memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id)); -+ if (ret == sizeof(node_id)) { -+ ether_addr_copy(dev->netdev->dev_addr, node_id); -+ } else { -+ eth_hw_addr_random(dev->netdev); -+ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", -+ dev->netdev->dev_addr); -+ } - } - - static int rtl8150_set_mac_address(struct net_device *netdev, void *p) -diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c -index f8ed079d8bc3e..7a6f851d9843a 100644 ---- a/drivers/net/wan/hdlc_cisco.c -+++ b/drivers/net/wan/hdlc_cisco.c -@@ -120,6 +120,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type, - skb_put(skb, sizeof(struct cisco_packet)); - skb->priority = TC_PRIO_CONTROL; - skb->dev = dev; -+ skb->protocol = htons(ETH_P_HDLC); - skb_reset_network_header(skb); - - dev_queue_xmit(skb); -diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c -index 89541cc90e877..74d46f7e77eaa 100644 ---- a/drivers/net/wan/hdlc_fr.c -+++ b/drivers/net/wan/hdlc_fr.c -@@ -435,6 +435,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) - if (pvc->state.fecn) /* TX Congestion counter */ - dev->stats.tx_compressed++; - skb->dev = pvc->frad; -+ skb->protocol = htons(ETH_P_HDLC); -+ skb_reset_network_header(skb); - dev_queue_xmit(skb); - return NETDEV_TX_OK; - } -@@ -557,6 +559,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep) - skb_put(skb, i); - skb->priority = TC_PRIO_CONTROL; - skb->dev = dev; -+ skb->protocol = htons(ETH_P_HDLC); - skb_reset_network_header(skb); - - dev_queue_xmit(skb); -diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c -index a2559f213daed..473a9b8ec9ba5 100644 ---- a/drivers/net/wan/hdlc_ppp.c -+++ b/drivers/net/wan/hdlc_ppp.c -@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code, - - skb->priority = TC_PRIO_CONTROL; - skb->dev = dev; -+ skb->protocol = htons(ETH_P_HDLC); - skb_reset_network_header(skb); - skb_queue_tail(&tx_queue, skb); - } -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index c6db9a4e7c457..ef746ba74ab4c 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) - struct net_device *dev; - int size = skb->len; - -- skb->protocol = htons(ETH_P_X25); -- - ptr = skb_push(skb, 2); - - *ptr++ = size % 256; -@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) - - skb->dev = dev = lapbeth->ethdev; - -+ skb->protocol = htons(ETH_P_DEC); -+ - skb_reset_network_header(skb); - - dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0); -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 0bed4733c4f04..9180b24ba60af 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -2474,7 +2474,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn, - */ - static int hotkey_kthread(void *data) - { -- struct tp_nvram_state s[2]; -+ struct tp_nvram_state s[2] = { 0 }; - u32 poll_mask, event_mask; - unsigned int si, so; - unsigned long t; -@@ -6362,8 +6362,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle) - list_for_each_entry(child, &device->children, node) { - acpi_status status = acpi_evaluate_object(child->handle, "_BCL", - NULL, &buffer); -- if (ACPI_FAILURE(status)) -+ if (ACPI_FAILURE(status)) { -+ buffer.length = ACPI_ALLOCATE_BUFFER; - continue; -+ } - - obj = (union acpi_object *)buffer.pointer; - if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) { -diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c -index e57fa26bcff19..29bb679216395 100644 ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -2234,6 +2234,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) - - if (font->width <= 8) { - j = vc->vc_font.height; -+ if (font->charcount * j > FNTSIZE(fontdata)) -+ return -EINVAL; -+ - for (i = 0; i < font->charcount; i++) { - memcpy(data, fontdata, j); - memset(data + j, 0, 32 - j); -@@ -2242,6 +2245,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) - } - } else if (font->width <= 16) { - j = vc->vc_font.height * 2; -+ if (font->charcount * j > FNTSIZE(fontdata)) -+ return -EINVAL; -+ - for (i = 0; i < font->charcount; i++) { - memcpy(data, fontdata, j); - memset(data + j, 0, 64 - j); -@@ -2249,6 +2255,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) - fontdata += j; - } - } else if (font->width <= 24) { -+ if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata)) -+ return -EINVAL; -+ - for (i = 0; i < font->charcount; i++) { - for (j = 0; j < vc->vc_font.height; j++) { - *data++ = fontdata[0]; -@@ -2261,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) - } - } else { - j = vc->vc_font.height * 4; -+ if (font->charcount * j > FNTSIZE(fontdata)) -+ return -EINVAL; -+ - for (i = 0; i < font->charcount; i++) { - memcpy(data, fontdata, j); - memset(data + j, 0, 128 - j); -diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h -index 5ebdccd070eb8..701eecab33171 100644 ---- a/drivers/video/console/fbcon.h -+++ b/drivers/video/console/fbcon.h -@@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, - #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) - #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) - --/* Font */ --#define REFCOUNT(fd) (((int *)(fd))[-1]) --#define FNTSIZE(fd) (((int *)(fd))[-2]) --#define FNTCHARCNT(fd) (((int *)(fd))[-3]) --#define FNTSUM(fd) (((int *)(fd))[-4]) --#define FONT_EXTRA_WORDS 4 -- - /* - * Scroll Method - */ -diff --git a/drivers/video/console/fbcon_rotate.c b/drivers/video/console/fbcon_rotate.c -index db6528f2d3f29..0e33210819454 100644 ---- a/drivers/video/console/fbcon_rotate.c -+++ b/drivers/video/console/fbcon_rotate.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include "fbcon.h" - #include "fbcon_rotate.h" -diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c -index bd0c6e53bec19..740284a4554c2 100644 ---- a/drivers/video/console/newport_con.c -+++ b/drivers/video/console/newport_con.c -@@ -35,12 +35,6 @@ - - #define FONT_DATA ((unsigned char *)font_vga_8x16.data) - --/* borrowed from fbcon.c */ --#define REFCOUNT(fd) (((int *)(fd))[-1]) --#define FNTSIZE(fd) (((int *)(fd))[-2]) --#define FNTCHARCNT(fd) (((int *)(fd))[-3]) --#define FONT_EXTRA_WORDS 3 -- - static unsigned char *font_data[MAX_NR_CONSOLES]; - - static struct newport_regs *npregs; -@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op) - FNTSIZE(new_data) = size; - FNTCHARCNT(new_data) = op->charcount; - REFCOUNT(new_data) = 0; /* usage counter */ -+ FNTSUM(new_data) = 0; - - p = new_data; - for (i = 0; i < op->charcount; i++) { -diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c -index 3c0b242dba5f0..691717276c3e2 100644 ---- a/drivers/video/console/tileblit.c -+++ b/drivers/video/console/tileblit.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include "fbcon.h" - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index e5324642023d6..2ef15a4018d01 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -217,8 +217,7 @@ struct eventpoll { - struct file *file; - - /* used to optimize loop detection check */ -- int visited; -- struct list_head visited_list_link; -+ u64 gen; - }; - - /* Wait structure used by the poll hooks */ -@@ -262,6 +261,8 @@ static long max_user_watches __read_mostly; - */ - static DEFINE_MUTEX(epmutex); - -+static u64 loop_check_gen = 0; -+ - /* Used to check for epoll file descriptor inclusion loops */ - static struct nested_calls poll_loop_ncalls; - -@@ -277,9 +278,6 @@ static struct kmem_cache *epi_cache __read_mostly; - /* Slab cache used to allocate "struct eppoll_entry" */ - static struct kmem_cache *pwq_cache __read_mostly; - --/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ --static LIST_HEAD(visited_list); -- - /* - * List of files with newly added links, where we may need to limit the number - * of emanating paths. Protected by the epmutex. -@@ -1234,7 +1232,7 @@ static int reverse_path_check(void) - - static int ep_create_wakeup_source(struct epitem *epi) - { -- const char *name; -+ struct name_snapshot n; - struct wakeup_source *ws; - - if (!epi->ep->ws) { -@@ -1243,8 +1241,9 @@ static int ep_create_wakeup_source(struct epitem *epi) - return -ENOMEM; - } - -- name = epi->ffd.file->f_path.dentry->d_name.name; -- ws = wakeup_source_register(name); -+ take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry); -+ ws = wakeup_source_register(n.name); -+ release_dentry_name_snapshot(&n); - - if (!ws) - return -ENOMEM; -@@ -1304,6 +1303,22 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, - RCU_INIT_POINTER(epi->ws, NULL); - } - -+ /* Add the current item to the list of active epoll hook for this file */ -+ spin_lock(&tfile->f_lock); -+ list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); -+ spin_unlock(&tfile->f_lock); -+ -+ /* -+ * Add the current item to the RB tree. All RB tree operations are -+ * protected by "mtx", and ep_insert() is called with "mtx" held. -+ */ -+ ep_rbtree_insert(ep, epi); -+ -+ /* now check if we've created too many backpaths */ -+ error = -EINVAL; -+ if (full_check && reverse_path_check()) -+ goto error_remove_epi; -+ - /* Initialize the poll table using the queue callback */ - epq.epi = epi; - init_poll_funcptr(&epq.pt, ep_ptable_queue_proc); -@@ -1326,22 +1341,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, - if (epi->nwait < 0) - goto error_unregister; - -- /* Add the current item to the list of active epoll hook for this file */ -- spin_lock(&tfile->f_lock); -- list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); -- spin_unlock(&tfile->f_lock); -- -- /* -- * Add the current item to the RB tree. All RB tree operations are -- * protected by "mtx", and ep_insert() is called with "mtx" held. -- */ -- ep_rbtree_insert(ep, epi); -- -- /* now check if we've created too many backpaths */ -- error = -EINVAL; -- if (full_check && reverse_path_check()) -- goto error_remove_epi; -- - /* We have to drop the new item inside our item list to keep track of it */ - spin_lock_irqsave(&ep->lock, flags); - -@@ -1367,6 +1366,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, - - return 0; - -+error_unregister: -+ ep_unregister_pollwait(ep, epi); - error_remove_epi: - spin_lock(&tfile->f_lock); - list_del_rcu(&epi->fllink); -@@ -1374,9 +1375,6 @@ error_remove_epi: - - rb_erase(&epi->rbn, &ep->rbr); - --error_unregister: -- ep_unregister_pollwait(ep, epi); -- - /* - * We need to do this because an event could have been arrived on some - * allocated wait queue. Note that we don't care about the ep->ovflist -@@ -1697,13 +1695,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - struct epitem *epi; - - mutex_lock_nested(&ep->mtx, call_nests + 1); -- ep->visited = 1; -- list_add(&ep->visited_list_link, &visited_list); -+ ep->gen = loop_check_gen; - for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) { - epi = rb_entry(rbp, struct epitem, rbn); - if (unlikely(is_file_epoll(epi->ffd.file))) { - ep_tovisit = epi->ffd.file->private_data; -- if (ep_tovisit->visited) -+ if (ep_tovisit->gen == loop_check_gen) - continue; - error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, - ep_loop_check_proc, epi->ffd.file, -@@ -1744,18 +1741,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - */ - static int ep_loop_check(struct eventpoll *ep, struct file *file) - { -- int ret; -- struct eventpoll *ep_cur, *ep_next; -- -- ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, -+ return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, - ep_loop_check_proc, file, ep, current); -- /* clear visited list */ -- list_for_each_entry_safe(ep_cur, ep_next, &visited_list, -- visited_list_link) { -- ep_cur->visited = 0; -- list_del(&ep_cur->visited_list_link); -- } -- return ret; - } - - static void clear_tfile_check_list(void) -@@ -1899,6 +1886,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - mutex_lock_nested(&ep->mtx, 0); - if (op == EPOLL_CTL_ADD) { - if (!list_empty(&f.file->f_ep_links) || -+ ep->gen == loop_check_gen || - is_file_epoll(tf.file)) { - full_check = 1; - mutex_unlock(&ep->mtx); -@@ -1957,6 +1945,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - error_tgt_fput: - if (full_check) { - clear_tfile_check_list(); -+ loop_check_gen++; - mutex_unlock(&epmutex); - } - -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 21e5fcbcb2272..ba7e98d8ce098 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -562,6 +562,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en - xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); - - do { -+ if (entry->label) -+ entry->label->len = NFS4_MAXLABELLEN; -+ - status = xdr_decode(desc, entry, &stream); - if (status != 0) { - if (status == -EAGAIN) -diff --git a/include/linux/font.h b/include/linux/font.h -index d6821769dd1e1..f85e70bd4793e 100644 ---- a/include/linux/font.h -+++ b/include/linux/font.h -@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres, - /* Max. length for the name of a predefined font */ - #define MAX_FONT_NAME 32 - -+/* Extra word getters */ -+#define REFCOUNT(fd) (((int *)(fd))[-1]) -+#define FNTSIZE(fd) (((int *)(fd))[-2]) -+#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -+#define FNTSUM(fd) (((int *)(fd))[-4]) -+ -+#define FONT_EXTRA_WORDS 4 -+ -+struct font_data { -+ unsigned int extra[FONT_EXTRA_WORDS]; -+ const unsigned char data[]; -+} __packed; -+ - #endif /* _VIDEO_FONT_H */ -diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h -index 93fc372007937..1a066faf7b801 100644 ---- a/include/linux/mtd/nand.h -+++ b/include/linux/mtd/nand.h -@@ -38,7 +38,7 @@ extern int nand_scan_ident(struct mtd_info *mtd, int max_chips, - struct nand_flash_dev *table); - extern int nand_scan_tail(struct mtd_info *mtd); - --/* Free resources held by the NAND device */ -+/* Unregister the MTD device and free resources held by the NAND device */ - extern void nand_release(struct mtd_info *mtd); - - /* Internal helper for board drivers which need to override command function */ -@@ -1029,4 +1029,8 @@ int nand_check_erased_ecc_chunk(void *data, int datalen, - void *ecc, int ecclen, - void *extraoob, int extraooblen, - int threshold); -+ -+/* Free resources held by the NAND device */ -+void nand_cleanup(struct nand_chip *chip); -+ - #endif /* __LINUX_MTD_NAND_H */ -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 89685c7bc7c0f..7a9c18deaa512 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -1730,21 +1730,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay - static inline int xfrm_replay_clone(struct xfrm_state *x, - struct xfrm_state *orig) - { -- x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), -+ -+ x->replay_esn = kmemdup(orig->replay_esn, -+ xfrm_replay_state_esn_len(orig->replay_esn), - GFP_KERNEL); - if (!x->replay_esn) - return -ENOMEM; -- -- x->replay_esn->bmp_len = orig->replay_esn->bmp_len; -- x->replay_esn->replay_window = orig->replay_esn->replay_window; -- -- x->preplay_esn = kmemdup(x->replay_esn, -- xfrm_replay_state_esn_len(x->replay_esn), -+ x->preplay_esn = kmemdup(orig->preplay_esn, -+ xfrm_replay_state_esn_len(orig->preplay_esn), - GFP_KERNEL); -- if (!x->preplay_esn) { -- kfree(x->replay_esn); -+ if (!x->preplay_esn) - return -ENOMEM; -- } - - return 0; - } -diff --git a/kernel/kmod.c b/kernel/kmod.c -index e4e5e98002fe3..3f3bbae4cec33 100644 ---- a/kernel/kmod.c -+++ b/kernel/kmod.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -222,6 +223,14 @@ static int call_usermodehelper_exec_async(void *data) - flush_signal_handlers(current, 1); - spin_unlock_irq(¤t->sighand->siglock); - -+ /* -+ * Initial kernel threads share ther FS with init, in order to -+ * get the init root directory. But we've now created a new -+ * thread that is going to execve a user process and has its own -+ * 'struct fs_struct'. Reset umask to the default. -+ */ -+ current->fs->umask = 0022; -+ - /* - * Our parent (unbound workqueue) runs with elevated scheduling - * priority. Avoid propagating that into the userspace child. -diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c -index 6be72bb218ee4..87e904f550c15 100644 ---- a/lib/fonts/font_10x18.c -+++ b/lib/fonts/font_10x18.c -@@ -7,8 +7,8 @@ - - #define FONTDATAMAX 9216 - --static const unsigned char fontdata_10x18[FONTDATAMAX] = { -- -+static struct font_data fontdata_10x18 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, 0x00, /* 0000000000 */ - 0x00, 0x00, /* 0000000000 */ -@@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = { - 0x00, 0x00, /* 0000000000 */ - 0x00, 0x00, /* 0000000000 */ - 0x00, 0x00, /* 0000000000 */ -- --}; -+} }; - - - const struct font_desc font_10x18 = { -@@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = { - .name = "10x18", - .width = 10, - .height = 18, -- .data = fontdata_10x18, -+ .data = fontdata_10x18.data, - #ifdef __sparc__ - .pref = 5, - #else -diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c -index b20620904d314..896ffa987c97b 100644 ---- a/lib/fonts/font_6x10.c -+++ b/lib/fonts/font_6x10.c -@@ -1,7 +1,9 @@ - #include - --static const unsigned char fontdata_6x10[] = { -+#define FONTDATAMAX 2560 - -+static struct font_data fontdata_6x10 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -@@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10[] = { - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -- --}; -+} }; - - const struct font_desc font_6x10 = { - .idx = FONT6x10_IDX, - .name = "6x10", - .width = 6, - .height = 10, -- .data = fontdata_6x10, -+ .data = fontdata_6x10.data, - .pref = 0, - }; -diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c -index 46e86e67aa6aa..eb46a59307d2e 100644 ---- a/lib/fonts/font_6x11.c -+++ b/lib/fonts/font_6x11.c -@@ -8,8 +8,8 @@ - - #define FONTDATAMAX (11*256) - --static const unsigned char fontdata_6x11[FONTDATAMAX] = { -- -+static struct font_data fontdata_6x11 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -@@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = { - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -- --}; -+} }; - - - const struct font_desc font_vga_6x11 = { -@@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = { - .name = "ProFont6x11", - .width = 6, - .height = 11, -- .data = fontdata_6x11, -+ .data = fontdata_6x11.data, - /* Try avoiding this font if possible unless on MAC */ - .pref = -2000, - }; -diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c -index 3b7dbf9c060b3..c88b3bba001bd 100644 ---- a/lib/fonts/font_7x14.c -+++ b/lib/fonts/font_7x14.c -@@ -7,8 +7,8 @@ - - #define FONTDATAMAX 3584 - --static const unsigned char fontdata_7x14[FONTDATAMAX] = { -- -+static struct font_data fontdata_7x14 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 0000000 */ - 0x00, /* 0000000 */ -@@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = { - 0x00, /* 0000000 */ - 0x00, /* 0000000 */ - 0x00, /* 0000000 */ -- --}; -+} }; - - - const struct font_desc font_7x14 = { -@@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = { - .name = "7x14", - .width = 7, - .height = 14, -- .data = fontdata_7x14, -+ .data = fontdata_7x14.data, - .pref = 0, - }; -diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c -index 00a0c67a5c7d0..ba53e2643670b 100644 ---- a/lib/fonts/font_8x16.c -+++ b/lib/fonts/font_8x16.c -@@ -9,8 +9,8 @@ - - #define FONTDATAMAX 4096 - --static const unsigned char fontdata_8x16[FONTDATAMAX] = { -- -+static struct font_data fontdata_8x16 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -@@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = { - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -- --}; -+} }; - - - const struct font_desc font_vga_8x16 = { -@@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = { - .name = "VGA8x16", - .width = 8, - .height = 16, -- .data = fontdata_8x16, -+ .data = fontdata_8x16.data, - .pref = 0, - }; - EXPORT_SYMBOL(font_vga_8x16); -diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c -index 9f56efe2cee72..4d28b81e8237c 100644 ---- a/lib/fonts/font_8x8.c -+++ b/lib/fonts/font_8x8.c -@@ -8,8 +8,8 @@ - - #define FONTDATAMAX 2048 - --static const unsigned char fontdata_8x8[FONTDATAMAX] = { -- -+static struct font_data fontdata_8x8 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -@@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = { - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -- --}; -+} }; - - - const struct font_desc font_vga_8x8 = { -@@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = { - .name = "VGA8x8", - .width = 8, - .height = 8, -- .data = fontdata_8x8, -+ .data = fontdata_8x8.data, - .pref = 0, - }; -diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c -index 639e31ae1100a..957398b762d38 100644 ---- a/lib/fonts/font_acorn_8x8.c -+++ b/lib/fonts/font_acorn_8x8.c -@@ -2,7 +2,10 @@ - - #include - --static const unsigned char acorndata_8x8[] = { -+#define FONTDATAMAX 2048 -+ -+static struct font_data acorndata_8x8 = { -+{ 0, 0, FONTDATAMAX, 0 }, { - /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ - /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ - /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */ -@@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8[] = { - /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00, - /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00, - /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 --}; -+} }; - - const struct font_desc font_acorn_8x8 = { - .idx = ACORN8x8_IDX, - .name = "Acorn8x8", - .width = 8, - .height = 8, -- .data = acorndata_8x8, -+ .data = acorndata_8x8.data, - #ifdef CONFIG_ARCH_ACORN - .pref = 20, - #else -diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c -index 838caa1cfef70..1449876c6a270 100644 ---- a/lib/fonts/font_mini_4x6.c -+++ b/lib/fonts/font_mini_4x6.c -@@ -43,8 +43,8 @@ __END__; - - #define FONTDATAMAX 1536 - --static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { -- -+static struct font_data fontdata_mini_4x6 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /*{*/ - /* Char 0: ' ' */ - 0xee, /*= [*** ] */ -@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { - 0xee, /*= [*** ] */ - 0x00, /*= [ ] */ - /*}*/ --}; -+} }; - - const struct font_desc font_mini_4x6 = { - .idx = MINI4x6_IDX, - .name = "MINI4x6", - .width = 4, - .height = 6, -- .data = fontdata_mini_4x6, -+ .data = fontdata_mini_4x6.data, - .pref = 3, - }; - -diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c -index dc6ad539ca4e4..4649314333bb0 100644 ---- a/lib/fonts/font_pearl_8x8.c -+++ b/lib/fonts/font_pearl_8x8.c -@@ -13,8 +13,8 @@ - - #define FONTDATAMAX 2048 - --static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { -- -+static struct font_data fontdata_pearl8x8 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -@@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ - 0x00, /* 00000000 */ -- --}; -+} }; - - const struct font_desc font_pearl_8x8 = { - .idx = PEARL8x8_IDX, - .name = "PEARL8x8", - .width = 8, - .height = 8, -- .data = fontdata_pearl8x8, -+ .data = fontdata_pearl8x8.data, - .pref = 2, - }; -diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c -index d3643853c33af..c6967cdf4207b 100644 ---- a/lib/fonts/font_sun12x22.c -+++ b/lib/fonts/font_sun12x22.c -@@ -2,8 +2,8 @@ - - #define FONTDATAMAX 11264 - --static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { -- -+static struct font_data fontdata_sun12x22 = { -+ { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, 0x00, /* 000000000000 */ - 0x00, 0x00, /* 000000000000 */ -@@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { - 0x00, 0x00, /* 000000000000 */ - 0x00, 0x00, /* 000000000000 */ - 0x00, 0x00, /* 000000000000 */ -- --}; -+} }; - - - const struct font_desc font_sun_12x22 = { -@@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = { - .name = "SUN12x22", - .width = 12, - .height = 22, -- .data = fontdata_sun12x22, -+ .data = fontdata_sun12x22.data, - #ifdef __sparc__ - .pref = 5, - #else -diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c -index 268151325b83e..7d979e5788999 100644 ---- a/lib/fonts/font_sun8x16.c -+++ b/lib/fonts/font_sun8x16.c -@@ -2,7 +2,8 @@ - - #define FONTDATAMAX 4096 - --static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { -+static struct font_data fontdata_sun8x16 = { -+{ 0, 0, FONTDATAMAX, 0 }, { - /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, - /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, - /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00, -@@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { - /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, - /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00, - /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, --}; -+} }; - - const struct font_desc font_sun_8x16 = { - .idx = SUN8x16_IDX, - .name = "SUN8x16", - .width = 8, - .height = 16, -- .data = fontdata_sun8x16, -+ .data = fontdata_sun8x16.data, - #ifdef __sparc__ - .pref = 10, - #else -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index f324a11244189..b349b8410ec80 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -1022,6 +1022,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[], - if (!tb[CTA_TUPLE_IP]) - return -EINVAL; - -+ if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6) -+ return -EOPNOTSUPP; - tuple->src.l3num = l3num; - - err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple); -diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c -index 91d43ab3a9610..ea615e53eab28 100644 ---- a/net/rxrpc/ar-key.c -+++ b/net/rxrpc/ar-key.c -@@ -897,7 +897,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen) - - _enter(""); - -- if (optlen <= 0 || optlen > PAGE_SIZE - 1) -+ if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities) - return -EINVAL; - - description = kmalloc(optlen + 1, GFP_KERNEL); -@@ -1114,7 +1114,8 @@ static long rxrpc_read(const struct key *key, - break; - - default: /* we have a ticket we can't encode */ -- BUG(); -+ pr_err("Unsupported key token type (%u)\n", -+ token->security_index); - continue; - } - -@@ -1149,6 +1150,14 @@ static long rxrpc_read(const struct key *key, - goto fault; \ - xdr += (_l + 3) >> 2; \ - } while(0) -+#define ENCODE_BYTES(l, s) \ -+ do { \ -+ u32 _l = (l); \ -+ memcpy(xdr, (s), _l); \ -+ if (_l & 3) \ -+ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ -+ xdr += (_l + 3) >> 2; \ -+ } while(0) - #define ENCODE64(x) \ - do { \ - __be64 y = cpu_to_be64(x); \ -@@ -1177,7 +1186,7 @@ static long rxrpc_read(const struct key *key, - case RXRPC_SECURITY_RXKAD: - ENCODE(token->kad->vice_id); - ENCODE(token->kad->kvno); -- ENCODE_DATA(8, token->kad->session_key); -+ ENCODE_BYTES(8, token->kad->session_key); - ENCODE(token->kad->start); - ENCODE(token->kad->expiry); - ENCODE(token->kad->primary_flag); -@@ -1227,7 +1236,6 @@ static long rxrpc_read(const struct key *key, - break; - - default: -- BUG(); - break; - } - -diff --git a/net/sctp/auth.c b/net/sctp/auth.c -index 1543e39f47c33..04cd87d26ed1b 100644 ---- a/net/sctp/auth.c -+++ b/net/sctp/auth.c -@@ -496,6 +496,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp) - out_err: - /* Clean up any successful allocations */ - sctp_auth_destroy_hmacs(ep->auth_hmacs); -+ ep->auth_hmacs = NULL; - return -ENOMEM; - } - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 55de35c4434a8..95366e35ab134 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -3101,6 +3101,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) - if (err) - return err; - -+ if (key.idx < 0) -+ return -EINVAL; -+ - if (info->attrs[NL80211_ATTR_MAC]) - mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); - -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index d3595f1d00f25..5bb5950d6276b 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -742,7 +742,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, - */ - if (x->km.state == XFRM_STATE_VALID) { - if ((x->sel.family && -- !xfrm_selector_match(&x->sel, fl, x->sel.family)) || -+ (x->sel.family != family || -+ !xfrm_selector_match(&x->sel, fl, family))) || - !security_xfrm_state_pol_flow_match(x, pol, fl)) - return; - -@@ -755,7 +756,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, - *acq_in_progress = 1; - } else if (x->km.state == XFRM_STATE_ERROR || - x->km.state == XFRM_STATE_EXPIRED) { -- if (xfrm_selector_match(&x->sel, fl, x->sel.family) && -+ if ((!x->sel.family || -+ (x->sel.family == family && -+ xfrm_selector_match(&x->sel, fl, family))) && - security_xfrm_state_pol_flow_match(x, pol, fl)) - *error = -ESRCH; - } -@@ -791,7 +794,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, - tmpl->mode == x->props.mode && - tmpl->id.proto == x->id.proto && - (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) -- xfrm_state_look_at(pol, x, fl, encap_family, -+ xfrm_state_look_at(pol, x, fl, family, - &best, &acquire_in_progress, &error); - } - if (best || acquire_in_progress) -@@ -807,7 +810,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, - tmpl->mode == x->props.mode && - tmpl->id.proto == x->id.proto && - (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) -- xfrm_state_look_at(pol, x, fl, encap_family, -+ xfrm_state_look_at(pol, x, fl, family, - &best, &acquire_in_progress, &error); - } - -@@ -1207,7 +1210,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig) - x->tfcpad = orig->tfcpad; - x->replay_maxdiff = orig->replay_maxdiff; - x->replay_maxage = orig->replay_maxage; -- x->curlft.add_time = orig->curlft.add_time; -+ memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); - x->km.state = orig->km.state; - x->km.seq = orig->km.seq; - x->replay = orig->replay; -diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c -index 4e64ba8163bb1..7d6dd799bbcdc 100644 ---- a/tools/perf/builtin-top.c -+++ b/tools/perf/builtin-top.c -@@ -626,7 +626,9 @@ repeat: - delay_msecs = top->delay_secs * 1000; - set_term_quiet_input(&save); - /* trash return*/ -- getc(stdin); -+ clearerr(stdin); -+ if (poll(&stdin_poll, 1, 0) > 0) -+ getc(stdin); - - while (!done) { - perf_top__print_sym_table(top); diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.239-240.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.239-240.patch deleted file mode 100644 index 1937046492..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.239-240.patch +++ /dev/null @@ -1,555 +0,0 @@ -diff --git a/Makefile b/Makefile -index 74072b5a958b2..69e7cd30e6465 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 239 -+SUBLEVEL = 240 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c -index 367b6661ee041..4dda526bd21b8 100644 ---- a/drivers/crypto/qat/qat_common/qat_algs.c -+++ b/drivers/crypto/qat/qat_common/qat_algs.c -@@ -822,6 +822,11 @@ static int qat_alg_aead_dec(struct aead_request *areq) - struct icp_qat_fw_la_bulk_req *msg; - int digst_size = crypto_aead_authsize(aead_tfm); - int ret, ctr = 0; -+ u32 cipher_len; -+ -+ cipher_len = areq->cryptlen - digst_size; -+ if (cipher_len % AES_BLOCK_SIZE != 0) -+ return -EINVAL; - - ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); - if (unlikely(ret)) -@@ -836,7 +841,7 @@ static int qat_alg_aead_dec(struct aead_request *areq) - qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; - qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; - cipher_param = (void *)&qat_req->req.serv_specif_rqpars; -- cipher_param->cipher_length = areq->cryptlen - digst_size; -+ cipher_param->cipher_length = cipher_len; - cipher_param->cipher_offset = areq->assoclen; - memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); - auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); -@@ -865,6 +870,9 @@ static int qat_alg_aead_enc(struct aead_request *areq) - uint8_t *iv = areq->iv; - int ret, ctr = 0; - -+ if (areq->cryptlen % AES_BLOCK_SIZE != 0) -+ return -EINVAL; -+ - ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); - if (unlikely(ret)) - return ret; -diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c -index a2eb87d74656f..8a1440a573a33 100644 ---- a/drivers/media/usb/usbtv/usbtv-core.c -+++ b/drivers/media/usb/usbtv/usbtv-core.c -@@ -96,7 +96,8 @@ static int usbtv_probe(struct usb_interface *intf, - - usbtv_audio_fail: - /* we must not free at this point */ -- usb_get_dev(usbtv->udev); -+ v4l2_device_get(&usbtv->v4l2_dev); -+ /* this will undo the v4l2_device_get() */ - usbtv_video_free(usbtv); - - usbtv_video_fail: -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 57001f8f727a3..6ed2959ce4dc0 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -1917,13 +1917,13 @@ static int __unregister(struct device *dev, void *null) - */ - void spi_unregister_master(struct spi_master *master) - { -+ device_for_each_child(&master->dev, NULL, __unregister); -+ - if (master->queued) { - if (spi_destroy_queue(master)) - dev_err(&master->dev, "queue remove failed\n"); - } - -- device_for_each_child(&master->dev, NULL, __unregister); -- - mutex_lock(&board_lock); - list_del(&master->list); - mutex_unlock(&board_lock); -diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c -index 95e53cfd76a41..51f9a7800edf5 100644 ---- a/drivers/staging/comedi/drivers/vmk80xx.c -+++ b/drivers/staging/comedi/drivers/vmk80xx.c -@@ -676,6 +676,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) - if (!devpriv->ep_rx || !devpriv->ep_tx) - return -ENODEV; - -+ if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx)) -+ return -EINVAL; -+ - return 0; - } - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 25e76d4c15054..5b42b8d760cb4 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1032,6 +1032,11 @@ static const struct usb_device_id id_table_combined[] = { - /* U-Blox devices */ - { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, - { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, -+ /* FreeCalypso USB adapters */ -+ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index c33e06752b5f0..f3302516a1e4f 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -38,6 +38,13 @@ - - #define FTDI_LUMEL_PD12_PID 0x6002 - -+/* -+ * Custom USB adapters made by Falconia Partners LLC -+ * for FreeCalypso project, ID codes allocated to Falconia by FTDI. -+ */ -+#define FTDI_FALCONIA_JTAG_BUF_PID 0x7150 -+#define FTDI_FALCONIA_JTAG_UNBUF_PID 0x7151 -+ - /* Sienna Serial Interface by Secyourit GmbH */ - #define FTDI_SIENNA_PID 0x8348 - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 8cff50ef4fd14..5017d37afe392 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -529,6 +529,7 @@ static void option_instat_callback(struct urb *urb); - /* Cellient products */ - #define CELLIENT_VENDOR_ID 0x2692 - #define CELLIENT_PRODUCT_MEN200 0x9005 -+#define CELLIENT_PRODUCT_MPL200 0x9025 - - /* Hyundai Petatel Inc. products */ - #define PETATEL_VENDOR_ID 0x1ff4 -@@ -1171,6 +1172,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ -+ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -1967,6 +1970,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, - { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, -+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), -+ .driver_info = RSVD(1) | RSVD(4) }, - { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, - { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, - { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 4fcded2971d1d..bf5533d6d83bd 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -89,6 +89,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LD381GC_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 54d2fb974a418..9d27c076f477e 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -125,6 +125,7 @@ - - /* Hewlett-Packard POS Pole Displays */ - #define HP_VENDOR_ID 0x03f0 -+#define HP_LD381GC_PRODUCT_ID 0x0183 - #define HP_LM920_PRODUCT_ID 0x026b - #define HP_TD620_PRODUCT_ID 0x0956 - #define HP_LD960_PRODUCT_ID 0x0b39 -diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c -index 60ba35087d126..cfb4691d92741 100644 ---- a/fs/reiserfs/inode.c -+++ b/fs/reiserfs/inode.c -@@ -1553,11 +1553,7 @@ void reiserfs_read_locked_inode(struct inode *inode, - * set version 1, version 2 could be used too, because stat data - * key is the same in both versions - */ -- key.version = KEY_FORMAT_3_5; -- key.on_disk_key.k_dir_id = dirino; -- key.on_disk_key.k_objectid = inode->i_ino; -- key.on_disk_key.k_offset = 0; -- key.on_disk_key.k_type = 0; -+ _make_cpu_key(&key, KEY_FORMAT_3_5, dirino, inode->i_ino, 0, 0, 3); - - /* look for the object's stat data */ - retval = search_item(inode->i_sb, &key, &path_to_sd); -diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c -index d424b3d4bf3b4..92d39cbc2d64d 100644 ---- a/fs/reiserfs/xattr.c -+++ b/fs/reiserfs/xattr.c -@@ -656,6 +656,13 @@ reiserfs_xattr_get(struct inode *inode, const char *name, void *buffer, - if (get_inode_sd_version(inode) == STAT_DATA_V1) - return -EOPNOTSUPP; - -+ /* -+ * priv_root needn't be initialized during mount so allow initial -+ * lookups to succeed. -+ */ -+ if (!REISERFS_SB(inode->i_sb)->priv_root) -+ return 0; -+ - dentry = xattr_lookup(inode, name, XATTR_REPLACE); - if (IS_ERR(dentry)) { - err = PTR_ERR(dentry); -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 7c0c83dfe86e3..5aaf6cdb121a1 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -1235,16 +1235,34 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) - conn->security_cfm_cb(conn, status); - } - --static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status, -- __u8 encrypt) -+static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) - { - struct hci_cb *cb; -+ __u8 encrypt; -+ -+ if (conn->state == BT_CONFIG) { -+ if (!status) -+ conn->state = BT_CONNECTED; - -- if (conn->sec_level == BT_SECURITY_SDP) -- conn->sec_level = BT_SECURITY_LOW; -+ hci_connect_cfm(conn, status); -+ hci_conn_drop(conn); -+ return; -+ } - -- if (conn->pending_sec_level > conn->sec_level) -- conn->sec_level = conn->pending_sec_level; -+ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) -+ encrypt = 0x00; -+ else if (test_bit(HCI_CONN_AES_CCM, &conn->flags)) -+ encrypt = 0x02; -+ else -+ encrypt = 0x01; -+ -+ if (!status) { -+ if (conn->sec_level == BT_SECURITY_SDP) -+ conn->sec_level = BT_SECURITY_LOW; -+ -+ if (conn->pending_sec_level > conn->sec_level) -+ conn->sec_level = conn->pending_sec_level; -+ } - - mutex_lock(&hci_cb_list_lock); - list_for_each_entry(cb, &hci_cb_list, list) { -diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c -index 5f123c3320a7b..8f918155685db 100644 ---- a/net/bluetooth/a2mp.c -+++ b/net/bluetooth/a2mp.c -@@ -233,6 +233,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_info_req req; - - found = true; -+ -+ memset(&req, 0, sizeof(req)); -+ - req.id = cl->id; - a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), - sizeof(req), &req); -@@ -312,6 +315,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, - if (!hdev || hdev->dev_type != HCI_AMP) { - struct a2mp_info_rsp rsp; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.id = req->id; - rsp.status = A2MP_STATUS_INVALID_CTRL_ID; - -@@ -355,6 +360,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, - if (!ctrl) - return -ENOMEM; - -+ memset(&req, 0, sizeof(req)); -+ - req.id = rsp->id; - a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), - &req); -@@ -383,6 +390,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_amp_assoc_rsp rsp; - rsp.id = req->id; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - if (tmp) { - rsp.status = A2MP_STATUS_COLLISION_OCCURED; - amp_mgr_put(tmp); -@@ -471,7 +480,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_cmd *hdr) - { - struct a2mp_physlink_req *req = (void *) skb->data; -- - struct a2mp_physlink_rsp rsp; - struct hci_dev *hdev; - struct hci_conn *hcon; -@@ -482,6 +490,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - - BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.local_id = req->remote_id; - rsp.remote_id = req->local_id; - -@@ -560,6 +570,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - - BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.local_id = req->remote_id; - rsp.remote_id = req->local_id; - rsp.status = A2MP_STATUS_SUCCESS; -@@ -682,6 +694,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) - if (err) { - struct a2mp_cmd_rej rej; - -+ memset(&rej, 0, sizeof(rej)); -+ - rej.reason = cpu_to_le16(0); - hdr = (void *) skb->data; - -@@ -905,6 +919,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev) - - BT_DBG("%s mgr %p", hdev->name, mgr); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.id = hdev->id; - rsp.status = A2MP_STATUS_INVALID_CTRL_ID; - -@@ -1002,6 +1018,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) - if (!mgr) - return; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); - if (!hs_hcon) { - rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; -@@ -1034,6 +1052,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan) - - mgr->bredr_chan = chan; - -+ memset(&req, 0, sizeof(req)); -+ - req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); - req.ext_feat = 0; - a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 114bcf6ea9168..2c94e3cd3545f 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1173,6 +1173,23 @@ int hci_conn_check_link_mode(struct hci_conn *conn) - return 0; - } - -+ /* AES encryption is required for Level 4: -+ * -+ * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C -+ * page 1319: -+ * -+ * 128-bit equivalent strength for link and encryption keys -+ * required using FIPS approved algorithms (E0 not allowed, -+ * SAFER+ not allowed, and P-192 not allowed; encryption key -+ * not shortened) -+ */ -+ if (conn->sec_level == BT_SECURITY_FIPS && -+ !test_bit(HCI_CONN_AES_CCM, &conn->flags)) { -+ bt_dev_err(conn->hdev, -+ "Invalid security: Missing AES-CCM usage"); -+ return 0; -+ } -+ - if (hci_conn_ssp_enabled(conn) && - !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) - return 0; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 03319ab8a7c6e..7cee89fddcd50 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -1133,6 +1133,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr, - { - struct discovery_state *d = &hdev->discovery; - -+ if (len > HCI_MAX_AD_LENGTH) -+ return; -+ - bacpy(&d->last_adv_addr, bdaddr); - d->last_adv_addr_type = bdaddr_type; - d->last_adv_rssi = rssi; -@@ -2479,7 +2482,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) - &cp); - } else { - clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); -- hci_encrypt_cfm(conn, ev->status, 0x00); -+ hci_encrypt_cfm(conn, ev->status); - } - } - -@@ -2565,22 +2568,7 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status, - conn->enc_key_size = rp->key_size; - } - -- if (conn->state == BT_CONFIG) { -- conn->state = BT_CONNECTED; -- hci_connect_cfm(conn, 0); -- hci_conn_drop(conn); -- } else { -- u8 encrypt; -- -- if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) -- encrypt = 0x00; -- else if (test_bit(HCI_CONN_AES_CCM, &conn->flags)) -- encrypt = 0x02; -- else -- encrypt = 0x01; -- -- hci_encrypt_cfm(conn, 0, encrypt); -- } -+ hci_encrypt_cfm(conn, 0); - - unlock: - hci_dev_unlock(hdev); -@@ -2627,24 +2615,20 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb) - - clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); - -+ /* Check link security requirements are met */ -+ if (!hci_conn_check_link_mode(conn)) -+ ev->status = HCI_ERROR_AUTH_FAILURE; -+ - if (ev->status && conn->state == BT_CONNECTED) { -+ /* Notify upper layers so they can cleanup before -+ * disconnecting. -+ */ -+ hci_encrypt_cfm(conn, ev->status); - hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); - hci_conn_drop(conn); - goto unlock; - } - -- /* In Secure Connections Only mode, do not allow any connections -- * that are not encrypted with AES-CCM using a P-256 authenticated -- * combination key. -- */ -- if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && -- (!test_bit(HCI_CONN_AES_CCM, &conn->flags) || -- conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) { -- hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE); -- hci_conn_drop(conn); -- goto unlock; -- } -- - /* Try reading the encryption key size for encrypted ACL links */ - if (!ev->status && ev->encrypt && conn->type == ACL_LINK) { - struct hci_cp_read_enc_key_size cp; -@@ -2674,14 +2658,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb) - } - - notify: -- if (conn->state == BT_CONFIG) { -- if (!ev->status) -- conn->state = BT_CONNECTED; -- -- hci_connect_cfm(conn, ev->status); -- hci_conn_drop(conn); -- } else -- hci_encrypt_cfm(conn, ev->status, ev->encrypt); -+ hci_encrypt_cfm(conn, ev->status); - - unlock: - hci_dev_unlock(hdev); -@@ -4752,6 +4729,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, - u32 flags; - u8 *ptr, real_len; - -+ if (len > HCI_MAX_AD_LENGTH) { -+ pr_err_ratelimited("legacy adv larger than 31 bytes"); -+ return; -+ } -+ - /* Find the end of the data in case the report contains padded zero - * bytes at the end causing an invalid length value. - * -@@ -4812,7 +4794,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, - */ - conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type, - direct_addr); -- if (conn && type == LE_ADV_IND) { -+ if (conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) { - /* Store report for later inclusion by - * mgmt_device_connected - */ -@@ -4937,10 +4919,14 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) - struct hci_ev_le_advertising_info *ev = ptr; - s8 rssi; - -- rssi = ev->data[ev->length]; -- process_adv_report(hdev, ev->evt_type, &ev->bdaddr, -- ev->bdaddr_type, NULL, 0, rssi, -- ev->data, ev->length); -+ if (ev->length <= HCI_MAX_AD_LENGTH) { -+ rssi = ev->data[ev->length]; -+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr, -+ ev->bdaddr_type, NULL, 0, rssi, -+ ev->data, ev->length); -+ } else { -+ bt_dev_err(hdev, "Dropping invalid advertising data"); -+ } - - ptr += sizeof(*ev) + ev->length + 1; - } -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index ecc3da6a14a18..ee761fb095594 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -628,7 +628,8 @@ static u32 get_supported_settings(struct hci_dev *hdev) - - if (lmp_ssp_capable(hdev)) { - settings |= MGMT_SETTING_SSP; -- settings |= MGMT_SETTING_HS; -+ if (IS_ENABLED(CONFIG_BT_HS)) -+ settings |= MGMT_SETTING_HS; - } - - if (lmp_sc_capable(hdev)) -@@ -2281,6 +2282,10 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, - - BT_DBG("request for %s", hdev->name); - -+ if (!IS_ENABLED(CONFIG_BT_HS)) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, -+ MGMT_STATUS_NOT_SUPPORTED); -+ - status = mgmt_bredr_support(hdev); - if (status) - return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.240-241.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.240-241.patch deleted file mode 100644 index 5bea128836..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.240-241.patch +++ /dev/null @@ -1,3167 +0,0 @@ -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 21ad4f3cece89..eac939abe6c4c 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -868,12 +868,14 @@ icmp_ratelimit - INTEGER - icmp_msgs_per_sec - INTEGER - Limit maximal number of ICMP packets sent per second from this host. - Only messages whose type matches icmp_ratemask (see below) are -- controlled by this limit. -+ controlled by this limit. For security reasons, the precise count -+ of messages per second is randomized. - Default: 1000 - - icmp_msgs_burst - INTEGER - icmp_msgs_per_sec controls number of ICMP packets sent per second, - while icmp_msgs_burst controls the burst size of these packets. -+ For security reasons, the precise burst size is randomized. - Default: 50 - - icmp_ratemask - INTEGER -diff --git a/Makefile b/Makefile -index 69e7cd30e6465..f475808037540 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 240 -+SUBLEVEL = 241 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c -index 493692d838c67..0b6f8a93d8c60 100644 ---- a/arch/arm/mm/cache-l2x0.c -+++ b/arch/arm/mm/cache-l2x0.c -@@ -1228,20 +1228,28 @@ static void __init l2c310_of_parse(const struct device_node *np, - - ret = of_property_read_u32(np, "prefetch-data", &val); - if (ret == 0) { -- if (val) -+ if (val) { - prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH; -- else -+ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH; -+ } else { - prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; -+ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; -+ } -+ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; - } else if (ret != -EINVAL) { - pr_err("L2C-310 OF prefetch-data property value is missing\n"); - } - - ret = of_property_read_u32(np, "prefetch-instr", &val); - if (ret == 0) { -- if (val) -+ if (val) { - prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH; -- else -+ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ } else { - prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ } -+ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; - } else if (ret != -EINVAL) { - pr_err("L2C-310 OF prefetch-instr property value is missing\n"); - } -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -index 172402cc1a0f5..ae2cbbdb634e4 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -@@ -191,7 +191,7 @@ - }; - - i2c0: i2c@ff020000 { -- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; -+ compatible = "cdns,i2c-r1p14"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 17 4>; -@@ -202,7 +202,7 @@ - }; - - i2c1: i2c@ff030000 { -- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; -+ compatible = "cdns,i2c-r1p14"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 18 4>; -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index ca372bbc0ffee..dd262f09a99ed 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -647,7 +647,7 @@ - #define THRM1_TIN (1 << 31) - #define THRM1_TIV (1 << 30) - #define THRM1_THRES(x) ((x&0x7f)<<23) --#define THRM3_SITV(x) ((x&0x3fff)<<1) -+#define THRM3_SITV(x) ((x & 0x1fff) << 1) - #define THRM1_TID (1<<2) - #define THRM1_TIE (1<<1) - #define THRM1_V (1<<0) -diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c -index a753b72efbc0c..70c9d134a9d44 100644 ---- a/arch/powerpc/kernel/tau_6xx.c -+++ b/arch/powerpc/kernel/tau_6xx.c -@@ -37,8 +37,6 @@ static struct tau_temp - - struct timer_list tau_timer; - --#undef DEBUG -- - /* TODO: put these in a /proc interface, with some sanity checks, and maybe - * dynamic adjustment to minimize # of interrupts */ - /* configurable values for step size and how much to expand the window when -@@ -71,47 +69,33 @@ void set_thresholds(unsigned long cpu) - - void TAUupdate(int cpu) - { -- unsigned thrm; -- --#ifdef DEBUG -- printk("TAUupdate "); --#endif -+ u32 thrm; -+ u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V; - - /* if both thresholds are crossed, the step_sizes cancel out - * and the window winds up getting expanded twice. */ -- if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */ -- if(thrm & THRM1_TIN){ /* crossed low threshold */ -- if (tau[cpu].low >= step_size){ -- tau[cpu].low -= step_size; -- tau[cpu].high -= (step_size - window_expand); -- } -- tau[cpu].grew = 1; --#ifdef DEBUG -- printk("low threshold crossed "); --#endif -+ thrm = mfspr(SPRN_THRM1); -+ if ((thrm & bits) == bits) { -+ mtspr(SPRN_THRM1, 0); -+ -+ if (tau[cpu].low >= step_size) { -+ tau[cpu].low -= step_size; -+ tau[cpu].high -= (step_size - window_expand); - } -+ tau[cpu].grew = 1; -+ pr_debug("%s: low threshold crossed\n", __func__); - } -- if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */ -- if(thrm & THRM1_TIN){ /* crossed high threshold */ -- if (tau[cpu].high <= 127-step_size){ -- tau[cpu].low += (step_size - window_expand); -- tau[cpu].high += step_size; -- } -- tau[cpu].grew = 1; --#ifdef DEBUG -- printk("high threshold crossed "); --#endif -+ thrm = mfspr(SPRN_THRM2); -+ if ((thrm & bits) == bits) { -+ mtspr(SPRN_THRM2, 0); -+ -+ if (tau[cpu].high <= 127 - step_size) { -+ tau[cpu].low += (step_size - window_expand); -+ tau[cpu].high += step_size; - } -+ tau[cpu].grew = 1; -+ pr_debug("%s: high threshold crossed\n", __func__); - } -- --#ifdef DEBUG -- printk("grew = %d\n", tau[cpu].grew); --#endif -- --#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */ -- set_thresholds(cpu); --#endif -- - } - - #ifdef CONFIG_TAU_INT -@@ -136,18 +120,18 @@ void TAUException(struct pt_regs * regs) - static void tau_timeout(void * info) - { - int cpu; -- unsigned long flags; - int size; - int shrink; - -- /* disabling interrupts *should* be okay */ -- local_irq_save(flags); - cpu = smp_processor_id(); - - #ifndef CONFIG_TAU_INT - TAUupdate(cpu); - #endif - -+ /* Stop thermal sensor comparisons and interrupts */ -+ mtspr(SPRN_THRM3, 0); -+ - size = tau[cpu].high - tau[cpu].low; - if (size > min_window && ! tau[cpu].grew) { - /* do an exponential shrink of half the amount currently over size */ -@@ -169,22 +153,12 @@ static void tau_timeout(void * info) - - set_thresholds(cpu); - -- /* -- * Do the enable every time, since otherwise a bunch of (relatively) -- * complex sleep code needs to be added. One mtspr every time -- * tau_timeout is called is probably not a big deal. -- * -- * Enable thermal sensor and set up sample interval timer -- * need 20 us to do the compare.. until a nice 'cpu_speed' function -- * call is implemented, just assume a 500 mhz clock. It doesn't really -- * matter if we take too long for a compare since it's all interrupt -- * driven anyway. -- * -- * use a extra long time.. (60 us @ 500 mhz) -+ /* Restart thermal sensor comparisons and interrupts. -+ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" -+ * recommends that "the maximum value be set in THRM3 under all -+ * conditions." - */ -- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E); -- -- local_irq_restore(flags); -+ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); - } - - static void tau_timeout_smp(unsigned long unused) -diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h -index acd17648cd188..5ea24d16a74a1 100644 ---- a/arch/powerpc/perf/hv-gpci-requests.h -+++ b/arch/powerpc/perf/hv-gpci-requests.h -@@ -94,7 +94,7 @@ REQUEST(__field(0, 8, partition_id) - - #define REQUEST_NAME system_performance_capabilities - #define REQUEST_NUM 0x40 --#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" -+#define REQUEST_IDX_KIND "starting_index=0xffffffff" - #include I(REQUEST_BEGIN) - REQUEST(__field(0, 1, perf_collect_privileged) - __field(0x1, 1, capability_mask) -@@ -222,7 +222,7 @@ REQUEST(__field(0, 2, partition_id) - - #define REQUEST_NAME system_hypervisor_times - #define REQUEST_NUM 0xF0 --#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" -+#define REQUEST_IDX_KIND "starting_index=0xffffffff" - #include I(REQUEST_BEGIN) - REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) - __count(0x8, 8, time_spent_processing_virtual_processor_timers) -@@ -233,7 +233,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) - - #define REQUEST_NAME system_tlbie_count_and_time - #define REQUEST_NUM 0xF4 --#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" -+#define REQUEST_IDX_KIND "starting_index=0xffffffff" - #include I(REQUEST_BEGIN) - REQUEST(__count(0, 8, tlbie_instructions_issued) - /* -diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig -index b7f9c408bf24f..0a0281a21ea50 100644 ---- a/arch/powerpc/platforms/Kconfig -+++ b/arch/powerpc/platforms/Kconfig -@@ -242,7 +242,7 @@ config TAU - temp is actually what /proc/cpuinfo says it is. - - config TAU_INT -- bool "Interrupt driven TAU driver (DANGEROUS)" -+ bool "Interrupt driven TAU driver (EXPERIMENTAL)" - depends on TAU - ---help--- - The TAU supports an interrupt driven mode which causes an interrupt -@@ -250,12 +250,7 @@ config TAU_INT - to get notified the temp has exceeded a range. With this option off, - a timer is used to re-check the temperature periodically. - -- However, on some cpus it appears that the TAU interrupt hardware -- is buggy and can cause a situation which would lead unexplained hard -- lockups. -- -- Unless you are extending the TAU driver, or enjoy kernel/hardware -- debugging, leave this option off. -+ If in doubt, say N here. - - config TAU_AVERAGE - bool "Average high and low temp" -diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c -index 4c827826c05eb..e21e2c0af69d2 100644 ---- a/arch/powerpc/platforms/powernv/opal-dump.c -+++ b/arch/powerpc/platforms/powernv/opal-dump.c -@@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj, - return count; - } - --static struct dump_obj *create_dump_obj(uint32_t id, size_t size, -- uint32_t type) -+static void create_dump_obj(uint32_t id, size_t size, uint32_t type) - { - struct dump_obj *dump; - int rc; - - dump = kzalloc(sizeof(*dump), GFP_KERNEL); - if (!dump) -- return NULL; -+ return; - - dump->kobj.kset = dump_kset; - -@@ -347,21 +346,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size, - rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id); - if (rc) { - kobject_put(&dump->kobj); -- return NULL; -+ return; - } - -+ /* -+ * As soon as the sysfs file for this dump is created/activated there is -+ * a chance the opal_errd daemon (or any userspace) might read and -+ * acknowledge the dump before kobject_uevent() is called. If that -+ * happens then there is a potential race between -+ * dump_ack_store->kobject_put() and kobject_uevent() which leads to a -+ * use-after-free of a kernfs object resulting in a kernel crash. -+ * -+ * To avoid that, we need to take a reference on behalf of the bin file, -+ * so that our reference remains valid while we call kobject_uevent(). -+ * We then drop our reference before exiting the function, leaving the -+ * bin file to drop the last reference (if it hasn't already). -+ */ -+ -+ /* Take a reference for the bin file */ -+ kobject_get(&dump->kobj); - rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr); -- if (rc) { -+ if (rc == 0) { -+ kobject_uevent(&dump->kobj, KOBJ_ADD); -+ -+ pr_info("%s: New platform dump. ID = 0x%x Size %u\n", -+ __func__, dump->id, dump->size); -+ } else { -+ /* Drop reference count taken for bin file */ - kobject_put(&dump->kobj); -- return NULL; - } - -- pr_info("%s: New platform dump. ID = 0x%x Size %u\n", -- __func__, dump->id, dump->size); -- -- kobject_uevent(&dump->kobj, KOBJ_ADD); -- -- return dump; -+ /* Drop our reference */ -+ kobject_put(&dump->kobj); -+ return; - } - - static irqreturn_t process_dump(int irq, void *data) -diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c -index 31ca557af60bc..262b8c5e1b9d0 100644 ---- a/arch/powerpc/platforms/pseries/rng.c -+++ b/arch/powerpc/platforms/pseries/rng.c -@@ -40,6 +40,7 @@ static __init int rng_init(void) - - ppc_md.get_random_seed = pseries_get_random_long; - -+ of_node_put(dn); - return 0; - } - machine_subsys_initcall(pseries, rng_init); -diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c -index c1917cf67c3de..3205e64c452bd 100644 ---- a/arch/powerpc/sysdev/xics/icp-hv.c -+++ b/arch/powerpc/sysdev/xics/icp-hv.c -@@ -179,6 +179,7 @@ int icp_hv_init(void) - - icp_ops = &icp_hv_ops; - -+ of_node_put(np); - return 0; - } - -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 466028623e1a0..0c1e249a7ab69 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -3524,7 +3524,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) - u64 tsc_aux = 0; - - if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) -- return emulate_gp(ctxt, 0); -+ return emulate_ud(ctxt); - ctxt->dst.val = tsc_aux; - return X86EMUL_CONTINUE; - } -diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c -index 0f1c6fc3ddd88..47770ccab6d77 100644 ---- a/arch/x86/mm/dump_pagetables.c -+++ b/arch/x86/mm/dump_pagetables.