diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2020-05-02 15:22:54 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2020-05-02 15:22:54 -0400 |
| commit | 11b08a10760b6d7004331fc6074fa4eeb2d7f08d (patch) | |
| tree | 4940e245b7d8f151992026a949fa2c12b2f26e97 | |
| parent | Linux patch 4.14.177 (diff) | |
| download | linux-patches-11b08a10760b6d7004331fc6074fa4eeb2d7f08d.tar.gz linux-patches-11b08a10760b6d7004331fc6074fa4eeb2d7f08d.tar.bz2 linux-patches-11b08a10760b6d7004331fc6074fa4eeb2d7f08d.zip | |
Linux patch 4.14.1784.14-188
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1177_linux-4.14.178.patch | 3850 |
2 files changed, 3854 insertions, 0 deletions
diff --git a/0000_README b/0000_README index f56b415f..36bc305b 100644 --- a/0000_README +++ b/0000_README @@ -751,6 +751,10 @@ Patch: 1176_linux-4.14.177.patch From: https://www.kernel.org Desc: Linux 4.14.177 +Patch: 1177_linux-4.14.178.patch +From: https://www.kernel.org +Desc: Linux 4.14.178 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1177_linux-4.14.178.patch b/1177_linux-4.14.178.patch new file mode 100644 index 00000000..a685a18a --- /dev/null +++ b/1177_linux-4.14.178.patch @@ -0,0 +1,3850 @@ +diff --git a/Makefile b/Makefile +index d81fb98737f7..73e93e596e50 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 177 ++SUBLEVEL = 178 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index fdb018e1278f..9d1e1061d8af 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -454,6 +454,7 @@ + "dsi0_ddr2", + "dsi0_ddr"; + ++ status = "disabled"; + }; + + thermal: thermal@7e212000 { +diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile +index 8cf1a98785a5..1d0923b4a82b 100644 +--- a/arch/arm/mach-imx/Makefile ++++ b/arch/arm/mach-imx/Makefile +@@ -87,8 +87,10 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7-a + obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o + obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o + endif ++ifeq ($(CONFIG_ARM_CPU_SUSPEND),y) + AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a + obj-$(CONFIG_SOC_IMX6) += resume-imx6.o ++endif + obj-$(CONFIG_SOC_IMX6) += pm-imx6.o + + obj-$(CONFIG_SOC_IMX1) += mach-imx1.o +diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h +index 50a89bcf9072..2564dd429ab6 100644 +--- a/arch/arm64/include/asm/sysreg.h ++++ b/arch/arm64/include/asm/sysreg.h +@@ -60,7 +60,9 @@ + #ifndef CONFIG_BROKEN_GAS_INST + + #ifdef __ASSEMBLY__ +-#define __emit_inst(x) .inst (x) ++// The space separator is omitted so that __emit_inst(x) can be parsed as ++// either an assembler directive or an assembler macro argument. ++#define __emit_inst(x) .inst(x) + #else + #define __emit_inst(x) ".inst " __stringify((x)) "\n\t" + #endif +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 41b3b2787f23..a1e336901cc8 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -466,6 +466,8 @@ static bool __init parse_cache_info(struct device_node *np, + lsizep = of_get_property(np, propnames[3], NULL); + if (bsizep == NULL) + bsizep = lsizep; ++ if (lsizep == NULL) ++ lsizep = bsizep; + if (lsizep != NULL) + lsize = be32_to_cpu(*lsizep); + if (bsizep != NULL) +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index c0201b11e9e2..a6b323a3a630 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -178,8 +178,8 @@ static void __init ms_hyperv_init_platform(void) + ms_hyperv.misc_features = cpuid_edx(HYPERV_CPUID_FEATURES); + ms_hyperv.hints = cpuid_eax(HYPERV_CPUID_ENLIGHTMENT_INFO); + +- pr_info("Hyper-V: features 0x%x, hints 0x%x\n", +- ms_hyperv.features, ms_hyperv.hints); ++ pr_info("Hyper-V: features 0x%x, hints 0x%x, misc 0x%x\n", ++ ms_hyperv.features, ms_hyperv.hints, ms_hyperv.misc_features); + + ms_hyperv.max_vp_index = cpuid_eax(HVCPUID_IMPLEMENTATION_LIMITS); + ms_hyperv.max_lp_index = cpuid_ebx(HVCPUID_IMPLEMENTATION_LIMITS); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f8e3f3c48283..c139dedec12b 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6250,7 +6250,7 @@ static int handle_rmode_exception(struct kvm_vcpu *vcpu, + */ + static void kvm_machine_check(void) + { +-#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64) ++#if defined(CONFIG_X86_MCE) + struct pt_regs regs = { + .cs = 3, /* Fake ring 3 no matter what the guest ran on */ + .flags = X86_EFLAGS_IF, +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index cdb386fa7101..0415c0cd4a19 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -153,6 +153,19 @@ static bool is_ereg(u32 reg) + BIT(BPF_REG_AX)); + } + ++/* ++ * is_ereg_8l() == true if BPF register 'reg' is mapped to access x86-64 ++ * lower 8-bit registers dil,sil,bpl,spl,r8b..r15b, which need extra byte ++ * of encoding. al,cl,dl,bl have simpler encoding. ++ */ ++static bool is_ereg_8l(u32 reg) ++{ ++ return is_ereg(reg) || ++ (1 << reg) & (BIT(BPF_REG_1) | ++ BIT(BPF_REG_2) | ++ BIT(BPF_REG_FP)); ++} ++ + /* add modifiers if 'reg' maps to x64 registers r8..r15 */ + static u8 add_1mod(u8 byte, u32 reg) + { +@@ -770,9 +783,8 @@ st: if (is_imm8(insn->off)) + /* STX: *(u8*)(dst_reg + off) = src_reg */ + case BPF_STX | BPF_MEM | BPF_B: + /* emit 'mov byte ptr [rax + off], al' */ +- if (is_ereg(dst_reg) || is_ereg(src_reg) || +- /* have to add extra byte for x86 SIL, DIL regs */ +- src_reg == BPF_REG_1 || src_reg == BPF_REG_2) ++ if (is_ereg(dst_reg) || is_ereg_8l(src_reg)) ++ /* Add extra byte for eregs or SIL,DIL,BPL in src_reg */ + EMIT2(add_2mod(0x40, dst_reg, src_reg), 0x88); + else + EMIT1(0x88); +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 9d5cb3b7a7a2..41474eec2181 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -951,8 +951,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + mm = alloc->vma_vm_mm; + if (!mmget_not_zero(mm)) + goto err_mmget; +- if (!down_write_trylock(&mm->mmap_sem)) +- goto err_down_write_mmap_sem_failed; ++ if (!down_read_trylock(&mm->mmap_sem)) ++ goto err_down_read_mmap_sem_failed; + vma = binder_alloc_get_vma(alloc); + + list_lru_isolate(lru, item); +@@ -967,7 +967,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + + trace_binder_unmap_user_end(alloc, index); + } +- up_write(&mm->mmap_sem); ++ up_read(&mm->mmap_sem); + mmput(mm); + + trace_binder_unmap_kernel_start(alloc, index); +@@ -982,7 +982,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + mutex_unlock(&alloc->mutex); + return LRU_REMOVED_RETRY; + +-err_down_write_mmap_sem_failed: ++err_down_read_mmap_sem_failed: + mmput_async(mm); + err_mmget: + err_page_already_freed: +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 77e47dc5aacc..569e93e1f06c 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (C) 2012 IBM Corporation ++ * Copyright (C) 2012-2020 IBM Corporation + * + * Author: Ashley Lai <ashleydlai@gmail.com> + * +@@ -140,6 +140,64 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) + return len; + } + ++/** ++ * ibmvtpm_crq_send_init - Send a CRQ initialize message ++ * @ibmvtpm: vtpm device struct ++ * ++ * Return: ++ * 0 on success. ++ * Non-zero on failure. ++ */ ++static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm) ++{ ++ int rc; ++ ++ rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD); ++ if (rc != H_SUCCESS) ++ dev_err(ibmvtpm->dev, ++ "%s failed rc=%d\n", __func__, rc); ++ ++ return rc; ++} ++ ++/** ++ * tpm_ibmvtpm_resume - Resume from suspend ++ * ++ * @dev: device struct ++ * ++ * Return: Always 0. ++ */ ++static int tpm_ibmvtpm_resume(struct device *dev) ++{ ++ struct tpm_chip *chip = dev_get_drvdata(dev); ++ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); ++ int rc = 0; ++ ++ do { ++ if (rc) ++ msleep(100); ++ rc = plpar_hcall_norets(H_ENABLE_CRQ, ++ ibmvtpm->vdev->unit_address); ++ } while (rc == H_IN_PROGRESS || rc == H_BUSY || H_IS_LONG_BUSY(rc)); ++ ++ if (rc) { ++ dev_err(dev, "Error enabling ibmvtpm rc=%d\n", rc); ++ return rc; ++ } ++ ++ rc = vio_enable_interrupts(ibmvtpm->vdev); ++ if (rc) { ++ dev_err(dev, "Error vio_enable_interrupts rc=%d\n", rc); ++ return rc; ++ } ++ ++ rc = ibmvtpm_crq_send_init(ibmvtpm); ++ if (rc) ++ dev_err(dev, "Error send_init rc=%d\n", rc); ++ ++ return rc; ++} ++ + /** + * tpm_ibmvtpm_send() - Send a TPM command + * @chip: tpm chip struct +@@ -153,6 +211,7 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) + static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + { + struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); ++ bool retry = true; + int rc, sig; + + if (!ibmvtpm->rtce_buf) { +@@ -186,18 +245,27 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + */ + ibmvtpm->tpm_processing_cmd = true; + ++again: + rc = ibmvtpm_send_crq(ibmvtpm->vdev, + IBMVTPM_VALID_CMD, VTPM_TPM_COMMAND, + count, ibmvtpm->rtce_dma_handle); + if (rc != H_SUCCESS) { ++ /* ++ * H_CLOSED can be returned after LPM resume. Call ++ * tpm_ibmvtpm_resume() to re-enable the CRQ then retry ++ * ibmvtpm_send_crq() once before failing. ++ */ ++ if (rc == H_CLOSED && retry) { ++ tpm_ibmvtpm_resume(ibmvtpm->dev); ++ retry = false; ++ goto again; ++ } + dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc); +- rc = 0; + ibmvtpm->tpm_processing_cmd = false; +- } else +- rc = 0; ++ } + + spin_unlock(&ibmvtpm->rtce_lock); +- return rc; ++ return 0; + } + + static void tpm_ibmvtpm_cancel(struct tpm_chip *chip) +@@ -275,26 +343,6 @@ static int ibmvtpm_crq_send_init_complete(struct ibmvtpm_dev *ibmvtpm) + return rc; + } + +-/** +- * ibmvtpm_crq_send_init - Send a CRQ initialize message +- * @ibmvtpm: vtpm device struct +- * +- * Return: +- * 0 on success. +- * Non-zero on failure. +- */ +-static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm) +-{ +- int rc; +- +- rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD); +- if (rc != H_SUCCESS) +- dev_err(ibmvtpm->dev, +- "ibmvtpm_crq_send_init failed rc=%d\n", rc); +- +- return rc; +-} +- + /** + * tpm_ibmvtpm_remove - ibm vtpm remove entry point + * @vdev: vio device struct +@@ -407,44 +455,6 @@ static int ibmvtpm_reset_crq(struct ibmvtpm_dev *ibmvtpm) + ibmvtpm->crq_dma_handle, CRQ_RES_BUF_SIZE); + } + +-/** +- * tpm_ibmvtpm_resume - Resume from suspend +- * +- * @dev: device struct +- * +- * Return: Always 0. +- */ +-static int tpm_ibmvtpm_resume(struct device *dev) +-{ +- struct tpm_chip *chip = dev_get_drvdata(dev); +- struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); +- int rc = 0; +- +- do { +- if (rc) +- msleep(100); +- rc = plpar_hcall_norets(H_ENABLE_CRQ, +- ibmvtpm->vdev->unit_address); +- } while (rc == H_IN_PROGRESS || rc == H_BUSY || H_IS_LONG_BUSY(rc)); +- +- if (rc) { +- dev_err(dev, "Error enabling ibmvtpm rc=%d\n", rc); +- return rc; +- } +- +- rc = vio_enable_interrupts(ibmvtpm->vdev); +- if (rc) { +- dev_err(dev, "Error vio_enable_interrupts rc=%d\n", rc); +- return rc; +- } +- +- rc = ibmvtpm_crq_send_init(ibmvtpm); +- if (rc) +- dev_err(dev, "Error send_init rc=%d\n", rc); +- +- return rc; +-} +- + static bool tpm_ibmvtpm_req_canceled(struct tpm_chip *chip, u8 status) + { + return (status == 0); +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index a7d9c0c53fcd..9b1116501f20 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -331,6 +331,9 @@ static void disable_interrupts(struct tpm_chip *chip) + u32 intmask; + int rc; + ++ if (priv->irq == 0) ++ return; ++ + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) + intmask = 0; +@@ -874,9 +877,12 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (irq) { + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, + irq); +- if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) ++ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { + dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); ++ ++ disable_interrupts(chip); ++ } + } else { + tpm_tis_probe_irq(chip, intmask); + } +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 5a4b8aee22a8..eb569cf06309 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -37,11 +37,11 @@ + * Null hashes to align with hw behavior on imx6sl and ull + * these are flipped for consistency with hw output + */ +-const uint8_t sha1_null_hash[] = ++static const uint8_t sha1_null_hash[] = + "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf" + "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda"; + +-const uint8_t sha256_null_hash[] = ++static const uint8_t sha256_null_hash[] = + "\x55\xb8\x52\x78\x1b\x99\x95\xa4" + "\x4c\x93\x9b\x64\xe4\x41\xae\x27" + "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a" +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 300c4624aa6c..b9403851f37f 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -61,7 +61,7 @@ static void sync_for_device(struct msm_gem_object *msm_obj) + { + struct device *dev = msm_obj->base.dev->dev; + +- if (get_dma_ops(dev)) { ++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) { + dma_sync_sg_for_device(dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, DMA_BIDIRECTIONAL); + } else { +@@ -74,7 +74,7 @@ static void sync_for_cpu(struct msm_gem_object *msm_obj) + { + struct device *dev = msm_obj->base.dev->dev; + +- if (get_dma_ops(dev)) { ++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) { + dma_sync_sg_for_cpu(dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, DMA_BIDIRECTIONAL); + } else { +diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c +index e5234f953a6d..b6e5aaa54963 100644 +--- a/drivers/hwmon/jc42.c ++++ b/drivers/hwmon/jc42.c +@@ -527,7 +527,7 @@ static int jc42_probe(struct i2c_client *client, const struct i2c_device_id *id) + } + data->config = config; + +- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, ++ hwmon_dev = devm_hwmon_device_register_with_info(dev, "jc42", + data, &jc42_chip_info, + NULL); + return PTR_ERR_OR_ZERO(hwmon_dev); +diff --git a/drivers/i2c/busses/i2c-altera.c b/drivers/i2c/busses/i2c-altera.c +index a1cdcfc74acf..8915ee30a5b4 100644 +--- a/drivers/i2c/busses/i2c-altera.c ++++ b/drivers/i2c/busses/i2c-altera.c +@@ -395,7 +395,6 @@ static int altr_i2c_probe(struct platform_device *pdev) + struct altr_i2c_dev *idev = NULL; + struct resource *res; + int irq, ret; +- u32 val; + + idev = devm_kzalloc(&pdev->dev, sizeof(*idev), GFP_KERNEL); + if (!idev) +@@ -422,17 +421,17 @@ static int altr_i2c_probe(struct platform_device *pdev) + init_completion(&idev->msg_complete); + spin_lock_init(&idev->lock); + +- val = device_property_read_u32(idev->dev, "fifo-size", ++ ret = device_property_read_u32(idev->dev, "fifo-size", + &idev->fifo_size); +- if (val) { ++ if (ret) { + dev_err(&pdev->dev, "FIFO size set to default of %d\n", + ALTR_I2C_DFLT_FIFO_SZ); + idev->fifo_size = ALTR_I2C_DFLT_FIFO_SZ; + } + +- val = device_property_read_u32(idev->dev, "clock-frequency", ++ ret = device_property_read_u32(idev->dev, "clock-frequency", + &idev->bus_clk_rate); +- if (val) { ++ if (ret) { + dev_err(&pdev->dev, "Default to 100kHz\n"); + idev->bus_clk_rate = 100000; /* default clock rate */ + } +diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c +index 07246a6037e3..f64781d03d5d 100644 +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -543,7 +543,7 @@ static const struct iio_info ad7797_info = { + .read_raw = &ad7793_read_raw, + .write_raw = &ad7793_write_raw, + .write_raw_get_fmt = &ad7793_write_raw_get_fmt, +- .attrs = &ad7793_attribute_group, ++ .attrs = &ad7797_attribute_group, + .validate_trigger = ad_sd_validate_trigger, + .driver_module = THIS_MODULE, + }; +diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c +index 258a4712167a..3cfb2d4b2441 100644 +--- a/drivers/iio/adc/stm32-adc.c ++++ b/drivers/iio/adc/stm32-adc.c +@@ -1311,8 +1311,30 @@ static unsigned int stm32_adc_dma_residue(struct stm32_adc *adc) + static void stm32_adc_dma_buffer_done(void *data) + { + struct iio_dev *indio_dev = data; ++ struct stm32_adc *adc = iio_priv(indio_dev); ++ int residue = stm32_adc_dma_residue(adc); ++ ++ /* ++ * In DMA mode the trigger services of IIO are not used ++ * (e.g. no call to iio_trigger_poll). ++ * Calling irq handler associated to the hardware trigger is not ++ * relevant as the conversions have already been done. Data ++ * transfers are performed directly in DMA callback instead. ++ * This implementation avoids to call trigger irq handler that ++ * may sleep, in an atomic context (DMA irq handler context). ++ */ ++ dev_dbg(&indio_dev->dev, "%s bufi=%d\n", __func__, adc->bufi); + +- iio_trigger_poll_chained(indio_dev->trig); ++ while (residue >= indio_dev->scan_bytes) { ++ u16 *buffer = (u16 *)&adc->rx_buf[adc->bufi]; ++ ++ iio_push_to_buffers(indio_dev, buffer); ++ ++ residue -= indio_dev->scan_bytes; ++ adc->bufi += indio_dev->scan_bytes; ++ if (adc->bufi >= adc->rx_buf_sz) ++ adc->bufi = 0; ++ } + } + + static int stm32_adc_dma_start(struct iio_dev *indio_dev) +@@ -1648,6 +1670,7 @@ static int stm32_adc_probe(struct platform_device *pdev) + { + struct iio_dev *indio_dev; + struct device *dev = &pdev->dev; ++ irqreturn_t (*handler)(int irq, void *p) = NULL; + struct stm32_adc *adc; + int ret; + +@@ -1730,9 +1753,11 @@ static int stm32_adc_probe(struct platform_device *pdev) + if (ret < 0) + goto err_clk_disable; + ++ if (!adc->dma_chan) ++ handler = &stm32_adc_trigger_handler; ++ + ret = iio_triggered_buffer_setup(indio_dev, +- &iio_pollfunc_store_time, +- &stm32_adc_trigger_handler, ++ &iio_pollfunc_store_time, handler, + &stm32_adc_buffer_setup_ops); + if (ret) { + dev_err(&pdev->dev, "buffer setup failed\n"); +diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c +index e89711b30ae8..36db28b9099f 100644 +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -660,7 +660,7 @@ static int xadc_trigger_set_state(struct iio_trigger *trigger, bool state) + + spin_lock_irqsave(&xadc->lock, flags); + xadc_read_reg(xadc, XADC_AXI_REG_IPIER, &val); +- xadc_write_reg(xadc, XADC_AXI_REG_IPISR, val & XADC_AXI_INT_EOS); ++ xadc_write_reg(xadc, XADC_AXI_REG_IPISR, XADC_AXI_INT_EOS); + if (state) + val |= XADC_AXI_INT_EOS; + else +@@ -709,13 +709,14 @@ static int xadc_power_adc_b(struct xadc *xadc, unsigned int seq_mode) + { + uint16_t val; + ++ /* Powerdown the ADC-B when it is not needed. */ + switch (seq_mode) { + case XADC_CONF1_SEQ_SIMULTANEOUS: + case XADC_CONF1_SEQ_INDEPENDENT: +- val = XADC_CONF2_PD_ADC_B; ++ val = 0; + break; + default: +- val = 0; ++ val = XADC_CONF2_PD_ADC_B; + break; + } + +@@ -784,6 +785,16 @@ static int xadc_preenable(struct iio_dev *indio_dev) + if (ret) + goto err; + ++ /* ++ * In simultaneous mode the upper and lower aux channels are samples at ++ * the same time. In this mode the upper 8 bits in the sequencer ++ * register are don't care and the lower 8 bits control two channels ++ * each. As such we must set the bit if either the channel in the lower ++ * group or the upper group is enabled. ++ */ ++ if (seq_mode == XADC_CONF1_SEQ_SIMULTANEOUS) ++ scan_mask = ((scan_mask >> 8) | scan_mask) & 0xff0000; ++ + ret = xadc_write_adc_reg(xadc, XADC_REG_SEQ(1), scan_mask >> 16); + if (ret) + goto err; +diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c +index e773dc6fdd3c..1f0d83086cb0 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -1883,7 +1883,11 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip, + continue; + } + +- if (time_after(jiffies, timeo) && !chip_ready(map, adr)) ++ /* ++ * We check "time_after" and "!chip_good" before checking "chip_good" to avoid ++ * the failure due to scheduling. ++ */ ++ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) + break; + + if (chip_good(map, adr, datum)) { +diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h +index e5c86d44667a..1b2a337d673d 100644 +--- a/drivers/net/dsa/b53/b53_regs.h ++++ b/drivers/net/dsa/b53/b53_regs.h +@@ -294,7 +294,7 @@ + * + * BCM5325 and BCM5365 share most definitions below + */ +-#define B53_ARLTBL_MAC_VID_ENTRY(n) (0x10 * (n)) ++#define B53_ARLTBL_MAC_VID_ENTRY(n) ((0x10 * (n)) + 0x10) + #define ARLTBL_MAC_MASK 0xffffffffffffULL + #define ARLTBL_VID_S 48 + #define ARLTBL_VID_MASK_25 0xff +@@ -306,7 +306,7 @@ + #define ARLTBL_VALID_25 BIT(63) + + /* ARL Table Data Entry N Registers (32 bit) */ +-#define B53_ARLTBL_DATA_ENTRY(n) ((0x10 * (n)) + 0x08) ++#define B53_ARLTBL_DATA_ENTRY(n) ((0x10 * (n)) + 0x18) + #define ARLTBL_DATA_PORT_ID_MASK 0x1ff + #define ARLTBL_TC(tc) ((3 & tc) << 11) + #define ARLTBL_AGE BIT(14) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 3e3044fe3206..4b3660c63b86 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -973,6 +973,8 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev, + if (netif_running(dev)) + bcmgenet_update_mib_counters(priv); + ++ dev->netdev_ops->ndo_get_stats(dev); ++ + for (i = 0; i < BCMGENET_STATS_LEN; i++) { + const struct bcmgenet_stats *s; + char *p; +@@ -3215,6 +3217,7 @@ static struct net_device_stats *bcmgenet_get_stats(struct net_device *dev) + dev->stats.rx_packets = rx_packets; + dev->stats.rx_errors = rx_errors; + dev->stats.rx_missed_errors = rx_errors; ++ dev->stats.rx_dropped = rx_dropped; + return &dev->stats; + } + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c +index 758f2b836328..ff7e58a8c90f 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c +@@ -311,32 +311,17 @@ static int cxgb4_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) + */ + static int cxgb4_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + { +- struct adapter *adapter = (struct adapter *)container_of(ptp, +- struct adapter, ptp_clock_info); +- struct fw_ptp_cmd c; ++ struct adapter *adapter = container_of(ptp, struct adapter, ++ ptp_clock_info); + u64 ns; +- int err; +- +- memset(&c, 0, sizeof(c)); +- c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) | +- FW_CMD_REQUEST_F | +- FW_CMD_READ_F | +- FW_PTP_CMD_PORTID_V(0)); +- c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16)); +- c.u.ts.sc = FW_PTP_SC_GET_TIME; + +- err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), &c); +- if (err < 0) { +- dev_err(adapter->pdev_dev, +- "PTP: %s error %d\n", __func__, -err); +- return err; +- } ++ ns = t4_read_reg(adapter, T5_PORT_REG(0, MAC_PORT_PTP_SUM_LO_A)); ++ ns |= (u64)t4_read_reg(adapter, ++ T5_PORT_REG(0, MAC_PORT_PTP_SUM_HI_A)) << 32; + + /* convert to timespec*/ +- ns = be64_to_cpu(c.u.ts.tm); + *ts = ns_to_timespec64(ns); +- +- return err; ++ return 0; + } + + /** +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 39bcf27902e4..0f126ce4645f 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3609,7 +3609,7 @@ int t4_phy_fw_ver(struct adapter *adap, int *phy_fw_ver) + FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_VERSION)); + ret = t4_query_params(adap, adap->mbox, adap->pf, 0, 1, + ¶m, &val); +- if (ret < 0) ++ if (ret) + return ret; + *phy_fw_ver = val; + return 0; +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h +index dac90837842b..d3df6962cf43 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h +@@ -1810,6 +1810,9 @@ + + #define MAC_PORT_CFG2_A 0x818 + ++#define MAC_PORT_PTP_SUM_LO_A 0x990 ++#define MAC_PORT_PTP_SUM_HI_A 0x994 ++ + #define MPS_CMN_CTL_A 0x9000 + + #define COUNTPAUSEMCRX_S 5 +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index c4e8bf0773fe..6024b832b4d9 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -3151,26 +3151,20 @@ static void qed_chain_free_single(struct qed_dev *cdev, + + static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *p_chain) + { +- void **pp_virt_addr_tbl = p_chain->pbl.pp_virt_addr_tbl; ++ struct addr_tbl_entry *pp_addr_tbl = p_chain->pbl.pp_addr_tbl; + u32 page_cnt = p_chain->page_cnt, i, pbl_size; +- u8 *p_pbl_virt = p_chain->pbl_sp.p_virt_table; + +- if (!pp_virt_addr_tbl) ++ if (!pp_addr_tbl) + return; + +- if (!p_pbl_virt) +- goto out; +- + for (i = 0; i < page_cnt; i++) { +- if (!pp_virt_addr_tbl[i]) ++ if (!pp_addr_tbl[i].virt_addr || !pp_addr_tbl[i].dma_map) + break; + + dma_free_coherent(&cdev->pdev->dev, + QED_CHAIN_PAGE_SIZE, +- pp_virt_addr_tbl[i], +- *(dma_addr_t *)p_pbl_virt); +- +- p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE; ++ pp_addr_tbl[i].virt_addr, ++ pp_addr_tbl[i].dma_map); + } + + pbl_size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE; +@@ -3180,9 +3174,9 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *p_chain) + pbl_size, + p_chain->pbl_sp.p_virt_table, + p_chain->pbl_sp.p_phys_table); +-out: +- vfree(p_chain->pbl.pp_virt_addr_tbl); +- p_chain->pbl.pp_virt_addr_tbl = NULL; ++ ++ vfree(p_chain->pbl.pp_addr_tbl); ++ p_chain->pbl.pp_addr_tbl = NULL; + } + + void qed_chain_free(struct qed_dev *cdev, struct qed_chain *p_chain) +@@ -3283,19 +3277,19 @@ qed_chain_alloc_pbl(struct qed_dev *cdev, + { + u32 page_cnt = p_chain->page_cnt, size, i; + dma_addr_t p_phys = 0, p_pbl_phys = 0; +- void **pp_virt_addr_tbl = NULL; ++ struct addr_tbl_entry *pp_addr_tbl; + u8 *p_pbl_virt = NULL; + void *p_virt = NULL; + +- size = page_cnt * sizeof(*pp_virt_addr_tbl); +- pp_virt_addr_tbl = vzalloc(size); +- if (!pp_virt_addr_tbl) ++ size = page_cnt * sizeof(*pp_addr_tbl); ++ pp_addr_tbl = vzalloc(size); ++ if (!pp_addr_tbl) + return -ENOMEM; + + /* The allocation of the PBL table is done with its full size, since it + * is expected to be successive. + * qed_chain_init_pbl_mem() is called even in a case of an allocation +- * failure, since pp_virt_addr_tbl was previously allocated, and it ++ * failure, since tbl was previously allocated, and it + * should be saved to allow its freeing during the error flow. + */ + size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE; +@@ -3309,8 +3303,7 @@ qed_chain_alloc_pbl(struct qed_dev *cdev, + p_chain->b_external_pbl = true; + } + +- qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys, +- pp_virt_addr_tbl); ++ qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys, pp_addr_tbl); + if (!p_pbl_virt) + return -ENOMEM; + +@@ -3329,7 +3322,8 @@ qed_chain_alloc_pbl(struct qed_dev *cdev, + /* Fill the PBL table with the physical address of the page */ + *(dma_addr_t *)p_pbl_virt = p_phys; + /* Keep the virtual address of the page */ +- p_chain->pbl.pp_virt_addr_tbl[i] = p_virt; ++ p_chain->pbl.pp_addr_tbl[i].virt_addr = p_virt; ++ p_chain->pbl.pp_addr_tbl[i].dma_map = p_phys; + + p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE; + } +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 5959e8817a1b..926e2eb528fd 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -3209,11 +3209,11 @@ static int macsec_newlink(struct net *net, struct net_device *dev, + struct netlink_ext_ack *extack) + { + struct macsec_dev *macsec = macsec_priv(dev); ++ rx_handler_func_t *rx_handler; ++ u8 icv_len = DEFAULT_ICV_LEN; + struct net_device *real_dev; +- int err; ++ int err, mtu; + sci_t sci; +- u8 icv_len = DEFAULT_ICV_LEN; +- rx_handler_func_t *rx_handler; + + if (!tb[IFLA_LINK]) + return -EINVAL; +@@ -3229,7 +3229,11 @@ static int macsec_newlink(struct net *net, struct net_device *dev, + + if (data && data[IFLA_MACSEC_ICV_LEN]) + icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); +- dev->mtu = real_dev->mtu - icv_len - macsec_extra_len(true); ++ mtu = real_dev->mtu - icv_len - macsec_extra_len(true); ++ if (mtu < 0) ++ dev->mtu = 0; ++ else ++ dev->mtu = mtu; + + rx_handler = rtnl_dereference(real_dev->rx_handler); + if (rx_handler && rx_handler != macsec_handle_frame) +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 6989e84670e5..3072fc902eca 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1673,7 +1673,7 @@ static int macvlan_device_event(struct notifier_block *unused, + struct macvlan_dev, + list); + +- if (macvlan_sync_address(vlan->dev, dev->dev_addr)) ++ if (vlan && macvlan_sync_address(vlan->dev, dev->dev_addr)) + return NOTIFY_BAD; + + break; +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 3dba58fa3433..396a8c6cb999 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -480,6 +480,9 @@ static const struct team_mode *team_mode_get(const char *kind) + struct team_mode_item *mitem; + const struct team_mode *mode = NULL; + ++ if (!try_module_get(THIS_MODULE)) ++ return NULL; ++ + spin_lock(&mode_list_lock); + mitem = __find_mode(kind); + if (!mitem) { +@@ -495,6 +498,7 @@ static const struct team_mode *team_mode_get(const char *kind) + } + + spin_unlock(&mode_list_lock); ++ module_put(THIS_MODULE); + return mode; + } + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 03e4fcdfeab7..811fe0bde8a3 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -476,7 +476,8 @@ static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev, + if (rt6_need_strict(&ipv6_hdr(skb)->daddr)) + return skb; + +- if (qdisc_tx_is_default(vrf_dev)) ++ if (qdisc_tx_is_default(vrf_dev) || ++ IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) + return vrf_ip6_out_direct(vrf_dev, sk, skb); + + return vrf_ip6_out_redirect(vrf_dev, skb); +@@ -692,7 +693,8 @@ static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev, + ipv4_is_lbcast(ip_hdr(skb)->daddr)) + return skb; + +- if (qdisc_tx_is_default(vrf_dev)) ++ if (qdisc_tx_is_default(vrf_dev) || ++ IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) + return vrf_ip_out_direct(vrf_dev, sk, skb); + + return vrf_ip_out_redirect(vrf_dev, skb); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index bbb39d6ec2ee..f37018d72b44 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -1124,6 +1124,9 @@ void iwl_trans_pcie_dyn_txq_free(struct iwl_trans *trans, int queue) + + iwl_pcie_gen2_txq_unmap(trans, queue); + ++ iwl_pcie_gen2_txq_free_memory(trans, trans_pcie->txq[queue]); ++ trans_pcie->txq[queue] = NULL; ++ + IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", queue); + } + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 6f58767b5190..400031622b76 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -80,6 +80,7 @@ struct pcie_link_state { + u32 clkpm_capable:1; /* Clock PM capable? */ + u32 clkpm_enabled:1; /* Current Clock PM state */ + u32 clkpm_default:1; /* Default Clock PM state by BIOS */ ++ u32 clkpm_disable:1; /* Clock PM disabled */ + + /* Exit latencies */ + struct aspm_latency latency_up; /* Upstream direction exit latency */ +@@ -177,8 +178,11 @@ static void pcie_set_clkpm_nocheck(struct pcie_link_state *link, int enable) + + static void pcie_set_clkpm(struct pcie_link_state *link, int enable) + { +- /* Don't enable Clock PM if the link is not Clock PM capable */ +- if (!link->clkpm_capable) ++ /* ++ * Don't enable Clock PM if the link is not Clock PM capable ++ * or Clock PM is disabled ++ */ ++ if (!link->clkpm_capable || link->clkpm_disable) + enable = 0; + /* Need nothing if the specified equals to current state */ + if (link->clkpm_enabled == enable) +@@ -208,7 +212,8 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist) + } + link->clkpm_enabled = enabled; + link->clkpm_default = enabled; +- link->clkpm_capable = (blacklist) ? 