commit: 18f95728d58727052a448f88bf6af01466fa695e Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Wed Nov 15 16:41:36 2017 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Wed Nov 15 16:41:36 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=18f95728
linux kernel 4.4.98 0000_README | 4 + 1097_linux-4.4.98.patch | 1881 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1885 insertions(+) diff --git a/0000_README b/0000_README index cc06fad..ba7ec36 100644 --- a/0000_README +++ b/0000_README @@ -431,6 +431,10 @@ Patch: 1096_linux-4.4.97.patch From: http://www.kernel.org Desc: Linux 4.4.97 +Patch: 1097_linux-4.4.98.patch +From: http://www.kernel.org +Desc: Linux 4.4.98 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1097_linux-4.4.98.patch b/1097_linux-4.4.98.patch new file mode 100644 index 0000000..38d2d5f --- /dev/null +++ b/1097_linux-4.4.98.patch @@ -0,0 +1,1881 @@ +diff --git a/Makefile b/Makefile +index fb1a40d64ba8..5d62e23347f9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 97 ++SUBLEVEL = 98 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig +index c5e1943e5427..09ebd37e01e0 100644 +--- a/arch/arm/configs/omap2plus_defconfig ++++ b/arch/arm/configs/omap2plus_defconfig +@@ -221,6 +221,7 @@ CONFIG_SERIO=m + CONFIG_SERIAL_8250=y + CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_8250_NR_UARTS=32 ++CONFIG_SERIAL_8250_RUNTIME_UARTS=6 + CONFIG_SERIAL_8250_EXTENDED=y + CONFIG_SERIAL_8250_MANY_PORTS=y + CONFIG_SERIAL_8250_SHARE_IRQ=y +diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c +index bc698383e822..c92b535150a0 100644 +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -132,30 +132,26 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom, + set_fs(fs); + } + +-static void dump_instr(const char *lvl, struct pt_regs *regs) ++static void __dump_instr(const char *lvl, struct pt_regs *regs) + { + unsigned long addr = instruction_pointer(regs); + const int thumb = thumb_mode(regs); + const int width = thumb ? 4 : 8; +- mm_segment_t fs; + char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; + int i; + + /* +- * We need to switch to kernel mode so that we can use __get_user +- * to safely read from kernel space. Note that we now dump the +- * code first, just in case the backtrace kills us. ++ * Note that we now dump the code first, just in case the backtrace ++ * kills us. + */ +- fs = get_fs(); +- set_fs(KERNEL_DS); + + for (i = -4; i < 1 + !!thumb; i++) { + unsigned int val, bad; + + if (thumb) +- bad = __get_user(val, &((u16 *)addr)[i]); ++ bad = get_user(val, &((u16 *)addr)[i]); + else +- bad = __get_user(val, &((u32 *)addr)[i]); ++ bad = get_user(val, &((u32 *)addr)[i]); + + if (!bad) + p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ", +@@ -166,8 +162,20 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) + } + } + printk("%sCode: %s\n", lvl, str); ++} + +- set_fs(fs); ++static void dump_instr(const char *lvl, struct pt_regs *regs) ++{ ++ mm_segment_t fs; ++ ++ if (!user_mode(regs)) { ++ fs = get_fs(); ++ set_fs(KERNEL_DS); ++ __dump_instr(lvl, regs); ++ set_fs(fs); ++ } else { ++ __dump_instr(lvl, regs); ++ } + } + + #ifdef CONFIG_ARM_UNWIND +diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c +index 58fca9ad5fcc..3446b6fb3acb 100644 +--- a/arch/mips/ar7/platform.c ++++ b/arch/mips/ar7/platform.c +@@ -576,6 +576,7 @@ static int __init ar7_register_uarts(void) + uart_port.type = PORT_AR7; + uart_port.uartclk = clk_get_rate(bus_clk) / 2; + uart_port.iotype = UPIO_MEM32; ++ uart_port.flags = UPF_FIXED_TYPE; + uart_port.regshift = 2; + + uart_port.line = 0; +@@ -654,6 +655,10 @@ static int __init ar7_register_devices(void) + u32 val; + int res; + ++ res = ar7_gpio_init(); ++ if (res) ++ pr_warn("unable to register gpios: %d\n", res); ++ + res = ar7_register_uarts(); + if (res) + pr_err("unable to setup uart(s): %d\n", res); +diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c +index a23adc49d50f..36aabee9cba4 100644 +--- a/arch/mips/ar7/prom.c ++++ b/arch/mips/ar7/prom.c +@@ -246,8 +246,6 @@ void __init prom_init(void) + ar7_init_cmdline(fw_arg0, (char **)fw_arg1); + ar7_init_env((struct env_var *)fw_arg2); + console_config(); +- +- ar7_gpio_init(); + } + + #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4))) +diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h +index 6516e9da5133..b836ddec82b7 100644 +--- a/arch/mips/include/asm/mips-cm.h ++++ b/arch/mips/include/asm/mips-cm.h +@@ -238,8 +238,8 @@ BUILD_CM_Cx_R_(tcid_8_priority, 0x80) + #define CM_GCR_BASE_GCRBASE_MSK (_ULCAST_(0x1ffff) << 15) + #define CM_GCR_BASE_CMDEFTGT_SHF 0 + #define CM_GCR_BASE_CMDEFTGT_MSK (_ULCAST_(0x3) << 0) +-#define CM_GCR_BASE_CMDEFTGT_DISABLED 0 +-#define CM_GCR_BASE_CMDEFTGT_MEM 1 ++#define CM_GCR_BASE_CMDEFTGT_MEM 0 ++#define CM_GCR_BASE_CMDEFTGT_RESERVED 1 + #define CM_GCR_BASE_CMDEFTGT_IOCU0 2 + #define CM_GCR_BASE_CMDEFTGT_IOCU1 3 + +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 477ba026c3e5..163b3449a8de 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -49,9 +49,7 @@ + #ifdef CONFIG_HOTPLUG_CPU + void arch_cpu_idle_dead(void) + { +- /* What the heck is this check doing ? */ +- if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map)) +- play_dead(); ++ play_dead(); + } + #endif + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 7fef02a9eb85..4af08c197177 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -64,6 +64,9 @@ EXPORT_SYMBOL(cpu_sibling_map); + cpumask_t cpu_core_map[NR_CPUS] __read_mostly; + EXPORT_SYMBOL(cpu_core_map); + ++static DECLARE_COMPLETION(cpu_starting); ++static DECLARE_COMPLETION(cpu_running); ++ + /* + * A logcal cpu mask containing only one VPE per core to + * reduce the number of IPIs on large MT systems. +@@ -174,9 +177,12 @@ asmlinkage void start_secondary(void) + cpumask_set_cpu(cpu, &cpu_coherent_mask); + notify_cpu_starting(cpu); + +- cpumask_set_cpu(cpu, &cpu_callin_map); ++ /* Notify boot CPU that we're starting & ready to sync counters */ ++ complete(&cpu_starting); ++ + synchronise_count_slave(cpu); + ++ /* The CPU is running and counters synchronised, now mark it online */ + set_cpu_online(cpu, true); + + set_cpu_sibling_map(cpu); +@@ -184,6 +190,12 @@ asmlinkage void start_secondary(void) + + calculate_cpu_foreign_map(); + ++ /* ++ * Notify boot CPU that we're up & online and it can safely return ++ * from __cpu_up ++ */ ++ complete(&cpu_running); ++ + /* + * irq will be enabled in ->smp_finish(), enabling it too early + * is dangerous. +@@ -242,22 +254,23 @@ void smp_prepare_boot_cpu(void) + { + set_cpu_possible(0, true); + set_cpu_online(0, true); +- cpumask_set_cpu(0, &cpu_callin_map); + } + + int __cpu_up(unsigned int cpu, struct task_struct *tidle) + { + mp_ops->boot_secondary(cpu, tidle); + +- /* +- * Trust is futile. We should really have timeouts ... +- */ +- while (!cpumask_test_cpu(cpu, &cpu_callin_map)) { +- udelay(100); +- schedule(); ++ /* Wait for CPU to start and be ready to sync counters */ ++ if (!wait_for_completion_timeout(&cpu_starting, ++ msecs_to_jiffies(1000))) { ++ pr_crit("CPU%u: failed to start\n", cpu); ++ return -EIO; + } + + synchronise_count_master(cpu); ++ ++ /* Wait for CPU to finish startup & mark itself online before return */ ++ wait_for_completion(&cpu_running); + return 