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -407,6 +408,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd, - } else - note_page(m, &st, __pgprot(0), 1); - -+ cond_resched(); - start++; - } - -diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c -index 57e6c45724e73..1930a1d1a1892 100644 ---- a/drivers/cpufreq/powernv-cpufreq.c -+++ b/drivers/cpufreq/powernv-cpufreq.c -@@ -410,12 +410,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb, - unsigned long action, void *unused) - { - int cpu; -- struct cpufreq_policy cpu_policy; -+ struct cpufreq_policy *cpu_policy; - - rebooting = true; - for_each_online_cpu(cpu) { -- cpufreq_get_policy(&cpu_policy, cpu); -- powernv_cpufreq_target_index(&cpu_policy, get_nominal_index()); -+ cpu_policy = cpufreq_cpu_get(cpu); -+ if (!cpu_policy) -+ continue; -+ powernv_cpufreq_target_index(cpu_policy, get_nominal_index()); -+ cpufreq_cpu_put(cpu_policy); - } - - return NOTIFY_DONE; -diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c -index 8f27903532812..13657105cfb93 100644 ---- a/drivers/crypto/ixp4xx_crypto.c -+++ b/drivers/crypto/ixp4xx_crypto.c -@@ -533,7 +533,7 @@ static void release_ixp_crypto(struct device *dev) - - if (crypt_virt) { - dma_free_coherent(dev, -- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl), -+ NPE_QLEN * sizeof(struct crypt_ctl), - crypt_virt, crypt_phys); - } - return; -diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c -index 48adb2a0903e5..7e9a44cee4250 100644 ---- a/drivers/crypto/omap-sham.c -+++ b/drivers/crypto/omap-sham.c -@@ -453,6 +453,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length, - struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req); - u32 val, mask; - -+ if (likely(ctx->digcnt)) -+ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt); -+ - /* - * Setting ALGO_CONST only for the first iteration and - * CLOSE_HASH only for the last one. Note that flags mode bits -diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c -index 40917775dca1c..59d10f48ed6ab 100644 ---- a/drivers/edac/i5100_edac.c -+++ b/drivers/edac/i5100_edac.c -@@ -1075,16 +1075,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - PCI_DEVICE_ID_INTEL_5100_19, 0); - if (!einj) { - ret = -ENODEV; -- goto bail_einj; -+ goto bail_mc_free; - } - - rc = pci_enable_device(einj); - if (rc < 0) { - ret = rc; -- goto bail_disable_einj; -+ goto bail_einj; - } - -- - mci->pdev = &pdev->dev; - - priv = mci->pvt_info; -@@ -1151,14 +1150,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - bail_scrub: - priv->scrub_enable = 0; - cancel_delayed_work_sync(&(priv->i5100_scrubbing)); -- edac_mc_free(mci); -- --bail_disable_einj: - pci_disable_device(einj); - - bail_einj: - pci_dev_put(einj); - -+bail_mc_free: -+ edac_mc_free(mci); -+ - bail_disable_ch1: - pci_disable_device(ch1mm); - -diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c -index d3de377dc857e..25c68e4dc7a53 100644 ---- a/drivers/gpu/drm/gma500/cdv_intel_dp.c -+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c -@@ -2120,7 +2120,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev - intel_dp->dpcd, - sizeof(intel_dp->dpcd)); - cdv_intel_edp_panel_vdd_off(gma_encoder); -- if (ret == 0) { -+ if (ret <= 0) { - /* if this fails, presume the device is a ghost */ - DRM_INFO("failed to retrieve link info, disabling eDP\n"); - cdv_intel_dp_encoder_destroy(encoder); -diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c -index 06496a1281622..476b9993b0682 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_kms.c -+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c -@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, - vgdev->capsets[i].id > 0, 5 * HZ); - if (ret == 0) { - DRM_ERROR("timed out waiting for cap set %d\n", i); -+ spin_lock(&vgdev->display_info_lock); - kfree(vgdev->capsets); - vgdev->capsets = NULL; -+ spin_unlock(&vgdev->display_info_lock); - return; - } - DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n", -diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c -index 772a5a3b0ce1a..18e8fcad6690b 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_vq.c -+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c -@@ -596,9 +596,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev, - int i = le32_to_cpu(cmd->capset_index); - - spin_lock(&vgdev->display_info_lock); -- vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); -- vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); -- vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); -+ if (vgdev->capsets) { -+ vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); -+ vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); -+ vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); -+ } else { -+ DRM_ERROR("invalid capset memory."); -+ } - spin_unlock(&vgdev->display_info_lock); - wake_up(&vgdev->resp_wq); - } -diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c -index c29265055ac1a..6c2b821c8d8b5 100644 ---- a/drivers/hid/hid-roccat-kone.c -+++ b/drivers/hid/hid-roccat-kone.c -@@ -299,31 +299,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, - struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev)); - struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev)); - int retval = 0, difference, old_profile; -+ struct kone_settings *settings = (struct kone_settings *)buf; - - /* I need to get my data in one piece */ - if (off != 0 || count != sizeof(struct kone_settings)) - return -EINVAL; - - mutex_lock(&kone->kone_lock); -- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings)); -+ difference = memcmp(settings, &kone->settings, -+ sizeof(struct kone_settings)); - if (difference) { -- retval = kone_set_settings(usb_dev, -- (struct kone_settings const *)buf); -- if (retval) { -- mutex_unlock(&kone->kone_lock); -- return retval; -+ if (settings->startup_profile < 1 || -+ settings->startup_profile > 5) { -+ retval = -EINVAL; -+ goto unlock; - } - -+ retval = kone_set_settings(usb_dev, settings); -+ if (retval) -+ goto unlock; -+ - old_profile = kone->settings.startup_profile; -- memcpy(&kone->settings, buf, sizeof(struct kone_settings)); -+ memcpy(&kone->settings, settings, sizeof(struct kone_settings)); - - kone_profile_activated(kone, kone->settings.startup_profile); - - if (kone->settings.startup_profile != old_profile) - kone_profile_report(kone, kone->settings.startup_profile); - } -+unlock: - mutex_unlock(&kone->kone_lock); - -+ if (retval) -+ return retval; -+ - return sizeof(struct kone_settings); - } - static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, -diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c -index 5dc920fe13269..c8c586c78d071 100644 ---- a/drivers/infiniband/hw/mlx4/cm.c -+++ b/drivers/infiniband/hw/mlx4/cm.c -@@ -309,6 +309,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) - if (!sriov->is_going_down) { - id->scheduled_delete = 1; - schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); -+ } else if (id->scheduled_delete) { -+ /* Adjust timeout if already scheduled */ -+ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); - } - spin_unlock_irqrestore(&sriov->going_down_lock, flags); - spin_unlock(&sriov->id_map_lock); -diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c -index f77b295e0123e..01788a78041b3 100644 ---- a/drivers/input/keyboard/ep93xx_keypad.c -+++ b/drivers/input/keyboard/ep93xx_keypad.c -@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev) - } - - keypad->irq = platform_get_irq(pdev, 0); -- if (!keypad->irq) { -- err = -ENXIO; -+ if (keypad->irq < 0) { -+ err = keypad->irq; - goto failed_free; - } - -diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c -index 3d2c60c8de830..c6a468dfdfb48 100644 ---- a/drivers/input/keyboard/omap4-keypad.c -+++ b/drivers/input/keyboard/omap4-keypad.c -@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(&pdev->dev, "no keyboard irq assigned\n"); -- return -EINVAL; -- } -+ if (irq < 0) -+ return irq; - - keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL); - if (!keypad_data) { -diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c -index 04b96fe393397..46512b4d686a8 100644 ---- a/drivers/input/serio/sun4i-ps2.c -+++ b/drivers/input/serio/sun4i-ps2.c -@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev) - struct sun4i_ps2data *drvdata; - struct serio *serio; - struct device *dev = &pdev->dev; -- unsigned int irq; - int error; - - drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL); -@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev) - writel(0, drvdata->reg_base + PS2_REG_GCTL); - - /* Get IRQ for the device */ -- irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(dev, "no IRQ found\n"); -- error = -ENXIO; -+ drvdata->irq = platform_get_irq(pdev, 0); -+ if (drvdata->irq < 0) { -+ error = drvdata->irq; - goto err_disable_clk; - } - -- drvdata->irq = irq; - drvdata->serio = serio; - drvdata->dev = dev; - -diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c -index 8275267eac254..4be7ddc04af0f 100644 ---- a/drivers/input/touchscreen/imx6ul_tsc.c -+++ b/drivers/input/touchscreen/imx6ul_tsc.c -@@ -490,20 +490,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev) - - mutex_lock(&input_dev->mutex); - -- if (input_dev->users) { -- retval = clk_prepare_enable(tsc->adc_clk); -- if (retval) -- goto out; -- -- retval = clk_prepare_enable(tsc->tsc_clk); -- if (retval) { -- clk_disable_unprepare(tsc->adc_clk); -- goto out; -- } -+ if (!input_dev->users) -+ goto out; - -- retval = imx6ul_tsc_init(tsc); -+ retval = clk_prepare_enable(tsc->adc_clk); -+ if (retval) -+ goto out; -+ -+ retval = clk_prepare_enable(tsc->tsc_clk); -+ if (retval) { -+ clk_disable_unprepare(tsc->adc_clk); -+ goto out; - } - -+ retval = imx6ul_tsc_init(tsc); -+ if (retval) { -+ clk_disable_unprepare(tsc->tsc_clk); -+ clk_disable_unprepare(tsc->adc_clk); -+ goto out; -+ } - out: - mutex_unlock(&input_dev->mutex); - return retval; -diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c -index 5d634706a7eaa..382f290c3f4d5 100644 ---- a/drivers/media/firewire/firedtv-fw.c -+++ b/drivers/media/firewire/firedtv-fw.c -@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) - - name_len = fw_csr_string(unit->directory, CSR_MODEL, - name, sizeof(name)); -- if (name_len < 0) -- return name_len; -+ if (name_len < 0) { -+ err = name_len; -+ goto fail_free; -+ } - for (i = ARRAY_SIZE(model_names); --i; ) - if (strlen(model_names[i]) <= name_len && - strncmp(name, model_names[i], name_len) == 0) -diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c -index 6404c0d93e7af..514267680dc96 100644 ---- a/drivers/media/i2c/m5mols/m5mols_core.c -+++ b/drivers/media/i2c/m5mols/m5mols_core.c -@@ -754,7 +754,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable) - - ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies); - if (ret) { -- info->set_power(&client->dev, 0); -+ if (info->set_power) -+ info->set_power(&client->dev, 0); - return ret; - } - -diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c -index 51dbef2f9a489..10c9c078af014 100644 ---- a/drivers/media/pci/bt8xx/bttv-driver.c -+++ b/drivers/media/pci/bt8xx/bttv-driver.c -@@ -4053,11 +4053,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) - btv->id = dev->device; - if (pci_enable_device(dev)) { - pr_warn("%d: Can't enable device\n", btv->c.nr); -- return -EIO; -+ result = -EIO; -+ goto free_mem; - } - if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) { - pr_warn("%d: No suitable DMA available\n", btv->c.nr); -- return -EIO; -+ result = -EIO; -+ goto free_mem; - } - if (!request_mem_region(pci_resource_start(dev,0), - pci_resource_len(dev,0), -@@ -4065,7 +4067,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) - pr_warn("%d: can't request iomem (0x%llx)\n", - btv->c.nr, - (unsigned long long)pci_resource_start(dev, 0)); -- return -EBUSY; -+ result = -EBUSY; -+ goto free_mem; - } - pci_set_master(dev); - pci_set_command(dev); -@@ -4251,6 +4254,10 @@ fail0: - release_mem_region(pci_resource_start(btv->c.pci,0), - pci_resource_len(btv->c.pci,0)); - pci_disable_device(btv->c.pci); -+ -+free_mem: -+ bttvs[btv->c.nr] = NULL; -+ kfree(btv); - return result; - } - -diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c -index 21a579309575d..02407983ce236 100644 ---- a/drivers/media/pci/saa7134/saa7134-tvaudio.c -+++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c -@@ -696,7 +696,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value) - { - int err; - -- audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value); -+ audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", -+ (reg << 2) & 0xffffffff, value); - err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR); - if (err < 0) - return err; -diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c -index 5d78f5716f3b8..ad280c5258b34 100644 ---- a/drivers/media/platform/exynos4-is/fimc-isp.c -+++ b/drivers/media/platform/exynos4-is/fimc-isp.c -@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on) - - if (on) { - ret = pm_runtime_get_sync(&is->pdev->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(&is->pdev->dev); - return ret; -+ } - set_bit(IS_ST_PWR_ON, &is->state); - - ret = fimc_is_start_firmware(is); -diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c -index 60660c3a5de0d..65b33470a1b1b 100644 ---- a/drivers/media/platform/exynos4-is/fimc-lite.c -+++ b/drivers/media/platform/exynos4-is/fimc-lite.c -@@ -487,7 +487,7 @@ static int fimc_lite_open(struct file *file) - set_bit(ST_FLITE_IN_USE, &fimc->state); - ret = pm_runtime_get_sync(&fimc->pdev->dev); - if (ret < 0) -- goto unlock; -+ goto err_pm; - - ret = v4l2_fh_open(file); - if (ret < 0) -diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c -index 31cc7d94064e3..76fadd3e3ada2 100644 ---- a/drivers/media/platform/exynos4-is/media-dev.c -+++ b/drivers/media/platform/exynos4-is/media-dev.c -@@ -413,8 +413,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) - return -ENXIO; - - ret = pm_runtime_get_sync(fmd->pmf); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(fmd->pmf); - return ret; -+ } - - fmd->num_sensors = 0; - -@@ -1170,11 +1172,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) - if (IS_ERR(pctl->state_default)) - return PTR_ERR(pctl->state_default); - -+ /* PINCTRL_STATE_IDLE is optional */ - pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, - PINCTRL_STATE_IDLE); -- if (IS_ERR(pctl->state_idle)) -- return PTR_ERR(pctl->state_idle); -- - return 0; - } - -diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c -index 4b85105dc159b..4f7a0f59f36c2 100644 ---- a/drivers/media/platform/exynos4-is/mipi-csis.c -+++ b/drivers/media/platform/exynos4-is/mipi-csis.c -@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable) - if (enable) { - s5pcsis_clear_counters(state); - ret = pm_runtime_get_sync(&state->pdev->dev); -- if (ret && ret != 1) -+ if (ret && ret != 1) { -+ pm_runtime_put_noidle(&state->pdev->dev); - return ret; -+ } - } - - mutex_lock(&state->lock); -diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c -index f41e0d08de93e..4c6842202e47c 100644 ---- a/drivers/media/platform/omap3isp/isp.c -+++ b/drivers/media/platform/omap3isp/isp.c -@@ -2388,8 +2388,10 @@ static int isp_probe(struct platform_device *pdev) - mem = platform_get_resource(pdev, IORESOURCE_MEM, i); - isp->mmio_base[map_idx] = - devm_ioremap_resource(isp->dev, mem); -- if (IS_ERR(isp->mmio_base[map_idx])) -- return PTR_ERR(isp->mmio_base[map_idx]); -+ if (IS_ERR(isp->mmio_base[map_idx])) { -+ ret = PTR_ERR(isp->mmio_base[map_idx]); -+ goto error; -+ } - } - - ret = isp_get_clocks(isp); -diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -index a00dfaa1b945d..6c97063cb3b3f 100644 ---- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -@@ -1369,7 +1369,7 @@ static int bdisp_probe(struct platform_device *pdev) - ret = pm_runtime_get_sync(dev); - if (ret < 0) { - dev_err(dev, "failed to set PM\n"); -- goto err_dbg; -+ goto err_pm; - } - - /* Continuous memory allocator */ -@@ -1406,7 +1406,6 @@ err_vb2_dma: - vb2_dma_contig_cleanup_ctx(bdisp->alloc_ctx); - err_pm: - pm_runtime_put(dev); --err_dbg: - bdisp_debugfs_remove(bdisp); - err_v4l2: - v4l2_device_unregister(&bdisp->v4l2_dev); -diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c -index b5f8c425cd2ef..8a3714bfb77e8 100644 ---- a/drivers/media/platform/ti-vpe/vpe.c -+++ b/drivers/media/platform/ti-vpe/vpe.c -@@ -2135,6 +2135,8 @@ static int vpe_runtime_get(struct platform_device *pdev) - - r = pm_runtime_get_sync(&pdev->dev); - WARN_ON(r < 0); -+ if (r) -+ pm_runtime_put_noidle(&pdev->dev); - return r < 0 ? r : 0; - } - -diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c -index a35631891cc00..3c3f4c4f6be40 100644 ---- a/drivers/media/rc/ati_remote.c -+++ b/drivers/media/rc/ati_remote.c -@@ -843,6 +843,10 @@ static int ati_remote_probe(struct usb_interface *interface, - err("%s: endpoint_in message size==0? \n", __func__); - return -ENODEV; - } -+ if (!usb_endpoint_is_int_out(endpoint_out)) { -+ err("%s: Unexpected endpoint_out\n", __func__); -+ return -ENODEV; -+ } - - ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); - rc_dev = rc_allocate_device(); -diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index 0e7d16fe84d42..a0a544628053d 100644 ---- a/drivers/media/usb/uvc/uvc_v4l2.c -+++ b/drivers/media/usb/uvc/uvc_v4l2.c -@@ -242,11 +242,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, - if (ret < 0) - goto done; - -+ /* After the probe, update fmt with the values returned from -+ * negotiation with the device. -+ */ -+ for (i = 0; i < stream->nformats; ++i) { -+ if (probe->bFormatIndex == stream->format[i].index) { -+ format = &stream->format[i]; -+ break; -+ } -+ } -+ -+ if (i == stream->nformats) { -+ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n", -+ probe->bFormatIndex); -+ return -EINVAL; -+ } -+ -+ for (i = 0; i < format->nframes; ++i) { -+ if (probe->bFrameIndex == format->frame[i].bFrameIndex) { -+ frame = &format->frame[i]; -+ break; -+ } -+ } -+ -+ if (i == format->nframes) { -+ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n", -+ probe->bFrameIndex); -+ return -EINVAL; -+ } -+ - fmt->fmt.pix.width = frame->wWidth; - fmt->fmt.pix.height = frame->wHeight; - fmt->fmt.pix.field = V4L2_FIELD_NONE; - fmt->fmt.pix.bytesperline = format->bpp * frame->wWidth / 8; - fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize; -+ fmt->fmt.pix.pixelformat = format->fcc; - fmt->fmt.pix.colorspace = format->colorspace; - fmt->fmt.pix.priv = 0; - -diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c -index 662d050243bec..2fbf8d09af36b 100644 ---- a/drivers/memory/fsl-corenet-cf.c -+++ b/drivers/memory/fsl-corenet-cf.c -@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev) - dev_set_drvdata(&pdev->dev, ccf); - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(&pdev->dev, "%s: no irq\n", __func__); -- return -ENXIO; -- } -+ if (irq < 0) -+ return irq; - - ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf); - if (ret) { -diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c -index 49691a8c74ee9..af187c91fc33b 100644 ---- a/drivers/memory/omap-gpmc.c -+++ b/drivers/memory/omap-gpmc.c -@@ -928,7 +928,7 @@ static int gpmc_cs_remap(int cs, u32 base) - int ret; - u32 old_base, size; - -- if (cs > gpmc_cs_num) { -+ if (cs >= gpmc_cs_num) { - pr_err("%s: requested chip-select is disabled\n", __func__); - return -ENODEV; - } -@@ -963,7 +963,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base) - struct resource *res = &gpmc->mem; - int r = -1; - -- if (cs > gpmc_cs_num) { -+ if (cs >= gpmc_cs_num) { - pr_err("%s: requested chip-select is disabled\n", __func__); - return -ENODEV; - } -diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c -index 98029ee0959e3..be61f8606a045 100644 ---- a/drivers/mfd/rtsx_pcr.c -+++ b/drivers/mfd/rtsx_pcr.c -@@ -1255,12 +1255,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, - ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells, - ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL); - if (ret < 0) -- goto disable_irq; -+ goto free_slots; - - schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200)); - - return 0; - -+free_slots: -+ kfree(pcr->slots); - disable_irq: - free_irq(pcr->irq, (void *)pcr); - disable_msi: -diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c -index fbec711c41956..0fe273d2f6190 100644 ---- a/drivers/mfd/sm501.c -+++ b/drivers/mfd/sm501.c -@@ -1430,8 +1430,14 @@ static int sm501_plat_probe(struct platform_device *dev) - goto err_claim; - } - -- return sm501_init_dev(sm); -+ ret = sm501_init_dev(sm); -+ if (ret) -+ goto err_unmap; -+ -+ return 0; - -+ err_unmap: -+ iounmap(sm->regs); - err_claim: - release_resource(sm->regs_claim); - kfree(sm->regs_claim); -diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c -index 71c69e1c4ac05..4188b88c20a4a 100644 ---- a/drivers/misc/mic/scif/scif_rma.c -+++ b/drivers/misc/mic/scif/scif_rma.c -@@ -1403,6 +1403,8 @@ retry: - NULL); - up_write(&mm->mmap_sem); - if (nr_pages != pinned_pages->nr_pages) { -+ if (pinned_pages->nr_pages < 0) -+ pinned_pages->nr_pages = 0; - if (try_upgrade) { - if (ulimit) - __scif_dec_pinned_vm_lock(mm, -@@ -1423,7 +1425,6 @@ retry: - - if (pinned_pages->nr_pages < nr_pages) { - err = -EFAULT; -- pinned_pages->nr_pages = nr_pages; - goto dec_pinned; - } - -@@ -1436,7 +1437,6 @@ dec_pinned: - __scif_dec_pinned_vm_lock(mm, nr_pages, 0); - /* Something went wrong! Rollback */ - error_unmap: -- pinned_pages->nr_pages = nr_pages; - scif_destroy_pinned_pages(pinned_pages); - *pages = NULL; - dev_dbg(scif_info.mdev.this_device, -diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c -index 3877f534fd3f4..e57340e980c4b 100644 ---- a/drivers/misc/vmw_vmci/vmci_queue_pair.c -+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c -@@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva, - if (retval < (int)produce_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(produce) failed (retval=%d)", - retval); -- qp_release_pages(produce_q->kernel_if->u.h.header_page, -- retval, false); -+ if (retval > 0) -+ qp_release_pages(produce_q->kernel_if->u.h.header_page, -+ retval, false); - err = VMCI_ERROR_NO_MEM; - goto out; - } -@@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva, - if (retval < (int)consume_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(consume) failed (retval=%d)", - retval); -- qp_release_pages(consume_q->kernel_if->u.h.header_page, -- retval, false); -+ if (retval > 0) -+ qp_release_pages(consume_q->kernel_if->u.h.header_page, -+ retval, false); - qp_release_pages(produce_q->kernel_if->u.h.header_page, - produce_q->kernel_if->num_pages, false); - err = VMCI_ERROR_NO_MEM; -diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c -index 8e94e555b788d..8651bd30863d4 100644 ---- a/drivers/mmc/core/sdio_cis.c -+++ b/drivers/mmc/core/sdio_cis.c -@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func, - unsigned i, nr_strings; - char **buffer, *string; - -+ if (size < 2) -+ return 0; -+ - /* Find all null-terminated (including zero length) strings in - the TPLLV1_INFO field. Trailing garbage is ignored. */ - buf += 2; -diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c -index 2342277c9bcb0..5e36366d9b36d 100644 ---- a/drivers/mtd/lpddr/lpddr2_nvm.c -+++ b/drivers/mtd/lpddr/lpddr2_nvm.c -@@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add, - return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK); - } - -+static const struct mtd_info lpddr2_nvm_mtd_info = { -+ .type = MTD_RAM, -+ .writesize = 1, -+ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), -+ ._read = lpddr2_nvm_read, -+ ._write = lpddr2_nvm_write, -+ ._erase = lpddr2_nvm_erase, -+ ._unlock = lpddr2_nvm_unlock, -+ ._lock = lpddr2_nvm_lock, -+}; -+ - /* - * lpddr2_nvm driver probe method - */ -@@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) - .pfow_base = OW_BASE_ADDRESS, - .fldrv_priv = pcm_data, - }; -+ - if (IS_ERR(map->virt)) - return PTR_ERR(map->virt); - -@@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) - return PTR_ERR(pcm_data->ctl_regs); - - /* Populate mtd_info data structure */ -- *mtd = (struct mtd_info) { -- .dev = { .parent = &pdev->dev }, -- .name = pdev->dev.init_name, -- .type = MTD_RAM, -- .priv = map, -- .size = resource_size(add_range), -- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width, -- .writesize = 1, -- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width, -- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), -- ._read = lpddr2_nvm_read, -- ._write = lpddr2_nvm_write, -- ._erase = lpddr2_nvm_erase, -- ._unlock = lpddr2_nvm_unlock, -- ._lock = lpddr2_nvm_lock, -- }; -+ *mtd = lpddr2_nvm_mtd_info; -+ mtd->dev.parent = &pdev->dev; -+ mtd->name = pdev->dev.init_name; -+ mtd->priv = map; -+ mtd->size = resource_size(add_range); -+ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width; -+ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width; - - /* Verify the presence of the device looking for PFOW string */ - if (!lpddr2_nvm_pfow_present(map)) { -diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c -index 97bb8f6304d4f..09165eaac7a15 100644 ---- a/drivers/mtd/mtdoops.c -+++ b/drivers/mtd/mtdoops.c -@@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper, - kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE, - record_size - MTDOOPS_HEADER_SIZE, NULL); - -- /* Panics must be written immediately */ -- if (reason != KMSG_DUMP_OOPS) -+ if (reason != KMSG_DUMP_OOPS) { -+ /* Panics must be written immediately */ - mtdoops_write(cxt, 1); -- -- /* For other cases, schedule work to write it "nicely" */ -- schedule_work(&cxt->work_write); -+ } else { -+ /* For other cases, schedule work to write it "nicely" */ -+ schedule_work(&cxt->work_write); -+ } - } - - static void mtdoops_notify_add(struct mtd_info *mtd) -diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h -index 7ba6d530b0c0a..230a4157ae9d0 100644 ---- a/drivers/net/ethernet/cisco/enic/enic.h -+++ b/drivers/net/ethernet/cisco/enic/enic.h -@@ -163,6 +163,7 @@ struct enic { - u16 num_vfs; - #endif - spinlock_t enic_api_lock; -+ bool enic_api_busy; - struct enic_port_profile *pp; - - /* work queue cache line section */ -diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c -index b161f24522b87..b028ea2dec2b9 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_api.c -+++ b/drivers/net/ethernet/cisco/enic/enic_api.c -@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, - struct vnic_dev *vdev = enic->vdev; - - spin_lock(&enic->enic_api_lock); -+ while (enic->enic_api_busy) { -+ spin_unlock(&enic->enic_api_lock); -+ cpu_relax(); -+ spin_lock(&enic->enic_api_lock); -+ } -+ - spin_lock_bh(&enic->devcmd_lock); - - vnic_dev_cmd_proxy_by_index_start(vdev, vf); -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index 3fd1cba0c7ec3..5c74e55b75e52 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -1938,8 +1938,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, - int done; - int err; - -- BUG_ON(in_interrupt()); -- - err = start(vdev, arg); - if (err) - return err; -@@ -2116,6 +2114,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) - rss_hash_bits, rss_base_cpu, rss_enable); - } - -+static void enic_set_api_busy(struct enic *enic, bool busy) -+{ -+ spin_lock(&enic->enic_api_lock); -+ enic->enic_api_busy = busy; -+ spin_unlock(&enic->enic_api_lock); -+} -+ - static void enic_reset(struct work_struct *work) - { - struct enic *enic = container_of(work, struct enic, reset); -@@ -2125,7 +2130,9 @@ static void enic_reset(struct work_struct *work) - - rtnl_lock(); - -- spin_lock(&enic->enic_api_lock); -+ /* Stop any activity from infiniband */ -+ enic_set_api_busy(enic, true); -+ - enic_stop(enic->netdev); - enic_dev_soft_reset(enic); - enic_reset_addr_lists(enic); -@@ -2133,7 +2140,10 @@ static void enic_reset(struct work_struct *work) - enic_set_rss_nic_cfg(enic); - enic_dev_set_ig_vlan_rewrite_mode(enic); - enic_open(enic->netdev); -- spin_unlock(&enic->enic_api_lock); -+ -+ /* Allow infiniband to fiddle with the device again */ -+ enic_set_api_busy(enic, false); -+ - call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); - - rtnl_unlock(); -@@ -2145,7 +2155,9 @@ static void enic_tx_hang_reset(struct work_struct *work) - - rtnl_lock(); - -- spin_lock(&enic->enic_api_lock); -+ /* Stop any activity from infiniband */ -+ enic_set_api_busy(enic, true); -+ - enic_dev_hang_notify(enic); - enic_stop(enic->netdev); - enic_dev_hang_reset(enic); -@@ -2154,7 +2166,10 @@ static void enic_tx_hang_reset(struct work_struct *work) - enic_set_rss_nic_cfg(enic); - enic_dev_set_ig_vlan_rewrite_mode(enic); - enic_open(enic->netdev); -- spin_unlock(&enic->enic_api_lock); -+ -+ /* Allow infiniband to fiddle with the device again */ -+ enic_set_api_busy(enic, false); -+ - call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); - - rtnl_unlock(); -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index b46fc37c1a947..18d17a7bba6c6 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1254,6 +1254,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) - int offset = ibmveth_rxq_frame_offset(adapter); - int csum_good = ibmveth_rxq_csum_good(adapter); - int lrg_pkt = ibmveth_rxq_large_packet(adapter); -+ __sum16 iph_check = 0; - - skb = ibmveth_rxq_get_buffer(adapter); - -@@ -1305,7 +1306,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) - } - } - -- if (length > netdev->mtu + ETH_HLEN) { -+ /* PHYP without PLSO support places a -1 in the ip -+ * checksum for large send frames. -+ */ -+ if (skb->protocol == cpu_to_be16(ETH_P_IP)) { -+ struct iphdr *iph = (struct iphdr *)skb->data; -+ -+ iph_check = iph->check; -+ } -+ -+ if ((length > netdev->mtu + ETH_HLEN) || -+ lrg_pkt || iph_check == 0xffff) { - ibmveth_rx_mss_helper(skb, mss, lrg_pkt); - adapter->rx_large_packets++; - } -diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c -index 07eabf72c480c..b491de946a0e6 100644 ---- a/drivers/net/ethernet/korina.c -+++ b/drivers/net/ethernet/korina.c -@@ -1188,7 +1188,7 @@ out: - return rc; - - probe_err_register: -- kfree(lp->td_ring); -+ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); - probe_err_td_ring: - iounmap(lp->tx_dma_regs); - probe_err_dma_tx: -@@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev) - iounmap(lp->eth_regs); - iounmap(lp->rx_dma_regs); - iounmap(lp->tx_dma_regs); -+ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring)); - - unregister_netdev(bif->dev); - free_netdev(bif->dev); -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 8f40e121f7d49..f3a685d3f6497 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -4452,6 +4452,62 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr) - rtl_unlock_work(tp); - } - -+static void rtl_init_rxcfg(struct rtl8169_private *tp) -+{ -+ void __iomem *ioaddr = tp->mmio_addr; -+ -+ switch (tp->mac_version) { -+ case RTL_GIGA_MAC_VER_01: -+ case RTL_GIGA_MAC_VER_02: -+ case RTL_GIGA_MAC_VER_03: -+ case RTL_GIGA_MAC_VER_04: -+ case RTL_GIGA_MAC_VER_05: -+ case RTL_GIGA_MAC_VER_06: -+ case RTL_GIGA_MAC_VER_10: -+ case RTL_GIGA_MAC_VER_11: -+ case RTL_GIGA_MAC_VER_12: -+ case RTL_GIGA_MAC_VER_13: -+ case RTL_GIGA_MAC_VER_14: -+ case RTL_GIGA_MAC_VER_15: -+ case RTL_GIGA_MAC_VER_16: -+ case RTL_GIGA_MAC_VER_17: -+ RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); -+ break; -+ case RTL_GIGA_MAC_VER_18: -+ case RTL_GIGA_MAC_VER_19: -+ case RTL_GIGA_MAC_VER_20: -+ case RTL_GIGA_MAC_VER_21: -+ case RTL_GIGA_MAC_VER_22: -+ case RTL_GIGA_MAC_VER_23: -+ case RTL_GIGA_MAC_VER_24: -+ case RTL_GIGA_MAC_VER_34: -+ case RTL_GIGA_MAC_VER_35: -+ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); -+ break; -+ case RTL_GIGA_MAC_VER_40: -+ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -+ break; -+ case RTL_GIGA_MAC_VER_41: -+ case RTL_GIGA_MAC_VER_42: -+ case RTL_GIGA_MAC_VER_43: -+ case RTL_GIGA_MAC_VER_44: -+ case RTL_GIGA_MAC_VER_45: -+ case RTL_GIGA_MAC_VER_46: -+ case RTL_GIGA_MAC_VER_47: -+ case RTL_GIGA_MAC_VER_48: -+ RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF); -+ break; -+ case RTL_GIGA_MAC_VER_49: -+ case RTL_GIGA_MAC_VER_50: -+ case RTL_GIGA_MAC_VER_51: -+ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -+ break; -+ default: -+ RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); -+ break; -+ } -+} -+ - static int rtl_set_mac_address(struct net_device *dev, void *p) - { - struct rtl8169_private *tp = netdev_priv(dev); -@@ -4464,6 +4520,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p) - - rtl_rar_set(tp, dev->dev_addr); - -+ /* Reportedly at least Asus X453MA truncates packets otherwise */ -+ if (tp->mac_version == RTL_GIGA_MAC_VER_37) -+ rtl_init_rxcfg(tp); -+ - return 0; - } - -@@ -4901,62 +4961,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp) - } - } - --static void rtl_init_rxcfg(struct rtl8169_private *tp) --{ -- void __iomem *ioaddr = tp->mmio_addr; -- -- switch (tp->mac_version) { -- case RTL_GIGA_MAC_VER_01: -- case RTL_GIGA_MAC_VER_02: -- case RTL_GIGA_MAC_VER_03: -- case RTL_GIGA_MAC_VER_04: -- case RTL_GIGA_MAC_VER_05: -- case RTL_GIGA_MAC_VER_06: -- case RTL_GIGA_MAC_VER_10: -- case RTL_GIGA_MAC_VER_11: -- case RTL_GIGA_MAC_VER_12: -- case RTL_GIGA_MAC_VER_13: -- case RTL_GIGA_MAC_VER_14: -- case RTL_GIGA_MAC_VER_15: -- case RTL_GIGA_MAC_VER_16: -- case RTL_GIGA_MAC_VER_17: -- RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); -- break; -- case RTL_GIGA_MAC_VER_18: -- case RTL_GIGA_MAC_VER_19: -- case RTL_GIGA_MAC_VER_20: -- case RTL_GIGA_MAC_VER_21: -- case RTL_GIGA_MAC_VER_22: -- case RTL_GIGA_MAC_VER_23: -- case RTL_GIGA_MAC_VER_24: -- case RTL_GIGA_MAC_VER_34: -- case RTL_GIGA_MAC_VER_35: -- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); -- break; -- case RTL_GIGA_MAC_VER_40: -- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -- break; -- case RTL_GIGA_MAC_VER_41: -- case RTL_GIGA_MAC_VER_42: -- case RTL_GIGA_MAC_VER_43: -- case RTL_GIGA_MAC_VER_44: -- case RTL_GIGA_MAC_VER_45: -- case RTL_GIGA_MAC_VER_46: -- case RTL_GIGA_MAC_VER_47: -- case RTL_GIGA_MAC_VER_48: -- RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF); -- break; -- case RTL_GIGA_MAC_VER_49: -- case RTL_GIGA_MAC_VER_50: -- case RTL_GIGA_MAC_VER_51: -- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -- break; -- default: -- RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST); -- break; -- } --} -- - static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) - { - tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0; -diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c -index 51f6cee8aab2d..b9216c3d49463 100644 ---- a/drivers/net/wan/hdlc.c -+++ b/drivers/net/wan/hdlc.c -@@ -57,7 +57,15 @@ int hdlc_change_mtu(struct net_device *dev, int new_mtu) - static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev, - struct packet_type *p, struct net_device *orig_dev) - { -- struct hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct hdlc_device *hdlc; -+ -+ /* First make sure "dev" is an HDLC device */ -+ if (!(dev->priv_flags & IFF_WAN_HDLC)) { -+ kfree_skb(skb); -+ return NET_RX_SUCCESS; -+ } -+ -+ hdlc = dev_to_hdlc(dev); - - if (!net_eq(dev_net(dev), &init_net)) { - kfree_skb(skb); -diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c -index 3ab72b3082dee..bb7c362b23ad5 100644 ---- a/drivers/net/wan/hdlc_raw_eth.c -+++ b/drivers/net/wan/hdlc_raw_eth.c -@@ -101,6 +101,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr) - old_qlen = dev->tx_queue_len; - ether_setup(dev); - dev->tx_queue_len = old_qlen; -+ dev->priv_flags &= ~IFF_TX_SKB_SHARING; - eth_hw_addr_random(dev); - netif_dormant_off(dev); - return 0; -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index a65b5d7f59f44..1c6c422dbad64 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -99,6 +99,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) - BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2); - - idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr); -+ -+ if (idx < 0 || idx >= htt->rx_ring.size) { -+ ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n"); -+ idx &= htt->rx_ring.size_mask; -+ ret = -ENOMEM; -+ goto fail; -+ } -+ - while (num > 0) { - skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN); - if (!skb) { -diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c -index 1af3fed5a72ca..1a68518279689 100644 ---- a/drivers/net/wireless/ath/ath6kl/main.c -+++ b/drivers/net/wireless/ath/ath6kl/main.c -@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, - - ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); - -+ if (aid < 1 || aid > AP_MAX_NUM_STA) -+ return; -+ - if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { - struct ieee80211_mgmt *mgmt = - (struct ieee80211_mgmt *) assoc_info; -diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c -index b2ec254f154e0..7e1010475cfb2 100644 ---- a/drivers/net/wireless/ath/ath6kl/wmi.c -+++ b/drivers/net/wireless/ath/ath6kl/wmi.c -@@ -2644,6 +2644,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, - return -EINVAL; - } - -+ if (tsid >= 16) { -+ ath6kl_err("invalid tsid: %d\n", tsid); -+ return -EINVAL; -+ } -+ - skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); - if (!skb) - return -ENOMEM; -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c -index 76d91859cfde9..75072a8f8cf42 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.c -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c -@@ -445,10 +445,19 @@ static void hif_usb_stop(void *hif_handle) - spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - - /* The pending URBs have to be canceled. */ -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - list_for_each_entry_safe(tx_buf, tx_buf_tmp, - &hif_dev->tx.tx_pending, list) { -+ usb_get_urb(tx_buf->urb); -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - usb_kill_urb(tx_buf->urb); -+ list_del(&tx_buf->list); -+ usb_free_urb(tx_buf->urb); -+ kfree(tx_buf->buf); -+ kfree(tx_buf); -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - } -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - - usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); - } -@@ -758,27 +767,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev) - struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL; - unsigned long flags; - -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - list_for_each_entry_safe(tx_buf, tx_buf_tmp, - &hif_dev->tx.tx_buf, list) { -+ usb_get_urb(tx_buf->urb); -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - usb_kill_urb(tx_buf->urb); - list_del(&tx_buf->list); - usb_free_urb(tx_buf->urb); - kfree(tx_buf->buf); - kfree(tx_buf); -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - } -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - - spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - hif_dev->tx.flags |= HIF_USB_TX_FLUSH; - spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - list_for_each_entry_safe(tx_buf, tx_buf_tmp, - &hif_dev->tx.tx_pending, list) { -+ usb_get_urb(tx_buf->urb); -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - usb_kill_urb(tx_buf->urb); - list_del(&tx_buf->list); - usb_free_urb(tx_buf->urb); - kfree(tx_buf->buf); - kfree(tx_buf); -+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); - } -+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); - - usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); - } -diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c -index 1af216aa5adae..625823e45d8f0 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_hst.c -+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c -@@ -346,6 +346,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, - - if (skb) { - htc_hdr = (struct htc_frame_hdr *) skb->data; -+ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint)) -+ goto ret; - endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id]; - skb_pull(skb, sizeof(struct htc_frame_hdr)); - -diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index a27279c2c6950..274d114962e8a 100644 ---- a/drivers/net/wireless/ath/wcn36xx/main.c -+++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -156,7 +156,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { - .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, - .mcs = { - .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, -- .rx_highest = cpu_to_le16(72), -+ .rx_highest = cpu_to_le16(150), - .tx_params = IEEE80211_HT_MCS_TX_DEFINED, - } - } -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -index f944f356d9c51..cacb43573f579 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -@@ -1530,6 +1530,8 @@ fail: - BRCMF_TX_IOCTL_MAX_MSG_SIZE, - msgbuf->ioctbuf, - msgbuf->ioctbuf_handle); -+ if (msgbuf->txflow_wq) -+ destroy_workqueue(msgbuf->txflow_wq); - kfree(msgbuf); - } - return -ENOMEM; -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c -index 93d4cde0eb313..c9f48ec46f4a1 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c -@@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) - pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; - pi->pi_fptr.detach = wlc_phy_detach_lcnphy; - -- if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) -+ if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) { -+ kfree(pi->u.pi_lcnphy); - return false; -+ } - - if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { - if (pi_lcn->lcnphy_tempsense_option == 3) { -diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c -index e7c8972431d34..e54dd4b7face6 100644 ---- a/drivers/net/wireless/mwifiex/scan.c -+++ b/drivers/net/wireless/mwifiex/scan.c -@@ -1862,7 +1862,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, - chan, CFG80211_BSS_FTYPE_UNKNOWN, - bssid, timestamp, - cap_info_bitmap, beacon_period, -- ie_buf, ie_len, rssi, GFP_KERNEL); -+ ie_buf, ie_len, rssi, GFP_ATOMIC); - if (bss) { - bss_priv = (struct mwifiex_bss_priv *)bss->priv; - bss_priv->band = band; -diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c -index 78a8474e1a3dc..abfe4e8700ed3 100644 ---- a/drivers/net/wireless/mwifiex/sdio.c -+++ b/drivers/net/wireless/mwifiex/sdio.c -@@ -1928,6 +1928,8 @@ error: - kfree(card->mpa_rx.buf); - card->mpa_tx.buf_size = 0; - card->mpa_rx.buf_size = 0; -+ card->mpa_tx.buf = NULL; -+ card->mpa_rx.buf = NULL; - } - - return ret; -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -index 8254d4b22c50b..b8d387edde65c 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -@@ -5135,7 +5135,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) - ret = usb_submit_urb(urb, GFP_KERNEL); - if (ret) { - usb_unanchor_urb(urb); -- usb_free_urb(urb); - goto error; - } - -@@ -5144,6 +5143,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) - rtl8xxxu_write32(priv, REG_USB_HIMR, val32); - - error: -+ usb_free_urb(urb); - return ret; - } - -@@ -5424,6 +5424,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) - struct rtl8xxxu_priv *priv = hw->priv; - struct rtl8xxxu_rx_urb *rx_urb; - struct rtl8xxxu_tx_urb *tx_urb; -+ struct sk_buff *skb; - unsigned long flags; - int ret, i; - -@@ -5472,6 +5473,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) - rx_urb->hw = hw; - - ret = rtl8xxxu_submit_rx_urb(priv, rx_urb); -+ if (ret) { -+ if (ret != -ENOMEM) { -+ skb = (struct sk_buff *)rx_urb->urb.context; -+ dev_kfree_skb(skb); -+ } -+ rtl8xxxu_queue_rx_urb(priv, rx_urb); -+ } - } - exit: - /* -diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c -index dab195f04da78..06ca0495f3e8e 100644 ---- a/drivers/scsi/csiostor/csio_hw.c -+++ b/drivers/scsi/csiostor/csio_hw.c -@@ -1973,7 +1973,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info, - FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), - FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), - FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); -- ret = EINVAL; -+ ret = -EINVAL; - goto bye; - } - -diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c -index 0526a47e30a3f..db80ab8335dfb 100644 ---- a/drivers/scsi/ibmvscsi/ibmvfc.c -+++ b/drivers/scsi/ibmvscsi/ibmvfc.c -@@ -4790,6 +4790,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id) - if (IS_ERR(vhost->work_thread)) { - dev_err(dev, "Couldn't create kernel thread: %ld\n", - PTR_ERR(vhost->work_thread)); -+ rc = PTR_ERR(vhost->work_thread); - goto free_host_mem; - } - -diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c -index 39285070f3b51..17ec51f9d9880 100644 ---- a/drivers/scsi/mvumi.c -+++ b/drivers/scsi/mvumi.c -@@ -2476,6 +2476,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba) - if (IS_ERR(mhba->dm_thread)) { - dev_err(&mhba->pdev->dev, - "failed to create device scan thread\n"); -+ ret = PTR_ERR(mhba->dm_thread); - mutex_unlock(&mhba->sas_discovery_mutex); - goto fail_create_thread; - } -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index 3fda5836aac69..f10088a1d38c0 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len) - le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error); - exit_host_stats: - if (ql_iscsi_stats) -- dma_free_coherent(&ha->pdev->dev, host_stats_size, -+ dma_free_coherent(&ha->pdev->dev, stats_size, - ql_iscsi_stats, iscsi_stats_dma); - - ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", -diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c -index 5997b17311113..cba662c50f919 100644 ---- a/drivers/tty/hvc/hvcs.c -+++ b/drivers/tty/hvc/hvcs.c -@@ -1232,13 +1232,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) - - tty_wait_until_sent(tty, HVCS_CLOSE_WAIT); - -- /* -- * This line is important because it tells hvcs_open that this -- * device needs to be re-configured the next time hvcs_open is -- * called. -- */ -- tty->driver_data = NULL; -- - free_irq(irq, hvcsd); - return; - } else if (hvcsd->port.count < 0) { -@@ -1254,6 +1247,13 @@ static void hvcs_cleanup(struct tty_struct * tty) - { - struct hvcs_struct *hvcsd = tty->driver_data; - -+ /* -+ * This line is important because it tells hvcs_open that this -+ * device needs to be re-configured the next time hvcs_open is -+ * called. -+ */ -+ tty->driver_data = NULL; -+ - tty_port_put(&hvcsd->port); - } - -diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c -index c0dfb642383b2..dc7f4eb18e0a7 100644 ---- a/drivers/tty/ipwireless/network.c -+++ b/drivers/tty/ipwireless/network.c -@@ -116,7 +116,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, - skb->len, - notify_packet_sent, - network); -- if (ret == -1) { -+ if (ret < 0) { - skb_pull(skb, 2); - return 0; - } -@@ -133,7 +133,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, - notify_packet_sent, - network); - kfree(buf); -- if (ret == -1) -+ if (ret < 0) - return 0; - } - kfree_skb(skb); -diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c -index 345cebb07ae79..0b06b1847450f 100644 ---- a/drivers/tty/ipwireless/tty.c -+++ b/drivers/tty/ipwireless/tty.c -@@ -217,7 +217,7 @@ static int ipw_write(struct tty_struct *linux_tty, - ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS, - buf, count, - ipw_write_packet_sent_callback, tty); -- if (ret == -1) { -+ if (ret < 0) { - mutex_unlock(&tty->ipw_tty_mutex); - return 0; - } -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index c8a2e5b0eff76..8ee146b14aae8 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -115,10 +115,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) - spin_lock_irqsave(&to->port->lock, flags); - /* Stuff the data into the input queue of the other end */ - c = tty_insert_flip_string(to->port, buf, c); -+ spin_unlock_irqrestore(&to->port->lock, flags); - /* And shovel */ - if (c) - tty_flip_buffer_push(to->port); -- spin_unlock_irqrestore(&to->port->lock, flags); - } - return c; - } -diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig -index f38beb28e7ae6..5c3c86d4fe716 100644 ---- a/drivers/tty/serial/Kconfig -+++ b/drivers/tty/serial/Kconfig -@@ -9,6 +9,7 @@ menu "Serial drivers" - - config SERIAL_EARLYCON - bool -+ depends on SERIAL_CORE - help - Support for early consoles with the earlycon parameter. This enables - the console before standard serial driver is probed. The console is -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 515839034dfbc..fb7e56fad41c8 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1897,6 +1897,17 @@ static const struct usb_device_id acm_ids[] = { - .driver_info = IGNORE_DEVICE, - }, - -+ /* Exclude ETAS ES58x */ -+ { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */ -+ .driver_info = IGNORE_DEVICE, -+ }, -+ { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */ -+ .driver_info = IGNORE_DEVICE, -+ }, -+ { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */ -+ .driver_info = IGNORE_DEVICE, -+ }, -+ - { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ - .driver_info = SEND_ZERO_PACKET, - }, -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 1a1d1cfc3704c..35ee2233ad170 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -61,6 +61,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); - - #define WDM_MAX 16 - -+/* we cannot wait forever at flush() */ -+#define WDM_FLUSH_TIMEOUT (30 * HZ) -+ - /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */ - #define WDM_DEFAULT_BUFSIZE 256 - -@@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb) - kfree(desc->outbuf); - desc->outbuf = NULL; - clear_bit(WDM_IN_USE, &desc->flags); -- wake_up(&desc->wait); -+ wake_up_all(&desc->wait); - } - - static void wdm_in_callback(struct urb *urb) -@@ -382,6 +385,9 @@ static ssize_t wdm_write - if (test_bit(WDM_RESETTING, &desc->flags)) - r = -EIO; - -+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) -+ r = -ENODEV; -+ - if (r < 0) { - rv = r; - goto out_free_mem_pm; -@@ -413,6 +419,7 @@ static ssize_t wdm_write - if (rv < 0) { - desc->outbuf = NULL; - clear_bit(WDM_IN_USE, &desc->flags); -+ wake_up_all(&desc->wait); /* for wdm_wait_for_response() */ - dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); - rv = usb_translate_errors(rv); - goto out_free_mem_pm; -@@ -573,28 +580,58 @@ err: - return rv; - } - --static int wdm_flush(struct file *file, fl_owner_t id) -+static int wdm_wait_for_response(struct file *file, long timeout) - { - struct wdm_device *desc = file->private_data; -+ long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */ - -- wait_event(desc->wait, -- /* -- * needs both flags. We cannot do with one -- * because resetting it would cause a race -- * with write() yet we need to signal -- * a disconnect -- */ -- !test_bit(WDM_IN_USE, &desc->flags) || -- test_bit(WDM_DISCONNECTING, &desc->flags)); -- -- /* cannot dereference desc->intf if WDM_DISCONNECTING */ -+ /* -+ * Needs both flags. We cannot do with one because resetting it would -+ * cause a race with write() yet we need to signal a disconnect. -+ */ -+ rv = wait_event_interruptible_timeout(desc->wait, -+ !test_bit(WDM_IN_USE, &desc->flags) || -+ test_bit(WDM_DISCONNECTING, &desc->flags), -+ timeout); -+ -+ /* -+ * To report the correct error. This is best effort. -+ * We are inevitably racing with the hardware. -+ */ - if (test_bit(WDM_DISCONNECTING, &desc->flags)) - return -ENODEV; -- if (desc->werr < 0) -- dev_err(&desc->intf->dev, "Error in flush path: %d\n", -- desc->werr); -+ if (!rv) -+ return -EIO; -+ if (rv < 0) -+ return -EINTR; - -- return usb_translate_errors(desc->werr); -+ spin_lock_irq(&desc->iuspin); -+ rv = desc->werr; -+ desc->werr = 0; -+ spin_unlock_irq(&desc->iuspin); -+ -+ return usb_translate_errors(rv); -+ -+} -+ -+/* -+ * You need to send a signal when you react to malicious or defective hardware. -+ * Also, don't abort when fsync() returned -EINVAL, for older kernels which do -+ * not implement wdm_flush() will return -EINVAL. -+ */ -+static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync) -+{ -+ return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT); -+} -+ -+/* -+ * Same with wdm_fsync(), except it uses finite timeout in order to react to -+ * malicious or defective hardware which ceased communication after close() was -+ * implicitly called due to process termination. -+ */ -+static int wdm_flush(struct file *file, fl_owner_t id) -+{ -+ return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT); - } - - static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait) -@@ -719,6 +756,7 @@ static const struct file_operations wdm_fops = { - .owner = THIS_MODULE, - .read = wdm_read, - .write = wdm_write, -+ .fsync = wdm_fsync, - .open = wdm_open, - .flush = wdm_flush, - .release = wdm_release, -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index c095cde55329c..8c4bfd42f785d 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -767,11 +767,12 @@ void usb_block_urb(struct urb *urb) - EXPORT_SYMBOL_GPL(usb_block_urb); - - /** -- * usb_kill_anchored_urbs - cancel transfer requests en masse -+ * usb_kill_anchored_urbs - kill all URBs associated with an anchor - * @anchor: anchor the requests are bound to - * -- * this allows all outstanding URBs to be killed starting -- * from the back of the queue -+ * This kills all outstanding URBs starting from the back of the queue, -+ * with guarantee that no completer callbacks will take place from the -+ * anchor after this function returns. - * - * This routine should not be called by a driver after its disconnect - * method has returned. -@@ -779,20 +780,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb); - void usb_kill_anchored_urbs(struct usb_anchor *anchor) - { - struct urb *victim; -+ int surely_empty; - -- spin_lock_irq(&anchor->lock); -- while (!list_empty(&anchor->urb_list)) { -- victim = list_entry(anchor->urb_list.prev, struct urb, -- anchor_list); -- /* we must make sure the URB isn't freed before we kill it*/ -- usb_get_urb(victim); -- spin_unlock_irq(&anchor->lock); -- /* this will unanchor the URB */ -- usb_kill_urb(victim); -- usb_put_urb(victim); -+ do { - spin_lock_irq(&anchor->lock); -- } -- spin_unlock_irq(&anchor->lock); -+ while (!list_empty(&anchor->urb_list)) { -+ victim = list_entry(anchor->urb_list.prev, -+ struct urb, anchor_list); -+ /* make sure the URB isn't freed before we kill it */ -+ usb_get_urb(victim); -+ spin_unlock_irq(&anchor->lock); -+ /* this will unanchor the URB */ -+ usb_kill_urb(victim); -+ usb_put_urb(victim); -+ spin_lock_irq(&anchor->lock); -+ } -+ surely_empty = usb_anchor_check_wakeup(anchor); -+ -+ spin_unlock_irq(&anchor->lock); -+ cpu_relax(); -+ } while (!surely_empty); - } - EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); - -@@ -811,21 +818,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); - void usb_poison_anchored_urbs(struct usb_anchor *anchor) - { - struct urb *victim; -+ int surely_empty; - -- spin_lock_irq(&anchor->lock); -- anchor->poisoned = 1; -- while (!list_empty(&anchor->urb_list)) { -- victim = list_entry(anchor->urb_list.prev, struct urb, -- anchor_list); -- /* we must make sure the URB isn't freed before we kill it*/ -- usb_get_urb(victim); -- spin_unlock_irq(&anchor->lock); -- /* this will unanchor the URB */ -- usb_poison_urb(victim); -- usb_put_urb(victim); -+ do { - spin_lock_irq(&anchor->lock); -- } -- spin_unlock_irq(&anchor->lock); -+ anchor->poisoned = 1; -+ while (!list_empty(&anchor->urb_list)) { -+ victim = list_entry(anchor->urb_list.prev, -+ struct urb, anchor_list); -+ /* make sure the URB isn't freed before we kill it */ -+ usb_get_urb(victim); -+ spin_unlock_irq(&anchor->lock); -+ /* this will unanchor the URB */ -+ usb_poison_urb(victim); -+ usb_put_urb(victim); -+ spin_lock_irq(&anchor->lock); -+ } -+ surely_empty = usb_anchor_check_wakeup(anchor); -+ -+ spin_unlock_irq(&anchor->lock); -+ cpu_relax(); -+ } while (!surely_empty); - } - EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs); - -@@ -965,14 +978,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor) - { - struct urb *victim; - unsigned long flags; -+ int surely_empty; -+ -+ do { -+ spin_lock_irqsave(&anchor->lock, flags); -+ while (!list_empty(&anchor->urb_list)) { -+ victim = list_entry(anchor->urb_list.prev, -+ struct urb, anchor_list); -+ __usb_unanchor_urb(victim, anchor); -+ } -+ surely_empty = usb_anchor_check_wakeup(anchor); - -- spin_lock_irqsave(&anchor->lock, flags); -- while (!list_empty(&anchor->urb_list)) { -- victim = list_entry(anchor->urb_list.prev, struct urb, -- anchor_list); -- __usb_unanchor_urb(victim, anchor); -- } -- spin_unlock_irqrestore(&anchor->lock, flags); -+ spin_unlock_irqrestore(&anchor->lock, flags); -+ cpu_relax(); -+ } while (!surely_empty); - } - - EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs); -diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c -index 69afc17fca38f..7b21ef09fffc2 100644 ---- a/drivers/usb/gadget/function/f_printer.c -+++ b/drivers/usb/gadget/function/f_printer.