0 : capable; ++ link->clkpm_capable = capable; ++ link->clkpm_disable = blacklist ? 1 : 0; + } + + static bool pcie_retrain_link(struct pcie_link_state *link) +@@ -1052,10 +1057,9 @@ static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem) + link->aspm_disable |= ASPM_STATE_L1; + pcie_config_aspm_link(link, policy_to_aspm_state(link)); + +- if (state & PCIE_LINK_STATE_CLKPM) { +- link->clkpm_capable = 0; +- pcie_set_clkpm(link, 0); +- } ++ if (state & PCIE_LINK_STATE_CLKPM) ++ link->clkpm_disable = 1; ++ pcie_set_clkpm(link, policy_to_clkpm_state(link)); + mutex_unlock(&aspm_lock); + if (sem) + up_read(&pci_bus_sem); +diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c +index db001cba937f..e340ad79a1ec 100644 +--- a/drivers/pwm/pwm-bcm2835.c ++++ b/drivers/pwm/pwm-bcm2835.c +@@ -166,6 +166,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev) + + pc->chip.dev = &pdev->dev; + pc->chip.ops = &bcm2835_pwm_ops; ++ pc->chip.base = -1; + pc->chip.npwm = 2; + pc->chip.of_xlate = of_pwm_xlate_with_flags; + pc->chip.of_pwm_n_cells = 3; +diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c +index 0fcf94ffad32..c298bec25a90 100644 +--- a/drivers/pwm/pwm-rcar.c ++++ b/drivers/pwm/pwm-rcar.c +@@ -236,24 +236,28 @@ static int rcar_pwm_probe(struct platform_device *pdev) + rcar_pwm->chip.base = -1; + rcar_pwm->chip.npwm = 1; + ++ pm_runtime_enable(&pdev->dev); ++ + ret = pwmchip_add(&rcar_pwm->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register PWM chip: %d\n", ret); ++ pm_runtime_disable(&pdev->dev); + return ret; + } + +- pm_runtime_enable(&pdev->dev); +- + return 0; + } + + static int rcar_pwm_remove(struct platform_device *pdev) + { + struct rcar_pwm_chip *rcar_pwm = platform_get_drvdata(pdev); ++ int ret; ++ ++ ret = pwmchip_remove(&rcar_pwm->chip); + + pm_runtime_disable(&pdev->dev); + +- return pwmchip_remove(&rcar_pwm->chip); ++ return ret; + } + + static const struct of_device_id rcar_pwm_of_table[] = { +diff --git a/drivers/pwm/pwm-renesas-tpu.c b/drivers/pwm/pwm-renesas-tpu.c +index 29267d12fb4c..9c7962f2f0aa 100644 +--- a/drivers/pwm/pwm-renesas-tpu.c ++++ b/drivers/pwm/pwm-renesas-tpu.c +@@ -423,16 +423,17 @@ static int tpu_probe(struct platform_device *pdev) + tpu->chip.base = -1; + tpu->chip.npwm = TPU_CHANNEL_MAX; + ++ pm_runtime_enable(&pdev->dev); ++ + ret = pwmchip_add(&tpu->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to register PWM chip\n"); ++ pm_runtime_disable(&pdev->dev); + return ret; + } + + dev_info(&pdev->dev, "TPU PWM %d registered\n", tpu->pdev->id); + +- pm_runtime_enable(&pdev->dev); +- + return 0; + } + +@@ -442,12 +443,10 @@ static int tpu_remove(struct platform_device *pdev) + int ret; + + ret = pwmchip_remove(&tpu->chip); +- if (ret) +- return ret; + + pm_runtime_disable(&pdev->dev); + +- return 0; ++ return ret; + } + + #ifdef CONFIG_OF +diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c +index cc733b89560a..8f4fa1a52f05 100644 +--- a/drivers/remoteproc/remoteproc_core.c ++++ b/drivers/remoteproc/remoteproc_core.c +@@ -288,7 +288,7 @@ void rproc_free_vring(struct rproc_vring *rvring) + { + int size = PAGE_ALIGN(vring_size(rvring->len, rvring->align)); + struct rproc *rproc = rvring->rvdev->rproc; +- int idx = rvring->rvdev->vring - rvring; ++ int idx = rvring - rvring->rvdev->vring; + struct fw_rsc_vdev *rsc; + + dma_free_coherent(rproc->dev.parent, size, rvring->va, rvring->dma); +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index e5c32f4b5287..d2203cd17813 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -828,8 +828,10 @@ static void io_subchannel_register(struct ccw_device *cdev) + * Now we know this subchannel will stay, we can throw + * our delayed uevent. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + /* make it known to the system */ + ret = ccw_device_add(cdev); + if (ret) { +@@ -1037,8 +1039,11 @@ static int io_subchannel_probe(struct subchannel *sch) + * Throw the delayed uevent for the subchannel, register + * the ccw_device and exit. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ /* should always be the case for the console */ ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + cdev = sch_get_cdev(sch); + rc = ccw_device_add(cdev); + if (rc) { +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index d8e0ba68879c..480d2d467f7a 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2271,6 +2271,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + !pmb->u.mb.mbxStatus) { + rpi = pmb->u.mb.un.varWords[0]; + vpi = pmb->u.mb.un.varRegLogin.vpi; ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ vpi -= phba->sli4_hba.max_cfg_param.vpi_base; + lpfc_unreg_login(phba, vpi, rpi, pmb); + pmb->vport = vport; + pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl; +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index aecb563a2b4e..958901523469 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2010,7 +2010,7 @@ static void __iscsi_unbind_session(struct work_struct *work) + if (session->target_id == ISCSI_MAX_TARGET) { + spin_unlock_irqrestore(&session->lock, flags); + mutex_unlock(&ihost->mutex); +- return; ++ goto unbind_session_exit; + } + + target_id = session->target_id; +@@ -2022,6 +2022,8 @@ static void __iscsi_unbind_session(struct work_struct *work) + ida_simple_remove(&iscsi_sess_ida, target_id); + + scsi_remove_target(&session->dev); ++ ++unbind_session_exit: + iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION); + ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n"); + } +diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c +index e19e395b0e44..9f1ec427c168 100644 +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -2603,8 +2603,10 @@ static int comedi_open(struct inode *inode, struct file *file) + } + + cfp = kzalloc(sizeof(*cfp), GFP_KERNEL); +- if (!cfp) ++ if (!cfp) { ++ comedi_dev_put(dev); + return -ENOMEM; ++ } + + cfp->dev = dev; + +diff --git a/drivers/staging/comedi/drivers/dt2815.c b/drivers/staging/comedi/drivers/dt2815.c +index ce5571971194..9b773c2e140b 100644 +--- a/drivers/staging/comedi/drivers/dt2815.c ++++ b/drivers/staging/comedi/drivers/dt2815.c +@@ -101,6 +101,7 @@ static int dt2815_ao_insn(struct comedi_device *dev, struct comedi_subdevice *s, + int ret; + + for (i = 0; i < insn->n; i++) { ++ /* FIXME: lo bit 0 chooses voltage output or current output */ + lo = ((data[i] & 0x0f) << 4) | (chan << 1) | 0x01; + hi = (data[i] & 0xff0) >> 4; + +@@ -114,6 +115,8 @@ static int dt2815_ao_insn(struct comedi_device *dev, struct comedi_subdevice *s, + if (ret) + return ret; + ++ outb(hi, dev->iobase + DT2815_DATA); ++ + devpriv->ao_readback[chan] = data[i]; + } + return i; +diff --git a/drivers/staging/vt6656/int.c b/drivers/staging/vt6656/int.c +index c521729c4192..d5d89e836309 100644 +--- a/drivers/staging/vt6656/int.c ++++ b/drivers/staging/vt6656/int.c +@@ -153,7 +153,8 @@ void vnt_int_process_data(struct vnt_private *priv) + priv->wake_up_count = + priv->hw->conf.listen_interval; + +- --priv->wake_up_count; ++ if (priv->wake_up_count) ++ --priv->wake_up_count; + + /* Turn on wake up to listen next beacon */ + if (priv->wake_up_count == 1) +diff --git a/drivers/staging/vt6656/key.c b/drivers/staging/vt6656/key.c +index cc18cb141bff..5ecc1a97cb44 100644 +--- a/drivers/staging/vt6656/key.c ++++ b/drivers/staging/vt6656/key.c +@@ -91,9 +91,6 @@ static int vnt_set_keymode(struct ieee80211_hw *hw, u8 *mac_addr, + case VNT_KEY_PAIRWISE: + key_mode |= mode; + key_inx = 4; +- /* Don't save entry for pairwise key for station mode */ +- if (priv->op_mode == NL80211_IFTYPE_STATION) +- clear_bit(entry, &priv->key_entry_inuse); + break; + default: + return -EINVAL; +@@ -117,7 +114,6 @@ static int vnt_set_keymode(struct ieee80211_hw *hw, u8 *mac_addr, + int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta, + struct ieee80211_vif *vif, struct ieee80211_key_conf *key) + { +- struct ieee80211_bss_conf *conf = &vif->bss_conf; + struct vnt_private *priv = hw->priv; + u8 *mac_addr = NULL; + u8 key_dec_mode = 0; +@@ -159,16 +155,12 @@ int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta, + key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV; + } + +- if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) { ++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) + vnt_set_keymode(hw, mac_addr, key, VNT_KEY_PAIRWISE, + key_dec_mode, true); +- } else { +- vnt_set_keymode(hw, mac_addr, key, VNT_KEY_DEFAULTKEY, ++ else ++ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_GROUP_ADDRESS, + key_dec_mode, true); + +- vnt_set_keymode(hw, (u8 *)conf->bssid, key, +- VNT_KEY_GROUP_ADDRESS, key_dec_mode, true); +- } +- + return 0; + } +diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c +index e8ccd800c94f..9adab851580c 100644 +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -594,8 +594,6 @@ static int vnt_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + + priv->op_mode = vif->type; + +- vnt_set_bss_mode(priv); +- + /* LED blink on TX */ + vnt_mac_set_led(priv, LEDSTS_STS, LEDSTS_INTER); + +@@ -682,7 +680,6 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, + priv->basic_rates = conf->basic_rates; + + vnt_update_top_rates(priv); +- vnt_set_bss_mode(priv); + + dev_dbg(&priv->usb->dev, "basic rates %x\n", conf->basic_rates); + } +@@ -711,11 +708,14 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, + priv->short_slot_time = false; + + vnt_set_short_slot_time(priv); +- vnt_update_ifs(priv); + vnt_set_vga_gain_offset(priv, priv->bb_vga[0]); + vnt_update_pre_ed_threshold(priv, false); + } + ++ if (changed & (BSS_CHANGED_BASIC_RATES | BSS_CHANGED_ERP_PREAMBLE | ++ BSS_CHANGED_ERP_SLOT)) ++ vnt_set_bss_mode(priv); ++ + if (changed & BSS_CHANGED_TXPOWER) + vnt_rf_setpower(priv, priv->current_rate, + conf->chandef.chan->hw_value); +@@ -739,12 +739,15 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, + vnt_mac_reg_bits_on(priv, MAC_REG_TFTCTL, + TFTCTL_TSFCNTREN); + +- vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, +- conf->sync_tsf, priv->current_tsf); +- + vnt_mac_set_beacon_interval(priv, conf->beacon_int); + + vnt_reset_next_tbtt(priv, conf->beacon_int); ++ ++ vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, ++ conf->sync_tsf, priv->current_tsf); ++ ++ vnt_update_next_tbtt(priv, ++ conf->sync_tsf, conf->beacon_int); + } else { + vnt_clear_current_tsf(priv); + +@@ -779,15 +782,11 @@ static void vnt_configure(struct ieee80211_hw *hw, + { + struct vnt_private *priv = hw->priv; + u8 rx_mode = 0; +- int rc; + + *total_flags &= FIF_ALLMULTI | FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC; + +- rc = vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR, +- MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode); +- +- if (!rc) +- rx_mode = RCR_MULTICAST | RCR_BROADCAST; ++ vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR, ++ MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode); + + dev_dbg(&priv->usb->dev, "rx mode in = %x\n", rx_mode); + +@@ -828,8 +827,12 @@ static int vnt_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + return -EOPNOTSUPP; + break; + case DISABLE_KEY: +- if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) ++ if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) { + clear_bit(key->hw_key_idx, &priv->key_entry_inuse); ++ ++ vnt_mac_disable_keyentry(priv, key->hw_key_idx); ++ } ++ + default: + break; + } +diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c +index 95aa47ac4dcd..f8621fe67376 100644 +--- a/drivers/target/target_core_fabric_lib.c ++++ b/drivers/target/target_core_fabric_lib.c +@@ -76,7 +76,7 @@ static int fc_get_pr_transport_id( + * encoded TransportID. + */ + ptr = &se_nacl->initiatorname[0]; +- for (i = 0; i < 24; ) { ++ for (i = 0; i < 23; ) { + if (!strncmp(&ptr[i], ":", 1)) { + i++; + continue; +diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c +index a8d399188242..fc0ef13f2616 100644 +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -288,10 +288,6 @@ int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops) + vtermnos[index] = vtermno; + cons_ops[index] = ops; + +- /* reserve all indices up to and including this index */ +- if (last_hvc < index) +- last_hvc = index; +- + /* check if we need to re-register the kernel console */ + hvc_check_console(index); + +@@ -895,13 +891,22 @@ struct hvc_struct *hvc_alloc(uint32_t vtermno, int data, + cons_ops[i] == hp->ops) + break; + +- /* no matching slot, just use a counter */ +- if (i >= MAX_NR_HVC_CONSOLES) +- i = ++last_hvc; ++ if (i >= MAX_NR_HVC_CONSOLES) { ++ ++ /* find 'empty' slot for console */ ++ for (i = 0; i < MAX_NR_HVC_CONSOLES && vtermnos[i] != -1; i++) { ++ } ++ ++ /* no matching slot, just use a counter */ ++ if (i == MAX_NR_HVC_CONSOLES) ++ i = ++last_hvc + MAX_NR_HVC_CONSOLES; ++ } + + hp->index = i; +- cons_ops[i] = ops; +- vtermnos[i] = vtermno; ++ if (i < MAX_NR_HVC_CONSOLES) { ++ cons_ops[i] = ops; ++ vtermnos[i] = vtermno; ++ } + + list_add_tail(&(hp->next), &hvc_structs); + spin_unlock(&hvc_structs_lock); +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 32943afacffd..1081810b3e3f 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -645,18 +645,21 @@ init_r_port(int board, int aiop, int chan, struct pci_dev *pci_dev) + tty_port_init(&info->port); + info->port.ops = &rocket_port_ops; + info->flags &= ~ROCKET_MODE_MASK; +- switch (pc104[board][line]) { +- case 422: +- info->flags |= ROCKET_MODE_RS422; +- break; +- case 485: +- info->flags |= ROCKET_MODE_RS485; +- break; +- case 232: +- default: ++ if (board < ARRAY_SIZE(pc104) && line < ARRAY_SIZE(pc104_1)) ++ switch (pc104[board][line]) { ++ case 422: ++ info->flags |= ROCKET_MODE_RS422; ++ break; ++ case 485: ++ info->flags |= ROCKET_MODE_RS485; ++ break; ++ case 232: ++ default: ++ info->flags |= ROCKET_MODE_RS232; ++ break; ++ } ++ else + info->flags |= ROCKET_MODE_RS232; +- break; +- } + + info->intmask = RXF_TRIG | TXFIFO_MT | SRC_INT | DELTA_CD | DELTA_CTS | DELTA_DSR; + if (sInitChan(ctlp, &info->channel, aiop, chan) == 0) { +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 333de7d3fe86..06cf474072d6 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -841,9 +841,16 @@ static void sci_receive_chars(struct uart_port *port) + tty_insert_flip_char(tport, c, TTY_NORMAL); + } else { + for (i = 0; i < count; i++) { +- char c = serial_port_in(port, SCxRDR); +- +- status = serial_port_in(port, SCxSR); ++ char c; ++ ++ if (port->type == PORT_SCIF || ++ port->type == PORT_HSCIF) { ++ status = serial_port_in(port, SCxSR); ++ c = serial_port_in(port, SCxRDR); ++ } else { ++ c = serial_port_in(port, SCxRDR); ++ status = serial_port_in(port, SCxSR); ++ } + if (uart_handle_sysrq_char(port, c)) { + count--; i--; + continue; +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 46defa3be9a4..8a4e7879a7a6 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -880,7 +880,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) + return 0; + +- if (new_screen_size > (4 << 20)) ++ if (new_screen_size > KMALLOC_MAX_SIZE) + return -EINVAL; + newscreen = kzalloc(new_screen_size, GFP_USER); + if (!newscreen) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 5e171e45c685..38709bee4c20 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -424,9 +424,12 @@ static void acm_ctrl_irq(struct urb *urb) + + exit: + retval = usb_submit_urb(urb, GFP_ATOMIC); +- if (retval && retval != -EPERM) ++ if (retval && retval != -EPERM && retval != -ENODEV) + dev_err(&acm->control->dev, + "%s - usb_submit_urb failed: %d\n", __func__, retval); ++ else ++ dev_vdbg(&acm->control->dev, ++ "control resubmission terminated %d\n", retval); + } + + static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags) +@@ -442,6 +445,8 @@ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags) + dev_err(&acm->data->dev, + "urb %d failed submission with %d\n", + index, res); ++ } else { ++ dev_vdbg(&acm->data->dev, "intended failure %d\n", res); + } + set_bit(index, &acm->read_urbs_free); + return res; +@@ -484,6 +489,7 @@ static void acm_read_bulk_callback(struct urb *urb) + int status = urb->status; + bool stopped = false; + bool stalled = false; ++ bool cooldown = false; + + dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n", + rb->index, urb->actual_length, status); +@@ -510,6 +516,14 @@ static void acm_read_bulk_callback(struct urb *urb) + __func__, status); + stopped = true; + break; ++ case -EOVERFLOW: ++ case -EPROTO: ++ dev_dbg(&acm->data->dev, ++ "%s - cooling babbling device\n", __func__); ++ usb_mark_last_busy(acm->dev); ++ set_bit(rb->index, &acm->urbs_in_error_delay); ++ cooldown = true; ++ break; + default: + dev_dbg(&acm->data->dev, + "%s - nonzero urb status received: %d\n", +@@ -531,9 +545,11 @@ static void acm_read_bulk_callback(struct urb *urb) + */ + smp_mb__after_atomic(); + +- if (stopped || stalled) { ++ if (stopped || stalled || cooldown) { + if (stalled) + schedule_work(&acm->work); ++ else if (cooldown) ++ schedule_delayed_work(&acm->dwork, HZ / 2); + return; + } + +@@ -575,14 +591,20 @@ static void acm_softint(struct work_struct *work) + struct acm *acm = container_of(work, struct acm, work); + + if (test_bit(EVENT_RX_STALL, &acm->flags)) { +- if (!(usb_autopm_get_interface(acm->data))) { ++ smp_mb(); /* against acm_suspend() */ ++ if (!acm->susp_count) { + for (i = 0; i < acm->rx_buflimit; i++) + usb_kill_urb(acm->read_urbs[i]); + usb_clear_halt(acm->dev, acm->in); + acm_submit_read_urbs(acm, GFP_KERNEL); +- usb_autopm_put_interface(acm->data); ++ clear_bit(EVENT_RX_STALL, &acm->flags); + } +- clear_bit(EVENT_RX_STALL, &acm->flags); ++ } ++ ++ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) { ++ for (i = 0; i < ACM_NR; i++) ++ if (test_and_clear_bit(i, &acm->urbs_in_error_delay)) ++ acm_submit_read_urb(acm, i, GFP_NOIO); + } + + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) +@@ -1374,6 +1396,7 @@ made_compressed_probe: + acm->readsize = readsize; + acm->rx_buflimit = num_rx_buf; + INIT_WORK(&acm->work, acm_softint); ++ INIT_DELAYED_WORK(&acm->dwork, acm_softint); + init_waitqueue_head(&acm->wioctl); + spin_lock_init(&acm->write_lock); + spin_lock_init(&acm->read_lock); +@@ -1587,6 +1610,7 @@ static void acm_disconnect(struct usb_interface *intf) + + acm_kill_urbs(acm); + cancel_work_sync(&acm->work); ++ cancel_delayed_work_sync(&acm->dwork); + + tty_unregister_device(acm_tty_driver, acm->minor); + +@@ -1629,6 +1653,8 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + + acm_kill_urbs(acm); + cancel_work_sync(&acm->work); ++ cancel_delayed_work_sync(&acm->dwork); ++ acm->urbs_in_error_delay = 0; + + return 0; + } +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index 515aad0847ee..30380d28a504 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -108,8 +108,11 @@ struct acm { + unsigned long flags; + # define EVENT_TTY_WAKEUP 0 + # define EVENT_RX_STALL 1 ++# define ACM_ERROR_DELAY 3 ++ unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */ + struct usb_cdc_line_coding line; /* bits, stop, parity */ +- struct work_struct work; /* work queue entry for line discipline waking up */ ++ struct work_struct work; /* work queue entry for various purposes*/ ++ struct delayed_work dwork; /* for cool downs needed in error recovery */ + unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */ + unsigned int ctrlout; /* output control lines (DTR, RTS) */ + struct async_icount iocount; /* counters for control line changes */ +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 4391192bdd19..d6d09486231d 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1195,6 +1195,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + #ifdef CONFIG_PM + udev->reset_resume = 1; + #endif ++ /* Don't set the change_bits when the device ++ * was powered off. ++ */ ++ if (test_bit(port1, hub->power_bits)) ++ set_bit(port1, hub->change_bits); + + } else { + /* The power session is gone; tell hub_wq */ +@@ -3008,6 +3013,15 @@ static int check_port_resume_type(struct usb_device *udev, + if (portchange & USB_PORT_STAT_C_ENABLE) + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_ENABLE); ++ ++ /* ++ * Whatever made this reset-resume necessary may have ++ * turned on the port1 bit in hub->change_bits. But after ++ * a successful reset-resume we want the bit to be clear; ++ * if it was on it would indicate that something happened ++ * following the reset-resume. ++ */ ++ clear_bit(port1, hub->change_bits); + } + + return status; +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index e70578e11156..00e80cfe614c 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -586,12 +586,13 @@ void usb_sg_cancel(struct usb_sg_request *io) + int i, retval; + + spin_lock_irqsave(&io->lock, flags); +- if (io->status) { ++ if (io->status || io->count == 0) { + spin_unlock_irqrestore(&io->lock, flags); + return; + } + /* shut everything down */ + io->status = -ECONNRESET; ++ io->count++; /* Keep the request alive until we're done */ + spin_unlock_irqrestore(&io->lock, flags); + + for (i = io->entries - 1; i >= 0; --i) { +@@ -605,6 +606,12 @@ void usb_sg_cancel(struct usb_sg_request *io) + dev_warn(&io->dev->dev, "%s, unlink --> %d\n", + __func__, retval); + } ++ ++ spin_lock_irqsave(&io->lock, flags); ++ io->count--; ++ if (!io->count) ++ complete(&io->complete); ++ spin_unlock_irqrestore(&io->lock, flags); + } + EXPORT_SYMBOL_GPL(usb_sg_cancel); + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 6c4bb47922ac..27d05f0134de 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -272,6 +272,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* Corsair K70 RGB RAPDIFIRE */ ++ { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, ++ + /* MIDI keyboard WORLDE MINI */ + { USB_DEVICE(0x1c75, 0x0204), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 76a0020b0f2e..4149d751719e 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1641,7 +1641,6 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc) + u32 reg; + + u8 link_state; +- u8 speed; + + /* + * According to the Databook Remote wakeup request should +@@ -1651,16 +1650,13 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc) + */ + reg = dwc3_readl(dwc->regs, DWC3_DSTS); + +- speed = reg & DWC3_DSTS_CONNECTSPD; +- if ((speed == DWC3_DSTS_SUPERSPEED) || +- (speed == DWC3_DSTS_SUPERSPEED_PLUS)) +- return 0; +- + link_state = DWC3_DSTS_USBLNKST(reg); + + switch (link_state) { ++ case DWC3_LINK_STATE_RESET: + case DWC3_LINK_STATE_RX_DET: /* in HS, means Early Suspend */ + case DWC3_LINK_STATE_U3: /* in HS, means SUSPEND */ ++ case DWC3_LINK_STATE_RESUME: + break; + default: + return -EINVAL; +diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c +index 12fe70beae69..21244c556b81 100644 +--- a/drivers/usb/early/xhci-dbc.c ++++ b/drivers/usb/early/xhci-dbc.c +@@ -738,19 +738,19 @@ static void xdbc_handle_tx_event(struct xdbc_trb *evt_trb) + case COMP_USB_TRANSACTION_ERROR: + case COMP_STALL_ERROR: + default: +- if (ep_id == XDBC_EPID_OUT) ++ if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL) + xdbc.flags |= XDBC_FLAGS_OUT_STALL; +- if (ep_id == XDBC_EPID_IN) ++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL) + xdbc.flags |= XDBC_FLAGS_IN_STALL; + + xdbc_trace("endpoint %d stalled\n", ep_id); + break; + } + +- if (ep_id == XDBC_EPID_IN) { ++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL) { + xdbc.flags &= ~XDBC_FLAGS_IN_PROCESS; + xdbc_bulk_transfer(NULL, XDBC_MAX_PACKET, true); +- } else if (ep_id == XDBC_EPID_OUT) { ++ } else if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL) { + xdbc.flags &= ~XDBC_FLAGS_OUT_PROCESS; + } else { + xdbc_trace("invalid endpoint id %d\n", ep_id); +diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h +index a516cab0bf4a..6c9200d913da 100644 +--- a/drivers/usb/early/xhci-dbc.h ++++ b/drivers/usb/early/xhci-dbc.h +@@ -123,8 +123,22 @@ struct xdbc_ring { + u32 cycle_state; + }; + +-#define XDBC_EPID_OUT 2 +-#define XDBC_EPID_IN 3 ++/* ++ * These are the "Endpoint ID" (also known as "Context Index") values for the ++ * OUT Transfer Ring and the IN Transfer Ring of a Debug Capability Context data ++ * structure. ++ * According to the "eXtensible Host Controller Interface for Universal Serial ++ * Bus (xHCI)" specification, section "7.6.3.2 Endpoint Contexts and Transfer ++ * Rings", these should be 0 and 1, and those are the values AMD machines give ++ * you; but Intel machines seem to use the formula from section "4.5.1 Device ++ * Context Index", which is supposed to be used for the Device Context only. ++ * Luckily the values from Intel don't overlap with those from AMD, so we can ++ * just test for both. ++ */ ++#define XDBC_EPID_OUT 0 ++#define XDBC_EPID_IN 1 ++#define XDBC_EPID_OUT_INTEL 2 ++#define XDBC_EPID_IN_INTEL 3 + + struct xdbc_state { + u16 vendor; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 819fd77a2da4..2ff7c21bbda5 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1727,6 +1727,10 @@ static void ffs_data_reset(struct ffs_data *ffs) + ffs->state = FFS_READ_DESCRIPTORS; + ffs->setup_state = FFS_NO_SETUP; + ffs->flags = 0; ++ ++ ffs->ms_os_descs_ext_prop_count = 0; ++ ffs->ms_os_descs_ext_prop_name_len = 0; ++ ffs->ms_os_descs_ext_prop_data_len = 0; + } + + +diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c +index bfd8f7ade935..be9f40bc9c12 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c +@@ -546,7 +546,7 @@ static void bdc_req_complete(struct bdc_ep *ep, struct bdc_req *req, + { + struct bdc *bdc = ep->bdc; + +- if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) ++ if (req == NULL) + return; + + dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status); +diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c +index 3121fa31aabf..a6f88442a53a 100644 +--- a/drivers/usb/misc/sisusbvga/sisusb.c ++++ b/drivers/usb/misc/sisusbvga/sisusb.c +@@ -1198,18 +1198,18 @@ static int sisusb_read_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, + /* High level: Gfx (indexed) register access */ + + #ifdef INCL_SISUSB_CON +-int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data) ++int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data) + { + return sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); + } + +-int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data) ++int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 *data) + { + return sisusb_read_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); + } + #endif + +-int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 data) + { + int ret; +@@ -1219,7 +1219,7 @@ int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, + return ret; + } + +-int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, ++int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 *data) + { + int ret; +@@ -1229,7 +1229,7 @@ int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, + return ret; + } + +-int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx, ++int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, u8 idx, + u8 myand, u8 myor) + { + int ret; +@@ -1244,7 +1244,7 @@ int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx, + } + + static int sisusb_setidxregmask(struct sisusb_usb_data *sisusb, +- int port, u8 idx, u8 data, u8 mask) ++ u32 port, u8 idx, u8 data, u8 mask) + { + int ret; + u8 tmp; +@@ -1257,13 +1257,13 @@ static int sisusb_setidxregmask(struct sisusb_usb_data *sisusb, + return ret; + } + +-int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 myor) + { + return sisusb_setidxregandor(sisusb, port, index, 0xff, myor); + } + +-int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand) + { + return sisusb_setidxregandor(sisusb, port, idx, myand, 0x00); +@@ -2786,8 +2786,8 @@ static loff_t sisusb_lseek(struct file *file, loff_t offset, int orig) + static int sisusb_handle_command(struct sisusb_usb_data *sisusb, + struct sisusb_command *y, unsigned long arg) + { +- int retval, port, length; +- u32 address; ++ int retval, length; ++ u32 port, address; + + /* All our commands require the device + * to be initialized. +diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.h b/drivers/usb/misc/sisusbvga/sisusb_init.h +index e79a616f0d26..f7182257f7e1 100644 +--- a/drivers/usb/misc/sisusbvga/sisusb_init.h ++++ b/drivers/usb/misc/sisusbvga/sisusb_init.h +@@ -811,17 +811,17 @@ static const struct SiS_VCLKData SiSUSB_VCLKData[] = { + int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo); + int SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo); + +-extern int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data); +-extern int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 * data); +-extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data); ++extern int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 * data); ++extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 data); +-extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 * data); +-extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand, u8 myor); +-extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 myor); +-extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand); + + void sisusb_delete(struct kref *kref); +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 9d97543449e6..20dd8df864c4 