0; + } + +diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c +index d78178daea4b..e2fe48dd67b5 100644 +--- a/arch/mips/mm/uasm-micromips.c ++++ b/arch/mips/mm/uasm-micromips.c +@@ -75,7 +75,7 @@ static struct insn insn_table_MM[] = { + { insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS }, + { insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM }, + { insn_ld, 0, 0 }, +- { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM }, ++ { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM }, + { insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM }, + { insn_lld, 0, 0 }, + { insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM }, +diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts b/arch/powerpc/boot/dts/fsl/kmcoge4.dts +index 6858ec9ef295..1a953d9edf1e 100644 +--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts ++++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts +@@ -83,6 +83,10 @@ + }; + }; + ++ sdhc@114000 { ++ status = "disabled"; ++ }; ++ + i2c@119000 { + status = "disabled"; + }; +diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c +index 24f58076d49e..1d2bc84338bf 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c +@@ -280,6 +280,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, struct kvmppc_icp *icp, + */ + if (reject && reject != XICS_IPI) { + arch_spin_unlock(&ics->lock); ++ icp->n_reject++; + new_irq = reject; + goto again; + } +@@ -611,10 +612,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr) + state = &ics->irq_state[src]; + + /* Still asserted, resend it */ +- if (state->asserted) { +- icp->n_reject++; ++ if (state->asserted) + icp_rm_deliver_irq(xics, icp, irq); +- } + + if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) { + icp->rm_action |= XICS_RM_NOTIFY_EOI; +diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c +index 538c10db3537..8dc315b212c2 100644 +--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c ++++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c +@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = { + .scscr = SCSCR_TE | SCSCR_RE, + .type = PORT_IRDA, + .ops = &sh770x_sci_port_ops, +- .regshift = 1, + }; + + static struct resource scif2_resources[] = { +diff --git a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S +index 85c4e1cf7172..e1693457c178 100644 +--- a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S ++++ b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S +@@ -174,8 +174,8 @@ LABEL skip_ %I + .endr + + # Find min length +- vmovdqa _lens+0*16(state), %xmm0 +- vmovdqa _lens+1*16(state), %xmm1 ++ vmovdqu _lens+0*16(state), %xmm0 ++ vmovdqu _lens+1*16(state), %xmm1 + + vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A} + vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C} +@@ -195,8 +195,8 @@ LABEL skip_ %I + vpsubd %xmm2, %xmm0, %xmm0 + vpsubd %xmm2, %xmm1, %xmm1 + +- vmovdqa %xmm0, _lens+0*16(state) +- vmovdqa %xmm1, _lens+1*16(state) ++ vmovdqu %xmm0, _lens+0*16(state) ++ vmovdqu %xmm1, _lens+1*16(state) + + # "state" and "args" are the same address, arg1 + # len is arg2 +@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2) + jc .return_null + + # Find min length +- vmovdqa _lens(state), %xmm0 +- vmovdqa _lens+1*16(state), %xmm1 ++ vmovdqu _lens(state), %xmm0 ++ vmovdqu _lens+1*16(state), %xmm1 + + vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A} + vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C} +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index b8c75f3aade8..d788b0cdc0ad 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -7,6 +7,7 @@ + #include <linux/compiler.h> + #include <linux/thread_info.h> + #include <linux/string.h> ++#include <linux/preempt.h> + #include <asm/asm.h> + #include <asm/page.h> + #include <asm/smap.h> +@@ -66,6 +67,12 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un + __chk_range_not_ok((unsigned long __force)(addr), size, limit); \ + }) + ++#ifdef CONFIG_DEBUG_ATOMIC_SLEEP ++# define WARN_ON_IN_IRQ() WARN_ON_ONCE(!in_task()) ++#else ++# define WARN_ON_IN_IRQ() ++#endif ++ + /** + * access_ok: - Checks if a user space pointer is valid + * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE. Note that +@@ -86,8 +93,11 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un + * checks that the pointer is in the user space range - after calling + * this function, memory access functions may still return -EFAULT. + */ +-#define access_ok(type, addr, size) \ +- likely(!__range_not_ok(addr, size, user_addr_max())) ++#define access_ok(type, addr, size) \ ++({ \ ++ WARN_ON_IN_IRQ(); \ ++ likely(!__range_not_ok(addr, size, user_addr_max())); \ ++}) + + /* + * The exception table consists of pairs of addresses relative to the +diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c +index d90528ea5412..12c051d19e4b 100644 +--- a/arch/x86/oprofile/op_model_ppro.c ++++ b/arch/x86/oprofile/op_model_ppro.c +@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(void) + eax.full = cpuid_eax(0xa); + + /* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */ +- if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 && +- __this_cpu_read(cpu_info.x86_model) == 15) { ++ if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 && ++ boot_cpu_data.x86_model == 15) { + eax.split.version_id = 2; + eax.split.num_counters = 2; + eax.split.bit_width = 40; +diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c +index 2516e97c58f1..5e5a8adac0ba 100644 +--- a/crypto/asymmetric_keys/pkcs7_parser.c ++++ b/crypto/asymmetric_keys/pkcs7_parser.c +@@ -87,7 +87,7 @@ EXPORT_SYMBOL_GPL(pkcs7_free_message); + static int pkcs7_check_authattrs(struct pkcs7_message *msg) + { + struct pkcs7_signed_info *sinfo; +- bool want; ++ bool want = false; + + sinfo = msg->signed_infos; + if (!sinfo) +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index fbdddd6f94b8..ca3bcc81b623 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2736,7 +2736,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request) + * from the parent. + */ + page_count = (u32)calc_pages_for(0, length); +- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); ++ pages = ceph_alloc_page_vector(page_count, GFP_NOIO); + if (IS_ERR(pages)) { + result = PTR_ERR(pages); + pages = NULL; +@@ -2863,7 +2863,7 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request) + */ + size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32); + page_count = (u32)calc_pages_for(0, size); +- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); ++ pages = ceph_alloc_page_vector(page_count, GFP_NOIO); + if (IS_ERR(pages)) + return PTR_ERR(pages); + +diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c +index 72f138985e18..d83ab4bac8b1 100644 +--- a/drivers/crypto/vmx/aes_ctr.c ++++ b/drivers/crypto/vmx/aes_ctr.c +@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const u8 *key, + int ret; + struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm); + ++ preempt_disable(); + pagefault_disable(); + enable_kernel_altivec(); + enable_kernel_vsx(); + ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key); + pagefault_enable(); ++ preempt_enable(); + + ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen); + return ret; +@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx, + u8 *dst = walk->dst.virt.addr; + unsigned int nbytes = walk->nbytes; + ++ preempt_disable(); + pagefault_disable(); + enable_kernel_altivec(); + enable_kernel_vsx(); + aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key); + pagefault_enable(); ++ preempt_enable(); + + crypto_xor(keystream, src, nbytes); + memcpy(dst, keystream, nbytes); +@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc, + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE); + while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) { ++ preempt_disable(); + pagefault_disable(); + enable_kernel_altivec(); + enable_kernel_vsx(); +@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc, + &ctx->enc_key, + walk.iv); + pagefault_enable(); ++ preempt_enable(); + + /* We need to update IV mostly for last bytes/round */ + inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE; +diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c +index 7dd6728dd092..ccc2044af831 100644 +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -312,7 +312,7 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type) + ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root); + if (ret) { + DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n"); +- return ret; ++ goto err_debugfs; + } + + ret = device_add(minor->kdev); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +index f3f31f995878..be3971b22a02 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -708,7 +708,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + * allocation taken by fbdev + */ + if (!(dev_priv->capabilities & SVGA_CAP_3D)) +- mem_size *= 2; ++ mem_size *= 3; + + dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE; + dev_priv->prim_bb_mem = +diff --git a/drivers/iio/trigger/iio-trig-interrupt.c b/drivers/iio/trigger/iio-trig-interrupt.c +index 572bc6f02ca8..e18f12b74610 100644 +--- a/drivers/iio/trigger/iio-trig-interrupt.c ++++ b/drivers/iio/trigger/iio-trig-interrupt.c +@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device *pdev) + trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL); + if (!trig_info) { + ret = -ENOMEM; +- goto error_put_trigger; ++ goto error_free_trigger; + } + iio_trigger_set_drvdata(trig, trig_info); + trig_info->irq = irq; +@@ -83,8 +83,8 @@ error_release_irq: + free_irq(irq, trig); + error_free_trig_info: + kfree(trig_info); +-error_put_trigger: +- iio_trigger_put(trig); ++error_free_trigger: ++ iio_trigger_free(trig); + error_ret: + return ret; + } +@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct platform_device *pdev) + iio_trigger_unregister(trig); + free_irq(trig_info->irq, trig); + kfree(trig_info); +- iio_trigger_put(trig); ++ iio_trigger_free(trig); + + return 0; + } +diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c +index 3dfab2bc6d69..202e8b89caf2 100644 +--- a/drivers/iio/trigger/iio-trig-sysfs.c ++++ b/drivers/iio/trigger/iio-trig-sysfs.c +@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id) + return 0; + + out2: +- iio_trigger_put(t->trig); ++ iio_trigger_free(t->trig); + free_t: + kfree(t); + out1: +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 2018d24344de..f74b11542603 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1373,7 +1373,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work) + + while (!list_empty(&priv->cm.reap_list)) { + p = list_entry(priv->cm.reap_list.next, typeof(*p), list); +- list_del(&p->list); ++ list_del_init(&p->list); + spin_unlock_irqrestore(&priv->lock, flags); + netif_tx_unlock_bh(dev); + ipoib_cm_tx_destroy(p); +diff --git a/drivers/input/keyboard/mpr121_touchkey.c b/drivers/input/keyboard/mpr121_touchkey.c +index 0fd612dd76ed..aaf43befffaa 100644 +--- a/drivers/input/keyboard/mpr121_touchkey.c ++++ b/drivers/input/keyboard/mpr121_touchkey.c +@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id) + struct mpr121_touchkey *mpr121 = dev_id; + struct i2c_client *client = mpr121->client; + struct input_dev *input = mpr121->input_dev; +- unsigned int key_num, key_val, pressed; ++ unsigned long bit_changed; ++ unsigned int key_num; + int reg; + + reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR); +@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id) + + reg &= TOUCH_STATUS_MASK; + /* use old press bit to figure out which bit changed */ +- key_num = ffs(reg ^ mpr121->statusbits) - 1; +- pressed = reg & (1 << key_num); ++ bit_changed = reg ^ mpr121->statusbits; + mpr121->statusbits = reg; ++ for_each_set_bit(key_num, &bit_changed, mpr121->keycount) { ++ unsigned int key_val, pressed; + +- key_val = mpr121->keycodes[key_num]; ++ pressed = reg & BIT(key_num); ++ key_val = mpr121->keycodes[key_num]; + +- input_event(input, EV_MSC, MSC_SCAN, key_num); +- input_report_key(input, key_val, pressed); +- input_sync(input); ++ input_event(input, EV_MSC, MSC_SCAN, key_num); ++ input_report_key(input, key_val, pressed); ++ ++ dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, ++ pressed ? "pressed" : "released"); + +- dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, +- pressed ? "pressed" : "released"); ++ } ++ input_sync(input); + + out: + return IRQ_HANDLED; +@@ -231,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client, + input_dev->id.bustype = BUS_I2C; + input_dev->dev.parent = &client->dev; + input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP); ++ input_set_capability(input_dev, EV_MSC, MSC_SCAN); + + input_dev->keycode = mpr121->keycodes; + input_dev->keycodesize = sizeof(mpr121->keycodes[0]); +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index b8c50d883b2c..c9d491bc85e0 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1240,6 +1240,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0605", 0 }, + { "ELAN0609", 0 }, + { "ELAN060B", 0 }, ++ { "ELAN060C", 0 }, + { "ELAN0611", 0 }, + { "ELAN1000", 0 }, + { } +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 00df3832faab..64f1eb8fdcbc 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1033,13 +1033,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid, + } + } + +- /* Nuke the existing Config, as we're going to rewrite it */ +- val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT); +- +- if (ste->valid) +- val |= STRTAB_STE_0_V; +- else +- val &= ~STRTAB_STE_0_V; ++ /* Nuke the existing STE_0 value, as we're going to rewrite it */ ++ val = ste->valid ? STRTAB_STE_0_V : 0; + + if (ste->bypass) { + val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT +@@ -1068,7 +1063,6 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid, + val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK + << STRTAB_STE_0_S1CTXPTR_SHIFT) | + STRTAB_STE_0_CFG_S1_TRANS; +- + } + + if (ste->s2_cfg) { +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 01adcdc52346..a9e2722f5e22 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2856,6 +2856,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state) + state->pdata.alt_data_sat = 1; + state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0; + state->pdata.bus_order = ADV7604_BUS_ORDER_RGB; ++ state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH; ++ state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH; ++ state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH; + + return 0; + } +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index