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -69,7 +70,7 @@ struct printer_dev { - struct usb_gadget *gadget; - s8 interface; - struct usb_ep *in_ep, *out_ep; -- -+ struct kref kref; - struct list_head rx_reqs; /* List of free RX structs */ - struct list_head rx_reqs_active; /* List of Active RX xfers */ - struct list_head rx_buffers; /* List of completed xfers */ -@@ -223,6 +224,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, - - /*-------------------------------------------------------------------------*/ - -+static void printer_dev_free(struct kref *kref) -+{ -+ struct printer_dev *dev = container_of(kref, struct printer_dev, kref); -+ -+ kfree(dev); -+} -+ - static struct usb_request * - printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) - { -@@ -353,6 +361,7 @@ printer_open(struct inode *inode, struct file *fd) - - spin_unlock_irqrestore(&dev->lock, flags); - -+ kref_get(&dev->kref); - DBG(dev, "printer_open returned %x\n", ret); - return ret; - } -@@ -370,6 +379,7 @@ printer_close(struct inode *inode, struct file *fd) - dev->printer_status &= ~PRINTER_SELECTED; - spin_unlock_irqrestore(&dev->lock, flags); - -+ kref_put(&dev->kref, printer_dev_free); - DBG(dev, "printer_close\n"); - - return 0; -@@ -1316,7 +1326,8 @@ static void gprinter_free(struct usb_function *f) - struct f_printer_opts *opts; - - opts = container_of(f->fi, struct f_printer_opts, func_inst); -- kfree(dev); -+ -+ kref_put(&dev->kref, printer_dev_free); - mutex_lock(&opts->lock); - --opts->refcnt; - mutex_unlock(&opts->lock); -@@ -1385,6 +1396,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) - return ERR_PTR(-ENOMEM); - } - -+ kref_init(&dev->kref); - ++opts->refcnt; - dev->minor = opts->minor; - dev->pnp_string = opts->pnp_string; -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index e69f20b2a3f44..46c50135ef9f7 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -96,7 +96,7 @@ struct eth_dev { - static inline int qlen(struct usb_gadget *gadget, unsigned qmult) - { - if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH || -- gadget->speed == USB_SPEED_SUPER)) -+ gadget->speed >= USB_SPEED_SUPER)) - return qmult * DEFAULT_QLEN; - else - return DEFAULT_QLEN; -diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c -index 27bd3e49fe8e3..07d76d9d4ce1b 100644 ---- a/drivers/usb/host/ohci-hcd.c -+++ b/drivers/usb/host/ohci-hcd.c -@@ -663,20 +663,24 @@ retry: - - /* handle root hub init quirks ... */ - val = roothub_a (ohci); -- val &= ~(RH_A_PSM | RH_A_OCPM); -+ /* Configure for per-port over-current protection by default */ -+ val &= ~RH_A_NOCP; -+ val |= RH_A_OCPM; - if (ohci->flags & OHCI_QUIRK_SUPERIO) { -- /* NSC 87560 and maybe others */ -+ /* NSC 87560 and maybe others. -+ * Ganged power switching, no over-current protection. -+ */ - val |= RH_A_NOCP; -- val &= ~(RH_A_POTPGT | RH_A_NPS); -- ohci_writel (ohci, val, &ohci->regs->roothub.a); -+ val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM); - } else if ((ohci->flags & OHCI_QUIRK_AMD756) || - (ohci->flags & OHCI_QUIRK_HUB_POWER)) { - /* hub power always on; required for AMD-756 and some -- * Mac platforms. ganged overcurrent reporting, if any. -+ * Mac platforms. - */ - val |= RH_A_NPS; -- ohci_writel (ohci, val, &ohci->regs->roothub.a); - } -+ ohci_writel(ohci, val, &ohci->regs->roothub.a); -+ - ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status); - ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM, - &ohci->regs->roothub.b); -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index f7d48661aa944..af4f7ebb45a79 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -364,11 +364,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - vdev->ctx[vector].producer.token = trigger; - vdev->ctx[vector].producer.irq = irq; - ret = irq_bypass_register_producer(&vdev->ctx[vector].producer); -- if (unlikely(ret)) -+ if (unlikely(ret)) { - dev_info(&pdev->dev, - "irq bypass producer (token %p) registration fails: %d\n", - vdev->ctx[vector].producer.token, ret); - -+ vdev->ctx[vector].producer.token = NULL; -+ } - vdev->ctx[vector].trigger = trigger; - - return 0; -diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c -index d414c7a3acf5a..a2f77625b7170 100644 ---- a/drivers/video/backlight/sky81452-backlight.c -+++ b/drivers/video/backlight/sky81452-backlight.c -@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( - num_entry); - if (ret < 0) { - dev_err(dev, "led-sources node is invalid.\n"); -+ of_node_put(np); - return ERR_PTR(-EINVAL); - } - -diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c -index dfe3eb769638b..fde27feae5d0c 100644 ---- a/drivers/video/fbdev/sis/init.c -+++ b/drivers/video/fbdev/sis/init.c -@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, - - i = 0; - -+ if (SiS_Pr->ChipType == SIS_730) -+ queuedata = &FQBQData730[0]; -+ else -+ queuedata = &FQBQData[0]; -+ - if(ModeNo > 0x13) { - - /* Get VCLK */ -@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, - /* Get half colordepth */ - colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)]; - -- if(SiS_Pr->ChipType == SIS_730) { -- queuedata = &FQBQData730[0]; -- } else { -- queuedata = &FQBQData[0]; -- } -- - do { - templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth; - -diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c -index 1acdb41a8a7c3..06cee2a40a9bf 100644 ---- a/drivers/video/fbdev/vga16fb.c -+++ b/drivers/video/fbdev/vga16fb.c -@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info) - } - - static void vga16fb_clock_chip(struct vga16fb_par *par, -- unsigned int pixclock, -+ unsigned int *pixclock, - const struct fb_info *info, - int mul, int div) - { -@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, - { 0 /* bad */, 0x00, 0x00}}; - int err; - -- pixclock = (pixclock * mul) / div; -+ *pixclock = (*pixclock * mul) / div; - best = vgaclocks; -- err = pixclock - best->pixclock; -+ err = *pixclock - best->pixclock; - if (err < 0) err = -err; - for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) { - int tmp; - -- tmp = pixclock - ptr->pixclock; -+ tmp = *pixclock - ptr->pixclock; - if (tmp < 0) tmp = -tmp; - if (tmp < err) { - err = tmp; -@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, - } - par->misc |= best->misc; - par->clkdiv = best->seq_clock_mode; -- pixclock = (best->pixclock * div) / mul; -+ *pixclock = (best->pixclock * div) / mul; - } - - #define FAIL(X) return -EINVAL -@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var, - - if (mode & MODE_8BPP) - /* pixel clock == vga clock / 2 */ -- vga16fb_clock_chip(par, var->pixclock, info, 1, 2); -+ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2); - else - /* pixel clock == vga clock */ -- vga16fb_clock_chip(par, var->pixclock, info, 1, 1); -+ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1); - - var->red.offset = var->green.offset = var->blue.offset = - var->transp.offset = 0; -diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c -index 9f96c7e61387d..0d11b5043db53 100644 ---- a/drivers/virt/fsl_hypervisor.c -+++ b/drivers/virt/fsl_hypervisor.c -@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - - unsigned int i; - long ret = 0; -- int num_pinned; /* return value from get_user_pages() */ -+ int num_pinned = 0; /* return value from get_user_pages_fast() */ - phys_addr_t remote_paddr; /* The next address in the remote buffer */ - uint32_t count; /* The number of bytes left to copy */ - -@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - return -EINVAL; - - /* -- * The array of pages returned by get_user_pages() covers only -+ * The array of pages returned by get_user_pages_fast() covers only - * page-aligned memory. Since the user buffer is probably not - * page-aligned, we need to handle the discrepancy. - * -@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - - /* - * 'pages' is an array of struct page pointers that's initialized by -- * get_user_pages(). -+ * get_user_pages_fast(). - */ - pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL); - if (!pages) { -@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - if (!sg_list_unaligned) { - pr_debug("fsl-hv: could not allocate S/G list\n"); - ret = -ENOMEM; -- goto exit; -+ goto free_pages; - } - sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list)); - -@@ -254,7 +254,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - up_read(¤t->mm->mmap_sem); - - if (num_pinned != num_pages) { -- /* get_user_pages() failed */ - pr_debug("fsl-hv: could not lock source buffer\n"); - ret = (num_pinned < 0) ? num_pinned : -EFAULT; - goto exit; -@@ -296,13 +295,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - virt_to_phys(sg_list), num_pages); - - exit: -- if (pages) { -- for (i = 0; i < num_pages; i++) -- if (pages[i]) -- put_page(pages[i]); -+ if (pages && (num_pinned > 0)) { -+ for (i = 0; i < num_pinned; i++) -+ put_page(pages[i]); - } - - kfree(sg_list_unaligned); -+free_pages: - kfree(pages); - - if (!ret) -diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c -index a3b56544c21b9..ae1f2817bd6a6 100644 ---- a/fs/cifs/asn1.c -+++ b/fs/cifs/asn1.c -@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, - return 0; - } else if ((cls != ASN1_CTX) || (con != ASN1_CON) - || (tag != ASN1_EOC)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", -+ cls, con, tag, end); - return 0; - } - -@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, - return 0; - } else if ((cls != ASN1_UNI) || (con != ASN1_CON) - || (tag != ASN1_SEQ)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n", -+ cls, con, tag, end); - return 0; - } - -@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, - return 0; - } else if ((cls != ASN1_CTX) || (con != ASN1_CON) - || (tag != ASN1_EOC)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", -+ cls, con, tag, end); - return 0; - } - -@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, - return 0; - } else if ((cls != ASN1_UNI) || (con != ASN1_CON) - || (tag != ASN1_SEQ)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n", -+ cls, con, tag, sequence_end); - return 0; - } - -diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c -index d284f07eda775..38260c07de8b5 100644 ---- a/fs/ntfs/inode.c -+++ b/fs/ntfs/inode.c -@@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi) - brelse(bh); - } - -+ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) { -+ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.", -+ le32_to_cpu(m->bytes_allocated), vol->mft_record_size); -+ goto err_out; -+ } -+ - /* Apply the mst fixups. */ - if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { - /* FIXME: Try to use the $MFTMirr now. */ -diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c -index 2aa012a68e90e..9891b8fb0432f 100644 ---- a/fs/quota/quota_v2.c -+++ b/fs/quota/quota_v2.c -@@ -266,6 +266,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot) - d->dqb_curspace = cpu_to_le64(m->dqb_curspace); - d->dqb_btime = cpu_to_le64(m->dqb_btime); - d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id)); -+ d->dqb_pad = 0; - if (qtree_entry_unused(info, dp)) - d->dqb_itime = cpu_to_le64(1); - } -diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c -index cfb4691d92741..ccbb15ab029f4 100644 ---- a/fs/reiserfs/inode.c -+++ b/fs/reiserfs/inode.c -@@ -2157,7 +2157,8 @@ out_end_trans: - out_inserted_sd: - clear_nlink(inode); - th->t_trans_id = 0; /* so the caller can't use this handle later */ -- unlock_new_inode(inode); /* OK to do even if we hadn't locked it */ -+ if (inode->i_state & I_NEW) -+ unlock_new_inode(inode); - iput(inode); - return err; - } -diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c -index f9796fd515315..503d8c06e0d93 100644 ---- a/fs/reiserfs/super.c -+++ b/fs/reiserfs/super.c -@@ -1232,6 +1232,10 @@ static int reiserfs_parse_options(struct super_block *s, - "turned on."); - return 0; - } -+ if (qf_names[qtype] != -+ REISERFS_SB(s)->s_qf_names[qtype]) -+ kfree(qf_names[qtype]); -+ qf_names[qtype] = NULL; - if (*arg) { /* Some filename specified? */ - if (REISERFS_SB(s)->s_qf_names[qtype] - && strcmp(REISERFS_SB(s)->s_qf_names[qtype], -@@ -1261,10 +1265,6 @@ static int reiserfs_parse_options(struct super_block *s, - else - *mount_options |= 1 << REISERFS_GRPQUOTA; - } else { -- if (qf_names[qtype] != -- REISERFS_SB(s)->s_qf_names[qtype]) -- kfree(qf_names[qtype]); -- qf_names[qtype] = NULL; - if (qtype == USRQUOTA) - *mount_options &= ~(1 << REISERFS_USRQUOTA); - else -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 3876448ec0dcb..2c39c1c81196c 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -140,21 +140,24 @@ void udf_evict_inode(struct inode *inode) - struct udf_inode_info *iinfo = UDF_I(inode); - int want_delete = 0; - -- if (!inode->i_nlink && !is_bad_inode(inode)) { -- want_delete = 1; -- udf_setsize(inode, 0); -- udf_update_inode(inode, IS_SYNC(inode)); -+ if (!is_bad_inode(inode)) { -+ if (!inode->i_nlink) { -+ want_delete = 1; -+ udf_setsize(inode, 0); -+ udf_update_inode(inode, IS_SYNC(inode)); -+ } -+ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && -+ inode->i_size != iinfo->i_lenExtents) { -+ udf_warn(inode->i_sb, -+ "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", -+ inode->i_ino, inode->i_mode, -+ (unsigned long long)inode->i_size, -+ (unsigned long long)iinfo->i_lenExtents); -+ } - } - truncate_inode_pages_final(&inode->i_data); - invalidate_inode_buffers(inode); - clear_inode(inode); -- if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && -- inode->i_size != iinfo->i_lenExtents) { -- udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", -- inode->i_ino, inode->i_mode, -- (unsigned long long)inode->i_size, -- (unsigned long long)iinfo->i_lenExtents); -- } - kfree(iinfo->i_ext.i_data); - iinfo->i_ext.i_data = NULL; - udf_clear_extent_cache(inode); -diff --git a/fs/udf/super.c b/fs/udf/super.c -index 159977ec8e548..710f1b8fad9bf 100644 ---- a/fs/udf/super.c -+++ b/fs/udf/super.c -@@ -1390,6 +1390,12 @@ static int udf_load_sparable_map(struct super_block *sb, - (int)spm->numSparingTables); - return -EIO; - } -+ if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) { -+ udf_err(sb, "error loading logical volume descriptor: " -+ "Too big sparing table size (%u)\n", -+ le32_to_cpu(spm->sizeSparingTable)); -+ return -EIO; -+ } - - for (i = 0; i < spm->numSparingTables; i++) { - loc = le32_to_cpu(spm->locSparingTable[i]); -diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c -index 919b6544b61a3..bda5248fc6498 100644 ---- a/fs/xfs/xfs_rtalloc.c -+++ b/fs/xfs/xfs_rtalloc.c -@@ -256,6 +256,9 @@ xfs_rtallocate_extent_block( - end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1; - i <= end; - i++) { -+ /* Make sure we don't scan off the end of the rt volume. */ -+ maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i; -+ - /* - * See if there's a free extent of maxlen starting at i. - * If it's not so then next will contain the first non-free. -@@ -447,6 +450,14 @@ xfs_rtallocate_extent_near( - */ - if (bno >= mp->m_sb.sb_rextents) - bno = mp->m_sb.sb_rextents - 1; -+ -+ /* Make sure we don't run off the end of the rt volume. */ -+ maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno; -+ if (maxlen < minlen) { -+ *rtblock = NULLRTBLOCK; -+ return 0; -+ } -+ - /* - * Try the exact allocation first. - */ -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index e5d349d65ae93..7cabe0cc86651 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -241,23 +241,21 @@ void __read_once_size(const volatile void *p, void *res, int size) - - #ifdef CONFIG_KASAN - /* -- * This function is not 'inline' because __no_sanitize_address confilcts -+ * We can't declare function 'inline' because __no_sanitize_address confilcts - * with inlining. Attempt to inline it may cause a build failure. - * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368 - * '__maybe_unused' allows us to avoid defined-but-not-used warnings. - */ --static __no_sanitize_address __maybe_unused --void __read_once_size_nocheck(const volatile void *p, void *res, int size) --{ -- __READ_ONCE_SIZE; --} -+# define __no_kasan_or_inline __no_sanitize_address __maybe_unused - #else --static __always_inline -+# define __no_kasan_or_inline __always_inline -+#endif -+ -+static __no_kasan_or_inline - void __read_once_size_nocheck(const volatile void *p, void *res, int size) - { - __READ_ONCE_SIZE; - } --#endif - - static __always_inline void __write_once_size(volatile void *p, void *res, int size) - { -@@ -294,6 +292,7 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s - * with an explicit memory barrier or atomic instruction that provides the - * required ordering. - */ -+#include - - #define __READ_ONCE(x, check) \ - ({ \ -@@ -312,6 +311,13 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s - */ - #define READ_ONCE_NOCHECK(x) __READ_ONCE(x, 0) - -+static __no_kasan_or_inline -+unsigned long read_word_at_a_time(const void *addr) -+{ -+ kasan_check_read(addr, 1); -+ return *(unsigned long *)addr; -+} -+ - #define WRITE_ONCE(x, val) \ - ({ \ - union { typeof(x) __val; char __c[1]; } __u = \ -diff --git a/include/linux/kasan-checks.h b/include/linux/kasan-checks.h -new file mode 100644 -index 0000000000000..b7f8aced78707 ---- /dev/null -+++ b/include/linux/kasan-checks.h -@@ -0,0 +1,12 @@ -+#ifndef _LINUX_KASAN_CHECKS_H -+#define _LINUX_KASAN_CHECKS_H -+ -+#ifdef CONFIG_KASAN -+void kasan_check_read(const void *p, unsigned int size); -+void kasan_check_write(const void *p, unsigned int size); -+#else -+static inline void kasan_check_read(const void *p, unsigned int size) { } -+static inline void kasan_check_write(const void *p, unsigned int size) { } -+#endif -+ -+#endif -diff --git a/include/net/ip.h b/include/net/ip.h -index 6067b7a10ccd2..5c9de851a9191 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -317,12 +317,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, - bool forwarding) - { - struct net *net = dev_net(dst->dev); -+ unsigned int mtu; - - if (net->ipv4.sysctl_ip_fwd_use_pmtu || - ip_mtu_locked(dst) || - !forwarding) - return dst_mtu(dst); - -+ /* 'forwarding = true' case should always honour route mtu */ -+ mtu = dst_metric_raw(dst, RTAX_MTU); -+ if (mtu) -+ return mtu; -+ - return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); - } - -diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h -index 11571b2a831e3..92ba09200f89b 100644 ---- a/include/scsi/scsi_common.h -+++ b/include/scsi/scsi_common.h -@@ -24,6 +24,13 @@ scsi_command_size(const unsigned char *cmnd) - scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]); - } - -+static inline unsigned char -+scsi_command_control(const unsigned char *cmnd) -+{ -+ return (cmnd[0] == VARIABLE_LENGTH_CMD) ? -+ cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1]; -+} -+ - /* Returns a human-readable name for the device */ - extern const char *scsi_device_type(unsigned type); - -diff --git a/include/trace/events/target.h b/include/trace/events/target.h -index 50fea660c0f89..d543e8b87e50a 100644 ---- a/include/trace/events/target.h -+++ b/include/trace/events/target.h -@@ -139,6 +139,7 @@ TRACE_EVENT(target_sequencer_start, - __field( unsigned int, opcode ) - __field( unsigned int, data_length ) - __field( unsigned int, task_attribute ) -+ __field( unsigned char, control ) - __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) - __string( initiator, cmd->se_sess->se_node_acl->initiatorname ) - ), -@@ -148,6 +149,7 @@ TRACE_EVENT(target_sequencer_start, - __entry->opcode = cmd->t_task_cdb[0]; - __entry->data_length = cmd->data_length; - __entry->task_attribute = cmd->sam_task_attr; -+ __entry->control = scsi_command_control(cmd->t_task_cdb); - memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE); - __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname); - ), -@@ -157,9 +159,7 @@ TRACE_EVENT(target_sequencer_start, - show_opcode_name(__entry->opcode), - __entry->data_length, __print_hex(__entry->cdb, 16), - show_task_attribute_name(__entry->task_attribute), -- scsi_command_size(__entry->cdb) <= 16 ? -- __entry->cdb[scsi_command_size(__entry->cdb) - 1] : -- __entry->cdb[1] -+ __entry->control - ) - ); - -@@ -174,6 +174,7 @@ TRACE_EVENT(target_cmd_complete, - __field( unsigned int, opcode ) - __field( unsigned int, data_length ) - __field( unsigned int, task_attribute ) -+ __field( unsigned char, control ) - __field( unsigned char, scsi_status ) - __field( unsigned char, sense_length ) - __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) -@@ -186,6 +187,7 @@ TRACE_EVENT(target_cmd_complete, - __entry->opcode = cmd->t_task_cdb[0]; - __entry->data_length = cmd->data_length; - __entry->task_attribute = cmd->sam_task_attr; -+ __entry->control = scsi_command_control(cmd->t_task_cdb); - __entry->scsi_status = cmd->scsi_status; - __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ? - min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0; -@@ -202,9 +204,7 @@ TRACE_EVENT(target_cmd_complete, - show_opcode_name(__entry->opcode), - __entry->data_length, __print_hex(__entry->cdb, 16), - show_task_attribute_name(__entry->task_attribute), -- scsi_command_size(__entry->cdb) <= 16 ? -- __entry->cdb[scsi_command_size(__entry->cdb) - 1] : -- __entry->cdb[1] -+ __entry->control - ) - ); - -diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c -index cc892a9e109d8..ae39b014b7d6c 100644 ---- a/kernel/debug/kdb/kdb_io.c -+++ b/kernel/debug/kdb/kdb_io.c -@@ -683,12 +683,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap) - size_avail = sizeof(kdb_buffer) - len; - goto kdb_print_out; - } -- if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) -+ if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) { - /* - * This was a interactive search (using '/' at more -- * prompt) and it has completed. Clear the flag. -+ * prompt) and it has completed. Replace the \0 with -+ * its original value to ensure multi-line strings -+ * are handled properly, and return to normal mode. - */ -+ *cphold = replaced_byte; - kdb_grepping_flag = 0; -+ } - /* - * at this point the string is a full line and - * should be printed, up to the null. -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 3124cebaec31e..7d73b30c55ccd 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -779,17 +779,6 @@ static int software_resume(void) - - /* Check if the device is there */ - swsusp_resume_device = name_to_dev_t(resume_file); -- -- /* -- * name_to_dev_t is ineffective to verify parition if resume_file is in -- * integer format. (e.g. major:minor) -- */ -- if (isdigit(resume_file[0]) && resume_wait) { -- int partno; -- while (!get_gendisk(swsusp_resume_device, &partno)) -- msleep(10); -- } -- - if (!swsusp_resume_device) { - /* - * Some device discovery might still be in progress; we need -diff --git a/lib/crc32.c b/lib/crc32.c -index 9a907d489d951..eed675bcd6751 100644 ---- a/lib/crc32.c -+++ b/lib/crc32.c -@@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p, - return crc; - } - --#if CRC_LE_BITS == 1 -+#if CRC_BE_BITS == 1 - u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len) - { - return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE); -diff --git a/lib/string.c b/lib/string.c -index c9983dc01e727..7f4baad6fb193 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -202,7 +202,7 @@ ssize_t strscpy(char *dest, const char *src, size_t count) - while (max >= sizeof(unsigned long)) { - unsigned long c, data; - -- c = *(unsigned long *)(src+res); -+ c = read_word_at_a_time(src+res); - if (has_zero(c, &data, &constants)) { - data = prep_zero_mask(c, data, &constants); - data = create_zero_mask(data); -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index e562385d9440e..30731ce390ba0 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1330,8 +1330,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) - - parent = bt_sk(sk)->parent; - -- sock_set_flag(sk, SOCK_ZAPPED); -- - switch (chan->state) { - case BT_OPEN: - case BT_BOUND: -@@ -1358,8 +1356,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) - - break; - } -- - release_sock(sk); -+ -+ /* Only zap after cleanup to avoid use after free race */ -+ sock_set_flag(sk, SOCK_ZAPPED); -+ - } - - static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index 9a9f49b55abd7..c16c199d9cd99 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -246,7 +246,7 @@ static struct { - /** - * icmp_global_allow - Are we allowed to send one more ICMP message ? - * -- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec. -+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec. - * Returns false if we reached the limit and can not send another packet. - * Note: called with BH disabled - */ -@@ -274,7 +274,10 @@ bool icmp_global_allow(void) - } - credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); - if (credit) { -- credit--; -+ /* We want to use a credit of one in average, but need to randomize -+ * it for security reasons. -+ */ -+ credit = max_t(int, credit - prandom_u32_max(3), 0); - rc = true; - } - WRITE_ONCE(icmp_global.credit, credit); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 9215ee1de4947..0919183b003fc 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -5531,6 +5531,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb, - tcp_data_snd_check(sk); - if (!inet_csk_ack_scheduled(sk)) - goto no_ack; -+ } else { -+ tcp_update_wl(tp, TCP_SKB_CB(skb)->seq); - } - - __tcp_ack_snd_check(sk, 0); -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index b176f76dfaa14..c7ee962a547b9 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -2383,6 +2383,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) - /* Set timeout values for (tcp tcpfin udp) */ - ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); - goto out_unlock; -+ } else if (!len) { -+ /* No more commands with len == 0 below */ -+ ret = -EINVAL; -+ goto out_unlock; - } - - usvc_compat = (struct ip_vs_service_user *)arg; -@@ -2459,9 +2463,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) - break; - case IP_VS_SO_SET_DELDEST: - ret = ip_vs_del_dest(svc, &udest); -- break; -- default: -- ret = -EINVAL; - } - - out_unlock: -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index c9d5e9c621784..639e5cad0442c 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -1190,7 +1190,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) - u32 idx; - char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; - -- if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) -+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME]) - return -EINVAL; - - idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); -diff --git a/net/tipc/msg.c b/net/tipc/msg.c -index fc1aa8bcb185d..30c3a7985fa4d 100644 ---- a/net/tipc/msg.c -+++ b/net/tipc/msg.c -@@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) - if (fragid == FIRST_FRAGMENT) { - if (unlikely(head)) - goto err; -- frag = skb_unshare(frag, GFP_ATOMIC); -+ if (skb_cloned(frag)) -+ frag = skb_copy(frag, GFP_ATOMIC); - if (unlikely(!frag)) - goto err; - head = *headbuf = frag; -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 95366e35ab134..7748d674677c9 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -1672,7 +1672,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, - * case we'll continue with more data in the next round, - * but break unconditionally so unsplit data stops here. - */ -- state->split_start++; -+ if (state->split) -+ state->split_start++; -+ else -+ state->split_start = 0; - break; - case 9: - if (rdev->wiphy.extended_capabilities && -diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c -index 5c87baaefafb6..0c0df76170aef 100644 ---- a/security/integrity/ima/ima_crypto.c -+++ b/security/integrity/ima/ima_crypto.c -@@ -555,6 +555,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, - ima_pcrread(i, pcr_i); - /* now accumulate with current aggregate */ - rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); -+ if (rc != 0) -+ return rc; - } - if (!rc) - crypto_shash_final(shash, digest); -diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c -index 8044775999eda..4d1548b951c41 100644 ---- a/sound/core/seq/oss/seq_oss.c -+++ b/sound/core/seq/oss/seq_oss.c -@@ -186,9 +186,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - if (snd_BUG_ON(!dp)) - return -ENXIO; - -- mutex_lock(®ister_mutex); -+ if (cmd != SNDCTL_SEQ_SYNC && -+ mutex_lock_interruptible(®ister_mutex)) -+ return -ERESTARTSYS; - rc = snd_seq_oss_ioctl(dp, cmd, arg); -- mutex_unlock(®ister_mutex); -+ if (cmd != SNDCTL_SEQ_SYNC) -+ mutex_unlock(®ister_mutex); - return rc; - } - -diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c -index ce731f4d8b4f5..733ba42e24622 100644 ---- a/sound/firewire/bebob/bebob_hwdep.c -+++ b/sound/firewire/bebob/bebob_hwdep.c -@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, - } - - memset(&event, 0, sizeof(event)); -+ count = min_t(long, count, sizeof(event.lock_status)); - if (bebob->dev_lock_changed) { - event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; - event.lock_status.status = (bebob->dev_lock_count > 0); - bebob->dev_lock_changed = false; -- -- count = min_t(long, count, sizeof(event.lock_status)); - } - - spin_unlock_irq(&bebob->lock); -diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c -index c8f2d084a8ce3..be5a7c1b36ff3 100644 ---- a/tools/perf/util/intel-pt.c -+++ b/tools/perf/util/intel-pt.c -@@ -794,6 +794,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt, - - if (queue->tid == -1 || pt->have_sched_switch) { - ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu); -+ if (ptq->tid == -1) -+ ptq->pid = -1; - thread__zput(ptq->thread); - } - -@@ -1634,10 +1636,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event, - tid = sample->tid; - } - -- if (tid == -1) { -- pr_err("context_switch event has no tid\n"); -- return -EINVAL; -- } -+ if (tid == -1) -+ intel_pt_log("context_switch event has no tid\n"); - - intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n", - cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time, diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.241-242.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.241-242.patch deleted file mode 100644 index 476d862f3f..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.241-242.patch +++ /dev/null @@ -1,2641 +0,0 @@ -diff --git a/Makefile b/Makefile -index f475808037540..0ba3fd9144264 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 241 -+SUBLEVEL = 242 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index 5e3f1edf5a292..db1eee5fe5024 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -168,6 +168,7 @@ END(EV_Extension) - tracesys: - ; save EFA in case tracer wants the PC of traced task - ; using ERET won't work since next-PC has already committed -+ lr r12, [efa] - GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 - st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address - -@@ -210,9 +211,15 @@ tracesys_exit: - ; Breakpoint TRAP - ; --------------------------------------------- - trap_with_param: -- mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc -+ -+ ; stop_pc info by gdb needs this info -+ lr r0, [efa] - mov r1, sp - -+ ; Now that we have read EFA, it is safe to do "fake" rtie -+ ; and get out of CPU exception mode -+ FAKE_RET_FROM_EXCPN -+ - ; Save callee regs in case gdb wants to have a look - ; SP will grow up by size of CALLEE Reg-File - ; NOTE: clobbers r12 -@@ -239,10 +246,6 @@ ENTRY(EV_Trap) - - EXCEPTION_PROLOGUE - -- lr r12, [efa] -- -- FAKE_RET_FROM_EXCPN -- - ;============ TRAP 1 :breakpoints - ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) - bmsk.f 0, r9, 7 -@@ -250,6 +253,9 @@ ENTRY(EV_Trap) - - ;============ TRAP (no param): syscall top level - -+ ; First return from Exception to pure K mode (Exception/IRQs renabled) -+ FAKE_RET_FROM_EXCPN -+ - ; If syscall tracing ongoing, invoke pre-post-hooks - GET_CURR_THR_INFO_FLAGS r10 - btst r10, TIF_SYSCALL_TRACE -diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c -index 11b50959f20ed..5401e2bab3da2 100644 ---- a/arch/arc/kernel/stacktrace.c -+++ b/arch/arc/kernel/stacktrace.c -@@ -113,7 +113,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs, - int (*consumer_fn) (unsigned int, void *), void *arg) - { - #ifdef CONFIG_ARC_DW2_UNWIND -- int ret = 0; -+ int ret = 0, cnt = 0; - unsigned int address; - struct unwind_frame_info frame_info; - -@@ -133,6 +133,11 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs, - break; - - frame_info.regs.r63 = frame_info.regs.r31; -+ -+ if (cnt++ > 128) { -+ printk("unwinder looping too long, aborting !\n"); -+ return 0; -+ } - } - - return address; /* return the last address it saw */ -diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index 45f2a5930379a..7da18cc30d101 100644 ---- a/arch/arm/Kconfig -+++ b/arch/arm/Kconfig -@@ -676,7 +676,9 @@ config ARCH_S3C24XX - select HAVE_S3C_RTC if RTC_CLASS - select MULTI_IRQ_HANDLER - select NEED_MACH_IO_H -+ select S3C2410_WATCHDOG - select SAMSUNG_ATAGS -+ select WATCHDOG - help - Samsung S3C2410, S3C2412, S3C2413, S3C2416, S3C2440, S3C2442, S3C2443 - and S3C2450 SoCs based systems, such as the Simtec Electronics BAST -diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi -index b03fe747b98ca..48bcab25720a5 100644 ---- a/arch/arm/boot/dts/s5pv210.dtsi -+++ b/arch/arm/boot/dts/s5pv210.dtsi -@@ -99,19 +99,16 @@ - }; - - clocks: clock-controller@e0100000 { -- compatible = "samsung,s5pv210-clock", "simple-bus"; -+ compatible = "samsung,s5pv210-clock"; - reg = <0xe0100000 0x10000>; - clock-names = "xxti", "xusbxti"; - clocks = <&xxti>, <&xusbxti>; - #clock-cells = <1>; -- #address-cells = <1>; -- #size-cells = <1>; -- ranges; -+ }; - -- pmu_syscon: syscon@e0108000 { -- compatible = "samsung-s5pv210-pmu", "syscon"; -- reg = <0xe0108000 0x8000>; -- }; -+ pmu_syscon: syscon@e0108000 { -+ compatible = "samsung-s5pv210-pmu", "syscon"; -+ reg = <0xe0108000 0x8000>; - }; - - pinctrl0: pinctrl@e0200000 { -@@ -228,43 +225,36 @@ - status = "disabled"; - }; - -- audio-subsystem { -- compatible = "samsung,s5pv210-audss", "simple-bus"; -- #address-cells = <1>; -- #size-cells = <1>; -- ranges; -- -- clk_audss: clock-controller@eee10000 { -- compatible = "samsung,s5pv210-audss-clock"; -- reg = <0xeee10000 0x1000>; -- clock-names = "hclk", "xxti", -- "fout_epll", -- "sclk_audio0"; -- clocks = <&clocks DOUT_HCLKP>, <&xxti>, -- <&clocks FOUT_EPLL>, -- <&clocks SCLK_AUDIO0>; -- #clock-cells = <1>; -- }; -+ clk_audss: clock-controller@eee10000 { -+ compatible = "samsung,s5pv210-audss-clock"; -+ reg = <0xeee10000 0x1000>; -+ clock-names = "hclk", "xxti", -+ "fout_epll", -+ "sclk_audio0"; -+ clocks = <&clocks DOUT_HCLKP>, <&xxti>, -+ <&clocks FOUT_EPLL>, -+ <&clocks SCLK_AUDIO0>; -+ #clock-cells = <1>; -+ }; - -- i2s0: i2s@eee30000 { -- compatible = "samsung,s5pv210-i2s"; -- reg = <0xeee30000 0x1000>; -- interrupt-parent = <&vic2>; -- interrupts = <16>; -- dma-names = "rx", "tx", "tx-sec"; -- dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; -- clock-names = "iis", -- "i2s_opclk0", -- "i2s_opclk1"; -- clocks = <&clk_audss CLK_I2S>, -- <&clk_audss CLK_I2S>, -- <&clk_audss CLK_DOUT_AUD_BUS>; -- samsung,idma-addr = <0xc0010000>; -- pinctrl-names = "default"; -- pinctrl-0 = <&i2s0_bus>; -- #sound-dai-cells = <0>; -- status = "disabled"; -- }; -+ i2s0: i2s@eee30000 { -+ compatible = "samsung,s5pv210-i2s"; -+ reg = <0xeee30000 0x1000>; -+ interrupt-parent = <&vic2>; -+ interrupts = <16>; -+ dma-names = "rx", "tx", "tx-sec"; -+ dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; -+ clock-names = "iis", -+ "i2s_opclk0", -+ "i2s_opclk1"; -+ clocks = <&clk_audss CLK_I2S>, -+ <&clk_audss CLK_I2S>, -+ <&clk_audss CLK_DOUT_AUD_BUS>; -+ samsung,idma-addr = <0xc0010000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2s0_bus>; -+ #sound-dai-cells = <0>; -+ status = "disabled"; - }; - - i2s1: i2s@e2100000 { -diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi -index aa90f319309ba..b8bbc8c187994 100644 ---- a/arch/arm/boot/dts/sun4i-a10.dtsi -+++ b/arch/arm/boot/dts/sun4i-a10.dtsi -@@ -137,7 +137,7 @@ - trips { - cpu_alert0: cpu_alert0 { - /* milliCelsius */ -- temperature = <850000>; -+ temperature = <85000>; - hysteresis = <2000>; - type = "passive"; - }; -diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig -index b9396dcf836d2..ffdf9f2ca437b 100644 ---- a/arch/arm/plat-samsung/Kconfig -+++ b/arch/arm/plat-samsung/Kconfig -@@ -239,6 +239,7 @@ config SAMSUNG_PM_DEBUG - bool "Samsung PM Suspend debug" - depends on PM && DEBUG_KERNEL - depends on DEBUG_EXYNOS_UART || DEBUG_S3C24XX_UART || DEBUG_S3C2410_UART -+ depends on DEBUG_LL && MMU - help - Say Y here if you want verbose debugging from the PM Suspend and - Resume code. See -diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms -index 5edb50772c11b..5fef6284a0bcb 100644 ---- a/arch/arm64/Kconfig.platforms -+++ b/arch/arm64/Kconfig.platforms -@@ -9,6 +9,7 @@ config ARCH_BERLIN - bool "Marvell Berlin SoC Family" - select ARCH_REQUIRE_GPIOLIB - select DW_APB_ICTL -+ select DW_APB_TIMER_OF - help - This enables support for Marvell Berlin SoC Family - -diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile -index 9edda5466020d..bcd3668f1bb82 100644 ---- a/arch/ia64/kernel/Makefile -+++ b/arch/ia64/kernel/Makefile -@@ -42,7 +42,7 @@ endif - obj-$(CONFIG_INTEL_IOMMU) += pci-dma.o - obj-$(CONFIG_SWIOTLB) += pci-swiotlb.o - --obj-$(CONFIG_BINFMT_ELF) += elfcore.o -+obj-$(CONFIG_ELF_CORE) += elfcore.o - - # fp_emulate() expects f2-f5,f16-f31 to contain the user-level state. - CFLAGS_traps.o += -mfixed-range=f2-f5,f16-f31 -diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c -index e21e2c0af69d2..1a8b6e276a112 100644 ---- a/arch/powerpc/platforms/powernv/opal-dump.c -+++ b/arch/powerpc/platforms/powernv/opal-dump.c -@@ -385,13 +385,12 @@ static irqreturn_t process_dump(int irq, void *data) - { - int rc; - uint32_t dump_id, dump_size, dump_type; -- struct dump_obj *dump; - char name[22]; - struct kobject *kobj; - - rc = dump_read_info(&dump_id, &dump_size, &dump_type); - if (rc != OPAL_SUCCESS) -- return rc; -+ return IRQ_HANDLED; - - sprintf(name, "0x%x-0x%x", dump_type, dump_id); - -@@ -403,12 +402,10 @@ static irqreturn_t process_dump(int irq, void *data) - if (kobj) { - /* Drop reference added by kset_find_obj() */ - kobject_put(kobj); -- return 0; -+ return IRQ_HANDLED; - } - -- dump = create_dump_obj(dump_id, dump_size, dump_type); -- if (!dump) -- return -1; -+ create_dump_obj(dump_id, dump_size, dump_type); - - return IRQ_HANDLED; - } -diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c -index f2344cbd2f464..3595f3cfefa35 100644 ---- a/arch/powerpc/platforms/powernv/opal-elog.c -+++ b/arch/powerpc/platforms/powernv/opal-elog.c -@@ -183,14 +183,14 @@ static ssize_t raw_attr_read(struct file *filep, struct kobject *kobj, - return count; - } - --static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type) -+static void create_elog_obj(uint64_t id, size_t size, uint64_t type) - { - struct elog_obj *elog; - int rc; - - elog = kzalloc(sizeof(*elog), GFP_KERNEL); - if (!elog) -- return NULL; -+ return; - - elog->kobj.kset = elog_kset; - -@@ -223,18 +223,37 @@ static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type) - rc = kobject_add(&elog->kobj, NULL, "0x%llx", id); - if (rc) { - kobject_put(&elog->kobj); -- return NULL; -+ return; - } - -+ /* -+ * As soon as the sysfs file for this elog is created/activated there is -+ * a chance the opal_errd daemon (or any userspace) might read and -+ * acknowledge the elog before kobject_uevent() is called. If that -+ * happens then there is a potential race between -+ * elog_ack_store->kobject_put() and kobject_uevent() which leads to a -+ * use-after-free of a kernfs object resulting in a kernel crash. -+ * -+ * To avoid that, we need to take a reference on behalf of the bin file, -+ * so that our reference remains valid while we call kobject_uevent(). -+ * We then drop our reference before exiting the function, leaving the -+ * bin file to drop the last reference (if it hasn't already). -+ */ -+ -+ /* Take a reference for the bin file */ -+ kobject_get(&elog->kobj); - rc = sysfs_create_bin_file(&elog->kobj, &elog->raw_attr); -- if (rc) { -+ if (rc == 0) { -+ kobject_uevent(&elog->kobj, KOBJ_ADD); -+ } else { -+ /* Drop the reference taken for the bin file */ - kobject_put(&elog->kobj); -- return NULL; - } - -- kobject_uevent(&elog->kobj, KOBJ_ADD); -+ /* Drop our reference */ -+ kobject_put(&elog->kobj); - -- return elog; -+ return; - } - - static irqreturn_t elog_event(int irq, void *data) -diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c -index ad7b1a3dbed09..c605c78a80896 100644 ---- a/arch/powerpc/platforms/powernv/smp.c -+++ b/arch/powerpc/platforms/powernv/smp.c -@@ -41,7 +41,7 @@ - #include - #define DBG(fmt...) udbg_printf(fmt) - #else --#define DBG(fmt...) -+#define DBG(fmt...) do { } while (0) - #endif - - static void pnv_smp_setup_cpu(int cpu) -diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index 46866b2097e81..bd27e86ce36db 100644 ---- a/arch/sparc/kernel/smp_64.c -+++ b/arch/sparc/kernel/smp_64.c -@@ -1030,38 +1030,9 @@ void smp_fetch_global_pmu(void) - * are flush_tlb_*() routines, and these run after flush_cache_*() - * which performs the flushw. - * -- * The SMP TLB coherency scheme we use works as follows: -- * -- * 1) mm->cpu_vm_mask is a bit mask of which cpus an address -- * space has (potentially) executed on, this is the heuristic -- * we use to avoid doing cross calls. -- * -- * Also, for flushing from kswapd and also for clones, we -- * use cpu_vm_mask as the list of cpus to make run the TLB. -- * -- * 2) TLB context numbers are shared globally across all processors -- * in the system, this allows us to play several games to avoid -- * cross calls. -- * -- * One invariant is that when a cpu switches to a process, and -- * that processes tsk->active_mm->cpu_vm_mask does not have the -- * current cpu's bit set, that tlb context is flushed locally. -- * -- * If the address space is non-shared (ie. mm->count == 1) we avoid -- * cross calls when we want to flush the currently running process's -- * tlb state. This is done by clearing all cpu bits except the current -- * processor's in current->mm->cpu_vm_mask and performing the -- * flush locally only. This will force any subsequent cpus which run -- * this task to flush the context from the local tlb if the process -- * migrates to another cpu (again). -- * -- * 3) For shared address spaces (threads) and swapping we bite the -- * bullet for most cases and perform the cross call (but only to -- * the cpus listed in cpu_vm_mask). -- * -- * The performance gain from "optimizing" away the cross call for threads is -- * questionable (in theory the big win for threads is the massive sharing of -- * address space state across processors). -+ * mm->cpu_vm_mask is a bit mask of which cpus an address -+ * space has (potentially) executed on, this is the heuristic -+ * we use to limit cross calls. - */ - - /* This currently is only used by the hugetlb arch pre-fault -@@ -1071,18 +1042,13 @@ void smp_fetch_global_pmu(void) - void smp_flush_tlb_mm(struct mm_struct *mm) - { - u32 ctx = CTX_HWBITS(mm->context); -- int cpu = get_cpu(); - -- if (atomic_read(&mm->mm_users) == 1) { -- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu)); -- goto local_flush_and_out; -- } -+ get_cpu(); - - smp_cross_call_masked(&xcall_flush_tlb_mm, - ctx, 0, 0, - mm_cpumask(mm)); - --local_flush_and_out: - __flush_tlb_mm(ctx, SECONDARY_CONTEXT); - - put_cpu(); -@@ -1105,17 +1071,15 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long - { - u32 ctx = CTX_HWBITS(mm->context); - struct tlb_pending_info info; -- int cpu = get_cpu(); -+ -+ get_cpu(); - - info.ctx = ctx; - info.nr = nr; - info.vaddrs = vaddrs; - -- if (mm == current->mm && atomic_read(&mm->mm_users) == 1) -- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu)); -- else -- smp_call_function_many(mm_cpumask(mm), tlb_pending_func, -- &info, 1); -+ smp_call_function_many(mm_cpumask(mm), tlb_pending_func, -+ &info, 1); - - __flush_tlb_pending(ctx, nr, vaddrs); - -@@ -1125,14 +1089,13 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long - void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr) - { - unsigned long context = CTX_HWBITS(mm->context); -- int cpu = get_cpu(); - -- if (mm == current->mm && atomic_read(&mm->mm_users) == 1) -- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu)); -- else -- smp_cross_call_masked(&xcall_flush_tlb_page, -- context, vaddr, 0, -- mm_cpumask(mm)); -+ get_cpu(); -+ -+ smp_cross_call_masked(&xcall_flush_tlb_page, -+ context, vaddr, 0, -+ mm_cpumask(mm)); -+ - __flush_tlb_page(context, vaddr); - - put_cpu(); -diff --git a/arch/um/kernel/sigio.c b/arch/um/kernel/sigio.c -index b5e0cbb343828..476ded92affac 100644 ---- a/arch/um/kernel/sigio.c -+++ b/arch/um/kernel/sigio.c -@@ -36,14 +36,14 @@ int write_sigio_irq(int fd) - } - - /* These are called from os-Linux/sigio.c to protect its pollfds arrays. */ --static DEFINE_SPINLOCK(sigio_spinlock); -+static DEFINE_MUTEX(sigio_mutex); - - void sigio_lock(void) - { -- spin_lock(&sigio_spinlock); -+ mutex_lock(&sigio_mutex); - } - - void sigio_unlock(void) - { -- spin_unlock(&sigio_spinlock); -+ mutex_unlock(&sigio_mutex); - } -diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index 0bf17576dd2af..299e7fb55f16e 100644 ---- a/arch/x86/kernel/kexec-bzimage64.c -+++ b/arch/x86/kernel/kexec-bzimage64.c -@@ -212,8 +212,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, - params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch; - - /* Copying screen_info will do? */ -- memcpy(¶ms->screen_info, &boot_params.screen_info, -- sizeof(struct screen_info)); -+ memcpy(¶ms->screen_info, &screen_info, sizeof(struct screen_info)); - - /* Fill in memsize later */ - params->screen_info.ext_mem_k = 0; -diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c -index b3842ffc19ba2..46d201fc7ecc7 100644 ---- a/drivers/acpi/acpi_extlog.c -+++ b/drivers/acpi/acpi_extlog.c -@@ -223,9 +223,9 @@ static int __init extlog_init(void) - u64 cap; - int rc; - -- rdmsrl(MSR_IA32_MCG_CAP, cap); -- -- if (!(cap & MCG_ELOG_P) || !extlog_get_l1addr()) -+ if (rdmsrl_safe(MSR_IA32_MCG_CAP, &cap) || -+ !(cap & MCG_ELOG_P) || -+ !extlog_get_l1addr()) - return -ENODEV; - - if (get_edac_report_status() == EDAC_REPORTING_FORCE) { -diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c -index 0936b68eff800..df3df21852fe2 100644 ---- a/drivers/acpi/video_detect.c -+++ b/drivers/acpi/video_detect.c -@@ -251,6 +251,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"), - }, - }, -+ /* https://bugs.launchpad.net/bugs/1894667 */ -+ { -+ .callback = video_detect_force_video, -+ .ident = "HP 635 Notebook", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "HP 635 Notebook PC"), -+ }, -+ }, - - /* Non win8 machines which need native backlight nevertheless */ - { -diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c -index 4199f7a39be0b..3adfba441b436 100644 ---- a/drivers/ata/sata_rcar.c -+++ b/drivers/ata/sata_rcar.c -@@ -122,7 +122,7 @@ - /* Descriptor table word 0 bit (when DTA32M = 1) */ - #define SATA_RCAR_DTEND BIT(0) - --#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFEUL -+#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFFUL - - /* Gen2 Physical Layer Control Registers */ - #define RCAR_GEN2_PHY_CTL1_REG 0x1704 -diff --git a/drivers/base/core.c b/drivers/base/core.c -index ddc9dd971674c..92fa2bfa2925d 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -2344,6 +2344,7 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) - */ - void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) - { -+ struct device *parent = dev->parent; - struct fwnode_handle *fn = dev->fwnode; - - if (fwnode) { -@@ -2355,7 +2356,8 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) - } else { - if (fwnode_is_primary(fn)) { - dev->fwnode = fn->secondary; -- fn->secondary = NULL; -+ if (!(parent && fn == parent->fwnode)) -+ fn->secondary = ERR_PTR(-ENODEV); - } else { - dev->fwnode = NULL; - } -diff --git a/drivers/clk/ti/clockdomain.c b/drivers/clk/ti/clockdomain.c -index b9bc3b8df659d..4fde9767392e3 100644 ---- a/drivers/clk/ti/clockdomain.c -+++ b/drivers/clk/ti/clockdomain.c -@@ -124,10 +124,12 @@ static void __init of_ti_clockdomain_setup(struct device_node *node) - if (clk_hw_get_flags(clk_hw) & CLK_IS_BASIC) { - pr_warn("can't setup clkdm for basic clk %s\n", - __clk_get_name(clk)); -+ clk_put(clk); - continue; - } - to_clk_hw_omap(clk_hw)->clkdm_name = clkdm_name; - omap2_init_clk_clkdm(clk_hw); -+ clk_put(clk); - } - } - -diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c -index c2598381fbc80..9738244a18dda 100644 ---- a/drivers/cpufreq/acpi-cpufreq.c -+++ b/drivers/cpufreq/acpi-cpufreq.c -@@ -713,7 +713,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) - cpumask_copy(policy->cpus, topology_core_cpumask(cpu)); - } - -- if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) { -+ if (check_amd_hwpstate_cpu(cpu) && boot_cpu_data.x86 < 0x19 && -+ !acpi_pstate_strict) { - cpumask_clear(policy->cpus); - cpumask_set_cpu(cpu, policy->cpus); - cpumask_copy(data->freqdomain_cpus, -diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c -index 1d01e3805f9c2..f417fba9bf1c9 100644 ---- a/drivers/dma/dma-jz4780.c -+++ b/drivers/dma/dma-jz4780.c -@@ -563,11 +563,11 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, - enum dma_status status; - unsigned long flags; - -+ spin_lock_irqsave(&jzchan->vchan.lock, flags); -+ - status = dma_cookie_status(chan, cookie, txstate); - if ((status == DMA_COMPLETE) || (txstate == NULL)) -- return status; -- -- spin_lock_irqsave(&jzchan->vchan.lock, flags); -+ goto out_unlock_irqrestore; - - vdesc = vchan_find_desc(&jzchan->vchan, cookie); - if (vdesc) { -@@ -584,6 +584,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, - && jzchan->desc->status & (JZ_DMA_DCS_AR | JZ_DMA_DCS_HLT)) - status = DMA_ERROR; - -+out_unlock_irqrestore: - spin_unlock_irqrestore(&jzchan->vchan.lock, flags); - return status; - } -diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c -index eef50e91f17cf..e04483254b283 100644 ---- a/drivers/iio/gyro/itg3200_buffer.c -+++ b/drivers/iio/gyro/itg3200_buffer.c -@@ -49,13 +49,20 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p) - struct iio_poll_func *pf = p; - struct iio_dev *indio_dev = pf->indio_dev; - struct itg3200 *st = iio_priv(indio_dev); -- __be16 buf[ITG3200_SCAN_ELEMENTS + sizeof(s64)/sizeof(u16)]; -- -- int ret = itg3200_read_all_channels(st->i2c, buf); -+ /* -+ * Ensure correct alignment and padding including for the -+ * timestamp that may be inserted. -+ */ -+ struct { -+ __be16 buf[ITG3200_SCAN_ELEMENTS]; -+ s64 ts __aligned(8); -+ } scan; -+ -+ int ret = itg3200_read_all_channels(st->i2c, scan.buf); - if (ret < 0) - goto error_ret; - -- iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp); -+ iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp); - - iio_trigger_notify_done(indio_dev->trig); - -diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c -index 65605e4ef3cf6..1491a9a5c6b06 100644 ---- a/drivers/input/serio/hil_mlc.c -+++ b/drivers/input/serio/hil_mlc.c -@@ -74,7 +74,7 @@ EXPORT_SYMBOL(hil_mlc_unregister); - static LIST_HEAD(hil_mlcs); - static DEFINE_RWLOCK(hil_mlcs_lock); - static struct timer_list hil_mlcs_kicker; --static int hil_mlcs_probe; -+static int hil_mlcs_probe, hil_mlc_stop; - - static void hil_mlcs_process(unsigned long unused); - static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0); -@@ -704,9 +704,13 @@ static int hilse_donode(hil_mlc *mlc) - if (!mlc->ostarted) { - mlc->ostarted = 1; - mlc->opacket = pack; -- mlc->out(mlc); -+ rc = mlc->out(mlc); - nextidx = HILSEN_DOZE; - write_unlock_irqrestore(&mlc->lock, flags); -+ if (rc) { -+ hil_mlc_stop = 1; -+ return 1; -+ } - break; - } - mlc->ostarted = 0; -@@ -717,8 +721,13 @@ static int hilse_donode(hil_mlc *mlc) - - case HILSE_CTS: - write_lock_irqsave(&mlc->lock, flags); -- nextidx = mlc->cts(mlc) ? node->bad : node->good; -+ rc = mlc->cts(mlc); -+ nextidx = rc ? node->bad : node->good; - write_unlock_irqrestore(&mlc->lock, flags); -+ if (rc) { -+ hil_mlc_stop = 1; -+ return 1; -+ } - break; - - default: -@@ -786,6 +795,12 @@ static void hil_mlcs_process(unsigned long unused) - - static void hil_mlcs_timer(unsigned long data) - { -+ if (hil_mlc_stop) { -+ /* could not send packet - stop immediately. */ -+ pr_warn(PREFIX "HIL seems stuck - Disabling HIL MLC.