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -82,6 +82,19 @@ static void uas_free_streams(struct uas_dev_info *devinfo); + static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix, + int status); + ++/* ++ * This driver needs its own workqueue, as we need to control memory allocation. ++ * ++ * In the course of error handling and power management uas_wait_for_pending_cmnds() ++ * needs to flush pending work items. In these contexts we cannot allocate memory ++ * by doing block IO as we would deadlock. For the same reason we cannot wait ++ * for anything allocating memory not heeding these constraints. ++ * ++ * So we have to control all work items that can be on the workqueue we flush. ++ * Hence we cannot share a queue and need our own. ++ */ ++static struct workqueue_struct *workqueue; ++ + static void uas_do_work(struct work_struct *work) + { + struct uas_dev_info *devinfo = +@@ -110,7 +123,7 @@ static void uas_do_work(struct work_struct *work) + if (!err) + cmdinfo->state &= ~IS_IN_WORK_LIST; + else +- schedule_work(&devinfo->work); ++ queue_work(workqueue, &devinfo->work); + } + out: + spin_unlock_irqrestore(&devinfo->lock, flags); +@@ -135,7 +148,7 @@ static void uas_add_work(struct uas_cmd_info *cmdinfo) + + lockdep_assert_held(&devinfo->lock); + cmdinfo->state |= IS_IN_WORK_LIST; +- schedule_work(&devinfo->work); ++ queue_work(workqueue, &devinfo->work); + } + + static void uas_zap_pending(struct uas_dev_info *devinfo, int result) +@@ -191,6 +204,9 @@ static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix, + struct uas_cmd_info *ci = (void *)&cmnd->SCp; + struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp; + ++ if (status == -ENODEV) /* too late */ ++ return; ++ + scmd_printk(KERN_INFO, cmnd, + "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ", + prefix, status, cmdinfo->uas_tag, +@@ -1233,7 +1249,31 @@ static struct usb_driver uas_driver = { + .id_table = uas_usb_ids, + }; + +-module_usb_driver(uas_driver); ++static int __init uas_init(void) ++{ ++ int rv; ++ ++ workqueue = alloc_workqueue("uas", WQ_MEM_RECLAIM, 0); ++ if (!workqueue) ++ return -ENOMEM; ++ ++ rv = usb_register(&uas_driver); ++ if (rv) { ++ destroy_workqueue(workqueue); ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ ++static void __exit uas_exit(void) ++{ ++ usb_deregister(&uas_driver); ++ destroy_workqueue(workqueue); ++} ++ ++module_init(uas_init); ++module_exit(uas_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR( +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index df8ee83c3f1a..5c3f2eaf59e8 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2342,6 +2342,13 @@ UNUSUAL_DEV( 0x3340, 0xffff, 0x0000, 0x0000, + USB_SC_DEVICE,USB_PR_DEVICE,NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Reported by Cyril Roelandt <tipecaml@gmail.com> */ ++UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */ + UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, + "iRiver", +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index b30fb637ae94..52e03f1c76e3 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -245,6 +245,7 @@ static int watchdog_start(struct watchdog_device *wdd) + if (err == 0) { + set_bit(WDOG_ACTIVE, &wdd->status); + wd_data->last_keepalive = started_at; ++ wd_data->last_hw_keepalive = started_at; + watchdog_update_worker(wdd); + } + +diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c +index a1c17000129b..e94a61eaeceb 100644 +--- a/drivers/xen/xenbus/xenbus_client.c ++++ b/drivers/xen/xenbus/xenbus_client.c +@@ -450,7 +450,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn); + int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs, + unsigned int nr_grefs, void **vaddr) + { +- return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr); ++ int err; ++ ++ err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr); ++ /* Some hypervisors are buggy and can return 1. */ ++ if (err > 0) ++ err = GNTST_general_error; ++ ++ return err; + } + EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc); + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index c3a3ee74e2d8..1b5a50848b5b 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1863,8 +1863,12 @@ retry_locked: + } + + /* want more caps from mds? */ +- if (want & ~(cap->mds_wanted | cap->issued)) +- goto ack; ++ if (want & ~cap->mds_wanted) { ++ if (want & ~(cap->mds_wanted | cap->issued)) ++ goto ack; ++ if (!__cap_is_valid(cap)) ++ goto ack; ++ } + + /* things we might delay */ + if ((cap->issued & ~retain) == 0 && +diff --git a/fs/ceph/export.c b/fs/ceph/export.c +index 3c59ad180ef0..4cfe1154d4c7 100644 +--- a/fs/ceph/export.c ++++ b/fs/ceph/export.c +@@ -151,6 +151,11 @@ static struct dentry *__get_parent(struct super_block *sb, + + req->r_num_caps = 1; + err = ceph_mdsc_do_request(mdsc, NULL, req); ++ if (err) { ++ ceph_mdsc_put_request(req); ++ return ERR_PTR(err); ++ } ++ + inode = req->r_target_inode; + if (inode) + ihold(inode); +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c +index bee888e0e2db..13eb028607ca 100644 +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -137,6 +137,49 @@ static void debug_print_tree(struct ext4_sb_info *sbi) + printk(KERN_CONT "\n"); + } + ++static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino) ++{ ++ struct inode *inode; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); ++ struct ext4_map_blocks map; ++ u32 i = 0, num; ++ int err = 0, n; ++ ++ if ((ino < EXT4_ROOT_INO) || ++ (ino > le32_to_cpu(sbi->s_es->s_inodes_count))) ++ return -EINVAL; ++ inode = ext4_iget(sb, ino, EXT4_IGET_SPECIAL); ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); ++ num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits; ++ while (i < num) { ++ map.m_lblk = i; ++ map.m_len = num - i; ++ n = ext4_map_blocks(NULL, inode, &map, 0); ++ if (n < 0) { ++ err = n; ++ break; ++ } ++ if (n == 0) { ++ i++; ++ } else { ++ if (!ext4_data_block_valid(sbi, map.m_pblk, n)) { ++ ext4_error(sb, "blocks %llu-%llu from inode %u " ++ "overlap system zone", map.m_pblk, ++ map.m_pblk + map.m_len - 1, ino); ++ err = -EFSCORRUPTED; ++ break; ++ } ++ err = add_system_zone(sbi, map.m_pblk, n); ++ if (err < 0) ++ break; ++ i += n; ++ } ++ } ++ iput(inode); ++ return err; ++} ++ + int ext4_setup_system_zone(struct super_block *sb) + { + ext4_group_t ngroups = ext4_get_groups_count(sb); +@@ -171,6 +214,12 @@ int ext4_setup_system_zone(struct super_block *sb) + if (ret) + return ret; + } ++ if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) { ++ ret = ext4_protect_reserved_inode(sb, ++ le32_to_cpu(sbi->s_es->s_journal_inum)); ++ if (ret) ++ return ret; ++ } + + if (test_opt(sb, DEBUG)) + debug_print_tree(EXT4_SB(sb)); +@@ -227,6 +276,11 @@ int ext4_check_blockref(const char *function, unsigned int line, + __le32 *bref = p; + unsigned int blk; + ++ if (ext4_has_feature_journal(inode->i_sb) && ++ (inode->i_ino == ++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) ++ return 0; ++ + while (bref < p+max) { + blk = le32_to_cpu(*bref++); + if (blk && +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 4aa0f8f7d9a0..6c5b4301ee37 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -2509,8 +2509,19 @@ int do_journal_get_write_access(handle_t *handle, + #define FALL_BACK_TO_NONDELALLOC 1 + #define CONVERT_INLINE_DATA 2 + +-extern struct inode *ext4_iget(struct super_block *, unsigned long); +-extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); ++typedef enum { ++ EXT4_IGET_NORMAL = 0, ++ EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */ ++ EXT4_IGET_HANDLE = 0x0002 /* Inode # is from a handle */ ++} ext4_iget_flags; ++ ++extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, ++ ext4_iget_flags flags, const char *function, ++ unsigned int line); ++ ++#define ext4_iget(sb, ino, flags) \ ++ __ext4_iget((sb), (ino), (flags), __func__, __LINE__) ++ + extern int ext4_write_inode(struct inode *, struct writeback_control *); + extern int ext4_setattr(struct dentry *, struct iattr *); + extern int ext4_getattr(const struct path *, struct kstat *, u32, unsigned int); +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index fa6ae9014e8f..4f9eb4b61549 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -510,6 +510,30 @@ int ext4_ext_check_inode(struct inode *inode) + return ext4_ext_check(inode, ext_inode_hdr(inode), ext_depth(inode), 0); + } + ++static void ext4_cache_extents(struct inode *inode, ++ struct ext4_extent_header *eh) ++{ ++ struct ext4_extent *ex = EXT_FIRST_EXTENT(eh); ++ ext4_lblk_t prev = 0; ++ int i; ++ ++ for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) { ++ unsigned int status = EXTENT_STATUS_WRITTEN; ++ ext4_lblk_t lblk = le32_to_cpu(ex->ee_block); ++ int len = ext4_ext_get_actual_len(ex); ++ ++ if (prev && (prev != lblk)) ++ ext4_es_cache_extent(inode, prev, lblk - prev, ~0, ++ EXTENT_STATUS_HOLE); ++ ++ if (ext4_ext_is_unwritten(ex)) ++ status = EXTENT_STATUS_UNWRITTEN; ++ ext4_es_cache_extent(inode, lblk, len, ++ ext4_ext_pblock(ex), status); ++ prev = lblk + len; ++ } ++} ++ + static struct buffer_head * + __read_extent_tree_block(const char *function, unsigned int line, + struct inode *inode, ext4_fsblk_t pblk, int depth, +@@ -530,36 +554,21 @@ __read_extent_tree_block(const char *function, unsigned int line, + } + if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE)) + return bh; +- err = __ext4_ext_check(function, line, inode, +- ext_block_hdr(bh), depth, pblk); +- if (err) +- goto errout; ++ if (!ext4_has_feature_journal(inode->i_sb) || ++ (inode->i_ino != ++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) { ++ err = __ext4_ext_check(function, line, inode, ++ ext_block_hdr(bh), depth, pblk); ++ if (err) ++ goto errout; ++ } + set_buffer_verified(bh); + /* + * If this is a leaf block, cache all of its entries + */ + if (!(flags & EXT4_EX_NOCACHE) && depth == 0) { + struct ext4_extent_header *eh = ext_block_hdr(bh); +- struct ext4_extent *ex = EXT_FIRST_EXTENT(eh); +- ext4_lblk_t prev = 0; +- int i; +- +- for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) { +- unsigned int status = EXTENT_STATUS_WRITTEN; +- ext4_lblk_t lblk = le32_to_cpu(ex->ee_block); +- int len = ext4_ext_get_actual_len(ex); +- +- if (prev && (prev != lblk)) +- ext4_es_cache_extent(inode, prev, +- lblk - prev, ~0, +- EXTENT_STATUS_HOLE); +- +- if (ext4_ext_is_unwritten(ex)) +- status = EXTENT_STATUS_UNWRITTEN; +- ext4_es_cache_extent(inode, lblk, len, +- ext4_ext_pblock(ex), status); +- prev = lblk + len; +- } ++ ext4_cache_extents(inode, eh); + } + return bh; + errout: +@@ -907,6 +916,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, + path[0].p_bh = NULL; + + i = depth; ++ if (!(flags & EXT4_EX_NOCACHE) && depth == 0) ++ ext4_cache_extents(inode, eh); + /* walk through the tree */ + while (i) { + ext_debug("depth %d: num %d, max %d\n", +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 2a480c0ef1bc..85c2a7ea5ea2 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -673,7 +673,7 @@ static int find_group_other(struct super_block *sb, struct inode *parent, + * block has been written back to disk. (Yes, these values are + * somewhat arbitrary...) + */ +-#define RECENTCY_MIN 5 ++#define RECENTCY_MIN 60 + #define RECENTCY_DIRTY 300 + + static int recently_deleted(struct super_block *sb, ext4_group_t group, int ino) +@@ -1239,7 +1239,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino) + if (!ext4_test_bit(bit, bitmap_bh->b_data)) + goto bad_orphan; + +- inode = ext4_iget(sb, ino); ++ inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); + ext4_error(sb, "couldn't read orphan inode %lu (err %d)", +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 5b0d5ca2c2b2..1bc0037c50aa 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -407,6 +407,10 @@ static int __check_block_validity(struct inode *inode, const char *func, + unsigned int line, + struct ext4_map_blocks *map) + { ++ if (ext4_has_feature_journal(inode->i_sb) && ++ (inode->i_ino == ++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) ++ return 0; + if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk, + map->m_len)) { + ext4_error_inode(inode, func, line, map->m_pblk, +@@ -2123,7 +2127,7 @@ static int ext4_writepage(struct page *page, + bool keep_towrite = false; + + if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) { +- ext4_invalidatepage(page, 0, PAGE_SIZE); ++ inode->i_mapping->a_ops->invalidatepage(page, 0, PAGE_SIZE); + unlock_page(page); + return -EIO; + } +@@ -4695,7 +4699,9 @@ int ext4_get_projid(struct inode *inode, kprojid_t *projid) + return 0; + } + +-struct inode *ext4_iget(struct super_block *sb, unsigned long ino) ++struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, ++ ext4_iget_flags flags, const char *function, ++ unsigned int line) + { + struct ext4_iloc iloc; + struct ext4_inode *raw_inode; +@@ -4709,6 +4715,18 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + gid_t i_gid; + projid_t i_projid; + ++ if (((flags & EXT4_IGET_NORMAL) && ++ (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || ++ (ino < EXT4_ROOT_INO) || ++ (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { ++ if (flags & EXT4_IGET_HANDLE) ++ return ERR_PTR(-ESTALE); ++ __ext4_error(sb, function, line, ++ "inode #%lu: comm %s: iget: illegal inode #", ++ ino, current->comm); ++ return ERR_PTR(-EFSCORRUPTED); ++ } ++ + inode = iget_locked(sb, ino); + if (!inode) + return ERR_PTR(-ENOMEM); +@@ -4724,18 +4742,26 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + raw_inode = ext4_raw_inode(&iloc); + + if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) { +- EXT4_ERROR_INODE(inode, "root inode unallocated"); ++ ext4_error_inode(inode, function, line, 0, ++ "iget: root inode unallocated"); + ret = -EFSCORRUPTED; + goto bad_inode; + } + ++ if ((flags & EXT4_IGET_HANDLE) && ++ (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) { ++ ret = -ESTALE; ++ goto bad_inode; ++ } ++ + if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { + ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize); + if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > + EXT4_INODE_SIZE(inode->i_sb) || + (ei->i_extra_isize & 3)) { +- EXT4_ERROR_INODE(inode, +- "bad extra_isize %u (inode size %u)", ++ ext4_error_inode(inode, function, line, 0, ++ "iget: bad extra_isize %u " ++ "(inode size %u)", + ei->i_extra_isize, + EXT4_INODE_SIZE(inode->i_sb)); + ret = -EFSCORRUPTED; +@@ -4757,7 +4783,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + } + + if (!ext4_inode_csum_verify(inode, raw_inode, ei)) { +- EXT4_ERROR_INODE(inode, "checksum invalid"); ++ ext4_error_inode(inode, function, line, 0, ++ "iget: checksum invalid"); + ret = -EFSBADCRC; + goto bad_inode; + } +@@ -4813,7 +4840,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32; + inode->i_size = ext4_isize(sb, raw_inode); + if ((size = i_size_read(inode)) < 0) { +- EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size); ++ ext4_error_inode(inode, function, line, 0, ++ "iget: bad i_size value: %lld", size); + ret = -EFSCORRUPTED; + goto bad_inode; + } +@@ -4899,7 +4927,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + ret = 0; + if (ei->i_file_acl && + !