cf7c18947189..d065c0e2d18e 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev, + break; + case BOSCH_D_CAN: + priv->regs = reg_map_d_can; +- priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + break; + default: + ret = -EINVAL; +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index e36d10520e24..717530eac70c 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev) + break; + case BOSCH_D_CAN: + priv->regs = reg_map_d_can; +- priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + priv->read_reg = c_can_plat_read_reg_aligned_to_16bit; + priv->write_reg = c_can_plat_write_reg_aligned_to_16bit; + priv->read_reg32 = d_can_plat_read_reg32; +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index b0c80859f746..1ac2090a1721 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + } + stats->rx_over_errors++; + stats->rx_errors++; ++ ++ /* reset the CAN IP by entering reset mode ++ * ignoring timeout error ++ */ ++ set_reset_mode(dev); ++ set_normal_mode(dev); ++ + /* clear bit */ + sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG); + } +@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id) + netif_wake_queue(dev); + can_led_event(dev, CAN_LED_EVENT_TX); + } +- if (isrc & SUN4I_INT_RBUF_VLD) { +- /* receive interrupt */ ++ if ((isrc & SUN4I_INT_RBUF_VLD) && ++ !(isrc & SUN4I_INT_DATA_OR)) { ++ /* receive interrupt - don't read if overrun occurred */ + while (status & SUN4I_STA_RBUF_RDY) { + /* RX buffer is not empty */ + sun4i_can_rx(dev); +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index e0e94b855bbe..1228d0da4075 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -724,8 +724,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + u8 *buf; + int len; + int temp; ++ int err; + u8 iface_no; + struct usb_cdc_parsed_header hdr; ++ u16 curr_ntb_format; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) +@@ -823,6 +825,32 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + goto error2; + } + ++ /* ++ * Some Huawei devices have been observed to come out of reset in NDP32 mode. ++ * Let's check if this is the case, and set the device to NDP16 mode again if ++ * needed. ++ */ ++ if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) { ++ err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT, ++ USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE, ++ 0, iface_no, &curr_ntb_format, 2); ++ if (err < 0) { ++ goto error2; ++ } ++ ++ if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) { ++ dev_info(&intf->dev, "resetting NTB format to 16-bit"); ++ err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT, ++ USB_TYPE_CLASS | USB_DIR_OUT ++ | USB_RECIP_INTERFACE, ++ USB_CDC_NCM_NTB16_FORMAT, ++ iface_no, NULL, 0); ++ ++ if (err < 0) ++ goto error2; ++ } ++ } ++ + cdc_ncm_find_endpoints(dev, ctx->data); + cdc_ncm_find_endpoints(dev, ctx->control); + if (!dev->in || !dev->out || !dev->status) { +diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c +index 2680a65cd5e4..63f28908afda 100644 +--- a/drivers/net/usb/huawei_cdc_ncm.c ++++ b/drivers/net/usb/huawei_cdc_ncm.c +@@ -80,6 +80,12 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev, + * be at the end of the frame. + */ + drvflags |= CDC_NCM_FLAG_NDP_TO_END; ++ ++ /* Additionally, it has been reported that some Huawei E3372H devices, with ++ * firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence ++ * needing to be set to the NTB16 one again. ++ */ ++ drvflags |= CDC_NCM_FLAG_RESET_NTB16; + ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags); + if (ret) + goto err; +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index 72ee1c305cc4..02db20b26749 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444); + unsigned int rx_stall_timeout_msecs = 60000; + module_param(rx_stall_timeout_msecs, uint, 0444); + ++#define MAX_QUEUES_DEFAULT 8 + unsigned int xenvif_max_queues; + module_param_named(max_queues, xenvif_max_queues, uint, 0644); + MODULE_PARM_DESC(max_queues, +@@ -2157,11 +2158,12 @@ static int __init netback_init(void) + if (!xen_domain()) + return -ENODEV; + +- /* Allow as many queues as there are CPUs if user has not ++ /* Allow as many queues as there are CPUs but max. 8 if user has not + * specified a value. + */ + if (xenvif_max_queues == 0) +- xenvif_max_queues = num_online_cpus(); ++ xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT, ++ num_online_cpus()); + + if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) { + pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n", +diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c +index 53b79c5f0559..379d08f76146 100644 +--- a/drivers/pci/host/pci-mvebu.c ++++ b/drivers/pci/host/pci-mvebu.c +@@ -131,6 +131,12 @@ struct mvebu_pcie { + int nports; + }; + ++struct mvebu_pcie_window { ++ phys_addr_t base; ++ phys_addr_t remap; ++ size_t size; ++}; ++ + /* Structure representing one PCIe interface */ + struct mvebu_pcie_port { + char *name; +@@ -148,10 +154,8 @@ struct mvebu_pcie_port { + struct mvebu_sw_pci_bridge bridge; + struct device_node *dn; + struct mvebu_pcie *pcie; +- phys_addr_t memwin_base; +- size_t memwin_size; +- phys_addr_t iowin_base; +- size_t iowin_size; ++ struct mvebu_pcie_window memwin; ++ struct mvebu_pcie_window iowin; + u32 saved_pcie_stat; + }; + +@@ -377,23 +381,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port, + } + } + ++static void mvebu_pcie_set_window(struct mvebu_pcie_port *port, ++ unsigned int target, unsigned int attribute, ++ const struct mvebu_pcie_window *desired, ++ struct mvebu_pcie_window *cur) ++{ ++ if (desired->base == cur->base && desired->remap == cur->remap && ++ desired->size == cur->size) ++ return; ++ ++ if (cur->size != 0) { ++ mvebu_pcie_del_windows(port, cur->base, cur->size); ++ cur->size = 0; ++ cur->base = 0; ++ ++ /* ++ * If something tries to change the window while it is enabled ++ * the change will not be done atomically. That would be ++ * difficult to do in the general case. ++ */ ++ } ++ ++ if (desired->size == 0) ++ return; ++ ++ mvebu_pcie_add_windows(port, target, attribute, desired->base, ++ desired->size, desired->remap); ++ *cur = *desired; ++} ++ + static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + { +- phys_addr_t iobase; ++ struct mvebu_pcie_window desired = {}; + + /* Are the new iobase/iolimit values invalid? */ + if (port->bridge.iolimit < port->bridge.iobase || + port->bridge.iolimitupper < port->bridge.iobaseupper || + !(port->bridge.command & PCI_COMMAND_IO)) { +- +- /* If a window was configured, remove it */ +- if (port->iowin_base) { +- mvebu_pcie_del_windows(port, port->iowin_base, +- port->iowin_size); +- port->iowin_base = 0; +- port->iowin_size = 0; +- } +- ++ mvebu_pcie_set_window(port, port->io_target, port->io_attr, ++ &desired, &port->iowin); + return; + } + +@@ -410,32 +436,27 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + * specifications. iobase is the bus address, port->iowin_base + * is the CPU address. + */ +- iobase = ((port->bridge.iobase & 0xF0) << 8) | +- (port->bridge.iobaseupper << 16); +- port->iowin_base = port->pcie->io.start + iobase; +- port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | +- (port->bridge.iolimitupper << 16)) - +- iobase) + 1; +- +- mvebu_pcie_add_windows(port, port->io_target, port->io_attr, +- port->iowin_base, port->iowin_size, +- iobase); ++ desired.remap = ((port->bridge.iobase & 0xF0) << 8) | ++ (port->bridge.iobaseupper << 16); ++ desired.base = port->pcie->io.start + desired.remap; ++ desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | ++ (port->bridge.iolimitupper << 16)) - ++ desired.remap) + ++ 1; ++ ++ mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired, ++ &port->iowin); + } + + static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) + { ++ struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP}; ++ + /* Are the new membase/memlimit values invalid? */ + if (port->bridge.memlimit < port->bridge.membase || + !