commit: 255753c89d48f9d5e6428111ab1439c1ed6d1985 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun Jan 13 19:29:52 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun Jan 13 19:29:52 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=255753c8
proj/linux-patches: Linux patch 4.20.2 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1001_linux-4.20.2.patch | 3086 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3090 insertions(+) diff --git a/0000_README b/0000_README index 543d775..0e0dc28 100644 --- a/0000_README +++ b/0000_README @@ -47,6 +47,10 @@ Patch: 1000_linux-4.20.1.patch From: http://www.kernel.org Desc: Linux 4.20.1 +Patch: 1001_linux-4.20.2.patch +From: http://www.kernel.org +Desc: Linux 4.20.2 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1001_linux-4.20.2.patch b/1001_linux-4.20.2.patch new file mode 100644 index 0000000..212bec9 --- /dev/null +++ b/1001_linux-4.20.2.patch @@ -0,0 +1,3086 @@ +diff --git a/Makefile b/Makefile +index 84d2f8deea30..4ba3dd0bf35d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 20 +-SUBLEVEL = 1 ++SUBLEVEL = 2 + EXTRAVERSION = + NAME = Shy Crocodile + +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index 6327fd79b0fb..fd59fef9931b 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs, + /* If TM bits are set to the reserved value, it's an invalid context */ + if (MSR_TM_RESV(msr_hi)) + return 1; +- /* Pull in the MSR TM bits from the user context */ ++ ++ /* ++ * Disabling preemption, since it is unsafe to be preempted ++ * with MSR[TS] set without recheckpointing. ++ */ ++ preempt_disable(); ++ ++ /* ++ * CAUTION: ++ * After regs->MSR[TS] being updated, make sure that get_user(), ++ * put_user() or similar functions are *not* called. These ++ * functions can generate page faults which will cause the process ++ * to be de-scheduled with MSR[TS] set but without calling ++ * tm_recheckpoint(). This can cause a bug. ++ * ++ * Pull in the MSR TM bits from the user context ++ */ + regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK); + /* Now, recheckpoint. This loads up all of the checkpointed (older) + * registers, including FP and V[S]Rs. After recheckpointing, the +@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs, + } + #endif + ++ preempt_enable(); ++ + return 0; + } + #endif +@@ -1140,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn) + { + struct rt_sigframe __user *rt_sf; + struct pt_regs *regs = current_pt_regs(); +- int tm_restore = 0; + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM + struct ucontext __user *uc_transact; + unsigned long msr_hi; + unsigned long tmp; ++ int tm_restore = 0; + #endif + /* Always make any pending restarted system calls return -EINTR */ + current->restart_block.fn = do_no_restart_syscall; +@@ -1192,19 +1210,11 @@ SYSCALL_DEFINE0(rt_sigreturn) + goto bad; + } + } +- if (!tm_restore) { +- /* +- * Unset regs->msr because ucontext MSR TS is not +- * set, and recheckpoint was not called. This avoid +- * hitting a TM Bad thing at RFID +- */ +- regs->msr &= ~MSR_TS_MASK; +- } +- /* Fall through, for non-TM restore */ +-#endif + if (!tm_restore) +- if (do_setcontext(&rt_sf->uc, regs, 1)) +- goto bad; ++ /* Fall through, for non-TM restore */ ++#endif ++ if (do_setcontext(&rt_sf->uc, regs, 1)) ++ goto bad; + + /* + * It's not clear whether or why it is desirable to save the +diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c +index daa28cb72272..bbd1c73243d7 100644 +--- a/arch/powerpc/kernel/signal_64.c ++++ b/arch/powerpc/kernel/signal_64.c +@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, + if (MSR_TM_RESV(msr)) + return -EINVAL; + +- /* pull in MSR TS bits from user context */ +- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); +- +- /* +- * Ensure that TM is enabled in regs->msr before we leave the signal +- * handler. It could be the case that (a) user disabled the TM bit +- * through the manipulation of the MSR bits in uc_mcontext or (b) the +- * TM bit was disabled because a sufficient number of context switches +- * happened whilst in the signal handler and load_tm overflowed, +- * disabling the TM bit. In either case we can end up with an illegal +- * TM state leading to a TM Bad Thing when we return to userspace. +- */ +- regs->msr |= MSR_TM; +- + /* pull in MSR LE from user context */ + regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE); + +@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, + tm_enable(); + /* Make sure the transaction is marked as failed */ + tsk->thread.tm_texasr |= TEXASR_FS; ++ ++ /* ++ * Disabling preemption, since it is unsafe to be preempted ++ * with MSR[TS] set without recheckpointing. ++ */ ++ preempt_disable(); ++ ++ /* pull in MSR TS bits from user context */ ++ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); ++ ++ /* ++ * Ensure that TM is enabled in regs->msr before we leave the signal ++ * handler. It could be the case that (a) user disabled the TM bit ++ * through the manipulation of the MSR bits in uc_mcontext or (b) the ++ * TM bit was disabled because a sufficient number of context switches ++ * happened whilst in the signal handler and load_tm overflowed, ++ * disabling the TM bit. In either case we can end up with an illegal ++ * TM state leading to a TM Bad Thing when we return to userspace. ++ * ++ * CAUTION: ++ * After regs->MSR[TS] being updated, make sure that get_user(), ++ * put_user() or similar functions are *not* called. These ++ * functions can generate page faults which will cause the process ++ * to be de-scheduled with MSR[TS] set but without calling ++ * tm_recheckpoint(). This can cause a bug. ++ */ ++ regs->msr |= MSR_TM; ++ + /* This loads the checkpointed FP/VEC state, if used */ + tm_recheckpoint(&tsk->thread); + +@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk, + regs->msr |= MSR_VEC; + } + ++ preempt_enable(); ++ + return err; + } + #endif +@@ -740,23 +756,11 @@ SYSCALL_DEFINE0(rt_sigreturn) + &uc_transact->uc_mcontext)) + goto badframe; + } +-#endif ++ else + /* Fall through, for non-TM restore */ +- if (!MSR_TM_ACTIVE(msr)) { +- /* +- * Unset MSR[TS] on the thread regs since MSR from user +- * context does not have MSR active, and recheckpoint was +- * not called since restore_tm_sigcontexts() was not called +- * also. +- * +- * If not unsetting it, the code can RFID to userspace with +- * MSR[TS] set, but without CPU in the proper state, +- * causing a TM bad thing. +- */ +- current->thread.regs->msr &= ~MSR_TS_MASK; +- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext)) +- goto badframe; +- } ++#endif ++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext)) ++ goto badframe; + + if (restore_altstack(&uc->uc_stack)) + goto badframe; +diff --git a/arch/powerpc/platforms/4xx/ocm.c b/arch/powerpc/platforms/4xx/ocm.c +index f5bbd4563342..3632de52db0a 100644 +--- a/arch/powerpc/platforms/4xx/ocm.c ++++ b/arch/powerpc/platforms/4xx/ocm.c +@@ -179,7 +179,7 @@ static void __init ocm_init_node(int count, struct device_node *node) + /* ioremap the non-cached region */ + if (ocm->nc.memtotal) { + ocm->nc.virt = __ioremap(ocm->nc.phys, ocm->nc.memtotal, +- _PAGE_EXEC | PAGE_KERNEL_NCG); ++ _PAGE_EXEC | pgprot_val(PAGE_KERNEL_NCG)); + + if (!ocm->nc.virt) { + printk(KERN_ERR +@@ -194,7 +194,7 @@ static void __init ocm_init_node(int count, struct device_node *node) + + if (ocm->c.memtotal) { + ocm->c.virt = __ioremap(ocm->c.phys, ocm->c.memtotal, +- _PAGE_EXEC | PAGE_KERNEL); ++ _PAGE_EXEC | pgprot_val(PAGE_KERNEL)); + + if (!ocm->c.virt) { + printk(KERN_ERR +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 29bfe8017a2d..da1de190a3b1 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -54,13 +54,14 @@ void blk_mq_sched_assign_ioc(struct request *rq, struct bio *bio) + * Mark a hardware queue as needing a restart. For shared queues, maintain + * a count of how many hardware queues are marked for restart. + */ +-static void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx) ++void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx) + { + if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state)) + return; + + set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state); + } ++EXPORT_SYMBOL_GPL(blk_mq_sched_mark_restart_hctx); + + void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx) + { +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index 8a9544203173..38e06e23821f 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -15,6 +15,7 @@ bool blk_mq_sched_try_merge(struct request_queue *q, struct bio *bio, + struct request **merged_request); + bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio); + bool blk_mq_sched_try_insert_merge(struct request_queue *q, struct request *rq); ++void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx); + void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx); + + void