\n"); -+ return; -+ } -+ - hil_mlcs_probe = 1; - tasklet_schedule(&hil_mlcs_tasklet); - /* Re-insert the periodic task. */ -diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c -index d50f0678bf47a..078cbe6522a2a 100644 ---- a/drivers/input/serio/hp_sdc_mlc.c -+++ b/drivers/input/serio/hp_sdc_mlc.c -@@ -213,7 +213,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc) - priv->tseq[2] = 1; - priv->tseq[3] = 0; - priv->tseq[4] = 0; -- __hp_sdc_enqueue_transaction(&priv->trans); -+ return __hp_sdc_enqueue_transaction(&priv->trans); - busy: - return 1; - done: -@@ -222,7 +222,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc) - return 0; - } - --static void hp_sdc_mlc_out(hil_mlc *mlc) -+static int hp_sdc_mlc_out(hil_mlc *mlc) - { - struct hp_sdc_mlc_priv_s *priv; - -@@ -237,7 +237,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc) - do_data: - if (priv->emtestmode) { - up(&mlc->osem); -- return; -+ return 0; - } - /* Shouldn't be sending commands when loop may be busy */ - BUG_ON(down_trylock(&mlc->csem)); -@@ -299,7 +299,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc) - BUG_ON(down_trylock(&mlc->csem)); - } - enqueue: -- hp_sdc_enqueue_transaction(&priv->trans); -+ return hp_sdc_enqueue_transaction(&priv->trans); - } - - static int __init hp_sdc_mlc_init(void) -diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c -index c7ea5c6263318..be728106baaef 100644 ---- a/drivers/leds/leds-bcm6328.c -+++ b/drivers/leds/leds-bcm6328.c -@@ -325,7 +325,7 @@ static int bcm6328_led(struct device *dev, struct device_node *nc, u32 reg, - led->cdev.brightness_set = bcm6328_led_set; - led->cdev.blink_set = bcm6328_blink_set; - -- rc = led_classdev_register(dev, &led->cdev); -+ rc = devm_led_classdev_register(dev, &led->cdev); - if (rc < 0) - return rc; - -diff --git a/drivers/leds/leds-bcm6358.c b/drivers/leds/leds-bcm6358.c -index 82b4ee1bc87e0..dae1fd097941d 100644 ---- a/drivers/leds/leds-bcm6358.c -+++ b/drivers/leds/leds-bcm6358.c -@@ -146,7 +146,7 @@ static int bcm6358_led(struct device *dev, struct device_node *nc, u32 reg, - - led->cdev.brightness_set = bcm6358_led_set; - -- rc = led_classdev_register(dev, &led->cdev); -+ rc = devm_led_classdev_register(dev, &led->cdev); - if (rc < 0) - return rc; - -diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 391090c455cea..65281f168c6fb 100644 ---- a/drivers/md/bitmap.c -+++ b/drivers/md/bitmap.c -@@ -1332,7 +1332,7 @@ __acquires(bitmap->lock) - if (bitmap->bp[page].hijacked || - bitmap->bp[page].map == NULL) - csize = ((sector_t)1) << (bitmap->chunkshift + -- PAGE_COUNTER_SHIFT - 1); -+ PAGE_COUNTER_SHIFT); - else - csize = ((sector_t)1) << bitmap->chunkshift; - *blocks = csize - (offset & (csize - 1)); -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 99cd843351c2b..24708dcf0bb43 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -2238,8 +2238,6 @@ static int resize_stripes(struct r5conf *conf, int newsize) - } else - err = -ENOMEM; - -- mutex_unlock(&conf->cache_size_mutex); -- - conf->slab_cache = sc; - conf->active_name = 1-conf->active_name; - -@@ -2262,6 +2260,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) - - if (!err) - conf->pool_size = newsize; -+ mutex_unlock(&conf->cache_size_mutex); -+ - return err; - } - -diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c -index 04644e7b42b12..88c32b8dc88a1 100644 ---- a/drivers/memory/emif.c -+++ b/drivers/memory/emif.c -@@ -165,35 +165,12 @@ static const struct file_operations emif_mr4_fops = { - - static int __init_or_module emif_debugfs_init(struct emif_data *emif) - { -- struct dentry *dentry; -- int ret; -- -- dentry = debugfs_create_dir(dev_name(emif->dev), NULL); -- if (!dentry) { -- ret = -ENOMEM; -- goto err0; -- } -- emif->debugfs_root = dentry; -- -- dentry = debugfs_create_file("regcache_dump", S_IRUGO, -- emif->debugfs_root, emif, &emif_regdump_fops); -- if (!dentry) { -- ret = -ENOMEM; -- goto err1; -- } -- -- dentry = debugfs_create_file("mr4", S_IRUGO, -- emif->debugfs_root, emif, &emif_mr4_fops); -- if (!dentry) { -- ret = -ENOMEM; -- goto err1; -- } -- -+ emif->debugfs_root = debugfs_create_dir(dev_name(emif->dev), NULL); -+ debugfs_create_file("regcache_dump", S_IRUGO, emif->debugfs_root, emif, -+ &emif_regdump_fops); -+ debugfs_create_file("mr4", S_IRUGO, emif->debugfs_root, emif, -+ &emif_mr4_fops); - return 0; --err1: -- debugfs_remove_recursive(emif->debugfs_root); --err0: -- return ret; - } - - static void __exit emif_debugfs_exit(struct emif_data *emif) -diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c -index e77185e143ab7..32083759b93d0 100644 ---- a/drivers/message/fusion/mptscsih.c -+++ b/drivers/message/fusion/mptscsih.c -@@ -1176,8 +1176,10 @@ mptscsih_remove(struct pci_dev *pdev) - - scsi_remove_host(host); - -- if((hd = shost_priv(host)) == NULL) -- return; -+ if (host == NULL) -+ hd = NULL; -+ else -+ hd = shost_priv(host); - - mptscsih_shutdown(pdev); - -@@ -1193,14 +1195,15 @@ mptscsih_remove(struct pci_dev *pdev) - "Free'd ScsiLookup (%d) memory\n", - ioc->name, sz1)); - -- kfree(hd->info_kbuf); -+ if (hd) -+ kfree(hd->info_kbuf); - - /* NULL the Scsi_Host pointer - */ - ioc->sh = NULL; - -- scsi_host_put(host); -- -+ if (host) -+ scsi_host_put(host); - mpt_detach(pdev); - - } -diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c -index 63fac78b3d46a..b455e9cf95afc 100644 ---- a/drivers/mmc/host/via-sdmmc.c -+++ b/drivers/mmc/host/via-sdmmc.c -@@ -1269,11 +1269,14 @@ static void via_init_sdc_pm(struct via_crdr_mmc_host *host) - static int via_sd_suspend(struct pci_dev *pcidev, pm_message_t state) - { - struct via_crdr_mmc_host *host; -+ unsigned long flags; - - host = pci_get_drvdata(pcidev); - -+ spin_lock_irqsave(&host->lock, flags); - via_save_pcictrlreg(host); - via_save_sdcreg(host); -+ spin_unlock_irqrestore(&host->lock, flags); - - pci_save_state(pcidev); - pci_enable_wake(pcidev, pci_choose_state(pcidev, state), 0); -diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c -index f4b3ce2b2bc3c..2ae0bc3d02f96 100644 ---- a/drivers/mtd/ubi/wl.c -+++ b/drivers/mtd/ubi/wl.c -@@ -1460,6 +1460,19 @@ int ubi_thread(void *u) - !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) { - set_current_state(TASK_INTERRUPTIBLE); - spin_unlock(&ubi->wl_lock); -+ -+ /* -+ * Check kthread_should_stop() after we set the task -+ * state to guarantee that we either see the stop bit -+ * and exit or the task state is reset to runnable such -+ * that it's not scheduled out indefinitely and detects -+ * the stop bit at kthread_should_stop(). -+ */ -+ if (kthread_should_stop()) { -+ set_current_state(TASK_RUNNING); -+ break; -+ } -+ - schedule(); - continue; - } -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 96310e2ee5458..bc00fa5e864f3 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -1385,7 +1385,7 @@ static int gfar_probe(struct platform_device *ofdev) - - if (dev->features & NETIF_F_IP_CSUM || - priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) -- dev->needed_headroom = GMAC_FCB_LEN; -+ dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN; - - /* Initializing some of the rx/tx queue level parameters */ - for (i = 0; i < priv->num_tx_queues; i++) { -@@ -2353,20 +2353,12 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev) - fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN; - - /* make space for additional header when fcb is needed */ -- if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) { -- struct sk_buff *skb_new; -- -- skb_new = skb_realloc_headroom(skb, fcb_len); -- if (!skb_new) { -+ if (fcb_len) { -+ if (unlikely(skb_cow_head(skb, fcb_len))) { - dev->stats.tx_errors++; - dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } -- -- if (skb->sk) -- skb_set_owner_w(skb_new, skb->sk); -- dev_consume_skb_any(skb); -- skb = skb_new; - } - - /* total number of fragments in the SKB */ -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 460b29ac5fd86..c6850287362b8 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1572,12 +1572,16 @@ static int ravb_hwtstamp_get(struct net_device *ndev, struct ifreq *req) - config.flags = 0; - config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON : - HWTSTAMP_TX_OFF; -- if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT) -+ switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) { -+ case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT: - config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; -- else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) -+ break; -+ case RAVB_RXTSTAMP_TYPE_ALL: - config.rx_filter = HWTSTAMP_FILTER_ALL; -- else -+ break; -+ default: - config.rx_filter = HWTSTAMP_FILTER_NONE; -+ } - - return copy_to_user(req->ifr_data, &config, sizeof(config)) ? - -EFAULT : 0; -diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c -index 74d46f7e77eaa..045158fab8fe6 100644 ---- a/drivers/net/wan/hdlc_fr.c -+++ b/drivers/net/wan/hdlc_fr.c -@@ -275,63 +275,69 @@ static inline struct net_device **get_dev_p(struct pvc_device *pvc, - - static int fr_hard_header(struct sk_buff **skb_p, u16 dlci) - { -- u16 head_len; - struct sk_buff *skb = *skb_p; - -- switch (skb->protocol) { -- case cpu_to_be16(NLPID_CCITT_ANSI_LMI): -- head_len = 4; -- skb_push(skb, head_len); -- skb->data[3] = NLPID_CCITT_ANSI_LMI; -- break; -- -- case cpu_to_be16(NLPID_CISCO_LMI): -- head_len = 4; -- skb_push(skb, head_len); -- skb->data[3] = NLPID_CISCO_LMI; -- break; -- -- case cpu_to_be16(ETH_P_IP): -- head_len = 4; -- skb_push(skb, head_len); -- skb->data[3] = NLPID_IP; -- break; -- -- case cpu_to_be16(ETH_P_IPV6): -- head_len = 4; -- skb_push(skb, head_len); -- skb->data[3] = NLPID_IPV6; -- break; -- -- case cpu_to_be16(ETH_P_802_3): -- head_len = 10; -- if (skb_headroom(skb) < head_len) { -- struct sk_buff *skb2 = skb_realloc_headroom(skb, -- head_len); -+ if (!skb->dev) { /* Control packets */ -+ switch (dlci) { -+ case LMI_CCITT_ANSI_DLCI: -+ skb_push(skb, 4); -+ skb->data[3] = NLPID_CCITT_ANSI_LMI; -+ break; -+ -+ case LMI_CISCO_DLCI: -+ skb_push(skb, 4); -+ skb->data[3] = NLPID_CISCO_LMI; -+ break; -+ -+ default: -+ return -EINVAL; -+ } -+ -+ } else if (skb->dev->type == ARPHRD_DLCI) { -+ switch (skb->protocol) { -+ case htons(ETH_P_IP): -+ skb_push(skb, 4); -+ skb->data[3] = NLPID_IP; -+ break; -+ -+ case htons(ETH_P_IPV6): -+ skb_push(skb, 4); -+ skb->data[3] = NLPID_IPV6; -+ break; -+ -+ default: -+ skb_push(skb, 10); -+ skb->data[3] = FR_PAD; -+ skb->data[4] = NLPID_SNAP; -+ /* OUI 00-00-00 indicates an Ethertype follows */ -+ skb->data[5] = 0x00; -+ skb->data[6] = 0x00; -+ skb->data[7] = 0x00; -+ /* This should be an Ethertype: */ -+ *(__be16 *)(skb->data + 8) = skb->protocol; -+ } -+ -+ } else if (skb->dev->type == ARPHRD_ETHER) { -+ if (skb_headroom(skb) < 10) { -+ struct sk_buff *skb2 = skb_realloc_headroom(skb, 10); - if (!skb2) - return -ENOBUFS; - dev_kfree_skb(skb); - skb = *skb_p = skb2; - } -- skb_push(skb, head_len); -+ skb_push(skb, 10); - skb->data[3] = FR_PAD; - skb->data[4] = NLPID_SNAP; -- skb->data[5] = FR_PAD; -+ /* OUI 00-80-C2 stands for the 802.1 organization */ -+ skb->data[5] = 0x00; - skb->data[6] = 0x80; - skb->data[7] = 0xC2; -+ /* PID 00-07 stands for Ethernet frames without FCS */ - skb->data[8] = 0x00; -- skb->data[9] = 0x07; /* bridged Ethernet frame w/out FCS */ -- break; -+ skb->data[9] = 0x07; - -- default: -- head_len = 10; -- skb_push(skb, head_len); -- skb->data[3] = FR_PAD; -- skb->data[4] = NLPID_SNAP; -- skb->data[5] = FR_PAD; -- skb->data[6] = FR_PAD; -- skb->data[7] = FR_PAD; -- *(__be16*)(skb->data + 8) = skb->protocol; -+ } else { -+ return -EINVAL; - } - - dlci_to_q922(skb->data, dlci); -@@ -427,8 +433,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) - skb_put(skb, pad); - memset(skb->data + len, 0, pad); - } -- skb->protocol = cpu_to_be16(ETH_P_802_3); - } -+ skb->dev = dev; - if (!fr_hard_header(&skb, pvc->dlci)) { - dev->stats.tx_bytes += skb->len; - dev->stats.tx_packets++; -@@ -496,10 +502,8 @@ static void fr_lmi_send(struct net_device *dev, int fullrep) - memset(skb->data, 0, len); - skb_reserve(skb, 4); - if (lmi == LMI_CISCO) { -- skb->protocol = cpu_to_be16(NLPID_CISCO_LMI); - fr_hard_header(&skb, LMI_CISCO_DLCI); - } else { -- skb->protocol = cpu_to_be16(NLPID_CCITT_ANSI_LMI); - fr_hard_header(&skb, LMI_CCITT_ANSI_DLCI); - } - data = skb_tail_pointer(skb); -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index 1c6c422dbad64..78079ce1ad5a4 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -665,6 +665,7 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar, - u8 preamble = 0; - u8 group_id; - u32 info1, info2, info3; -+ u32 stbc, nsts_su; - - info1 = __le32_to_cpu(rxd->ppdu_start.info1); - info2 = __le32_to_cpu(rxd->ppdu_start.info2); -@@ -708,11 +709,16 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar, - TODO check this */ - bw = info2 & 3; - sgi = info3 & 1; -+ stbc = (info2 >> 3) & 1; - group_id = (info2 >> 4) & 0x3F; - - if (GROUP_ID_IS_SU_MIMO(group_id)) { - mcs = (info3 >> 4) & 0x0F; -- nss = ((info2 >> 10) & 0x07) + 1; -+ nsts_su = ((info2 >> 10) & 0x07); -+ if (stbc) -+ nss = (nsts_su >> 2) + 1; -+ else -+ nss = (nsts_su + 1); - } else { - /* Hardware doesn't decode VHT-SIG-B into Rx descriptor - * so it's impossible to decode MCS. Also since -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index 07dd81586c52b..7ccf077c72a05 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -218,6 +218,16 @@ static int __init __rmem_cmp(const void *a, const void *b) - if (ra->base > rb->base) - return 1; - -+ /* -+ * Put the dynamic allocations (address == 0, size == 0) before static -+ * allocations at address 0x0 so that overlap detection works -+ * correctly. -+ */ -+ if (ra->size < rb->size) -+ return -1; -+ if (ra->size > rb->size) -+ return 1; -+ - return 0; - } - -@@ -235,8 +245,7 @@ static void __init __rmem_check_for_overlap(void) - - this = &reserved_mem[i]; - next = &reserved_mem[i + 1]; -- if (!(this->base && next->base)) -- continue; -+ - if (this->base + this->size > next->base) { - phys_addr_t this_end, next_end; - -diff --git a/drivers/power/test_power.c b/drivers/power/test_power.c -index 57246cdbd0426..925abec45380f 100644 ---- a/drivers/power/test_power.c -+++ b/drivers/power/test_power.c -@@ -344,6 +344,7 @@ static int param_set_ac_online(const char *key, const struct kernel_param *kp) - static int param_get_ac_online(char *buffer, const struct kernel_param *kp) - { - strcpy(buffer, map_get_key(map_ac_online, ac_online, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -@@ -357,6 +358,7 @@ static int param_set_usb_online(const char *key, const struct kernel_param *kp) - static int param_get_usb_online(char *buffer, const struct kernel_param *kp) - { - strcpy(buffer, map_get_key(map_ac_online, usb_online, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -@@ -371,6 +373,7 @@ static int param_set_battery_status(const char *key, - static int param_get_battery_status(char *buffer, const struct kernel_param *kp) - { - strcpy(buffer, map_get_key(map_status, battery_status, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -@@ -385,6 +388,7 @@ static int param_set_battery_health(const char *key, - static int param_get_battery_health(char *buffer, const struct kernel_param *kp) - { - strcpy(buffer, map_get_key(map_health, battery_health, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -@@ -400,6 +404,7 @@ static int param_get_battery_present(char *buffer, - const struct kernel_param *kp) - { - strcpy(buffer, map_get_key(map_present, battery_present, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -@@ -417,6 +422,7 @@ static int param_get_battery_technology(char *buffer, - { - strcpy(buffer, - map_get_key(map_technology, battery_technology, "unknown")); -+ strcat(buffer, "\n"); - return strlen(buffer); - } - -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 3e2288af56bc3..647a057a9b6cc 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -1710,15 +1710,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost) - */ - static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) - { -- struct async_scan_data *data; -+ struct async_scan_data *data = NULL; - unsigned long flags; - - if (strncmp(scsi_scan_type, "sync", 4) == 0) - return NULL; - -+ mutex_lock(&shost->scan_mutex); - if (shost->async_scan) { - shost_printk(KERN_DEBUG, shost, "%s called twice\n", __func__); -- return NULL; -+ goto err; - } - - data = kmalloc(sizeof(*data), GFP_KERNEL); -@@ -1729,7 +1730,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) - goto err; - init_completion(&data->prev_finished); - -- mutex_lock(&shost->scan_mutex); - spin_lock_irqsave(shost->host_lock, flags); - shost->async_scan = 1; - spin_unlock_irqrestore(shost->host_lock, flags); -@@ -1744,6 +1744,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) - return data; - - err: -+ mutex_unlock(&shost->scan_mutex); - kfree(data); - return NULL; - } -diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c -index 3cd008acb657a..3ea15bb0e56ef 100644 ---- a/drivers/staging/comedi/drivers/cb_pcidas.c -+++ b/drivers/staging/comedi/drivers/cb_pcidas.c -@@ -1351,6 +1351,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev, - if (dev->irq && board->has_ao_fifo) { - dev->write_subdev = s; - s->subdev_flags |= SDF_CMD_WRITE; -+ s->len_chanlist = s->n_chan; - s->do_cmdtest = cb_pcidas_ao_cmdtest; - s->do_cmd = cb_pcidas_ao_cmd; - s->cancel = cb_pcidas_ao_cancel; -diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c -index 470ccf729d598..93334e07dd5f7 100644 ---- a/drivers/tty/serial/8250/8250_mtk.c -+++ b/drivers/tty/serial/8250/8250_mtk.c -@@ -58,7 +58,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, - */ - baud = tty_termios_baud_rate(termios); - -- serial8250_do_set_termios(port, termios, old); -+ serial8250_do_set_termios(port, termios, NULL); - - tty_termios_encode_baud_rate(termios, baud, baud); - -diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c -index f80312eed4fda..ffb3fb1bda9e7 100644 ---- a/drivers/tty/serial/serial_txx9.c -+++ b/drivers/tty/serial/serial_txx9.c -@@ -1287,6 +1287,9 @@ static int __init serial_txx9_init(void) - - #ifdef ENABLE_SERIAL_TXX9_PCI - ret = pci_register_driver(&serial_txx9_pci_driver); -+ if (ret) { -+ platform_driver_unregister(&serial_txx9_plat_driver); -+ } - #endif - if (ret == 0) - goto out; -diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c -index 96c65fe641414..05941f86df3d8 100644 ---- a/drivers/tty/vt/keyboard.c -+++ b/drivers/tty/vt/keyboard.c -@@ -712,8 +712,13 @@ static void k_fn(struct vc_data *vc, unsigned char value, char up_flag) - return; - - if ((unsigned)value < ARRAY_SIZE(func_table)) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&func_buf_lock, flags); - if (func_table[value]) - puts_queue(vc, func_table[value]); -+ spin_unlock_irqrestore(&func_buf_lock, flags); -+ - } else - pr_err("k_fn called with value=%d\n", value); - } -@@ -1969,13 +1974,11 @@ out: - #undef s - #undef v - --/* FIXME: This one needs untangling and locking */ -+/* FIXME: This one needs untangling */ - int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - { - struct kbsentry *kbs; -- char *p; - u_char *q; -- u_char __user *up; - int sz, fnw_sz; - int delta; - char *first_free, *fj, *fnw; -@@ -2001,23 +2004,19 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - i = kbs->kb_func; - - switch (cmd) { -- case KDGKBSENT: -- sz = sizeof(kbs->kb_string) - 1; /* sz should have been -- a struct member */ -- up = user_kdgkb->kb_string; -- p = func_table[i]; -- if(p) -- for ( ; *p && sz; p++, sz--) -- if (put_user(*p, up++)) { -- ret = -EFAULT; -- goto reterr; -- } -- if (put_user('\0', up)) { -- ret = -EFAULT; -- goto reterr; -- } -- kfree(kbs); -- return ((p && *p) ? -EOVERFLOW : 0); -+ case KDGKBSENT: { -+ /* size should have been a struct member */ -+ ssize_t len = sizeof(user_kdgkb->kb_string); -+ -+ spin_lock_irqsave(&func_buf_lock, flags); -+ len = strlcpy(kbs->kb_string, func_table[i] ? : "", len); -+ spin_unlock_irqrestore(&func_buf_lock, flags); -+ -+ ret = copy_to_user(user_kdgkb->kb_string, kbs->kb_string, -+ len + 1) ? -EFAULT : 0; -+ -+ goto reterr; -+ } - case KDSKBSENT: - if (!perm) { - ret = -EPERM; -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 01aeffcdf9849..7ec5e6dd60e5c 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -4226,27 +4226,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) - return rc; - } - --static int con_font_copy(struct vc_data *vc, struct console_font_op *op) --{ -- int con = op->height; -- int rc; -- -- -- console_lock(); -- if (vc->vc_mode != KD_TEXT) -- rc = -EINVAL; -- else if (!vc->vc_sw->con_font_copy) -- rc = -ENOSYS; -- else if (con < 0 || !vc_cons_allocated(con)) -- rc = -ENOTTY; -- else if (con == vc->vc_num) /* nothing to do */ -- rc = 0; -- else -- rc = vc->vc_sw->con_font_copy(vc, con); -- console_unlock(); -- return rc; --} -- - int con_font_op(struct vc_data *vc, struct console_font_op *op) - { - switch (op->op) { -@@ -4257,7 +4236,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) - case KD_FONT_OP_SET_DEFAULT: - return con_font_default(vc, op); - case KD_FONT_OP_COPY: -- return con_font_copy(vc, op); -+ /* was buggy and never really used */ -+ return -EINVAL; - } - return -ENOSYS; - } -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index b0f0771a57298..b111071d19b53 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -243,7 +243,7 @@ int vt_waitactive(int n) - - - static inline int --do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) -+do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) - { - struct consolefontdesc cfdarg; - int i; -@@ -261,15 +261,16 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; -- return con_font_op(vc_cons[fg_console].d, op); -- case GIO_FONTX: { -+ return con_font_op(vc, op); -+ -+ case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; -- i = con_font_op(vc_cons[fg_console].d, op); -+ i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; -@@ -277,7 +278,6 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) - return -EFAULT; - return 0; -- } - } - return -EINVAL; - } -@@ -927,7 +927,7 @@ int vt_ioctl(struct tty_struct *tty, - op.height = 0; - op.charcount = 256; - op.data = up; -- ret = con_font_op(vc_cons[fg_console].d, &op); -+ ret = con_font_op(vc, &op); - break; - } - -@@ -938,7 +938,7 @@ int vt_ioctl(struct tty_struct *tty, - op.height = 32; - op.charcount = 256; - op.data = up; -- ret = con_font_op(vc_cons[fg_console].d, &op); -+ ret = con_font_op(vc, &op); - break; - } - -@@ -955,7 +955,7 @@ int vt_ioctl(struct tty_struct *tty, - - case PIO_FONTX: - case GIO_FONTX: -- ret = do_fontx_ioctl(cmd, up, perm, &op); -+ ret = do_fontx_ioctl(vc, cmd, up, perm, &op); - break; - - case PIO_FONTRESET: -@@ -972,11 +972,11 @@ int vt_ioctl(struct tty_struct *tty, - { - op.op = KD_FONT_OP_SET_DEFAULT; - op.data = NULL; -- ret = con_font_op(vc_cons[fg_console].d, &op); -+ ret = con_font_op(vc, &op); - if (ret) - break; - console_lock(); -- con_set_default_unimap(vc_cons[fg_console].d); -+ con_set_default_unimap(vc); - console_unlock(); - break; - } -@@ -1109,8 +1109,9 @@ struct compat_consolefontdesc { - }; - - static inline int --compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, -- int perm, struct console_font_op *op) -+compat_fontx_ioctl(struct vc_data *vc, int cmd, -+ struct compat_consolefontdesc __user *user_cfd, -+ int perm, struct console_font_op *op) - { - struct compat_consolefontdesc cfdarg; - int i; -@@ -1128,7 +1129,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); -- return con_font_op(vc_cons[fg_console].d, op); -+ return con_font_op(vc, op); -+ - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; -@@ -1136,7 +1138,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); -- i = con_font_op(vc_cons[fg_console].d, op); -+ i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; -@@ -1231,7 +1233,7 @@ long vt_compat_ioctl(struct tty_struct *tty, - */ - case PIO_FONTX: - case GIO_FONTX: -- ret = compat_fontx_ioctl(cmd, up, perm, &op); -+ ret = compat_fontx_ioctl(vc, cmd, up, perm, &op); - break; - - case KDFONTOP: -diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c -index ba5c0a4591ac9..012d97f9c30c7 100644 ---- a/drivers/usb/misc/adutux.c -+++ b/drivers/usb/misc/adutux.c -@@ -210,6 +210,7 @@ static void adu_interrupt_out_callback(struct urb *urb) - - if (status != 0) { - if ((status != -ENOENT) && -+ (status != -ESHUTDOWN) && - (status != -ECONNRESET)) { - dev_dbg(&dev->udev->dev, - "%s :nonzero status received: %d\n", __func__, -diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c -index 8948f375e75d2..5a29ea0d00c58 100644 ---- a/drivers/usb/serial/cyberjack.c -+++ b/drivers/usb/serial/cyberjack.c -@@ -368,11 +368,12 @@ static void cyberjack_write_bulk_callback(struct urb *urb) - struct cyberjack_private *priv = usb_get_serial_port_data(port); - struct device *dev = &port->dev; - int status = urb->status; -+ bool resubmitted = false; - -- set_bit(0, &port->write_urbs_free); - if (status) { - dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", - __func__, status); -+ set_bit(0, &port->write_urbs_free); - return; - } - -@@ -405,6 +406,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb) - goto exit; - } - -+ resubmitted = true; -+ - dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent); - dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled); - -@@ -421,6 +424,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb) - - exit: - spin_unlock(&priv->lock); -+ if (!resubmitted) -+ set_bit(0, &port->write_urbs_free); - usb_serial_port_softint(port); - } - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 5017d37afe392..34ac1265afe46 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1174,6 +1174,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ - .driver_info = NCTRL(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -1186,6 +1188,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ -+ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), -@@ -1200,6 +1204,10 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ -+ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), -diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c -index 3bb02c60a2f5f..d56736655dec4 100644 ---- a/drivers/vhost/vringh.c -+++ b/drivers/vhost/vringh.c -@@ -272,13 +272,14 @@ __vringh_iov(struct vringh *vrh, u16 i, - desc_max = vrh->vring.num; - up_next = -1; - -+ /* You must want something! */ -+ if (WARN_ON(!riov && !wiov)) -+ return -EINVAL; -+ - if (riov) - riov->i = riov->used = 0; -- else if (wiov) -+ if (wiov) - wiov->i = wiov->used = 0; -- else -- /* You must want something! */ -- BUG(); - - for (;;) { - void *addr; -diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c -index 750a384bf1915..1a015a6b682e7 100644 ---- a/drivers/video/fbdev/pvr2fb.c -+++ b/drivers/video/fbdev/pvr2fb.c -@@ -1029,6 +1029,8 @@ static int __init pvr2fb_setup(char *options) - if (!options || !*options) - return 0; - -+ cable_arg[0] = output_arg[0] = 0; -+ - while ((this_opt = strsep(&options, ","))) { - if (!*this_opt) - continue; -diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c -index dacb5919970c5..d2e9d2f6a7843 100644 ---- a/drivers/w1/masters/mxc_w1.c -+++ b/drivers/w1/masters/mxc_w1.c -@@ -15,7 +15,7 @@ - #include - #include - #include --#include -+#include - #include - #include - -@@ -48,12 +48,12 @@ struct mxc_w1_device { - static u8 mxc_w1_ds2_reset_bus(void *data) - { - struct mxc_w1_device *dev = data; -- unsigned long timeout; -+ ktime_t timeout; - - writeb(MXC_W1_CONTROL_RPP, dev->regs + MXC_W1_CONTROL); - - /* Wait for reset sequence 511+512us, use 1500us for sure */ -- timeout = jiffies + usecs_to_jiffies(1500); -+ timeout = ktime_add_us(ktime_get(), 1500); - - udelay(511 + 512); - -@@ -63,7 +63,7 @@ static u8 mxc_w1_ds2_reset_bus(void *data) - /* PST bit is valid after the RPP bit is self-cleared */ - if (!(ctrl & MXC_W1_CONTROL_RPP)) - return !(ctrl & MXC_W1_CONTROL_PST); -- } while (time_is_after_jiffies(timeout)); -+ } while (ktime_before(ktime_get(), timeout)); - - return 1; - } -@@ -76,12 +76,12 @@ static u8 mxc_w1_ds2_reset_bus(void *data) - static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit) - { - struct mxc_w1_device *dev = data; -- unsigned long timeout; -+ ktime_t timeout; - - writeb(MXC_W1_CONTROL_WR(bit), dev->regs + MXC_W1_CONTROL); - - /* Wait for read/write bit (60us, Max 120us), use 200us for sure */ -- timeout = jiffies + usecs_to_jiffies(200); -+ timeout = ktime_add_us(ktime_get(), 200); - - udelay(60); - -@@ -91,7 +91,7 @@ static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit) - /* RDST bit is valid after the WR1/RD bit is self-cleared */ - if (!(ctrl & MXC_W1_CONTROL_WR(bit))) - return !!(ctrl & MXC_W1_CONTROL_RDST); -- } while (time_is_after_jiffies(timeout)); -+ } while (ktime_before(ktime_get(), timeout)); - - return 0; - } -diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c -index 47a8f1b1087d4..4568af9a165be 100644 ---- a/drivers/watchdog/rdc321x_wdt.c -+++ b/drivers/watchdog/rdc321x_wdt.c -@@ -244,6 +244,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) - - rdc321x_wdt_device.sb_pdev = pdata->sb_pdev; - rdc321x_wdt_device.base_reg = r->start; -+ rdc321x_wdt_device.queue = 0; -+ rdc321x_wdt_device.default_ticks = ticks; - - err = misc_register(&rdc321x_wdt_misc); - if (err < 0) { -@@ -258,14 +260,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) - rdc321x_wdt_device.base_reg, RDC_WDT_RST); - - init_completion(&rdc321x_wdt_device.stop); -- rdc321x_wdt_device.queue = 0; - - clear_bit(0, &rdc321x_wdt_device.inuse); - - setup_timer(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0); - -- rdc321x_wdt_device.default_ticks = ticks; -- - dev_info(&pdev->dev, "watchdog init success\n"); - - return 0; -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index e4dd991e2888b..9a126732d5d9c 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -91,6 +91,8 @@ static bool (*pirq_needs_eoi)(unsigned irq); - /* Xen will never allocate port zero for any purpose. */ - #define VALID_EVTCHN(chn) ((chn) != 0) - -+static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY]; -+ - static struct irq_chip xen_dynamic_chip; - static struct irq_chip xen_percpu_chip; - static struct irq_chip xen_pirq_chip; -@@ -155,7 +157,18 @@ int get_evtchn_to_irq(unsigned evtchn) - /* Get info for IRQ */ - struct irq_info *info_for_irq(unsigned irq) - { -- return irq_get_chip_data(irq); -+ if (irq < nr_legacy_irqs()) -+ return legacy_info_ptrs[irq]; -+ else -+ return irq_get_chip_data(irq); -+} -+ -+static void set_info_for_irq(unsigned int irq, struct irq_info *info) -+{ -+ if (irq < nr_legacy_irqs()) -+ legacy_info_ptrs[irq] = info; -+ else -+ irq_set_chip_data(irq, info); - } - - /* Constructors for packed IRQ information. */ -@@ -384,7 +397,7 @@ static void xen_irq_init(unsigned irq) - info->type = IRQT_UNBOUND; - info->refcnt = -1; - -- irq_set_chip_data(irq, info); -+ set_info_for_irq(irq, info); - - list_add_tail(&info->list, &xen_irq_list_head); - } -@@ -433,14 +446,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) - - static void xen_free_irq(unsigned irq) - { -- struct irq_info *info = irq_get_chip_data(irq); -+ struct irq_info *info = info_for_irq(irq); - - if (WARN_ON(!info)) - return; - - list_del(&info->list); - -- irq_set_chip_data(irq, NULL); -+ set_info_for_irq(irq, NULL); - - WARN_ON(info->refcnt > 0); - -@@ -610,7 +623,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); - static void __unbind_from_irq(unsigned int irq) - { - int evtchn = evtchn_from_irq(irq); -- struct irq_info *info = irq_get_chip_data(irq); -+ struct irq_info *info = info_for_irq(irq); - - if (info->refcnt > 0) { - info->refcnt--; -@@ -1114,7 +1127,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, - - void unbind_from_irqhandler(unsigned int irq, void *dev_id) - { -- struct irq_info *info = irq_get_chip_data(irq); -+ struct irq_info *info = info_for_irq(irq); - - if (WARN_ON(!info)) - return; -@@ -1148,7 +1161,7 @@ int evtchn_make_refcounted(unsigned int evtchn) - if (irq == -1) - return -ENOENT; - -- info = irq_get_chip_data(irq); -+ info = info_for_irq(irq); - - if (!info) - return -ENOENT; -@@ -1176,7 +1189,7 @@ int evtchn_get(unsigned int evtchn) - if (irq == -1) - goto done; - -- info = irq_get_chip_data(irq); -+ info = info_for_irq(irq); - - if (!info) - goto done; -diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c -index 9dbf371471261..b5aa3e005b9e9 100644 ---- a/fs/9p/vfs_file.c -+++ b/fs/9p/vfs_file.c -@@ -624,9 +624,9 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma) - struct writeback_control wbc = { - .nr_to_write = LONG_MAX, - .sync_mode = WB_SYNC_ALL, -- .range_start = vma->vm_pgoff * PAGE_SIZE, -+ .range_start = (loff_t)vma->vm_pgoff * PAGE_SIZE, - /* absolute end, byte at end included */ -- .range_end = vma->vm_pgoff * PAGE_SIZE + -+ .range_end = (loff_t)vma->vm_pgoff * PAGE_SIZE + - (vma->vm_end - vma->vm_start - 1), - }; - -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 8f0f91de436d5..ee26ccd12da80 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3335,6 +3335,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, - * search and this search we'll not find the key again and can just - * bail. - */ -+search: - ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); - if (ret != 0) - goto done; -@@ -3354,6 +3355,13 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, - - if (min_key.objectid != ino || min_key.type != key_type) - goto done; -+ -+ if (need_resched()) { -+ btrfs_release_path(path); -+ cond_resched(); -+ goto search; -+ } -+ - ret = overwrite_item(trans, log, dst_path, src, i, - &min_key); - if (ret) { -diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c -index 5df898fd0a0aa..9047f0e64bc0a 100644 ---- a/fs/cachefiles/rdwr.c -+++ b/fs/cachefiles/rdwr.c -@@ -125,7 +125,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object, - _debug("reissue read"); - ret = bmapping->a_ops->readpage(NULL, backpage); - if (ret < 0) -- goto unlock_discard; -+ goto discard; - } - - /* but the page may have been read before the monitor was installed, so -@@ -142,6 +142,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object, - - unlock_discard: - unlock_page(backpage); -+discard: - spin_lock_irq(&object->work_lock); - list_del(&monitor->op_link); - spin_unlock_irq(&object->work_lock); -diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c -index 22bae2b434e2c..fbf3830484090 100644 ---- a/fs/ceph/addr.c -+++ b/fs/ceph/addr.c -@@ -1243,7 +1243,7 @@ static int ceph_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - struct ceph_inode_info *ci = ceph_inode(inode); - struct ceph_file_info *fi = vma->vm_file->private_data; - struct page *pinned_page = NULL; -- loff_t off = vmf->pgoff << PAGE_CACHE_SHIFT; -+ loff_t off = (loff_t)vmf->pgoff << PAGE_CACHE_SHIFT; - int want, got, ret; - - dout("filemap_fault %p %llx.%llx %llu~%zd trying to get caps\n", -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index abb244b060245..fca235020312d 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -147,6 +147,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor, - - name[len + EFI_VARIABLE_GUID_LEN+1] = '\0'; - -+ /* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */ -+ strreplace(name, '/', '!'); -+ - inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0, - is_removable); - if (!inode) -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 061b026e464c5..96d77a42ecdea 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3218,7 +3218,7 @@ static int ext4_link(struct dentry *old_dentry, - return -EMLINK; - if (ext4_encrypted_inode(dir) && - !ext4_is_child_context_consistent_with_parent(dir, inode)) -- return -EPERM; -+ return -EXDEV; - err = dquot_initialize(dir); - if (err) - return err; -@@ -3537,7 +3537,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - ext4_encrypted_inode(new.dir) && - !ext4_is_child_context_consistent_with_parent(new.dir, - old.inode)) { -- retval = -EPERM; -+ retval = -EXDEV; - goto end_rename; - } - -@@ -3718,7 +3718,7 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry, - old.inode) || - !ext4_is_child_context_consistent_with_parent(old_dir, - new.inode))) -- return -EPERM; -+ return -EXDEV; - - retval = dquot_initialize(old.dir); - if (retval) -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index aca086a25b2ef..6350971852e19 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -5185,6 +5185,11 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, - /* Quotafile not on the same filesystem? */ - if (path->dentry->d_sb != sb) - return -EXDEV; -+ -+ /* Quota already enabled for this file? */ -+ if (IS_NOQUOTA(d_inode(path->dentry))) -+ return -EBUSY; -+ - /* Journaling quota? */ - if (EXT4_SB(sb)->s_qf_names[type]) { - /* Quotafile not in fs root? */ -diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c -index b7b43d00cc6d7..8ed2b1a716376 100644 ---- a/fs/gfs2/ops_fstype.c -+++ b/fs/gfs2/ops_fstype.c -@@ -160,15 +160,19 @@ static int gfs2_check_sb(struct gfs2_sbd *sdp, int silent) - return -EINVAL; - } - -- /* If format numbers match exactly, we're done. */ -- -- if (sb->sb_fs_format == GFS2_FORMAT_FS && -- sb->sb_multihost_format == GFS2_FORMAT_MULTI) -- return 0; -+ if (sb->sb_fs_format != GFS2_FORMAT_FS || -+ sb->sb_multihost_format != GFS2_FORMAT_MULTI) { -+ fs_warn(sdp, "Unknown on-disk format, unable to mount\n"); -+ return -EINVAL; -+ } - -- fs_warn(sdp, "Unknown on-disk format, unable to mount\n"); -+ if (sb->sb_bsize < 512 || sb->sb_bsize > PAGE_SIZE || -+ (sb->sb_bsize & (sb->sb_bsize - 1))) { -+ pr_warn("Invalid superblock size\n"); -+ return -EINVAL; -+ } - -- return -EINVAL; -+ return 0; - } - - static void end_bio_io_page(struct bio *bio) -diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c -index c8162c660c440..d29ad4e02d33d 100644 ---- a/fs/nfs/namespace.c -+++ b/fs/nfs/namespace.c -@@ -30,9 +30,9 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ; - /* - * nfs_path - reconstruct the path given an arbitrary dentry - * @base - used to return pointer to the end of devname part of path -- * @dentry - pointer to dentry -+ * @dentry_in - pointer to dentry - * @buffer - result buffer -- * @buflen - length of buffer -+ * @buflen_in - length of buffer - * @flags - options (see below) - * - * Helper function for constructing the server pathname -@@ -47,15 +47,19 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ; - * the original device (export) name - * (if unset, the original name is returned verbatim) - */ --char *nfs_path(char **p, struct dentry *dentry, char *buffer, ssize_t buflen, -- unsigned flags) -+char *nfs_path(char **p, struct dentry *dentry_in, char *buffer, -+ ssize_t buflen_in, unsigned flags) - { - char *end; - int namelen; - unsigned seq; - const char *base; -+ struct dentry *dentry; -+ ssize_t buflen; - - rename_retry: -+ buflen = buflen_in; -+ dentry = dentry_in; - end = buffer+buflen; - *--end = '\0'; - buflen--; -diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c -index 595ca0debe117..09134a13a39ce 100644 ---- a/fs/ubifs/debug.c -+++ b/fs/ubifs/debug.c -@@ -1125,6 +1125,7 @@ int dbg_check_dir(struct ubifs_info *c, const struct inode *dir) - err = PTR_ERR(dent); - if (err == -ENOENT) - break; -+ kfree(pdent); - return err; - } - -diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c -index bda5248fc6498..acadeaf72674e 100644 ---- a/fs/xfs/xfs_rtalloc.c -+++ b/fs/xfs/xfs_rtalloc.c -@@ -1017,10 +1017,13 @@ xfs_growfs_rt( - xfs_ilock(mp->m_rbmip, XFS_ILOCK_EXCL); - xfs_trans_ijoin(tp, mp->m_rbmip, XFS_ILOCK_EXCL); - /* -- * Update the bitmap inode's size. -+ * Update the bitmap inode's size ondisk and incore. We need -+ * to update the incore size so that inode inactivation won't -+ * punch what it thinks are "posteof" blocks. - */ - mp->m_rbmip->i_d.di_size = - nsbp->sb_rbmblocks * nsbp->sb_blocksize; -+ i_size_write(VFS_I(mp->m_rbmip), mp->m_rbmip->i_d.di_size); - xfs_trans_log_inode(tp, mp->m_rbmip, XFS_ILOG_CORE); - /* - * Get the summary inode into the transaction. -@@ -1028,9 +1031,12 @@ xfs_growfs_rt( - xfs_ilock(mp->m_rsumip, XFS_ILOCK_EXCL); - xfs_trans_ijoin(tp, mp->m_rsumip, XFS_ILOCK_EXCL); - /* -- * Update the summary inode's size. -+ * Update the summary inode's size. We need to update the -+ * incore size so that inode inactivation won't punch what it -+ * thinks are "posteof" blocks. - */ - mp->m_rsumip->i_d.di_size = nmp->m_rsumsize; -+ i_size_write(VFS_I(mp->m_rsumip), mp->m_rsumip->i_d.di_size); - xfs_trans_log_inode(tp, mp->m_rsumip, XFS_ILOG_CORE); - /* - * Copy summary data from old to new sizes. -diff --git a/include/linux/hil_mlc.h b/include/linux/hil_mlc.h -index 394a8405dd74d..e0521a1d93250 100644 ---- a/include/linux/hil_mlc.h -+++ b/include/linux/hil_mlc.h -@@ -103,7 +103,7 @@ struct hilse_node { - - /* Methods for back-end drivers, e.g. hp_sdc_mlc */ - typedef int (hil_mlc_cts) (hil_mlc *mlc); --typedef void (hil_mlc_out) (hil_mlc *mlc); -+typedef int (hil_mlc_out) (hil_mlc *mlc); - typedef int (hil_mlc_in) (hil_mlc *mlc, suseconds_t timeout); - - struct hil_mlc_devinfo { -diff --git a/include/linux/mtd/pfow.h b/include/linux/mtd/pfow.h -index 42ff7ff09bf59..09404fb36b345 100644 ---- a/include/linux/mtd/pfow.h -+++ b/include/linux/mtd/pfow.h -@@ -127,7 +127,7 @@ static inline void print_drs_error(unsigned dsr) - - if (!(dsr & DSR_AVAILABLE)) - printk(KERN_NOTICE"DSR.15: (0) Device not Available\n"); -- if (prog_status & 0x03) -+ if ((prog_status & 0x03) == 0x03) - printk(KERN_NOTICE"DSR.9,8: (11) Attempt to program invalid " - "half with 41h command\n"); - else if (prog_status & 0x02) -diff --git a/init/Kconfig b/init/Kconfig -index f9fb621c95623..5d8ada360ca34 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -823,7 +823,8 @@ config IKCONFIG_PROC - - config LOG_BUF_SHIFT - int "Kernel log buffer size (16 => 64KB, 17 => 128KB)" -- range 12 25 -+ range 12 25 if !H8300 -+ range 12 19 if H8300 - default 17 - depends on PRINTK - help -diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c -index 321ccdbb73649..bc791cec58e63 100644 ---- a/kernel/debug/debug_core.c -+++ b/kernel/debug/debug_core.c -@@ -94,14 +94,6 @@ int dbg_switch_cpu; - /* Use kdb or gdbserver mode */ - int dbg_kdb_mode = 1; - --static int __init opt_kgdb_con(char *str) --{ -- kgdb_use_con = 1; -- return 0; --} -- --early_param("kgdbcon", opt_kgdb_con); -- - module_param(kgdb_use_con, int, 0644); - module_param(kgdbreboot, int, 0644); - -@@ -811,6 +803,20 @@ static struct console kgdbcons = { - .index = -1, - }; - -+static int __init opt_kgdb_con(char *str) -+{ -+ kgdb_use_con = 1; -+ -+ if (kgdb_io_module_registered && !kgdb_con_registered) { -+ register_console(&kgdbcons); -+ kgdb_con_registered = 1; -+ } -+ -+ return 0; -+} -+ -+early_param("kgdbcon", opt_kgdb_con); -+ - #ifdef CONFIG_MAGIC_SYSRQ - static void sysrq_handle_dbg(int key) - { -diff --git a/kernel/fork.c b/kernel/fork.c -index a6dc6b3f6a015..5d35be1e0913b 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1539,14 +1539,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, - /* ok, now we should be set up.. */ - p->pid = pid_nr(pid); - if (clone_flags & CLONE_THREAD) { -- p->exit_signal = -1; - p->group_leader = current->group_leader; - p->tgid = current->tgid; - } else { -- if (clone_flags & CLONE_PARENT) -- p->exit_signal = current->group_leader->exit_signal; -- else -- p->exit_signal = (clone_flags & CSIGNAL); - p->group_leader = p; - p->tgid = p->pid; - } -@@ -1591,9 +1586,14 @@ static struct task_struct *copy_process(unsigned long clone_flags, - if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { - p->real_parent = current->real_parent; - p->parent_exec_id = current->parent_exec_id; -+ if (clone_flags & CLONE_THREAD) -+ p->exit_signal = -1; -+ else -+ p->exit_signal = current->group_leader->exit_signal; - } else { - p->real_parent = current; - p->parent_exec_id = current->self_exec_id; -+ p->exit_signal = (clone_flags & CSIGNAL); - } - - spin_lock(¤t->sighand->siglock); -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 1cf2402c69228..1c1ecc1d49ad2 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -1659,18 +1659,18 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, - { - struct ring_buffer_per_cpu *cpu_buffer; - unsigned long nr_pages; -- int cpu, err = 0; -+ int cpu, err; - - /* - * Always succeed at resizing a non-existent buffer: - */ - if (!buffer) -- return size; -+ return 0; - - /* Make sure the requested buffer exists */ - if (cpu_id != RING_BUFFER_ALL_CPUS && - !cpumask_test_cpu(cpu_id, buffer->cpumask)) -- return size; -+ return 0; - - nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); - -@@ -1810,7 +1810,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, - } - - mutex_unlock(&buffer->mutex); -- return size; -+ return 0; - - out_err: - for_each_buffer_cpu(buffer, cpu) { -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 12a82a7ad5a68..cd0d8cc7163e1 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -478,6 +478,12 @@ enum { - * can only be modified by current, we can reuse trace_recursion. - */ - TRACE_IRQ_BIT, -+ -+ /* -+ * When transitioning between context, the preempt_count() may -+ * not be correct. Allow for a single recursion to cover this case. -+ */ -+ TRACE_TRANSITION_BIT, - }; - - #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0) -@@ -522,14 +528,27 @@ static __always_inline int trace_test_and_set_recursion(int start, int max) - return 0; - - bit = trace_get_context_bit() + start; -- if (unlikely(val & (1 << bit))) -- return -1; -+ if (unlikely(val & (1 << bit))) { -+ /* -+ * It could be that preempt_count has not been updated during -+ * a switch between contexts. Allow for a single recursion. -+ */ -+ bit = TRACE_TRANSITION_BIT; -+ if (trace_recursion_test(bit)) -+ return -1; -+ trace_recursion_set(bit); -+ barrier(); -+ return bit + 1; -+ } -+ -+ /* Normal check passed, clear the transition to allow it again */ -+ trace_recursion_clear(TRACE_TRANSITION_BIT); - - val |= 1 << bit; - current->trace_recursion = val; - barrier(); - -- return bit; -+ return bit + 1; - } - - static __always_inline void trace_clear_recursion(int bit) -@@ -539,6 +558,7 @@ static __always_inline void trace_clear_recursion(int bit) - if (!bit) - return; - -+ bit--; - bit = 1 << bit; - val &= ~bit; - -diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c -index ca70d11b8aa78..f444f57f1338b 100644 ---- a/kernel/trace/trace_selftest.c -+++ b/kernel/trace/trace_selftest.c -@@ -490,8 +490,13 @@ trace_selftest_function_recursion(void) - unregister_ftrace_function(&test_rec_probe); - - ret = -1; -- if (trace_selftest_recursion_cnt != 1) { -- pr_cont("*callback not called once (%d)* ", -+ /* -+ * Recursion allows for transitions between context, -+ * and may call the callback twice. -+ */ -+ if (trace_selftest_recursion_cnt != 1 && -+ trace_selftest_recursion_cnt != 2) { -+ pr_cont("*callback not called once (or twice) (%d)* ", - trace_selftest_recursion_cnt); - goto out; - } -diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c -index 87e904f550c15..0ea39bfdc3cfa 100644 ---- a/lib/fonts/font_10x18.c -+++ b/lib/fonts/font_10x18.c -@@ -7,7 +7,7 @@ - - #define FONTDATAMAX 9216 - --static struct font_data fontdata_10x18 = { -+static const struct font_data fontdata_10x18 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, 0x00, /* 0000000000 */ -diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c -index 896ffa987c97b..ec243d7d2e0e3 100644 ---- a/lib/fonts/font_6x10.c -+++ b/lib/fonts/font_6x10.c -@@ -2,7 +2,7 @@ - - #define FONTDATAMAX 2560 - --static struct font_data fontdata_6x10 = { -+static const struct font_data fontdata_6x10 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ -diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c -index eb46a59307d2e..0010e213fbe22 100644 ---- a/lib/fonts/font_6x11.c -+++ b/lib/fonts/font_6x11.c -@@ -8,7 +8,7 @@ - - #define FONTDATAMAX (11*256) - --static struct font_data fontdata_6x11 = { -+static const struct font_data fontdata_6x11 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ -diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c -index c88b3bba001bd..2900b59325e5f 100644 ---- a/lib/fonts/font_7x14.c -+++ b/lib/fonts/font_7x14.c -@@ -7,7 +7,7 @@ - - #define FONTDATAMAX 3584 - --static struct font_data fontdata_7x14 = { -+static const struct font_data fontdata_7x14 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 0000000 */ -diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c -index ba53e2643670b..cc3fa17ff94df 100644 ---- a/lib/fonts/font_8x16.c -+++ b/lib/fonts/font_8x16.c -@@ -9,7 +9,7 @@ - - #define FONTDATAMAX 4096 - --static struct font_data fontdata_8x16 = { -+static const struct font_data fontdata_8x16 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ -diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c -index 4d28b81e8237c..1519b7ce88278 100644 ---- a/lib/fonts/font_8x8.c -+++ b/lib/fonts/font_8x8.c -@@ -8,7 +8,7 @@ - - #define FONTDATAMAX 2048 - --static struct font_data fontdata_8x8 = { -+static const struct font_data fontdata_8x8 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ -diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c -index 957398b762d38..c6367ed4c5bcf 100644 ---- a/lib/fonts/font_acorn_8x8.c -+++ b/lib/fonts/font_acorn_8x8.c -@@ -4,7 +4,7 @@ - - #define FONTDATAMAX 2048 - --static struct font_data acorndata_8x8 = { -+static const struct font_data acorndata_8x8 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ - /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ -diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c -index 1449876c6a270..592774a90917b 100644 ---- a/lib/fonts/font_mini_4x6.c -+++ b/lib/fonts/font_mini_4x6.c -@@ -43,7 +43,7 @@ __END__; - - #define FONTDATAMAX 1536 - --static struct font_data fontdata_mini_4x6 = { -+static const struct font_data fontdata_mini_4x6 = { - { 0, 0, FONTDATAMAX, 0 }, { - /*{*/ - /* Char 0: ' ' */ -diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c -index 4649314333bb0..6351b759ae702 100644 ---- a/lib/fonts/font_pearl_8x8.c -+++ b/lib/fonts/font_pearl_8x8.c -@@ -13,7 +13,7 @@ - - #define FONTDATAMAX 2048 - --static struct font_data fontdata_pearl8x8 = { -+static const struct font_data fontdata_pearl8x8 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, /* 00000000 */ -diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c -index c6967cdf4207b..057b0bf368a2a 100644 ---- a/lib/fonts/font_sun12x22.c -+++ b/lib/fonts/font_sun12x22.c -@@ -2,7 +2,7 @@ - - #define FONTDATAMAX 11264 - --static struct font_data fontdata_sun12x22 = { -+static const struct font_data fontdata_sun12x22 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* 0 0x00 '^@' */ - 0x00, 0x00, /* 000000000000 */ -diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c -index 7d979e5788999..84db7275e0534 100644 ---- a/lib/fonts/font_sun8x16.c -+++ b/lib/fonts/font_sun8x16.c -@@ -2,7 +2,7 @@ - - #define FONTDATAMAX 4096 - --static struct font_data fontdata_sun8x16 = { -+static const struct font_data fontdata_sun8x16 = { - { 0, 0, FONTDATAMAX, 0 }, { - /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, - /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, -diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c -index eab058f93ec97..6f8e84844bb27 100644 ---- a/net/9p/trans_fd.c -+++ b/net/9p/trans_fd.c -@@ -991,7 +991,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) - - csocket = NULL; - -- if (addr == NULL) -+ if (!addr || !strlen(addr)) - return -EINVAL; - - if (strlen(addr) >= UNIX_PATH_MAX) { -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index 3ed2796d008bb..3fbc312e43cef 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -2976,6 +2976,11 @@ static void con_fault(struct ceph_connection *con) - ceph_msg_put(con->in_msg); - con->in_msg = NULL; - } -+ if (con->out_msg) { -+ BUG_ON(con->out_msg->con != con); -+ ceph_msg_put(con->out_msg); -+ con->out_msg = NULL; -+ } - - /* Requeue anything that hasn't been acked */ - list_splice_init(&con->out_sent, &con->out_queue); -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index f28aeb2cfd328..cc308f7a2c027 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -1826,6 +1826,14 @@ call_connect_status(struct rpc_task *task) - task->tk_status = 0; - switch (status) { - case -ECONNREFUSED: -+ /* A positive refusal suggests a rebind is needed. */ -+ if (RPC_IS_SOFTCONN(task)) -+ break; -+ if (clnt->cl_autobind) { -+ rpc_force_rebind(clnt); -+ task->tk_action = call_bind; -+ return; -+ } - case -ECONNRESET: - case -ECONNABORTED: - case -ENETUNREACH: -diff --git a/net/tipc/core.c b/net/tipc/core.c -index 1aa16b00f1057..758e59a20a6c5 100644 ---- a/net/tipc/core.c -+++ b/net/tipc/core.c -@@ -88,6 +88,11 @@ out_sk_rht: - static void __net_exit tipc_exit_net(struct net *net) - { - tipc_net_stop(net); -+ -+ /* Make sure the tipc_net_finalize_work stopped -+ * before releasing the resources. -+ */ -+ flush_scheduled_work(); - tipc_bcast_stop(net); - tipc_nametbl_stop(net); - tipc_sk_rht_destroy(net); -diff --git a/net/tipc/msg.c b/net/tipc/msg.c -index 30c3a7985fa4d..f3c7e5d1fc57e 100644 ---- a/net/tipc/msg.c -+++ b/net/tipc/msg.c -@@ -138,12 +138,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) - if (fragid == FIRST_FRAGMENT) { - if (unlikely(head)) - goto err; -- if (skb_cloned(frag)) -- frag = skb_copy(frag, GFP_ATOMIC); -+ *buf = NULL; -+ frag = skb_unshare(frag, GFP_ATOMIC); - if (unlikely(!frag)) - goto err; - head = *headbuf = frag; -- *buf = NULL; - TIPC_SKB_CB(head)->tail = NULL; - if (skb_is_nonlinear(head)) { - skb_walk_frags(head, tail) { -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index a645352e366aa..07b1a2775210b 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -633,7 +633,7 @@ struct sock *__vsock_create(struct net *net, - vsk->owner = get_cred(psk->owner); - vsk->connect_timeout = psk->connect_timeout; - } else { -- vsk->trusted = capable(CAP_NET_ADMIN); -+ vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); - vsk->owner = get_current_cred(); - vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT; - } -diff --git a/scripts/setlocalversion b/scripts/setlocalversion -index aa28c3f298093..0c8741b795d0c 100755 ---- a/scripts/setlocalversion -+++ b/scripts/setlocalversion -@@ -44,7 +44,7 @@ scm_version() - - # Check for git and a git repo. - if test -z "$(git rev-parse --show-cdup 2>/dev/null)" && -- head=`git rev-parse --verify --short HEAD 2>/dev/null`; then -+ head=$(git rev-parse --verify HEAD 2>/dev/null); then - - # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore - # it, because this version is defined in the top level Makefile. -@@ -58,11 +58,22 @@ scm_version() - fi - # If we are past a tagged commit (like - # "v2.6.30-rc5-302-g72357d5"), we pretty print it. -- if atag="`git describe 2>/dev/null`"; then -- echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}' -- -- # If we don't have a tag at all we print -g{commitish}. -+ # -+ # Ensure the abbreviated sha1 has exactly 12 -+ # hex characters, to make the output -+ # independent of git version, local -+ # core.abbrev settings and/or total number of -+ # objects in the current repository - passing -+ # --abbrev=12 ensures a minimum of 12, and the -+ # awk substr() then picks the 'g' and first 12 -+ # hex chars. -+ if atag="$(git describe --abbrev=12 2>/dev/null)"; then -+ echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),substr($(NF),0,13))}' -+ -+ # If we don't have a tag at all we print -g{commitish}, -+ # again using exactly 12 hex chars. - else -+ head="$(echo $head | cut -c1-12)" - printf '%s%s' -g $head - fi - fi -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index c97d9a537f763..366813f1a5f80 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -332,6 +332,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, - switch (subs->stream->chip->usb_id) { - case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */ - case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */ -+ case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */ - ep = 0x81; - iface = usb_ifnum_to_if(dev, 3); - diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.242-243.