(port->bridge.command & PCI_COMMAND_MEMORY)) { +- +- /* If a window was configured, remove it */ +- if (port->memwin_base) { +- mvebu_pcie_del_windows(port, port->memwin_base, +- port->memwin_size); +- port->memwin_base = 0; +- port->memwin_size = 0; +- } +- ++ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, ++ &desired, &port->memwin); + return; + } + +@@ -445,14 +466,12 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) + * window to setup, according to the PCI-to-PCI bridge + * specifications. + */ +- port->memwin_base = ((port->bridge.membase & 0xFFF0) << 16); +- port->memwin_size = +- (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - +- port->memwin_base + 1; +- +- mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr, +- port->memwin_base, port->memwin_size, +- MVEBU_MBUS_NO_REMAP); ++ desired.base = ((port->bridge.membase & 0xFFF0) << 16); ++ desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - ++ desired.base + 1; ++ ++ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired, ++ &port->memwin); + } + + /* +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index af2046c87806..847f75601591 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -249,7 +249,7 @@ static int hp_wmi_display_state(void) + int ret = hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, &state, + sizeof(state), sizeof(state)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return state; + } + +@@ -259,7 +259,7 @@ static int hp_wmi_hddtemp_state(void) + int ret = hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, &state, + sizeof(state), sizeof(state)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return state; + } + +@@ -269,7 +269,7 @@ static int hp_wmi_als_state(void) + int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, &state, + sizeof(state), sizeof(state)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return state; + } + +@@ -280,7 +280,7 @@ static int hp_wmi_dock_state(void) + sizeof(state), sizeof(state)); + + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + + return state & 0x1; + } +@@ -291,7 +291,7 @@ static int hp_wmi_tablet_state(void) + int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, &state, + sizeof(state), sizeof(state)); + if (ret) +- return ret; ++ return ret < 0 ? ret : -EINVAL; + + return (state & 0x4) ? 1 : 0; + } +@@ -324,7 +324,7 @@ static int __init hp_wmi_enable_hotkeys(void) + int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value, + sizeof(value), 0); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return 0; + } + +@@ -337,7 +337,7 @@ static int hp_wmi_set_block(void *data, bool blocked) + ret = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, + &query, sizeof(query), 0); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return 0; + } + +@@ -429,7 +429,7 @@ static int hp_wmi_post_code_state(void) + int ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 0, &state, + sizeof(state), sizeof(state)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + return state; + } + +@@ -495,7 +495,7 @@ static ssize_t set_als(struct device *dev, struct device_attribute *attr, + int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, &tmp, + sizeof(tmp), sizeof(tmp)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + + return count; + } +@@ -516,7 +516,7 @@ static ssize_t set_postcode(struct device *dev, struct device_attribute *attr, + ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 1, &tmp, + sizeof(tmp), sizeof(tmp)); + if (ret) +- return -EINVAL; ++ return ret < 0 ? ret : -EINVAL; + + return count; + } +@@ -573,10 +573,12 @@ static void hp_wmi_notify(u32 value, void *context) + + switch (event_id) { + case HPWMI_DOCK_EVENT: +- input_report_switch(hp_wmi_input_dev, SW_DOCK, +- hp_wmi_dock_state()); +- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, +- hp_wmi_tablet_state()); ++ if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit)) ++ input_report_switch(hp_wmi_input_dev, SW_DOCK, ++ hp_wmi_dock_state()); ++ if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) ++ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, ++ hp_wmi_tablet_state()); + input_sync(hp_wmi_input_dev); + break; + case HPWMI_PARK_HDD: +@@ -649,6 +651,7 @@ static int __init hp_wmi_input_setup(void) + { + acpi_status status; + int err; ++ int val; + + hp_wmi_input_dev = input_allocate_device(); + if (!hp_wmi_input_dev) +@@ -659,17 +662,26 @@ static int __init hp_wmi_input_setup(void) + hp_wmi_input_dev->id.bustype = BUS_HOST; + + __set_bit(EV_SW, hp_wmi_input_dev->evbit); +- __set_bit(SW_DOCK, hp_wmi_input_dev->swbit); +- __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit); ++ ++ /* Dock */ ++ val = hp_wmi_dock_state(); ++ if (!(val < 0)) { ++ __set_bit(SW_DOCK, hp_wmi_input_dev->swbit); ++ input_report_switch(hp_wmi_input_dev, SW_DOCK, val); ++ } ++ ++ /* Tablet mode */ ++ val = hp_wmi_tablet_state(); ++ if (!(val < 0)) { ++ __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit); ++ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val); ++ } + + err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL); + if (err) + goto err_free_dev; + + /* Set initial hardware state */ +- input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state()); +- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, +- hp_wmi_tablet_state()); + input_sync(hp_wmi_input_dev); + + if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later()) +@@ -982,10 +994,12 @@ static int hp_wmi_resume_handler(struct device *device) + * changed. + */ + if (hp_wmi_input_dev) { +- input_report_switch(hp_wmi_input_dev, SW_DOCK, +- hp_wmi_dock_state()); +- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, +- hp_wmi_tablet_state()); ++ if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit)) ++ input_report_switch(hp_wmi_input_dev, SW_DOCK, ++ hp_wmi_dock_state()); ++ if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) ++ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, ++ hp_wmi_tablet_state()); + input_sync(hp_wmi_input_dev); + } + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 741f3ee81cfe..5006cb6ce62d 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -909,7 +909,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, unsigned long); + int qeth_core_hardsetup_card(struct qeth_card *); + void qeth_print_status_message(struct qeth_card *); + int qeth_init_qdio_queues(struct qeth_card *); +-int qeth_send_startlan(struct qeth_card *); + int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *, + int (*reply_cb) + (struct qeth_card *, struct qeth_reply *, unsigned long), +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index