commit: 2e76d12605325175166610a828dae3a9daa06f89 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Mar 18 14:35:30 2017 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Mar 18 14:35:30 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2e76d126
Linux patch 4.10.4 0000_README | 4 + 1003_linux-4.10.4.patch | 1805 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1809 insertions(+) diff --git a/0000_README b/0000_README index 471175a..a80feb8 100644 --- a/0000_README +++ b/0000_README @@ -55,6 +55,10 @@ Patch: 1002_linux-4.10.3.patch From: http://www.kernel.org Desc: Linux 4.10.3 +Patch: 1003_linux-4.10.4.patch +From: http://www.kernel.org +Desc: Linux 4.10.4 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1003_linux-4.10.4.patch b/1003_linux-4.10.4.patch new file mode 100644 index 0000000..ed8a7ee --- /dev/null +++ b/1003_linux-4.10.4.patch @@ -0,0 +1,1805 @@ +diff --git a/Makefile b/Makefile +index 190a684303c1..8df819e31882 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 10 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = Fearless Coyote + +diff --git a/arch/arm/configs/qcom_defconfig b/arch/arm/configs/qcom_defconfig +index 8c3a0108a231..c73299b51f7b 100644 +--- a/arch/arm/configs/qcom_defconfig ++++ b/arch/arm/configs/qcom_defconfig +@@ -157,6 +157,8 @@ CONFIG_DMADEVICES=y + CONFIG_QCOM_BAM_DMA=y + CONFIG_STAGING=y + CONFIG_COMMON_CLK_QCOM=y ++CONFIG_QCOM_CLK_RPM=y ++CONFIG_QCOM_CLK_SMD_RPM=y + CONFIG_APQ_MMCC_8084=y + CONFIG_IPQ_LCC_806X=y + CONFIG_MSM_GCC_8660=y +diff --git a/arch/mips/configs/ip22_defconfig b/arch/mips/configs/ip22_defconfig +index 5d83ff755547..ec8e9684296d 100644 +--- a/arch/mips/configs/ip22_defconfig ++++ b/arch/mips/configs/ip22_defconfig +@@ -67,8 +67,8 @@ CONFIG_NETFILTER_NETLINK_QUEUE=m + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_DCCP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_DCCP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig +index 2b74aee320a1..e582069b44fd 100644 +--- a/arch/mips/configs/ip27_defconfig ++++ b/arch/mips/configs/ip27_defconfig +@@ -133,7 +133,7 @@ CONFIG_LIBFC=m + CONFIG_SCSI_QLOGIC_1280=y + CONFIG_SCSI_PMCRAID=m + CONFIG_SCSI_BFA_FC=m +-CONFIG_SCSI_DH=m ++CONFIG_SCSI_DH=y + CONFIG_SCSI_DH_RDAC=m + CONFIG_SCSI_DH_HP_SW=m + CONFIG_SCSI_DH_EMC=m +@@ -205,7 +205,6 @@ CONFIG_MLX4_EN=m + # CONFIG_MLX4_DEBUG is not set + CONFIG_TEHUTI=m + CONFIG_BNX2X=m +-CONFIG_QLGE=m + CONFIG_SFC=m + CONFIG_BE2NET=m + CONFIG_LIBERTAS_THINFIRM=m +diff --git a/arch/mips/configs/lemote2f_defconfig b/arch/mips/configs/lemote2f_defconfig +index 5da76e0e120f..0cdb431bff80 100644 +--- a/arch/mips/configs/lemote2f_defconfig ++++ b/arch/mips/configs/lemote2f_defconfig +@@ -39,7 +39,7 @@ CONFIG_HIBERNATION=y + CONFIG_PM_STD_PARTITION="/dev/hda3" + CONFIG_CPU_FREQ=y + CONFIG_CPU_FREQ_DEBUG=y +-CONFIG_CPU_FREQ_STAT=m ++CONFIG_CPU_FREQ_STAT=y + CONFIG_CPU_FREQ_STAT_DETAILS=y + CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y + CONFIG_CPU_FREQ_GOV_POWERSAVE=m +diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig +index 58d43f3c348d..078ecac071ab 100644 +--- a/arch/mips/configs/malta_defconfig ++++ b/arch/mips/configs/malta_defconfig +@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_DCCP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_DCCP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/malta_kvm_defconfig b/arch/mips/configs/malta_kvm_defconfig +index c8f7e2835840..e233f878afef 100644 +--- a/arch/mips/configs/malta_kvm_defconfig ++++ b/arch/mips/configs/malta_kvm_defconfig +@@ -60,8 +60,8 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_DCCP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_DCCP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/malta_kvm_guest_defconfig b/arch/mips/configs/malta_kvm_guest_defconfig +index d2f54e55356c..fbe085c328ab 100644 +--- a/arch/mips/configs/malta_kvm_guest_defconfig ++++ b/arch/mips/configs/malta_kvm_guest_defconfig +@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_DCCP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_DCCP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/maltaup_xpa_defconfig b/arch/mips/configs/maltaup_xpa_defconfig +index 3d0d9cb9673f..2942610e4082 100644 +--- a/arch/mips/configs/maltaup_xpa_defconfig ++++ b/arch/mips/configs/maltaup_xpa_defconfig +@@ -61,8 +61,8 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_DCCP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_DCCP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig +index b496c25fced6..07d01827a973 100644 +--- a/arch/mips/configs/nlm_xlp_defconfig ++++ b/arch/mips/configs/nlm_xlp_defconfig +@@ -110,7 +110,7 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig +index 8e99ad807a57..f59969acb724 100644 +--- a/arch/mips/configs/nlm_xlr_defconfig ++++ b/arch/mips/configs/nlm_xlr_defconfig +@@ -90,7 +90,7 @@ CONFIG_NETFILTER=y + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_SECMARK=y + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +diff --git a/arch/mips/include/asm/mach-ip27/spaces.h b/arch/mips/include/asm/mach-ip27/spaces.h +index 4775a1136a5b..24d5e31bcfa6 100644 +--- a/arch/mips/include/asm/mach-ip27/spaces.h ++++ b/arch/mips/include/asm/mach-ip27/spaces.h +@@ -12,14 +12,16 @@ + + /* + * IP27 uses the R10000's uncached attribute feature. Attribute 3 selects +- * uncached memory addressing. ++ * uncached memory addressing. Hide the definitions on 32-bit compilation ++ * of the compat-vdso code. + */ +- ++#ifdef CONFIG_64BIT + #define HSPEC_BASE 0x9000000000000000 + #define IO_BASE 0x9200000000000000 + #define MSPEC_BASE 0x9400000000000000 + #define UNCAC_BASE 0x9600000000000000 + #define CAC_BASE 0xa800000000000000 ++#endif + + #define TO_MSPEC(x) (MSPEC_BASE | ((x) & TO_PHYS_MASK)) + #define TO_HSPEC(x) (HSPEC_BASE | ((x) & TO_PHYS_MASK)) +diff --git a/arch/mips/ralink/prom.c b/arch/mips/ralink/prom.c +index 5a73c5e14221..23198c9050e5 100644 +--- a/arch/mips/ralink/prom.c ++++ b/arch/mips/ralink/prom.c +@@ -30,8 +30,10 @@ const char *get_system_type(void) + return soc_info.sys_type; + } + +-static __init void prom_init_cmdline(int argc, char **argv) ++static __init void prom_init_cmdline(void) + { ++ int argc; ++ char **argv; + int i; + + pr_debug("prom: fw_arg0=%08x fw_arg1=%08x fw_arg2=%08x fw_arg3=%08x\n", +@@ -60,14 +62,11 @@ static __init void prom_init_cmdline(int argc, char **argv) + + void __init prom_init(void) + { +- int argc; +- char **argv; +- + prom_soc_init(&soc_info); + + pr_info("SoC Type: %s\n", get_system_type()); + +- prom_init_cmdline(argc, argv); ++ prom_init_cmdline(); + } + + void __init