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.242-243.patch deleted file mode 100644 index dd5374f078..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.242-243.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0ba3fd9144264..99badda272d74 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 242 -+SUBLEVEL = 243 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c -index fd12ccc11e262..2313bb93f5c2e 100644 ---- a/drivers/powercap/powercap_sys.c -+++ b/drivers/powercap/powercap_sys.c -@@ -379,9 +379,9 @@ static void create_power_zone_common_attributes( - &dev_attr_max_energy_range_uj.attr; - if (power_zone->ops->get_energy_uj) { - if (power_zone->ops->reset_energy_uj) -- dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO; -+ dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR; - else -- dev_attr_energy_uj.attr.mode = S_IRUGO; -+ dev_attr_energy_uj.attr.mode = S_IRUSR; - power_zone->zone_dev_attrs[count++] = - &dev_attr_energy_uj.attr; - } diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.243-244.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.243-244.patch deleted file mode 100644 index 1e1d27085c..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.243-244.patch +++ /dev/null @@ -1,3736 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index b19d872feb569..17747dcd0e779 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -4488,6 +4488,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - Disables the PV optimizations forcing the HVM guest to - run as generic HVM guest with no PV drivers. - -+ xen.event_eoi_delay= [XEN] -+ How long to delay EOI handling in case of event -+ storms (jiffies). Default is 10. -+ -+ xen.event_loop_timeout= [XEN] -+ After which time (jiffies) the event handling loop -+ should start to delay EOI handling. Default is 2. -+ - xirc2ps_cs= [NET,PCMCIA] - Format: - ,,,,,[,[,[,]]] -diff --git a/Makefile b/Makefile -index 99badda272d74..f8b9fd688781c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 243 -+SUBLEVEL = 244 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 2d2631f9a519f..2c9a2992863b0 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -1223,6 +1223,14 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl) - return 0; - } - -+static bool is_spec_ib_user_controlled(void) -+{ -+ return spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL || -+ spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP; -+} -+ - static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) - { - switch (ctrl) { -@@ -1230,17 +1238,26 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) - if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && - spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) - return 0; -- /* -- * Indirect branch speculation is always disabled in strict -- * mode. It can neither be enabled if it was force-disabled -- * by a previous prctl call. - -+ /* -+ * With strict mode for both IBPB and STIBP, the instruction -+ * code paths avoid checking this task flag and instead, -+ * unconditionally run the instruction. However, STIBP and IBPB -+ * are independent and either can be set to conditionally -+ * enabled regardless of the mode of the other. -+ * -+ * If either is set to conditional, allow the task flag to be -+ * updated, unless it was force-disabled by a previous prctl -+ * call. Currently, this is possible on an AMD CPU which has the -+ * feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the -+ * kernel is booted with 'spectre_v2_user=seccomp', then -+ * spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and -+ * spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED. - */ -- if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED || -+ if (!is_spec_ib_user_controlled() || - task_spec_ib_force_disable(task)) - return -EPERM; -+ - task_clear_spec_ib_disable(task); - task_update_spec_tif(task); - break; -@@ -1253,10 +1270,10 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) - if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && - spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) - return -EPERM; -- if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED) -+ -+ if (!is_spec_ib_user_controlled()) - return 0; -+ - task_set_spec_ib_disable(task); - if (ctrl == PR_SPEC_FORCE_DISABLE) - task_set_spec_ib_force_disable(task); -@@ -1319,20 +1336,17 @@ static int ib_prctl_get(struct task_struct *task) - if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && - spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) - return PR_SPEC_ENABLE; -- else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || -- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED) -- return PR_SPEC_DISABLE; -- else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL || -- spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP || -- spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL || -- spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) { -+ else if (is_spec_ib_user_controlled()) { - if (task_spec_ib_force_disable(task)) - return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE; - if (task_spec_ib_disable(task)) - return PR_SPEC_PRCTL | PR_SPEC_DISABLE; - return PR_SPEC_PRCTL | PR_SPEC_ENABLE; -- } else -+ } else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT || -+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED) -+ return PR_SPEC_DISABLE; -+ else - return PR_SPEC_NOT_AFFECTED; - } - -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index a295ad6a1674f..8dbdd156e0d3e 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -173,7 +173,7 @@ static inline void shrink_free_pagepool(struct xen_blkif *blkif, int num) - - #define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page))) - --static int do_block_io_op(struct xen_blkif *blkif); -+static int do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags); - static int dispatch_rw_block_io(struct xen_blkif *blkif, - struct blkif_request *req, - struct pending_req *pending_req); -@@ -594,6 +594,8 @@ int xen_blkif_schedule(void *arg) - struct xen_vbd *vbd = &blkif->vbd; - unsigned long timeout; - int ret; -+ bool do_eoi; -+ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS; - - while (!kthread_should_stop()) { - if (try_to_freeze()) -@@ -617,16 +619,23 @@ int xen_blkif_schedule(void *arg) - if (timeout == 0) - goto purge_gnt_list; - -+ do_eoi = blkif->waiting_reqs; -+ - blkif->waiting_reqs = 0; - smp_mb(); /* clear flag *before* checking for work */ - -- ret = do_block_io_op(blkif); -+ ret = do_block_io_op(blkif, &eoi_flags); - if (ret > 0) - blkif->waiting_reqs = 1; - if (ret == -EACCES) - wait_event_interruptible(blkif->shutdown_wq, - kthread_should_stop()); - -+ if (do_eoi && !blkif->waiting_reqs) { -+ xen_irq_lateeoi(blkif->irq, eoi_flags); -+ eoi_flags |= XEN_EOI_FLAG_SPURIOUS; -+ } -+ - purge_gnt_list: - if (blkif->vbd.feature_gnt_persistent && - time_after(jiffies, blkif->next_lru)) { -@@ -1094,7 +1103,7 @@ static void end_block_io_op(struct bio *bio) - * and transmute it to the block API to hand it over to the proper block disk. - */ - static int --__do_block_io_op(struct xen_blkif *blkif) -+__do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags) - { - union blkif_back_rings *blk_rings = &blkif->blk_rings; - struct blkif_request req; -@@ -1117,6 +1126,9 @@ __do_block_io_op(struct xen_blkif *blkif) - if (RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, rc)) - break; - -+ /* We've seen a request, so clear spurious eoi flag. */ -+ *eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS; -+ - if (kthread_should_stop()) { - more_to_do = 1; - break; -@@ -1175,13 +1187,13 @@ done: - } - - static int --do_block_io_op(struct xen_blkif *blkif) -+do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags) - { - union blkif_back_rings *blk_rings = &blkif->blk_rings; - int more_to_do; - - do { -- more_to_do = __do_block_io_op(blkif); -+ more_to_do = __do_block_io_op(blkif, eoi_flags); - if (more_to_do) - break; - -diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c -index 9233082013755..0ec257e69e95a 100644 ---- a/drivers/block/xen-blkback/xenbus.c -+++ b/drivers/block/xen-blkback/xenbus.c -@@ -200,9 +200,8 @@ static int xen_blkif_map(struct xen_blkif *blkif, grant_ref_t *gref, - BUG(); - } - -- err = bind_interdomain_evtchn_to_irqhandler(blkif->domid, evtchn, -- xen_blkif_be_int, 0, -- "blkif-backend", blkif); -+ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(blkif->domid, -+ evtchn, xen_blkif_be_int, 0, "blkif-backend", blkif); - if (err < 0) { - xenbus_unmap_ring_vfree(blkif->be->dev, blkif->blk_ring); - blkif->blk_rings.common.sring = NULL; -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 7bb1e423eb190..08d96d58f1f2f 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -678,7 +678,6 @@ retry: - r->initialized = 1; - r->entropy_total = 0; - if (r == &nonblocking_pool) { -- prandom_reseed_late(); - process_random_ready_list(); - wake_up_all(&urandom_init_wait); - pr_notice("random: %s pool is initialized\n", r->name); -@@ -923,7 +922,6 @@ void add_interrupt_randomness(int irq, int irq_flags) - - fast_mix(fast_pool); - add_interrupt_bench(cycles); -- this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]); - - if ((fast_pool->count < 64) && - !time_after(now, fast_pool->last + HZ)) -diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -index c568293cb6c1a..f1745c5cdf7b3 100644 ---- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c -@@ -1118,22 +1118,19 @@ static int cik_sdma_soft_reset(void *handle) - { - u32 srbm_soft_reset = 0; - struct amdgpu_device *adev = (struct amdgpu_device *)handle; -- u32 tmp = RREG32(mmSRBM_STATUS2); -+ u32 tmp; - -- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) { -- /* sdma0 */ -- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); -- tmp |= SDMA0_F32_CNTL__HALT_MASK; -- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); -- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; -- } -- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) { -- /* sdma1 */ -- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); -- tmp |= SDMA0_F32_CNTL__HALT_MASK; -- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); -- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; -- } -+ /* sdma0 */ -+ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); -+ tmp |= SDMA0_F32_CNTL__HALT_MASK; -+ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); -+ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; -+ -+ /* sdma1 */ -+ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); -+ tmp |= SDMA0_F32_CNTL__HALT_MASK; -+ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); -+ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; - - if (srbm_soft_reset) { - cik_sdma_print_status((void *)adev); -diff --git a/drivers/gpu/drm/gma500/psb_irq.c b/drivers/gpu/drm/gma500/psb_irq.c -index 78eb109028091..076b6da44f461 100644 ---- a/drivers/gpu/drm/gma500/psb_irq.c -+++ b/drivers/gpu/drm/gma500/psb_irq.c -@@ -350,6 +350,7 @@ int psb_irq_postinstall(struct drm_device *dev) - { - struct drm_psb_private *dev_priv = dev->dev_private; - unsigned long irqflags; -+ unsigned int i; - - spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags); - -@@ -362,20 +363,12 @@ int psb_irq_postinstall(struct drm_device *dev) - PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R); - PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM); - -- if (dev->vblank[0].enabled) -- psb_enable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE); -- else -- psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE); -- -- if (dev->vblank[1].enabled) -- psb_enable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE); -- else -- psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE); -- -- if (dev->vblank[2].enabled) -- psb_enable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE); -- else -- psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE); -+ for (i = 0; i < dev->num_crtcs; ++i) { -+ if (dev->vblank[i].enabled) -+ psb_enable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE); -+ else -+ psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE); -+ } - - if (dev_priv->ops->hotplug_enable) - dev_priv->ops->hotplug_enable(dev, true); -@@ -388,6 +381,7 @@ void psb_irq_uninstall(struct drm_device *dev) - { - struct drm_psb_private *dev_priv = dev->dev_private; - unsigned long irqflags; -+ unsigned int i; - - spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags); - -@@ -396,14 +390,10 @@ void psb_irq_uninstall(struct drm_device *dev) - - PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM); - -- if (dev->vblank[0].enabled) -- psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE); -- -- if (dev->vblank[1].enabled) -- psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE); -- -- if (dev->vblank[2].enabled) -- psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE); -+ for (i = 0; i < dev->num_crtcs; ++i) { -+ if (dev->vblank[i].enabled) -+ psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE); -+ } - - dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG | - _PSB_IRQ_MSVDX_FLAG | -diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h -index 695d4e235438c..90832bf00538e 100644 ---- a/drivers/iommu/amd_iommu_types.h -+++ b/drivers/iommu/amd_iommu_types.h -@@ -351,7 +351,11 @@ extern bool amd_iommu_np_cache; - /* Only true if all IOMMUs support device IOTLBs */ - extern bool amd_iommu_iotlb_sup; - --#define MAX_IRQS_PER_TABLE 256 -+/* -+ * AMD IOMMU hardware only support 512 IRTEs despite -+ * the architectural limitation of 2048 entries. -+ */ -+#define MAX_IRQS_PER_TABLE 512 - #define IRQ_TABLE_ALIGNMENT 128 - - struct irq_remap_table { -diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h -index 04e1aa39243f7..993d8f3e51d4e 100644 ---- a/drivers/misc/mei/client.h -+++ b/drivers/misc/mei/client.h -@@ -156,11 +156,11 @@ static inline u8 mei_cl_me_id(const struct mei_cl *cl) - * - * @cl: host client - * -- * Return: mtu -+ * Return: mtu or 0 if client is not connected - */ - static inline size_t mei_cl_mtu(const struct mei_cl *cl) - { -- return cl->me_cl->props.max_msg_length; -+ return cl->me_cl ? cl->me_cl->props.max_msg_length : 0; - } - - /** -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 9dd968ee792e0..9579dae54af29 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -439,9 +439,13 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 - */ - struct sk_buff *skb = priv->echo_skb[idx]; - struct canfd_frame *cf = (struct canfd_frame *)skb->data; -- u8 len = cf->len; - -- *len_ptr = len; -+ /* get the real payload length for netdev statistics */ -+ if (cf->can_id & CAN_RTR_FLAG) -+ *len_ptr = 0; -+ else -+ *len_ptr = cf->len; -+ - priv->echo_skb[idx] = NULL; - - return skb; -@@ -466,7 +470,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx) - if (!skb) - return 0; - -- netif_rx(skb); -+ skb_get(skb); -+ if (netif_rx(skb) == NET_RX_SUCCESS) -+ dev_consume_skb_any(skb); -+ else -+ dev_kfree_skb_any(skb); - - return len; - } -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index 8c47cc8dc8965..22deddb2dbf5a 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -150,14 +150,55 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts, - /* protect from getting timeval before setting now */ - if (time_ref->tv_host.tv_sec > 0) { - u64 delta_us; -+ s64 delta_ts = 0; -+ -+ /* General case: dev_ts_1 < dev_ts_2 < ts, with: -+ * -+ * - dev_ts_1 = previous sync timestamp -+ * - dev_ts_2 = last sync timestamp -+ * - ts = event timestamp -+ * - ts_period = known sync period (theoretical) -+ * ~ dev_ts2 - dev_ts1 -+ * *but*: -+ * -+ * - time counters wrap (see adapter->ts_used_bits) -+ * - sometimes, dev_ts_1 < ts < dev_ts2 -+ * -+ * "normal" case (sync time counters increase): -+ * must take into account case when ts wraps (tsw) -+ * -+ * < ts_period > < > -+ * | | | -+ * ---+--------+----+-------0-+--+--> -+ * ts_dev_1 | ts_dev_2 | -+ * ts tsw -+ */ -+ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { -+ /* case when event time (tsw) wraps */ -+ if (ts < time_ref->ts_dev_1) -+ delta_ts = 1 << time_ref->adapter->ts_used_bits; -+ -+ /* Otherwise, sync time counter (ts_dev_2) has wrapped: -+ * handle case when event time (tsn) hasn't. -+ * -+ * < ts_period > < > -+ * | | | -+ * ---+--------+--0-+---------+--+--> -+ * ts_dev_1 | ts_dev_2 | -+ * tsn ts -+ */ -+ } else if (time_ref->ts_dev_1 < ts) { -+ delta_ts = -(1 << time_ref->adapter->ts_used_bits); -+ } - -- delta_us = ts - time_ref->ts_dev_2; -- if (ts < time_ref->ts_dev_2) -- delta_us &= (1 << time_ref->adapter->ts_used_bits) - 1; -+ /* add delay between last sync and event timestamps */ -+ delta_ts += (signed int)(ts - time_ref->ts_dev_2); - -- delta_us += time_ref->ts_total; -+ /* add time from beginning to last sync */ -+ delta_ts += time_ref->ts_total; - -- delta_us *= time_ref->adapter->us_per_ts_scale; -+ /* convert ticks number into microseconds */ -+ delta_us = delta_ts * time_ref->adapter->us_per_ts_scale; - delta_us >>= time_ref->adapter->us_per_ts_shift; - - *tv = time_ref->tv_host_0; -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -index 1b75d5304a2c1..2e62cdc7ec7ab 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -@@ -475,12 +475,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, - struct pucan_msg *rx_msg) - { - struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg; -- struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel(rm)]; -- struct net_device *netdev = dev->netdev; -+ struct peak_usb_device *dev; -+ struct net_device *netdev; - struct canfd_frame *cfd; - struct sk_buff *skb; - const u16 rx_msg_flags = le16_to_cpu(rm->flags); - -+ if (pucan_msg_get_channel(rm) >= ARRAY_SIZE(usb_if->dev)) -+ return -ENOMEM; -+ -+ dev = usb_if->dev[pucan_msg_get_channel(rm)]; -+ netdev = dev->netdev; -+ - if (rx_msg_flags & PUCAN_MSG_EXT_DATA_LEN) { - /* CANFD frame case */ - skb = alloc_canfd_skb(netdev, &cfd); -@@ -527,15 +533,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, - struct pucan_msg *rx_msg) - { - struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg; -- struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel(sm)]; -- struct pcan_usb_fd_device *pdev = -- container_of(dev, struct pcan_usb_fd_device, dev); -+ struct pcan_usb_fd_device *pdev; - enum can_state new_state = CAN_STATE_ERROR_ACTIVE; - enum can_state rx_state, tx_state; -- struct net_device *netdev = dev->netdev; -+ struct peak_usb_device *dev; -+ struct net_device *netdev; - struct can_frame *cf; - struct sk_buff *skb; - -+ if (pucan_stmsg_get_channel(sm) >= ARRAY_SIZE(usb_if->dev)) -+ return -ENOMEM; -+ -+ dev = usb_if->dev[pucan_stmsg_get_channel(sm)]; -+ pdev = container_of(dev, struct pcan_usb_fd_device, dev); -+ netdev = dev->netdev; -+ - /* nothing should be sent while in BUS_OFF state */ - if (dev->can.state == CAN_STATE_BUS_OFF) - return 0; -@@ -588,9 +600,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if, - struct pucan_msg *rx_msg) - { - struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg; -- struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel(er)]; -- struct pcan_usb_fd_device *pdev = -- container_of(dev, struct pcan_usb_fd_device, dev); -+ struct pcan_usb_fd_device *pdev; -+ struct peak_usb_device *dev; -+ -+ if (pucan_ermsg_get_channel(er) >= ARRAY_SIZE(usb_if->dev)) -+ return -EINVAL; -+ -+ dev = usb_if->dev[pucan_ermsg_get_channel(er)]; -+ pdev = container_of(dev, struct pcan_usb_fd_device, dev); - - /* keep a trace of tx and rx error counters for later use */ - pdev->bec.txerr = er->tx_err_cnt; -@@ -604,11 +621,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if, - struct pucan_msg *rx_msg) - { - struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg; -- struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel(ov)]; -- struct net_device *netdev = dev->netdev; -+ struct peak_usb_device *dev; -+ struct net_device *netdev; - struct can_frame *cf; - struct sk_buff *skb; - -+ if (pufd_omsg_get_channel(ov) >= ARRAY_SIZE(usb_if->dev)) -+ return -EINVAL; -+ -+ dev = usb_if->dev[pufd_omsg_get_channel(ov)]; -+ netdev = dev->netdev; -+ - /* allocate an skb to store the error frame */ - skb = alloc_can_err_skb(netdev, &cf); - if (!skb) -@@ -726,6 +749,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev, - u16 tx_msg_size, tx_msg_flags; - u8 can_dlc; - -+ if (cfd->len > CANFD_MAX_DLEN) -+ return -EINVAL; -+ - tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4); - tx_msg->size = cpu_to_le16(tx_msg_size); - tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index cdb263875efb3..b4b4d46da1734 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -188,7 +188,7 @@ static inline bool i40e_vc_isvalid_vsi_id(struct i40e_vf *vf, u16 vsi_id) - * check for the valid queue id - **/ - static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id, -- u8 qid) -+ u16 qid) - { - struct i40e_pf *pf = vf->pf; - struct i40e_vsi *vsi = i40e_find_vsi_from_id(pf, vsi_id); -@@ -203,7 +203,7 @@ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id, - * - * check for the valid vector id - **/ --static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u8 vector_id) -+static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u32 vector_id) - { - struct i40e_pf *pf = vf->pf; - -diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c -index ec13e2ae6d16e..ee38299f9c578 100644 ---- a/drivers/net/geneve.c -+++ b/drivers/net/geneve.c -@@ -711,7 +711,8 @@ free_dst: - static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, - struct net_device *dev, - struct flowi4 *fl4, -- struct ip_tunnel_info *info) -+ struct ip_tunnel_info *info, -+ __be16 dport, __be16 sport) - { - struct geneve_dev *geneve = netdev_priv(dev); - struct rtable *rt = NULL; -@@ -720,6 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, - memset(fl4, 0, sizeof(*fl4)); - fl4->flowi4_mark = skb->mark; - fl4->flowi4_proto = IPPROTO_UDP; -+ fl4->fl4_dport = dport; -+ fl4->fl4_sport = sport; - - if (info) { - fl4->daddr = info->key.u.ipv4.dst; -@@ -754,7 +757,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, - static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, - struct net_device *dev, - struct flowi6 *fl6, -- struct ip_tunnel_info *info) -+ struct ip_tunnel_info *info, -+ __be16 dport, __be16 sport) - { - struct geneve_dev *geneve = netdev_priv(dev); - struct geneve_sock *gs6 = geneve->sock6; -@@ -764,6 +768,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, - memset(fl6, 0, sizeof(*fl6)); - fl6->flowi6_mark = skb->mark; - fl6->flowi6_proto = IPPROTO_UDP; -+ fl6->fl6_dport = dport; -+ fl6->fl6_sport = sport; - - if (info) { - fl6->daddr = info->key.u.ipv6.dst; -@@ -834,13 +840,14 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, - goto tx_error; - } - -- rt = geneve_get_v4_rt(skb, dev, &fl4, info); -+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); -+ rt = geneve_get_v4_rt(skb, dev, &fl4, info, -+ geneve->dst_port, sport); - if (IS_ERR(rt)) { - err = PTR_ERR(rt); - goto tx_error; - } - -- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); - skb_reset_mac_header(skb); - - if (info) { -@@ -916,13 +923,14 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, - } - } - -- dst = geneve_get_v6_dst(skb, dev, &fl6, info); -+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); -+ dst = geneve_get_v6_dst(skb, dev, &fl6, info, -+ geneve->dst_port, sport); - if (IS_ERR(dst)) { - err = PTR_ERR(dst); - goto tx_error; - } - -- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); - skb_reset_mac_header(skb); - - if (info) { -@@ -1011,9 +1019,14 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) - struct dst_entry *dst; - struct flowi6 fl6; - #endif -+ __be16 sport; - - if (ip_tunnel_info_af(info) == AF_INET) { -- rt = geneve_get_v4_rt(skb, dev, &fl4, info); -+ sport = udp_flow_src_port(geneve->net, skb, -+ 1, USHRT_MAX, true); -+ -+ rt = geneve_get_v4_rt(skb, dev, &fl4, info, -+ geneve->dst_port, sport); - if (IS_ERR(rt)) - return PTR_ERR(rt); - -@@ -1021,7 +1034,11 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) - info->key.u.ipv4.src = fl4.saddr; - #if IS_ENABLED(CONFIG_IPV6) - } else if (ip_tunnel_info_af(info) == AF_INET6) { -- dst = geneve_get_v6_dst(skb, dev, &fl6, info); -+ sport = udp_flow_src_port(geneve->net, skb, -+ 1, USHRT_MAX, true); -+ -+ dst = geneve_get_v6_dst(skb, dev, &fl6, info, -+ geneve->dst_port, sport); - if (IS_ERR(dst)) - return PTR_ERR(dst); - -@@ -1032,8 +1049,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) - return -EINVAL; - } - -- info->key.tp_src = udp_flow_src_port(geneve->net, skb, -- 1, USHRT_MAX, true); -+ info->key.tp_src = sport; - info->key.tp_dst = geneve->dst_port; - return 0; - } -diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c -index 848ea6a399f23..cbda69e58e084 100644 ---- a/drivers/net/wan/cosa.c -+++ b/drivers/net/wan/cosa.c -@@ -903,6 +903,7 @@ static ssize_t cosa_write(struct file *file, - chan->tx_status = 1; - spin_unlock_irqrestore(&cosa->lock, flags); - up(&chan->wsem); -+ kfree(kbuf); - return -ERESTARTSYS; - } - } -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -index 91d199481a37c..64ff52eed9f53 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -@@ -972,7 +972,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, - struct ath_htc_rx_status *rxstatus; - struct ath_rx_status rx_stats; - bool decrypt_error = false; -- __be16 rs_datalen; -+ u16 rs_datalen; - bool is_phyerr; - - if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { -diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h -index 34173b5e886fb..53c2fa244c64b 100644 ---- a/drivers/net/xen-netback/common.h -+++ b/drivers/net/xen-netback/common.h -@@ -137,6 +137,20 @@ struct xenvif_queue { /* Per-queue data for xenvif */ - char name[QUEUE_NAME_SIZE]; /* DEVNAME-qN */ - struct xenvif *vif; /* Parent VIF */ - -+ /* -+ * TX/RX common EOI handling. -+ * When feature-split-event-channels = 0, interrupt handler sets -+ * NETBK_COMMON_EOI, otherwise NETBK_RX_EOI and NETBK_TX_EOI are set -+ * by the RX and TX interrupt handlers. -+ * RX and TX handler threads will issue an EOI when either -+ * NETBK_COMMON_EOI or their specific bits (NETBK_RX_EOI or -+ * NETBK_TX_EOI) are set and they will reset those bits. -+ */ -+ atomic_t eoi_pending; -+#define NETBK_RX_EOI 0x01 -+#define NETBK_TX_EOI 0x02 -+#define NETBK_COMMON_EOI 0x04 -+ - /* Use NAPI for guest TX */ - struct napi_struct napi; - /* When feature-split-event-channels = 0, tx_irq = rx_irq. */ -@@ -317,6 +331,7 @@ void xenvif_kick_thread(struct xenvif_queue *queue); - - int xenvif_dealloc_kthread(void *data); - -+bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread); - void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); - - void xenvif_carrier_on(struct xenvif *vif); -@@ -353,4 +368,28 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue); - bool xenvif_mcast_match(struct xenvif *vif, const u8 *addr); - void xenvif_mcast_addr_list_free(struct xenvif *vif); - -+#include -+ -+static inline int xenvif_atomic_fetch_or(int i, atomic_t *v) -+{ -+ int c, old; -+ -+ c = v->counter; -+ while ((old = cmpxchg(&v->counter, c, c | i)) != c) -+ c = old; -+ -+ return c; -+} -+ -+static inline int xenvif_atomic_fetch_andnot(int i, atomic_t *v) -+{ -+ int c, old; -+ -+ c = v->counter; -+ while ((old = cmpxchg(&v->counter, c, c & ~i)) != c) -+ c = old; -+ -+ return c; -+} -+ - #endif /* __XEN_NETBACK__COMMON_H__ */ -diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c -index 2008c6a02b8a7..66260ea74d7dd 100644 ---- a/drivers/net/xen-netback/interface.c -+++ b/drivers/net/xen-netback/interface.c -@@ -76,12 +76,28 @@ int xenvif_schedulable(struct xenvif *vif) - !vif->disabled; - } - -+static bool xenvif_handle_tx_interrupt(struct xenvif_queue *queue) -+{ -+ bool rc; -+ -+ rc = RING_HAS_UNCONSUMED_REQUESTS(&queue->tx); -+ if (rc) -+ napi_schedule(&queue->napi); -+ return rc; -+} -+ - static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id) - { - struct xenvif_queue *queue = dev_id; -+ int old; - -- if (RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)) -- napi_schedule(&queue->napi); -+ old = xenvif_atomic_fetch_or(NETBK_TX_EOI, &queue->eoi_pending); -+ WARN(old & NETBK_TX_EOI, "Interrupt while EOI pending\n"); -+ -+ if (!xenvif_handle_tx_interrupt(queue)) { -+ atomic_andnot(NETBK_TX_EOI, &queue->eoi_pending); -+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); -+ } - - return IRQ_HANDLED; - } -@@ -115,19 +131,46 @@ static int xenvif_poll(struct napi_struct *napi, int budget) - return work_done; - } - -+static bool xenvif_handle_rx_interrupt(struct xenvif_queue *queue) -+{ -+ bool rc; -+ -+ rc = xenvif_have_rx_work(queue, false); -+ if (rc) -+ xenvif_kick_thread(queue); -+ return rc; -+} -+ - static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id) - { - struct xenvif_queue *queue = dev_id; -+ int old; - -- xenvif_kick_thread(queue); -+ old = xenvif_atomic_fetch_or(NETBK_RX_EOI, &queue->eoi_pending); -+ WARN(old & NETBK_RX_EOI, "Interrupt while EOI pending\n"); -+ -+ if (!xenvif_handle_rx_interrupt(queue)) { -+ atomic_andnot(NETBK_RX_EOI, &queue->eoi_pending); -+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); -+ } - - return IRQ_HANDLED; - } - - irqreturn_t xenvif_interrupt(int irq, void *dev_id) - { -- xenvif_tx_interrupt(irq, dev_id); -- xenvif_rx_interrupt(irq, dev_id); -+ struct xenvif_queue *queue = dev_id; -+ int old; -+ -+ old = xenvif_atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending); -+ WARN(old, "Interrupt while EOI pending\n"); -+ -+ /* Use bitwise or as we need to call both functions. */ -+ if ((!xenvif_handle_tx_interrupt(queue) | -+ !xenvif_handle_rx_interrupt(queue))) { -+ atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending); -+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); -+ } - - return IRQ_HANDLED; - } -@@ -555,7 +598,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref, - - if (tx_evtchn == rx_evtchn) { - /* feature-split-event-channels == 0 */ -- err = bind_interdomain_evtchn_to_irqhandler( -+ err = bind_interdomain_evtchn_to_irqhandler_lateeoi( - queue->vif->domid, tx_evtchn, xenvif_interrupt, 0, - queue->name, queue); - if (err < 0) -@@ -566,7 +609,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref, - /* feature-split-event-channels == 1 */ - snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name), - "%s-tx", queue->name); -- err = bind_interdomain_evtchn_to_irqhandler( -+ err = bind_interdomain_evtchn_to_irqhandler_lateeoi( - queue->vif->domid, tx_evtchn, xenvif_tx_interrupt, 0, - queue->tx_irq_name, queue); - if (err < 0) -@@ -576,7 +619,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref, - - snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name), - "%s-rx", queue->name); -- err = bind_interdomain_evtchn_to_irqhandler( -+ err = bind_interdomain_evtchn_to_irqhandler_lateeoi( - queue->vif->domid, rx_evtchn, xenvif_rx_interrupt, 0, - queue->rx_irq_name, queue); - if (err < 0) -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 65d37257e033b..ee7a800c16d54 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -670,6 +670,10 @@ void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue) - - if (more_to_do) - napi_schedule(&queue->napi); -+ else if (xenvif_atomic_fetch_andnot(NETBK_TX_EOI | NETBK_COMMON_EOI, -+ &queue->eoi_pending) & -+ (NETBK_TX_EOI | NETBK_COMMON_EOI)) -+ xen_irq_lateeoi(queue->tx_irq, 0); - } - - static void tx_add_credit(struct xenvif_queue *queue) -@@ -2010,14 +2014,14 @@ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue) - return queue->stalled && prod - cons >= 1; - } - --static bool xenvif_have_rx_work(struct xenvif_queue *queue) -+bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread) - { - return (!skb_queue_empty(&queue->rx_queue) - && xenvif_rx_ring_slots_available(queue)) - || (queue->vif->stall_timeout && - (xenvif_rx_queue_stalled(queue) - || xenvif_rx_queue_ready(queue))) -- || kthread_should_stop() -+ || (test_kthread && kthread_should_stop()) - || queue->vif->disabled; - } - -@@ -2048,15 +2052,20 @@ static void xenvif_wait_for_rx_work(struct xenvif_queue *queue) - { - DEFINE_WAIT(wait); - -- if (xenvif_have_rx_work(queue)) -+ if (xenvif_have_rx_work(queue, true)) - return; - - for (;;) { - long ret; - - prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE); -- if (xenvif_have_rx_work(queue)) -+ if (xenvif_have_rx_work(queue, true)) - break; -+ if (xenvif_atomic_fetch_andnot(NETBK_RX_EOI | NETBK_COMMON_EOI, -+ &queue->eoi_pending) & -+ (NETBK_RX_EOI | NETBK_COMMON_EOI)) -+ xen_irq_lateeoi(queue->rx_irq, 0); -+ - ret = schedule_timeout(xenvif_rx_queue_timeout(queue)); - if (!ret) - break; -diff --git a/drivers/of/address.c b/drivers/of/address.c -index b3bf8762f4e8c..77881432dd404 100644 ---- a/drivers/of/address.c -+++ b/drivers/of/address.c -@@ -1014,11 +1014,13 @@ EXPORT_SYMBOL_GPL(of_dma_get_range); - */ - bool of_dma_is_coherent(struct device_node *np) - { -- struct device_node *node = of_node_get(np); -+ struct device_node *node; - - if (IS_ENABLED(CONFIG_OF_DMA_DEFAULT_COHERENT)) - return true; - -+ node = of_node_get(np); -+ - while (node) { - if (of_property_read_bool(node, "dma-coherent")) { - of_node_put(node); -diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c -index fe04e748dfe4b..eb8c29f3e16ef 100644 ---- a/drivers/pinctrl/devicetree.c -+++ b/drivers/pinctrl/devicetree.c -@@ -40,6 +40,13 @@ struct pinctrl_dt_map { - static void dt_free_map(struct pinctrl_dev *pctldev, - struct pinctrl_map *map, unsigned num_maps) - { -+ int i; -+ -+ for (i = 0; i < num_maps; ++i) { -+ kfree_const(map[i].dev_name); -+ map[i].dev_name = NULL; -+ } -+ - if (pctldev) { - const struct pinctrl_ops *ops = pctldev->desc->pctlops; - ops->dt_free_map(pctldev, map, num_maps); -@@ -73,7 +80,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - - /* Initialize common mapping table entry fields */ - for (i = 0; i < num_maps; i++) { -- map[i].dev_name = dev_name(p->dev); -+ const char *devname; -+ -+ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); -+ if (!devname) -+ goto err_free_map; -+ -+ map[i].dev_name = devname; - map[i].name = statename; - if (pctldev) - map[i].ctrl_dev_name = dev_name(pctldev->dev); -@@ -81,11 +94,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - - /* Remember the converted mapping table entries */ - dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); -- if (!dt_map) { -- dev_err(p->dev, "failed to alloc struct pinctrl_dt_map\n"); -- dt_free_map(pctldev, map, num_maps); -- return -ENOMEM; -- } -+ if (!dt_map) -+ goto err_free_map; - - dt_map->pctldev = pctldev; - dt_map->map = map; -@@ -93,6 +103,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - list_add_tail(&dt_map->node, &p->dt_maps); - - return pinctrl_register_map(map, num_maps, false); -+ -+err_free_map: -+ dt_free_map(pctldev, map, num_maps); -+ return -ENOMEM; - } - - struct pinctrl_dev *of_pinctrl_get(struct device_node *np) -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index 7340ff78839a3..a3b27856b9e97 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -144,7 +144,7 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset, - pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); - pin_reg &= ~BIT(DB_TMR_LARGE_OFF); - } else if (debounce < 250000) { -- time = debounce / 15600; -+ time = debounce / 15625; - pin_reg |= time & DB_TMR_OUT_MASK; - pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF); - pin_reg |= BIT(DB_TMR_LARGE_OFF); -@@ -154,14 +154,14 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset, - pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); - pin_reg |= BIT(DB_TMR_LARGE_OFF); - } else { -- pin_reg &= ~DB_CNTRl_MASK; -+ pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF); - ret = -EINVAL; - } - } else { - pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF); - pin_reg &= ~BIT(DB_TMR_LARGE_OFF); - pin_reg &= ~DB_TMR_OUT_MASK; -- pin_reg &= ~DB_CNTRl_MASK; -+ pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF); - } - writel(pin_reg, gpio_dev->base + offset * 4); - spin_unlock_irqrestore(&gpio_dev->lock, flags); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index fb7e56fad41c8..a74a5c0eba6e4 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1693,6 +1693,15 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -+ { USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */ -+ .driver_info = DISABLE_ECHO, /* Don't echo banner */ -+ }, -+ { USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */ -+ .driver_info = DISABLE_ECHO, /* Don't echo banner */ -+ }, -+ { USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */ -+ .driver_info = DISABLE_ECHO, /* Don't echo banner */ -+ }, - { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c -index 1fdfec14a3ba1..5d4616061309e 100644 ---- a/drivers/usb/gadget/udc/goku_udc.c -+++ b/drivers/usb/gadget/udc/goku_udc.c -@@ -1773,6 +1773,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) - goto err; - } - -+ pci_set_drvdata(pdev, dev); - spin_lock_init(&dev->lock); - dev->pdev = pdev; - dev->gadget.ops = &goku_ops; -@@ -1806,7 +1807,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) - } - dev->regs = (struct goku_udc_regs __iomem *) base; - -- pci_set_drvdata(pdev, dev); - INFO(dev, "%s\n", driver_desc); - INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr()); - INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base); -diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c -index 7dd46312c1802..e902512fcfb50 100644 ---- a/drivers/xen/events/events_2l.c -+++ b/drivers/xen/events/events_2l.c -@@ -90,6 +90,8 @@ static void evtchn_2l_unmask(unsigned port) - - BUG_ON(!irqs_disabled()); - -+ smp_wmb(); /* All writes before unmask must be visible. */ -+ - if (unlikely((cpu != cpu_from_evtchn(port)))) - do_hypercall = 1; - else { -@@ -158,7 +160,7 @@ static inline xen_ulong_t active_evtchns(unsigned int cpu, - * a bitset of words which contain pending event bits. The second - * level is a bitset of pending events themselves. - */ --static void evtchn_2l_handle_events(unsigned cpu) -+static void evtchn_2l_handle_events(unsigned cpu, struct evtchn_loop_ctrl *ctrl) - { - int irq; - xen_ulong_t pending_words; -@@ -239,10 +241,7 @@ static void evtchn_2l_handle_events(unsigned cpu) - - /* Process port. */ - port = (word_idx * BITS_PER_EVTCHN_WORD) + bit_idx; -- irq = get_evtchn_to_irq(port); -- -- if (irq != -1) -- generic_handle_irq(irq); -+ handle_irq_for_port(port, ctrl); - - bit_idx = (bit_idx + 1) % BITS_PER_EVTCHN_WORD; - -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 9a126732d5d9c..ec4074c66d9db 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -32,6 +32,10 @@ - #include - #include - #include -+#include -+#include -+#include -+#include - - #ifdef CONFIG_X86 - #include -@@ -62,6 +66,15 @@ - - #include "events_internal.h" - -+#undef MODULE_PARAM_PREFIX -+#define MODULE_PARAM_PREFIX "xen." -+ -+static uint __read_mostly event_loop_timeout = 2; -+module_param(event_loop_timeout, uint, 0644); -+ -+static uint __read_mostly event_eoi_delay = 10; -+module_param(event_eoi_delay, uint, 0644); -+ - const struct evtchn_ops *evtchn_ops; - - /* -@@ -70,6 +83,24 @@ const struct evtchn_ops *evtchn_ops; - */ - static DEFINE_MUTEX(irq_mapping_update_lock); - -+/* -+ * Lock protecting event handling loop against removing event channels. -+ * Adding of event channels is no issue as the associated IRQ becomes active -+ * only after everything is setup (before request_[threaded_]irq() the handler -+ * can't be entered for an event, as the event channel will be unmasked only -+ * then). -+ */ -+static DEFINE_RWLOCK(evtchn_rwlock); -+ -+/* -+ * Lock hierarchy: -+ * -+ * irq_mapping_update_lock -+ * evtchn_rwlock -+ * IRQ-desc lock -+ * percpu eoi_list_lock -+ */ -+ - static LIST_HEAD(xen_irq_list_head); - - /* IRQ <-> VIRQ mapping. */ -@@ -94,17 +125,20 @@ static bool (*pirq_needs_eoi)(unsigned irq); - static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY]; - - static struct irq_chip xen_dynamic_chip; -+static struct irq_chip xen_lateeoi_chip; - static struct irq_chip xen_percpu_chip; - static struct irq_chip xen_pirq_chip; - static void enable_dynirq(struct irq_data *data); - static void disable_dynirq(struct irq_data *data); - -+static DEFINE_PER_CPU(unsigned int, irq_epoch); -+ - static void clear_evtchn_to_irq_row(unsigned row) - { - unsigned col; - - for (col = 0; col < EVTCHN_PER_ROW; col++) -- evtchn_to_irq[row][col] = -1; -+ WRITE_ONCE(evtchn_to_irq[row][col], -1); - } - - static void clear_evtchn_to_irq_all(void) -@@ -141,7 +175,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) - clear_evtchn_to_irq_row(row); - } - -- evtchn_to_irq[row][col] = irq; -+ WRITE_ONCE(evtchn_to_irq[row][col], irq); - return 0; - } - -@@ -151,7 +185,7 @@ int get_evtchn_to_irq(unsigned evtchn) - return -1; - if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL) - return -1; -- return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]; -+ return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]); - } - - /* Get info for IRQ */ -@@ -260,10 +294,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) - */ - unsigned int evtchn_from_irq(unsigned irq) - { -- if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq))) -+ const struct irq_info *info = NULL; -+ -+ if (likely(irq < nr_irqs)) -+ info = info_for_irq(irq); -+ if (!info) - return 0; - -- return info_for_irq(irq)->evtchn; -+ return info->evtchn; - } - - unsigned irq_from_evtchn(unsigned int evtchn) -@@ -382,9 +420,157 @@ void notify_remote_via_irq(int irq) - } - EXPORT_SYMBOL_GPL(notify_remote_via_irq); - -+struct lateeoi_work { -+ struct delayed_work delayed; -+ spinlock_t eoi_list_lock; -+ struct list_head eoi_list; -+}; -+ -+static DEFINE_PER_CPU(struct lateeoi_work, lateeoi); -+ -+static void lateeoi_list_del(struct irq_info *info) -+{ -+ struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu); -+ unsigned long flags; -+ -+ spin_lock_irqsave(&eoi->eoi_list_lock, flags); -+ list_del_init(&info->eoi_list); -+ spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); -+} -+ -+static void lateeoi_list_add(struct irq_info *info) -+{ -+ struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu); -+ struct irq_info *elem; -+ u64 now = get_jiffies_64(); -+ unsigned long delay; -+ unsigned long flags; -+ -+ if (now < info->eoi_time) -+ delay = info->eoi_time - now; -+ else -+ delay = 1; -+ -+ spin_lock_irqsave(&eoi->eoi_list_lock, flags); -+ -+ if (list_empty(&eoi->eoi_list)) { -+ list_add(&info->eoi_list, &eoi->eoi_list); -+ mod_delayed_work_on(info->eoi_cpu, system_wq, -+ &eoi->delayed, delay); -+ } else { -+ list_for_each_entry_reverse(elem, &eoi->eoi_list, eoi_list) { -+ if (elem->eoi_time <= info->eoi_time) -+ break; -+ } -+ list_add(&info->eoi_list, &elem->eoi_list); -+ } -+ -+ spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); -+} -+ -+static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious) -+{ -+ evtchn_port_t evtchn; -+ unsigned int cpu; -+ unsigned int delay = 0; -+ -+ evtchn = info->evtchn; -+ if (!VALID_EVTCHN(evtchn) || !list_empty(&info->eoi_list)) -+ return; -+ -+ if (spurious) { -+ if ((1 << info->spurious_cnt) < (HZ << 2)) -+ info->spurious_cnt++; -+ if (info->spurious_cnt > 1) { -+ delay = 1 << (info->spurious_cnt - 2); -+ if (delay > HZ) -+ delay = HZ; -+ if (!info->eoi_time) -+ info->eoi_cpu = smp_processor_id(); -+ info->eoi_time = get_jiffies_64() + delay; -+ } -+ } else { -+ info->spurious_cnt = 0; -+ } -+ -+ cpu = info->eoi_cpu; -+ if (info->eoi_time && -+ (info->irq_epoch == per_cpu(irq_epoch, cpu) || delay)) { -+ lateeoi_list_add(info); -+ return; -+ } -+ -+ info->eoi_time = 0; -+ unmask_evtchn(evtchn); -+} -+ -+static void xen_irq_lateeoi_worker(struct work_struct *work) -+{ -+ struct lateeoi_work *eoi; -+ struct irq_info *info; -+ u64 now = get_jiffies_64(); -+ unsigned long flags; -+ -+ eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); -+ -+ read_lock_irqsave(&evtchn_rwlock, flags); -+ -+ while (true) { -+ spin_lock(&eoi->eoi_list_lock); -+ -+ info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, -+ eoi_list); -+ -+ if (info == NULL || now < info->eoi_time) { -+ spin_unlock(&eoi->eoi_list_lock); -+ break; -+ } -+ -+ list_del_init(&info->eoi_list); -+ -+ spin_unlock(&eoi->eoi_list_lock); -+ -+ info->eoi_time = 0; -+ -+ xen_irq_lateeoi_locked(info, false); -+ } -+ -+ if (info) -+ mod_delayed_work_on(info->eoi_cpu, system_wq, -+ &eoi->delayed, info->eoi_time - now); -+ -+ read_unlock_irqrestore(&evtchn_rwlock, flags); -+} -+ -+static void xen_cpu_init_eoi(unsigned int cpu) -+{ -+ struct lateeoi_work *eoi = &per_cpu(lateeoi, cpu); -+ -+ INIT_DELAYED_WORK(&eoi->delayed, xen_irq_lateeoi_worker); -+ spin_lock_init(&eoi->eoi_list_lock); -+ INIT_LIST_HEAD(&eoi->eoi_list); -+} -+ -+void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) -+{ -+ struct irq_info *info; -+ unsigned long flags; -+ -+ read_lock_irqsave(&evtchn_rwlock, flags); -+ -+ info = info_for_irq(irq); -+ -+ if (info) -+ xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS); -+ -+ read_unlock_irqrestore(&evtchn_rwlock, flags); -+} -+EXPORT_SYMBOL_GPL(xen_irq_lateeoi); -+ - static void xen_irq_init(unsigned irq) - { - struct irq_info *info; -+ - #ifdef CONFIG_SMP - /* By default all event channels notify CPU#0. */ - cpumask_copy(irq_get_affinity_mask(irq), cpumask_of(0)); -@@ -399,6 +585,7 @@ static void xen_irq_init(unsigned irq) - - set_info_for_irq(irq, info); - -+ INIT_LIST_HEAD(&info->eoi_list); - list_add_tail(&info->list, &xen_irq_list_head); - } - -@@ -447,16 +634,24 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) - static void xen_free_irq(unsigned irq) - { - struct irq_info *info = info_for_irq(irq); -+ unsigned long flags; - - if (WARN_ON(!info)) - return; - -+ write_lock_irqsave(&evtchn_rwlock, flags); -+ -+ if (!list_empty(&info->eoi_list)) -+ lateeoi_list_del(info); -+ - list_del(&info->list); - - set_info_for_irq(irq, NULL); - - WARN_ON(info->refcnt > 0); - -+ write_unlock_irqrestore(&evtchn_rwlock, flags); -+ - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ -@@ -848,7 +1043,7 @@ int xen_pirq_from_irq(unsigned irq) - } - EXPORT_SYMBOL_GPL(xen_pirq_from_irq); - --int bind_evtchn_to_irq(unsigned int evtchn) -+static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip) - { - int irq; - int ret; -@@ -865,7 +1060,7 @@ int bind_evtchn_to_irq(unsigned int evtchn) - if (irq < 0) - goto out; - -- irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, -+ irq_set_chip_and_handler_name(irq, chip, - handle_edge_irq, "event"); - - ret = xen_irq_info_evtchn_setup(irq, evtchn); -@@ -886,8 +1081,19 @@ out: - - return irq; - } -+ -+int bind_evtchn_to_irq(evtchn_port_t evtchn) -+{ -+ return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip); -+} - EXPORT_SYMBOL_GPL(bind_evtchn_to_irq); - -+int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn) -+{ -+ return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip); -+} -+EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi); -+ - static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) - { - struct evtchn_bind_ipi bind_ipi; -@@ -929,8 +1135,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) - return irq; - } - --int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, -- unsigned int remote_port) -+static int bind_interdomain_evtchn_to_irq_chip(unsigned int remote_domain, -+ evtchn_port_t remote_port, -+ struct irq_chip *chip) - { - struct evtchn_bind_interdomain bind_interdomain; - int err; -@@ -941,10 +1148,26 @@ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, - err = HYPERVISOR_event_channel_op(EVTCHNOP_bind_interdomain, - &bind_interdomain); - -- return err ? : bind_evtchn_to_irq(bind_interdomain.local_port); -+ return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port, -+ chip); -+} -+ -+int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, -+ evtchn_port_t remote_port) -+{ -+ return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port, -+ &xen_dynamic_chip); - } - EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq); - -+int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain, -+ evtchn_port_t remote_port) -+{ -+ return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port, -+ &xen_lateeoi_chip); -+} -+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi); -+ - static int find_virq(unsigned int virq, unsigned int cpu) - { - struct evtchn_status status; -@@ -1040,14 +1263,15 @@ static void unbind_from_irq(unsigned int irq) - mutex_unlock(&irq_mapping_update_lock); - } - --int bind_evtchn_to_irqhandler(unsigned int evtchn, -- irq_handler_t handler, -- unsigned long irqflags, -- const char *devname, void *dev_id) -+static int bind_evtchn_to_irqhandler_chip(evtchn_port_t evtchn, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, void *dev_id, -+ struct irq_chip *chip) - { - int irq, retval; - -- irq = bind_evtchn_to_irq(evtchn); -+ irq = bind_evtchn_to_irq_chip(evtchn, chip); - if (irq < 0) - return irq; - retval = request_irq(irq, handler, irqflags, devname, dev_id); -@@ -1058,18 +1282,38 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, - - return irq; - } -+ -+int bind_evtchn_to_irqhandler(evtchn_port_t evtchn, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, void *dev_id) -+{ -+ return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags, -+ devname, dev_id, -+ &xen_dynamic_chip); -+} - EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler); - --int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, -- unsigned int remote_port, -- irq_handler_t handler, -- unsigned long irqflags, -- const char *devname, -- void *dev_id) -+int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, void *dev_id) -+{ -+ return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags, -+ devname, dev_id, -+ &xen_lateeoi_chip); -+} -+EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler_lateeoi); -+ -+static int bind_interdomain_evtchn_to_irqhandler_chip( -+ unsigned int remote_domain, evtchn_port_t remote_port, -+ irq_handler_t handler, unsigned long irqflags, -+ const char *devname, void *dev_id, struct irq_chip *chip) - { - int irq, retval; - -- irq = bind_interdomain_evtchn_to_irq(remote_domain, remote_port); -+ irq = bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port, -+ chip); - if (irq < 0) - return irq; - -@@ -1081,8 +1325,33 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, - - return irq; - } -+ -+int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, -+ evtchn_port_t remote_port, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, -+ void *dev_id) -+{ -+ return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain, -+ remote_port, handler, irqflags, devname, -+ dev_id, &xen_dynamic_chip); -+} - EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler); - -+int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain, -+ evtchn_port_t remote_port, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, -+ void *dev_id) -+{ -+ return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain, -+ remote_port, handler, irqflags, devname, -+ dev_id, &xen_lateeoi_chip); -+} -+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler_lateeoi); -+ - int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, - irq_handler_t handler, - unsigned long irqflags, const char *devname, void *dev_id) -@@ -1195,7 +1464,7 @@ int evtchn_get(unsigned int evtchn) - goto done; - - err = -EINVAL; -- if (info->refcnt <= 0) -+ if (info->refcnt <= 0 || info->refcnt == SHRT_MAX) - goto done; - - info->refcnt++; -@@ -1233,6 +1502,54 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector) - notify_remote_via_irq(irq); - } - -+struct evtchn_loop_ctrl { -+ ktime_t timeout; -+ unsigned count; -+ bool defer_eoi; -+}; -+ -+void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl) -+{ -+ int irq; -+ struct irq_info *info; -+ -+ irq = get_evtchn_to_irq(port); -+ if (irq == -1) -+ return; -+ -+ /* -+ * Check for timeout every 256 events. -+ * We are setting the timeout value only after the first 256 -+ * events in order to not hurt the common case of few loop -+ * iterations. The 256 is basically an arbitrary value. -+ * -+ * In case we are hitting the timeout we need to defer all further -+ * EOIs in order to ensure to leave the event handling loop rather -+ * sooner than later. -+ */ -+ if (!ctrl->defer_eoi && !