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) { +- EXT4_ERROR_INODE(inode, "bad extended attribute block %llu", ++ ext4_error_inode(inode, function, line, 0, ++ "iget: bad extended attribute block %llu", + ei->i_file_acl); + ret = -EFSCORRUPTED; + goto bad_inode; +@@ -4954,7 +4983,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + make_bad_inode(inode); + } else { + ret = -EFSCORRUPTED; +- EXT4_ERROR_INODE(inode, "bogus i_mode (%o)", inode->i_mode); ++ ext4_error_inode(inode, function, line, 0, ++ "iget: bogus i_mode (%o)", inode->i_mode); + goto bad_inode; + } + brelse(iloc.bh); +@@ -4969,13 +4999,6 @@ bad_inode: + return ERR_PTR(ret); + } + +-struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) +-{ +- if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) +- return ERR_PTR(-EFSCORRUPTED); +- return ext4_iget(sb, ino); +-} +- + static int ext4_inode_blocks_set(handle_t *handle, + struct ext4_inode *raw_inode, + struct ext4_inode_info *ei) +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 82e118e9e50b..9dbb5542167a 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -111,7 +111,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + if (!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) + return -EPERM; + +- inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO); ++ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL); + if (IS_ERR(inode_bl)) + return PTR_ERR(inode_bl); + ei_bl = EXT4_I(inode_bl); +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 745a89d30a57..d7cedfaa1cc0 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1952,7 +1952,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac, + int free; + + free = e4b->bd_info->bb_free; +- BUG_ON(free <= 0); ++ if (WARN_ON(free <= 0)) ++ return; + + i = e4b->bd_info->bb_first_free; + +@@ -1973,7 +1974,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac, + } + + mb_find_extent(e4b, i, ac->ac_g_ex.fe_len, &ex); +- BUG_ON(ex.fe_len <= 0); ++ if (WARN_ON(ex.fe_len <= 0)) ++ break; + if (free < ex.fe_len) { + ext4_grp_locked_error(sb, e4b->bd_group, 0, 0, + "%d free clusters as per " +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 3f7b3836166c..161099f39ab9 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1597,7 +1597,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi + dentry); + return ERR_PTR(-EFSCORRUPTED); + } +- inode = ext4_iget_normal(dir->i_sb, ino); ++ inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL); + if (inode == ERR_PTR(-ESTALE)) { + EXT4_ERROR_INODE(dir, + "deleted inode referenced: %u", +@@ -1639,7 +1639,7 @@ struct dentry *ext4_get_parent(struct dentry *child) + return ERR_PTR(-EFSCORRUPTED); + } + +- return d_obtain_alias(ext4_iget_normal(child->d_sb, ino)); ++ return d_obtain_alias(ext4_iget(child->d_sb, ino, EXT4_IGET_NORMAL)); + } + + /* +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index d42f7471fd5b..19af346a6651 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1652,7 +1652,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input) + "No reserved GDT blocks, can't resize"); + return -EPERM; + } +- inode = ext4_iget(sb, EXT4_RESIZE_INO); ++ inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL); + if (IS_ERR(inode)) { + ext4_warning(sb, "Error opening resize inode"); + return PTR_ERR(inode); +@@ -1980,7 +1980,8 @@ retry: + } + + if (!resize_inode) +- resize_inode = ext4_iget(sb, EXT4_RESIZE_INO); ++ resize_inode = ext4_iget(sb, EXT4_RESIZE_INO, ++ EXT4_IGET_SPECIAL); + if (IS_ERR(resize_inode)) { + ext4_warning(sb, "Error opening resize inode"); + return PTR_ERR(resize_inode); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 0ced133a36ec..ffc985d78137 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1126,20 +1126,11 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, + { + struct inode *inode; + +- if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) +- return ERR_PTR(-ESTALE); +- if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)) +- return ERR_PTR(-ESTALE); +- +- /* iget isn't really right if the inode is currently unallocated!! +- * +- * ext4_read_inode will return a bad_inode if the inode had been +- * deleted, so we should be safe. +- * ++ /* + * Currently we don't know the generation for parent directory, so + * a generation of 0 means "accept any" + */ +- inode = ext4_iget_normal(sb, ino); ++ inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE); + if (IS_ERR(inode)) + return ERR_CAST(inode); + if (generation && inode->i_generation != generation) { +@@ -3465,7 +3456,8 @@ int ext4_calculate_overhead(struct super_block *sb) + */ + if (sbi->s_journal && !sbi->journal_bdev) + overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen); +- else if (ext4_has_feature_journal(sb) && !sbi->s_journal) { ++ else if (ext4_has_feature_journal(sb) && !sbi->s_journal && j_inum) { ++ /* j_inum for internal journal is non-zero */ + j_inode = ext4_get_journal_inode(sb, j_inum); + if (j_inode) { + j_blocks = j_inode->i_size >> sb->s_blocksize_bits; +@@ -4370,7 +4362,7 @@ no_journal: + * so we can safely mount the rest of the filesystem now. + */ + +- root = ext4_iget(sb, EXT4_ROOT_INO); ++ root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL); + if (IS_ERR(root)) { + ext4_msg(sb, KERN_ERR, "get root inode failed"); + ret = PTR_ERR(root); +@@ -4620,7 +4612,7 @@ static struct inode *ext4_get_journal_inode(struct super_block *sb, + * happen if we iget() an unused inode, as the subsequent iput() + * will try to delete it. + */ +- journal_inode = ext4_iget(sb, journal_inum); ++ journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL); + if (IS_ERR(journal_inode)) { + ext4_msg(sb, KERN_ERR, "no journal found"); + return NULL; +@@ -5693,7 +5685,7 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, + if (!qf_inums[type]) + return -EPERM; + +- qf_inode = ext4_iget(sb, qf_inums[type]); ++ qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL); + if (IS_ERR(qf_inode)) { + ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]); + return PTR_ERR(qf_inode); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index f2fde3ac8698..b0873b89dc87 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -383,7 +383,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + struct inode *inode; + int err; + +- inode = ext4_iget(parent->i_sb, ea_ino); ++ inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); + ext4_error(parent->i_sb, +@@ -1486,7 +1486,8 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, + } + + while (ce) { +- ea_inode = ext4_iget(inode->i_sb, ce->e_value); ++ ea_inode = ext4_iget(inode->i_sb, ce->e_value, ++ EXT4_IGET_NORMAL); + if (!IS_ERR(ea_inode) && + !is_bad_inode(ea_inode) && + (EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) && +diff --git a/fs/namespace.c b/fs/namespace.c +index e9c13eedd739..c8acc60c456d 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -3216,8 +3216,8 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, + /* make certain new is below the root */ + if (!is_path_reachable(new_mnt, new.dentry, &root)) + goto out4; +- root_mp->m_count++; /* pin it so it won't go away */ + lock_mount_hash(); ++ root_mp->m_count++; /* pin it so it won't go away */ + detach_mnt(new_mnt, &parent_path); + detach_mnt(root_mnt, &root_parent); + if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index fca8b2e7fbeb..d5d1c70bb927 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -246,6 +246,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh, + if (!nbl) { + nbl= kmalloc(sizeof(*nbl), GFP_KERNEL); + if (nbl) { ++ INIT_LIST_HEAD(&nbl->nbl_list); ++ INIT_LIST_HEAD(&nbl->nbl_lru); + fh_copy_shallow(&nbl->nbl_fh, fh); + locks_init_lock(&nbl->nbl_lock); + nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client, +diff --git a/fs/pnode.c b/fs/pnode.c +index 53d411a371ce..7910ae91f17e 100644 +--- a/fs/pnode.c ++++ b/fs/pnode.c +@@ -266,14 +266,13 @@ static int propagate_one(struct mount *m) + if (IS_ERR(child)) + return PTR_ERR(child); + child->mnt.mnt_flags &= ~MNT_LOCKED; ++ read_seqlock_excl(&mount_lock); + mnt_set_mountpoint(m, mp, child); ++ if (m->mnt_master != dest_master) ++ SET_MNT_MARK(m->mnt_master); ++ read_sequnlock_excl(&mount_lock); + last_dest = m; + last_source = child; +- if (m->mnt_master != dest_master) { +- read_seqlock_excl(&mount_lock); +- SET_MNT_MARK(m->mnt_master); +- read_sequnlock_excl(&mount_lock); +- } + hlist_add_head(&child->mnt_hash, list); + return count_mounts(m->mnt_ns, child); + } +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index ce400f97370d..aaa7486b6f0d 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -459,7 +459,7 @@ static int mmap_vmcore(struct file *file, struct vm_area_struct *vma) + tsz = min(elfcorebuf_sz + elfnotes_sz - (size_t)start, size); + kaddr = elfnotes_buf + start - elfcorebuf_sz; + if (remap_vmalloc_range_partial(vma, vma->vm_start + len, +- kaddr, tsz)) ++ kaddr, 0, tsz)) + goto fail; + size -= tsz; + start += tsz; +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c +index cb4833d06467..7cfbe2b0f886 100644 +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -3035,7 +3035,8 @@ xfs_rename( + &dfops, &first_block, spaceres); + + /* +- * Set up the target. ++ * Check for expected errors before we dirty the transaction ++ * so we can return an error without a transaction abort. + */ + if (target_ip == NULL) { + /* +@@ -3047,6 +3048,46 @@ xfs_rename( + if (error) + goto out_trans_cancel; + } ++ } else { ++ /* ++ * If target exists and it's a directory, check that whether ++ * it can be destroyed. ++ */ ++ if (S_ISDIR(VFS_I(target_ip)->i_mode) && ++ (!xfs_dir_isempty(target_ip) || ++ (VFS_I(target_ip)->i_nlink > 2))) { ++ error = -EEXIST; ++ goto out_trans_cancel; ++ } ++ } ++ ++ /* ++ * Directory entry creation below may acquire the AGF. Remove ++ * the whiteout from the unlinked list first to preserve correct ++ * AGI/AGF locking order. This dirties the transaction so failures ++ * after this point will abort and log recovery will clean up the ++ * mess. ++ * ++ * For whiteouts, we need to bump the link count on the whiteout ++ * inode. After this point, we have a real link, clear the tmpfile ++ * state flag from the inode so it doesn't accidentally get misused ++ * in future. ++ */ ++ if (wip) { ++ ASSERT(VFS_I(wip)->i_nlink == 0); ++ error = xfs_iunlink_remove(tp, wip); ++ if (error) ++ goto out_trans_cancel; ++ ++ xfs_bumplink(tp, wip); ++ xfs_trans_log_inode(tp, wip, XFS_ILOG_CORE); ++ VFS_I(wip)->i_state &= ~I_LINKABLE; ++ } ++ ++ /* ++ * Set up the target. ++ */ ++ if (target_ip == NULL) { + /* + * If target does not exist and the rename crosses + * directories, adjust the target directory link count +@@ -3067,22 +3108,6 @@ xfs_rename( + goto out_bmap_cancel; + } + } else { /* target_ip != NULL */ +- /* +- * If target exists and it's a directory, check that both +- * target and source are directories and that target can be +- * destroyed, or that neither is a directory. +- */ +- if (S_ISDIR(VFS_I(target_ip)->i_mode)) { +- /* +- * Make sure target dir is empty. +- */ +- if (!(xfs_dir_isempty(target_ip)) || +- (VFS_I(target_ip)->i_nlink > 2)) { +- error = -EEXIST; +- goto out_trans_cancel; +- } +- } +- + /* + * Link the source inode under the target name. + * If the source inode is a directory and we are moving +@@ -3175,32 +3200,6 @@ xfs_rename( + if (error) + goto out_bmap_cancel; + +- /* +- * For whiteouts, we need to bump the link count on the whiteout inode. +- * This means that failures all the way up to this point leave the inode +- * on the unlinked list and so cleanup is a simple matter of dropping +- * the remaining reference to it. If we fail here after bumping the link +- * count, we're shutting down the filesystem so we'll never see the +- * intermediate state on disk. +- */ +- if (wip) { +- ASSERT(VFS_I(wip)->i_nlink == 0); +- error = xfs_bumplink(tp, wip); +- if (error) +- goto out_bmap_cancel; +- error = xfs_iunlink_remove(tp, wip); +- if (error) +- goto out_bmap_cancel; +- xfs_trans_log_inode(tp, wip, XFS_ILOG_CORE); +- +- /* +- * Now we have a real link, clear the "I'm a tmpfile" state +- * flag from the inode so it doesn't accidentally get misused in +- * future. +- */ +- VFS_I(wip)->i_state &= ~I_LINKABLE; +- } +- + xfs_trans_ichgtime(tp, src_dp, XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG); + xfs_trans_log_inode(tp, src_dp, XFS_ILOG_CORE); + if (new_parent) +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index 4e768e606998..360e32220f93 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -608,6 +608,7 @@ xfs_log_mount( + xfs_daddr_t blk_offset, + int num_bblks) + { ++ bool fatal = xfs_sb_version_hascrc(&mp->m_sb); + int error = 0; + int min_logfsbs; + +@@ -659,9 +660,20 @@ xfs_log_mount( + XFS_FSB_TO_B(mp, mp->m_sb.sb_logblocks), + XFS_MAX_LOG_BYTES); + error = -EINVAL; ++ } else if (mp->m_sb.sb_logsunit > 1 && ++ mp->m_sb.sb_logsunit % mp->m_sb.sb_blocksize) { ++ xfs_warn(mp, ++ "log stripe unit %u bytes must be a multiple of block size", ++ mp->m_sb.sb_logsunit); ++ error = -EINVAL; ++ fatal = true; + } + if (error) { +- if (xfs_sb_version_hascrc(&mp->m_sb)) { ++ /* ++ * Log check errors are always fatal on v5; or whenever bad ++ * metadata leads to a crash. ++ */ ++ if (fatal) { + xfs_crit(mp, "AAIEEE! Log failed size checks. Abort!"); + ASSERT(0); + goto out_free_log; +diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c +index 37e603bf1591..db7f9fdd20a3 100644 +--- a/fs/xfs/xfs_reflink.c ++++ b/fs/xfs/xfs_reflink.c +@@ -1125,6 +1125,7 @@ xfs_reflink_remap_extent( + uirec.br_startblock = irec->br_startblock + rlen; + uirec.br_startoff = irec->br_startoff + rlen; + uirec.br_blockcount = unmap_len - rlen; ++ uirec.br_state = irec->br_state; + unmap_len = rlen; + + /* If this isn't a real mapping, we're done. */ +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 30376715a607..2e06ca46f07c 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -945,7 +945,7 @@ search_memslots(struct kvm_memslots *slots, gfn_t gfn) + start = slot + 1; + } + +- if (gfn >= memslots[start].base_gfn && ++ if (start < slots->used_slots && gfn >= memslots[start].base_gfn && + gfn < memslots[start].base_gfn + memslots[start].npages) { + atomic_set(&slots->lru_slot, start); + return &memslots[start]; +diff --git a/include/linux/overflow.h b/include/linux/overflow.h +index c8890ec358a7..d309788f4cd2 100644 +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -202,4 +202,35 @@ + + #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */ + ++/** check_shl_overflow() - Calculate a left-shifted value and check overflow ++ * ++ * @a: Value to be shifted ++ * @s: How many bits left to shift ++ * @d: Pointer to where to store the result ++ * ++ * Computes *@d = (@a << @s) ++ * ++ * Returns true if '*d' cannot hold the result or when 'a << s' doesn't ++ * make sense. Example conditions: ++ * - 'a << s' causes bits to be lost when stored in *d. ++ * - 's' is garbage (e.g. negative) or so large that the result of ++ * 'a << s' is guaranteed to be 0. ++ * - 'a' is negative. ++ * - 'a << s' sets the sign bit, if any, in '*d'. ++ * ++ * '*d' will hold the results of the attempted shift, but is not ++ * considered "safe for use" if false is returned. ++ */ ++#define check_shl_overflow(a, s, d) ({ \ ++ typeof(a) _a = a; \ ++ typeof(s) _s = s; \ ++ typeof(d) _d = d; \ ++ u64 _a_full = _a; \ ++ unsigned int _to_shift = \ ++ _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \ ++ *_d = (_a_full << _to_shift); \ ++ (_to_shift != _s || *_d < 0 || _a < 0 || \ ++ (*_d >> _to_shift) != _a); \ ++}) ++ + #endif /* __LINUX_OVERFLOW_H */ +diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h +index 2dd0a9ed5b36..733fad7dfbed 100644 +--- a/include/linux/qed/qed_chain.h ++++ b/include/linux/qed/qed_chain.h +@@ -97,6 +97,11 @@ struct qed_chain_u32 { + u32 cons_idx; + }; + ++struct addr_tbl_entry { ++ void *virt_addr; ++ dma_addr_t dma_map; ++}; ++ + struct qed_chain { + /* fastpath portion of the chain - required for commands such + * as produce / consume. +@@ -107,10 +112,11 @@ struct qed_chain { + + /* Fastpath portions of the PBL [if exists] */ + struct { +- /* Table for keeping the virtual addresses of the chain pages, +- * respectively to the physical addresses in the pbl table. ++ /* Table for keeping the virtual and physical addresses of the ++ * chain pages, respectively to the physical addresses ++ * in the pbl table. + */ +- void **pp_virt_addr_tbl; ++ struct addr_tbl_entry *pp_addr_tbl; + + union { + struct qed_chain_pbl_u16 u16; +@@ -287,7 +293,7 @@ qed_chain_advance_page(struct qed_chain *p_chain, + *(u32 *)page_to_inc = 0; + page_index = *(u32 *)page_to_inc; + } +- *p_next_elem = p_chain->pbl.pp_virt_addr_tbl[page_index]; ++ *p_next_elem = p_chain->pbl.pp_addr_tbl[page_index].virt_addr; + } + } + +@@ -537,7 +543,7 @@ static inline void qed_chain_init_params(struct qed_chain *p_chain, + + p_chain->pbl_sp.p_phys_table = 0; + p_chain->pbl_sp.p_virt_table = NULL; +- p_chain->pbl.pp_virt_addr_tbl = NULL; ++ p_chain->pbl.pp_addr_tbl = NULL; + } + + /** +@@ -575,11 +581,11 @@ static inline void qed_chain_init_mem(struct qed_chain *p_chain, + static inline void qed_chain_init_pbl_mem(struct qed_chain *p_chain, + void *p_virt_pbl, + dma_addr_t p_phys_pbl, +- void **pp_virt_addr_tbl) ++ struct addr_tbl_entry *pp_addr_tbl) + { + p_chain->pbl_sp.p_phys_table = p_phys_pbl; + p_chain->pbl_sp.p_virt_table = p_virt_pbl; +- p_chain->pbl.pp_virt_addr_tbl = pp_virt_addr_tbl; ++ p_chain->pbl.pp_addr_tbl = pp_addr_tbl; + } + + /** +@@ -644,7 +650,7 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain) + break; + case QED_CHAIN_MODE_PBL: + last_page_idx = p_chain->page_cnt - 1; +- p_virt_addr = p_chain->pbl.pp_virt_addr_tbl[last_page_idx]; ++ p_virt_addr = p_chain->pbl.pp_addr_tbl[last_page_idx].virt_addr; + break; + } + /* p_virt_addr points at this stage to the last page of the chain */ +@@ -716,7 +722,7 @@ static inline void qed_chain_pbl_zero_mem(struct qed_chain *p_chain) + page_cnt = qed_chain_get_page_cnt(p_chain); + + for (i = 0; i < page_cnt; i++) +- memset(p_chain->pbl.pp_virt_addr_tbl[i], 0, ++ memset(p_chain->pbl.pp_addr_tbl[i].virt_addr, 0, + QED_CHAIN_PAGE_SIZE); + } + +diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h +index 29ef33498cb6..98d65e11e837 100644 +--- a/include/linux/vmalloc.h ++++ b/include/linux/vmalloc.h +@@ -102,7 +102,7 @@ extern void vunmap(const void *addr); + + extern int remap_vmalloc_range_partial(struct vm_area_struct *vma, + unsigned long uaddr, void *kaddr, +- unsigned long size); ++ unsigned long pgoff, unsigned long size); + + extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, + unsigned long pgoff); +diff --git a/include/net/tcp.h b/include/net/tcp.h +index c96302310314..58e8e57787cf 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -55,7 +55,7 @@ extern struct inet_hashinfo tcp_hashinfo; + extern struct percpu_counter tcp_orphan_count; + void tcp_time_wait(struct sock *sk, int state, int timeo); + +-#define MAX_TCP_HEADER (128 + MAX_HEADER) ++#define MAX_TCP_HEADER L1_CACHE_ALIGN(128 + MAX_HEADER) + #define MAX_TCP_OPTION_SPACE 40 + #define TCP_MIN_SND_MSS 48 + #define TCP_MIN_GSO_SIZE (TCP_MIN_SND_MSS - MAX_TCP_OPTION_SPACE) +diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h +index 7b8c9e19bad1..0f3cb13db8e9 100644 +--- a/include/uapi/linux/keyctl.h ++++ b/include/uapi/linux/keyctl.h +@@ -65,7 +65,12 @@ + + /* keyctl structures */ + struct keyctl_dh_params { +- __s32 private; ++ union { ++#ifndef __cplusplus ++ __s32 private; ++#endif ++ __s32 priv; ++ }; + __s32 prime; + __s32 base; + }; +diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h +index fa7f97da5b76..7272f85d6d6a 100644 +--- a/include/uapi/linux/swab.h ++++ b/include/uapi/linux/swab.h +@@ -135,9 +135,9 @@ static inline __attribute_const__ __u32 __fswahb32(__u32 val) + + static __always_inline unsigned long __swab(const unsigned long y) + { +-#if BITS_PER_LONG == 64 ++#if __BITS_PER_LONG == 64 + return __swab64(y); +-#else /* BITS_PER_LONG == 32 */ ++#else /* __BITS_PER_LONG == 32 */ + return __swab32(y); + #endif + } +diff --git a/ipc/util.c b/ipc/util.c +index 79b30eee32cd..7989f5e53219 100644 +--- a/ipc/util.c ++++ b/ipc/util.c +@@ -750,13 +750,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, + total++; + } + ++ *new_pos = pos + 1; + if (total >= ids->in_use) + return NULL; + + for (; pos < IPCMNI; pos++) { + ipc = idr_find(&ids->ipcs_idr, pos); + if (ipc != NULL) { +- *new_pos = pos + 1; + rcu_read_lock(); + ipc_lock_object(ipc); + return ipc; +diff --git a/kernel/audit.c b/kernel/audit.c +index b21a8910f765..aa6d5e39526b 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1292,6 +1292,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: + if (!audit_enabled && msg_type != AUDIT_USER_AVC) + return 0; ++ /* exit early if there isn't at least one character to print */ ++ if (data_len < 2) ++ return -EINVAL; + + err = audit_filter(msg_type, AUDIT_FILTER_USER); + if (err == 1) { /* match or error */ +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 845c8a1a9d30..5636c9c48545 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6119,9 +6119,12 @@ static u64 perf_virt_to_phys(u64 virt) + * Try IRQ-safe __get_user_pages_fast first. + * If failed, leave phys_addr as 0. + */ +- if ((current->mm != NULL) && +- (__get_user_pages_fast(virt, 1, 0, &p) == 1)) +- phys_addr = page_to_phys(p) + virt % PAGE_SIZE; ++ if (current->mm != NULL) { ++ pagefault_disable(); ++ if (__get_user_pages_fast(virt, 1, 0, &p) == 1) ++ phys_addr = page_to_phys(p) + virt % PAGE_SIZE; ++ pagefault_enable(); ++ } + + if (p) + put_page(p); +@@ -6607,10 +6610,17 @@ static void perf_event_task_output(struct perf_event *event, + goto out; + + task_event->event_id.pid = perf_event_pid(event, task); +- task_event->event_id.ppid = perf_event_pid(event, current); +- + task_event->event_id.tid = perf_event_tid(event, task); +- task_event->event_id.ptid = perf_event_tid(event, current); ++ ++ if (task_event->event_id.header.type == PERF_RECORD_EXIT) { ++ task_event->event_id.ppid = perf_event_pid(event, ++ task->real_parent); ++ task_event->event_id.ptid = perf_event_pid(event, ++ task->real_parent); ++ } else { /* PERF_RECORD_FORK */ ++ task_event->event_id.ppid = perf_event_pid(event, current); ++ task_event->event_id.ptid = perf_event_tid(event, current); ++ } + + task_event->event_id.time = perf_event_clock(event); + +diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c +index 6e40ff6be083..291e0797125b 100644 +--- a/kernel/gcov/fs.c ++++ b/kernel/gcov/fs.c +@@ -109,9 +109,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos) + { + struct gcov_iterator *iter = data; + ++ (*pos)++; + if (gcov_iter_next(iter)) + return NULL; +- (*pos)++; + + return iter; + } +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 310656b4ede6..d6464045d3b9 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4745,8 +4745,8 @@ pte_t *huge_pte_offset(struct mm_struct *mm, + { + pgd_t *pgd; + p4d_t *p4d; +- pud_t *pud; +- pmd_t *pmd; ++ pud_t *pud, pud_entry; ++ pmd_t *pmd, pmd_entry; + + pgd = pgd_offset(mm, addr); + if (!pgd_present(*pgd)) +@@ -4756,17 +4756,19 @@ pte_t *huge_pte_offset(struct mm_struct *mm, + return NULL; + + pud = pud_offset(p4d, addr); +- if (sz != PUD_SIZE && pud_none(*pud)) ++ pud_entry = READ_ONCE(*pud); ++ if (sz != PUD_SIZE && pud_none(pud_entry)) + return NULL; + /* hugepage or swap? */ +- if (pud_huge(*pud) || !pud_present(*pud)) ++ if (pud_huge(pud_entry) || !pud_present(pud_entry)) + return (pte_t *)pud; + + pmd = pmd_offset(pud, addr); +- if (sz != PMD_SIZE && pmd_none(*pmd)) ++ pmd_entry = READ_ONCE(*pmd); ++ if (sz != PMD_SIZE && pmd_none(pmd_entry)) + return NULL; + /* hugepage or swap? */ +- if (pmd_huge(*pmd) || !pmd_present(*pmd)) ++ if (pmd_huge(pmd_entry) || !pmd_present(pmd_entry)) + return (pte_t *)pmd; + + return NULL; +diff --git a/mm/ksm.c b/mm/ksm.c +index 764486ffcd16..65d4bf52f543 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -2074,8 +2074,16 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item) + + down_read(&mm->mmap_sem); + vma = find_mergeable_vma(mm, rmap_item->address); +- err = try_to_merge_one_page(vma, page, +- ZERO_PAGE(rmap_item->address)); ++ if (vma) { ++ err = try_to_merge_one_page(vma, page, ++ ZERO_PAGE(rmap_item->address)); ++ } else { ++ /* ++ * If the vma is out of date, we do not need to ++ * continue. ++ */ ++ err = 0; ++ } + up_read(&mm->mmap_sem); + /* + * In case of failure, the page was not really empty, so we +diff --git a/mm/shmem.c b/mm/shmem.c +index 0b6db162083c..f9a1e0ba259f 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2330,11 +2330,11 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm, + + lru_cache_add_anon(page); + +- spin_lock(&info->lock); ++ spin_lock_irq(&info->lock); + info->alloced++; + inode->i_blocks += BLOCKS_PER_PAGE; + shmem_recalc_inode(inode); +- spin_unlock(&info->lock); ++ spin_unlock_irq(&info->lock); + + inc_mm_counter(dst_mm, mm_counter_file(page)); + page_add_file_rmap(page, false); +diff --git a/mm/slub.c b/mm/slub.c +index 3c1a16f03b2b..481518c3f61a 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -269,8 +269,7 @@ static inline void *get_freepointer(struct kmem_cache *s, void *object) + + static void prefetch_freepointer(const struct kmem_cache *s, void *object) + { +- if (object) +- prefetch(freelist_dereference(s, object + s->offset)); ++ prefetch(object + s->offset); + } + + static inline void *get_freepointer_safe(struct kmem_cache *s, void *object) +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 88091fd704f4..63bf3f207e16 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -31,6 +31,7 @@ + #include <linux/compiler.h> + #include <linux/llist.h> + #include <linux/bitops.h> ++#include <linux/overflow.h> + + #include <linux/uaccess.h> + #include <asm/tlbflush.h> +@@ -2246,6 +2247,7 @@ finished: + * @vma: vma to cover + * @uaddr: target user address to start at + * @kaddr: virtual address of vmalloc kernel memory ++ * @pgoff: offset from @kaddr to start at + * @size: size of map area + * + * Returns: 0 for success, -Exxx on failure +@@ -2258,9 +2260,15 @@ finished: + * Similar to remap_pfn_range() (see mm/memory.c) + */ + int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, +- void *kaddr, unsigned long size) ++ void *kaddr, unsigned long pgoff, ++ unsigned long size) + { + struct vm_struct *area; ++ unsigned long off; ++ unsigned long end_index; ++ ++ if (check_shl_overflow(pgoff, PAGE_SHIFT, &off)) ++ return -EINVAL; + + size = PAGE_ALIGN(size); + +@@ -2274,8 +2282,10 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, + if (!(area->flags & VM_USERMAP)) + return -EINVAL; + +- if (kaddr + size > area->addr + get_vm_area_size(area)) ++ if (check_add_overflow(size, off, &end_index) || ++ end_index > get_vm_area_size(area)) + return -EINVAL; ++ kaddr += off; + + do { + struct page *page = vmalloc_to_page(kaddr); +@@ -2314,7 +2324,7 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, + unsigned long pgoff) + { + return remap_vmalloc_range_partial(vma, vma->vm_start, +- addr + (pgoff << PAGE_SHIFT), ++ addr, pgoff, + vma->vm_end - vma->vm_start); + } + EXPORT_SYMBOL(remap_vmalloc_range); +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index b930ab5cf140..c1693d75e196 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -681,10 +681,8 @@ static int __init vti_init(void) + + msg = "ipip tunnel"; + err = xfrm4_tunnel_register(&ipip_handler, AF_INET); +- if (err < 0) { +- pr_info("%s: cant't register tunnel\n",__func__); ++ if (err < 0) + goto xfrm_tunnel_failed; +- } + + msg = "netlink interface"; + err = rtnl_link_register(&vti_link_ops); +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 53a11894f9e4..261a9813b88c 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -520,9 +520,11 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + goto out; + + /* hdrincl should be READ_ONCE(inet->hdrincl) +- * but READ_ONCE() doesn't work with bit fields ++ * but READ_ONCE() doesn't work with bit fields. ++ * Doing this indirectly yields the same result. + */ + hdrincl = inet->hdrincl; ++ hdrincl = READ_ONCE(hdrincl); + /* + * Check the flags. + */ +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 05fe1d007544..3c298ec32200 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -133,8 +133,6 @@ static int ip_rt_min_advmss __read_mostly = 256; + + static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; + +-static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; +- + /* + * Interface to generic destination cache. + */ +@@ -2869,6 +2867,7 @@ void ip_rt_multicast_event(struct in_device *in_dev) + static int ip_rt_gc_interval __read_mostly = 60 * HZ; + static int ip_rt_gc_min_interval __read_mostly = HZ / 2; + static int ip_rt_gc_elasticity __read_mostly = 8; ++static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; + + static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write, + void __user *buffer, +diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c +index 94b8702603bc..35dbc8eb9396 100644 +--- a/net/ipv4/xfrm4_output.c ++++ b/net/ipv4/xfrm4_output.c +@@ -76,9 +76,7 @@ int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb) + { + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + +-#ifdef CONFIG_NETFILTER + IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; +-#endif + + return xfrm_output(sk, skb); + } +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 8c492471b0da..337b43d4c3eb 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -185,15 +185,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + retv = -EBUSY; + break; + } +- } else