prom_free_prom_memory(void) +diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c +index 285796e6d75c..2b76e3643869 100644 +--- a/arch/mips/ralink/rt288x.c ++++ b/arch/mips/ralink/rt288x.c +@@ -40,16 +40,6 @@ static struct rt2880_pmx_group rt2880_pinmux_data_act[] = { + { 0 } + }; + +-static void rt288x_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on pin SRAM_CS_N */ +- t = rt_sysc_r32(SYSC_REG_CLKCFG); +- t |= CLKCFG_SRAM_CS_N_WDT; +- rt_sysc_w32(t, SYSC_REG_CLKCFG); +-} +- + void __init ralink_clk_init(void) + { + unsigned long cpu_rate, wmac_rate = 40000000; +diff --git a/arch/mips/ralink/rt305x.c b/arch/mips/ralink/rt305x.c +index c8a28c4bf29e..e778e0b54ffb 100644 +--- a/arch/mips/ralink/rt305x.c ++++ b/arch/mips/ralink/rt305x.c +@@ -89,17 +89,6 @@ static struct rt2880_pmx_group rt5350_pinmux_data[] = { + { 0 } + }; + +-static void rt305x_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on pin SRAM_CS_N */ +- t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG); +- t |= RT305X_SYSCFG_SRAM_CS0_MODE_WDT << +- RT305X_SYSCFG_SRAM_CS0_MODE_SHIFT; +- rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG); +-} +- + static unsigned long rt5350_get_mem_size(void) + { + void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE); +diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c +index 4cef9162bd9b..3e0aa09c6b55 100644 +--- a/arch/mips/ralink/rt3883.c ++++ b/arch/mips/ralink/rt3883.c +@@ -63,16 +63,6 @@ static struct rt2880_pmx_group rt3883_pinmux_data[] = { + { 0 } + }; + +-static void rt3883_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on GPIO 2 */ +- t = rt_sysc_r32(RT3883_SYSC_REG_SYSCFG1); +- t |= RT3883_SYSCFG1_GPIO2_AS_WDT_OUT; +- rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1); +-} +- + void __init ralink_clk_init(void) + { + unsigned long cpu_rate, sys_rate; +diff --git a/arch/mips/ralink/timer.c b/arch/mips/ralink/timer.c +index 8077ff39bdea..d4469b20d176 100644 +--- a/arch/mips/ralink/timer.c ++++ b/arch/mips/ralink/timer.c +@@ -71,11 +71,6 @@ static int rt_timer_request(struct rt_timer *rt) + return err; + } + +-static void rt_timer_free(struct rt_timer *rt) +-{ +- free_irq(rt->irq, rt); +-} +- + static int rt_timer_config(struct rt_timer *rt, unsigned long divisor) + { + if (rt->timer_freq < divisor) +@@ -101,15 +96,6 @@ static int rt_timer_enable(struct rt_timer *rt) + return 0; + } + +-static void rt_timer_disable(struct rt_timer *rt) +-{ +- u32 t; +- +- t = rt_timer_r32(rt, TIMER_REG_TMR0CTL); +- t &= ~TMR0CTL_ENABLE; +- rt_timer_w32(rt, TIMER_REG_TMR0CTL, t); +-} +- + static int rt_timer_probe(struct platform_device *pdev) + { + struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform +index b7a4b7e04c38..e8f6b3a42a48 100644 +--- a/arch/mips/sgi-ip22/Platform ++++ b/arch/mips/sgi-ip22/Platform +@@ -25,7 +25,7 @@ endif + # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys + # + ifdef CONFIG_SGI_IP28 +- ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n) ++ ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n) + $(error gcc doesn't support needed option -mr10k-cache-barrier=store) + endif + endif +diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h +index 0cd8a3852763..e5805ad78e12 100644 +--- a/arch/powerpc/include/asm/nohash/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/pgtable.h +@@ -230,7 +230,7 @@ static inline int hugepd_ok(hugepd_t hpd) + return ((hpd_val(hpd) & 0x4) != 0); + #else + /* We clear the top bit to indicate hugepd */ +- return ((hpd_val(hpd) & PD_HUGE) == 0); ++ return (hpd_val(hpd) && (hpd_val(hpd) & PD_HUGE) == 0); + #endif + } + +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index 06c7e9b88408..e14a2fbcf38d 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -1799,8 +1799,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto instr_done; + + case LARX: +- if (regs->msr & MSR_LE) +- return 0; + if (op.ea & (size - 1)) + break; /* can't handle misaligned */ + err = -EFAULT; +@@ -1824,8 +1822,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case STCX: +- if (regs->msr & MSR_LE) +- return 0; + if (op.ea & (size - 1)) + break; /* can't handle misaligned */ + err = -EFAULT; +@@ -1851,8 +1847,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case LOAD: +- if (regs->msr & MSR_LE) +- return 0; + err = read_mem(®s->gpr[op.reg], op.ea, size, regs); + if (!err) { + if (op.type & SIGNEXT) +@@ -1864,8 +1858,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + + #ifdef CONFIG_PPC_FPU + case LOAD_FP: +- if (regs->msr & MSR_LE) +- return 0; + if (size == 4) + err = do_fp_load(op.reg, do_lfs, op.ea, size, regs); + else +@@ -1874,15 +1866,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + #endif + #ifdef CONFIG_ALTIVEC + case LOAD_VMX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs); + goto ldst_done; + #endif + #ifdef CONFIG_VSX + case LOAD_VSX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs); + goto ldst_done; + #endif +@@ -1905,8 +1893,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto instr_done; + + case STORE: +- if (regs->msr & MSR_LE) +- return 0; + if ((op.type & UPDATE) && size == sizeof(long) && + op.reg == 1 && op.update_reg == 1 && + !(regs->msr & MSR_PR) && +@@ -1919,8 +1905,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + + #ifdef CONFIG_PPC_FPU + case STORE_FP: +- if (regs->msr & MSR_LE) +- return 0; + if (size == 4) + err = do_fp_store(op.reg, do_stfs, op.ea, size, regs); + else +@@ -1929,15 +1913,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + #endif + #ifdef CONFIG_ALTIVEC + case STORE_VMX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs); + goto ldst_done; + #endif + #ifdef CONFIG_VSX + case STORE_VSX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs); + goto ldst_done; + #endif +diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c +index f9670eabfcfa..b53f80f0b4d8 100644 +--- a/arch/powerpc/sysdev/xics/icp-opal.c ++++ b/arch/powerpc/sysdev/xics/icp-opal.c +@@ -91,6 +91,16 @@ static unsigned int icp_opal_get_irq(void) + + static void icp_opal_set_cpu_priority(unsigned char cppr) + { ++ /* ++ * Here be dragons. The caller has asked to allow only IPI's and not ++ * external interrupts. But OPAL XIVE doesn't support that. So instead ++ * of allowing no interrupts allow all. That's still not right, but ++ * currently the only caller who does this is xics_migrate_irqs_away() ++ * and it works in that case. ++ */ ++ if (cppr >= DEFAULT_PRIORITY) ++ cppr = LOWEST_PRIORITY; ++ + xics_set_base_cppr(cppr); + opal_int_set_cppr(cppr); + iosync(); +diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c +index 69d858e51ac7..23efe4e42172 