(++ctrl->count & 0xff)) { -+ ktime_t kt = ktime_get(); -+ -+ if (!ctrl->timeout.tv64) { -+ kt = ktime_add_ms(kt, -+ jiffies_to_msecs(event_loop_timeout)); -+ ctrl->timeout = kt; -+ } else if (kt.tv64 > ctrl->timeout.tv64) { -+ ctrl->defer_eoi = true; -+ } -+ } -+ -+ info = info_for_irq(irq); -+ -+ if (ctrl->defer_eoi) { -+ info->eoi_cpu = smp_processor_id(); -+ info->irq_epoch = __this_cpu_read(irq_epoch); -+ info->eoi_time = get_jiffies_64() + event_eoi_delay; -+ } -+ -+ generic_handle_irq(irq); -+} -+ - static DEFINE_PER_CPU(unsigned, xed_nesting_count); - - static void __xen_evtchn_do_upcall(void) -@@ -1240,6 +1557,9 @@ static void __xen_evtchn_do_upcall(void) - struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu); - int cpu = get_cpu(); - unsigned count; -+ struct evtchn_loop_ctrl ctrl = { 0 }; -+ -+ read_lock(&evtchn_rwlock); - - do { - vcpu_info->evtchn_upcall_pending = 0; -@@ -1247,7 +1567,7 @@ static void __xen_evtchn_do_upcall(void) - if (__this_cpu_inc_return(xed_nesting_count) - 1) - goto out; - -- xen_evtchn_handle_events(cpu); -+ xen_evtchn_handle_events(cpu, &ctrl); - - BUG_ON(!irqs_disabled()); - -@@ -1256,6 +1576,14 @@ static void __xen_evtchn_do_upcall(void) - } while (count != 1 || vcpu_info->evtchn_upcall_pending); - - out: -+ read_unlock(&evtchn_rwlock); -+ -+ /* -+ * Increment irq_epoch only now to defer EOIs only for -+ * xen_irq_lateeoi() invocations occurring from inside the loop -+ * above. -+ */ -+ __this_cpu_inc(irq_epoch); - - put_cpu(); - } -@@ -1612,6 +1940,21 @@ static struct irq_chip xen_dynamic_chip __read_mostly = { - .irq_retrigger = retrigger_dynirq, - }; - -+static struct irq_chip xen_lateeoi_chip __read_mostly = { -+ /* The chip name needs to contain "xen-dyn" for irqbalance to work. */ -+ .name = "xen-dyn-lateeoi", -+ -+ .irq_disable = disable_dynirq, -+ .irq_mask = disable_dynirq, -+ .irq_unmask = enable_dynirq, -+ -+ .irq_ack = mask_ack_dynirq, -+ .irq_mask_ack = mask_ack_dynirq, -+ -+ .irq_set_affinity = set_affinity_irq, -+ .irq_retrigger = retrigger_dynirq, -+}; -+ - static struct irq_chip xen_pirq_chip __read_mostly = { - .name = "xen-pirq", - -@@ -1679,12 +2022,55 @@ void xen_callback_vector(void) - void xen_callback_vector(void) {} - #endif - --#undef MODULE_PARAM_PREFIX --#define MODULE_PARAM_PREFIX "xen." -- - static bool fifo_events = true; - module_param(fifo_events, bool, 0); - -+static int xen_evtchn_cpu_prepare(unsigned int cpu) -+{ -+ int ret = 0; -+ -+ xen_cpu_init_eoi(cpu); -+ -+ if (evtchn_ops->percpu_init) -+ ret = evtchn_ops->percpu_init(cpu); -+ -+ return ret; -+} -+ -+static int xen_evtchn_cpu_dead(unsigned int cpu) -+{ -+ int ret = 0; -+ -+ if (evtchn_ops->percpu_deinit) -+ ret = evtchn_ops->percpu_deinit(cpu); -+ -+ return ret; -+} -+ -+static int evtchn_cpu_notification(struct notifier_block *self, -+ unsigned long action, void *hcpu) -+{ -+ int cpu = (long)hcpu; -+ int ret = 0; -+ -+ switch (action) { -+ case CPU_UP_PREPARE: -+ ret = xen_evtchn_cpu_prepare(cpu); -+ break; -+ case CPU_DEAD: -+ ret = xen_evtchn_cpu_dead(cpu); -+ break; -+ default: -+ break; -+ } -+ -+ return ret < 0 ? NOTIFY_BAD : NOTIFY_OK; -+} -+ -+static struct notifier_block evtchn_cpu_notifier = { -+ .notifier_call = evtchn_cpu_notification, -+}; -+ - void __init xen_init_IRQ(void) - { - int ret = -EINVAL; -@@ -1694,6 +2080,10 @@ void __init xen_init_IRQ(void) - if (ret < 0) - xen_evtchn_2l_init(); - -+ xen_cpu_init_eoi(smp_processor_id()); -+ -+ register_cpu_notifier(&evtchn_cpu_notifier); -+ - evtchn_to_irq = kcalloc(EVTCHN_ROW(xen_evtchn_max_channels()), - sizeof(*evtchn_to_irq), GFP_KERNEL); - BUG_ON(!evtchn_to_irq); -diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c -index 96a1b8da53715..7addca0d8d26b 100644 ---- a/drivers/xen/events/events_fifo.c -+++ b/drivers/xen/events/events_fifo.c -@@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(unsigned port) - return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word)); - } - /* -- * Clear MASKED, spinning if BUSY is set. -+ * Clear MASKED if not PENDING, spinning if BUSY is set. -+ * Return true if mask was cleared. - */ --static void clear_masked(volatile event_word_t *word) -+static bool clear_masked_cond(volatile event_word_t *word) - { - event_word_t new, old, w; - - w = *word; - - do { -+ if (w & (1 << EVTCHN_FIFO_PENDING)) -+ return false; -+ - old = w & ~(1 << EVTCHN_FIFO_BUSY); - new = old & ~(1 << EVTCHN_FIFO_MASKED); - w = sync_cmpxchg(word, old, new); - } while (w != old); -+ -+ return true; - } - - static void evtchn_fifo_unmask(unsigned port) -@@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(unsigned port) - - BUG_ON(!irqs_disabled()); - -- clear_masked(word); -- if (evtchn_fifo_is_pending(port)) { -+ if (!clear_masked_cond(word)) { - struct evtchn_unmask unmask = { .port = port }; - (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask); - } -@@ -270,19 +275,9 @@ static uint32_t clear_linked(volatile event_word_t *word) - return w & EVTCHN_FIFO_LINK_MASK; - } - --static void handle_irq_for_port(unsigned port) --{ -- int irq; -- -- irq = get_evtchn_to_irq(port); -- if (irq != -1) -- generic_handle_irq(irq); --} -- --static void consume_one_event(unsigned cpu, -+static void consume_one_event(unsigned cpu, struct evtchn_loop_ctrl *ctrl, - struct evtchn_fifo_control_block *control_block, -- unsigned priority, unsigned long *ready, -- bool drop) -+ unsigned priority, unsigned long *ready) - { - struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu); - uint32_t head; -@@ -315,16 +310,17 @@ static void consume_one_event(unsigned cpu, - clear_bit(priority, ready); - - if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) { -- if (unlikely(drop)) -+ if (unlikely(!ctrl)) - pr_warn("Dropping pending event for port %u\n", port); - else -- handle_irq_for_port(port); -+ handle_irq_for_port(port, ctrl); - } - - q->head[priority] = head; - } - --static void __evtchn_fifo_handle_events(unsigned cpu, bool drop) -+static void __evtchn_fifo_handle_events(unsigned cpu, -+ struct evtchn_loop_ctrl *ctrl) - { - struct evtchn_fifo_control_block *control_block; - unsigned long ready; -@@ -336,14 +332,15 @@ static void __evtchn_fifo_handle_events(unsigned cpu, bool drop) - - while (ready) { - q = find_first_bit(&ready, EVTCHN_FIFO_MAX_QUEUES); -- consume_one_event(cpu, control_block, q, &ready, drop); -+ consume_one_event(cpu, ctrl, control_block, q, &ready); - ready |= xchg(&control_block->ready, 0); - } - } - --static void evtchn_fifo_handle_events(unsigned cpu) -+static void evtchn_fifo_handle_events(unsigned cpu, -+ struct evtchn_loop_ctrl *ctrl) - { -- __evtchn_fifo_handle_events(cpu, false); -+ __evtchn_fifo_handle_events(cpu, ctrl); - } - - static void evtchn_fifo_resume(void) -@@ -381,21 +378,6 @@ static void evtchn_fifo_resume(void) - event_array_pages = 0; - } - --static const struct evtchn_ops evtchn_ops_fifo = { -- .max_channels = evtchn_fifo_max_channels, -- .nr_channels = evtchn_fifo_nr_channels, -- .setup = evtchn_fifo_setup, -- .bind_to_cpu = evtchn_fifo_bind_to_cpu, -- .clear_pending = evtchn_fifo_clear_pending, -- .set_pending = evtchn_fifo_set_pending, -- .is_pending = evtchn_fifo_is_pending, -- .test_and_set_mask = evtchn_fifo_test_and_set_mask, -- .mask = evtchn_fifo_mask, -- .unmask = evtchn_fifo_unmask, -- .handle_events = evtchn_fifo_handle_events, -- .resume = evtchn_fifo_resume, --}; -- - static int evtchn_fifo_alloc_control_block(unsigned cpu) - { - void *control_block = NULL; -@@ -418,29 +400,34 @@ static int evtchn_fifo_alloc_control_block(unsigned cpu) - return ret; - } - --static int evtchn_fifo_cpu_notification(struct notifier_block *self, -- unsigned long action, -- void *hcpu) -+static int evtchn_fifo_percpu_init(unsigned int cpu) - { -- int cpu = (long)hcpu; -- int ret = 0; -- -- switch (action) { -- case CPU_UP_PREPARE: -- if (!per_cpu(cpu_control_block, cpu)) -- ret = evtchn_fifo_alloc_control_block(cpu); -- break; -- case CPU_DEAD: -- __evtchn_fifo_handle_events(cpu, true); -- break; -- default: -- break; -- } -- return ret < 0 ? NOTIFY_BAD : NOTIFY_OK; -+ if (!per_cpu(cpu_control_block, cpu)) -+ return evtchn_fifo_alloc_control_block(cpu); -+ return 0; -+} -+ -+static int evtchn_fifo_percpu_deinit(unsigned int cpu) -+{ -+ __evtchn_fifo_handle_events(cpu, NULL); -+ return 0; - } - --static struct notifier_block evtchn_fifo_cpu_notifier = { -- .notifier_call = evtchn_fifo_cpu_notification, -+static const struct evtchn_ops evtchn_ops_fifo = { -+ .max_channels = evtchn_fifo_max_channels, -+ .nr_channels = evtchn_fifo_nr_channels, -+ .setup = evtchn_fifo_setup, -+ .bind_to_cpu = evtchn_fifo_bind_to_cpu, -+ .clear_pending = evtchn_fifo_clear_pending, -+ .set_pending = evtchn_fifo_set_pending, -+ .is_pending = evtchn_fifo_is_pending, -+ .test_and_set_mask = evtchn_fifo_test_and_set_mask, -+ .mask = evtchn_fifo_mask, -+ .unmask = evtchn_fifo_unmask, -+ .handle_events = evtchn_fifo_handle_events, -+ .resume = evtchn_fifo_resume, -+ .percpu_init = evtchn_fifo_percpu_init, -+ .percpu_deinit = evtchn_fifo_percpu_deinit, - }; - - int __init xen_evtchn_fifo_init(void) -@@ -456,7 +443,6 @@ int __init xen_evtchn_fifo_init(void) - - evtchn_ops = &evtchn_ops_fifo; - -- register_cpu_notifier(&evtchn_fifo_cpu_notifier); - out: - put_cpu(); - return ret; -diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h -index 50c2050a1e320..b9b4f59198930 100644 ---- a/drivers/xen/events/events_internal.h -+++ b/drivers/xen/events/events_internal.h -@@ -32,11 +32,16 @@ enum xen_irq_type { - */ - struct irq_info { - struct list_head list; -- int refcnt; -+ struct list_head eoi_list; -+ short refcnt; -+ short spurious_cnt; - enum xen_irq_type type; /* type */ - unsigned irq; - unsigned int evtchn; /* event channel */ - unsigned short cpu; /* cpu bound */ -+ unsigned short eoi_cpu; /* EOI must happen on this cpu */ -+ unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */ -+ u64 eoi_time; /* Time in jiffies when to EOI. */ - - union { - unsigned short virq; -@@ -55,6 +60,8 @@ struct irq_info { - #define PIRQ_SHAREABLE (1 << 1) - #define PIRQ_MSI_GROUP (1 << 2) - -+struct evtchn_loop_ctrl; -+ - struct evtchn_ops { - unsigned (*max_channels)(void); - unsigned (*nr_channels)(void); -@@ -69,14 +76,18 @@ struct evtchn_ops { - void (*mask)(unsigned port); - void (*unmask)(unsigned port); - -- void (*handle_events)(unsigned cpu); -+ void (*handle_events)(unsigned cpu, struct evtchn_loop_ctrl *ctrl); - void (*resume)(void); -+ -+ int (*percpu_init)(unsigned int cpu); -+ int (*percpu_deinit)(unsigned int cpu); - }; - - extern const struct evtchn_ops *evtchn_ops; - - extern int **evtchn_to_irq; - int get_evtchn_to_irq(unsigned int evtchn); -+void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl); - - struct irq_info *info_for_irq(unsigned irq); - unsigned cpu_from_irq(unsigned irq); -@@ -134,9 +145,10 @@ static inline void unmask_evtchn(unsigned port) - return evtchn_ops->unmask(port); - } - --static inline void xen_evtchn_handle_events(unsigned cpu) -+static inline void xen_evtchn_handle_events(unsigned cpu, -+ struct evtchn_loop_ctrl *ctrl) - { -- return evtchn_ops->handle_events(cpu); -+ return evtchn_ops->handle_events(cpu, ctrl); - } - - static inline void xen_evtchn_resume(void) -diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c -index f4edd6df3df23..96c3007576b62 100644 ---- a/drivers/xen/evtchn.c -+++ b/drivers/xen/evtchn.c -@@ -173,7 +173,6 @@ static irqreturn_t evtchn_interrupt(int irq, void *data) - "Interrupt for port %d, but apparently not enabled; per-user %p\n", - evtchn->port, u); - -- disable_irq_nosync(irq); - evtchn->enabled = false; - - spin_lock(&u->ring_prod_lock); -@@ -299,7 +298,7 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf, - evtchn = find_evtchn(u, port); - if (evtchn && !evtchn->enabled) { - evtchn->enabled = true; -- enable_irq(irq_from_evtchn(port)); -+ xen_irq_lateeoi(irq_from_evtchn(port), 0); - } - } - -@@ -399,8 +398,8 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port) - if (rc < 0) - goto err; - -- rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, 0, -- u->name, evtchn); -+ rc = bind_evtchn_to_irqhandler_lateeoi(port, evtchn_interrupt, 0, -+ u->name, evtchn); - if (rc < 0) - goto err; - -diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c -index 47c6df53cabfb..e21b82921c335 100644 ---- a/drivers/xen/xen-pciback/pci_stub.c -+++ b/drivers/xen/xen-pciback/pci_stub.c -@@ -681,10 +681,17 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev, - wmb(); - notify_remote_via_irq(pdev->evtchn_irq); - -+ /* Enable IRQ to signal "request done". */ -+ xen_pcibk_lateeoi(pdev, 0); -+ - ret = wait_event_timeout(xen_pcibk_aer_wait_queue, - !(test_bit(_XEN_PCIB_active, (unsigned long *) - &sh_info->flags)), 300*HZ); - -+ /* Enable IRQ for pcifront request if not already active. */ -+ if (!test_bit(_PDEVF_op_active, &pdev->flags)) -+ xen_pcibk_lateeoi(pdev, 0); -+ - if (!ret) { - if (test_bit(_XEN_PCIB_active, - (unsigned long *)&sh_info->flags)) { -@@ -698,13 +705,6 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev, - } - clear_bit(_PCIB_op_pending, (unsigned long *)&pdev->flags); - -- if (test_bit(_XEN_PCIF_active, -- (unsigned long *)&sh_info->flags)) { -- dev_dbg(&psdev->dev->dev, -- "schedule pci_conf service in " DRV_NAME "\n"); -- xen_pcibk_test_and_schedule_op(psdev->pdev); -- } -- - res = (pci_ers_result_t)aer_op->err; - return res; - } -diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h -index 4d529f3e40df9..f44a425d1a5a1 100644 ---- a/drivers/xen/xen-pciback/pciback.h -+++ b/drivers/xen/xen-pciback/pciback.h -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - - #define DRV_NAME "xen-pciback" -@@ -26,6 +27,8 @@ struct pci_dev_entry { - #define PDEVF_op_active (1<<(_PDEVF_op_active)) - #define _PCIB_op_pending (1) - #define PCIB_op_pending (1<<(_PCIB_op_pending)) -+#define _EOI_pending (2) -+#define EOI_pending (1<<(_EOI_pending)) - - struct xen_pcibk_device { - void *pci_dev_data; -@@ -182,12 +185,17 @@ static inline void xen_pcibk_release_devices(struct xen_pcibk_device *pdev) - irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id); - void xen_pcibk_do_op(struct work_struct *data); - -+static inline void xen_pcibk_lateeoi(struct xen_pcibk_device *pdev, -+ unsigned int eoi_flag) -+{ -+ if (test_and_clear_bit(_EOI_pending, &pdev->flags)) -+ xen_irq_lateeoi(pdev->evtchn_irq, eoi_flag); -+} -+ - int xen_pcibk_xenbus_register(void); - void xen_pcibk_xenbus_unregister(void); - - extern int verbose_request; -- --void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev); - #endif - - /* Handles shared IRQs that can to device domain and control domain. */ -diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c -index 49c5f0e9600aa..232db7fcc5236 100644 ---- a/drivers/xen/xen-pciback/pciback_ops.c -+++ b/drivers/xen/xen-pciback/pciback_ops.c -@@ -296,26 +296,41 @@ int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev, - return 0; - } - #endif -+ -+static inline bool xen_pcibk_test_op_pending(struct xen_pcibk_device *pdev) -+{ -+ return test_bit(_XEN_PCIF_active, -+ (unsigned long *)&pdev->sh_info->flags) && -+ !test_and_set_bit(_PDEVF_op_active, &pdev->flags); -+} -+ - /* - * Now the same evtchn is used for both pcifront conf_read_write request - * as well as pcie aer front end ack. We use a new work_queue to schedule - * xen_pcibk conf_read_write service for avoiding confict with aer_core - * do_recovery job which also use the system default work_queue - */ --void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev) -+static void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev) - { -+ bool eoi = true; -+ - /* Check that frontend is requesting an operation and that we are not - * already processing a request */ -- if (test_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags) -- && !test_and_set_bit(_PDEVF_op_active, &pdev->flags)) { -+ if (xen_pcibk_test_op_pending(pdev)) { - queue_work(xen_pcibk_wq, &pdev->op_work); -+ eoi = false; - } - /*_XEN_PCIB_active should have been cleared by pcifront. And also make - sure xen_pcibk is waiting for ack by checking _PCIB_op_pending*/ - if (!test_bit(_XEN_PCIB_active, (unsigned long *)&pdev->sh_info->flags) - && test_bit(_PCIB_op_pending, &pdev->flags)) { - wake_up(&xen_pcibk_aer_wait_queue); -+ eoi = false; - } -+ -+ /* EOI if there was nothing to do. */ -+ if (eoi) -+ xen_pcibk_lateeoi(pdev, XEN_EOI_FLAG_SPURIOUS); - } - - /* Performing the configuration space reads/writes must not be done in atomic -@@ -323,10 +338,8 @@ void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev) - * use of semaphores). This function is intended to be called from a work - * queue in process context taking a struct xen_pcibk_device as a parameter */ - --void xen_pcibk_do_op(struct work_struct *data) -+static void xen_pcibk_do_one_op(struct xen_pcibk_device *pdev) - { -- struct xen_pcibk_device *pdev = -- container_of(data, struct xen_pcibk_device, op_work); - struct pci_dev *dev; - struct xen_pcibk_dev_data *dev_data = NULL; - struct xen_pci_op *op = &pdev->op; -@@ -399,16 +412,31 @@ void xen_pcibk_do_op(struct work_struct *data) - smp_mb__before_atomic(); /* /after/ clearing PCIF_active */ - clear_bit(_PDEVF_op_active, &pdev->flags); - smp_mb__after_atomic(); /* /before/ final check for work */ -+} - -- /* Check to see if the driver domain tried to start another request in -- * between clearing _XEN_PCIF_active and clearing _PDEVF_op_active. -- */ -- xen_pcibk_test_and_schedule_op(pdev); -+void xen_pcibk_do_op(struct work_struct *data) -+{ -+ struct xen_pcibk_device *pdev = -+ container_of(data, struct xen_pcibk_device, op_work); -+ -+ do { -+ xen_pcibk_do_one_op(pdev); -+ } while (xen_pcibk_test_op_pending(pdev)); -+ -+ xen_pcibk_lateeoi(pdev, 0); - } - - irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id) - { - struct xen_pcibk_device *pdev = dev_id; -+ bool eoi; -+ -+ /* IRQs might come in before pdev->evtchn_irq is written. */ -+ if (unlikely(pdev->evtchn_irq != irq)) -+ pdev->evtchn_irq = irq; -+ -+ eoi = test_and_set_bit(_EOI_pending, &pdev->flags); -+ WARN(eoi, "IRQ while EOI pending\n"); - - xen_pcibk_test_and_schedule_op(pdev); - -diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c -index 4843741e703a3..48196347f2f94 100644 ---- a/drivers/xen/xen-pciback/xenbus.c -+++ b/drivers/xen/xen-pciback/xenbus.c -@@ -124,7 +124,7 @@ static int xen_pcibk_do_attach(struct xen_pcibk_device *pdev, int gnt_ref, - - pdev->sh_info = vaddr; - -- err = bind_interdomain_evtchn_to_irqhandler( -+ err = bind_interdomain_evtchn_to_irqhandler_lateeoi( - pdev->xdev->otherend_id, remote_evtchn, xen_pcibk_handle_event, - 0, DRV_NAME, pdev); - if (err < 0) { -diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c -index 51387d75c7bf1..29a1b8054a4dc 100644 ---- a/drivers/xen/xen-scsiback.c -+++ b/drivers/xen/xen-scsiback.c -@@ -91,7 +91,6 @@ struct vscsibk_info { - unsigned int irq; - - struct vscsiif_back_ring ring; -- int ring_error; - - spinlock_t ring_lock; - atomic_t nr_unreplied_reqs; -@@ -698,7 +697,8 @@ static int prepare_pending_reqs(struct vscsibk_info *info, - return 0; - } - --static int scsiback_do_cmd_fn(struct vscsibk_info *info) -+static int scsiback_do_cmd_fn(struct vscsibk_info *info, -+ unsigned int *eoi_flags) - { - struct vscsiif_back_ring *ring = &info->ring; - struct vscsiif_request ring_req; -@@ -715,11 +715,12 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info) - rc = ring->rsp_prod_pvt; - pr_warn("Dom%d provided bogus ring requests (%#x - %#x = %u). Halting ring processing\n", - info->domid, rp, rc, rp - rc); -- info->ring_error = 1; -- return 0; -+ return -EINVAL; - } - - while ((rc != rp)) { -+ *eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS; -+ - if (RING_REQUEST_CONS_OVERFLOW(ring, rc)) - break; - pending_req = kmem_cache_alloc(scsiback_cachep, GFP_KERNEL); -@@ -782,13 +783,16 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info) - static irqreturn_t scsiback_irq_fn(int irq, void *dev_id) - { - struct vscsibk_info *info = dev_id; -+ int rc; -+ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS; - -- if (info->ring_error) -- return IRQ_HANDLED; -- -- while (scsiback_do_cmd_fn(info)) -+ while ((rc = scsiback_do_cmd_fn(info, &eoi_flags)) > 0) - cond_resched(); - -+ /* In case of a ring error we keep the event channel masked. */ -+ if (!rc) -+ xen_irq_lateeoi(irq, eoi_flags); -+ - return IRQ_HANDLED; - } - -@@ -809,7 +813,7 @@ static int scsiback_init_sring(struct vscsibk_info *info, grant_ref_t ring_ref, - sring = (struct vscsiif_sring *)area; - BACK_RING_INIT(&info->ring, sring, PAGE_SIZE); - -- err = bind_interdomain_evtchn_to_irq(info->domid, evtchn); -+ err = bind_interdomain_evtchn_to_irq_lateeoi(info->domid, evtchn); - if (err < 0) - goto unmap_page; - -@@ -1210,7 +1214,6 @@ static int scsiback_probe(struct xenbus_device *dev, - - info->domid = dev->otherend_id; - spin_lock_init(&info->ring_lock); -- info->ring_error = 0; - atomic_set(&info->nr_unreplied_reqs, 0); - init_waitqueue_head(&info->waiting_to_free); - info->dev = dev; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 97a80238fdee3..b28bc7690d4b3 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4000,6 +4000,10 @@ retry: - if (!ret) { - free_extent_buffer(eb); - continue; -+ } else if (ret < 0) { -+ done = 1; -+ free_extent_buffer(eb); -+ break; - } - - ret = write_one_eb(eb, fs_info, wbc, &epd); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 67366515a29d2..f35e18e76f160 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -3856,6 +3856,8 @@ process_slot: - ret = -EINTR; - goto out; - } -+ -+ cond_resched(); - } - ret = 0; - -diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c -index 211ac472cb9dc..942874257a092 100644 ---- a/fs/cifs/cifs_unicode.c -+++ b/fs/cifs/cifs_unicode.c -@@ -493,7 +493,13 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, - else if (map_chars == SFM_MAP_UNI_RSVD) { - bool end_of_string; - -- if (i == srclen - 1) -+ /** -+ * Remap spaces and periods found at the end of every -+ * component of the path. The special cases of '.' and -+ * '..' do not need to be dealt with explicitly because -+ * they are addressed in namei.c:link_path_walk(). -+ **/ -+ if ((i == srclen - 1) || (source[i+1] == '\\')) - end_of_string = true; - else - end_of_string = false; -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 00f9433eea23a..df585267d3c25 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1892,6 +1892,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - - ext4_write_lock_xattr(inode, &no_expand); - if (!ext4_has_inline_data(inode)) { -+ ext4_write_unlock_xattr(inode, &no_expand); - *has_inline = 0; - ext4_journal_stop(handle); - return; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 6350971852e19..7a5a1602ee01d 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1452,8 +1452,8 @@ static const struct mount_opts { - MOPT_SET | MOPT_Q}, - {Opt_noquota, (EXT4_MOUNT_QUOTA | EXT4_MOUNT_USRQUOTA | - EXT4_MOUNT_GRPQUOTA), MOPT_CLEAR | MOPT_Q}, -- {Opt_usrjquota, 0, MOPT_Q}, -- {Opt_grpjquota, 0, MOPT_Q}, -+ {Opt_usrjquota, 0, MOPT_Q | MOPT_STRING}, -+ {Opt_grpjquota, 0, MOPT_Q | MOPT_STRING}, - {Opt_offusrjquota, 0, MOPT_Q}, - {Opt_offgrpjquota, 0, MOPT_Q}, - {Opt_jqfmt_vfsold, QFMT_VFS_OLD, MOPT_QFMT}, -@@ -4168,6 +4168,7 @@ cantfind_ext4: - #ifdef CONFIG_QUOTA - failed_mount8: - ext4_unregister_sysfs(sb); -+ kobject_put(&sbi->s_kobj); - #endif - failed_mount7: - ext4_unregister_li_request(sb); -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 1eb737c466ddc..8e8695eb652af 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -751,7 +751,8 @@ again: - } - kfree(gl->gl_lksb.sb_lvbptr); - kmem_cache_free(cachep, gl); -- atomic_dec(&sdp->sd_glock_disposal); -+ if (atomic_dec_and_test(&sdp->sd_glock_disposal)) -+ wake_up(&sdp->sd_glock_wait); - *glp = tmp; - - return ret; -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index 2736e9cfc2ee9..faa5e0e2c4493 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -747,9 +747,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) - } - - gfs2_free_clones(rgd); -+ return_all_reservations(rgd); - kfree(rgd->rd_bits); - rgd->rd_bits = NULL; -- return_all_reservations(rgd); - kmem_cache_free(gfs2_rgrpd_cachep, rgd); - } - } -@@ -1388,6 +1388,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp) - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - -+ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) -+ return -EROFS; -+ - if (!blk_queue_discard(q)) - return -EOPNOTSUPP; - -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index d97403bb36226..0ee1f088bace8 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -1751,6 +1751,7 @@ static void ocfs2_inode_init_once(void *data) - - oi->ip_blkno = 0ULL; - oi->ip_clusters = 0; -+ oi->ip_next_orphan = NULL; - - ocfs2_resv_init_once(&oi->ip_la_data_resv); - -diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c -index dc6221942b85f..ab66ea0a72bfb 100644 ---- a/fs/xfs/xfs_pnfs.c -+++ b/fs/xfs/xfs_pnfs.c -@@ -162,7 +162,7 @@ xfs_fs_map_blocks( - goto out_unlock; - error = invalidate_inode_pages2(inode->i_mapping); - if (WARN_ON_ONCE(error)) -- return error; -+ goto out_unlock; - - end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + length); - offset_fsb = XFS_B_TO_FSBT(mp, offset); -diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h -index 51bb6532785c3..1a2111c775ae1 100644 ---- a/include/linux/can/skb.h -+++ b/include/linux/can/skb.h -@@ -60,21 +60,17 @@ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk) - */ - static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb) - { -- if (skb_shared(skb)) { -- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); -+ struct sk_buff *nskb; - -- if (likely(nskb)) { -- can_skb_set_owner(nskb, skb->sk); -- consume_skb(skb); -- return nskb; -- } else { -- kfree_skb(skb); -- return NULL; -- } -+ nskb = skb_clone(skb, GFP_ATOMIC); -+ if (unlikely(!nskb)) { -+ kfree_skb(skb); -+ return NULL; - } - -- /* we can assume to have an unshared skb with proper owner */ -- return skb; -+ can_skb_set_owner(nskb, skb->sk); -+ consume_skb(skb); -+ return nskb; - } - - #endif /* !_CAN_SKB_H */ -diff --git a/include/linux/prandom.h b/include/linux/prandom.h -index aa16e6468f91e..cc1e71334e53c 100644 ---- a/include/linux/prandom.h -+++ b/include/linux/prandom.h -@@ -16,12 +16,44 @@ void prandom_bytes(void *buf, size_t nbytes); - void prandom_seed(u32 seed); - void prandom_reseed_late(void); - -+#if BITS_PER_LONG == 64 -+/* -+ * The core SipHash round function. Each line can be executed in -+ * parallel given enough CPU resources. -+ */ -+#define PRND_SIPROUND(v0, v1, v2, v3) ( \ -+ v0 += v1, v1 = rol64(v1, 13), v2 += v3, v3 = rol64(v3, 16), \ -+ v1 ^= v0, v0 = rol64(v0, 32), v3 ^= v2, \ -+ v0 += v3, v3 = rol64(v3, 21), v2 += v1, v1 = rol64(v1, 17), \ -+ v3 ^= v0, v1 ^= v2, v2 = rol64(v2, 32) \ -+) -+ -+#define PRND_K0 (0x736f6d6570736575 ^ 0x6c7967656e657261) -+#define PRND_K1 (0x646f72616e646f6d ^ 0x7465646279746573) -+ -+#elif BITS_PER_LONG == 32 -+/* -+ * On 32-bit machines, we use HSipHash, a reduced-width version of SipHash. -+ * This is weaker, but 32-bit machines are not used for high-traffic -+ * applications, so there is less output for an attacker to analyze. -+ */ -+#define PRND_SIPROUND(v0, v1, v2, v3) ( \ -+ v0 += v1, v1 = rol32(v1, 5), v2 += v3, v3 = rol32(v3, 8), \ -+ v1 ^= v0, v0 = rol32(v0, 16), v3 ^= v2, \ -+ v0 += v3, v3 = rol32(v3, 7), v2 += v1, v1 = rol32(v1, 13), \ -+ v3 ^= v0, v1 ^= v2, v2 = rol32(v2, 16) \ -+) -+#define PRND_K0 0x6c796765 -+#define PRND_K1 0x74656462 -+ -+#else -+#error Unsupported BITS_PER_LONG -+#endif -+ - struct rnd_state { - __u32 s1, s2, s3, s4; - }; - --DECLARE_PER_CPU(struct rnd_state, net_rand_state); -- - u32 prandom_u32_state(struct rnd_state *state); - void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); - void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); -diff --git a/include/linux/time64.h b/include/linux/time64.h -index 367d5af899e81..10239cffd70f8 100644 ---- a/include/linux/time64.h -+++ b/include/linux/time64.h -@@ -197,6 +197,10 @@ static inline bool timespec64_valid_strict(const struct timespec64 *ts) - */ - static inline s64 timespec64_to_ns(const struct timespec64 *ts) - { -+ /* Prevent multiplication overflow */ -+ if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) -+ return KTIME_MAX; -+ - return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec; - } - -diff --git a/include/xen/events.h b/include/xen/events.h -index 88da2abaf5359..ad0c61cf399be 100644 ---- a/include/xen/events.h -+++ b/include/xen/events.h -@@ -12,11 +12,16 @@ - - unsigned xen_evtchn_nr_channels(void); - --int bind_evtchn_to_irq(unsigned int evtchn); --int bind_evtchn_to_irqhandler(unsigned int evtchn, -+int bind_evtchn_to_irq(evtchn_port_t evtchn); -+int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn); -+int bind_evtchn_to_irqhandler(evtchn_port_t evtchn, - irq_handler_t handler, - unsigned long irqflags, const char *devname, - void *dev_id); -+int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn, -+ irq_handler_t handler, -+ unsigned long irqflags, const char *devname, -+ void *dev_id); - int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); - int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, - irq_handler_t handler, -@@ -29,13 +34,21 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, - const char *devname, - void *dev_id); - int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, -- unsigned int remote_port); -+ evtchn_port_t remote_port); -+int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain, -+ evtchn_port_t remote_port); - int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, -- unsigned int remote_port, -+ evtchn_port_t remote_port, - irq_handler_t handler, - unsigned long irqflags, - const char *devname, - void *dev_id); -+int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain, -+ evtchn_port_t remote_port, -+ irq_handler_t handler, -+ unsigned long irqflags, -+ const char *devname, -+ void *dev_id); - - /* - * Common unbind function for all event sources. Takes IRQ to unbind from. -@@ -44,6 +57,14 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, - */ - void unbind_from_irqhandler(unsigned int irq, void *dev_id); - -+/* -+ * Send late EOI for an IRQ bound to an event channel via one of the *_lateeoi -+ * functions above. -+ */ -+void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags); -+/* Signal an event was spurious, i.e. there was no action resulting from it. */ -+#define XEN_EOI_FLAG_SPURIOUS 0x00000001 -+ - #define XEN_IRQ_PRIORITY_MAX EVTCHN_FIFO_PRIORITY_MAX - #define XEN_IRQ_PRIORITY_DEFAULT EVTCHN_FIFO_PRIORITY_DEFAULT - #define XEN_IRQ_PRIORITY_MIN EVTCHN_FIFO_PRIORITY_MIN -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 388ce03155b40..d399748ea86b5 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -4664,11 +4664,11 @@ static void perf_mmap_open(struct vm_area_struct *vma) - static void perf_mmap_close(struct vm_area_struct *vma) - { - struct perf_event *event = vma->vm_file->private_data; -- - struct ring_buffer *rb = ring_buffer_get(event); - struct user_struct *mmap_user = rb->mmap_user; - int mmap_locked = rb->mmap_locked; - unsigned long size = perf_data_size(rb); -+ bool detach_rest = false; - - if (event->pmu->event_unmapped) - event->pmu->event_unmapped(event); -@@ -4687,7 +4687,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) - mutex_unlock(&event->mmap_mutex); - } - -- atomic_dec(&rb->mmap_count); -+ if (atomic_dec_and_test(&rb->mmap_count)) -+ detach_rest = true; - - if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) - goto out_put; -@@ -4696,7 +4697,7 @@ static void perf_mmap_close(struct vm_area_struct *vma) - mutex_unlock(&event->mmap_mutex); - - /* If there's still other mmap()s of this buffer, we're done. */ -- if (atomic_read(&rb->mmap_count)) -+ if (!detach_rest) - goto out_put; - - /* -diff --git a/kernel/events/internal.h b/kernel/events/internal.h -index 2bbad9c1274c3..8baa3121e7a6b 100644 ---- a/kernel/events/internal.h -+++ b/kernel/events/internal.h -@@ -193,7 +193,7 @@ static inline int get_recursion_context(int *recursion) - rctx = 3; - else if (in_irq()) - rctx = 2; -- else if (in_softirq()) -+ else if (in_serving_softirq()) - rctx = 1; - else - rctx = 0; -diff --git a/kernel/exit.c b/kernel/exit.c -index 03f6722302b54..5c20a32c95392 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -408,7 +408,10 @@ static void exit_mm(struct task_struct *tsk) - up_read(&mm->mmap_sem); - - self.task = tsk; -- self.next = xchg(&core_state->dumper.next, &self); -+ if (self.task->flags & PF_SIGNALED) -+ self.next = xchg(&core_state->dumper.next, &self); -+ else -+ self.task = NULL; - /* - * Implies mb(), the result of xchg() must be visible - * to core_state->dumper. -diff --git a/kernel/reboot.c b/kernel/reboot.c -index bd30a973fe946..2946ed1d99d4d 100644 ---- a/kernel/reboot.c -+++ b/kernel/reboot.c -@@ -512,22 +512,22 @@ static int __init reboot_setup(char *str) - break; - - case 's': -- { -- int rc; -- -- if (isdigit(*(str+1))) { -- rc = kstrtoint(str+1, 0, &reboot_cpu); -- if (rc) -- return rc; -- } else if (str[1] == 'm' && str[2] == 'p' && -- isdigit(*(str+3))) { -- rc = kstrtoint(str+3, 0, &reboot_cpu); -- if (rc) -- return rc; -- } else -+ if (isdigit(*(str+1))) -+ reboot_cpu = simple_strtoul(str+1, NULL, 0); -+ else if (str[1] == 'm' && str[2] == 'p' && -+ isdigit(*(str+3))) -+ reboot_cpu = simple_strtoul(str+3, NULL, 0); -+ else - reboot_mode = REBOOT_SOFT; -+ if (reboot_cpu >= num_possible_cpus()) { -+ pr_err("Ignoring the CPU number in reboot= option. " -+ "CPU %d exceeds possible cpu number %d\n", -+ reboot_cpu, num_possible_cpus()); -+ reboot_cpu = 0; -+ break; -+ } - break; -- } -+ - case 'g': - reboot_mode = REBOOT_GPIO; - break; -diff --git a/kernel/time/timer.c b/kernel/time/timer.c -index 43bee4993187c..6ca409a460308 100644 ---- a/kernel/time/timer.c -+++ b/kernel/time/timer.c -@@ -1432,13 +1432,6 @@ void update_process_times(int user_tick) - #endif - scheduler_tick(); - run_posix_cpu_timers(p); -- -- /* The current CPU might make use of net randoms without receiving IRQs -- * to renew them often enough. Let's update the net_rand_state from a -- * non-constant value that's not affine to the number of calls to make -- * sure it's updated when there's some activity (we don't care in idle). -- */ -- this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick); - } - - /* -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 1c1ecc1d49ad2..547a3a5ac57b5 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -416,14 +416,16 @@ struct rb_event_info { - - /* - * Used for which event context the event is in. -- * NMI = 0 -- * IRQ = 1 -- * SOFTIRQ = 2 -- * NORMAL = 3 -+ * TRANSITION = 0 -+ * NMI = 1 -+ * IRQ = 2 -+ * SOFTIRQ = 3 -+ * NORMAL = 4 - * - * See trace_recursive_lock() comment below for more details. - */ - enum { -+ RB_CTX_TRANSITION, - RB_CTX_NMI, - RB_CTX_IRQ, - RB_CTX_SOFTIRQ, -@@ -2585,10 +2587,10 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) - * a bit of overhead in something as critical as function tracing, - * we use a bitmask trick. - * -- * bit 0 = NMI context -- * bit 1 = IRQ context -- * bit 2 = SoftIRQ context -- * bit 3 = normal context. -+ * bit 1 = NMI context -+ * bit 2 = IRQ context -+ * bit 3 = SoftIRQ context -+ * bit 4 = normal context. - * - * This works because this is the order of contexts that can - * preempt other contexts. A SoftIRQ never preempts an IRQ -@@ -2611,6 +2613,30 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) - * The least significant bit can be cleared this way, and it - * just so happens that it is the same bit corresponding to - * the current context. -+ * -+ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit -+ * is set when a recursion is detected at the current context, and if -+ * the TRANSITION bit is already set, it will fail the recursion. -+ * This is needed because there's a lag between the changing of -+ * interrupt context and updating the preempt count. In this case, -+ * a false positive will be found. To handle this, one extra recursion -+ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION -+ * bit is already set, then it is considered a recursion and the function -+ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned. -+ * -+ * On the trace_recursive_unlock(), the TRANSITION bit will be the first -+ * to be cleared. Even if it wasn't the context that set it. That is, -+ * if an interrupt comes in while NORMAL bit is set and the ring buffer -+ * is called before preempt_count() is updated, since the check will -+ * be on the NORMAL bit, the TRANSITION bit will then be set. If an -+ * NMI then comes in, it will set the NMI bit, but when the NMI code -+ * does the trace_recursive_unlock() it will clear the TRANSTION bit -+ * and leave the NMI bit set. But this is fine, because the interrupt -+ * code that set the TRANSITION bit will then clear the NMI bit when it -+ * calls trace_recursive_unlock(). If another NMI comes in, it will -+ * set the TRANSITION bit and continue. -+ * -+ * Note: The TRANSITION bit only handles a single transition between context. - */ - - static __always_inline int -@@ -2629,8 +2655,16 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer) - } else - bit = RB_CTX_NORMAL; - -- if (unlikely(val & (1 << bit))) -- return 1; -+ if (unlikely(val & (1 << bit))) { -+ /* -+ * It is possible that this was called by transitioning -+ * between interrupt context, and preempt_count() has not -+ * been updated yet. In this case, use the TRANSITION bit. -+ */ -+ bit = RB_CTX_TRANSITION; -+ if (val & (1 << bit)) -+ return 1; -+ } - - val |= (1 << bit); - cpu_buffer->current_context = val; -diff --git a/lib/random32.c b/lib/random32.c -index 8072ccd9eed58..17e5780eebd72 100644 ---- a/lib/random32.c -+++ b/lib/random32.c -@@ -39,16 +39,6 @@ - #include - #include - --#ifdef CONFIG_RANDOM32_SELFTEST --static void __init prandom_state_selftest(void); --#else --static inline void prandom_state_selftest(void) --{ --} --#endif -- --DEFINE_PER_CPU(struct rnd_state, net_rand_state); -- - /** - * prandom_u32_state - seeded pseudo-random number generator. - * @state: pointer to state structure holding seeded state. -@@ -68,25 +58,6 @@ u32 prandom_u32_state(struct rnd_state *state) - } - EXPORT_SYMBOL(prandom_u32_state); - --/** -- * prandom_u32 - pseudo random number generator -- * -- * A 32 bit pseudo-random number is generated using a fast -- * algorithm suitable for simulation. This algorithm is NOT -- * considered safe for cryptographic use. -- */ --u32 prandom_u32(void) --{ -- struct rnd_state *state = &get_cpu_var(net_rand_state); -- u32 res; -- -- res = prandom_u32_state(state); -- put_cpu_var(state); -- -- return res; --} --EXPORT_SYMBOL(prandom_u32); -- - /** - * prandom_bytes_state - get the requested number of pseudo-random bytes - * -@@ -118,20 +89,6 @@ void prandom_bytes_state(struct rnd_state *state, void *buf, size_t bytes) - } - EXPORT_SYMBOL(prandom_bytes_state); - --/** -- * prandom_bytes - get the requested number of pseudo-random bytes -- * @buf: where to copy the pseudo-random bytes to -- * @bytes: the requested number of bytes -- */ --void prandom_bytes(void *buf, size_t bytes) --{ -- struct rnd_state *state = &get_cpu_var(net_rand_state); -- -- prandom_bytes_state(state, buf, bytes); -- put_cpu_var(state); --} --EXPORT_SYMBOL(prandom_bytes); -- - static void prandom_warmup(struct rnd_state *state) - { - /* Calling RNG ten times to satisfy recurrence condition */ -@@ -147,97 +104,6 @@ static void prandom_warmup(struct rnd_state *state) - prandom_u32_state(state); - } - --static u32 __extract_hwseed(void) --{ -- unsigned int val = 0; -- -- (void)(arch_get_random_seed_int(&val) || -- arch_get_random_int(&val)); -- -- return val; --} -- --static void prandom_seed_early(struct rnd_state *state, u32 seed, -- bool mix_with_hwseed) --{ --#define LCG(x) ((x) * 69069U) /* super-duper LCG */ --#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0) -- state->s1 = __seed(HWSEED() ^ LCG(seed), 2U); -- state->s2 = __seed(HWSEED() ^ LCG(state->s1), 8U); -- state->s3 = __seed(HWSEED() ^ LCG(state->s2), 16U); -- state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U); --} -- --/** -- * prandom_seed - add entropy to pseudo random number generator -- * @seed: seed value -- * -- * Add some additional seeding to the prandom pool. -- */ --void prandom_seed(u32 entropy) --{ -- int i; -- /* -- * No locking on the CPUs, but then somewhat random results are, well, -- * expected. -- */ -- for_each_possible_cpu(i) { -- struct rnd_state *state = &per_cpu(net_rand_state, i); -- -- state->s1 = __seed(state->s1 ^ entropy, 2U); -- prandom_warmup(state); -- } --} --EXPORT_SYMBOL(prandom_seed); -- --/* -- * Generate some initially weak seeding values to allow -- * to start the prandom_u32() engine. -- */ --static int __init prandom_init(void) --{ -- int i; -- -- prandom_state_selftest(); -- -- for_each_possible_cpu(i) { -- struct rnd_state *state = &per_cpu(net_rand_state, i); -- u32 weak_seed = (i + jiffies) ^ random_get_entropy(); -- -- prandom_seed_early(state, weak_seed, true); -- prandom_warmup(state); -- } -- -- return 0; --} --core_initcall(prandom_init); -- --static void __prandom_timer(unsigned long dontcare); -- --static DEFINE_TIMER(seed_timer, __prandom_timer, 0, 0); -- --static void __prandom_timer(unsigned long dontcare) --{ -- u32 entropy; -- unsigned long expires; -- -- get_random_bytes(&entropy, sizeof(entropy)); -- prandom_seed(entropy); -- -- /* reseed every ~60 seconds, in [40 .. 80) interval with slack */ -- expires = 40 + prandom_u32_max(40); -- seed_timer.expires = jiffies + msecs_to_jiffies(expires * MSEC_PER_SEC); -- -- add_timer(&seed_timer); --} -- --static void __init __prandom_start_seed_timer(void) --{ -- set_timer_slack(&seed_timer, HZ); -- seed_timer.expires = jiffies + msecs_to_jiffies(40 * MSEC_PER_SEC); -- add_timer(&seed_timer); --} -- - void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state) - { - int i; -@@ -256,51 +122,6 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state) - } - } - --/* -- * Generate better values after random number generator -- * is fully initialized. -- */ --static void __prandom_reseed(bool late) --{ -- unsigned long flags; -- static bool latch = false; -- static DEFINE_SPINLOCK(lock); -- -- /* Asking for random bytes might result in bytes getting -- * moved into the nonblocking pool and thus marking it -- * as initialized. In this case we would double back into -- * this function and attempt to do a late reseed. -- * Ignore the pointless attempt to reseed again if we're -- * already waiting for bytes when the nonblocking pool -- * got initialized. -- */ -- -- /* only allow initial seeding (late == false) once */ -- if (!spin_trylock_irqsave(&lock, flags)) -- return; -- -- if (latch && !late) -- goto out; -- -- latch = true; -- prandom_seed_full_state(&net_rand_state); --out: -- spin_unlock_irqrestore(&lock, flags); --} -- --void prandom_reseed_late(void) --{ -- __prandom_reseed(true); --} -- --static int __init prandom_reseed(void) --{ -- __prandom_reseed(false); -- __prandom_start_seed_timer(); -- return 0; --} --late_initcall(prandom_reseed); -- - #ifdef CONFIG_RANDOM32_SELFTEST - static struct prandom_test1 { - u32 seed; -@@ -420,7 +241,28 @@ static struct prandom_test2 { - { 407983964U, 921U, 728767059U }, - }; - --static void __init prandom_state_selftest(void) -+static u32 __extract_hwseed(void) -+{ -+ unsigned int val = 0; -+ -+ (void)(arch_get_random_seed_int(&val) || -+ arch_get_random_int(&val)); -+ -+ return val; -+} -+ -+static void prandom_seed_early(struct rnd_state *state, u32 seed, -+ bool mix_with_hwseed) -+{ -+#define LCG(x) ((x) * 69069U) /* super-duper LCG */ -+#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0) -+ state->s1 = __seed(HWSEED() ^ LCG(seed), 2U); -+ state->s2 = __seed(HWSEED() ^ LCG(state->s1), 8U); -+ state->s3 = __seed(HWSEED() ^ LCG(state->s2), 16U); -+ state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U); -+} -+ -+static int __init prandom_state_selftest(void) - { - int i, j, errors = 0, runs = 0; - bool error = false; -@@ -460,5 +302,266 @@ static void __init prandom_state_selftest(void) - pr_warn("prandom: %d/%d self tests failed\n", errors, runs); - else - pr_info("prandom: %d self tests passed\n", runs); -+ return 0; - } -+core_initcall(prandom_state_selftest); - #endif -+ -+/* -+ * The prandom_u32() implementation is now completely separate from the -+ * prandom_state() functions, which are retained (for now) for compatibility. -+ * -+ * Because of (ab)use in the networking code for choosing random TCP/UDP port -+ * numbers, which open DoS possibilities if guessable, we want something -+ * stronger than a standard PRNG. But the performance requirements of -+ * the network code do not allow robust crypto for this application. -+ * -+ * So this is a homebrew Junior Spaceman implementation, based on the -+ * lowest-latency trustworthy crypto primitive available, SipHash. -+ * (The authors of SipHash have not been consulted about this abuse of -+ * their work.) -+ * -+ * Standard SipHash-2-4 uses 2n+4 rounds to hash n words of input to -+ * one word of output. This abbreviated version uses 2 rounds per word -+ * of output. -+ */ -+ -+struct siprand_state { -+ unsigned long v0; -+ unsigned long v1; -+ unsigned long v2; -+ unsigned long v3; -+}; -+ -+static DEFINE_PER_CPU(struct siprand_state, net_rand_state); -+ -+/* -+ * This is the core CPRNG function. As "pseudorandom", this is not used -+ * for truly valuable things, just intended to be a PITA to guess. -+ * For maximum speed, we do just two SipHash rounds per word. This is -+ * the same rate as 4 rounds per 64 bits that SipHash normally uses, -+ * so hopefully it's reasonably secure. -+ * -+ * There are two changes from the official SipHash finalization: -+ * - We omit some constants XORed with v2 in the SipHash spec as irrelevant; -+ * they are there only to make the output rounds distinct from the input -+ * rounds, and this application has no input rounds. -+ * - Rather than returning v0^v1^v2^v3, return v1+v3. -+ * If you look at the SipHash round, the last operation on v3 is -+ * "v3 ^= v0", so "v0 ^ v3" just undoes that, a waste of time. -+ * Likewise "v1 ^= v2". (The rotate of v2 makes a difference, but -+ * it still cancels out half of the bits in v2 for no benefit.) -+ * Second, since the last combining operation was xor, continue the -+ * pattern of alternating xor/add for a tiny bit of extra non-linearity. -+ */ -+static inline u32 siprand_u32(struct siprand_state *s) -+{ -+ unsigned long v0 = s->v0, v1 = s->v1, v2 = s->v2, v3 = s->v3; -+ -+ PRND_SIPROUND(v0, v1, v2, v3); -+ PRND_SIPROUND(v0, v1, v2, v3); -+ s->v0 = v0; s->v1 = v1; s->v2 = v2; s->v3 = v3; -+ return v1 + v3; -+} -+ -+ -+/** -+ * prandom_u32 - pseudo random number generator -+ * -+ * A 32 bit pseudo-random number is generated using a fast -+ * algorithm suitable for simulation. This algorithm is NOT -+ * considered safe for cryptographic use. -+ */ -+u32 prandom_u32(void) -+{ -+ struct siprand_state *state = get_cpu_ptr(&net_rand_state); -+ u32 res = siprand_u32(state); -+ -+ put_cpu_ptr(&net_rand_state); -+ return res; -+} -+EXPORT_SYMBOL(prandom_u32); -+ -+/** -+ * prandom_bytes - get the requested number of pseudo-random bytes -+ * @buf: where to copy the pseudo-random bytes to -+ * @bytes: the requested number of bytes -+ */ -+void prandom_bytes(void *buf, size_t bytes) -+{ -+ struct siprand_state *state = get_cpu_ptr(&net_rand_state); -+ u8 *ptr = buf; -+ -+ while (bytes >= sizeof(u32)) { -+ put_unaligned(siprand_u32(state), (u32 *)ptr); -+ ptr += sizeof(u32); -+ bytes -= sizeof(u32); -+ } -+ -+ if (bytes > 0) { -+ u32 rem = siprand_u32(state); -+ -+ do { -+ *ptr++ = (u8)rem; -+ rem >>= BITS_PER_BYTE; -+ } while (--bytes > 0); -+ } -+ put_cpu_ptr(&net_rand_state); -+} -+EXPORT_SYMBOL(prandom_bytes); -+ -+/** -+ * prandom_seed - add entropy to pseudo random number generator -+ * @entropy: entropy value -+ * -+ * Add some additional seed material to the prandom pool. -+ * The "entropy" is actually our IP address (the only caller is -+ * the network code), not for unpredictability, but to ensure that -+ * different machines are initialized differently. -+ */ -+void prandom_seed(u32 entropy) -+{ -+ int i; -+ -+ add_device_randomness(&entropy, sizeof(entropy)); -+ -+ for_each_possible_cpu(i) { -+ struct siprand_state *state = per_cpu_ptr(&net_rand_state, i); -+ unsigned long v0 = state->v0, v1 = state->v1; -+ unsigned long v2 = state->v2, v3 = state->v3; -+ -+ do { -+ v3 ^= entropy; -+ PRND_SIPROUND(v0, v1, v2, v3); -+ PRND_SIPROUND(v0, v1, v2, v3); -+ v0 ^= entropy; -+ } while (unlikely(!v0 || !v1 || !v2 || !v3)); -+ -+ WRITE_ONCE(state->v0, v0); -+ WRITE_ONCE(state->v1, v1); -+ WRITE_ONCE(state->v2, v2); -+ WRITE_ONCE(state->v3, v3); -+ } -+} -+EXPORT_SYMBOL(prandom_seed); -+ -+/* -+ * Generate some initially weak seeding values to allow -+ * the prandom_u32() engine to be started. -+ */ -+static int __init prandom_init_early(void) -+{ -+ int i; -+ unsigned long v0, v1, v2, v3; -+ -+ if (!arch_get_random_long(&v0)) -+ v0 = jiffies; -+ if (!arch_get_random_long(&v1)) -+ v1 = random_get_entropy(); -+ v2 = v0 ^ PRND_K0; -+ v3 = v1 ^ PRND_K1; -+ -+ for_each_possible_cpu(i) { -+ struct siprand_state *state; -+ -+ v3 ^= i; -+ PRND_SIPROUND(v0, v1, v2, v3); -+ PRND_SIPROUND(v0, v1, v2, v3); -+ v0 ^= i; -+ -+ state = per_cpu_ptr(&net_rand_state, i); -+ state->v0 = v0; state->v1 = v1; -+ state->v2 = v2; state->v3 = v3; -+ } -+ -+ return 0; -+} -+core_initcall(prandom_init_early); -+ -+ -+/* Stronger reseeding when available, and periodically thereafter. */ -+static void prandom_reseed(unsigned long dontcare); -+ -+static DEFINE_TIMER(seed_timer, prandom_reseed, 0, 0); -+ -+static void prandom_reseed(unsigned long dontcare) -+{ -+ unsigned long expires; -+ int i; -+ -+ /* -+ * Reinitialize each CPU's PRNG with 128 bits of key. -+ * No locking on the CPUs, but then somewhat random results are, -+ * well, expected. -+ */ -+ for_each_possible_cpu(i) { -+ struct siprand_state *state; -+ unsigned long v0 = get_random_long(), v2 = v0 ^ PRND_K0; -+ unsigned long v1 = get_random_long(), v3 = v1 ^ PRND_K1; -+#if BITS_PER_LONG == 32 -+ int j; -+ -+ /* -+ * On 32-bit machines, hash in two extra words to -+ * approximate 128-bit key length. Not that the hash -+ * has that much security, but this prevents a trivial -+ * 64-bit brute force. -+ */ -+ for (j = 0; j < 2; j++) { -+ unsigned long m = get_random_long(); -+ -+ v3 ^= m; -+ PRND_SIPROUND(v0, v1, v2, v3); -+ PRND_SIPROUND(v0, v1, v2, v3); -+ v0 ^= m; -+ } -+#endif -+ /* -+ * Probably impossible in practice, but there is a -+ * theoretical risk that a race between this reseeding -+ * and the target CPU writing its state back could -+ * create the all-zero SipHash fixed point. -+ * -+ * To ensure that never happens, ensure the state -+ * we write contains no zero words. -+ */ -+ state = per_cpu_ptr(&net_rand_state, i); -+ WRITE_ONCE(state->v0, v0 ? v0 : -1ul); -+ WRITE_ONCE(state->v1, v1 ? v1 : -1ul); -+ WRITE_ONCE(state->v2, v2 ? v2 : -1ul); -+ WRITE_ONCE(state->v3, v3 ? v3 : -1ul); -+ } -+ -+ /* reseed every ~60 seconds, in [40 .. 80) interval with slack */ -+ expires = round_jiffies(jiffies + 40 * HZ + prandom_u32_max(40 * HZ)); -+ mod_timer(&seed_timer, expires); -+} -+ -+/* -+ * The random ready callback can be called from almost any interrupt. -+ * To avoid worrying about whether it's safe to delay that interrupt -+ * long enough to seed all CPUs, just schedule an immediate timer event. -+ */ -+static void prandom_timer_start(struct random_ready_callback *unused) -+{ -+ mod_timer(&seed_timer, jiffies); -+} -+ -+/* -+ * Start periodic full reseeding as soon as strong -+ * random numbers are available. -+ */ -+static int __init prandom_init_late(void) -+{ -+ static struct random_ready_callback random_ready = { -+ .func = prandom_timer_start -+ }; -+ int ret = add_random_ready_callback(&random_ready); -+ -+ if (ret == -EALREADY) { -+ prandom_timer_start(&random_ready); -+ ret = 0; -+ } -+ return ret; -+} -+late_initcall(prandom_init_late); -diff --git a/lib/swiotlb.c b/lib/swiotlb.c -index 6bc452b33b76f..7ccc45c3fdd7f 100644 ---- a/lib/swiotlb.c -+++ b/lib/swiotlb.c -@@ -195,6 +195,7 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose) - io_tlb_orig_addr[i] = INVALID_PHYS_ADDR; - } - io_tlb_index = 0; -+ no_iotlb_memory = false; - - if (verbose) - swiotlb_print_info(); -@@ -225,9 +226,11 @@ swiotlb_init(int verbose) - if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, verbose)) - return; - -- if (io_tlb_start) -+ if (io_tlb_start) { - memblock_free_early(io_tlb_start, - PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT)); -+ io_tlb_start = 0; -+ } - pr_warn("Cannot allocate buffer"); - no_iotlb_memory = true; - } -@@ -326,6 +329,7 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs) - io_tlb_orig_addr[i] = INVALID_PHYS_ADDR; - } - io_tlb_index = 0; -+ no_iotlb_memory = false; - - swiotlb_print_info(); - -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index e101cac3d4a63..9ab7969ee7e30 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -490,14 +490,14 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, - struct queue_pages *qp = walk->private; - unsigned long flags = qp->flags; - int nid; -- pte_t *pte; -+ pte_t *pte, *mapped_pte; - spinlock_t *ptl; - - split_huge_page_pmd(vma, addr, pmd); - if (pmd_trans_unstable(pmd)) - return 0; - -- pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); -+ mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); - for (; addr != end; pte++, addr += PAGE_SIZE) { - if (!pte_present(*pte)) - continue; -@@ -521,7 +521,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, - } else - break; - } -- pte_unmap_unlock(pte - 1, ptl); -+ pte_unmap_unlock(mapped_pte, ptl); - cond_resched(); - return addr != end ? -EIO : 0; - } -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index f3d3ac5c23d59..d9e7d61a0197e 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -307,7 +307,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) - __u32 cookie = ntohl(th->ack_seq) - 1; - struct sock *ret = sk; - struct request_sock *req; -- int mss; -+ int full_space, mss; - struct rtable *rt; - __u8 rcv_wscale; - struct flowi4 fl4; -@@ -391,8 +391,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) - - /* Try to redo what tcp_v4_send_synack did. */ - req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW); -+ /* limit the window selection if the user enforce a smaller rx buffer */ -+ full_space = tcp_full_space(sk); -+ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK && -+ (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0)) -+ req->rsk_window_clamp = full_space; - -- tcp_select_initial_window(tcp_full_space(sk), req->mss, -+ tcp_select_initial_window(full_space, req->mss, - &req->rsk_rcv_wnd, &req->rsk_window_clamp, - ireq->wscale_ok, &rcv_wscale, - dst_metric(&rt->dst, RTAX_INITRWND)); -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 5039486c4f86b..8bab7e64ffcfb 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1079,7 +1079,6 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev) - if (tdev && !netif_is_l3_master(tdev)) { - int t_hlen = tunnel->hlen + sizeof(struct iphdr); - -- dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr); - dev->mtu = tdev->mtu - t_hlen; - if (dev->mtu < IPV6_MIN_MTU) - dev->mtu = IPV6_MIN_MTU; -@@ -1371,7 +1370,6 @@ static void ipip6_tunnel_setup(struct net_device *dev) - dev->destructor = ipip6_dev_free; - - dev->type = ARPHRD_SIT; -- dev->hard_header_len = LL_MAX_HEADER + t_hlen; - dev->mtu = ETH_DATA_LEN - t_hlen; - dev->flags = IFF_NOARP; - netif_keep_dst(dev); -diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c -index fb3ba2a511196..d2792580b1124 100644 ---- a/net/ipv6/syncookies.c -+++ b/net/ipv6/syncookies.c -@@ -144,7 +144,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) - __u32 cookie = ntohl(th->ack_seq) - 1; - struct sock *ret = sk; - struct request_sock *req; -- int mss; -+ int full_space, mss; - struct dst_entry *dst; - __u8 rcv_wscale; - -@@ -237,7 +237,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) - } - - req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW); -- tcp_select_initial_window(tcp_full_space(sk), req->mss, -+ /* limit the window selection if the user enforce a smaller rx buffer */ -+ full_space = tcp_full_space(sk); -+ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK && -+ (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0)) -+ req->rsk_window_clamp = full_space; -+ -+ tcp_select_initial_window(full_space, req->mss, - &req->rsk_rcv_wnd, &req->rsk_window_clamp, - ireq->wscale_ok, &rcv_wscale, - dst_metric(dst, RTAX_INITRWND)); -diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c -index 3edffb7bf2a46..f94107e27b5ed 100644 ---- a/net/iucv/af_iucv.c -+++ b/net/iucv/af_iucv.c -@@ -1513,7 +1513,8 @@ static int iucv_sock_shutdown(struct socket *sock, int how) - break; - } - -- if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) { -+ if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) && -+ sk->sk_state == IUCV_CONNECTED) { - if (iucv->transport == AF_IUCV_TRANS_IUCV) { - txmsg.class = 0; - txmsg.tag = 0; -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 98c34c3adf392..4466413c5eecc 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -1594,19 +1594,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, - - /* device xmit handlers */ - -+enum ieee80211_encrypt { -+ ENCRYPT_NO, -+ ENCRYPT_MGMT, -+ ENCRYPT_DATA, -+}; -+ - static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, - struct sk_buff *skb, -- int head_need, bool may_encrypt) -+ int head_need, -+ enum ieee80211_encrypt encrypt) - { - struct ieee80211_local *local = sdata->local; -- struct ieee80211_hdr *hdr; - bool enc_tailroom; - int tail_need = 0; - -- hdr = (struct ieee80211_hdr *) skb->data; -- enc_tailroom = may_encrypt && -- (sdata->crypto_tx_tailroom_needed_cnt || -- ieee80211_is_mgmt(hdr->frame_control)); -+ enc_tailroom = encrypt == ENCRYPT_MGMT || -+ (encrypt == ENCRYPT_DATA && -+ sdata->crypto_tx_tailroom_needed_cnt); - - if (enc_tailroom) { - tail_need = IEEE80211_ENCRYPT_TAILROOM; -@@ -1639,21 +1644,27 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; - int headroom; -- bool may_encrypt; -+ enum ieee80211_encrypt encrypt; - -- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT); -+ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT) -+ encrypt = ENCRYPT_NO; -+ else if (ieee80211_is_mgmt(hdr->frame_control)) -+ encrypt = ENCRYPT_MGMT; -+ else -+ encrypt = ENCRYPT_DATA; - - headroom = local->tx_headroom; -- if (may_encrypt) -+ if (encrypt != ENCRYPT_NO) - headroom += sdata->encrypt_headroom; - headroom -= skb_headroom(skb); - headroom = max_t(int, 0, headroom); - -- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) { -+ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) { - ieee80211_free_txskb(&local->hw, skb); - return; - } - -+ /* reload after potential resize */ - hdr = (struct ieee80211_hdr *) skb->data; - info->control.vif = &sdata->vif; - -@@ -2346,7 +2357,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, - head_need += sdata->encrypt_headroom; - head_need += local->tx_headroom; - head_need = max_t(int, 0, head_need); -- if (ieee80211_skb_resize(sdata, skb, head_need, true)) { -+ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) { - ieee80211_free_txskb(&local->hw, skb); - skb = NULL; - return ERR_PTR(-ENOMEM); -@@ -2756,7 +2767,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata, - if (unlikely(ieee80211_skb_resize(sdata, skb, - max_t(int, extra_head + hw_headroom - - skb_headroom(skb), 0), -- false))) { -+ ENCRYPT_NO))) { - kfree_skb(skb); - return true; - } -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 474923175b108..dcbf5cd44bb37 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -2775,7 +2775,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd) - power_rule = ®_rule->power_rule; - - if (reg_rule->flags & NL80211_RRF_AUTO_BW) -- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO", -+ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO", - freq_range->max_bandwidth_khz, - reg_get_max_bandwidth(rd, reg_rule)); - else -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index f9fb8613fb287..e39bb38eedf30 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -823,7 +823,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr, - sock->state = SS_CONNECTED; - rc = 0; - out_put_neigh: -- if (rc) { -+ if (rc && x25->neighbour) { - read_lock_bh(&x25_list_lock); - x25_neigh_put(x25->neighbour); - x25->neighbour = NULL; -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 5bb5950d6276b..ed05cd7a4ef2c 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -1554,6 +1554,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) - int err = -ENOENT; - __be32 minspi = htonl(low); - __be32 maxspi = htonl(high); -+ __be32 newspi = 0; - u32 mark = x->mark.v & x->mark.m; - - spin_lock_bh(&x->lock); -@@ -1572,21 +1573,22 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high) - xfrm_state_put(x0); - goto unlock; - } -- x->id.spi = minspi; -+ newspi = minspi; - } else { - u32 spi = 0; - for (h = 0; h < high-low+1; h++) { - spi = low + prandom_u32()%(high-low+1); - x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family); - if (x0 == NULL) { -- x->id.spi = htonl(spi); -+ newspi = htonl(spi); - break; - } - xfrm_state_put(x0); - } - } -- if (x->id.spi) { -+ if (newspi) { - spin_lock_bh(&net->xfrm.xfrm_state_lock); -+ x->id.spi = newspi; - h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family); - hlist_add_head(&x->byspi, net->xfrm.state_byspi+h); - spin_unlock_bh(&net->xfrm.xfrm_state_lock); -diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c -index 63215b17247c8..379250dd0668e 100644 ---- a/sound/hda/ext/hdac_ext_controller.c -+++ b/sound/hda/ext/hdac_ext_controller.c -@@ -221,6 +221,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_ext_bus *ebus, - return NULL; - if (ebus->idx != bus_idx) - return NULL; -+ if (addr < 0 || addr > 31) -+ return NULL; - - list_for_each_entry(hlink, &ebus->hlink_list, list) { - for (i = 0; i < HDA_MAX_CODECS; i++) { -diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c -index 0ae4f73dc8eb5..5b392662d100b 100644 ---- a/tools/perf/util/session.c -+++ b/tools/perf/util/session.c -@@ -415,6 +415,7 @@ static void perf_event__mmap2_swap(union perf_event *event, - event->mmap2.maj = bswap_32(event->mmap2.maj); - event->mmap2.min = bswap_32(event->mmap2.min); - event->mmap2.ino = bswap_64(event->mmap2.ino); -+ event->mmap2.ino_generation = bswap_64(event->mmap2.ino_generation); - - if (sample_id_all) { - void *data = &event->mmap2.filename; diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.244-245.