if (sk->sk_protocol == IPPROTO_TCP) { +- if (sk->sk_prot != &tcpv6_prot) { +- retv = -EBUSY; +- break; +- } +- break; +- } else { ++ } ++ if (sk->sk_protocol == IPPROTO_TCP && ++ sk->sk_prot != &tcpv6_prot) { ++ retv = -EBUSY; + break; + } ++ if (sk->sk_protocol != IPPROTO_TCP) ++ break; + if (sk->sk_state != TCP_ESTABLISHED) { + retv = -ENOTCONN; + break; +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index 29dae7f2ff14..aff901be5353 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -130,9 +130,7 @@ int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb) + { + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + +-#ifdef CONFIG_NETFILTER + IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; +-#endif + + return xfrm_output(sk, skb); + } +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 0c59354e280e..d098bb8d53aa 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -199,6 +199,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic, + /* refcount initialized at 1 */ + spin_unlock_bh(&nr_node_list_lock); + ++ nr_neigh_put(nr_neigh); + return 0; + } + nr_node_lock(nr_node); +diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c +index 39231237e1c3..30f71620d4e3 100644 +--- a/net/x25/x25_dev.c ++++ b/net/x25/x25_dev.c +@@ -120,8 +120,10 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev, + goto drop; + } + +- if (!pskb_may_pull(skb, 1)) ++ if (!pskb_may_pull(skb, 1)) { ++ x25_neigh_put(nb); + return 0; ++ } + + switch (skb->data[0]) { + +diff --git a/security/keys/internal.h b/security/keys/internal.h +index e3a573840186..124273e500cf 100644 +--- a/security/keys/internal.h ++++ b/security/keys/internal.h +@@ -20,6 +20,8 @@ + #include <linux/keyctl.h> + #include <linux/refcount.h> + #include <linux/compat.h> ++#include <linux/mm.h> ++#include <linux/vmalloc.h> + + struct iovec; + +@@ -305,4 +307,14 @@ static inline void key_check(const struct key *key) + + #endif + ++/* ++ * Helper function to clear and free a kvmalloc'ed memory object. ++ */ ++static inline void __kvzfree(const void *addr, size_t len) ++{ ++ if (addr) { ++ memset((void *)addr, 0, len); ++ kvfree(addr); ++ } ++} + #endif /* _INTERNAL_H */ +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index 4b6a084e323b..c07c2e2b2478 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -330,7 +330,7 @@ long keyctl_update_key(key_serial_t id, + payload = NULL; + if (plen) { + ret = -ENOMEM; +- payload = kmalloc(plen, GFP_KERNEL); ++ payload = kvmalloc(plen, GFP_KERNEL); + if (!payload) + goto error; + +@@ -351,7 +351,7 @@ long keyctl_update_key(key_serial_t id, + + key_ref_put(key_ref); + error2: +- kzfree(payload); ++ __kvzfree(payload, plen); + error: + return ret; + } +@@ -772,7 +772,8 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) + struct key *key; + key_ref_t key_ref; + long ret; +- char *key_data; ++ char *key_data = NULL; ++ size_t key_data_len; + + /* find the key first */ + key_ref = lookup_user_key(keyid, 0, 0); +@@ -823,24 +824,51 @@ can_read_key: + * Allocating a temporary buffer to hold the keys before + * transferring them to user buffer to avoid potential + * deadlock involving page fault and mmap_sem. ++ * ++ * key_data_len = (buflen <= PAGE_SIZE) ++ * ? buflen : actual length of key data ++ * ++ * This prevents allocating arbitrary large buffer which can ++ * be much larger than the actual key length. In the latter case, ++ * at least 2 passes of this loop is required. + */ +- key_data = kmalloc(buflen, GFP_KERNEL); ++ key_data_len = (buflen <= PAGE_SIZE) ? buflen : 0; ++ for (;;) { ++ if (key_data_len) { ++ key_data = kvmalloc(key_data_len, GFP_KERNEL); ++ if (!key_data) { ++ ret = -ENOMEM; ++ goto key_put_out; ++ } ++ } + +- if (!key_data) { +- ret = -ENOMEM; +- goto key_put_out; +- } +- ret = __keyctl_read_key(key, key_data, buflen); ++ ret = __keyctl_read_key(key, key_data, key_data_len); ++ ++ /* ++ * Read methods will just return the required length without ++ * any copying if the provided length isn't large enough. ++ */ ++ if (ret <= 0 || ret > buflen) ++ break; ++ ++ /* ++ * The key may change (unlikely) in between 2 consecutive ++ * __keyctl_read_key() calls. In this case, we reallocate ++ * a larger buffer and redo the key read when ++ * key_data_len < ret <= buflen. ++ */ ++ if (ret > key_data_len) { ++ if (unlikely(key_data)) ++ __kvzfree(key_data, key_data_len); ++ key_data_len = ret; ++ continue; /* Allocate buffer */ ++ } + +- /* +- * Read methods will just return the required length without +- * any copying if the provided length isn't large enough. +- */ +- if (ret > 0 && ret <= buflen) { + if (copy_to_user(buffer, key_data, ret)) + ret = -EFAULT; ++ break; + } +- kzfree(key_data); ++ __kvzfree(key_data, key_data_len); + + key_put_out: + key_put(key); +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index d392c1ec0b28..46670da04707 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2173,7 +2173,6 @@ static const struct hdac_io_ops pci_hda_io_ops = { + * should be ignored from the beginning. + */ + static const struct snd_pci_quirk driver_blacklist[] = { +- SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0), + SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0), + SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0), + {} +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3fded87817c6..288ea05dfa3c 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -334,6 +334,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0233: + case 0x10ec0235: + case 0x10ec0236: ++ case 0x10ec0245: + case 0x10ec0255: + case 0x10ec0256: + case 0x10ec0257: +@@ -7264,6 +7265,7 @@ static int patch_alc269(struct hda_codec *codec) + spec->gen.mixer_nid = 0; + break; + case 0x10ec0215: ++ case 0x10ec0245: + case 0x10ec0285: + case 0x10ec0289: + spec->codec_variant = ALC269_TYPE_ALC215; +@@ -8344,6 +8346,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0234, "ALC234", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269), ++ HDA_CODEC_ENTRY(0x10ec0245, "ALC245", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269), +diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c +index 6044b3bbb121..999eb3ba7867 100644 +--- a/sound/soc/intel/atom/sst-atom-controls.c ++++ b/sound/soc/intel/atom/sst-atom-controls.c +@@ -974,7 +974,9 @@ static int sst_set_be_modules(struct snd_soc_dapm_widget *w, + dev_dbg(c->dev, "Enter: widget=%s\n", w->name); + + if (SND_SOC_DAPM_EVENT_ON(event)) { ++ mutex_lock(&drv->lock); + ret = sst_send_slot_map(drv); ++ mutex_unlock(&drv->lock); + if (ret) + return ret; + ret = sst_send_pipe_module_params(w, k); +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 7861cf7a4488..c42ee8ef544d 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -413,7 +413,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget, + + memset(&template, 0, sizeof(template)); + template.reg = e->reg; +- template.mask = e->mask << e->shift_l; ++ template.mask = e->mask; + template.shift = e->shift_l; + template.off_val = snd_soc_enum_item_to_val(e, 0); + template.on_val = template.off_val; +@@ -539,8 +539,22 @@ static bool dapm_kcontrol_set_value(const struct snd_kcontrol *kcontrol, + if (data->value == value) + return false; + +- if (data->widget) +- data->widget->on_val = value; ++ if (data->widget) { ++ switch (dapm_kcontrol_get_wlist(kcontrol)->widgets[0]->id) { ++ case snd_soc_dapm_switch: ++ case snd_soc_dapm_mixer: ++ case snd_soc_dapm_mixer_named_ctl: ++ data->widget->on_val = value & data->widget->mask; ++ break; ++ case snd_soc_dapm_demux: ++ case snd_soc_dapm_mux: ++ data->widget->on_val = value >> data->widget->shift; ++ break; ++ default: ++ data->widget->on_val = value; ++ break; ++ } ++ } + + data->value = value; + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index 2c44386e5569..eeb56d6fe8aa 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -220,6 +220,52 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof + return 0; + } + ++/* ++ * Many Focusrite devices supports a limited set of sampling rates per ++ * altsetting. Maximum rate is exposed in the last 4 bytes of Format Type ++ * descriptor which has a non-standard bLength = 10. ++ */ ++static bool focusrite_valid_sample_rate(struct snd_usb_audio *chip, ++ struct audioformat *fp, ++ unsigned int rate) ++{ ++ struct usb_interface *iface; ++ struct usb_host_interface *alts; ++ unsigned char *fmt; ++ unsigned int max_rate; ++ ++ iface = usb_ifnum_to_if(chip->dev, fp->iface); ++ if (!iface) ++ return true; ++ ++ alts = &iface->altsetting[fp->altset_idx]; ++ fmt = snd_usb_find_csint_desc(alts->extra, alts->extralen, ++ NULL, UAC_FORMAT_TYPE); ++ if (!fmt) ++ return true; ++ ++ if (fmt[0] == 10) { /* bLength */ ++ max_rate = combine_quad(&fmt[6]); ++ ++ /* Validate max rate */ ++ if (max_rate != 48000 && ++ max_rate != 96000 && ++ max_rate != 192000 && ++ max_rate != 384000) { ++ ++ usb_audio_info(chip, ++ "%u:%d : unexpected max rate: %u\n", ++ fp->iface, fp->altsetting, max_rate); ++ ++ return true; ++ } ++ ++ return rate <= max_rate; ++ } ++ ++ return true; ++} ++ + /* + * Helper function to walk the array of sample rate triplets reported by + * the device. The problem is that we need to parse whole array first to +@@ -256,6 +302,11 @@ static int parse_uac2_sample_rate_range(struct snd_usb_audio *chip, + } + + for (rate = min; rate <= max; rate += res) { ++ /* Filter out invalid rates on Focusrite devices */ ++ if (USB_ID_VENDOR(chip->usb_id) == 0x1235 && ++ !focusrite_valid_sample_rate(chip, fp, rate)) ++ goto skip_rate; ++ + if (fp->rate_table) + fp->rate_table[nr_rates] = rate; + if (!fp->rate_min || rate < fp->rate_min) +@@ -270,6 +321,7 @@ static int parse_uac2_sample_rate_range(struct snd_usb_audio *chip, + break; + } + ++skip_rate: + /* avoid endless loop */ + if (res == 0) + break; +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index b54f7dab8372..b9ea4a42aee4 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -1520,11 +1520,15 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, + + /* use known values for that card: interface#1 altsetting#1 */ + iface = usb_ifnum_to_if(chip->dev, 1); +- if (!iface || iface->num_altsetting < 2) +- return -EINVAL; ++ if (!iface || iface->num_altsetting < 2) { ++ err = -EINVAL; ++ goto end; ++ } + alts = &iface->altsetting[1]; +- if (get_iface_desc(alts)->bNumEndpoints < 1) +- return -EINVAL; ++ if (get_iface_desc(alts)->bNumEndpoints < 1) { ++ err = -EINVAL; ++ goto end; ++ } + ep = get_endpoint(alts, 0)->bEndpointAddress; + + err = snd_usb_ctl_msg(chip->dev, +diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c +index f93b355756e6..2dfc0abf2e37 100644 +--- a/sound/usb/usx2y/usbusx2yaudio.c ++++ b/sound/usb/usx2y/usbusx2yaudio.c +@@ -689,6 +689,8 @@ static int usX2Y_rate_set(struct usX2Ydev *usX2Y, int rate) + us->submitted = 2*NOOF_SETRATE_URBS; + for (i = 0; i < NOOF_SETRATE_URBS; ++i) { + struct urb *urb = us->urb[i]; ++ if (!urb) ++ continue; + if (urb->status) { + if (!err) + err = -ENODEV; +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index ccd5319d1284..04fc04b4ab67 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2062,14 +2062,27 @@ static bool ignore_unreachable_insn(struct instruction *insn) + !strcmp(insn->sec->name, ".altinstr_aux")) + return true; + ++ if (!insn->func) ++ return false; ++ ++ /* ++ * CONFIG_UBSAN_TRAP inserts a UD2 when it sees ++ * __builtin_unreachable(). The BUG() macro has an unreachable() after ++ * the UD2, which causes GCC's undefined trap logic to emit another UD2 ++ * (or occasionally a JMP to UD2). ++ */ ++ if (list_prev_entry(insn, list)->dead_end && ++ (insn->type == INSN_BUG || ++ (insn->type == INSN_JUMP_UNCONDITIONAL && ++ insn->jump_dest && insn->jump_dest->type == INSN_BUG))) ++ return true; ++ + /* + * Check if this (or a subsequent) instruction is related to + * CONFIG_UBSAN or CONFIG_KASAN. + * + * End the search at 5 instructions to avoid going into the weeds. + */ +- if (!insn->func) +- return false; + for (i = 0; i < 5; i++) { + + if (is_kasan_insn(insn) || is_ubsan_insn(insn)) +diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c +index c3343820916a..7cbbbdd932f1 100644 +--- a/tools/objtool/orc_dump.c ++++ b/tools/objtool/orc_dump.c +@@ -78,7 +78,7 @@ int orc_dump(const char *_objname) + char *name; + size_t nr_sections; + Elf64_Addr orc_ip_addr = 0; +- size_t shstrtab_idx; ++ size_t shstrtab_idx, strtab_idx = 0; + Elf *elf; + Elf_Scn *scn; + GElf_Shdr sh; +@@ -139,6 +139,8 @@ int orc_dump(const char *_objname) + + if (!strcmp(name, ".symtab")) { + symtab = data; ++ } else if (!strcmp(name, ".strtab")) { ++ strtab_idx = i; + } else if (!strcmp(name, ".orc_unwind")) { + orc = data->d_buf; + orc_size = sh.sh_size; +@@ -150,7 +152,7 @@ int orc_dump(const char *_objname) + } + } + +- if (!symtab || !orc || !orc_ip) ++ if (!symtab || !strtab_idx || !orc || !orc_ip) + return 0; + + if (orc_size % sizeof(*orc) != 0) { +@@ -171,21 +173,29 @@ int orc_dump(const char *_objname) + return -1; + } + +- scn = elf_getscn(elf, sym.st_shndx); +- if (!scn) { +- WARN_ELF("elf_getscn"); +- return -1; +- } +- +- if (!gelf_getshdr(scn, &sh)) { +- WARN_ELF("gelf_getshdr"); +- return -1; +- } +- +- name = elf_strptr(elf, shstrtab_idx, sh.sh_name); +- if (!name || !*name) { +- WARN_ELF("elf_strptr"); +- return -1; ++ if (GELF_ST_TYPE(sym.st_info) == STT_SECTION) { ++ scn = elf_getscn(elf, sym.st_shndx); ++ if (!scn) { ++ WARN_ELF("elf_getscn"); ++ return -1; ++ } ++ ++ if (!gelf_getshdr(scn, &sh)) { ++ WARN_ELF("gelf_getshdr"); ++ return -1; ++ } ++ ++ name = elf_strptr(elf, shstrtab_idx, sh.sh_name); ++ if (!name) { ++ WARN_ELF("elf_strptr"); ++ return -1; ++ } ++ } else { ++ name = elf_strptr(elf, strtab_idx, sym.st_name); ++ if (!name) { ++ WARN_ELF("elf_strptr"); ++ return -1; ++ } + } + + printf("%s+%llx:", name, (unsigned long long)rela.r_addend); +diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh +index 7956ea3be667..eed5d5b81226 100755 +--- a/tools/testing/selftests/kmod/kmod.sh ++++ b/tools/testing/selftests/kmod/kmod.sh +@@ -502,18 +502,23 @@ function test_num() + fi + } + +-function get_test_count() ++function get_test_data() + { + test_num $1 +- TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}') ++ local field_num=$(echo $1 | sed 's/^0*//') ++ echo $ALL_TESTS | awk '{print $'$field_num'}' ++} ++ ++function get_test_count() ++{ ++ TEST_DATA=$(get_test_data $1) + LAST_TWO=${TEST_DATA#*:*} + echo ${LAST_TWO%:*} + } + + function get_test_enabled() + { +- test_num $1 +- TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}') ++ TEST_DATA=$(get_test_data $1) + echo ${TEST_DATA#*:*:} + } + +diff --git a/tools/vm/Makefile b/tools/vm/Makefile +index 20f6cf04377f..9860622cbb15 100644 +--- a/tools/vm/Makefile ++++ b/tools/vm/Makefile +@@ -1,6 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for vm tools + # ++include ../scripts/Makefile.include ++ + TARGETS=page-types slabinfo page_owner_sort + + LIB_DIR = ../lib/api |