blk_mq_sched_insert_request(struct request *rq, bool at_head, +diff --git a/block/blk-stat.h b/block/blk-stat.h +index f4a1568e81a4..17b47a86eefb 100644 +--- a/block/blk-stat.h ++++ b/block/blk-stat.h +@@ -145,6 +145,11 @@ static inline void blk_stat_activate_nsecs(struct blk_stat_callback *cb, + mod_timer(&cb->timer, jiffies + nsecs_to_jiffies(nsecs)); + } + ++static inline void blk_stat_deactivate(struct blk_stat_callback *cb) ++{ ++ del_timer_sync(&cb->timer); ++} ++ + /** + * blk_stat_activate_msecs() - Gather block statistics during a time window in + * milliseconds. +diff --git a/block/blk-wbt.c b/block/blk-wbt.c +index 8ac93fcbaa2e..0c62bf4eca75 100644 +--- a/block/blk-wbt.c ++++ b/block/blk-wbt.c +@@ -760,8 +760,10 @@ void wbt_disable_default(struct request_queue *q) + if (!rqos) + return; + rwb = RQWB(rqos); +- if (rwb->enable_state == WBT_STATE_ON_DEFAULT) ++ if (rwb->enable_state == WBT_STATE_ON_DEFAULT) { ++ blk_stat_deactivate(rwb->cb); + rwb->wb_normal = 0; ++ } + } + EXPORT_SYMBOL_GPL(wbt_disable_default); + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 099a9e05854c..d5e21ce44d2c 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -373,9 +373,16 @@ done: + + /* + * One confusing aspect here is that we get called for a specific +- * hardware queue, but we return a request that may not be for a ++ * hardware queue, but we may return a request that is for a + * different hardware queue. This is because mq-deadline has shared + * state for all hardware queues, in terms of sorting, FIFOs, etc. ++ * ++ * For a zoned block device, __dd_dispatch_request() may return NULL ++ * if all the queued write requests are directed at zones that are already ++ * locked due to on-going write requests. In this case, make sure to mark ++ * the queue as needing a restart to ensure that the queue is run again ++ * and the pending writes dispatched once the target zones for the ongoing ++ * write requests are unlocked in dd_finish_request(). + */ + static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx) + { +@@ -384,6 +391,9 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx) + + spin_lock(&dd->lock); + rq = __dd_dispatch_request(dd); ++ if (!rq && blk_queue_is_zoned(hctx->queue) && ++ !list_empty(&dd->fifo_list[WRITE])) ++ blk_mq_sched_mark_restart_hctx(hctx); + spin_unlock(&dd->lock); + + return rq; +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 169412ee4ae8..dbba123e058d 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -933,11 +933,11 @@ static void __device_release_driver(struct device *dev, struct device *parent) + + while (device_links_busy(dev)) { + device_unlock(dev); +- if (parent) ++ if (parent && dev->bus->need_parent_lock) + device_unlock(parent); + + device_links_unbind_consumers(dev); +- if (parent) ++ if (parent && dev->bus->need_parent_lock) + device_lock(parent); + + device_lock(dev); +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 4879595200e1..8e6a0db6555f 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -382,8 +382,10 @@ static ssize_t backing_dev_store(struct device *dev, + + bdev = bdgrab(I_BDEV(inode)); + err = blkdev_get(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL, zram); +- if (err < 0) ++ if (err < 0) { ++ bdev = NULL; + goto out; ++ } + + nr_pages = i_size_read(inode) >> PAGE_SHIFT; + bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long); +diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c +index 99e2aace8078..2c1f459c0c63 100644 +--- a/drivers/dax/pmem.c ++++ b/drivers/dax/pmem.c +@@ -48,9 +48,8 @@ static void dax_pmem_percpu_exit(void *data) + percpu_ref_exit(ref); + } + +-static void dax_pmem_percpu_kill(void *data) ++static void dax_pmem_percpu_kill(struct percpu_ref *ref) + { +- struct percpu_ref *ref = data; + struct dax_pmem *dax_pmem = to_dax_pmem(ref); + + dev_dbg(dax_pmem->dev, "trace\n"); +@@ -112,17 +111,10 @@ static int dax_pmem_probe(struct device *dev) + } + + dax_pmem->pgmap.ref = &dax_pmem->ref; ++ dax_pmem->pgmap.kill = dax_pmem_percpu_kill; + addr = devm_memremap_pages(dev, &dax_pmem->pgmap); +- if (IS_ERR(addr)) { +- devm_remove_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref); +- percpu_ref_exit(&dax_pmem->ref); ++ if (IS_ERR(addr)) + return PTR_ERR(addr); +- } +- +- rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill, +- &dax_pmem->ref); +- if (rc) +- return rc; + + /* adjust the dax_region resource to the start of data */ + memcpy(&res, &dax_pmem->pgmap.res, sizeof(res)); +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index db1bf7f88c1f..e0e6d66de745 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -1262,8 +1262,16 @@ nv50_mstm_fini(struct nv50_mstm *mstm) + static void + nv50_mstm_init(struct nv50_mstm *mstm) + { +- if (mstm && mstm->mgr.mst_state) +- drm_dp_mst_topology_mgr_resume(&mstm->mgr); ++ int ret; ++ ++ if (!mstm || !mstm->mgr.mst_state) ++ return; ++ ++ ret = drm_dp_mst_topology_mgr_resume(&mstm->mgr); ++ if (ret == -1) { ++ drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, false); ++ drm_kms_helper_hotplug_event(mstm->mgr.dev); ++ } + } + + static void +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c +index 79d00d861a31..01ff3c858875 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c +@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all); + int rockchip_drm_psr_register(struct drm_encoder *encoder, + int (*psr_set)(struct drm_encoder *, bool enable)) + { +- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private; ++ struct rockchip_drm_private *drm_drv; + struct psr_drv *psr; + + if (!encoder || !psr_set) + return -EINVAL; + ++ drm_drv = encoder->dev->dev_private; ++ + psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL); + if (!psr) + return -ENOMEM; +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index c6635f23918a..ae6254b0b1ae 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -321,6 +321,7 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + if (vc4_state->is_unity) + vc4_state->x_scaling[0] = VC4_SCALING_PPF; + } else { ++ vc4_state->is_yuv = false; + vc4_state->x_scaling[1] = VC4_SCALING_NONE; + vc4_state->y_scaling[1] = VC4_SCALING_NONE; + } +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index d293e55553bd..ba7aaf421f36 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1423,7 +1423,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr, + if (!end) + break; + +- len -= end - p; ++ /* consume the number and the following comma, hence +1 */ ++ len -= end - p + 1; + p = end + 1; + } while (len); + +diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c +index 0910ec807187..4b9e44b227d8 100644 +--- a/drivers/hwtracing/stm/policy.c ++++ b/drivers/hwtracing/stm/policy.c +@@ -440,10 +440,8 @@ stp_policy_make(struct config_group *group, const char *name) + + stm->policy = kzalloc(sizeof(*stm->policy), GFP_KERNEL); + if (!stm->policy) { +- mutex_unlock(&stm->policy_mutex); +- stm_put_protocol(pdrv); +- stm_put_device(stm); +- return ERR_PTR(-ENOMEM); ++ ret = ERR_PTR(-ENOMEM); ++ goto unlock_policy; + } + + config_group_init_type_name(&stm->policy->group, name, +@@ -458,7 +456,11 @@ unlock_policy: + mutex_unlock(&stm->policy_mutex); + + if (IS_ERR(ret)) { +- stm_put_protocol(stm->pdrv); ++ /* ++ * pdrv and stm->pdrv at this point can be quite different, ++ * and only one of them needs to be 'put' ++ */ ++ stm_put_protocol(pdrv); + stm_put_device(stm); + } + +diff --git a/drivers/iio/adc/qcom-spmi-adc5.c b/drivers/iio/adc/qcom-spmi-adc5.c +index f9af6b082916..6a866cc187f7 100644 +--- a/drivers/iio/adc/qcom-spmi-adc5.c ++++ b/drivers/iio/adc/qcom-spmi-adc5.c +@@ -423,6 +423,7 @@ struct adc5_channels { + enum vadc_scale_fn_type scale_fn_type; + }; + ++/* In these definitions, _pre refers to an index into adc5_prescale_ratios. */ + #define ADC5_CHAN(_dname, _type, _mask, _pre, _scale) \ + { \ + .datasheet_name = _dname, \ +@@ -443,63 +444,63 @@ struct adc5_channels { + _pre, _scale) \ + + static const struct adc5_channels adc5_chans_pmic[ADC5_MAX_CHANNEL] = { +- [ADC5_REF_GND] = ADC5_CHAN_VOLT("ref_gnd", 1, ++ [ADC5_REF_GND] = ADC5_CHAN_VOLT("ref_gnd", 0, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_1P25VREF] = ADC5_CHAN_VOLT("vref_1p25", 1, ++ [ADC5_1P25VREF] = ADC5_CHAN_VOLT("vref_1p25", 0, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_VPH_PWR] = ADC5_CHAN_VOLT("vph_pwr", 3, ++ [ADC5_VPH_PWR] = ADC5_CHAN_VOLT("vph_pwr", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_VBAT_SNS] = ADC5_CHAN_VOLT("vbat_sns", 3, ++ [ADC5_VBAT_SNS] = ADC5_CHAN_VOLT("vbat_sns", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_DIE_TEMP] = ADC5_CHAN_TEMP("die_temp", 1, ++ [ADC5_DIE_TEMP] = ADC5_CHAN_TEMP("die_temp", 0, + SCALE_HW_CALIB_PMIC_THERM) +- [ADC5_USB_IN_I] = ADC5_CHAN_VOLT("usb_in_i_uv", 