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.244-245.patch deleted file mode 100644 index 3b8afb4721..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.244-245.patch +++ /dev/null @@ -1,1668 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 17747dcd0e779..a8ceef14e7818 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2196,6 +2196,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - spec_store_bypass_disable=off [X86] - mds=off [X86] - tsx_async_abort=off [X86] -+ no_entry_flush [PPC] -+ no_uaccess_flush [PPC] - - auto (default) - Mitigate all CPU vulnerabilities, but leave SMT -@@ -2476,6 +2478,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - noefi Disable EFI runtime services support. - -+ no_entry_flush [PPC] Don't flush the L1-D cache when entering the kernel. -+ - noexec [IA-64] - - noexec [X86] -@@ -2518,6 +2522,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - nospec_store_bypass_disable - [HW] Disable all mitigations for the Speculative Store Bypass vulnerability - -+ no_uaccess_flush -+ [PPC] Don't flush the L1-D cache after accessing user data. -+ - noxsave [BUGS=X86] Disables x86 extended register state save - and restore using xsave. The kernel will fallback to - enabling legacy floating-point and sse state. -diff --git a/Makefile b/Makefile -index f8b9fd688781c..2d9e5c4688a49 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 244 -+SUBLEVEL = 245 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h -new file mode 100644 -index 0000000000000..cce8e7497d72b ---- /dev/null -+++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h -@@ -0,0 +1,23 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H -+#define _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H -+#include -+ -+DECLARE_STATIC_KEY_FALSE(uaccess_flush_key); -+ -+/* Prototype for function defined in exceptions-64s.S */ -+void do_uaccess_flush(void); -+ -+static __always_inline void allow_user_access(void __user *to, const void __user *from, -+ unsigned long size) -+{ -+} -+ -+static inline void prevent_user_access(void __user *to, const void __user *from, -+ unsigned long size) -+{ -+ if (static_branch_unlikely(&uaccess_flush_key)) -+ do_uaccess_flush(); -+} -+ -+#endif /* _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H */ -diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h -index 3ed536bec462d..fbcfc722d109c 100644 ---- a/arch/powerpc/include/asm/exception-64s.h -+++ b/arch/powerpc/include/asm/exception-64s.h -@@ -65,11 +65,18 @@ - nop; \ - nop - -+#define ENTRY_FLUSH_SLOT \ -+ ENTRY_FLUSH_FIXUP_SECTION; \ -+ nop; \ -+ nop; \ -+ nop; -+ - /* - * r10 must be free to use, r13 must be paca - */ - #define INTERRUPT_TO_KERNEL \ -- STF_ENTRY_BARRIER_SLOT -+ STF_ENTRY_BARRIER_SLOT; \ -+ ENTRY_FLUSH_SLOT - - /* - * Macros for annotating the expected destination of (h)rfid -@@ -597,6 +604,12 @@ label##_relon_hv: \ - EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_HV, vec); \ - EXCEPTION_PROLOG_PSERIES_1(label##_common, EXC_HV); - -+#define MASKABLE_RELON_EXCEPTION_PSERIES_OOL(vec, label) \ -+ .globl label##_relon_pSeries; \ -+label##_relon_pSeries: \ -+ EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_PR, vec); \ -+ EXCEPTION_PROLOG_PSERIES_1(label##_common, EXC_STD) -+ - /* - * Our exception common code can be passed various "additions" - * to specify the behaviour of interrupts, whether to kick the -diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h -index 145a37ab2d3ea..83219710e9043 100644 ---- a/arch/powerpc/include/asm/feature-fixups.h -+++ b/arch/powerpc/include/asm/feature-fixups.h -@@ -200,6 +200,22 @@ label##3: \ - FTR_ENTRY_OFFSET 955b-956b; \ - .popsection; - -+#define UACCESS_FLUSH_FIXUP_SECTION \ -+959: \ -+ .pushsection __uaccess_flush_fixup,"a"; \ -+ .align 2; \ -+960: \ -+ FTR_ENTRY_OFFSET 959b-960b; \ -+ .popsection; -+ -+#define ENTRY_FLUSH_FIXUP_SECTION \ -+957: \ -+ .pushsection __entry_flush_fixup,"a"; \ -+ .align 2; \ -+958: \ -+ FTR_ENTRY_OFFSET 957b-958b; \ -+ .popsection; -+ - #define RFI_FLUSH_FIXUP_SECTION \ - 951: \ - .pushsection __rfi_flush_fixup,"a"; \ -@@ -231,8 +247,11 @@ label##3: \ - #ifndef __ASSEMBLY__ - - extern long stf_barrier_fallback; -+extern long entry_flush_fallback; - extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup; - extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup; -+extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup; -+extern long __start___entry_flush_fixup, __stop___entry_flush_fixup; - extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; - extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup; - extern long __start__btb_flush_fixup, __stop__btb_flush_fixup; -diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h -index b73ab8a7ebc3f..10746519b351b 100644 ---- a/arch/powerpc/include/asm/futex.h -+++ b/arch/powerpc/include/asm/futex.h -@@ -36,6 +36,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, - { - int oldval = 0, ret; - -+ allow_write_to_user(uaddr, sizeof(*uaddr)); - pagefault_disable(); - - switch (op) { -@@ -62,6 +63,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, - - *oval = oldval; - -+ prevent_write_to_user(uaddr, sizeof(*uaddr)); - return ret; - } - -@@ -75,6 +77,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) - return -EFAULT; - -+ allow_write_to_user(uaddr, sizeof(*uaddr)); - __asm__ __volatile__ ( - PPC_ATOMIC_ENTRY_BARRIER - "1: lwarx %1,0,%3 # futex_atomic_cmpxchg_inatomic\n\ -@@ -97,6 +100,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - : "cc", "memory"); - - *uval = prev; -+ prevent_write_to_user(uaddr, sizeof(*uaddr)); - return ret; - } - -diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h -new file mode 100644 -index 0000000000000..f0f8e36ad71f5 ---- /dev/null -+++ b/arch/powerpc/include/asm/kup.h -@@ -0,0 +1,40 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _ASM_POWERPC_KUP_H_ -+#define _ASM_POWERPC_KUP_H_ -+ -+#ifndef __ASSEMBLY__ -+ -+#include -+ -+#ifdef CONFIG_PPC_BOOK3S_64 -+#include -+#else -+static inline void allow_user_access(void __user *to, const void __user *from, -+ unsigned long size) { } -+static inline void prevent_user_access(void __user *to, const void __user *from, -+ unsigned long size) { } -+#endif /* CONFIG_PPC_BOOK3S_64 */ -+ -+static inline void allow_read_from_user(const void __user *from, unsigned long size) -+{ -+ allow_user_access(NULL, from, size); -+} -+ -+static inline void allow_write_to_user(void __user *to, unsigned long size) -+{ -+ allow_user_access(to, NULL, size); -+} -+ -+static inline void prevent_read_from_user(const void __user *from, unsigned long size) -+{ -+ prevent_user_access(NULL, from, size); -+} -+ -+static inline void prevent_write_to_user(void __user *to, unsigned long size) -+{ -+ prevent_user_access(to, NULL, size); -+} -+ -+#endif /* !__ASSEMBLY__ */ -+ -+#endif /* _ASM_POWERPC_KUP_H_ */ -diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h -index ccf44c135389a..3b45a64e491e5 100644 ---- a/arch/powerpc/include/asm/security_features.h -+++ b/arch/powerpc/include/asm/security_features.h -@@ -84,12 +84,19 @@ static inline bool security_ftr_enabled(unsigned long feature) - // Software required to flush link stack on context switch - #define SEC_FTR_FLUSH_LINK_STACK 0x0000000000001000ull - -+// The L1-D cache should be flushed when entering the kernel -+#define SEC_FTR_L1D_FLUSH_ENTRY 0x0000000000004000ull -+ -+// The L1-D cache should be flushed after user accesses from the kernel -+#define SEC_FTR_L1D_FLUSH_UACCESS 0x0000000000008000ull - - // Features enabled by default - #define SEC_FTR_DEFAULT \ - (SEC_FTR_L1D_FLUSH_HV | \ - SEC_FTR_L1D_FLUSH_PR | \ - SEC_FTR_BNDS_CHK_SPEC_BAR | \ -+ SEC_FTR_L1D_FLUSH_ENTRY | \ -+ SEC_FTR_L1D_FLUSH_UACCESS | \ - SEC_FTR_FAVOUR_SECURITY) - - #endif /* _ASM_POWERPC_SECURITY_FEATURES_H */ -diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h -index d299479c770b4..1ccf474f08ab7 100644 ---- a/arch/powerpc/include/asm/setup.h -+++ b/arch/powerpc/include/asm/setup.h -@@ -38,12 +38,16 @@ enum l1d_flush_type { - }; - - void setup_rfi_flush(enum l1d_flush_type, bool enable); -+void setup_entry_flush(bool enable); -+void setup_uaccess_flush(bool enable); - void do_rfi_flush_fixups(enum l1d_flush_type types); - #ifdef CONFIG_PPC_BARRIER_NOSPEC - void setup_barrier_nospec(void); - #else - static inline void setup_barrier_nospec(void) { }; - #endif -+void do_uaccess_flush_fixups(enum l1d_flush_type types); -+void do_entry_flush_fixups(enum l1d_flush_type types); - void do_barrier_nospec_fixups(bool enable); - extern bool barrier_nospec_enabled; - -diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index e51ce5a0e2214..eb4b060efd95e 100644 ---- a/arch/powerpc/include/asm/uaccess.h -+++ b/arch/powerpc/include/asm/uaccess.h -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - - #define VERIFY_READ 0 - #define VERIFY_WRITE 1 -@@ -105,9 +106,14 @@ struct exception_table_entry { - __put_user_check((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr))) - - #define __get_user(x, ptr) \ -- __get_user_nocheck((x), (ptr), sizeof(*(ptr))) -+ __get_user_nocheck((x), (ptr), sizeof(*(ptr)), true) - #define __put_user(x, ptr) \ -- __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr))) -+ __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), true) -+ -+#define __get_user_allowed(x, ptr) \ -+ __get_user_nocheck((x), (ptr), sizeof(*(ptr)), false) -+#define __put_user_allowed(x, ptr) \ -+ __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), false) - - #define __get_user_inatomic(x, ptr) \ - __get_user_nosleep((x), (ptr), sizeof(*(ptr))) -@@ -161,7 +167,7 @@ extern long __put_user_bad(void); - : "r" (x), "b" (addr), "i" (-EFAULT), "0" (err)) - #endif /* __powerpc64__ */ - --#define __put_user_size(x, ptr, size, retval) \ -+#define __put_user_size_allowed(x, ptr, size, retval) \ - do { \ - retval = 0; \ - switch (size) { \ -@@ -173,14 +179,28 @@ do { \ - } \ - } while (0) - --#define __put_user_nocheck(x, ptr, size) \ -+#define __put_user_size(x, ptr, size, retval) \ -+do { \ -+ allow_write_to_user(ptr, size); \ -+ __put_user_size_allowed(x, ptr, size, retval); \ -+ prevent_write_to_user(ptr, size); \ -+} while (0) -+ -+#define __put_user_nocheck(x, ptr, size, do_allow) \ - ({ \ - long __pu_err; \ - __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ -+ __typeof__(*(ptr)) __pu_val = (x); \ -+ __typeof__(size) __pu_size = (size); \ -+ \ - if (!is_kernel_addr((unsigned long)__pu_addr)) \ - might_fault(); \ -- __chk_user_ptr(ptr); \ -- __put_user_size((x), __pu_addr, (size), __pu_err); \ -+ __chk_user_ptr(__pu_addr); \ -+ if (do_allow) \ -+ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ -+ else \ -+ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \ -+ \ - __pu_err; \ - }) - -@@ -188,9 +208,13 @@ do { \ - ({ \ - long __pu_err = -EFAULT; \ - __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ -+ __typeof__(*(ptr)) __pu_val = (x); \ -+ __typeof__(size) __pu_size = (size); \ -+ \ - might_fault(); \ -- if (access_ok(VERIFY_WRITE, __pu_addr, size)) \ -- __put_user_size((x), __pu_addr, (size), __pu_err); \ -+ if (access_ok(VERIFY_WRITE, __pu_addr, __pu_size)) \ -+ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ -+ \ - __pu_err; \ - }) - -@@ -198,8 +222,12 @@ do { \ - ({ \ - long __pu_err; \ - __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ -- __chk_user_ptr(ptr); \ -- __put_user_size((x), __pu_addr, (size), __pu_err); \ -+ __typeof__(*(ptr)) __pu_val = (x); \ -+ __typeof__(size) __pu_size = (size); \ -+ \ -+ __chk_user_ptr(__pu_addr); \ -+ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ -+ \ - __pu_err; \ - }) - -@@ -246,7 +274,7 @@ extern long __get_user_bad(void); - : "b" (addr), "i" (-EFAULT), "0" (err)) - #endif /* __powerpc64__ */ - --#define __get_user_size(x, ptr, size, retval) \ -+#define __get_user_size_allowed(x, ptr, size, retval) \ - do { \ - retval = 0; \ - __chk_user_ptr(ptr); \ -@@ -261,17 +289,30 @@ do { \ - } \ - } while (0) - --#define __get_user_nocheck(x, ptr, size) \ -+#define __get_user_size(x, ptr, size, retval) \ -+do { \ -+ allow_read_from_user(ptr, size); \ -+ __get_user_size_allowed(x, ptr, size, retval); \ -+ prevent_read_from_user(ptr, size); \ -+} while (0) -+ -+#define __get_user_nocheck(x, ptr, size, do_allow) \ - ({ \ - long __gu_err; \ - unsigned long __gu_val; \ - __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ -- __chk_user_ptr(ptr); \ -+ __typeof__(size) __gu_size = (size); \ -+ \ -+ __chk_user_ptr(__gu_addr); \ - if (!is_kernel_addr((unsigned long)__gu_addr)) \ - might_fault(); \ - barrier_nospec(); \ -- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ -+ if (do_allow) \ -+ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ -+ else \ -+ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \ - (x) = (__typeof__(*(ptr)))__gu_val; \ -+ \ - __gu_err; \ - }) - -@@ -296,12 +337,15 @@ do { \ - long __gu_err = -EFAULT; \ - unsigned long __gu_val = 0; \ - __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ -+ __typeof__(size) __gu_size = (size); \ -+ \ - might_fault(); \ -- if (access_ok(VERIFY_READ, __gu_addr, (size))) { \ -+ if (access_ok(VERIFY_READ, __gu_addr, __gu_size)) { \ - barrier_nospec(); \ -- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ -+ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ - } \ - (x) = (__force __typeof__(*(ptr)))__gu_val; \ -+ \ - __gu_err; \ - }) - -@@ -310,10 +354,13 @@ do { \ - long __gu_err; \ - unsigned long __gu_val; \ - __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ -- __chk_user_ptr(ptr); \ -+ __typeof__(size) __gu_size = (size); \ -+ \ -+ __chk_user_ptr(__gu_addr); \ - barrier_nospec(); \ -- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ -+ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ - (x) = (__force __typeof__(*(ptr)))__gu_val; \ -+ \ - __gu_err; \ - }) - -@@ -328,9 +375,14 @@ extern unsigned long __copy_tofrom_user(void __user *to, - static inline unsigned long copy_from_user(void *to, - const void __user *from, unsigned long n) - { -+ unsigned long ret; -+ - if (likely(access_ok(VERIFY_READ, from, n))) { -+ allow_user_access(to, from, n); - barrier_nospec(); -- return __copy_tofrom_user((__force void __user *)to, from, n); -+ ret = __copy_tofrom_user((__force void __user *)to, from, n); -+ prevent_user_access(to, from, n); -+ return ret; - } - memset(to, 0, n); - return n; -@@ -361,8 +413,9 @@ extern unsigned long copy_in_user(void __user *to, const void __user *from, - static inline unsigned long __copy_from_user_inatomic(void *to, - const void __user *from, unsigned long n) - { -+ unsigned long ret; - if (__builtin_constant_p(n) && (n <= 8)) { -- unsigned long ret = 1; -+ ret = 1; - - switch (n) { - case 1: -@@ -387,34 +440,42 @@ static inline unsigned long __copy_from_user_inatomic(void *to, - } - - barrier_nospec(); -- return __copy_tofrom_user((__force void __user *)to, from, n); -+ allow_read_from_user(from, n); -+ ret = __copy_tofrom_user((__force void __user *)to, from, n); -+ prevent_read_from_user(from, n); -+ return ret; - } - - static inline unsigned long __copy_to_user_inatomic(void __user *to, - const void *from, unsigned long n) - { -+ unsigned long ret; -+ - if (__builtin_constant_p(n) && (n <= 8)) { -- unsigned long ret = 1; -+ ret = 1; - - switch (n) { - case 1: -- __put_user_size(*(u8 *)from, (u8 __user *)to, 1, ret); -+ __put_user_size_allowed(*(u8 *)from, (u8 __user *)to, 1, ret); - break; - case 2: -- __put_user_size(*(u16 *)from, (u16 __user *)to, 2, ret); -+ __put_user_size_allowed(*(u16 *)from, (u16 __user *)to, 2, ret); - break; - case 4: -- __put_user_size(*(u32 *)from, (u32 __user *)to, 4, ret); -+ __put_user_size_allowed(*(u32 *)from, (u32 __user *)to, 4, ret); - break; - case 8: -- __put_user_size(*(u64 *)from, (u64 __user *)to, 8, ret); -+ __put_user_size_allowed(*(u64 *)from, (u64 __user *)to, 8, ret); - break; - } - if (ret == 0) - return 0; - } - -- return __copy_tofrom_user(to, (__force const void __user *)from, n); -+ allow_write_to_user(to, n); -+ ret = __copy_tofrom_user(to, (__force const void __user *)from, n); -+ prevent_write_to_user(to, n); -+ return ret; - } - - static inline unsigned long __copy_from_user(void *to, -@@ -431,20 +492,39 @@ static inline unsigned long __copy_to_user(void __user *to, - return __copy_to_user_inatomic(to, from, size); - } - --extern unsigned long __clear_user(void __user *addr, unsigned long size); -+unsigned long __arch_clear_user(void __user *addr, unsigned long size); - - static inline unsigned long clear_user(void __user *addr, unsigned long size) - { -+ unsigned long ret = size; - might_fault(); -- if (likely(access_ok(VERIFY_WRITE, addr, size))) -- return __clear_user(addr, size); -- return size; -+ if (likely(access_ok(VERIFY_WRITE, addr, size))) { -+ allow_write_to_user(addr, size); -+ ret = __arch_clear_user(addr, size); -+ prevent_write_to_user(addr, size); -+ } -+ return ret; -+} -+ -+static inline unsigned long __clear_user(void __user *addr, unsigned long size) -+{ -+ return clear_user(addr, size); - } - - extern long strncpy_from_user(char *dst, const char __user *src, long count); - extern __must_check long strlen_user(const char __user *str); - extern __must_check long strnlen_user(const char __user *str, long n); - -+ -+#define user_access_begin() do { } while (0) -+#define user_access_end() prevent_user_access(NULL, NULL, ~0ul) -+ -+#define unsafe_op_wrap(op, err) do { if (unlikely(op)) goto err; } while (0) -+#define unsafe_get_user(x, p, e) unsafe_op_wrap(__get_user_allowed(x, p), e) -+#define unsafe_put_user(x, p, e) unsafe_op_wrap(__put_user_allowed(x, p), e) -+#define unsafe_copy_to_user(d, s, l, e) \ -+ unsafe_op_wrap(__copy_to_user_inatomic(d, s, l), e) -+ - #endif /* __ASSEMBLY__ */ - #endif /* __KERNEL__ */ - -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 536718ed033fc..7f8e1bdbe3e20 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -202,8 +202,8 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE) - data_access_pSeries: - HMT_MEDIUM_PPR_DISCARD - SET_SCRATCH0(r13) -- EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, data_access_common, EXC_STD, -- KVMTEST, 0x300) -+ EXCEPTION_PROLOG_0(PACA_EXGEN) -+ b data_access_pSeries_ool - - . = 0x380 - .globl data_access_slb_pSeries -@@ -211,31 +211,15 @@ data_access_slb_pSeries: - HMT_MEDIUM_PPR_DISCARD - SET_SCRATCH0(r13) - EXCEPTION_PROLOG_0(PACA_EXSLB) -- EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST, 0x380) -- std r3,PACA_EXSLB+EX_R3(r13) -- mfspr r3,SPRN_DAR --#ifdef __DISABLED__ -- /* Keep that around for when we re-implement dynamic VSIDs */ -- cmpdi r3,0 -- bge slb_miss_user_pseries --#endif /* __DISABLED__ */ -- mfspr r12,SPRN_SRR1 --#ifndef CONFIG_RELOCATABLE -- b slb_miss_realmode --#else -- /* -- * We can't just use a direct branch to slb_miss_realmode -- * because the distance from here to there depends on where -- * the kernel ends up being put. -- */ -- mfctr r11 -- ld r10,PACAKBASE(r13) -- LOAD_HANDLER(r10, slb_miss_realmode) -- mtctr r10 -- bctr --#endif -+ b data_access_slb_pSeries_ool - -- STD_EXCEPTION_PSERIES(0x400, 0x400, instruction_access) -+ . = 0x400 -+ .globl instruction_access_pSeries -+instruction_access_pSeries: -+ HMT_MEDIUM_PPR_DISCARD -+ SET_SCRATCH0(r13) -+ EXCEPTION_PROLOG_0(PACA_EXGEN) -+ b instruction_access_pSeries_ool - - . = 0x480 - .globl instruction_access_slb_pSeries -@@ -243,24 +227,7 @@ instruction_access_slb_pSeries: - HMT_MEDIUM_PPR_DISCARD - SET_SCRATCH0(r13) - EXCEPTION_PROLOG_0(PACA_EXSLB) -- EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x480) -- std r3,PACA_EXSLB+EX_R3(r13) -- mfspr r3,SPRN_SRR0 /* SRR0 is faulting address */ --#ifdef __DISABLED__ -- /* Keep that around for when we re-implement dynamic VSIDs */ -- cmpdi r3,0 -- bge slb_miss_user_pseries --#endif /* __DISABLED__ */ -- mfspr r12,SPRN_SRR1 --#ifndef CONFIG_RELOCATABLE -- b slb_miss_realmode --#else -- mfctr r11 -- ld r10,PACAKBASE(r13) -- LOAD_HANDLER(r10, slb_miss_realmode) -- mtctr r10 -- bctr --#endif -+ b instruction_access_slb_pSeries_ool - - /* We open code these as we can't have a ". = x" (even with - * x = "." within a feature section -@@ -291,13 +258,19 @@ hardware_interrupt_hv: - KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0x800) - - . = 0x900 -- .globl decrementer_pSeries --decrementer_pSeries: -+ .globl decrementer_trampoline -+decrementer_trampoline: - SET_SCRATCH0(r13) - EXCEPTION_PROLOG_0(PACA_EXGEN) - b decrementer_ool - -- STD_EXCEPTION_HV(0x980, 0x982, hdecrementer) -+ . = 0x980 -+ .globl hdecrementer_trampoline -+hdecrementer_trampoline: -+ HMT_MEDIUM_PPR_DISCARD; -+ SET_SCRATCH0(r13); -+ EXCEPTION_PROLOG_0(PACA_EXGEN) -+ b hdecrementer_hv - - MASKABLE_EXCEPTION_PSERIES(0xa00, 0xa00, doorbell_super) - KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xa00) -@@ -545,6 +518,64 @@ machine_check_pSeries_0: - KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0x900) - KVM_HANDLER(PACA_EXGEN, EXC_HV, 0x982) - -+/* moved from 0x300 */ -+ .globl data_access_pSeries_ool -+data_access_pSeries_ool: -+ EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST, 0x300) -+ EXCEPTION_PROLOG_PSERIES_1(data_access_common, EXC_STD) -+ -+ .globl data_access_slb_pSeries_ool -+data_access_slb_pSeries_ool: -+ EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST, 0x380) -+ std r3,PACA_EXSLB+EX_R3(r13) -+ mfspr r3,SPRN_DAR -+#ifdef __DISABLED__ -+ /* Keep that around for when we re-implement dynamic VSIDs */ -+ cmpdi r3,0 -+ bge slb_miss_user_pseries -+#endif /* __DISABLED__ */ -+ mfspr r12,SPRN_SRR1 -+#ifndef CONFIG_RELOCATABLE -+ b slb_miss_realmode -+#else -+ /* -+ * We can't just use a direct branch to slb_miss_realmode -+ * because the distance from here to there depends on where -+ * the kernel ends up being put. -+ */ -+ mfctr r11 -+ ld r10,PACAKBASE(r13) -+ LOAD_HANDLER(r10, slb_miss_realmode) -+ mtctr r10 -+ bctr -+#endif -+ -+ .globl instruction_access_pSeries_ool -+instruction_access_pSeries_ool: -+ EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST_PR, 0x400) -+ EXCEPTION_PROLOG_PSERIES_1(instruction_access_common, EXC_STD) -+ -+ .globl instruction_access_slb_pSeries_ool -+instruction_access_slb_pSeries_ool: -+ EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x480) -+ std r3,PACA_EXSLB+EX_R3(r13) -+ mfspr r3,SPRN_SRR0 /* SRR0 is faulting address */ -+#ifdef __DISABLED__ -+ /* Keep that around for when we re-implement dynamic VSIDs */ -+ cmpdi r3,0 -+ bge slb_miss_user_pseries -+#endif /* __DISABLED__ */ -+ mfspr r12,SPRN_SRR1 -+#ifndef CONFIG_RELOCATABLE -+ b slb_miss_realmode -+#else -+ mfctr r11 -+ ld r10,PACAKBASE(r13) -+ LOAD_HANDLER(r10, slb_miss_realmode) -+ mtctr r10 -+ bctr -+#endif -+ - #ifdef CONFIG_PPC_DENORMALISATION - denorm_assist: - BEGIN_FTR_SECTION -@@ -612,6 +643,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR) - .align 7 - /* moved from 0xe00 */ - MASKABLE_EXCEPTION_OOL(0x900, decrementer) -+ STD_EXCEPTION_HV_OOL(0x982, hdecrementer) - STD_EXCEPTION_HV_OOL(0xe02, h_data_storage) - KVM_HANDLER_SKIP(PACA_EXGEN, EXC_HV, 0xe02) - STD_EXCEPTION_HV_OOL(0xe22, h_instr_storage) -@@ -894,7 +926,15 @@ hardware_interrupt_relon_hv: - STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment) - STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check) - STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable) -- MASKABLE_RELON_EXCEPTION_PSERIES(0x4900, 0x900, decrementer) -+ -+ . = 0x4900 -+ .globl decrementer_relon_trampoline -+decrementer_relon_trampoline: -+ HMT_MEDIUM_PPR_DISCARD -+ SET_SCRATCH0(r13) -+ EXCEPTION_PROLOG_0(PACA_EXGEN) -+ b decrementer_relon_pSeries -+ - STD_RELON_EXCEPTION_HV(0x4980, 0x982, hdecrementer) - MASKABLE_RELON_EXCEPTION_PSERIES(0x4a00, 0xa00, doorbell_super) - STD_RELON_EXCEPTION_PSERIES(0x4b00, 0xb00, trap_0b) -@@ -1244,6 +1284,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX) - __end_handlers: - - /* Equivalents to the above handlers for relocation-on interrupt vectors */ -+ MASKABLE_RELON_EXCEPTION_PSERIES_OOL(0x900, decrementer) -+ - STD_RELON_EXCEPTION_HV_OOL(0xe40, emulation_assist) - MASKABLE_RELON_EXCEPTION_HV_OOL(0xe80, h_doorbell) - -@@ -1588,14 +1630,9 @@ stf_barrier_fallback: - .endr - blr - -- .globl rfi_flush_fallback --rfi_flush_fallback: -- SET_SCRATCH0(r13); -- GET_PACA(r13); -- std r9,PACA_EXRFI+EX_R9(r13) -- std r10,PACA_EXRFI+EX_R10(r13) -- std r11,PACA_EXRFI+EX_R11(r13) -- mfctr r9 -+ -+/* Clobbers r10, r11, ctr */ -+.macro L1D_DISPLACEMENT_FLUSH - ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) - ld r11,PACA_L1D_FLUSH_SIZE(r13) - srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */ -@@ -1621,7 +1658,18 @@ rfi_flush_fallback: - ld r11,(0x80 + 8)*7(r10) - addi r10,r10,0x80*8 - bdnz 1b -+.endm -+ - -+ .globl rfi_flush_fallback -+rfi_flush_fallback: -+ SET_SCRATCH0(r13); -+ GET_PACA(r13); -+ std r9,PACA_EXRFI+EX_R9(r13) -+ std r10,PACA_EXRFI+EX_R10(r13) -+ std r11,PACA_EXRFI+EX_R11(r13) -+ mfctr r9 -+ L1D_DISPLACEMENT_FLUSH - mtctr r9 - ld r9,PACA_EXRFI+EX_R9(r13) - ld r10,PACA_EXRFI+EX_R10(r13) -@@ -1637,32 +1685,7 @@ hrfi_flush_fallback: - std r10,PACA_EXRFI+EX_R10(r13) - std r11,PACA_EXRFI+EX_R11(r13) - mfctr r9 -- ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) -- ld r11,PACA_L1D_FLUSH_SIZE(r13) -- srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */ -- mtctr r11 -- DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ -- -- /* order ld/st prior to dcbt stop all streams with flushing */ -- sync -- -- /* -- * The load adresses are at staggered offsets within cachelines, -- * which suits some pipelines better (on others it should not -- * hurt). -- */ --1: -- ld r11,(0x80 + 8)*0(r10) -- ld r11,(0x80 + 8)*1(r10) -- ld r11,(0x80 + 8)*2(r10) -- ld r11,(0x80 + 8)*3(r10) -- ld r11,(0x80 + 8)*4(r10) -- ld r11,(0x80 + 8)*5(r10) -- ld r11,(0x80 + 8)*6(r10) -- ld r11,(0x80 + 8)*7(r10) -- addi r10,r10,0x80*8 -- bdnz 1b -- -+ L1D_DISPLACEMENT_FLUSH - mtctr r9 - ld r9,PACA_EXRFI+EX_R9(r13) - ld r10,PACA_EXRFI+EX_R10(r13) -@@ -1670,6 +1693,20 @@ hrfi_flush_fallback: - GET_SCRATCH0(r13); - hrfid - -+ .globl entry_flush_fallback -+entry_flush_fallback: -+ std r9,PACA_EXRFI+EX_R9(r13) -+ std r10,PACA_EXRFI+EX_R10(r13) -+ std r11,PACA_EXRFI+EX_R11(r13) -+ mfctr r9 -+ L1D_DISPLACEMENT_FLUSH -+ mtctr r9 -+ ld r9,PACA_EXRFI+EX_R9(r13) -+ ld r10,PACA_EXRFI+EX_R10(r13) -+ ld r11,PACA_EXRFI+EX_R11(r13) -+ blr -+ -+ - /* - * Hash table stuff - */ -@@ -1829,3 +1866,12 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR) - 1: addi r3,r1,STACK_FRAME_OVERHEAD - bl kernel_bad_stack - b 1b -+ -+_KPROBE(do_uaccess_flush) -+ UACCESS_FLUSH_FIXUP_SECTION -+ nop -+ nop -+ nop -+ blr -+ L1D_DISPLACEMENT_FLUSH -+ blr -diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S -index 01e274e6907b1..3d7512e729005 100644 ---- a/arch/powerpc/kernel/head_8xx.S -+++ b/arch/powerpc/kernel/head_8xx.S -@@ -361,11 +361,9 @@ InstructionTLBMiss: - /* Load the MI_TWC with the attributes for this "segment." */ - MTSPR_CPU6(SPRN_MI_TWC, r11, r3) /* Set segment attributes */ - --#ifdef CONFIG_SWAP -- rlwinm r11, r10, 32-5, _PAGE_PRESENT -+ rlwinm r11, r10, 32-11, _PAGE_PRESENT - and r11, r11, r10 - rlwimi r10, r11, 0, _PAGE_PRESENT --#endif - li r11, RPN_PATTERN - /* The Linux PTE won't go exactly into the MMU TLB. - * Software indicator bits 20-23 and 28 must be clear. -@@ -436,11 +434,9 @@ DataStoreTLBMiss: - * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5)); - * r10 = (r10 & ~PRESENT) | r11; - */ --#ifdef CONFIG_SWAP -- rlwinm r11, r10, 32-5, _PAGE_PRESENT -+ rlwinm r11, r10, 32-11, _PAGE_PRESENT - and r11, r11, r10 - rlwimi r10, r11, 0, _PAGE_PRESENT --#endif - /* The Linux PTE won't go exactly into the MMU TLB. - * Software indicator bits 22 and 28 must be clear. - * Software indicator bits 24, 25, 26, and 27 must be -diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c -index 202963ee013a8..80eb47113d5dc 100644 ---- a/arch/powerpc/kernel/ppc_ksyms.c -+++ b/arch/powerpc/kernel/ppc_ksyms.c -@@ -5,6 +5,10 @@ - #include - #include - #include -+#include -+#ifdef CONFIG_PPC64 -+#include -+#endif - - EXPORT_SYMBOL(flush_dcache_range); - EXPORT_SYMBOL(flush_icache_range); -@@ -43,3 +47,9 @@ EXPORT_SYMBOL(epapr_hypercall_start); - #endif - - EXPORT_SYMBOL(current_stack_pointer); -+ -+EXPORT_SYMBOL(__arch_clear_user); -+ -+#ifdef CONFIG_PPC64 -+EXPORT_SYMBOL(do_uaccess_flush); -+#endif -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index 11590f6cb2f9d..3c67175693609 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -844,7 +844,13 @@ early_initcall(disable_hardlockup_detector); - static enum l1d_flush_type enabled_flush_types; - static void *l1d_flush_fallback_area; - static bool no_rfi_flush; -+static bool no_entry_flush; -+static bool no_uaccess_flush; - bool rfi_flush; -+bool entry_flush; -+bool uaccess_flush; -+DEFINE_STATIC_KEY_FALSE(uaccess_flush_key); -+EXPORT_SYMBOL(uaccess_flush_key); - - static int __init handle_no_rfi_flush(char *p) - { -@@ -854,6 +860,22 @@ static int __init handle_no_rfi_flush(char *p) - } - early_param("no_rfi_flush", handle_no_rfi_flush); - -+static int __init handle_no_entry_flush(char *p) -+{ -+ pr_info("entry-flush: disabled on command line."); -+ no_entry_flush = true; -+ return 0; -+} -+early_param("no_entry_flush", handle_no_entry_flush); -+ -+static int __init handle_no_uaccess_flush(char *p) -+{ -+ pr_info("uaccess-flush: disabled on command line."); -+ no_uaccess_flush = true; -+ return 0; -+} -+early_param("no_uaccess_flush", handle_no_uaccess_flush); -+ - /* - * The RFI flush is not KPTI, but because users will see doco that says to use - * nopti we hijack that option here to also disable the RFI flush. -@@ -885,6 +907,35 @@ void rfi_flush_enable(bool enable) - rfi_flush = enable; - } - -+void entry_flush_enable(bool enable) -+{ -+ if (enable) { -+ do_entry_flush_fixups(enabled_flush_types); -+ on_each_cpu(do_nothing, NULL, 1); -+ } else { -+ do_entry_flush_fixups(L1D_FLUSH_NONE); -+ } -+ -+ entry_flush = enable; -+} -+ -+void uaccess_flush_enable(bool enable) -+{ -+ if (enable) { -+ do_uaccess_flush_fixups(enabled_flush_types); -+ if (static_key_initialized) -+ static_branch_enable(&uaccess_flush_key); -+ else -+ printk(KERN_DEBUG "uaccess-flush: deferring static key until after static key initialization\n"); -+ on_each_cpu(do_nothing, NULL, 1); -+ } else { -+ static_branch_disable(&uaccess_flush_key); -+ do_uaccess_flush_fixups(L1D_FLUSH_NONE); -+ } -+ -+ uaccess_flush = enable; -+} -+ - static void __ref init_fallback_flush(void) - { - u64 l1d_size, limit; -@@ -930,6 +981,24 @@ void setup_rfi_flush(enum l1d_flush_type types, bool enable) - rfi_flush_enable(enable); - } - -+void setup_entry_flush(bool enable) -+{ -+ if (cpu_mitigations_off()) -+ return; -+ -+ if (!no_entry_flush) -+ entry_flush_enable(enable); -+} -+ -+void setup_uaccess_flush(bool enable) -+{ -+ if (cpu_mitigations_off()) -+ return; -+ -+ if (!no_uaccess_flush) -+ uaccess_flush_enable(enable); -+} -+ - #ifdef CONFIG_DEBUG_FS - static int rfi_flush_set(void *data, u64 val) - { -@@ -957,11 +1026,80 @@ static int rfi_flush_get(void *data, u64 *val) - - DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n"); - -+static int entry_flush_set(void *data, u64 val) -+{ -+ bool enable; -+ -+ if (val == 1) -+ enable = true; -+ else if (val == 0) -+ enable = false; -+ else -+ return -EINVAL; -+ -+ /* Only do anything if we're changing state */ -+ if (enable != entry_flush) -+ entry_flush_enable(enable); -+ -+ return 0; -+} -+ -+static int entry_flush_get(void *data, u64 *val) -+{ -+ *val = entry_flush ? 1 : 0; -+ return 0; -+} -+ -+DEFINE_SIMPLE_ATTRIBUTE(fops_entry_flush, entry_flush_get, entry_flush_set, "%llu\n"); -+ -+static int uaccess_flush_set(void *data, u64 val) -+{ -+ bool enable; -+ -+ if (val == 1) -+ enable = true; -+ else if (val == 0) -+ enable = false; -+ else -+ return -EINVAL; -+ -+ /* Only do anything if we're changing state */ -+ if (enable != uaccess_flush) -+ uaccess_flush_enable(enable); -+ -+ return 0; -+} -+ -+static int uaccess_flush_get(void *data, u64 *val) -+{ -+ *val = uaccess_flush ? 1 : 0; -+ return 0; -+} -+ -+DEFINE_SIMPLE_ATTRIBUTE(fops_uaccess_flush, uaccess_flush_get, uaccess_flush_set, "%llu\n"); -+ -+ - static __init int rfi_flush_debugfs_init(void) - { - debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush); -+ debugfs_create_file("entry_flush", 0600, powerpc_debugfs_root, NULL, &fops_entry_flush); -+ debugfs_create_file("uaccess_flush", 0600, powerpc_debugfs_root, NULL, &fops_uaccess_flush); - return 0; - } - device_initcall(rfi_flush_debugfs_init); - #endif -+ -+/* -+ * setup_uaccess_flush runs before jump_label_init, so we can't do the setup -+ * there. Do it now instead. -+ */ -+static __init int uaccess_flush_static_key_init(void) -+{ -+ if (uaccess_flush) { -+ printk(KERN_DEBUG "uaccess-flush: switching on static key\n"); -+ static_branch_enable(&uaccess_flush_key); -+ } -+ return 0; -+} -+early_initcall(uaccess_flush_static_key_init); - #endif /* CONFIG_PPC_BOOK3S_64 */ -diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S -index 9b1e297be6730..f820d03335eb6 100644 ---- a/arch/powerpc/kernel/vmlinux.lds.S -+++ b/arch/powerpc/kernel/vmlinux.lds.S -@@ -80,6 +80,20 @@ SECTIONS - __stop___stf_entry_barrier_fixup = .; - } - -+ . = ALIGN(8); -+ __uaccess_flush_fixup : AT(ADDR(__uaccess_flush_fixup) - LOAD_OFFSET) { -+ __start___uaccess_flush_fixup = .; -+ *(__uaccess_flush_fixup) -+ __stop___uaccess_flush_fixup = .; -+ } -+ -+ . = ALIGN(8); -+ __entry_flush_fixup : AT(ADDR(__entry_flush_fixup) - LOAD_OFFSET) { -+ __start___entry_flush_fixup = .; -+ *(__entry_flush_fixup) -+ __stop___entry_flush_fixup = .; -+ } -+ - . = ALIGN(8); - __stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) { - __start___stf_exit_barrier_fixup = .; -diff --git a/arch/powerpc/lib/checksum_wrappers_64.c b/arch/powerpc/lib/checksum_wrappers_64.c -index 08e3a3356c402..11b58949eb628 100644 ---- a/arch/powerpc/lib/checksum_wrappers_64.c -+++ b/arch/powerpc/lib/checksum_wrappers_64.c -@@ -29,6 +29,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst, - unsigned int csum; - - might_sleep(); -+ allow_read_from_user(src, len); - - *err_ptr = 0; - -@@ -60,6 +61,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst, - } - - out: -+ prevent_read_from_user(src, len); - return (__force __wsum)csum; - } - EXPORT_SYMBOL(csum_and_copy_from_user); -@@ -70,6 +72,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len, - unsigned int csum; - - might_sleep(); -+ allow_write_to_user(dst, len); - - *err_ptr = 0; - -@@ -97,6 +100,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len, - } - - out: -+ prevent_write_to_user(dst, len); - return (__force __wsum)csum; - } - EXPORT_SYMBOL(csum_and_copy_to_user); -diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c -index 7bdfc19a491d5..40b134bf5a680 100644 ---- a/arch/powerpc/lib/feature-fixups.c -+++ b/arch/powerpc/lib/feature-fixups.c -@@ -229,6 +229,110 @@ void do_stf_barrier_fixups(enum stf_barrier_type types) - do_stf_exit_barrier_fixups(types); - } - -+void do_uaccess_flush_fixups(enum l1d_flush_type types) -+{ -+ unsigned int instrs[4], *dest; -+ long *start, *end; -+ int i; -+ -+ start = PTRRELOC(&__start___uaccess_flush_fixup); -+ end = PTRRELOC(&__stop___uaccess_flush_fixup); -+ -+ instrs[0] = 0x60000000; /* nop */ -+ instrs[1] = 0x60000000; /* nop */ -+ instrs[2] = 0x60000000; /* nop */ -+ instrs[3] = 0x4e800020; /* blr */ -+ -+ i = 0; -+ if (types == L1D_FLUSH_FALLBACK) { -+ instrs[3] = 0x60000000; /* nop */ -+ /* fallthrough to fallback flush */ -+ } -+ -+ if (types & L1D_FLUSH_ORI) { -+ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ -+ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/ -+ } -+ -+ if (types & L1D_FLUSH_MTTRIG) -+ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */ -+ -+ for (i = 0; start < end; start++, i++) { -+ dest = (void *)start + *start; -+ -+ pr_devel("patching dest %lx\n", (unsigned long)dest); -+ -+ patch_instruction(dest, instrs[0]); -+ -+ patch_instruction((dest + 1), instrs[1]); -+ patch_instruction((dest + 2), instrs[2]); -+ patch_instruction((dest + 3), instrs[3]); -+ } -+ -+ printk(KERN_DEBUG "uaccess-flush: patched %d locations (%s flush)\n", i, -+ (types == L1D_FLUSH_NONE) ? "no" : -+ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" : -+ (types & L1D_FLUSH_ORI) ? (types & L1D_FLUSH_MTTRIG) -+ ? "ori+mttrig type" -+ : "ori type" : -+ (types & L1D_FLUSH_MTTRIG) ? "mttrig type" -+ : "unknown"); -+} -+ -+void do_entry_flush_fixups(enum l1d_flush_type types) -+{ -+ unsigned int instrs[3], *dest; -+ long *start, *end; -+ int i; -+ -+ start = PTRRELOC(&__start___entry_flush_fixup); -+ end = PTRRELOC(&__stop___entry_flush_fixup); -+ -+ instrs[0] = 0x60000000; /* nop */ -+ instrs[1] = 0x60000000; /* nop */ -+ instrs[2] = 0x60000000; /* nop */ -+ -+ i = 0; -+ if (types == L1D_FLUSH_FALLBACK) { -+ instrs[i++] = 0x7d4802a6; /* mflr r10 */ -+ instrs[i++] = 0x60000000; /* branch patched below */ -+ instrs[i++] = 0x7d4803a6; /* mtlr r10 */ -+ } -+ -+ if (types & L1D_FLUSH_ORI) { -+ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ -+ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/ -+ } -+ -+ if (types & L1D_FLUSH_MTTRIG) -+ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */ -+ -+ for (i = 0; start < end; start++, i++) { -+ dest = (void *)start + *start; -+ -+ pr_devel("patching dest %lx\n", (unsigned long)dest); -+ -+ patch_instruction(dest, instrs[0]); -+ -+ if (types == L1D_FLUSH_FALLBACK) -+ patch_branch((dest + 1), (unsigned long)&entry_flush_fallback, -+ BRANCH_SET_LINK); -+ else -+ patch_instruction((dest + 1), instrs[1]); -+ -+ patch_instruction((dest + 2), instrs[2]); -+ } -+ -+ printk(KERN_DEBUG "entry-flush: patched %d locations (%s flush)\n", i, -+ (types == L1D_FLUSH_NONE) ? "no" : -+ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" : -+ (types & L1D_FLUSH_ORI) ? (types & L1D_FLUSH_MTTRIG) -+ ? "ori+mttrig type" -+ : "ori type" : -+ (types & L1D_FLUSH_MTTRIG) ? "mttrig type" -+ : "unknown"); -+} -+ - void do_rfi_flush_fixups(enum l1d_flush_type types) - { - unsigned int instrs[3], *dest; -diff --git a/arch/powerpc/lib/string.S b/arch/powerpc/lib/string.S -index c80fb49ce607f..93c4c34ad0910 100644 ---- a/arch/powerpc/lib/string.S -+++ b/arch/powerpc/lib/string.S -@@ -122,7 +122,7 @@ _GLOBAL(memchr) - blr - - #ifdef CONFIG_PPC32 --_GLOBAL(__clear_user) -+_GLOBAL(__arch_clear_user) - addi r6,r3,-4 - li r3,0 - li r5,0 -diff --git a/arch/powerpc/lib/string_64.S b/arch/powerpc/lib/string_64.S -index 7bd9549a90a23..14d26ad2cd69e 100644 ---- a/arch/powerpc/lib/string_64.S -+++ b/arch/powerpc/lib/string_64.S -@@ -27,7 +27,7 @@ PPC64_CACHES: - .section ".text" - - /** -- * __clear_user: - Zero a block of memory in user space, with less checking. -+ * __arch_clear_user: - Zero a block of memory in user space, with less checking. - * @to: Destination address, in user space. - * @n: Number of bytes to zero. - * -@@ -77,7 +77,7 @@ err3; stb r0,0(r3) - mr r3,r4 - blr - --_GLOBAL_TOC(__clear_user) -+_GLOBAL_TOC(__arch_clear_user) - cmpdi r4,32 - neg r6,r3 - li r0,0 -diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c -index e14b52c7ebd83..6259228a0e18c 100644 ---- a/arch/powerpc/platforms/powernv/setup.c -+++ b/arch/powerpc/platforms/powernv/setup.c -@@ -124,12 +124,27 @@ static void pnv_setup_rfi_flush(void) - type = L1D_FLUSH_ORI; - } - -+ /* -+ * 4.4 doesn't support Power9 bare metal, so we don't need to flush -+ * here - the flushes fix a P9 specific vulnerability. -+ */ -+ security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY); -+ security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS); -+ - enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \ - (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) || \ - security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)); - - setup_rfi_flush(type, enable); - setup_count_cache_flush(); -+ -+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && -+ security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY); -+ setup_entry_flush(enable); -+ -+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && -+ security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS); -+ setup_uaccess_flush(enable); - } - - static void __init pnv_setup_arch(void) -diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c -index 88fcf6a95fa67..498c5092bd23a 100644 ---- a/arch/powerpc/platforms/pseries/setup.c -+++ b/arch/powerpc/platforms/pseries/setup.c -@@ -584,6 +584,14 @@ void pseries_setup_rfi_flush(void) - - setup_rfi_flush(types, enable); - setup_count_cache_flush(); -+ -+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && -+ security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY); -+ setup_entry_flush(enable); -+ -+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && -+ security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS); -+ setup_uaccess_flush(enable); - } - - static void __init pSeries_setup_arch(void) -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 0c1e249a7ab69..827d54a5126e8 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -3922,6 +3922,12 @@ static int em_clflush(struct x86_emulate_ctxt *ctxt) - return X86EMUL_CONTINUE; - } - -+static int em_clflushopt(struct x86_emulate_ctxt *ctxt) -+{ -+ /* emulating clflushopt regardless of cpuid */ -+ return X86EMUL_CONTINUE; -+} -+ - static int em_movsxd(struct x86_emulate_ctxt *ctxt) - { - ctxt->dst.val = (s32) ctxt->src.val; -@@ -4411,7 +4417,7 @@ static const struct opcode group11[] = { - }; - - static const struct gprefix pfx_0f_ae_7 = { -- I(SrcMem | ByteOp, em_clflush), N, N, N, -+ I(SrcMem | ByteOp, em_clflush), I(SrcMem | ByteOp, em_clflushopt), N, N, - }; - - static const struct group_dual group15 = { { -diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c -index d121c5732d7db..37303a7a2e737 100644 ---- a/drivers/i2c/busses/i2c-imx.c -+++ b/drivers/i2c/busses/i2c-imx.c -@@ -1093,20 +1093,20 @@ static int i2c_imx_probe(struct platform_device *pdev) - goto clk_disable; - } - -- /* Request IRQ */ -- ret = devm_request_irq(&pdev->dev, irq, i2c_imx_isr, 0, -- pdev->name, i2c_imx); -- if (ret) { -- dev_err(&pdev->dev, "can't claim irq %d\n", irq); -- goto clk_disable; -- } -- - /* Init queue */ - init_waitqueue_head(&i2c_imx->queue); - - /* Set up adapter data */ - i2c_set_adapdata(&i2c_imx->adapter, i2c_imx); - -+ /* Request IRQ */ -+ ret = request_threaded_irq(irq, i2c_imx_isr, NULL, 0, -+ pdev->name, i2c_imx); -+ if (ret) { -+ dev_err(&pdev->dev, "can't claim irq %d\n", irq); -+ goto clk_disable; -+ } -+ - /* Set up clock divider */ - i2c_imx->bitrate = IMX_I2C_BIT_RATE; - ret = of_property_read_u32(pdev->dev.of_node, -@@ -1125,7 +1125,7 @@ static int i2c_imx_probe(struct platform_device *pdev) - ret = i2c_add_numbered_adapter(&i2c_imx->adapter); - if (ret < 0) { - dev_err(&pdev->dev, "registration failed\n"); -- goto clk_disable; -+ goto clk_free_irq; - } - - /* Set up platform driver data */ -@@ -1143,6 +1143,8 @@ static int i2c_imx_probe(struct platform_device *pdev) - - return 0; /* Return OK */ - -+clk_free_irq: -+ free_irq(irq, i2c_imx); - clk_disable: - clk_disable_unprepare(i2c_imx->clk); - return ret; -@@ -1151,6 +1153,7 @@ clk_disable: - static int i2c_imx_remove(struct platform_device *pdev) - { - struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev); -+ int irq; - - /* remove adapter */ - dev_dbg(&i2c_imx->adapter.dev, "adapter removed\n"); -@@ -1165,6 +1168,10 @@ static int i2c_imx_remove(struct platform_device *pdev) - imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR); - imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR); - -+ irq = platform_get_irq(pdev, 0); -+ if (irq >= 0) -+ free_irq(irq, i2c_imx); -+ - return 0; - } - -diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c -index dc6bb9d5b4f02..191c27dda3860 100644 ---- a/drivers/input/keyboard/sunkbd.c -+++ b/drivers/input/keyboard/sunkbd.c -@@ -115,7 +115,8 @@ static irqreturn_t sunkbd_interrupt(struct serio *serio, - switch (data) { - - case SUNKBD_RET_RESET: -- schedule_work(&sunkbd->tq); -+ if (sunkbd->enabled) -+ schedule_work(&sunkbd->tq); - sunkbd->reset = -1; - break; - -@@ -216,16 +217,12 @@ static int sunkbd_initialize(struct sunkbd *sunkbd) - } - - /* -- * sunkbd_reinit() sets leds and beeps to a state the computer remembers they -- * were in. -+ * sunkbd_set_leds_beeps() sets leds and beeps to a state the computer remembers -+ * they were in. - */ - --static void sunkbd_reinit(struct work_struct *work) -+static void sunkbd_set_leds_beeps(struct sunkbd *sunkbd) - { -- struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); -- -- wait_event_interruptible_timeout(sunkbd->wait, sunkbd->reset >= 0, HZ); -- - serio_write(sunkbd->serio, SUNKBD_CMD_SETLED); - serio_write(sunkbd->serio, - (!!test_bit(LED_CAPSL, sunkbd->dev->led) << 3) | -@@ -238,11 +235,39 @@ static void sunkbd_reinit(struct work_struct *work) - SUNKBD_CMD_BELLOFF - !!test_bit(SND_BELL, sunkbd->dev->snd)); - } - -+ -+/* -+ * sunkbd_reinit() wait for the keyboard reset to complete and restores state -+ * of leds and beeps. -+ */ -+ -+static void sunkbd_reinit(struct work_struct *work) -+{ -+ struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq); -+ -+ /* -+ * It is OK that we check sunkbd->enabled without pausing serio, -+ * as we only want to catch true->false transition that will -+ * happen once and we will be woken up for it. -+ */ -+ wait_event_interruptible_timeout(sunkbd->wait, -+ sunkbd->reset >= 0 || !sunkbd->enabled, -+ HZ); -+ -+ if (sunkbd->reset >= 0 && sunkbd->enabled) -+ sunkbd_set_leds_beeps(sunkbd); -+} -+ - static void sunkbd_enable(struct sunkbd *sunkbd, bool enable) - { - serio_pause_rx(sunkbd->serio); - sunkbd->enabled = enable; - serio_continue_rx(sunkbd->serio); -+ -+ if (!enable) { -+ wake_up_interruptible(&sunkbd->wait); -+ cancel_work_sync(&sunkbd->tq); -+ } - } - - /* -diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c -index adbc1f59969a5..d8cdab4bfd30d 100644 ---- a/fs/xfs/xfs_icache.c -+++ b/fs/xfs/xfs_icache.c -@@ -134,6 +134,46 @@ xfs_inode_free( - call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback); - } - -+/* -+ * If we are allocating a new inode, then check what was returned is -+ * actually a free, empty inode. If we are not allocating an inode, -+ * then check we didn't find a free inode. -+ * -+ * Returns: -+ * 0 if the inode free state matches the lookup context -+ * -ENOENT if the inode is free and we are not allocating -+ * -EFSCORRUPTED if there is any state mismatch at all -+ */ -+static int -+xfs_iget_check_free_state( -+ struct xfs_inode *ip, -+ int flags) -+{ -+ if (flags & XFS_IGET_CREATE) { -+ /* should be a free inode */ -+ if (ip->i_d.di_mode != 0) { -+ xfs_warn(ip->i_mount, -+"Corruption detected! Free inode 0x%llx not marked free! (mode 0x%x)", -+ ip->i_ino, ip->i_d.di_mode); -+ return -EFSCORRUPTED; -+ } -+ -+ if (ip->i_d.di_nblocks != 0) { -+ xfs_warn(ip->i_mount, -+"Corruption detected! Free inode 0x%llx has blocks allocated!", -+ ip->i_ino); -+ return -EFSCORRUPTED; -+ } -+ return 0; -+ } -+ -+ /* should be an allocated inode */ -+ if (ip->i_d.di_mode == 0) -+ return -ENOENT; -+ -+ return 0; -+} -+ - /* - * Check the validity of the inode we just found it the cache - */ -@@ -183,12 +223,12 @@ xfs_iget_cache_hit( - } - - /* -- * If lookup is racing with unlink return an error immediately. -+ * Check the inode free state is valid. This also detects lookup -+ * racing with unlinks. - */ -- if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) { -- error = -ENOENT; -+ error = xfs_iget_check_free_state(ip, flags); -+ if (error) - goto out_error; -- } - - /* - * If IRECLAIMABLE is set, we've torn down the VFS inode already. -@@ -298,10 +338,14 @@ xfs_iget_cache_miss( - - trace_xfs_iget_miss(ip); - -- if ((ip->i_d.di_mode == 0) && !(flags & XFS_IGET_CREATE)) { -- error = -ENOENT; -+ -+ /* -+ * Check the inode free state is valid. This also detects lookup -+ * racing with unlinks. -+ */ -+ error = xfs_iget_check_free_state(ip, flags); -+ if (error) - goto out_destroy; -- } - - /* - * Preload the radix tree so we can insert safely under the -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index bbddab248c489..6f7c3f6a5027b 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -242,6 +242,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata, - */ - void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) - { -+ /* -+ * If we had used sta_info_pre_move_state() then we might not -+ * have gone through the state transitions down again, so do -+ * it here now (and warn if it's inserted). -+ * -+ * This will clear state such as fast TX/RX that may have been -+ * allocated during state transitions. -+ */ -+ while (sta->sta_state > IEEE80211_STA_NONE) { -+ int ret; -+ -+ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED)); -+ -+ ret = sta_info_move_state(sta, sta->sta_state - 1); -+ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret)) -+ break; -+ } -+ - if (sta->rate_ctrl) - rate_control_free_sta(sta); - diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.245-246.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.245-246.patch deleted file mode 100644 index a754217e7f..