100644 +--- a/arch/powerpc/sysdev/xics/xics-common.c ++++ b/arch/powerpc/sysdev/xics/xics-common.c +@@ -20,6 +20,7 @@ + #include <linux/of.h> + #include <linux/slab.h> + #include <linux/spinlock.h> ++#include <linux/delay.h> + + #include <asm/prom.h> + #include <asm/io.h> +@@ -198,9 +199,6 @@ void xics_migrate_irqs_away(void) + /* Remove ourselves from the global interrupt queue */ + xics_set_cpu_giq(xics_default_distrib_server, 0); + +- /* Allow IPIs again... */ +- icp_ops->set_priority(DEFAULT_PRIORITY); +- + for_each_irq_desc(virq, desc) { + struct irq_chip *chip; + long server; +@@ -255,6 +253,19 @@ void xics_migrate_irqs_away(void) + unlock: + raw_spin_unlock_irqrestore(&desc->lock, flags); + } ++ ++ /* Allow "sufficient" time to drop any inflight IRQ's */ ++ mdelay(5); ++ ++ /* ++ * Allow IPIs again. This is done at the very end, after migrating all ++ * interrupts, the expectation is that we'll only get woken up by an IPI ++ * interrupt beyond this point, but leave externals masked just to be ++ * safe. If we're using icp-opal this may actually allow all ++ * interrupts anyway, but that should be OK. ++ */ ++ icp_ops->set_priority(DEFAULT_PRIORITY); ++ + } + #endif /* CONFIG_HOTPLUG_CPU */ + +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index d56ef26d4681..7678f7956409 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -606,12 +606,29 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr) + { + spinlock_t *ptl; ++ pgd_t *pgd; ++ pud_t *pud; ++ pmd_t *pmd; + pgste_t pgste; + pte_t *ptep; + pte_t pte; + bool dirty; + +- ptep = get_locked_pte(mm, addr, &ptl); ++ pgd = pgd_offset(mm, addr); ++ pud = pud_alloc(mm, pgd, addr); ++ if (!pud) ++ return false; ++ pmd = pmd_alloc(mm, pud, addr); ++ if (!pmd) ++ return false; ++ /* We can't run guests backed by huge pages, but userspace can ++ * still set them up and then try to migrate them without any ++ * migration support. ++ */ ++ if (pmd_large(*pmd)) ++ return true; ++ ++ ptep = pte_alloc_map_lock(mm, pmd, addr, &ptl); + if (unlikely(!ptep)) + return false; + +diff --git a/crypto/Makefile b/crypto/Makefile +index b8f0e3eb0791..aa10a4db41de 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -75,6 +75,7 @@ obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o + obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o + obj-$(CONFIG_CRYPTO_SHA3) += sha3_generic.o + obj-$(CONFIG_CRYPTO_WP512) += wp512.o ++CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o + obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o + obj-$(CONFIG_CRYPTO_ECB) += ecb.o +@@ -98,6 +99,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH_COMMON) += blowfish_common.o + obj-$(CONFIG_CRYPTO_TWOFISH) += twofish_generic.o + obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o + obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o ++CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_AES) += aes_generic.o + obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o + obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 349dc3e1e52e..974c5a31a005 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -65,6 +65,7 @@ static bool __init efi_virtmap_init(void) + bool systab_found; + + efi_mm.pgd = pgd_alloc(&efi_mm); ++ mm_init_cpumask(&efi_mm); + init_new_context(NULL, &efi_mm); + + systab_found = false; +diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c +index ab2ea157da4c..e9d9e8aa180d 100644 +--- a/drivers/gpu/drm/i915/gvt/handlers.c ++++ b/drivers/gpu/drm/i915/gvt/handlers.c +@@ -1039,7 +1039,7 @@ static int send_display_ready_uevent(struct intel_vgpu *vgpu, int ready) + char vmid_str[20]; + char display_ready_str[20]; + +- snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d\n", ready); ++ snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d", ready); + env[0] = display_ready_str; + + snprintf(vmid_str, 20, "VMID=%d", vgpu->id); +diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c +index c3436f627028..cd07a69e2e93 100644 +--- a/drivers/i2c/busses/i2c-bcm2835.c ++++ b/drivers/i2c/busses/i2c-bcm2835.c +@@ -195,7 +195,9 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data) + } + + if (val & BCM2835_I2C_S_DONE) { +- if (i2c_dev->curr_msg->flags & I2C_M_RD) { ++ if (!i2c_dev->curr_msg) { ++ dev_err(i2c_dev->dev, "Got unexpected interrupt (from firmware?)\n"); ++ } else if (i2c_dev->curr_msg->flags & I2C_M_RD) { + bcm2835_drain_rxfifo(i2c_dev); + val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S); + } +diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c +index 83768e85a919..2178266bca79 100644 +--- a/drivers/i2c/i2c-mux.c ++++ b/drivers/i2c/i2c-mux.c +@@ -429,6 +429,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc) + while (muxc->num_adapters) { + struct i2c_adapter *adap = muxc->adapter[--muxc->num_adapters]; + struct i2c_mux_priv *priv = adap->algo_data; ++ struct device_node *np = adap->dev.of_node; + + muxc->adapter[muxc->num_adapters] = NULL; + +@@ -438,6 +439,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc) + + sysfs_remove_link(&priv->adap.dev.kobj, "mux_device"); + i2c_del_adapter(adap); ++ of_node_put(np); + kfree(priv); + } + } +diff --git a/drivers/iio/counter/104-quad-8.c b/drivers/iio/counter/104-quad-8.c +index a5913e97945e..f9b8fc9ae13f 100644 +--- a/drivers/iio/counter/104-quad-8.c ++++ b/drivers/iio/counter/104-quad-8.c +@@ -76,7 +76,7 @@ static int quad8_read_raw(struct iio_dev *indio_dev, + return IIO_VAL_INT; + } + +- flags = inb(base_offset); ++ flags = inb(base_offset + 1); + borrow = flags & BIT(0); + carry = !!(flags & BIT(1)); + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index d566f6738833..1664a7ccada7 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3233,9 +3233,11 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) + if (err) + goto err_rsrc; + +- err = mlx5_ib_alloc_q_counters(dev); +- if (err) +- goto err_odp; ++ if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt)) { ++ err = mlx5_ib_alloc_q_counters(dev); ++ if (err) ++ goto err_odp; ++ } + + err = ib_register_device(&dev->ib_dev, NULL); + if (err) +@@ -3263,7 +3265,8 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) + ib_unregister_device(&dev->ib_dev); + + err_q_cnt: +- mlx5_ib_dealloc_q_counters(dev); ++ if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt)) ++ mlx5_ib_dealloc_q_counters(dev); + + err_odp: + mlx5_ib_odp_remove_one(dev); +@@ -3293,7 +3296,8 @@ static void mlx5_ib_remove(struct mlx5_core_dev *mdev, void *context) + + mlx5_remove_netdev_notifier(dev); + ib_unregister_device(&dev->ib_dev); +- mlx5_ib_dealloc_q_counters(dev); ++ if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt)) ++ mlx5_ib_dealloc_q_counters(dev); + destroy_umrc_res(dev); + mlx5_ib_odp_remove_one(dev); + destroy_dev_resources(&dev->devr); +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 3086da5664f3..0ff5469c03d2 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -972,10 +972,61 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors) + } + EXPORT_SYMBOL_GPL(dm_accept_partial_bio); + ++/* ++ * Flush current->bio_list when the target map method blocks. ++ * This fixes deadlocks in snapshot and possibly in other targets. ++ */ ++struct dm_offload { ++ struct blk_plug plug; ++ struct blk_plug_cb cb; ++}; ++ ++static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule) ++{ ++ struct dm_offload *o = container_of(cb, struct dm_offload, cb); ++ struct bio_list list; ++ struct bio *bio; ++ ++ INIT_LIST_HEAD(&o->cb.list); ++ ++ if (unlikely(!current->bio_list)) ++ return; ++ ++ list = *current->bio_list; ++ bio_list_init(current->bio_list); ++ ++ while ((bio = bio_list_pop(&list))) { ++ struct bio_set *bs = bio->bi_pool; ++ if (unlikely(!bs) || bs == fs_bio_set) { ++ bio_list_add(current->bio_list, bio); ++ continue; ++ } ++ ++ spin_lock(&bs->rescue_lock); ++ bio_list_add(&bs->rescue_list, bio); ++ queue_work(bs->rescue_workqueue, &bs->rescue_work); ++ spin_unlock(&bs->rescue_lock); ++ } ++} ++ ++static void dm_offload_start(struct dm_offload *o) ++{ ++ blk_start_plug(&o->plug); ++ o->cb.callback = flush_current_bio_list; ++ list_add(&o->cb.list, ¤t->plug->cb_list); ++} ++ ++static void dm_offload_end(struct dm_offload *o) ++{ ++ list_del(&o->cb.list); ++ blk_finish_plug(&o->plug); ++} ++ + static void __map_bio(struct dm_target_io *tio) + { + int r; + sector_t sector; ++ struct dm_offload o; + struct bio *clone = &tio->clone; + struct dm_target *ti = tio->ti; + +@@ -988,7 +1039,11 @@ static void __map_bio(struct dm_target_io *tio) + */ + atomic_inc(&tio->io->io_count); + sector = clone->bi_iter.bi_sector; ++ ++ dm_offload_start(&o); + r = ti->type->map(ti, clone); ++ dm_offload_end(&o); ++ + if (r == DM_MAPIO_REMAPPED) { + /* the bio has been remapped so dispatch it */ + +diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c +index dedaf38c5ff6..9a397da137b1 100644 +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1441,6 +1441,7 @@ int rc_register_device(struct rc_dev *dev) + int attr = 0; + int minor; + int rc; ++ u64 rc_type; + + if (!dev || !dev->map_name) + return -EINVAL; +@@ -1526,14 +1527,18 @@ int rc_register_device(struct rc_dev *dev) + goto out_input; + } + ++ rc_type = BIT_ULL(rc_map->rc_type); ++ + if (dev->change_protocol) { +- u64 rc_type = (1ll << rc_map->rc_type); + rc = dev->change_protocol(dev, &rc_type); + if (rc < 0) + goto out_raw; + dev->enabled_protocols = rc_type; + } + ++ if (dev->driver_type == RC_DRIVER_IR_RAW) ++ ir_raw_load_modules(&rc_type); ++ + /* Allow the RC sysfs nodes to be accessible */ + atomic_set(&dev->initialized, 1); + +diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c +index 436bd58b5f05..62f8d10b39e8 100644 +--- a/drivers/media/rc/serial_ir.c ++++ b/drivers/media/rc/serial_ir.c +@@ -471,10 +471,65 @@ static int hardware_init_port(void) + return 0; + } + ++/* Needed by serial_ir_probe() */ ++static int serial_ir_tx(struct rc_dev *dev, unsigned int *txbuf, ++ unsigned int count); ++static int serial_ir_tx_duty_cycle(struct rc_dev *dev, u32 cycle); ++static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier); ++static int serial_ir_open(struct rc_dev *rcdev); ++static void serial_ir_close(struct rc_dev *rcdev); ++ + static int serial_ir_probe(struct platform_device *dev) + { ++ struct rc_dev *rcdev; + int i, nlow, nhigh, result; + ++ rcdev = devm_rc_allocate_device(&dev->dev); ++ if (!rcdev) ++ return -ENOMEM; ++ ++ if (hardware[type].send_pulse && hardware[type].send_space) ++ rcdev->tx_ir = serial_ir_tx; ++ if (hardware[type].set_send_carrier) ++ rcdev->s_tx_carrier = serial_ir_tx_carrier; ++ if (hardware[type].set_duty_cycle) ++ rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle; ++ ++ switch (type) { ++ case IR_HOMEBREW: ++ rcdev->input_name = "Serial IR type home-brew"; ++ break; ++ case IR_IRDEO: ++ rcdev->input_name = "Serial IR type IRdeo"; ++ break; ++ case IR_IRDEO_REMOTE: ++ rcdev->input_name = "Serial IR type IRdeo remote"; ++ break; ++ case IR_ANIMAX: ++ rcdev->input_name = "Serial IR type AnimaX"; ++ break; ++ case IR_IGOR: ++ rcdev->input_name = "Serial IR type IgorPlug"; ++ break; ++ } ++ ++ rcdev->input_phys = KBUILD_MODNAME "/input0"; ++ rcdev->input_id.bustype = BUS_HOST; ++ rcdev->input_id.vendor = 0x0001; ++ rcdev->input_id.product = 0x0001; ++ rcdev->input_id.version = 0x0100; ++ rcdev->open = serial_ir_open; ++ rcdev->close = serial_ir_close; ++ rcdev->dev.parent = &serial_ir.pdev->dev; ++ rcdev->driver_type = RC_DRIVER_IR_RAW; ++ rcdev->allowed_protocols = RC_BIT_ALL; ++ rcdev->driver_name = KBUILD_MODNAME; ++ rcdev->map_name = RC_MAP_RC6_MCE; ++ rcdev->timeout = IR_DEFAULT_TIMEOUT; ++ rcdev->rx_resolution = 250000; ++ ++ serial_ir.rcdev = rcdev; ++ + result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler, + share_irq ? IRQF_SHARED : 0, + KBUILD_MODNAME, &hardware); +@@ -533,7 +588,8 @@ static int serial_ir_probe(struct platform_device *dev) + sense ? "low" : "high"); + + dev_dbg(&dev->dev, "Interrupt %d, port %04x obtained\n", irq, io); +- return 0; ++ ++ return devm_rc_register_device(&dev->dev, rcdev); + } + + static int serial_ir_open(struct rc_dev *rcdev) +@@ -704,7 +760,6 @@ static void serial_ir_exit(void) + + static int __init serial_ir_init_module(void) + { +- struct rc_dev *rcdev; + int result; + + switch (type) { +@@ -735,69 +790,15 @@ static int __init serial_ir_init_module(void) + sense = !!sense; + + result = serial_ir_init(); +- if (result) +- return result; +- +- rcdev = devm_rc_allocate_device(&serial_ir.pdev->dev); +- if (!rcdev) { +- result = -ENOMEM; +- goto serial_cleanup; +- } +- +- if (hardware[type].send_pulse && hardware[type].send_space) +- rcdev->tx_ir = serial_ir_tx; +- if (hardware[type].set_send_carrier) +- rcdev->s_tx_carrier = serial_ir_tx_carrier; +- if (hardware[type].set_duty_cycle) +- rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle; +- +- switch (type) { +- case IR_HOMEBREW: +- rcdev->input_name = "Serial IR type home-brew"; +- break; +- case IR_IRDEO: +- rcdev->input_name = "Serial IR type IRdeo"; +- break; +- case IR_IRDEO_REMOTE: +- rcdev->input_name = "Serial IR type IRdeo remote"; +- break; +- case IR_ANIMAX: +- rcdev->input_name = "Serial IR type AnimaX"; +- break; +- case IR_IGOR: +- rcdev->input_name = "Serial