1, ++ [ADC5_USB_IN_I] = ADC5_CHAN_VOLT("usb_in_i_uv", 0, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_USB_IN_V_16] = ADC5_CHAN_VOLT("usb_in_v_div_16", 16, ++ [ADC5_USB_IN_V_16] = ADC5_CHAN_VOLT("usb_in_v_div_16", 8, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_CHG_TEMP] = ADC5_CHAN_TEMP("chg_temp", 1, ++ [ADC5_CHG_TEMP] = ADC5_CHAN_TEMP("chg_temp", 0, + SCALE_HW_CALIB_PM5_CHG_TEMP) + /* Charger prescales SBUx and MID_CHG to fit within 1.8V upper unit */ +- [ADC5_SBUx] = ADC5_CHAN_VOLT("chg_sbux", 3, ++ [ADC5_SBUx] = ADC5_CHAN_VOLT("chg_sbux", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_MID_CHG_DIV6] = ADC5_CHAN_VOLT("chg_mid_chg", 6, ++ [ADC5_MID_CHG_DIV6] = ADC5_CHAN_VOLT("chg_mid_chg", 3, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_XO_THERM_100K_PU] = ADC5_CHAN_TEMP("xo_therm", 1, ++ [ADC5_XO_THERM_100K_PU] = ADC5_CHAN_TEMP("xo_therm", 0, + SCALE_HW_CALIB_XOTHERM) +- [ADC5_AMUX_THM1_100K_PU] = ADC5_CHAN_TEMP("amux_thm1_100k_pu", 1, ++ [ADC5_AMUX_THM1_100K_PU] = ADC5_CHAN_TEMP("amux_thm1_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM2_100K_PU] = ADC5_CHAN_TEMP("amux_thm2_100k_pu", 1, ++ [ADC5_AMUX_THM2_100K_PU] = ADC5_CHAN_TEMP("amux_thm2_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM3_100K_PU] = ADC5_CHAN_TEMP("amux_thm3_100k_pu", 1, ++ [ADC5_AMUX_THM3_100K_PU] = ADC5_CHAN_TEMP("amux_thm3_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM2] = ADC5_CHAN_TEMP("amux_thm2", 1, ++ [ADC5_AMUX_THM2] = ADC5_CHAN_TEMP("amux_thm2", 0, + SCALE_HW_CALIB_PM5_SMB_TEMP) + }; + + static const struct adc5_channels adc5_chans_rev2[ADC5_MAX_CHANNEL] = { +- [ADC5_REF_GND] = ADC5_CHAN_VOLT("ref_gnd", 1, ++ [ADC5_REF_GND] = ADC5_CHAN_VOLT("ref_gnd", 0, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_1P25VREF] = ADC5_CHAN_VOLT("vref_1p25", 1, ++ [ADC5_1P25VREF] = ADC5_CHAN_VOLT("vref_1p25", 0, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_VPH_PWR] = ADC5_CHAN_VOLT("vph_pwr", 3, ++ [ADC5_VPH_PWR] = ADC5_CHAN_VOLT("vph_pwr", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_VBAT_SNS] = ADC5_CHAN_VOLT("vbat_sns", 3, ++ [ADC5_VBAT_SNS] = ADC5_CHAN_VOLT("vbat_sns", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_VCOIN] = ADC5_CHAN_VOLT("vcoin", 3, ++ [ADC5_VCOIN] = ADC5_CHAN_VOLT("vcoin", 1, + SCALE_HW_CALIB_DEFAULT) +- [ADC5_DIE_TEMP] = ADC5_CHAN_TEMP("die_temp", 1, ++ [ADC5_DIE_TEMP] = ADC5_CHAN_TEMP("die_temp", 0, + SCALE_HW_CALIB_PMIC_THERM) +- [ADC5_AMUX_THM1_100K_PU] = ADC5_CHAN_TEMP("amux_thm1_100k_pu", 1, ++ [ADC5_AMUX_THM1_100K_PU] = ADC5_CHAN_TEMP("amux_thm1_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM2_100K_PU] = ADC5_CHAN_TEMP("amux_thm2_100k_pu", 1, ++ [ADC5_AMUX_THM2_100K_PU] = ADC5_CHAN_TEMP("amux_thm2_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM3_100K_PU] = ADC5_CHAN_TEMP("amux_thm3_100k_pu", 1, ++ [ADC5_AMUX_THM3_100K_PU] = ADC5_CHAN_TEMP("amux_thm3_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM4_100K_PU] = ADC5_CHAN_TEMP("amux_thm4_100k_pu", 1, ++ [ADC5_AMUX_THM4_100K_PU] = ADC5_CHAN_TEMP("amux_thm4_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_AMUX_THM5_100K_PU] = ADC5_CHAN_TEMP("amux_thm5_100k_pu", 1, ++ [ADC5_AMUX_THM5_100K_PU] = ADC5_CHAN_TEMP("amux_thm5_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) +- [ADC5_XO_THERM_100K_PU] = ADC5_CHAN_TEMP("xo_therm_100k_pu", 1, ++ [ADC5_XO_THERM_100K_PU] = ADC5_CHAN_TEMP("xo_therm_100k_pu", 0, + SCALE_HW_CALIB_THERM_100K_PULLUP) + }; + +@@ -558,6 +559,9 @@ static int adc5_get_dt_channel_data(struct adc5_chip *adc, + return ret; + } + prop->prescale = ret; ++ } else { ++ prop->prescale = ++ adc->data->adc_chans[prop->channel].prescale_index; + } + + ret = of_property_read_u32(node, "qcom,hw-settle-time", &value); +diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c +index 0e134b13967a..eae740fceed9 100644 +--- a/drivers/iio/dac/ad5686.c ++++ b/drivers/iio/dac/ad5686.c +@@ -124,7 +124,8 @@ static int ad5686_read_raw(struct iio_dev *indio_dev, + mutex_unlock(&indio_dev->mlock); + if (ret < 0) + return ret; +- *val = ret; ++ *val = (ret >> chan->scan_type.shift) & ++ GENMASK(chan->scan_type.realbits - 1, 0); + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + *val = st->vref_mv; +diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c +index ba668d49c751..476abc74178e 100644 +--- a/drivers/infiniband/core/iwcm.c ++++ b/drivers/infiniband/core/iwcm.c +@@ -502,17 +502,21 @@ static void iw_cm_check_wildcard(struct sockaddr_storage *pm_addr, + */ + static int iw_cm_map(struct iw_cm_id *cm_id, bool active) + { ++ const char *devname = dev_name(&cm_id->device->dev); ++ const char *ifname = cm_id->device->iwcm->ifname; + struct iwpm_dev_data pm_reg_msg; + struct iwpm_sa_data pm_msg; + int status; + ++ if (strlen(devname) >= sizeof(pm_reg_msg.dev_name) || ++ strlen(ifname) >= sizeof(pm_reg_msg.if_name)) ++ return -EINVAL; ++ + cm_id->m_local_addr = cm_id->local_addr; + cm_id->m_remote_addr = cm_id->remote_addr; + +- memcpy(pm_reg_msg.dev_name, dev_name(&cm_id->device->dev), +- sizeof(pm_reg_msg.dev_name)); +- memcpy(pm_reg_msg.if_name, cm_id->device->iwcm->ifname, +- sizeof(pm_reg_msg.if_name)); ++ strncpy(pm_reg_msg.dev_name, devname, sizeof(pm_reg_msg.dev_name)); ++ strncpy(pm_reg_msg.if_name, ifname, sizeof(pm_reg_msg.if_name)); + + if (iwpm_register_pid(&pm_reg_msg, RDMA_NL_IWCM) || + !iwpm_valid_pid()) +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index c962160292f4..f0438bc6df88 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -844,11 +844,16 @@ static enum resp_states do_complete(struct rxe_qp *qp, + + memset(&cqe, 0, sizeof(cqe)); + +- wc->wr_id = wqe->wr_id; +- wc->status = qp->resp.status; +- wc->qp = &qp->ibqp; ++ if (qp->rcq->is_user) { ++ uwc->status = qp->resp.status; ++ uwc->qp_num = qp->ibqp.qp_num; ++ uwc->wr_id = wqe->wr_id; ++ } else { ++ wc->status = qp->resp.status; ++ wc->qp = &qp->ibqp; ++ wc->wr_id = wqe->wr_id; ++ } + +- /* fields after status are not required for errors */ + if (wc->status == IB_WC_SUCCESS) { + wc->opcode = (pkt->mask & RXE_IMMDT_MASK && + pkt->mask & RXE_WRITE_MASK) ? +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 2357aa727dcf..96c767324575 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2010,6 +2010,14 @@ static void srpt_free_ch(struct kref *kref) + kfree_rcu(ch, rcu); + } + ++/* ++ * Shut down the SCSI target session, tell the connection manager to ++ * disconnect the associated RDMA channel, transition the QP to the error ++ * state and remove the channel from the channel list. This function is ++ * typically called from inside srpt_zerolength_write_done(). Concurrent ++ * srpt_zerolength_write() calls from inside srpt_close_ch() are possible ++ * as long as the channel is on sport->nexus_list. ++ */ + static void srpt_release_channel_work(struct work_struct *w) + { + struct srpt_rdma_ch *ch; +@@ -2037,6 +2045,11 @@ static void srpt_release_channel_work(struct work_struct *w) + else + ib_destroy_cm_id(ch->ib_cm.cm_id); + ++ sport = ch->sport; ++ mutex_lock(&sport->mutex); ++ list_del_rcu(&ch->list); ++ mutex_unlock(&sport->mutex); ++ + srpt_destroy_ch_ib(ch); + + srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring, +@@ -2047,11 +2060,6 @@ static void srpt_release_channel_work(struct work_struct *w) + sdev, ch->rq_size, + srp_max_req_size, DMA_FROM_DEVICE); + +- sport = ch->sport; +- mutex_lock(&sport->mutex); +- list_del_rcu(&ch->list); +- mutex_unlock(&sport->mutex); +- + wake_up(&sport->ch_releaseQ); + + kref_put(&ch->kref, srpt_free_ch); +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 41a4b8808802..f3afab82f3ee 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2044,7 +2044,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain, + * than default. Unnecessary for PT mode. + */ + if (translation != CONTEXT_TT_PASS_THROUGH) { +- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) { ++ for (agaw = domain->agaw; agaw > iommu->agaw; agaw--) { + ret = -ENOMEM; + pgd = phys_to_virt(dma_pte_addr(pgd)); + if (!dma_pte_present(pgd)) +@@ -2058,7 +2058,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain, + translation = CONTEXT_TT_MULTI_LEVEL; + + context_set_address_root(context, virt_to_phys(pgd)); +- context_set_address_width(context, iommu->agaw); ++ context_set_address_width(context, agaw); + } else { + /* + * In pass through mode, AW must be programmed to +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 9038c302d5c2..44f180e47622 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1927,6 +1927,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + */ + if (blk_queue_is_zoned(q)) + blk_revalidate_disk_zones(t->md->disk); ++ ++ /* Allow reads to exceed readahead limits */ ++ q->backing_dev_info->io_pages = limits->max_sectors >> (PAGE_SHIFT - 9); + } + + unsigned int dm_table_get_num_targets(struct dm_table *t) +diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c +index 39804d830305..fd5c52b21436 100644 +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -23,6 +23,7 @@ + #include <linux/moduleparam.h> + #include <linux/kmod.h> + #include <linux/kernel.h> ++#include <linux/pci.h> + #include <linux/slab.h> + #include <linux/interrupt.h> + #include <linux/delay.h> +@@ -41,6 +42,18 @@ MODULE_AUTHOR("Steven Toth <st...