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.245-246.patch +++ /dev/null @@ -1,1047 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2d9e5c4688a49..c42ada4e88466 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 245 -+SUBLEVEL = 246 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts -index 27d763c7a307d..4dbd180e72ba6 100644 ---- a/arch/arm/boot/dts/imx50-evk.dts -+++ b/arch/arm/boot/dts/imx50-evk.dts -@@ -66,7 +66,7 @@ - MX50_PAD_CSPI_MISO__CSPI_MISO 0x00 - MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00 - MX50_PAD_CSPI_SS0__GPIO4_11 0xc4 -- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4 -+ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84 - >; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi -index 1211da894ee99..061e6a00b2557 100644 ---- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi -@@ -39,7 +39,7 @@ - &fec { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_enet>; -- phy-mode = "rgmii"; -+ phy-mode = "rgmii-id"; - status = "okay"; - }; - -diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c -index e6ad81556575c..ae91d202b7475 100644 ---- a/arch/arm64/kernel/psci.c -+++ b/arch/arm64/kernel/psci.c -@@ -136,7 +136,6 @@ static int cpu_psci_cpu_disable(unsigned int cpu) - - static void cpu_psci_cpu_die(unsigned int cpu) - { -- int ret; - /* - * There are no known implementations of PSCI actually using the - * power state field, pass a sensible default for now. -@@ -144,9 +143,7 @@ static void cpu_psci_cpu_die(unsigned int cpu) - u32 state = PSCI_POWER_STATE_TYPE_POWER_DOWN << - PSCI_0_2_POWER_STATE_TYPE_SHIFT; - -- ret = psci_ops.cpu_off(state); -- -- pr_crit("unable to power off CPU%u (%d)\n", cpu, ret); -+ psci_ops.cpu_off(state); - } - - static int cpu_psci_cpu_kill(unsigned int cpu) -diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c -index bd34f4093cd9f..7b0dec333c964 100644 ---- a/arch/mips/alchemy/common/clock.c -+++ b/arch/mips/alchemy/common/clock.c -@@ -151,6 +151,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, - { - struct clk_init_data id; - struct clk_hw *h; -+ struct clk *clk; - - h = kzalloc(sizeof(*h), GFP_KERNEL); - if (!h) -@@ -163,7 +164,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, - id.ops = &alchemy_clkops_cpu; - h->init = &id; - -- return clk_register(NULL, h); -+ clk = clk_register(NULL, h); -+ if (IS_ERR(clk)) { -+ pr_err("failed to register clock\n"); -+ kfree(h); -+ } -+ -+ return clk; - } - - /* AUXPLLs ************************************************************/ -diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S -index 7ffd158de76e5..1b837d6f73deb 100644 ---- a/arch/mips/kernel/genex.S -+++ b/arch/mips/kernel/genex.S -@@ -142,9 +142,8 @@ LEAF(__r4k_wait) - PTR_LA k1, __r4k_wait - ori k0, 0x1f /* 32 byte rollback region */ - xori k0, 0x1f -- bne k0, k1, 9f -+ bne k0, k1, \handler - MTC0 k0, CP0_EPC --9: - .set pop - .endm - -diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c -index 80eb47113d5dc..0f05c85cbde38 100644 ---- a/arch/powerpc/kernel/ppc_ksyms.c -+++ b/arch/powerpc/kernel/ppc_ksyms.c -@@ -6,7 +6,7 @@ - #include - #include - #include --#ifdef CONFIG_PPC64 -+#ifdef CONFIG_PPC_BOOK3S_64 - #include - #endif - -@@ -50,6 +50,6 @@ EXPORT_SYMBOL(current_stack_pointer); - - EXPORT_SYMBOL(__arch_clear_user); - --#ifdef CONFIG_PPC64 -+#ifdef CONFIG_PPC_BOOK3S_64 - EXPORT_SYMBOL(do_uaccess_flush); - #endif -diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c -index 4a76b381d25aa..59429133491cd 100644 ---- a/arch/s390/kernel/perf_cpum_sf.c -+++ b/arch/s390/kernel/perf_cpum_sf.c -@@ -1666,4 +1666,4 @@ out: - return err; - } - arch_initcall(init_cpum_sampling_pmu); --core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640); -+core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0644); -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index 619d69aa81c89..d4c3a30a7b334 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -132,51 +132,6 @@ load_microcode(struct mc_saved_data *mc_saved_data, unsigned long *initrd, - } - } - --/* -- * Given CPU signature and a microcode patch, this function finds if the -- * microcode patch has matching family and model with the CPU. -- */ --static enum ucode_state --matching_model_microcode(struct microcode_header_intel *mc_header, -- unsigned long sig) --{ -- unsigned int fam, model; -- unsigned int fam_ucode, model_ucode; -- struct extended_sigtable *ext_header; -- unsigned long total_size = get_totalsize(mc_header); -- unsigned long data_size = get_datasize(mc_header); -- int ext_sigcount, i; -- struct extended_signature *ext_sig; -- -- fam = __x86_family(sig); -- model = x86_model(sig); -- -- fam_ucode = __x86_family(mc_header->sig); -- model_ucode = x86_model(mc_header->sig); -- -- if (fam == fam_ucode && model == model_ucode) -- return UCODE_OK; -- -- /* Look for ext. headers: */ -- if (total_size <= data_size + MC_HEADER_SIZE) -- return UCODE_NFOUND; -- -- ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE; -- ext_sig = (void *)ext_header + EXT_HEADER_SIZE; -- ext_sigcount = ext_header->count; -- -- for (i = 0; i < ext_sigcount; i++) { -- fam_ucode = __x86_family(ext_sig->sig); -- model_ucode = x86_model(ext_sig->sig); -- -- if (fam == fam_ucode && model == model_ucode) -- return UCODE_OK; -- -- ext_sig++; -- } -- return UCODE_NFOUND; --} -- - static int - save_microcode(struct mc_saved_data *mc_saved_data, - struct microcode_intel **mc_saved_src, -@@ -321,8 +276,8 @@ get_matching_model_microcode(int cpu, unsigned long start, - * the platform, we need to find and save microcode patches - * with the same family and model as the BSP. - */ -- if (matching_model_microcode(mc_header, uci->cpu_sig.sig) != -- UCODE_OK) { -+ if (!find_matching_signature(mc_header, uci->cpu_sig.sig, -+ uci->cpu_sig.pf)) { - ucode_ptr += mc_size; - continue; - } -diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c -index 1a804a2f9a5be..2fe5cabfc41ec 100644 ---- a/arch/xtensa/mm/cache.c -+++ b/arch/xtensa/mm/cache.c -@@ -74,8 +74,10 @@ static inline void kmap_invalidate_coherent(struct page *page, - kvaddr = TLBTEMP_BASE_1 + - (page_to_phys(page) & DCACHE_ALIAS_MASK); - -+ preempt_disable(); - __invalidate_dcache_page_alias(kvaddr, - page_to_phys(page)); -+ preempt_enable(); - } - } - } -@@ -162,6 +164,7 @@ void flush_dcache_page(struct page *page) - if (!alias && !mapping) - return; - -+ preempt_disable(); - virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK); - __flush_invalidate_dcache_page_alias(virt, phys); - -@@ -172,6 +175,7 @@ void flush_dcache_page(struct page *page) - - if (mapping) - __invalidate_icache_page_alias(virt, phys); -+ preempt_enable(); - } - - /* There shouldn't be an entry in the cache for this page anymore. */ -@@ -204,8 +208,10 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address, - unsigned long phys = page_to_phys(pfn_to_page(pfn)); - unsigned long virt = TLBTEMP_BASE_1 + (address & DCACHE_ALIAS_MASK); - -+ preempt_disable(); - __flush_invalidate_dcache_page_alias(virt, phys); - __invalidate_icache_page_alias(virt, phys); -+ preempt_enable(); - } - - #endif -@@ -231,11 +237,13 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep) - unsigned long phys = page_to_phys(page); - unsigned long tmp; - -+ preempt_disable(); - tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK); - __flush_invalidate_dcache_page_alias(tmp, phys); - tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK); - __flush_invalidate_dcache_page_alias(tmp, phys); - __invalidate_icache_page_alias(tmp, phys); -+ preempt_enable(); - - clear_bit(PG_arch_1, &page->flags); - } -@@ -269,7 +277,9 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page, - - if (alias) { - unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK); -+ preempt_disable(); - __flush_invalidate_dcache_page_alias(t, phys); -+ preempt_enable(); - } - - /* Copy data */ -@@ -284,9 +294,11 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page, - if (alias) { - unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK); - -+ preempt_disable(); - __flush_invalidate_dcache_range((unsigned long) dst, len); - if ((vma->vm_flags & VM_EXEC) != 0) - __invalidate_icache_page_alias(t, phys); -+ preempt_enable(); - - } else if ((vma->vm_flags & VM_EXEC) != 0) { - __flush_dcache_range((unsigned long)dst,len); -@@ -308,7 +320,9 @@ extern void copy_from_user_page(struct vm_area_struct *vma, struct page *page, - - if (alias) { - unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK); -+ preempt_disable(); - __flush_invalidate_dcache_page_alias(t, phys); -+ preempt_enable(); - } - - memcpy(dst, src, len); -diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c -index ddc4ceb85fc56..49da83f87170b 100644 ---- a/drivers/atm/nicstar.c -+++ b/drivers/atm/nicstar.c -@@ -1704,6 +1704,8 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb) - - if (push_scqe(card, vc, scq, &scqe, skb) != 0) { - atomic_inc(&vcc->stats->tx_err); -+ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len, -+ DMA_TO_DEVICE); - dev_kfree_skb_any(skb); - return -EIO; - } -diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c -index 2b2d02f408bbb..2e189646d8fe2 100644 ---- a/drivers/input/misc/adxl34x.c -+++ b/drivers/input/misc/adxl34x.c -@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, - struct input_dev *input_dev; - const struct adxl34x_platform_data *pdata; - int err, range, i; -- unsigned char revid; -+ int revid; - - if (!irq) { - dev_err(dev, "no IRQ?\n"); -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 9579dae54af29..52110017fd401 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -525,7 +525,7 @@ static void can_restart(struct net_device *dev) - } - cf->can_id |= CAN_ERR_RESTARTED; - -- netif_rx(skb); -+ netif_rx_ni(skb); - - stats->rx_packets++; - stats->rx_bytes += cf->can_dlc; -diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c -index 195f15edb32e3..0bd7e71647964 100644 ---- a/drivers/net/can/m_can/m_can.c -+++ b/drivers/net/can/m_can/m_can.c -@@ -572,7 +572,7 @@ static int m_can_handle_state_change(struct net_device *dev, - unsigned int ecr; - - switch (new_state) { -- case CAN_STATE_ERROR_ACTIVE: -+ case CAN_STATE_ERROR_WARNING: - /* error warning state */ - priv->can.can_stats.error_warning++; - priv->can.state = CAN_STATE_ERROR_WARNING; -@@ -601,7 +601,7 @@ static int m_can_handle_state_change(struct net_device *dev, - __m_can_get_berr_counter(dev, &bec); - - switch (new_state) { -- case CAN_STATE_ERROR_ACTIVE: -+ case CAN_STATE_ERROR_WARNING: - /* error warning state */ - cf->can_id |= CAN_ERR_CRTL; - cf->data[1] = (bec.txerr > bec.rxerr) ? -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index 22deddb2dbf5a..7b148174eb760 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -176,7 +176,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts, - if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { - /* case when event time (tsw) wraps */ - if (ts < time_ref->ts_dev_1) -- delta_ts = 1 << time_ref->adapter->ts_used_bits; -+ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits); - - /* Otherwise, sync time counter (ts_dev_2) has wrapped: - * handle case when event time (tsn) hasn't. -@@ -188,7 +188,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts, - * tsn ts - */ - } else if (time_ref->ts_dev_1 < ts) { -- delta_ts = -(1 << time_ref->adapter->ts_used_bits); -+ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits); - } - - /* add delay between last sync and event timestamps */ -diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c -index e7214edfe5b46..4db19cf5b587d 100644 ---- a/drivers/net/ethernet/broadcom/b44.c -+++ b/drivers/net/ethernet/broadcom/b44.c -@@ -2393,7 +2393,8 @@ static int b44_init_one(struct ssb_device *sdev, - goto err_out_free_dev; - } - -- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) { -+ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30)); -+ if (err) { - dev_err(sdev->dev, - "Required 30BIT DMA mask unsupported by the system\n"); - goto err_out_powerdown; -diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c -index 0a4e9731d33bc..b6ae4b17555ba 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/fw.c -+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c -@@ -1711,14 +1711,14 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, struct mlx4_init_hca_param *param) - #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77) - #define INIT_HCA_MCAST_OFFSET 0x0c0 - #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00) --#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12) --#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16) -+#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13) -+#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17) - #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18) - #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b) - #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6 - #define INIT_HCA_FS_PARAM_OFFSET 0x1d0 - #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00) --#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12) -+#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13) - #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18) - #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b) - #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21) -diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h -index 074631be342ba..8f04c26da36ec 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/fw.h -+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h -@@ -184,8 +184,8 @@ struct mlx4_init_hca_param { - u64 cmpt_base; - u64 mtt_base; - u64 global_caps; -- u16 log_mc_entry_sz; -- u16 log_mc_hash_sz; -+ u8 log_mc_entry_sz; -+ u8 log_mc_hash_sz; - u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */ - u8 log_num_qps; - u8 log_num_srqs; -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c -index 083aeca77c758..b0f51ff9e5b35 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c -@@ -2255,7 +2255,8 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter) - - /* Boot either flash image or firmware image from host file system */ - if (qlcnic_load_fw_file == 1) { -- if (qlcnic_83xx_load_fw_image_from_host(adapter)) -+ err = qlcnic_83xx_load_fw_image_from_host(adapter); -+ if (err) - return err; - } else { - QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID, -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 14eca1f80ce36..42303f3f1348d 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -702,7 +702,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x05c6, 0x9011, 4)}, - {QMI_FIXED_INTF(0x05c6, 0x9021, 1)}, - {QMI_FIXED_INTF(0x05c6, 0x9022, 2)}, -- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ -+ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ - {QMI_FIXED_INTF(0x05c6, 0x9026, 3)}, - {QMI_FIXED_INTF(0x05c6, 0x902e, 5)}, - {QMI_FIXED_INTF(0x05c6, 0x9031, 5)}, -diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c -index 616055b5e9967..eba400df82154 100644 ---- a/drivers/pinctrl/pinctrl-rockchip.c -+++ b/drivers/pinctrl/pinctrl-rockchip.c -@@ -1445,7 +1445,9 @@ static int rockchip_gpio_to_irq(struct gpio_chip *gc, unsigned offset) - if (!bank->domain) - return -ENXIO; - -+ clk_enable(bank->clk); - virq = irq_create_mapping(bank->domain, offset); -+ clk_disable(bank->clk); - - return (virq) ? : -ENXIO; - } -diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c -index 6d17357b3a248..5f5f63eb8c762 100644 ---- a/drivers/regulator/ti-abb-regulator.c -+++ b/drivers/regulator/ti-abb-regulator.c -@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) - return ret; - } - -- /* If data is exactly the same, then just update index, no change */ - info = &abb->info[sel]; -+ /* -+ * When Linux kernel is starting up, we are'nt sure of the -+ * Bias configuration that bootloader has configured. -+ * So, we get to know the actual setting the first time -+ * we are asked to transition. -+ */ -+ if (abb->current_info_idx == -EINVAL) -+ goto just_set_abb; -+ -+ /* If data is exactly the same, then just update index, no change */ - oinfo = &abb->info[abb->current_info_idx]; - if (!memcmp(info, oinfo, sizeof(*info))) { - dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__, -@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) - goto out; - } - -+just_set_abb: - ret = ti_abb_set_opp(rdev, abb, info); - - out: -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index ca69e2ca6b561..6a9fa718bfd8e 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1628,16 +1628,6 @@ imx_console_write(struct console *co, const char *s, unsigned int count) - unsigned int ucr1; - unsigned long flags = 0; - int locked = 1; -- int retval; -- -- retval = clk_enable(sport->clk_per); -- if (retval) -- return; -- retval = clk_enable(sport->clk_ipg); -- if (retval) { -- clk_disable(sport->clk_per); -- return; -- } - - if (sport->port.sysrq) - locked = 0; -@@ -1673,9 +1663,6 @@ imx_console_write(struct console *co, const char *s, unsigned int count) - - if (locked) - spin_unlock_irqrestore(&sport->port.lock, flags); -- -- clk_disable(sport->clk_ipg); -- clk_disable(sport->clk_per); - } - - /* -@@ -1776,15 +1763,14 @@ imx_console_setup(struct console *co, char *options) - - retval = uart_set_options(&sport->port, co, baud, parity, bits, flow); - -- clk_disable(sport->clk_ipg); - if (retval) { -- clk_unprepare(sport->clk_ipg); -+ clk_disable_unprepare(sport->clk_ipg); - goto error_console; - } - -- retval = clk_prepare(sport->clk_per); -+ retval = clk_prepare_enable(sport->clk_per); - if (retval) -- clk_unprepare(sport->clk_ipg); -+ clk_disable_unprepare(sport->clk_ipg); - - error_console: - return retval; -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index fca235020312d..0e4f20377d196 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -23,6 +23,7 @@ LIST_HEAD(efivarfs_list); - static void efivarfs_evict_inode(struct inode *inode) - { - clear_inode(inode); -+ kfree(inode->i_private); - } - - static const struct super_operations efivarfs_ops = { -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index de47525972a1c..abffa2488ae91 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2398,7 +2398,8 @@ int ext4_insert_dentry(struct inode *dir, - struct ext4_filename *fname); - static inline void ext4_update_dx_flag(struct inode *inode) - { -- if (!ext4_has_feature_dir_index(inode->i_sb)) { -+ if (!ext4_has_feature_dir_index(inode->i_sb) && -+ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) { - /* ext4_iget() should have caught this... */ - WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb)); - ext4_clear_inode_flag(inode, EXT4_INODE_INDEX); -diff --git a/fs/libfs.c b/fs/libfs.c -index a33e95f8729bf..01e9cae5b1601 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -827,7 +827,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, - size_t len, loff_t *ppos) - { - struct simple_attr *attr; -- u64 val; -+ unsigned long long val; - size_t size; - ssize_t ret; - -@@ -845,7 +845,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, - goto out; - - attr->set_buf[size] = '\0'; -- val = simple_strtoll(attr->set_buf, NULL, 0); -+ ret = kstrtoull(attr->set_buf, 0, &val); -+ if (ret) -+ goto out; - ret = attr->set(attr->data, val); - if (ret == 0) - ret = len; /* on success, claim we got the whole input */ -diff --git a/include/net/mac80211.h b/include/net/mac80211.h -index ec11cb1c0d808..0fbe5fc558f00 100644 ---- a/include/net/mac80211.h -+++ b/include/net/mac80211.h -@@ -1915,6 +1915,11 @@ struct ieee80211_txq { - * @IEEE80211_HW_BEACON_TX_STATUS: The device/driver provides TX status - * for sent beacons. - * -+ * @IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR: Hardware (or driver) requires that each -+ * station has a unique address, i.e. each station entry can be identified -+ * by just its MAC address; this prevents, for example, the same station -+ * from connecting to two virtual AP interfaces at the same time. -+ * - * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays - */ - enum ieee80211_hw_flags { -@@ -1950,6 +1955,7 @@ enum ieee80211_hw_flags { - IEEE80211_HW_TDLS_WIDER_BW, - IEEE80211_HW_SUPPORTS_AMSDU_IN_AMPDU, - IEEE80211_HW_BEACON_TX_STATUS, -+ IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR, - - /* keep last, obviously */ - NUM_IEEE80211_HW_FLAGS -diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c -index 3d462fee9ed75..06e88c6bb5115 100644 ---- a/net/bridge/br_device.c -+++ b/net/bridge/br_device.c -@@ -166,6 +166,7 @@ static struct rtnl_link_stats64 *br_get_stats64(struct net_device *dev, - sum.rx_packets += tmp.rx_packets; - } - -+ netdev_stats_to_stats64(stats, &dev->stats); - stats->tx_bytes = sum.tx_bytes; - stats->tx_packets = sum.tx_packets; - stats->rx_bytes = sum.rx_bytes; -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index f2610f8f171ca..2a64de757be9b 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -661,15 +662,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup); - - int netpoll_setup(struct netpoll *np) - { -- struct net_device *ndev = NULL; -+ struct net_device *ndev = NULL, *dev = NULL; -+ struct net *net = current->nsproxy->net_ns; - struct in_device *in_dev; - int err; - - rtnl_lock(); -- if (np->dev_name[0]) { -- struct net *net = current->nsproxy->net_ns; -+ if (np->dev_name) - ndev = __dev_get_by_name(net, np->dev_name); -- } -+ - if (!ndev) { - np_err(np, "%s doesn't exist, aborting\n", np->dev_name); - err = -ENODEV; -@@ -677,6 +678,19 @@ int netpoll_setup(struct netpoll *np) - } - dev_hold(ndev); - -+ /* bring up DSA management network devices up first */ -+ for_each_netdev(net, dev) { -+ if (!netdev_uses_dsa(dev)) -+ continue; -+ -+ err = dev_change_flags(dev, dev->flags | IFF_UP); -+ if (err < 0) { -+ np_err(np, "%s failed to open %s\n", -+ np->dev_name, dev->name); -+ goto put; -+ } -+ } -+ - if (netdev_master_upper_dev_get(ndev)) { - np_err(np, "%s is a slave device, aborting\n", np->dev_name); - err = -EBUSY; -diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c -index 0edc44cb254e0..519e0730d9f62 100644 ---- a/net/ipv6/ah6.c -+++ b/net/ipv6/ah6.c -@@ -595,7 +595,8 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) - memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); - memset(ah->auth_data, 0, ahp->icv_trunc_len); - -- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN)) -+ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN); -+ if (err) - goto out_free; - - ip6h->priority = 0; -diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c -index e546a987a9d37..3e24d0ddb51bf 100644 ---- a/net/mac80211/debugfs.c -+++ b/net/mac80211/debugfs.c -@@ -125,6 +125,7 @@ static const char *hw_flag_names[] = { - FLAG(TDLS_WIDER_BW), - FLAG(SUPPORTS_AMSDU_IN_AMPDU), - FLAG(BEACON_TX_STATUS), -+ FLAG(NEEDS_UNIQUE_STA_ADDR), - #undef FLAG - }; - -diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c -index b54f398cda5d0..dfcb65d36832b 100644 ---- a/net/mac80211/rc80211_minstrel.c -+++ b/net/mac80211/rc80211_minstrel.c -@@ -274,7 +274,7 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband, - success = !!(info->flags & IEEE80211_TX_STAT_ACK); - - for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) { -- if (ar[i].idx < 0) -+ if (ar[i].idx < 0 || !ar[i].count) - break; - - ndx = rix_to_ndx(mi, ar[i].idx); -@@ -287,12 +287,6 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband, - mi->r[ndx].stats.success += success; - } - -- if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0)) -- mi->sample_packets++; -- -- if (mi->sample_deferred > 0) -- mi->sample_deferred--; -- - if (time_after(jiffies, mi->last_stats_update + - (mp->update_interval * HZ) / 1000)) - minstrel_update_stats(mp, mi); -@@ -366,7 +360,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, - #endif - - delta = (mi->total_packets * sampling_ratio / 100) - -- (mi->sample_packets + mi->sample_deferred / 2); -+ mi->sample_packets; - - /* delta < 0: no sampling required */ - prev_sample = mi->prev_sample; -@@ -375,7 +369,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, - return; - - if (mi->total_packets >= 10000) { -- mi->sample_deferred = 0; - mi->sample_packets = 0; - mi->total_packets = 0; - } else if (delta > mi->n_rates * 2) { -@@ -400,19 +393,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, - * rate sampling method should be used. - * Respect such rates that are not sampled for 20 interations. - */ -- if (mrr_capable && -- msr->perfect_tx_time > mr->perfect_tx_time && -- msr->stats.sample_skipped < 20) { -- /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark -- * packets that have the sampling rate deferred to the -- * second MRR stage. Increase the sample counter only -- * if the deferred sample rate was actually used. -- * Use the sample_deferred counter to make sure that -- * the sampling is not done in large bursts */ -- info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE; -- rate++; -- mi->sample_deferred++; -- } else { -+ if (msr->perfect_tx_time < mr->perfect_tx_time || -+ msr->stats.sample_skipped >= 20) { - if (!msr->sample_limit) - return; - -@@ -432,6 +414,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, - - rate->idx = mi->r[ndx].rix; - rate->count = minstrel_get_retry_count(&mi->r[ndx], info); -+ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE; - } - - -diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h -index c230bbe93262b..5a9e44f4fba49 100644 ---- a/net/mac80211/rc80211_minstrel.h -+++ b/net/mac80211/rc80211_minstrel.h -@@ -105,7 +105,6 @@ struct minstrel_sta_info { - u8 max_prob_rate; - unsigned int total_packets; - unsigned int sample_packets; -- int sample_deferred; - - unsigned int sample_row; - unsigned int sample_column; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 6f7c3f6a5027b..e63d64e1225d7 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -457,6 +457,19 @@ static int sta_info_insert_check(struct sta_info *sta) - is_multicast_ether_addr(sta->sta.addr))) - return -EINVAL; - -+ /* Strictly speaking this isn't necessary as we hold the mutex, but -+ * the rhashtable code can't really deal with that distinction. We -+ * do require the mutex for correctness though. -+ */ -+ rcu_read_lock(); -+ lockdep_assert_held(&sdata->local->sta_mtx); -+ if (ieee80211_hw_check(&sdata->local->hw, NEEDS_UNIQUE_STA_ADDR) && -+ ieee80211_find_sta_by_ifaddr(&sdata->local->hw, sta->addr, NULL)) { -+ rcu_read_unlock(); -+ return -ENOTUNIQ; -+ } -+ rcu_read_unlock(); -+ - return 0; - } - -@@ -570,7 +583,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - out_drop_sta: - local->num_sta--; - synchronize_net(); -- __cleanup_single_sta(sta); -+ cleanup_single_sta(sta); - out_err: - mutex_unlock(&local->sta_mtx); - kfree(sinfo); -@@ -585,22 +598,17 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU) - - might_sleep(); - -+ mutex_lock(&local->sta_mtx); -+ - err = sta_info_insert_check(sta); - if (err) { -+ sta_info_free(local, sta); -+ mutex_unlock(&local->sta_mtx); - rcu_read_lock(); -- goto out_free; -+ return err; - } - -- mutex_lock(&local->sta_mtx); -- -- err = sta_info_insert_finish(sta); -- if (err) -- goto out_free; -- -- return 0; -- out_free: -- sta_info_free(local, sta); -- return err; -+ return sta_info_insert_finish(sta); - } - - int sta_info_insert(struct sta_info *sta) -diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c -index 9f4ec16abfcff..5210f5546e3eb 100644 ---- a/net/netlabel/netlabel_unlabeled.c -+++ b/net/netlabel/netlabel_unlabeled.c -@@ -1185,12 +1185,13 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, - struct netlbl_unlhsh_walk_arg cb_arg; - u32 skip_bkt = cb->args[0]; - u32 skip_chain = cb->args[1]; -- u32 iter_bkt; -- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; -+ u32 skip_addr4 = cb->args[2]; -+ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; - struct netlbl_unlhsh_iface *iface; - struct list_head *iter_list; - struct netlbl_af4list *addr4; - #if IS_ENABLED(CONFIG_IPV6) -+ u32 skip_addr6 = cb->args[3]; - struct netlbl_af6list *addr6; - #endif - -@@ -1201,7 +1202,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, - rcu_read_lock(); - for (iter_bkt = skip_bkt; - iter_bkt < rcu_dereference(netlbl_unlhsh)->size; -- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { -+ iter_bkt++) { - iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; - list_for_each_entry_rcu(iface, iter_list, list) { - if (!iface->valid || -@@ -1209,7 +1210,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, - continue; - netlbl_af4list_foreach_rcu(addr4, - &iface->addr4_list) { -- if (iter_addr4++ < cb->args[2]) -+ if (iter_addr4++ < skip_addr4) - continue; - if (netlbl_unlabel_staticlist_gen( - NLBL_UNLABEL_C_STATICLIST, -@@ -1222,10 +1223,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, - goto unlabel_staticlist_return; - } - } -+ iter_addr4 = 0; -+ skip_addr4 = 0; - #if IS_ENABLED(CONFIG_IPV6) - netlbl_af6list_foreach_rcu(addr6, - &iface->addr6_list) { -- if (iter_addr6++ < cb->args[3]) -+ if (iter_addr6++ < skip_addr6) - continue; - if (netlbl_unlabel_staticlist_gen( - NLBL_UNLABEL_C_STATICLIST, -@@ -1238,8 +1241,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, - goto unlabel_staticlist_return; - } - } -+ iter_addr6 = 0; -+ skip_addr6 = 0; - #endif /* IPv6 */ - } -+ iter_chain = 0; -+ skip_chain = 0; - } - - unlabel_staticlist_return: -diff --git a/net/sctp/input.c b/net/sctp/input.c -index 71c2ef84c5b07..9fa89a35afcd3 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -448,7 +448,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk, - else { - if (!mod_timer(&t->proto_unreach_timer, - jiffies + (HZ/20))) -- sctp_association_hold(asoc); -+ sctp_transport_hold(t); - } - } else { - struct net *net = sock_net(sk); -@@ -457,7 +457,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk, - "encountered!\n", __func__); - - if (del_timer(&t->proto_unreach_timer)) -- sctp_association_put(asoc); -+ sctp_transport_put(t); - - sctp_do_sm(net, SCTP_EVENT_T_OTHER, - SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), -diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c -index 8e2e10d127286..fc3d8ca21f6ee 100644 ---- a/net/sctp/sm_sideeffect.c -+++ b/net/sctp/sm_sideeffect.c -@@ -416,7 +416,7 @@ void sctp_generate_proto_unreach_event(unsigned long data) - /* Try again later. */ - if (!mod_timer(&transport->proto_unreach_timer, - jiffies + (HZ/20))) -- sctp_association_hold(asoc); -+ sctp_transport_hold(transport); - goto out_unlock; - } - -@@ -432,7 +432,7 @@ void sctp_generate_proto_unreach_event(unsigned long data) - - out_unlock: - bh_unlock_sock(sk); -- sctp_association_put(asoc); -+ sctp_transport_put(transport); - } - - -diff --git a/net/sctp/transport.c b/net/sctp/transport.c -index fbbe268e34e77..f8041fb032905 100644 ---- a/net/sctp/transport.c -+++ b/net/sctp/transport.c -@@ -148,7 +148,7 @@ void sctp_transport_free(struct sctp_transport *transport) - - /* Delete the ICMP proto unreachable timer if it's active. */ - if (del_timer(&transport->proto_unreach_timer)) -- sctp_association_put(transport->asoc); -+ sctp_transport_put(transport); - - sctp_transport_put(transport); - } -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index e39bb38eedf30..dd9a0cff22877 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -1047,6 +1047,7 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb, - makex25->lci = lci; - makex25->dest_addr = dest_addr; - makex25->source_addr = source_addr; -+ x25_neigh_hold(nb); - makex25->neighbour = nb; - makex25->facilities = facilities; - makex25->dte_facilities= dte_facilities; -diff --git a/sound/core/control.c b/sound/core/control.c -index 2be860a446a2f..43c8eac250b8a 100644 ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -1349,7 +1349,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, - - unlock: - up_write(&card->controls_rwsem); -- return 0; -+ return err; - } - - static int snd_ctl_elem_add_user(struct snd_ctl_file *file, -diff --git a/sound/pci/mixart/mixart_core.c b/sound/pci/mixart/mixart_core.c -index dccf3db48fe06..1381f4fa08565 100644 ---- a/sound/pci/mixart/mixart_core.c -+++ b/sound/pci/mixart/mixart_core.c -@@ -83,7 +83,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp, - unsigned int i; - #endif - -- mutex_lock(&mgr->msg_lock); - err = 0; - - /* copy message descriptor from miXart to driver */ -@@ -132,8 +131,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp, - writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD)); - - _clean_exit: -- mutex_unlock(&mgr->msg_lock); -- - return err; - } - -@@ -271,7 +268,9 @@ int snd_mixart_send_msg(struct mixart_mgr *mgr, struct mixart_msg *request, int - resp.data = resp_data; - resp.size = max_resp_size; - -+ mutex_lock(&mgr->msg_lock); - err = get_msg(mgr, &resp, msg_frame); -+ mutex_unlock(&mgr->msg_lock); - - if( request->message_id != resp.message_id ) - dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n"); -diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c -index de16aaed516e6..daf2dc0232450 100644 ---- a/tools/perf/builtin-lock.c -+++ b/tools/perf/builtin-lock.c -@@ -616,7 +616,7 @@ static int report_lock_release_event(struct perf_evsel *evsel, - case SEQ_STATE_READ_ACQUIRED: - seq->read_count--; - BUG_ON(seq->read_count < 0); -- if (!seq->read_count) { -+ if (seq->read_count) { - ls->nr_release++; - goto end; - } diff --git a/patch/kernel/archive/rockpis-4.4/patch-4.4.246-247.patch b/patch/kernel/archive/rockpis-4.4/patch-4.4.246-247.patch deleted file mode 100644 index 75ce3fbef2..0000000000 --- a/patch/kernel/archive/rockpis-4.4/patch-4.4.246-247.patch +++ /dev/null @@ -1,814 +0,0 @@ -diff --git a/Makefile b/Makefile -index c42ada4e88466..c493d3ae046f6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 246 -+SUBLEVEL = 247 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 2c9a2992863b0..ffc3bc8111b80 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -707,11 +707,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) - if (boot_cpu_has(X86_FEATURE_IBPB)) { - setup_force_cpu_cap(X86_FEATURE_USE_IBPB); - -+ spectre_v2_user_ibpb = mode; - switch (cmd) { - case SPECTRE_V2_USER_CMD_FORCE: - case SPECTRE_V2_USER_CMD_PRCTL_IBPB: - case SPECTRE_V2_USER_CMD_SECCOMP_IBPB: - static_branch_enable(&switch_mm_always_ibpb); -+ spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT; - break; - case SPECTRE_V2_USER_CMD_PRCTL: - case SPECTRE_V2_USER_CMD_AUTO: -@@ -725,8 +727,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) - pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n", - static_key_enabled(&switch_mm_always_ibpb) ? - "always-on" : "conditional"); -- -- spectre_v2_user_ibpb = mode; - } - - /* -diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c -index 85872a08994a1..e9fc0f7df0da8 100644 ---- a/arch/x86/xen/spinlock.c -+++ b/arch/x86/xen/spinlock.c -@@ -301,10 +301,20 @@ void xen_init_lock_cpu(int cpu) - - void xen_uninit_lock_cpu(int cpu) - { -+ int irq; -+ - if (!xen_pvspin) - return; - -- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL); -+ /* -+ * When booting the kernel with 'mitigations=auto,nosmt', the secondary -+ * CPUs are not activated, and lock_kicker_irq is not initialized. -+ */ -+ irq = per_cpu(lock_kicker_irq, cpu); -+ if (irq == -1) -+ return; -+ -+ unbind_from_irqhandler(irq, NULL); - per_cpu(lock_kicker_irq, cpu) = -1; - kfree(per_cpu(irq_name, cpu)); - per_cpu(irq_name, cpu) = NULL; -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 9aa57b37381a9..7f66ae1945b24 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2634,7 +2634,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, - * If burst size is smaller than bus width then make sure we only - * transfer one at a time to avoid a burst stradling an MFIFO entry. - */ -- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) -+ if (burst * 8 < pl330->pcfg.data_bus_width) - desc->rqcfg.brst_len = 1; - - desc->bytes_requested = len; -diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c -index 1689568b597d4..12c5d7c96527a 100644 ---- a/drivers/hid/hid-cypress.c -+++ b/drivers/hid/hid-cypress.c -@@ -26,19 +26,17 @@ - #define CP_2WHEEL_MOUSE_HACK 0x02 - #define CP_2WHEEL_MOUSE_HACK_ON 0x04 - -+#define VA_INVAL_LOGICAL_BOUNDARY 0x08 -+ - /* - * Some USB barcode readers from cypress have usage min and usage max in - * the wrong order - */ --static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, -+static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc, - unsigned int *rsize) - { -- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); - unsigned int i; - -- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) -- return rdesc; -- - if (*rsize < 4) - return rdesc; - -@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, - return rdesc; - } - -+static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc, -+ unsigned int *rsize) -+{ -+ /* -+ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly -+ * reports Logical Minimum of its Consumer Control device as 572 -+ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero. -+ */ -+ if (*rsize == 25 && -+ rdesc[0] == 0x05 && rdesc[1] == 0x0c && -+ rdesc[2] == 0x09 && rdesc[3] == 0x01 && -+ rdesc[6] == 0x19 && rdesc[7] == 0x00 && -+ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) { -+ hid_info(hdev, -+ "fixing up varmilo VA104M consumer control report descriptor\n"); -+ rdesc[12] = 0x00; -+ rdesc[13] = 0x00; -+ } -+ return rdesc; -+} -+ -+static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, -+ unsigned int *rsize) -+{ -+ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); -+ -+ if (quirks & CP_RDESC_SWAPPED_MIN_MAX) -+ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize); -+ if (quirks & VA_INVAL_LOGICAL_BOUNDARY) -+ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize); -+ -+ return rdesc; -+} -+ - static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi, - struct hid_field *field, struct hid_usage *usage, - unsigned long **bit, int *max) -@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = { - .driver_data = CP_RDESC_SWAPPED_MIN_MAX }, - { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE), - .driver_data = CP_2WHEEL_MOUSE_HACK }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1), -+ .driver_data = VA_INVAL_LOGICAL_BOUNDARY }, - { } - }; - MODULE_DEVICE_TABLE(hid, cp_devices); -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 33d2b5948d7fc..773452c6edfab 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -279,6 +279,8 @@ - #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81 - #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001 - -+#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1 -+ - #define USB_VENDOR_ID_DATA_MODUL 0x7374 - #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201 - -diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c -index 8efaa88329aa3..83e45d5801a98 100644 ---- a/drivers/hid/hid-sensor-hub.c -+++ b/drivers/hid/hid-sensor-hub.c -@@ -473,7 +473,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev, - return 1; - - ptr = raw_data; -- ptr++; /* Skip report id */ -+ if (report->id) -+ ptr++; /* Skip report id */ - - spin_lock_irqsave(&pdata->lock, flags); - -diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c -index 40ba833381557..59e1f6ea2ede9 100644 ---- a/drivers/infiniband/hw/mthca/mthca_cq.c -+++ b/drivers/infiniband/hw/mthca/mthca_cq.c -@@ -811,8 +811,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, - } - - mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); -- if (IS_ERR(mailbox)) -+ if (IS_ERR(mailbox)) { -+ err = PTR_ERR(mailbox); - goto err_out_arm; -+ } - - cq_context = mailbox->buf; - -@@ -854,9 +856,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, - } - - spin_lock_irq(&dev->cq_table.lock); -- if (mthca_array_set(&dev->cq_table.cq, -- cq->cqn & (dev->limits.num_cqs - 1), -- cq)) { -+ err = mthca_array_set(&dev->cq_table.cq, -+ cq->cqn & (dev->limits.num_cqs - 1), cq); -+ if (err) { - spin_unlock_irq(&dev->cq_table.lock); - goto err_out_free_mr; - } -diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c -index c84c685056b99..6b648339733fa 100644 ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600); - MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]"); - #endif - -+static bool i8042_present; - static bool i8042_bypass_aux_irq_test; - static char i8042_kbd_firmware_id[128]; - static char i8042_aux_firmware_id[128]; -@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command) - unsigned long flags; - int retval; - -+ if (!i8042_present) -+ return -1; -+ - spin_lock_irqsave(&i8042_lock, flags); - retval = __i8042_command(param, command); - spin_unlock_irqrestore(&i8042_lock, flags); -@@ -1597,12 +1601,15 @@ static int __init i8042_init(void) - - err = i8042_platform_init(); - if (err) -- return err; -+ return (err == -ENODEV) ? 0 : err; - - err = i8042_controller_check(); - if (err) - goto err_platform_exit; - -+ /* Set this before creating the dev to allow i8042_command to work right away */ -+ i8042_present = true; -+ - pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); - if (IS_ERR(pdev)) { - err = PTR_ERR(pdev); -@@ -1621,6 +1628,9 @@ static int __init i8042_init(void) - - static void __exit i8042_exit(void) - { -+ if (!i8042_present) -+ return; -+ - platform_device_unregister(i8042_platform_device); - platform_driver_unregister(&i8042_driver); - i8042_platform_exit(); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 2da1c22946450..250ecbcca019f 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -5198,7 +5198,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) - if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && - dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { - dev_err(&pdev->dev, "System does not support DMA, aborting\n"); -- goto init_err_disable; -+ rc = -EIO; -+ goto init_err_release; - } - - pci_set_master(pdev); -diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c -index c61d8a308da45..779f7a76ecd3d 100644 ---- a/drivers/nfc/s3fwrn5/i2c.c -+++ b/drivers/nfc/s3fwrn5/i2c.c -@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy { - struct i2c_client *i2c_dev; - struct nci_dev *ndev; - -- unsigned int gpio_en; -- unsigned int gpio_fw_wake; -+ int gpio_en; -+ int gpio_fw_wake; - - struct mutex mutex; - -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index b4fbcf4cade8f..36e415487fe53 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -570,8 +570,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) - if (conn->task == task) - conn->task = NULL; - -- if (conn->ping_task == task) -- conn->ping_task = NULL; -+ if (READ_ONCE(conn->ping_task) == task) -+ WRITE_ONCE(conn->ping_task, NULL); - - /* release get from queueing */ - __iscsi_put_task(task); -@@ -780,6 +780,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, - task->conn->session->age); - } - -+ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK)) -+ WRITE_ONCE(conn->ping_task, task); -+ - if (!ihost->workq) { - if (iscsi_prep_mgmt_task(conn, task)) - goto free_task; -@@ -987,8 +990,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) - struct iscsi_nopout hdr; - struct iscsi_task *task; - -- if (!rhdr && conn->ping_task) -- return -EINVAL; -+ if (!rhdr) { -+ if (READ_ONCE(conn->ping_task)) -+ return -EINVAL; -+ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK); -+ } - - memset(&hdr, 0, sizeof(struct iscsi_nopout)); - hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE; -@@ -1003,11 +1009,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) - - task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0); - if (!task) { -+ if (!rhdr) -+ WRITE_ONCE(conn->ping_task, NULL); - iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n"); - return -EIO; - } else if (!rhdr) { - /* only track our nops */ -- conn->ping_task = task; - conn->last_ping = jiffies; - } - -@@ -1020,7 +1027,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task, - struct iscsi_conn *conn = task->conn; - int rc = 0; - -- if (conn->ping_task != task) { -+ if (READ_ONCE(conn->ping_task) != task) { - /* - * If this is not in response to one of our - * nops then it must be from userspace. -@@ -1960,7 +1967,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn) - */ - static int iscsi_has_ping_timed_out(struct iscsi_conn *conn) - { -- if (conn->ping_task && -+ if (READ_ONCE(conn->ping_task) && - time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) + - (conn->ping_timeout * HZ), jiffies)) - return 1; -@@ -2095,7 +2102,7 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) - * Checking the transport already or nop from a cmd timeout still - * running - */ -- if (conn->ping_task) { -+ if (READ_ONCE(conn->ping_task)) { - task->have_checked_conn = true; - rc = BLK_EH_RESET_TIMER; - goto done; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index d7a0a64f64536..e37f6db0dd156 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -5387,11 +5387,7 @@ int ufshcd_shutdown(struct ufs_hba *hba) - if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) - goto out; - -- if (pm_runtime_suspended(hba->dev)) { -- ret = ufshcd_runtime_resume(hba); -- if (ret) -- goto out; -- } -+ pm_runtime_get_sync(hba->dev); - - ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM); - out: -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index cbb4414edd71b..c48aca1360c89 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -493,8 +493,7 @@ static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD); - - spin_lock_bh(&conn->cmd_lock); -- if (!list_empty(&cmd->i_conn_node) && -- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) -+ if (!list_empty(&cmd->i_conn_node)) - list_del_init(&cmd->i_conn_node); - spin_unlock_bh(&conn->cmd_lock); - -@@ -4228,12 +4227,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) - spin_lock_bh(&conn->cmd_lock); - list_splice_init(&conn->conn_cmd_list, &tmp_list); - -- list_for_each_entry(cmd, &tmp_list, i_conn_node) { -+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { - struct se_cmd *se_cmd = &cmd->se_cmd; - - if (se_cmd->se_tfo != NULL) { - spin_lock_irq(&se_cmd->t_state_lock); -- se_cmd->transport_state |= CMD_T_FABRIC_STOP; -+ if (se_cmd->transport_state & CMD_T_ABORTED) { -+ /* -+ * LIO's abort path owns the cleanup for this, -+ * so put it back on the list and let -+ * aborted_task handle it. -+ */ -+ list_move_tail(&cmd->i_conn_node, -+ &conn->conn_cmd_list); -+ } else { -+ se_cmd->transport_state |= CMD_T_FABRIC_STOP; -+ } - spin_unlock_irq(&se_cmd->t_state_lock); - } - } -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 570a76d912503..eca8d04cfb3ec 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -222,6 +222,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, - struct usb_host_interface *ifp, int num_ep, - unsigned char *buffer, int size) - { -+ struct usb_device *udev = to_usb_device(ddev); - unsigned char *buffer0 = buffer; - struct usb_endpoint_descriptor *d; - struct usb_host_endpoint *endpoint; -@@ -263,6 +264,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, - goto skip_to_next_endpoint_or_interface_descriptor; - } - -+ /* Ignore blacklisted endpoints */ -+ if (udev->quirks & USB_QUIRK_ENDPOINT_BLACKLIST) { -+ if (usb_endpoint_is_blacklisted(udev, ifp, d)) { -+ dev_warn(ddev, "config %d interface %d altsetting %d has a blacklisted endpoint with address 0x%X, skipping\n", -+ cfgno, inum, asnum, -+ d->bEndpointAddress); -+ goto skip_to_next_endpoint_or_interface_descriptor; -+ } -+ } -+ - endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; - ++ifp->desc.bNumEndpoints; - -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 7559d96695da6..4c1679cc57425 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -369,11 +369,11 @@ static void snoop_urb(struct usb_device *udev, - - if (userurb) { /* Async */ - if (when == SUBMIT) -- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " -+ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " - "length %u\n", - userurb, ep, t, d, length); - else -- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " -+ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " - "actual_length %u status %d\n", - userurb, ep, t, d, length, - timeout_or_status); -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index ca74b67c4450d..34d8cece6dd3b 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -195,6 +195,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Guillemot Webcam Hercules Dualpix Exchange*/ - { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Guillemot Hercules DJ Console audio card (BZ 208357) */ -+ { USB_DEVICE(0x06f8, 0xb000), .driver_info = -+ USB_QUIRK_ENDPOINT_BLACKLIST }, -+ - /* Midiman M-Audio Keystation 88es */ - { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, - -@@ -344,6 +348,40 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { - { } /* terminating entry must be last */ - }; - -+/* -+ * Entries for blacklisted endpoints that should be ignored when parsing -+ * configuration descriptors. -+ * -+ * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST. -+ */ -+static const struct usb_device_id usb_endpoint_blacklist[] = { -+ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 }, -+ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 }, -+ { } -+}; -+ -+bool usb_endpoint_is_blacklisted(struct usb_device *udev, -+ struct usb_host_interface *intf, -+ struct usb_endpoint_descriptor *epd) -+{ -+ const struct usb_device_id *id; -+ unsigned int address; -+ -+ for (id = usb_endpoint_blacklist; id->match_flags; ++id) { -+ if (!usb_match_device(udev, id)) -+ continue; -+ -+ if (!usb_match_one_id_intf(udev, intf, id)) -+ continue; -+ -+ address = id->driver_info; -+ if (address == epd->bEndpointAddress) -+ return true; -+ } -+ -+ return false; -+} -+ - static bool usb_match_any_interface(struct usb_device *udev, - const struct usb_device_id *id) - { -diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h -index 6b2f115442838..462a00c749b87 100644 ---- a/drivers/usb/core/usb.h -+++ b/drivers/usb/core/usb.h -@@ -31,6 +31,9 @@ extern void usb_deauthorize_interface(struct usb_interface *); - extern void usb_authorize_interface(struct usb_interface *); - extern void usb_detect_quirks(struct usb_device *udev); - extern void usb_detect_interface_quirks(struct usb_device *udev); -+extern bool usb_endpoint_is_blacklisted(struct usb_device *udev, -+ struct usb_host_interface *intf, -+ struct usb_endpoint_descriptor *epd); - extern int usb_remove_device(struct usb_device *udev); - - extern int usb_get_device_descriptor(struct usb_device *dev, -diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c -index e2451bdb4525d..299412abb1658 100644 ---- a/drivers/video/fbdev/hyperv_fb.c -+++ b/drivers/video/fbdev/hyperv_fb.c -@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) - goto err1; - } - -- fb_virt = ioremap(par->mem->start, screen_fb_size); -+ /* -+ * Map the VRAM cacheable for performance. This is also required for -+ * VM Connect to display properly for ARM64 Linux VM, as the host also -+ * maps the VRAM cacheable. -+ */ -+ fb_virt = ioremap_cache(par->mem->start, screen_fb_size); - if (!fb_virt) - goto err2; - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index b1125778b9080..9e1f9910bdf2d 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -5370,11 +5370,13 @@ no_delete: - } - - /* -- * this returns the key found in the dir entry in the location pointer. -+ * Return the key found in the dir entry in the location pointer, fill @type -+ * with BTRFS_FT_*, and return 0. -+ * - * If no dir entries were found, location->objectid is 0. - */ - static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry, -- struct btrfs_key *location) -+ struct btrfs_key *location, u8 *type) - { - const char *name = dentry->d_name.name; - int namelen = dentry->d_name.len; -@@ -5396,6 +5398,8 @@ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry, - goto out_err; - - btrfs_dir_item_key_to_cpu(path->nodes[0], di, location); -+ if (!ret) -+ *type = btrfs_dir_type(path->nodes[0], di); - out: - btrfs_free_path(path); - return ret; -@@ -5681,19 +5685,25 @@ static struct inode *new_simple_dir(struct super_block *s, - return inode; - } - -+static inline u8 btrfs_inode_type(struct inode *inode) -+{ -+ return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT]; -+} -+ - struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry) - { - struct inode *inode; - struct btrfs_root *root = BTRFS_I(dir)->root; - struct btrfs_root *sub_root = root; - struct btrfs_key location; -+ u8 di_type = 0; - int index; - int ret = 0; - - if (dentry->d_name.len > BTRFS_NAME_LEN) - return ERR_PTR(-ENAMETOOLONG); - -- ret = btrfs_inode_by_name(dir, dentry, &location); -+ ret = btrfs_inode_by_name(dir, dentry, &location, &di_type); - if (ret < 0) - return ERR_PTR(ret); - -@@ -5702,6 +5712,18 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry) - - if (location.type == BTRFS_INODE_ITEM_KEY) { - inode = btrfs_iget(dir->i_sb, &location, root, NULL); -+ if (IS_ERR(inode)) -+ return inode; -+ -+ /* Do extra check against inode mode with di_type */ -+ if (btrfs_inode_type(inode) != di_type) { -+ btrfs_crit(root->fs_info, -+"inode mode mismatch with dir: inode mode=0%o btrfs type=%u dir type=%u", -+ inode->i_mode, btrfs_inode_type(inode), -+ di_type); -+ iput(inode); -+ return ERR_PTR(-EUCLEAN); -+ } - return inode; - } - -@@ -6315,11 +6337,6 @@ fail: - return ERR_PTR(ret); - } - --static inline u8 btrfs_inode_type(struct inode *inode) --{ -- return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT]; --} -- - /* - * utility function to add 'inode' into 'parent_inode' with - * a give name and a given sequence number. -@@ -6904,6 +6921,14 @@ again: - extent_start = found_key.offset; - if (found_type == BTRFS_FILE_EXTENT_REG || - found_type == BTRFS_FILE_EXTENT_PREALLOC) { -+ /* Only regular file could have regular/prealloc extent */ -+ if (!S_ISREG(inode->i_mode)) { -+ ret = -EUCLEAN; -+ btrfs_crit(root->fs_info, -+ "regular/prealloc extent found for non-regular inode %llu", -+ btrfs_ino(inode)); -+ goto out; -+ } - extent_end = extent_start + - btrfs_file_extent_num_bytes(leaf, item); - } else if (found_type == BTRFS_FILE_EXTENT_INLINE) { -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 734babb6626c4..18e667fbd054d 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -462,6 +462,7 @@ next2: - break; - } - out: -+ btrfs_free_path(path); - fs_info->qgroup_flags |= flags; - if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) { - fs_info->quota_enabled = 0; -@@ -470,7 +471,6 @@ out: - ret >= 0) { - ret = qgroup_rescan_init(fs_info, rescan_progress, 0); - } -- btrfs_free_path(path); - - if (ret < 0) { - ulist_free(fs_info->qgroup_ulist); -diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c -index 054fc0d97131b..5ff676df698f0 100644 ---- a/fs/btrfs/tests/inode-tests.c -+++ b/fs/btrfs/tests/inode-tests.c -@@ -235,6 +235,7 @@ static noinline int test_btrfs_get_extent(void) - return ret; - } - -+ inode->i_mode = S_IFREG; - BTRFS_I(inode)->location.type = BTRFS_INODE_ITEM_KEY; - BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID; - BTRFS_I(inode)->location.offset = 0; -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 2d10b818399b1..cd1e9411f9269 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -6262,6 +6262,13 @@ static int btrfs_check_chunk_valid(struct btrfs_root *root, - return -EIO; - } - -+ if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) && -+ (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) { -+ btrfs_err(root->fs_info, -+ "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set", -+ type & BTRFS_BLOCK_GROUP_PROFILE_MASK); -+ return -EUCLEAN; -+ } - if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) { - btrfs_err(root->fs_info, "missing chunk type flag: 0x%llx", type); - return -EIO; -diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c -index e2ab6d0497f2b..151884b95ee2f 100644 ---- a/fs/efivarfs/inode.c -+++ b/fs/efivarfs/inode.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - - #include "internal.h" -@@ -138,6 +139,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, - var->var.VariableName[i] = '\0'; - - inode->i_private = var; -+ kmemleak_ignore(var); - - efivar_entry_add(var, &efivarfs_list); - d_instantiate(dentry, inode); -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index 0e4f20377d196..fca235020312d 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list); - static void efivarfs_evict_inode(struct inode *inode) - { - clear_inode(inode); -- kfree(inode->i_private); - } - - static const struct super_operations efivarfs_ops = { -diff --git a/fs/proc/self.c b/fs/proc/self.c -index 2dcc2558b3aa7..dffbe533d53fc 100644 ---- a/fs/proc/self.c -+++ b/fs/proc/self.c -@@ -24,6 +24,13 @@ static const char *proc_self_follow_link(struct dentry *dentry, void **cookie) - pid_t tgid = task_tgid_nr_ns(current, ns); - char *name; - -+ /* -+ * Not currently supported. Once we can inherit all of struct pid, -+ * we can allow this. -+ */ -+ if (current->flags & PF_KTHREAD) -+ return ERR_PTR(-EOPNOTSUPP); -+ - if (!tgid) - return ERR_PTR(-ENOENT); - /* 11 for max length of signed int in decimal + NULL term */ -diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index ea4f81c2a6d5e..602dff213bae1 100644 ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -59,4 +59,7 @@ - /* Device needs a pause after every control message. */ - #define USB_QUIRK_DELAY_CTRL_MSG BIT(13) - -+/* device has blacklisted endpoints */ -+#define USB_QUIRK_ENDPOINT_BLACKLIST BIT(15) -+ - #endif /* __LINUX_USB_QUIRKS_H */ -diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h -index c7b1dc713cdd7..9c7f4aad6db66 100644 ---- a/include/scsi/libiscsi.h -+++ b/include/scsi/libiscsi.h -@@ -144,6 +144,9 @@ struct iscsi_task { - void *dd_data; /* driver/transport data */ - }; - -+/* invalid scsi_task pointer */ -+#define INVALID_SCSI_TASK (struct iscsi_task *)-1l -+ - static inline int iscsi_task_has_unsol_data(struct iscsi_task *task) - { - return task->unsol_r2t.data_length > task->unsol_r2t.sent; -diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c -index fd460aca36e55..40e4c933b3728 100644 ---- a/tools/perf/util/dwarf-aux.c -+++ b/tools/perf/util/dwarf-aux.c -@@ -305,6 +305,7 @@ bool die_is_func_def(Dwarf_Die *dw_die) - int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) - { - Dwarf_Addr base, end; -+ Dwarf_Attribute attr; - - if (!addr) - return -EINVAL; -@@ -312,6 +313,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) - if (dwarf_entrypc(dw_die, addr) == 0) - return 0; - -+ /* -+ * Since the dwarf_ranges() will return 0 if there is no -+ * DW_AT_ranges attribute, we should check it first. -+ */ -+ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr)) -+ return -ENOENT; -+ - return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; - } -