IR type IgorPlug"; +- break; +- } +- +- rcdev->input_phys = KBUILD_MODNAME "/input0"; +- rcdev->input_id.bustype = BUS_HOST; +- rcdev->input_id.vendor = 0x0001; +- rcdev->input_id.product = 0x0001; +- rcdev->input_id.version = 0x0100; +- rcdev->open = serial_ir_open; +- rcdev->close = serial_ir_close; +- rcdev->dev.parent = &serial_ir.pdev->dev; +- rcdev->driver_type = RC_DRIVER_IR_RAW; +- rcdev->allowed_protocols = RC_BIT_ALL; +- rcdev->driver_name = KBUILD_MODNAME; +- rcdev->map_name = RC_MAP_RC6_MCE; +- rcdev->timeout = IR_DEFAULT_TIMEOUT; +- rcdev->rx_resolution = 250000; +- +- serial_ir.rcdev = rcdev; +- +- result = rc_register_device(rcdev); +- + if (!result) + return 0; +-serial_cleanup: ++ + serial_ir_exit(); + return result; + } + + static void __exit serial_ir_exit_module(void) + { +- rc_unregister_device(serial_ir.rcdev); + serial_ir_exit(); + } + +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index 6ca502d834b4..4f42d57f81d9 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -68,6 +68,7 @@ + struct dw2102_state { + u8 initialized; + u8 last_lock; ++ u8 data[MAX_XFER_SIZE + 4]; + struct i2c_client *i2c_client_demod; + struct i2c_client *i2c_client_tuner; + +@@ -661,62 +662,72 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + int num) + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); +- u8 obuf[0x40], ibuf[0x40]; ++ struct dw2102_state *state; + + if (!d) + return -ENODEV; ++ ++ state = d->priv; ++ + if (mutex_lock_interruptible(&d->i2c_mutex) < 0) + return -EAGAIN; ++ if (mutex_lock_interruptible(&d->data_mutex) < 0) { ++ mutex_unlock(&d->i2c_mutex); ++ return -EAGAIN; ++ } + + switch (num) { + case 1: + switch (msg[0].addr) { + case SU3000_STREAM_CTRL: +- obuf[0] = msg[0].buf[0] + 0x36; +- obuf[1] = 3; +- obuf[2] = 0; +- if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 0, 0) < 0) ++ state->data[0] = msg[0].buf[0] + 0x36; ++ state->data[1] = 3; ++ state->data[2] = 0; ++ if (dvb_usb_generic_rw(d, state->data, 3, ++ state->data, 0, 0) < 0) + err("i2c transfer failed."); + break; + case DW2102_RC_QUERY: +- obuf[0] = 0x10; +- if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 2, 0) < 0) ++ state->data[0] = 0x10; ++ if (dvb_usb_generic_rw(d, state->data, 1, ++ state->data, 2, 0) < 0) + err("i2c transfer failed."); +- msg[0].buf[1] = ibuf[0]; +- msg[0].buf[0] = ibuf[1]; ++ msg[0].buf[1] = state->data[0]; ++ msg[0].buf[0] = state->data[1]; + break; + default: + /* always i2c write*/ +- obuf[0] = 0x08; +- obuf[1] = msg[0].addr; +- obuf[2] = msg[0].len; ++ state->data[0] = 0x08; ++ state->data[1] = msg[0].addr; ++ state->data[2] = msg[0].len; + +- memcpy(&obuf[3], msg[0].buf, msg[0].len); ++ memcpy(&state->data[3], msg[0].buf, msg[0].len); + +- if (dvb_usb_generic_rw(d, obuf, msg[0].len + 3, +- ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3, ++ state->data, 1, 0) < 0) + err("i2c transfer failed."); + + } + break; + case 2: + /* always i2c read */ +- obuf[0] = 0x09; +- obuf[1] = msg[0].len; +- obuf[2] = msg[1].len; +- obuf[3] = msg[0].addr; +- memcpy(&obuf[4], msg[0].buf, msg[0].len); +- +- if (dvb_usb_generic_rw(d, obuf, msg[0].len + 4, +- ibuf, msg[1].len + 1, 0) < 0) ++ state->data[0] = 0x09; ++ state->data[1] = msg[0].len; ++ state->data[2] = msg[1].len; ++ state->data[3] = msg[0].addr; ++ memcpy(&state->data[4], msg[0].buf, msg[0].len); ++ ++ if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4, ++ state->data, msg[1].len + 1, 0) < 0) + err("i2c transfer failed."); + +- memcpy(msg[1].buf, &ibuf[1], msg[1].len); ++ memcpy(msg[1].buf, &state->data[1], msg[1].len); + break; + default: + warn("more than 2 i2c messages at a time is not handled yet."); + break; + } ++ mutex_unlock(&d->data_mutex); + mutex_unlock(&d->i2c_mutex); + return num; + } +@@ -844,17 +855,23 @@ static int su3000_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) + static int su3000_power_ctrl(struct dvb_usb_device *d, int i) + { + struct dw2102_state *state = (struct dw2102_state *)d->priv; +- u8 obuf[] = {0xde, 0}; ++ int ret = 0; + + info("%s: %d, initialized %d", __func__, i, state->initialized); + + if (i && !state->initialized) { ++ mutex_lock(&d->data_mutex); ++ ++ state->data[0] = 0xde; ++ state->data[1] = 0; ++ + state->initialized = 1; + /* reset board */ +- return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0); ++ ret = dvb_usb_generic_rw(d, state->data, 2, NULL, 0, 0); ++ mutex_unlock(&d->data_mutex); + } + +- return 0; ++ return ret; + } + + static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) +@@ -1309,49 +1326,57 @@ static int prof_7500_frontend_attach(struct dvb_usb_adapter *d) + return 0; + } + +-static int su3000_frontend_attach(struct dvb_usb_adapter *d) ++static int su3000_frontend_attach(struct dvb_usb_adapter *adap) + { +- u8 obuf[3] = { 0xe, 0x80, 0 }; +- u8 ibuf[] = { 0 }; ++ struct dvb_usb_device *d = adap->dev; ++ struct dw2102_state *state = d->priv; ++ ++ mutex_lock(&d->data_mutex); ++ ++ state->data[0] = 0xe; ++ state->data[1] = 0x80; ++ state->data[2] = 0; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x02; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x02; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + msleep(300); + +- obuf[0] = 0xe; +- obuf[1] = 0x83; +- obuf[2] = 0; ++ state->data[0] = 0xe; ++ state->data[1] = 0x83; ++ state->data[2] = 0; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x83; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x83; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0x51; ++ state->data[0] = 0x51; + +- if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0) + err("command 0x51 transfer failed."); + +- d->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config, +- &d->dev->i2c_adap); +- if (d->fe_adap[0].fe == NULL) ++ mutex_unlock(&d->data_mutex); ++ ++ adap->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config, ++ &d->i2c_adap); ++ if (adap->fe_adap[0].fe == NULL) + return -EIO; + +- if (dvb_attach(ts2020_attach, d->fe_adap[0].fe, ++ if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe, + &dw2104_ts2020_config, +- &d->dev->i2c_adap)) { ++ &d->i2c_adap)) { + info("Attached DS3000/TS2020!"); + return 0; + } +@@ -1360,47 +1385,55 @@ static int su3000_frontend_attach(struct dvb_usb_adapter *d) + return -EIO; + } + +-static int t220_frontend_attach(struct dvb_usb_adapter *d) ++static int t220_frontend_attach(struct dvb_usb_adapter *adap) + { +- u8 obuf[3] = { 0xe, 0x87, 0 }; +- u8 ibuf[] = { 0 }; ++ struct dvb_usb_device *d = adap->dev; ++ struct dw2102_state *state = d->priv; ++ ++ mutex_lock(&d->data_mutex); + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ state->data[0] = 0xe; ++ state->data[1] = 0x87; ++ state->data[2] = 0x0; ++ ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x86; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x86; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x80; +- obuf[2] = 0; ++ state->data[0] = 0xe; ++ state->data[1] = 0x80; ++ state->data[2] = 0; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + + msleep(50); + +- obuf[0] = 0xe; +- obuf[1] = 0x80; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x80; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0x51; ++ state->data[0] = 0x51; + +- if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0) + err("command 0x51 transfer failed."); + +- d->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config, +- &d->dev->i2c_adap, NULL); +- if (d->fe_adap[0].fe != NULL) { +- if (dvb_attach(tda18271_attach, d->fe_adap[0].fe, 0x60, +- &d->dev->i2c_adap, &tda18271_config)) { ++ mutex_unlock(&d->data_mutex); ++ ++ adap->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config, ++ &d->i2c_adap, NULL); ++ if (adap->fe_adap[0].fe != NULL) { ++ if (dvb_attach(tda18271_attach, adap->fe_adap[0].fe, 0x60, ++ &d->i2c_adap, &tda18271_config)) { + info("Attached TDA18271HD/CXD2820R!"); + return 0; + } +@@ -1410,23 +1443,30 @@ static int t220_frontend_attach(struct dvb_usb_adapter *d) + return -EIO; + } + +-static int m88rs2000_frontend_attach(struct dvb_usb_adapter *d) ++static int m88rs2000_frontend_attach(struct dvb_usb_adapter *adap) + { +- u8 obuf[] = { 0x51 }; +- u8 ibuf[] = { 0 }; ++ struct dvb_usb_device *d = adap->dev; ++ struct dw2102_state *state = d->priv; ++ ++ mutex_lock(&d->data_mutex); + +- if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0) ++ state->data[0] = 0x51; ++ ++ if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0) + err("command 0x51 transfer failed."); + +- d->fe_adap[0].fe = dvb_attach(m88rs2000_attach, &s421_m88rs2000_config, +- &d->dev->i2c_adap); ++ mutex_unlock(&d->data_mutex); + +- if (d->fe_adap[0].fe == NULL) ++ adap->fe_adap[0].fe = dvb_attach(m88rs2000_attach, ++ &s421_m88rs2000_config, ++ &d->i2c_adap); ++ ++ if (adap->fe_adap[0].fe == NULL) + return -EIO; + +- if (dvb_attach(ts2020_attach, d->fe_adap[0].fe, ++ if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe, + &dw2104_ts2020_config, +- &d->dev->i2c_adap)) { ++ &d->i2c_adap)) { + info("Attached RS2000/TS2020!"); + return 0; + } +@@ -1439,44 +1479,50 @@ static int tt_s2_4600_frontend_attach(struct dvb_usb_adapter *adap) + { + struct dvb_usb_device *d = adap->dev; + struct dw2102_state *state = d->priv; +- u8 obuf[3] = { 0xe, 0x80, 0 }; +- u8 ibuf[] = { 0 }; + struct i2c_adapter *i2c_adapter; + struct i2c_client *client; + struct i2c_board_info board_info; + struct m88ds3103_platform_data m88ds3103_pdata = {}; + struct ts2020_config ts2020_config = {}; + +- if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0) ++ mutex_lock(&d->data_mutex); ++ ++ state->data[0] = 0xe; ++ state->data[1] = 0x80; ++ state->data[2] = 0x0; ++ ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x02; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x02; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + msleep(300); + +- obuf[0] = 0xe; +- obuf[1] = 0x83; +- obuf[2] = 0; ++ state->data[0] = 0xe; ++ state->data[1] = 0x83; ++ state->data[2] = 0; + +- if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0xe; +- obuf[1] = 0x83; +- obuf[2] = 1; ++ state->data[0] = 0xe; ++ state->data[1] = 0x83; ++ state->data[2] = 1; + +- if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0) + err("command 0x0e transfer failed."); + +- obuf[0] = 0x51; ++ state->data[0] = 0x51; + +- if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 1, 0) < 0) ++ if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0) + err("command 0x51 transfer failed."); + ++ mutex_unlock(&d->data_mutex); ++ + /* attach demod */ + m88ds3103_pdata.clk = 27000000; + m88ds3103_pdata.i2c_wr_max = 33; +diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c +index f9fa3fad728e..2051f28ddac6 100644 +--- a/drivers/mtd/maps/pmcmsp-flash.c ++++ b/drivers/mtd/maps/pmcmsp-flash.c +@@ -139,15 +139,13 @@ static int __init init_msp_flash(void) + } + + msp_maps[i].bankwidth = 1; +- msp_maps[i].name = kmalloc(7, GFP_KERNEL); ++ msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL); + if (!msp_maps[i].name) { + iounmap(msp_maps[i].virt); + kfree(msp_parts[i]); + goto cleanup_loop; + } + +- msp_maps[i].name = strncpy(msp_maps[i].name, flash_name, 7); +- + for (j = 0; j < pcnt; j++) { + part_name[5] = '0' + i; + part_name[7] = '0' + j; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 1800befa8b8b..024def5bb3fa 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2173,6 +2173,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005d, quirk_blacklist_vpd); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID, + quirk_blacklist_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd); + + /* + * For Broadcom 5706, 5708, 5709 rev. A nics, any read beyond the +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index f44615fa474d..3e2ef4fd7382 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1036,8 +1036,10 @@ static int s3c64xx_serial_startup(struct uart_port *port) + if (ourport->dma) { + ret = s3c24xx_serial_request_dma(ourport); + if (ret < 0) { +- dev_warn(port->dev, "DMA request failed\n"); +- return ret; ++ dev_warn(port->dev, ++ "DMA request failed, DMA will not be used\n"); ++ devm_kfree(port->dev, ourport->dma); ++ ourport->dma = NULL; + } + } + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index eb1b9cb3f9d1..35b63518baf6 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; + dwc3_omap_write_utmi_ctrl(omap, val); ++ break; + + case OMAP_DWC3_VBUS_OFF: + val = dwc3_omap_read_utmi_ctrl(omap); +diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h +index 3129bcf74d7d..265e223ab645 100644 +--- a/drivers/usb/dwc3/gadget.h ++++ b/drivers/usb/dwc3/gadget.h +@@ -28,23 +28,23 @@ struct dwc3; + #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget)) + + /* DEPCFG parameter 1 */ +-#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0) ++#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0) + #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8) + #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9) + #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10) + #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11) + #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13) +-#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16) ++#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) + #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24) +-#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25) ++#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) + #define