@linuxtv.org>"); + MODULE_LICENSE("GPL"); + MODULE_VERSION(CX23885_VERSION); + ++/* ++ * Some platforms have been found to require periodic resetting of the DMA ++ * engine. Ryzen and XEON platforms are known to be affected. The symptom ++ * encountered is "mpeg risc op code error". Only Ryzen platforms employ ++ * this workaround if the option equals 1. The workaround can be explicitly ++ * disabled for all platforms by setting to 0, the workaround can be forced ++ * on for any platform by setting to 2. ++ */ ++static unsigned int dma_reset_workaround = 1; ++module_param(dma_reset_workaround, int, 0644); ++MODULE_PARM_DESC(dma_reset_workaround, "periodic RiSC dma engine reset; 0-force disable, 1-driver detect (default), 2-force enable"); ++ + static unsigned int debug; + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "enable debug messages"); +@@ -603,8 +616,13 @@ static void cx23885_risc_disasm(struct cx23885_tsport *port, + + static void cx23885_clear_bridge_error(struct cx23885_dev *dev) + { +- uint32_t reg1_val = cx_read(TC_REQ); /* read-only */ +- uint32_t reg2_val = cx_read(TC_REQ_SET); ++ uint32_t reg1_val, reg2_val; ++ ++ if (!dev->need_dma_reset) ++ return; ++ ++ reg1_val = cx_read(TC_REQ); /* read-only */ ++ reg2_val = cx_read(TC_REQ_SET); + + if (reg1_val && reg2_val) { + cx_write(TC_REQ, reg1_val); +@@ -2058,6 +2076,37 @@ void cx23885_gpio_enable(struct cx23885_dev *dev, u32 mask, int asoutput) + /* TODO: 23-19 */ + } + ++static struct { ++ int vendor, dev; ++} const broken_dev_id[] = { ++ /* According with ++ * https://openbenchmarking.org/system/1703021-RI-AMDZEN08075/Ryzen%207%201800X/lspci, ++ * 0x1451 is PCI ID for the IOMMU found on Ryzen ++ */ ++ { PCI_VENDOR_ID_AMD, 0x1451 }, ++}; ++ ++static bool cx23885_does_need_dma_reset(void) ++{ ++ int i; ++ struct pci_dev *pdev = NULL; ++ ++ if (dma_reset_workaround == 0) ++ return false; ++ else if (dma_reset_workaround == 2) ++ return true; ++ ++ for (i = 0; i < ARRAY_SIZE(broken_dev_id); i++) { ++ pdev = pci_get_device(broken_dev_id[i].vendor, ++ broken_dev_id[i].dev, NULL); ++ if (pdev) { ++ pci_dev_put(pdev); ++ return true; ++ } ++ } ++ return false; ++} ++ + static int cx23885_initdev(struct pci_dev *pci_dev, + const struct pci_device_id *pci_id) + { +@@ -2069,6 +2118,8 @@ static int cx23885_initdev(struct pci_dev *pci_dev, + if (NULL == dev) + return -ENOMEM; + ++ dev->need_dma_reset = cx23885_does_need_dma_reset(); ++ + err = v4l2_device_register(&pci_dev->dev, &dev->v4l2_dev); + if (err < 0) + goto fail_free; +diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h +index d54c7ee1ab21..cf965efabe66 100644 +--- a/drivers/media/pci/cx23885/cx23885.h ++++ b/drivers/media/pci/cx23885/cx23885.h +@@ -451,6 +451,8 @@ struct cx23885_dev { + /* Analog raw audio */ + struct cx23885_audio_dev *audio_dev; + ++ /* Does the system require periodic DMA resets? */ ++ unsigned int need_dma_reset:1; + }; + + static inline struct cx23885_dev *to_cx23885(struct v4l2_device *v4l2_dev) +diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c +index 3fcb9a2fe1c9..efe2fb72d54b 100644 +--- a/drivers/misc/genwqe/card_utils.c ++++ b/drivers/misc/genwqe/card_utils.c +@@ -215,7 +215,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init) + void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size, + dma_addr_t *dma_handle) + { +- if (get_order(size) > MAX_ORDER) ++ if (get_order(size) >= MAX_ORDER) + return NULL; + + return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle, +diff --git a/drivers/net/wireless/broadcom/b43/phy_common.c b/drivers/net/wireless/broadcom/b43/phy_common.c +index 85f2ca989565..ef3ffa5ad466 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_common.c ++++ b/drivers/net/wireless/broadcom/b43/phy_common.c +@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta) + u8 i; + s32 tmp; + s8 signx = 1; +- u32 angle = 0; ++ s32 angle = 0; + struct b43_c32 ret = { .i = 39797, .q = 0, }; + + while (theta > (180 << 16)) +diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c +index 0e39e3d1846f..d28418b05a04 100644 +--- a/drivers/nvdimm/pmem.c ++++ b/drivers/nvdimm/pmem.c +@@ -309,8 +309,11 @@ static void pmem_release_queue(void *q) + blk_cleanup_queue(q); + } + +-static void pmem_freeze_queue(void *q) ++static void pmem_freeze_queue(struct percpu_ref *ref) + { ++ struct request_queue *q; ++ ++ q = container_of(ref, typeof(*q), q_usage_counter); + blk_freeze_queue_start(q); + } + +@@ -402,6 +405,7 @@ static int pmem_attach_disk(struct device *dev, + + pmem->pfn_flags = PFN_DEV; + pmem->pgmap.ref = &q->q_usage_counter; ++ pmem->pgmap.kill = pmem_freeze_queue; + if (is_nd_pfn(dev)) { + if (setup_pagemap_fsdax(dev, &pmem->pgmap)) + return -ENOMEM; +@@ -427,13 +431,6 @@ static int pmem_attach_disk(struct device *dev, + memcpy(&bb_res, &nsio->res, sizeof(bb_res)); + } + +- /* +- * At release time the queue must be frozen before +- * devm_memremap_pages is unwound +- */ +- if (devm_add_action_or_reset(dev, pmem_freeze_queue, q)) +- return -ENOMEM; +- + if (IS_ERR(addr)) + return PTR_ERR(addr); + pmem->virt_addr = addr; +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 09692c9b32a7..6d20b6dcf034 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -116,9 +116,6 @@ int __weak of_node_to_nid(struct device_node *np) + } + #endif + +-static struct device_node **phandle_cache; +-static u32 phandle_cache_mask; +- + /* + * Assumptions behind phandle_cache implementation: + * - phandle property values are in a contiguous range of 1..n +@@ -127,6 +124,66 @@ static u32 phandle_cache_mask; + * - the phandle lookup overhead reduction provided by the cache + * will likely be less + */ ++ ++static struct device_node **phandle_cache; ++static u32 phandle_cache_mask; ++ ++/* ++ * Caller must hold devtree_lock. ++ */ ++static void __of_free_phandle_cache(void) ++{ ++ u32 cache_entries = phandle_cache_mask + 1; ++ u32 k; ++ ++ if (!phandle_cache) ++ return; ++ ++ for (k = 0; k < cache_entries; k++) ++ of_node_put(phandle_cache[k]); ++ ++ kfree(phandle_cache); ++ phandle_cache = NULL; ++} ++ ++int of_free_phandle_cache(void) ++{ ++ unsigned long flags; ++ ++ raw_spin_lock_irqsave(&devtree_lock, flags); ++ ++ __of_free_phandle_cache(); ++ ++ raw_spin_unlock_irqrestore(&devtree_lock, flags); ++ ++ return 0; ++} ++#if !defined(CONFIG_MODULES) ++late_initcall_sync(of_free_phandle_cache); ++#endif ++ ++/* ++ * Caller must hold devtree_lock. ++ */ ++void __of_free_phandle_cache_entry(phandle handle) ++{ ++ phandle masked_handle; ++ struct device_node *np; ++ ++ if (!handle) ++ return; ++ ++ masked_handle = handle & phandle_cache_mask; ++ ++ if (phandle_cache) { ++ np = phandle_cache[masked_handle]; ++ if (np && handle == np->phandle) { ++ of_node_put(np); ++ phandle_cache[masked_handle] = NULL; ++ } ++ } ++} ++ + void of_populate_phandle_cache(void) + { + unsigned long flags; +@@ -136,8 +193,7 @@ void of_populate_phandle_cache(void) + + raw_spin_lock_irqsave(&devtree_lock, flags); + +- kfree(phandle_cache); +- phandle_cache = NULL; ++ __of_free_phandle_cache(); + + for_each_of_allnodes(np) + if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL) +@@ -155,30 +211,15 @@ void of_populate_phandle_cache(void) + goto out; + + for_each_of_allnodes(np) +- if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL) ++ if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL) { ++ of_node_get(np); + phandle_cache[np->phandle & phandle_cache_mask] = np; ++ } + + out: + raw_spin_unlock_irqrestore(&devtree_lock, flags); + } + +-int of_free_phandle_cache(void) +-{ +- unsigned long flags; +- +- raw_spin_lock_irqsave(&devtree_lock, flags); +- +- kfree(phandle_cache); +- phandle_cache = NULL; +- +- raw_spin_unlock_irqrestore(&devtree_lock, flags); +- +- return 0; +-} +-#if !defined(CONFIG_MODULES) +-late_initcall_sync(of_free_phandle_cache); +-#endif +- + void __init of_core_init(void) + { + struct device_node *np; +@@ -1190,13 +1231,23 @@ struct device_node *of_find_node_by_phandle(phandle handle) + if (phandle_cache[masked_handle] && + handle == phandle_cache[masked_handle]->phandle) + np = phandle_cache[masked_handle]; ++ if (np && of_node_check_flag(np, OF_DETACHED)) { ++ WARN_ON(1); /* did not uncache np on node removal */ ++ of_node_put(np); ++ phandle_cache[masked_handle] = NULL; ++ np = NULL; ++ } + } + + if (!np) { + for_each_of_allnodes(np) +- if (np->phandle == handle) { +- if (phandle_cache) ++ if (np->phandle == handle && ++ !of_node_check_flag(np, OF_DETACHED)) { ++ if (phandle_cache) { ++ /* will put when removed from cache */ ++ of_node_get(np); + phandle_cache[masked_handle] = np; ++ } + break; + } + } +diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c +index f4f8ed9b5454..ecea92f68c87 100644 +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -268,6 +268,9 @@ void __of_detach_node(struct device_node *np) + } + + of_node_set_flag(np, OF_DETACHED); ++ ++ /* race with of_find_node_by_phandle() prevented by devtree_lock */ ++ __of_free_phandle_cache_entry(np->phandle); + } + + /** +diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h +index 5d1567025358..24786818e32e 100644 +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -84,6 +84,10 @@ static inline void __of_detach_node_sysfs(struct device_node *np) {} + int of_resolve_phandles(struct device_node *tree); + #endif + ++#if defined(CONFIG_OF_DYNAMIC) ++void __of_free_phandle_cache_entry(phandle handle); ++#endif ++ + #if defined(CONFIG_OF_OVERLAY) + void of_overlay_mutex_lock(void); + void of_overlay_mutex_unlock(void); +diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c +index ae3c5b25dcc7..a2eb25271c96 100644 +--- a/drivers/pci/p2pdma.c ++++ b/drivers/pci/p2pdma.c +@@ -82,10 +82,8 @@ static void pci_p2pdma_percpu_release(struct percpu_ref *ref) + complete_all(&p2p->devmap_ref_done); + } + +-static void pci_p2pdma_percpu_kill(void *data) ++static void pci_p2pdma_percpu_kill(struct percpu_ref *ref) + { +- struct percpu_ref *ref = data; +- + /* + * pci_p2pdma_add_resource() may be called multiple times + * by a driver and may register the percpu_kill devm action multiple +@@ -198,6 +196,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, + pgmap->type = MEMORY_DEVICE_PCI_P2PDMA; + pgmap->pci_p2pdma_bus_offset = pci_bus_address(pdev, bar) - + pci_resource_start(pdev, bar); ++ pgmap->kill = pci_p2pdma_percpu_kill; + + addr = devm_memremap_pages(&pdev->dev, pgmap); + if (IS_ERR(addr)) { +@@ -211,11 +210,6 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, + if (error) + goto pgmap_free; + +- error = devm_add_action_or_reset(&pdev->dev, pci_p2pdma_percpu_kill, +- &pdev->p2pdma->devmap_ref); +- if (error) +- goto pgmap_free; +- + pci_info(pdev, "added peer-to-peer DMA memory %pR\n", + &pgmap->res); + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index bef17c3fca67..33f3f475e5c6 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1251,30 +1251,29 @@ static int pci_pm_runtime_suspend(struct device *dev) + return 0; + } + +- if (!pm || !pm->runtime_suspend) +- return -ENOSYS; +- + pci_dev->state_saved = false; +- error = pm->runtime_suspend(dev); +- if (error) { ++ if (pm && pm->runtime_suspend) { ++ error = pm->runtime_suspend(dev); + /* + * -EBUSY and -EAGAIN is used to request the runtime PM core + * to schedule a new suspend, so log the event only with debug + * log level. + */ +- if (error == -EBUSY || error == -EAGAIN) ++ if (error == -EBUSY || error == -EAGAIN) { + dev_dbg(dev, "can't suspend now (%pf returned %d)\n", + pm->runtime_suspend, error); +- else ++ return error; ++ } else if (error) { + dev_err(dev, "can't suspend (%pf returned %d)\n", + pm->runtime_suspend, error); +- +- return error; ++ return error; ++ } + } + + pci_fixup_device(pci_fixup_suspend, pci_dev); + +- if (!pci_dev->state_saved && pci_dev->current_state != PCI_D0 ++ if (pm && pm->runtime_suspend ++ && !pci_dev->state_saved && pci_dev->current_state != PCI_D0 + && pci_dev->current_state != PCI_UNKNOWN) { + WARN_ONCE(pci_dev->current_state != prev, + "PCI PM: State of device not saved by %pF\n", +@@ -1292,7 +1291,7 @@ static int pci_pm_runtime_suspend(struct device *dev) + + static int pci_pm_runtime_resume(struct device *dev) + { +- int rc; ++ int rc = 0; + struct pci_dev *pci_dev = to_pci_dev(dev); + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + +@@ -1306,14 +1305,12 @@ static int pci_pm_runtime_resume(struct device *dev) + if (!pci_dev->driver) + return 0; + +- if (!pm || !pm->runtime_resume) +- return -ENOSYS; +- + pci_fixup_device(pci_fixup_resume_early, pci_dev); + pci_enable_wake(pci_dev, PCI_D0, false); + pci_fixup_device(pci_fixup_resume, pci_dev); + +- rc = pm->runtime_resume(dev); ++ if (pm && pm->runtime_resume) ++ rc = pm->runtime_resume(dev); + + pci_dev->runtime_d3cold = false; + +diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +index 1b10ea05a914..69372e2bc93c 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +@@ -30,8 +30,8 @@ + #define DDRC_FLUX_RCMD 0x38c + #define DDRC_PRE_CMD 0x3c0 + #define DDRC_ACT_CMD 0x3c4 +-#define DDRC_BNK_CHG 0x3c8 + #define DDRC_RNK_CHG 0x3cc ++#define DDRC_RW_CHG 0x3d0 + #define DDRC_EVENT_CTRL 0x6C0 + #define DDRC_INT_MASK 0x6c8 + #define DDRC_INT_STATUS 0x6cc +@@ -51,7 +51,7 @@ + + static const u32 ddrc_reg_off[] = { + DDRC_FLUX_WR, DDRC_FLUX_RD, DDRC_FLUX_WCMD, DDRC_FLUX_RCMD, +- DDRC_PRE_CMD, DDRC_ACT_CMD, DDRC_BNK_CHG, DDRC_RNK_CHG ++ DDRC_PRE_CMD, DDRC_ACT_CMD, DDRC_RNK_CHG, DDRC_RW_CHG + }; + + /* +diff --git a/drivers/power/supply/olpc_battery.c b/drivers/power/supply/olpc_battery.c +index 6da79ae14860..5a97e42a3547 100644 +--- a/drivers/power/supply/olpc_battery.c ++++ b/drivers/power/supply/olpc_battery.c +@@ -428,14 +428,14 @@ static int olpc_bat_get_property(struct power_supply *psy, + if (ret) + return ret; + +- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256; ++ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256; + break; + case POWER_SUPPLY_PROP_TEMP_AMBIENT: + ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2); + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256; ++ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256; + break; + case POWER_SUPPLY_PROP_CHARGE_COUNTER: + ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2); +diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c +index 94f4d8fe85e0..d1b531fe9ada 100644 +--- a/drivers/s390/scsi/zfcp_aux.c ++++ b/drivers/s390/scsi/zfcp_aux.c +@@ -275,16 +275,16 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter) + */ + int zfcp_status_read_refill(struct zfcp_adapter *adapter) + { +- while (atomic_read(&adapter->stat_miss) > 0) ++ while (atomic_add_unless(&adapter->stat_miss, -1, 0)) + if (zfcp_fsf_status_read(adapter->qdio)) { ++ atomic_inc(&adapter->stat_miss); /* undo add -1 */ + if (atomic_read(&adapter->stat_miss) >= + adapter->stat_read_buf_num) { + zfcp_erp_adapter_reopen(adapter, 0, "axsref1"); + return 1; + } + break; +- } else +- atomic_dec(&adapter->stat_miss); ++ } + return 0; + } + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index b9e5cd79931a..462ed4ad21d2 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -14501,7 +14501,8 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size, + hw_page_size))/hw_page_size; + + /* If needed, Adjust page count to match the max the adapter supports */ +- if (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt) ++ if (phba->sli4_hba.pc_sli4_params.wqpcnt && ++ (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt)) + queue->page_count = phba->sli4_hba.pc_sli4_params.wqpcnt; + + INIT_LIST_HEAD(&queue->list); +diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c +index bbed039617a4..d59c8a59f582 100644 +--- a/drivers/video/fbdev/pxafb.c ++++ b/drivers/video/fbdev/pxafb.c +@@ -2234,10 +2234,8 @@ static struct pxafb_mach_info *of_pxafb_of_mach_info(struct device *dev) + if (!info) + return ERR_PTR(-ENOMEM); + ret = of_get_pxafb_mode_info(dev, info); +- if (ret) { +- kfree(info->modes); ++ if (ret) + return ERR_PTR(ret); +- } + + /* + * On purpose, neither lccrX registers nor video memory size can be +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index f3496db4bb3e..a58666a3f8dd 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -3569,7 +3569,6 @@ retry: + tcap->cap_id = t_cap_id; + tcap->seq = t_seq - 1; + tcap->issue_seq = t_seq - 1; +- tcap->mseq = t_mseq; + tcap->issued |= issued; + tcap->implemented |= issued; + if (cap == ci->i_auth_cap) +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index cc91963683de..a928ba008d7d 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -1209,6 +1209,7 @@ static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret) + + if (rv < 0) { + log_error(ls, "create_lkb idr error %d", rv); ++ dlm_free_lkb(lkb); + return rv; + } + +@@ -4179,6 +4180,7 @@ static int receive_convert(struct dlm_ls *ls, struct dlm_message *ms) + (unsigned long long)lkb->lkb_recover_seq, + ms->m_header.h_nodeid, ms->m_lkid); + error = -ENOENT; ++ dlm_put_lkb(lkb); + goto fail; + } + +@@ -4232,6 +4234,7 @@ static int receive_unlock(struct dlm_ls *ls, struct dlm_message *ms) + lkb->lkb_id, lkb->lkb_remid, + ms->m_header.h_nodeid, ms->m_lkid); + error = -ENOENT; ++ dlm_put_lkb(lkb); + goto fail; + } + +@@ -5792,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua, + goto out; + } + } +- +- /* After ua is attached to lkb it will be freed by dlm_free_lkb(). +- When DLM_IFL_USER is set, the dlm knows that this is a userspace +- lock and that lkb_astparam is the dlm_user_args structure. */ +- + error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs, + fake_astfn, ua, fake_bastfn, &args); +- lkb->lkb_flags |= DLM_IFL_USER; +- + if (error) { ++ kfree(ua->lksb.sb_lvbptr); ++ ua->lksb.sb_lvbptr = NULL; ++ kfree(ua); + __put_lkb(ls, lkb); + goto out; + } + ++ /* After ua is attached to lkb it will be freed by dlm_free_lkb(). ++ When DLM_IFL_USER is set, the dlm knows that this is a userspace ++ lock and that lkb_astparam is the dlm_user_args structure. */ ++ lkb->lkb_flags |= DLM_IFL_USER; + error = request_lock(ls, lkb, name, namelen, &args); + + switch (error) { +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 5ba94be006ee..6a1529e478f3 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -680,11 +680,11 @@ static int new_lockspace(const char *name, const char *cluster, + kfree(ls->ls_recover_buf); + out_lkbidr: + idr_destroy(&ls->ls_lkbidr); ++ out_rsbtbl: + for (i = 0; i < DLM_REMOVE_NAMES_MAX; i++) { + if (ls->ls_remove_names[i]) + kfree(ls->ls_remove_names[i]); + } +- out_rsbtbl: + vfree(ls->ls_rsbtbl); + out_lsfree: + if (do_unreg) +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 648f0ca1ad57..998051c4aea7 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -744,17 +744,19 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, + the gfs2 structures. */ + if (default_acl) { + error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT); ++ if (error) ++ goto fail_gunlock3; + posix_acl_release(default_acl); ++ default_acl = NULL; + } + if (acl) { +- if (!error) +- error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS); ++ error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS); ++ if (error) ++ goto fail_gunlock3; + posix_acl_release(acl); ++ acl = NULL; + } + +- if (error) +- goto fail_gunlock3; +- + error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name, + &gfs2_initxattrs, NULL); + if (error) +@@ -789,10 +791,8 @@ fail_free_inode: + } + gfs2_rsqa_delete(ip, NULL); + fail_free_acls: +- if (default_acl) +- posix_acl_release(default_acl); +- if (acl) +- posix_acl_release(acl); ++ posix_acl_release(default_acl); ++ posix_acl_release(acl); + fail_gunlock: + gfs2_dir_no_add(&da); + gfs2_glock_dq_uninit(ghs); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index b08a530433ad..8d7916570362 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1780,9 +1780,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, + goto next_iter; + } + if (ret == -E2BIG) { ++ n += rbm->bii - initial_bii; + rbm->bii = 0; + rbm->offset = 0; +- n += (rbm->bii - initial_bii); + goto res_covered_end_of_rgrp; + } + return ret; +diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c +index d20b92f271c2..0a67dd4250e9 100644 +--- a/fs/lockd/clntproc.c ++++ b/fs/lockd/clntproc.c +@@ -442,7 +442,7 @@ nlmclnt_test(struct nlm_rqst *req, struct file_lock *fl) + fl->fl_start = req->a_res.lock.fl.fl_start; + fl->fl_end = req->a_res.lock.fl.fl_end; + fl->fl_type = req->a_res.lock.fl.fl_type; +- fl->fl_pid = 0; ++ fl->fl_pid = -req->a_res.lock.fl.fl_pid; + break; + default: + status = nlm_stat_to_errno(req->a_res.status); +diff --git a/fs/lockd/xdr.c b/fs/lockd/xdr.c +index 7147e4aebecc..9846f7e95282 100644 +--- a/fs/lockd/xdr.c ++++ b/fs/lockd/xdr.c +@@ -127,7 +127,7 @@ nlm_decode_lock(__be32 *p, struct nlm_lock *lock) + + locks_init_lock(fl); + fl->fl_owner = current->files; +- fl->fl_pid = (pid_t)lock->svid; ++ fl->fl_pid = current->tgid; + fl->fl_flags = FL_POSIX; + fl->fl_type = F_RDLCK; /* as good as anything else */ + start = ntohl(*p++); +@@ -269,7 +269,7 @@ nlmsvc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p) + memset(lock, 0, sizeof(*lock)); + locks_init_lock(&lock->fl); + lock->svid = ~(u32) 0; +- lock->fl.fl_pid = (pid_t)lock->svid; ++ lock->fl.fl_pid = current->tgid; + + if (!(p = nlm_decode_cookie(p, &argp->cookie)) + || !(p = xdr_decode_string_inplace(p, &lock->caller, +diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c +index 7ed9edf9aed4..70154f376695 100644 +--- a/fs/lockd/xdr4.c ++++ b/fs/lockd/xdr4.c +@@ -119,7 +119,7 @@ nlm4_decode_lock(__be32 *p, struct nlm_lock *lock) + + locks_init_lock(fl); + fl->fl_owner = current->files; +- fl->fl_pid = (pid_t)lock->svid; ++ fl->fl_pid = current->tgid; + fl->fl_flags = FL_POSIX; + fl->fl_type = F_RDLCK; /* as good as anything else */ + p = xdr_decode_hyper(p, &start); +@@ -266,7 +266,7 @@ nlm4svc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p) + memset(lock, 0, sizeof(*lock)); + locks_init_lock(&lock->fl); + lock->svid = ~(u32) 0; +- lock->fl.fl_pid = (pid_t)lock->svid; ++ lock->fl.fl_pid = current->tgid; + + if (!(p = nlm4_decode_cookie(p, &argp->cookie)) + || !(p = xdr_decode_string_inplace(p, &lock->caller, +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index d505990dac7c..c364acbb6aba 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1016,8 +1016,6 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + + nvecs = svc_fill_write_vector(rqstp, write->wr_pagelist, + &write->wr_head, write->wr_buflen); +- if (!nvecs) +- return nfserr_io; + WARN_ON_ONCE(nvecs > ARRAY_SIZE(rqstp->rq_vec)); + + status = nfsd_vfs_write(rqstp, &cstate->current_fh, filp, +diff --git a/include/linux/hmm.h b/include/linux/hmm.h +index c6fb869a81c0..ed89fbc525d2 100644 +--- a/include/linux/hmm.h ++++ b/include/linux/hmm.h +@@ -512,8 +512,7 @@ struct hmm_devmem { + * enough and allocate struct page for it. + * + * The device driver can wrap the hmm_devmem struct inside a private device +- * driver struct. The device driver must call hmm_devmem_remove() before the +- * device goes away and before freeing the hmm_devmem struct memory. ++ * driver struct. + */ + struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, + struct device *device, +@@ -521,7 +520,6 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, + struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, + struct device *device, + struct resource *res); +-void hmm_devmem_remove(struct hmm_devmem *devmem); + + /* + * hmm_devmem_page_set_drvdata - set per-page driver data field +diff --git a/include/linux/memremap.h b/include/linux/memremap.h +index 0ac69ddf5fc4..55db66b3716f 100644 +--- a/include/linux/memremap.h ++++ b/include/linux/memremap.h +@@ -111,6 +111,7 @@ typedef void (*dev_page_free_t)(struct page *page, void *data); + * @altmap: pre-allocated/reserved memory for vmemmap allocations + * @res: physical address range covered by @ref + * @ref: reference count that pins the devm_memremap_pages() mapping ++ * @kill: callback to transition @ref to the dead state + * @dev: host device of the mapping for debug + * @data: private data pointer for page_free() + * @type: memory type: see MEMORY_* in memory_hotplug.h +@@ -122,6 +123,7 @@ struct dev_pagemap { + bool altmap_valid; + struct resource res; + struct percpu_ref *ref; ++ void (*kill)(struct percpu_ref *ref); + struct device *dev; + void *data; + enum memory_type type; +diff --git a/kernel/fork.c b/kernel/fork.c +index e2a5156bc9c3..3c16bc490583 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1837,8 +1837,6 @@ static __latent_entropy struct task_struct *copy_process( + + posix_cpu_timers_init(p); + +- p->start_time = ktime_get_ns(); +- p->real_start_time = ktime_get_boot_ns(); + p->io_context = NULL; + audit_set_context(p, NULL); + cgroup_fork(p); +@@ -2004,6 +2002,17 @@ static __latent_entropy struct task_struct *copy_process( + if (retval) + goto bad_fork_free_pid; + ++ /* ++ * From this point on we must avoid any synchronous user-space ++ * communication until we take the tasklist-lock. In particular, we do ++ * not want user-space to be able to predict the process start-time by ++ * stalling fork(2) after we recorded the start_time but before it is ++ * visible to the system. ++ */ ++ ++ p->start_time = ktime_get_ns(); ++ p->real_start_time = ktime_get_boot_ns(); ++ + /* + * Make it visible to the rest of the system, but dont wake it up yet. + * Need tasklist lock for parent etc handling! +diff --git a/kernel/memremap.c b/kernel/memremap.c +index 9eced2cc9f94..3eef989ef035 100644 +--- a/kernel/memremap.c ++++ b/kernel/memremap.c +@@ -88,23 +88,25 @@ static void devm_memremap_pages_release(void *data) + resource_size_t align_start, align_size; + unsigned long pfn; + ++ pgmap->kill(pgmap->ref); + for_each_device_pfn(pfn, pgmap) + put_page(pfn_to_page(pfn)); + +- if (percpu_ref_tryget_live(pgmap->ref)) { +- dev_WARN(dev, "%s: page mapping is still live!