d10bf3da8e5f..e5b9506698b1 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2955,7 +2955,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob, + } + EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd); + +-int qeth_send_startlan(struct qeth_card *card) ++static int qeth_send_startlan(struct qeth_card *card) + { + int rc; + struct qeth_cmd_buffer *iob; +@@ -2968,7 +2968,6 @@ int qeth_send_startlan(struct qeth_card *card) + rc = qeth_send_ipa_cmd(card, iob, NULL, NULL); + return rc; + } +-EXPORT_SYMBOL_GPL(qeth_send_startlan); + + static int qeth_default_setadapterparms_cb(struct qeth_card *card, + struct qeth_reply *reply, unsigned long data) +@@ -5080,6 +5079,20 @@ retriable: + goto out; + } + ++ rc = qeth_send_startlan(card); ++ if (rc) { ++ QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); ++ if (rc == IPA_RC_LAN_OFFLINE) { ++ dev_warn(&card->gdev->dev, ++ "The LAN is offline\n"); ++ card->lan_online = 0; ++ } else { ++ rc = -ENODEV; ++ goto out; ++ } ++ } else ++ card->lan_online = 1; ++ + card->options.ipa4.supported_funcs = 0; + card->options.ipa6.supported_funcs = 0; + card->options.adp.supported_funcs = 0; +@@ -5091,14 +5104,14 @@ retriable: + if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) { + rc = qeth_query_setadapterparms(card); + if (rc < 0) { +- QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); ++ QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); + goto out; + } + } + if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) { + rc = qeth_query_setdiagass(card); + if (rc < 0) { +- QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); ++ QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc); + goto out; + } + } +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index bf1e0e39334d..58bcb3c9a86a 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1203,21 +1203,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode) + /* softsetup */ + QETH_DBF_TEXT(SETUP, 2, "softsetp"); + +- rc = qeth_send_startlan(card); +- if (rc) { +- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); +- if (rc == 0xe080) { +- dev_warn(&card->gdev->dev, +- "The LAN is offline\n"); +- card->lan_online = 0; +- goto contin; +- } +- rc = -ENODEV; +- goto out_remove; +- } else +- card->lan_online = 1; +- +-contin: + if ((card->info.type == QETH_CARD_TYPE_OSD) || + (card->info.type == QETH_CARD_TYPE_OSX)) { + if (qeth_l2_start_ipassists(card)) +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 285fe0b2c753..bf3c1b2301db 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3298,21 +3298,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode) + /* softsetup */ + QETH_DBF_TEXT(SETUP, 2, "softsetp"); + +- rc = qeth_send_startlan(card); +- if (rc) { +- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); +- if (rc == 0xe080) { +- dev_warn(&card->gdev->dev, +- "The LAN is offline\n"); +- card->lan_online = 0; +- goto contin; +- } +- rc = -ENODEV; +- goto out_remove; +- } else +- card->lan_online = 1; +- +-contin: + rc = qeth_l3_setadapter_parms(card); + if (rc) + QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc); +diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c +index 035dd456d7d6..737747354db6 100644 +--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c ++++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c +@@ -259,7 +259,7 @@ out_free_irq: + out1: + iio_trigger_unregister(st->trig); + out: +- iio_trigger_put(st->trig); ++ iio_trigger_free(st->trig); + return ret; + } + +@@ -272,7 +272,7 @@ static int iio_bfin_tmr_trigger_remove(struct platform_device *pdev) + peripheral_free(st->t->pin); + free_irq(st->irq, st); + iio_trigger_unregister(st->trig); +- iio_trigger_put(st->trig); ++ iio_trigger_free(st->trig); + + return 0; + } +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 235e150d7b81..80d0ffe7abc1 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -163,18 +163,17 @@ static const struct plat_sci_reg sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = { + }, + + /* +- * Common definitions for legacy IrDA ports, dependent on +- * regshift value. ++ * Common definitions for legacy IrDA ports. + */ + [SCIx_IRDA_REGTYPE] = { + [SCSMR] = { 0x00, 8 }, +- [SCBRR] = { 0x01, 8 }, +- [SCSCR] = { 0x02, 8 }, +- [SCxTDR] = { 0x03, 8 }, +- [SCxSR] = { 0x04, 8 }, +- [SCxRDR] = { 0x05, 8 }, +- [SCFCR] = { 0x06, 8 }, +- [SCFDR] = { 0x07, 16 }, ++ [SCBRR] = { 0x02, 8 }, ++ [SCSCR] = { 0x04, 8 }, ++ [SCxTDR] = { 0x06, 8 }, ++ [SCxSR] = { 0x08, 16 }, ++ [SCxRDR] = { 0x0a, 8 }, ++ [SCFCR] = { 0x0c, 8 }, ++ [SCFDR] = { 0x0e, 16 }, + [SCTFDR] = sci_reg_invalid, + [SCRFDR] = sci_reg_invalid, + [SCSPTR] = sci_reg_invalid, +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 5c0952995280..87a83d925eea 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2997,6 +2997,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) + } + + usb_put_invalidate_rhdev(hcd); ++ hcd->flags = 0; + } + EXPORT_SYMBOL_GPL(usb_remove_hcd); + +diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c +index 914a52ba8477..77837665ce89 100644 +--- a/drivers/video/fbdev/pmag-ba-fb.c ++++ b/drivers/video/fbdev/pmag-ba-fb.c +@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = { + /* + * Turn the hardware cursor off. + */ +-static void __init pmagbafb_erase_cursor(struct fb_info *info) ++static void pmagbafb_erase_cursor(struct fb_info *info) + { + struct pmagbafb_par *par = info->par; + +diff --git a/include/linux/phy.h b/include/linux/phy.h +index b64825d6ad26..5bc4b9d563a9 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -136,11 +136,7 @@ static inline const char *phy_modes(phy_interface_t interface) + /* Used when trying to connect to a specific phy (mii bus id:phy device id) */ + #define PHY_ID_FMT "%s:%02x" + +-/* +- * Need to be a little smaller than phydev->dev.bus_id to leave room +- * for the ":%02x" +- */ +-#define MII_BUS_ID_SIZE (20 - 3) ++#define MII_BUS_ID_SIZE 61 + + /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit + IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */ +@@ -599,7 +595,7 @@ struct phy_driver { + /* A Structure for boards to register fixups with the PHY Lib */ + struct phy_fixup { + struct list_head list; +- char bus_id[20]; ++ char bus_id[MII_BUS_ID_SIZE + 3]; + u32 phy_uid; + u32 phy_uid_mask; + int (*run)(struct phy_device *phydev); +diff --git a/include/linux/preempt.h b/include/linux/preempt.h +index 75e4e30677f1..7eeceac52dea 100644 +--- a/include/linux/preempt.h ++++ b/include/linux/preempt.h +@@ -65,19 +65,24 @@ + + /* + * Are we doing bottom half or hardware interrupt processing? +- * Are we in a softirq context? Interrupt context? +- * in_softirq - Are we currently processing softirq or have bh disabled? +- * in_serving_softirq - Are we currently processing softirq? ++ * ++ * in_irq() - We're in (hard) IRQ context ++ * in_softirq() - We have BH disabled, or are processing softirqs ++ * in_interrupt() - We're in NMI,IRQ,SoftIRQ context or have BH disabled ++ * in_serving_softirq() - We're in softirq context ++ * in_nmi() - We're in NMI context ++ * in_task() - We're in task context ++ * ++ * Note: due to the BH disabled confusion: in_softirq(),in_interrupt() really ++ * should not be used in new code. + */ + #define in_irq() (hardirq_count()) + #define in_softirq() (softirq_count()) + #define in_interrupt() (irq_count()) + #define in_serving_softirq() (softirq_count() & SOFTIRQ_OFFSET) +- +-/* +- * Are we in NMI context? +- */ +-#define in_nmi() (preempt_count() & NMI_MASK) ++#define in_nmi() (preempt_count() & NMI_MASK) ++#define in_task() (!