DWC3_DEPCFG_BULK_BASED (1 << 30) + #define DWC3_DEPCFG_FIFO_BASED (1 << 31) + + /* DEPCFG parameter 0 */ +-#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1) +-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3) +-#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17) +-#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22) ++#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1) ++#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3) ++#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17) ++#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22) + #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26) + /* This applies for core versions earlier than 1.94a */ + #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index fd80c1b9c823..560d400eb078 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1833,11 +1833,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) + spin_lock_irqsave(&func->ffs->eps_lock, flags); + while(count--) { + struct usb_endpoint_descriptor *ds; ++ struct usb_ss_ep_comp_descriptor *comp_desc = NULL; ++ int needs_comp_desc = false; + int desc_idx; + +- if (ffs->gadget->speed == USB_SPEED_SUPER) ++ if (ffs->gadget->speed == USB_SPEED_SUPER) { + desc_idx = 2; +- else if (ffs->gadget->speed == USB_SPEED_HIGH) ++ needs_comp_desc = true; ++ } else if (ffs->gadget->speed == USB_SPEED_HIGH) + desc_idx = 1; + else + desc_idx = 0; +@@ -1854,6 +1857,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) + + ep->ep->driver_data = ep; + ep->ep->desc = ds; ++ ++ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + ++ USB_DT_ENDPOINT_SIZE); ++ ep->ep->maxburst = comp_desc->bMaxBurst + 1; ++ ++ if (needs_comp_desc) ++ ep->ep->comp_desc = comp_desc; ++ + ret = usb_ep_enable(ep->ep); + if (likely(!ret)) { + epfile->ep = ep; +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index 27ed51b5082f..29b41b5dee04 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) + memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req)); + v4l2_event_queue(&uvc->vdev, &v4l2_event); + +- /* Pass additional setup data to userspace */ +- if (uvc->event_setup_out && uvc->event_length) { +- uvc->control_req->length = uvc->event_length; +- return usb_ep_queue(uvc->func.config->cdev->gadget->ep0, +- uvc->control_req, GFP_ATOMIC); +- } +- + return 0; + } + +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index c60abe3a68f9..8cabc5944d5f 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev) + int rc; + + dum = *((void **)dev_get_platdata(&pdev->dev)); ++ /* Clear usb_gadget region for new registration to udc-core */ ++ memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); + dum->gadget.name = gadget_name; + dum->gadget.ops = &dummy_ops; + dum->gadget.max_speed = USB_SPEED_SUPER; +diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c +index 414e3c376dbb..5302f988e7e6 100644 +--- a/drivers/usb/host/ohci-at91.c ++++ b/drivers/usb/host/ohci-at91.c +@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + + case USB_PORT_FEAT_SUSPEND: + dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n"); +- if (valid_port(wIndex)) { ++ if (valid_port(wIndex) && ohci_at91->sfr_regmap) { + ohci_at91_port_suspend(ohci_at91->sfr_regmap, + 1); + return 0; +@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + + case USB_PORT_FEAT_SUSPEND: + dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n"); +- if (valid_port(wIndex)) { ++ if (valid_port(wIndex) && ohci_at91->sfr_regmap) { + ohci_at91_port_suspend(ohci_at91->sfr_regmap, + 0); + return 0; +diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c +index 74c42f722678..3425154baf8b 100644 +--- a/drivers/usb/host/xhci-dbg.c ++++ b/drivers/usb/host/xhci-dbg.c +@@ -111,7 +111,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci) + xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK); + + /* xhci 1.1 controllers have the HCCPARAMS2 register */ +- if (hci_version > 100) { ++ if (hci_version > 0x100) { + temp = readl(&xhci->cap_regs->hcc_params2); + xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp); + xhci_dbg(xhci, " HC %s Force save context capability", +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index c0cd98e804a3..9715200eb36e 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -283,6 +283,8 @@ static int xhci_plat_remove(struct platform_device *dev) + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct clk *clk = xhci->clk; + ++ xhci->xhc_state |= XHCI_STATE_REMOVING; ++ + usb_remove_hcd(xhci->shared_hcd); + usb_phy_shutdown(hcd->usb_phy); + +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index 095778ff984d..37c63cb39714 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + +- if (iface_desc->desc.bNumEndpoints < 1) { +- dev_err(&interface->dev, "Invalid number of endpoints\n"); +- retval = -EINVAL; +- goto error; +- } +- + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface, + /* this one will match for the IOWarrior56 only */ + dev->int_out_endpoint = endpoint; + } ++ ++ if (!dev->int_in_endpoint) { ++ dev_err(&interface->dev, "no interrupt-in endpoint found\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ ++ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) { ++ if (!dev->int_out_endpoint) { ++ dev_err(&interface->dev, "no interrupt-out endpoint found\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ } ++ + /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ + dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); + if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 6a1df9e824ca..30bf0f5db82d 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1482,16 +1482,20 @@ static int digi_read_oob_callback(struct urb *urb) + struct usb_serial *serial = port->serial; + struct tty_struct *tty; + struct digi_port *priv = usb_get_serial_port_data(port); ++ unsigned char *buf = urb->transfer_buffer; + int opcode, line, status, val; + int i; + unsigned int rts; + ++ if (urb->actual_length < 4) ++ return -1; ++ + /* handle each oob command */ +- for (i = 0; i < urb->actual_length - 3;) { +- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; +- line = ((unsigned char *)urb->transfer_buffer)[i++]; +- status = ((unsigned char *)urb->transfer_buffer)[i++]; +- val = ((unsigned char *)urb->transfer_buffer)[i++]; ++ for (i = 0; i < urb->actual_length - 3; i += 4) { ++ opcode = buf[i]; ++ line = buf[i + 1]; ++ status = buf[i + 2]; ++ val = buf[i + 