(preempt_count() & \ ++ (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET))) + + /* + * The preempt_count offset after preempt_disable(); +diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h +index 3a375d07d0dc..6670e9b34f20 100644 +--- a/include/linux/usb/cdc_ncm.h ++++ b/include/linux/usb/cdc_ncm.h +@@ -82,6 +82,7 @@ + + /* Driver flags */ + #define CDC_NCM_FLAG_NDP_TO_END 0x02 /* NDP is placed at end of frame */ ++#define CDC_NCM_FLAG_RESET_NTB16 0x08 /* set NDP16 one more time after altsetting switch */ + + #define cdc_ncm_comm_intf_is_mbim(x) ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \ + (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE) +diff --git a/include/sound/seq_kernel.h b/include/sound/seq_kernel.h +index feb58d455560..4b9ee3009aa0 100644 +--- a/include/sound/seq_kernel.h ++++ b/include/sound/seq_kernel.h +@@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_timestamp_t; + #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS 200 + + /* max delivery path length */ +-#define SNDRV_SEQ_MAX_HOPS 10 ++/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */ ++#define SNDRV_SEQ_MAX_HOPS 8 + + /* max size of event size */ + #define SNDRV_SEQ_MAX_EVENT_LEN 0x3fffffff +diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h +index 45215870ac6c..3fa9c146fccb 100644 +--- a/kernel/workqueue_internal.h ++++ b/kernel/workqueue_internal.h +@@ -9,6 +9,7 @@ + + #include <linux/workqueue.h> + #include <linux/kthread.h> ++#include <linux/preempt.h> + + struct worker_pool; + +@@ -59,7 +60,7 @@ struct worker { + */ + static inline struct worker *current_wq_worker(void) + { +- if (current->flags & PF_WQ_WORKER) ++ if (in_task() && (current->flags & PF_WQ_WORKER)) + return kthread_data(current); + return NULL; + } +diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c +index faa2a3f017f8..4fa2e54b3f59 100644 +--- a/lib/asn1_decoder.c ++++ b/lib/asn1_decoder.c +@@ -227,7 +227,7 @@ next_op: + hdr = 2; + + /* Extract a tag from the data */ +- if (unlikely(dp >= datalen - 1)) ++ if (unlikely(datalen - dp < 2)) + goto data_overrun_error; + tag = data[dp++]; + if (unlikely((tag & 0x1f) == ASN1_LONG_TAG)) +@@ -273,7 +273,7 @@ next_op: + int n = len - 0x80; + if (unlikely(n > 2)) + goto length_too_long; +- if (unlikely(dp >= datalen - n)) ++ if (unlikely(n > datalen - dp)) + goto data_overrun_error; + hdr += n; + for (len = 0; n > 0; n--) { +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 86374c1c49a4..841191061816 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -65,14 +65,19 @@ static ssize_t trigger_request_store(struct device *dev, + release_firmware(test_firmware); + test_firmware = NULL; + rc = request_firmware(&test_firmware, name, dev); +- if (rc) ++ if (rc) { + pr_info("load of '%s' failed: %d\n", name, rc); +- pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0); ++ goto out; ++ } ++ pr_info("loaded: %zu\n", test_firmware->size); ++ rc = count; ++ ++out: + mutex_unlock(&test_fw_mutex); + + kfree(name); + +- return count; ++ return rc; + } + static DEVICE_ATTR_WO(trigger_request); + +diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig +index ff7736f7ff42..fc0c09e770e6 100644 +--- a/net/dsa/Kconfig ++++ b/net/dsa/Kconfig +@@ -1,12 +1,13 @@ + config HAVE_NET_DSA + def_bool y +- depends on NETDEVICES && !S390 ++ depends on INET && NETDEVICES && !S390 + + # Drivers must select NET_DSA and the appropriate tagging format + + config NET_DSA + tristate "Distributed Switch Architecture" +- depends on HAVE_NET_DSA && NET_SWITCHDEV ++ depends on HAVE_NET_DSA ++ select NET_SWITCHDEV + select PHYLIB + ---help--- + Say Y if you want to enable support for the hardware switches supported +diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c +index f2a71025a770..22377c8ff14b 100644 +--- a/net/ipv4/ah4.c ++++ b/net/ipv4/ah4.c +@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request *base, int err) + int ihl = ip_hdrlen(skb); + int ah_hlen = (ah->hdrlen + 2) << 2; + ++ if (err) ++ goto out; ++ + work_iph = AH_SKB_CB(skb)->tmp; + auth_data = ah_tmp_auth(work_iph, ihl); + icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len); +diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c +index 9dfaf4d55ee0..a97a5bf716be 100644 +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -151,8 +151,34 @@ void nft_meta_get_eval(const struct nft_expr *expr, + else + *dest = PACKET_BROADCAST; + break; ++ case NFPROTO_NETDEV: ++ switch (skb->protocol) { ++ case htons(ETH_P_IP): { ++ int noff = skb_network_offset(skb); ++ struct iphdr *iph, _iph; ++ ++ iph = skb_header_pointer(skb, noff, ++ sizeof(_iph), &_iph); ++ if (!iph) ++ goto err; ++ ++ if (ipv4_is_multicast(iph->daddr)) ++ *dest = PACKET_MULTICAST; ++ else ++ *dest = PACKET_BROADCAST; ++ ++ break; ++ } ++ case htons(ETH_P_IPV6): ++ *dest = PACKET_MULTICAST; ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ goto err; ++ } ++ break; + default: +- WARN_ON(1); ++ WARN_ON_ONCE(1); + goto err; + } + break; +diff --git a/security/keys/trusted.c b/security/keys/trusted.c +index 509aedcf8310..214ae2dc7f64 100644 +--- a/security/keys/trusted.c ++++ b/security/keys/trusted.c +@@ -69,7 +69,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen, + } + + ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest); +- kfree(sdesc); ++ kzfree(sdesc); + return ret; + } + +@@ -113,7 +113,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key, + if (!ret) + ret = crypto_shash_final(&sdesc->shash, digest); + out: +- kfree(sdesc); ++ kzfree(sdesc); + return ret; + } + +@@ -164,7 +164,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key, + paramdigest, TPM_NONCE_SIZE, h1, + TPM_NONCE_SIZE, h2, 1, &c, 0, 0); + out: +- kfree(sdesc); ++ kzfree(sdesc); + return ret; + } + +@@ -245,7 +245,7 @@ static int TSS_checkhmac1(unsigned char *buffer, + if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE)) + ret = -EINVAL; + out: +- kfree(sdesc); ++ kzfree(sdesc); + return ret; + } + +@@ -346,7 +346,7 @@ static int TSS_checkhmac2(unsigned char *buffer, + if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE)) + ret = -EINVAL; + out: +- kfree(sdesc); ++ kzfree(sdesc); + return ret; + } + +@@ -563,7 +563,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, + *bloblen = storedsize; + } + out: +- kfree(td); ++ kzfree(td); + return ret; + } + +@@ -677,7 +677,7 @@ static int key_seal(struct trusted_key_payload *p, + if (ret < 0) + pr_info("trusted_key: srkseal failed (%d)\n", ret); + +- kfree(tb); ++ kzfree(tb); + return ret; + } + +@@ -702,7 +702,7 @@ static int key_unseal(struct trusted_key_payload *p, + /* pull migratable flag out of sealed key */ + p->migratable = p->key[--p->key_len]; + +- kfree(tb); ++ kzfree(tb); + return ret; + } + +@@ -984,12 +984,12 @@ static int trusted_instantiate(struct key *key, + if (!ret && options->pcrlock) + ret = pcrlock(options->pcrlock); + out: +- kfree(datablob); +- kfree(options); ++ kzfree(datablob); ++ kzfree(options); + if (!ret) + rcu_assign_keypointer(key, payload); + else +- kfree(payload); ++ kzfree(payload); + return ret; + } + +@@ -998,8 +998,7 @@ static void trusted_rcu_free(struct rcu_head *rcu) + struct trusted_key_payload *p; + + p = container_of(rcu, struct trusted_key_payload, rcu); +- memset(p->key, 0, p->key_len); +- kfree(p); ++ kzfree(p); + } + + /* +@@ -1041,13 +1040,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) + ret = datablob_parse(datablob, new_p, new_o); + if (ret != Opt_update) { + ret = -EINVAL; +- kfree(new_p); ++ kzfree(new_p); + goto out; + } + + if (!new_o->keyhandle) { + ret = -EINVAL; +- kfree(new_p); ++ kzfree(new_p); + goto out; + } + +@@ -1061,22 +1060,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) + ret = key_seal(new_p, new_o); + if (ret < 0) { + pr_info("trusted_key: key_seal failed (%d)\n", ret); +- kfree(new_p); ++ kzfree(new_p); + goto out; + } + if (new_o->pcrlock) { + ret = pcrlock(new_o->pcrlock); + if (ret < 0) { + pr_info("trusted_key: pcrlock failed (%d)\n", ret); +- kfree(new_p); ++ kzfree(new_p); + goto out; + } + } + rcu_assign_keypointer(key, new_p); + call_rcu(&p->rcu, trusted_rcu_free); + out: +- kfree(datablob); +- kfree(new_o); ++ kzfree(datablob); ++ kzfree(new_o); + return ret; + } + +@@ -1095,34 +1094,30 @@ static long trusted_read(const struct key *key, char __user *buffer, + p = rcu_dereference_key(key); + if (!p) + return -EINVAL; +- if (!buffer || buflen <= 0) +- return 2 * p->blob_len; +- ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); +- if (!ascii_buf) +- return -ENOMEM; + +- bufp = ascii_buf; +- for (i = 0; i < p->blob_len; i++) +- bufp = hex_byte_pack(bufp, p->blob[i]); +- if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) { +- kfree(ascii_buf); +- return -EFAULT; ++ if (buffer && buflen >= 2 * p->blob_len) { ++ ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); ++ if (!ascii_buf) ++ return -ENOMEM; ++ ++ bufp = ascii_buf; ++ for (i = 0; i < p->blob_len; i++) ++ bufp = hex_byte_pack(bufp, p->blob[i]); ++ if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) { ++ kzfree(ascii_buf); ++ return -EFAULT; ++ } ++ kzfree(ascii_buf); + } +- kfree(ascii_buf); + return 2 * p->blob_len; + } + + /* +- * trusted_destroy - before freeing the key, clear the decrypted data ++ * trusted_destroy - clear and free the key's payload + */ + static void trusted_destroy(struct key *key) + { +- struct trusted_key_payload *p = key->payload.data[0]; +- +- if (!p) +- return; +- memset(p->key, 0, p->key_len); +- kfree(key->payload.data[0]); ++ kzfree(key->payload.data[0]); + } + + struct key_type key_type_trusted = { +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index aaff9ee32695..b30b2139e3f0 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq + if (!dp->timer->running) + len = snd_seq_oss_timer_start(dp->timer); + if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { +- if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE) +- snd_seq_oss_readq_puts(dp->readq, mdev->seq_device, +- ev->data.ext.ptr, ev->data.ext.len); ++ snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev); + } else { + len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev); + if (len > 0) +diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c +index 046cb586fb2f..06b21226b4e7 100644 +--- a/sound/core/seq/oss/seq_oss_readq.c ++++ b/sound/core/seq/oss/seq_oss_readq.c +@@ -117,6 +117,35 @@ snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, in + return 0; + } + ++/* ++ * put MIDI sysex bytes; the event buffer may be chained, thus it has ++ * to be expanded via snd_seq_dump_var_event(). ++ */ ++struct readq_sysex_ctx { ++ struct seq_oss_readq *readq; ++ int dev; ++}; ++ ++static int readq_dump_sysex(void *ptr, void *buf, int count) ++{ ++ struct readq_sysex_ctx *ctx = ptr; ++ ++ return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count); ++} ++ ++int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, ++ struct snd_seq_event *ev) ++{ ++ struct readq_sysex_ctx ctx = { ++ .readq = q, ++ .dev = dev ++ }; ++ ++ if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) ++ return 0; ++ return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx); ++} ++ + /* + * copy an event to input queue: + * return zero if enqueued +diff --git a/sound/core/seq/oss/seq_oss_readq.h b/sound/core/seq/oss/seq_oss_readq.h +index f1463f1f449e..8d033ca2d23f 100644 +--- a/sound/core/seq/oss/seq_oss_readq.h ++++ b/sound/core/seq/oss/seq_oss_readq.h +@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq_oss_readq *q); + void snd_seq_oss_readq_clear(struct seq_oss_readq *readq); + unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait); + int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len); ++int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, ++ struct snd_seq_event *ev); + int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev); + int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode); + int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec); +diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh +index c4366dc74e01..856a1f327b3f 100755 +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -48,8 +48,16 @@ echo "ABCD0123" >"$FW" + + NAME=$(basename "$FW") + ++if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then ++ echo "$0: empty filename should not succeed" >&2 ++ exit 1 ++fi ++ + # Request a firmware that doesn't exist, it should fail. +-echo -n "nope-$NAME" >"$DIR"/trigger_request ++if echo -n "nope-$NAME" >"$DIR"/trigger_request 2> /dev/null; then ++ echo "$0: firmware shouldn't have loaded" >&2 ++ exit 1 ++fi + if diff -q "$FW" /dev/test_firmware >/dev/null ; then + echo "$0: firmware was not expected to match" >&2 + exit 1 +diff --git a/tools/testing/selftests/firmware/fw_userhelper.sh b/tools/testing/selftests/firmware/fw_userhelper.sh +index b9983f8e09f6..01c626a1f226 100755 +--- a/tools/testing/selftests/firmware/fw_userhelper.sh ++++ b/tools/testing/selftests/firmware/fw_userhelper.sh +@@ -64,9 +64,33 @@ trap "test_finish" EXIT + echo "ABCD0123" >"$FW" + NAME=$(basename "$FW") + ++DEVPATH="$DIR"/"nope-$NAME"/loading ++ + # Test failure when doing nothing (timeout works). +-echo 1 >/sys/class/firmware/timeout +-echo -n "$NAME" >"$DIR"/trigger_request ++echo -n 2 >/sys/class/firmware/timeout ++echo -n "nope-$NAME" >"$DIR"/trigger_request 2>/dev/null & ++ ++# Give the kernel some time to load the loading file, must be less ++# than the timeout above. ++sleep 1 ++if [ ! -f $DEVPATH ]; then ++ echo "$0: fallback mechanism immediately cancelled" ++ echo "" ++ echo "The file never appeared: $DEVPATH" ++ echo "" ++ echo "This might be a distribution udev rule setup by your distribution" ++ echo "to immediately cancel all fallback requests, this must be" ++ echo "removed before running these tests. To confirm look for" ++ echo "a firmware rule like /lib/udev/rules.d/50-firmware.rules" ++ echo "and see if you have something like this:" ++ echo "" ++ echo "SUBSYSTEM==\"firmware\", ACTION==\"add\", ATTR{loading}=\"-1\"" ++ echo "" ++ echo "If you do remove this file or comment out this line before" ++ echo "proceeding with these tests." ++ exit 1 ++fi ++ + if diff -q "$FW" /dev/test_firmware >/dev/null ; then + echo "$0: firmware was not expected to match" >&2 + exit 1