3]; + + dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", + opcode, line, status, val); +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c +index 9a0db2965fbb..d1cec36f55f2 100644 +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb) + function = TIUMP_GET_FUNC_FROM_CODE(data[0]); + dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__, + port_number, function, data[1]); ++ ++ if (port_number >= edge_serial->serial->num_ports) { ++ dev_err(dev, "bad port number %d\n", port_number); ++ goto exit; ++ } ++ + port = edge_serial->serial->port[port_number]; + edge_port = usb_get_serial_port_data(port); + if (!edge_port) { +@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb) + + port_number = edge_port->port->port_number; + +- if (edge_port->lsr_event) { ++ if (urb->actual_length > 0 && edge_port->lsr_event) { + edge_port->lsr_event = 0; + dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n", + __func__, port_number, edge_port->lsr_mask, *data); +diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c +index a180b17d2432..76564b3bebb9 100644 +--- a/drivers/usb/serial/omninet.c ++++ b/drivers/usb/serial/omninet.c +@@ -142,12 +142,6 @@ static int omninet_port_remove(struct usb_serial_port *port) + + static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct usb_serial *serial = port->serial; +- struct usb_serial_port *wport; +- +- wport = serial->port[1]; +- tty_port_tty_set(&wport->port, tty); +- + return usb_serial_generic_open(tty, port); + } + +diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c +index 93c6c9b08daa..8a069aa154ed 100644 +--- a/drivers/usb/serial/safe_serial.c ++++ b/drivers/usb/serial/safe_serial.c +@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb) + if (!safe) + goto out; + ++ if (length < 2) { ++ dev_err(&port->dev, "malformed packet\n"); ++ return; ++ } ++ + fcs = fcs_compute10(data, length, CRC10_INITFCS); + if (fcs) { + dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index b4a8173bb80c..750b3f1eba31 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3927,6 +3927,10 @@ static int ext4_block_truncate_page(handle_t *handle, + unsigned blocksize; + struct inode *inode = mapping->host; + ++ /* If we are processing an encrypted inode during orphan list handling */ ++ if (ext4_encrypted_inode(inode) && !fscrypt_has_encryption_key(inode)) ++ return 0; ++ + blocksize = inode->i_sb->s_blocksize; + length = blocksize - (offset & (blocksize - 1)); + +diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h +index eb209d4523f5..dc797739f164 100644 +--- a/include/linux/user_namespace.h ++++ b/include/linux/user_namespace.h +@@ -65,7 +65,7 @@ struct ucounts { + struct hlist_node node; + struct user_namespace *ns; + kuid_t uid; +- atomic_t count; ++ int count; + atomic_t ucount[UCOUNT_COUNTS]; + }; + +diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h +index 14e49c798135..b35533b94277 100644 +--- a/include/trace/events/syscalls.h ++++ b/include/trace/events/syscalls.h +@@ -1,5 +1,6 @@ + #undef TRACE_SYSTEM + #define TRACE_SYSTEM raw_syscalls ++#undef TRACE_INCLUDE_FILE + #define TRACE_INCLUDE_FILE syscalls + + #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ) +diff --git a/kernel/ucount.c b/kernel/ucount.c +index 95c6336fc2b3..c761cdba2a2d 100644 +--- a/kernel/ucount.c ++++ b/kernel/ucount.c +@@ -139,7 +139,7 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid) + + new->ns = ns; + new->uid = uid; +- atomic_set(&new->count, 0); ++ new->count = 0; + + spin_lock_irq(&ucounts_lock); + ucounts = find_ucounts(ns, uid, hashent); +@@ -150,8 +150,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid) + ucounts = new; + } + } +- if (!atomic_add_unless(&ucounts->count, 1, INT_MAX)) ++ if (ucounts->count == INT_MAX) + ucounts = NULL; ++ else ++ ucounts->count += 1; + spin_unlock_irq(&ucounts_lock); + return ucounts; + } +@@ -160,13 +162,15 @@ static void put_ucounts(struct ucounts *ucounts) + { + unsigned long flags; + +- if (atomic_dec_and_test(&ucounts->count)) { +- spin_lock_irqsave(&ucounts_lock, flags); ++ spin_lock_irqsave(&ucounts_lock, flags); ++ ucounts->count -= 1; ++ if (!ucounts->count) + hlist_del_init(&ucounts->node); +- spin_unlock_irqrestore(&ucounts_lock, flags); ++ else ++ ucounts = NULL; ++ spin_unlock_irqrestore(&ucounts_lock, flags); + +- kfree(ucounts); +- } ++ kfree(ucounts); + } + + static inline bool atomic_inc_below(atomic_t *v, int u) +diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c +index ebe1b9fa3c4d..85814d1bad11 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio.c ++++ b/virt/kvm/arm/vgic/vgic-mmio.c +@@ -187,21 +187,37 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu, + static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq, + bool new_active_state) + { ++ struct kvm_vcpu *requester_vcpu; + spin_lock(&irq->irq_lock); ++ ++ /* ++ * The vcpu parameter here can mean multiple things depending on how ++ * this function is called; when handling a trap from the kernel it ++ * depends on the GIC version, and these functions are also called as ++ * part of save/restore from userspace. ++ * ++ * Therefore, we have to figure out the requester in a reliable way. ++ * ++ * When accessing VGIC state from user space, the requester_vcpu is ++ * NULL, which is fine, because we guarantee that no VCPUs are running ++ * when accessing VGIC state from user space so irq->vcpu->cpu is ++ * always -1. ++ */ ++ requester_vcpu = kvm_arm_get_running_vcpu(); ++ + /* + * If this virtual IRQ was written into a list register, we + * have to make sure the CPU that runs the VCPU thread has +- * synced back LR state to the struct vgic_irq. We can only +- * know this for sure, when either this irq is not assigned to +- * anyone's AP list anymore, or the VCPU thread is not +- * running on any CPUs. ++ * synced back the LR state to the struct vgic_irq. + * +- * In the opposite case, we know the VCPU thread may be on its +- * way back from the guest and still has to sync back this +- * IRQ, so we release and re-acquire the spin_lock to let the +- * other thread sync back the IRQ. ++ * As long as the conditions below are true, we know the VCPU thread ++ * may be on its way back from the guest (we kicked the VCPU thread in ++ * vgic_change_active_prepare) and still has to sync back this IRQ, ++ * so we release and re-acquire the spin_lock to let the other thread ++ * sync back the IRQ. + */ + while (irq->vcpu && /* IRQ may have state in an LR somewhere */ ++ irq->vcpu != requester_vcpu && /* Current thread is not the VCPU thread */ + irq->vcpu->cpu != -1) /* VCPU thread is running */ + cond_resched_lock(&irq->irq_lock); +