\n", __func__); +- percpu_ref_put(pgmap->ref); +- } +- + /* pages are dead and unused, undo the arch mapping */ + align_start = res->start & ~(SECTION_SIZE - 1); + align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE) + - align_start; + + mem_hotplug_begin(); +- arch_remove_memory(align_start, align_size, pgmap->altmap_valid ? +- &pgmap->altmap : NULL); +- kasan_remove_zero_shadow(__va(align_start), align_size); ++ if (pgmap->type == MEMORY_DEVICE_PRIVATE) { ++ pfn = align_start >> PAGE_SHIFT; ++ __remove_pages(page_zone(pfn_to_page(pfn)), pfn, ++ align_size >> PAGE_SHIFT, NULL); ++ } else { ++ arch_remove_memory(align_start, align_size, ++ pgmap->altmap_valid ? &pgmap->altmap : NULL); ++ kasan_remove_zero_shadow(__va(align_start), align_size); ++ } + mem_hotplug_done(); + + untrack_pfn(NULL, PHYS_PFN(align_start), align_size); +@@ -116,7 +118,7 @@ static void devm_memremap_pages_release(void *data) + /** + * devm_memremap_pages - remap and provide memmap backing for the given resource + * @dev: hosting device for @res +- * @pgmap: pointer to a struct dev_pgmap ++ * @pgmap: pointer to a struct dev_pagemap + * + * Notes: + * 1/ At a minimum the res, ref and type members of @pgmap must be initialized +@@ -125,11 +127,8 @@ static void devm_memremap_pages_release(void *data) + * 2/ The altmap field may optionally be initialized, in which case altmap_valid + * must be set to true + * +- * 3/ pgmap.ref must be 'live' on entry and 'dead' before devm_memunmap_pages() +- * time (or devm release event). The expected order of events is that ref has +- * been through percpu_ref_kill() before devm_memremap_pages_release(). The +- * wait for the completion of all references being dropped and +- * percpu_ref_exit() must occur after devm_memremap_pages_release(). ++ * 3/ pgmap->ref must be 'live' on entry and will be killed at ++ * devm_memremap_pages_release() time, or if this routine fails. + * + * 4/ res is expected to be a host memory range that could feasibly be + * treated as a "System RAM" range, i.e. not a device mmio range, but +@@ -145,6 +144,9 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + pgprot_t pgprot = PAGE_KERNEL; + int error, nid, is_ram; + ++ if (!pgmap->ref || !pgmap->kill) ++ return ERR_PTR(-EINVAL); ++ + align_start = res->start & ~(SECTION_SIZE - 1); + align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE) + - align_start; +@@ -167,18 +169,13 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + is_ram = region_intersects(align_start, align_size, + IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE); + +- if (is_ram == REGION_MIXED) { +- WARN_ONCE(1, "%s attempted on mixed region %pr\n", +- __func__, res); +- return ERR_PTR(-ENXIO); ++ if (is_ram != REGION_DISJOINT) { ++ WARN_ONCE(1, "%s attempted on %s region %pr\n", __func__, ++ is_ram == REGION_MIXED ? "mixed" : "ram", res); ++ error = -ENXIO; ++ goto err_array; + } + +- if (is_ram == REGION_INTERSECTS) +- return __va(res->start); +- +- if (!pgmap->ref) +- return ERR_PTR(-EINVAL); +- + pgmap->dev = dev; + + error = xa_err(xa_store_range(&pgmap_array, PHYS_PFN(res->start), +@@ -196,17 +193,40 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + goto err_pfn_remap; + + mem_hotplug_begin(); +- error = kasan_add_zero_shadow(__va(align_start), align_size); +- if (error) { +- mem_hotplug_done(); +- goto err_kasan; ++ ++ /* ++ * For device private memory we call add_pages() as we only need to ++ * allocate and initialize struct page for the device memory. More- ++ * over the device memory is un-accessible thus we do not want to ++ * create a linear mapping for the memory like arch_add_memory() ++ * would do. ++ * ++ * For all other device memory types, which are accessible by ++ * the CPU, we do want the linear mapping and thus use ++ * arch_add_memory(). ++ */ ++ if (pgmap->type == MEMORY_DEVICE_PRIVATE) { ++ error = add_pages(nid, align_start >> PAGE_SHIFT, ++ align_size >> PAGE_SHIFT, NULL, false); ++ } else { ++ error = kasan_add_zero_shadow(__va(align_start), align_size); ++ if (error) { ++ mem_hotplug_done(); ++ goto err_kasan; ++ } ++ ++ error = arch_add_memory(nid, align_start, align_size, altmap, ++ false); ++ } ++ ++ if (!error) { ++ struct zone *zone; ++ ++ zone = &NODE_DATA(nid)->node_zones[ZONE_DEVICE]; ++ move_pfn_range_to_zone(zone, align_start >> PAGE_SHIFT, ++ align_size >> PAGE_SHIFT, altmap); + } + +- error = arch_add_memory(nid, align_start, align_size, altmap, false); +- if (!error) +- move_pfn_range_to_zone(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], +- align_start >> PAGE_SHIFT, +- align_size >> PAGE_SHIFT, altmap); + mem_hotplug_done(); + if (error) + goto err_add_memory; +@@ -220,7 +240,10 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + align_size >> PAGE_SHIFT, pgmap); + percpu_ref_get_many(pgmap->ref, pfn_end(pgmap) - pfn_first(pgmap)); + +- devm_add_action(dev, devm_memremap_pages_release, pgmap); ++ error = devm_add_action_or_reset(dev, devm_memremap_pages_release, ++ pgmap); ++ if (error) ++ return ERR_PTR(error); + + return __va(res->start); + +@@ -231,9 +254,10 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + err_pfn_remap: + pgmap_array_delete(res); + err_array: ++ pgmap->kill(pgmap->ref); + return ERR_PTR(error); + } +-EXPORT_SYMBOL(devm_memremap_pages); ++EXPORT_SYMBOL_GPL(devm_memremap_pages); + + unsigned long vmem_altmap_offset(struct vmem_altmap *altmap) + { +diff --git a/kernel/pid.c b/kernel/pid.c +index b2f6c506035d..20881598bdfa 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -233,8 +233,10 @@ out_unlock: + + out_free: + spin_lock_irq(&pidmap_lock); +- while (++i <= ns->level) +- idr_remove(&ns->idr, (pid->numbers + i)->nr); ++ while (++i <= ns->level) { ++ upid = pid->numbers + i; ++ idr_remove(&upid->ns->idr, upid->nr); ++ } + + /* On failure to allocate the first pid, reset the state */ + if (ns->pid_allocated == PIDNS_ADDING) +diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c +index a8846ed7f352..a180abc8c925 100644 +--- a/kernel/rcu/srcutree.c ++++ b/kernel/rcu/srcutree.c +@@ -451,10 +451,12 @@ static void srcu_gp_start(struct srcu_struct *sp) + + lockdep_assert_held(&ACCESS_PRIVATE(sp, lock)); + WARN_ON_ONCE(ULONG_CMP_GE(sp->srcu_gp_seq, sp->srcu_gp_seq_needed)); ++ spin_lock_rcu_node(sdp); /* Interrupts already disabled. */ + rcu_segcblist_advance(&sdp->srcu_cblist, + rcu_seq_current(&sp->srcu_gp_seq)); + (void)rcu_segcblist_accelerate(&sdp->srcu_cblist, + rcu_seq_snap(&sp->srcu_gp_seq)); ++ spin_unlock_rcu_node(sdp); /* Interrupts remain disabled. */ + smp_mb(); /* Order prior store to ->srcu_gp_seq_needed vs. GP start. */ + rcu_seq_start(&sp->srcu_gp_seq); + state = rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index ac855b2f4774..e8f191ba3fe5 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -352,10 +352,9 @@ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq) + } + } + +-/* Iterate thr' all leaf cfs_rq's on a runqueue */ +-#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \ +- list_for_each_entry_safe(cfs_rq, pos, &rq->leaf_cfs_rq_list, \ +- leaf_cfs_rq_list) ++/* Iterate through all leaf cfs_rq's on a runqueue: */ ++#define for_each_leaf_cfs_rq(rq, cfs_rq) \ ++ list_for_each_entry_rcu(cfs_rq, &rq->leaf_cfs_rq_list, leaf_cfs_rq_list) + + /* Do the two (enqueued) entities belong to the same group ? */ + static inline struct cfs_rq * +@@ -447,8 +446,8 @@ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq) + { + } + +-#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \ +- for (cfs_rq = &rq->cfs, pos = NULL; cfs_rq; cfs_rq = pos) ++#define for_each_leaf_cfs_rq(rq, cfs_rq) \ ++ for (cfs_rq = &rq->cfs; cfs_rq; cfs_rq = NULL) + + static inline struct sched_entity *parent_entity(struct sched_entity *se) + { +@@ -7387,27 +7386,10 @@ static inline bool others_have_blocked(struct rq *rq) + + #ifdef CONFIG_FAIR_GROUP_SCHED + +-static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq) +-{ +- if (cfs_rq->load.weight) +- return false; +- +- if (cfs_rq->avg.load_sum) +- return false; +- +- if (cfs_rq->avg.util_sum) +- return false; +- +- if (cfs_rq->avg.runnable_load_sum) +- return false; +- +- return true; +-} +- + static void update_blocked_averages(int cpu) + { + struct rq *rq = cpu_rq(cpu); +- struct cfs_rq *cfs_rq, *pos; ++ struct cfs_rq *cfs_rq; + const struct sched_class *curr_class; + struct rq_flags rf; + bool done = true; +@@ -7419,7 +7401,7 @@ static void update_blocked_averages(int cpu) + * Iterates the task_group tree in a bottom up fashion, see + * list_add_leaf_cfs_rq() for details. + */ +- for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) { ++ for_each_leaf_cfs_rq(rq, cfs_rq) { + struct sched_entity *se; + + /* throttled entities do not contribute to load */ +@@ -7434,13 +7416,6 @@ static void update_blocked_averages(int cpu) + if (se && !skip_blocked_update(se)) + update_load_avg(cfs_rq_of(se), se, 0); + +- /* +- * There can be a lot of idle CPU cgroups. Don't let fully +- * decayed cfs_rqs linger on the list. +- */ +- if (cfs_rq_is_decayed(cfs_rq)) +- list_del_leaf_cfs_rq(cfs_rq); +- + /* Don't need periodic decay once load/util_avg are null */ + if (cfs_rq_has_blocked(cfs_rq)) + done = false; +@@ -10289,10 +10264,10 @@ const struct sched_class fair_sched_class = { + #ifdef CONFIG_SCHED_DEBUG + void print_cfs_stats(struct seq_file *m, int cpu) + { +- struct cfs_rq *cfs_rq, *pos; ++ struct cfs_rq *cfs_rq; + + rcu_read_lock(); +- for_each_leaf_cfs_rq_safe(cpu_rq(cpu), cfs_rq, pos) ++ for_each_leaf_cfs_rq(cpu_rq(cpu), cfs_rq) + print_cfs_rq(m, cpu, cfs_rq); + rcu_read_unlock(); + } +diff --git a/lib/test_debug_virtual.c b/lib/test_debug_virtual.c +index d5a06addeb27..bf864c73e462 100644 +--- a/lib/test_debug_virtual.c ++++ b/lib/test_debug_virtual.c +@@ -5,6 +5,7 @@ + #include <linux/vmalloc.h> + #include <linux/slab.h> + #include <linux/sizes.h> ++#include <linux/io.h> + + #include <asm/page.h> + #ifdef CONFIG_MIPS +diff --git a/mm/hmm.c b/mm/hmm.c +index 90c34f3d1243..50fbaf80f95e 100644 +--- a/mm/hmm.c ++++ b/mm/hmm.c +@@ -986,19 +986,16 @@ static void hmm_devmem_ref_exit(void *data) + struct hmm_devmem *devmem; + + devmem = container_of(ref, struct hmm_devmem, ref); ++ wait_for_completion(&devmem->completion); + percpu_ref_exit(ref); +- devm_remove_action(devmem->device, &hmm_devmem_ref_exit, data); + } + +-static void hmm_devmem_ref_kill(void *data) ++static void hmm_devmem_ref_kill(struct percpu_ref *ref) + { +- struct percpu_ref *ref = data; + struct hmm_devmem *devmem; + + devmem = container_of(ref, struct hmm_devmem, ref); + percpu_ref_kill(ref); +- wait_for_completion(&devmem->completion); +- devm_remove_action(devmem->device, &hmm_devmem_ref_kill, data); + } + + static int hmm_devmem_fault(struct vm_area_struct *vma, +@@ -1021,172 +1018,6 @@ static void hmm_devmem_free(struct page *page, void *data) + devmem->ops->free(devmem, page); + } + +-static DEFINE_MUTEX(hmm_devmem_lock); +-static RADIX_TREE(hmm_devmem_radix, GFP_KERNEL); +- +-static void hmm_devmem_radix_release(struct resource *resource) +-{ +- resource_size_t key; +- +- mutex_lock(&hmm_devmem_lock); +- for (key = resource->start; +- key <= resource->end; +- key += PA_SECTION_SIZE) +- radix_tree_delete(&hmm_devmem_radix, key >> PA_SECTION_SHIFT); +- mutex_unlock(&hmm_devmem_lock); +-} +- +-static void hmm_devmem_release(struct device *dev, void *data) +-{ +- struct hmm_devmem *devmem = data; +- struct resource *resource = devmem->resource; +- unsigned long start_pfn, npages; +- struct zone *zone; +- struct page *page; +- +- if (percpu_ref_tryget_live(&devmem->ref)) { +- dev_WARN(dev, "%s: page mapping is still live!\n", __func__); +- percpu_ref_put(&devmem->ref); +- } +- +- /* pages are dead and unused, undo the arch mapping */ +- start_pfn = (resource->start & ~(PA_SECTION_SIZE - 1)) >> PAGE_SHIFT; +- npages = ALIGN(resource_size(resource), PA_SECTION_SIZE) >> PAGE_SHIFT; +- +- page = pfn_to_page(start_pfn); +- zone = page_zone(page); +- +- mem_hotplug_begin(); +- if (resource->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) +- __remove_pages(zone, start_pfn, npages, NULL); +- else +- arch_remove_memory(start_pfn << PAGE_SHIFT, +- npages << PAGE_SHIFT, NULL); +- mem_hotplug_done(); +- +- hmm_devmem_radix_release(resource); +-} +- +-static int hmm_devmem_pages_create(struct hmm_devmem *devmem) +-{ +- resource_size_t key, align_start, align_size, align_end; +- struct device *device = devmem->device; +- int ret, nid, is_ram; +- +- align_start = devmem->resource->start & ~(PA_SECTION_SIZE - 1); +- align_size = ALIGN(devmem->resource->start + +- resource_size(devmem->resource), +- PA_SECTION_SIZE) - align_start; +- +- is_ram = region_intersects(align_start, align_size, +- IORESOURCE_SYSTEM_RAM, +- IORES_DESC_NONE); +- if (is_ram == REGION_MIXED) { +- WARN_ONCE(1, "%s attempted on mixed region %pr\n", +- __func__, devmem->resource); +- return -ENXIO; +- } +- if (is_ram == REGION_INTERSECTS) +- return -ENXIO; +- +- if (devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY) +- devmem->pagemap.type = MEMORY_DEVICE_PUBLIC; +- else +- devmem->pagemap.type = MEMORY_DEVICE_PRIVATE; +- +- devmem->pagemap.res = *devmem->resource; +- devmem->pagemap.page_fault = hmm_devmem_fault; +- devmem->pagemap.page_free = hmm_devmem_free; +- devmem->pagemap.dev = devmem->device; +- devmem->pagemap.ref = &devmem->ref; +- devmem->pagemap.data = devmem; +- +- mutex_lock(&hmm_devmem_lock); +- align_end = align_start + align_size - 1; +- for (key = align_start; key <= align_end; key += PA_SECTION_SIZE) { +- struct hmm_devmem *dup; +- +- dup = radix_tree_lookup(&hmm_devmem_radix, +- key >> PA_SECTION_SHIFT); +- if (dup) { +- dev_err(device, "%s: collides with mapping for %s\n", +- __func__, dev_name(dup->device)); +- mutex_unlock(&hmm_devmem_lock); +- ret = -EBUSY; +- goto error; +- } +- ret = radix_tree_insert(&hmm_devmem_radix, +- key >> PA_SECTION_SHIFT, +- devmem); +- if (ret) { +- dev_err(device, "%s: failed: %d\n", __func__, ret); +- mutex_unlock(&hmm_devmem_lock); +- goto error_radix; +- } +- } +- mutex_unlock(&hmm_devmem_lock); +- +- nid = dev_to_node(device); +- if (nid < 0) +- nid = numa_mem_id(); +- +- mem_hotplug_begin(); +- /* +- * For device private memory we call add_pages() as we only need to +- * allocate and initialize struct page for the device memory. More- +- * over the device memory is un-accessible thus we do not want to +- * create a linear mapping for the memory like arch_add_memory() +- * would do. +- * +- * For device public memory, which is accesible by the CPU, we do +- * want the linear mapping and thus use arch_add_memory(). +- */ +- if (devmem->pagemap.type == MEMORY_DEVICE_PUBLIC) +- ret = arch_add_memory(nid, align_start, align_size, NULL, +- false); +- else +- ret = add_pages(nid, align_start >> PAGE_SHIFT, +- align_size >> PAGE_SHIFT, NULL, false); +- if (ret) { +- mem_hotplug_done(); +- goto error_add_memory; +- } +- move_pfn_range_to_zone(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], +- align_start >> PAGE_SHIFT, +- align_size >> PAGE_SHIFT, NULL); +- mem_hotplug_done(); +- +- /* +- * Initialization of the pages has been deferred until now in order +- * to allow us to do the work while not holding the hotplug lock. +- */ +- memmap_init_zone_device(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], +- align_start >> PAGE_SHIFT, +- align_size >> PAGE_SHIFT, &devmem->pagemap); +- +- return 0; +- +-error_add_memory: +- untrack_pfn(NULL, PHYS_PFN(align_start), align_size); +-error_radix: +- hmm_devmem_radix_release(devmem->resource); +-error: +- return ret; +-} +- +-static int hmm_devmem_match(struct device *dev, void *data, void *match_data) +-{ +- struct hmm_devmem *devmem = data; +- +- return devmem->resource == match_data; +-} +- +-static void hmm_devmem_pages_remove(struct hmm_devmem *devmem) +-{ +- devres_release(devmem->device, &hmm_devmem_release, +- &hmm_devmem_match, devmem->resource); +-} +- + /* + * hmm_devmem_add() - hotplug ZONE_DEVICE memory for device memory + * +@@ -1210,12 +1041,12 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, + { + struct hmm_devmem *devmem; + resource_size_t addr; ++ void *result; + int ret; + + dev_pagemap_get_ops(); + +- devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem), +- GFP_KERNEL, dev_to_node(device)); ++ devmem = devm_kzalloc(device, sizeof(*devmem), GFP_KERNEL); + if (!devmem) + return ERR_PTR(-ENOMEM); + +@@ -1229,11 +1060,11 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, + ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release, + 0, GFP_KERNEL); + if (ret) +- goto error_percpu_ref; ++ return ERR_PTR(ret); + +- ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref); ++ ret = devm_add_action_or_reset(device, hmm_devmem_ref_exit, &devmem->ref); + if (ret) +- goto error_devm_add_action; ++ return ERR_PTR(ret); + + size = ALIGN(size, PA_SECTION_SIZE); + addr = min((unsigned long)iomem_resource.end, +@@ -1253,54 +1084,40 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, + + devmem->resource = devm_request_mem_region(device, addr, size, + dev_name(device)); +- if (!devmem->resource) { +- ret = -ENOMEM; +- goto error_no_resource; +- } ++ if (!devmem->resource) ++ return ERR_PTR(-ENOMEM); + break; + } +- if (!devmem->resource) { +- ret = -ERANGE; +- goto error_no_resource; +- } ++ if (!devmem->resource) ++ return ERR_PTR(-ERANGE); + + devmem->resource->desc = IORES_DESC_DEVICE_PRIVATE_MEMORY; + devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT; + devmem->pfn_last = devmem->pfn_first + + (resource_size(devmem->resource) >> PAGE_SHIFT); + +- ret = hmm_devmem_pages_create(devmem); +- if (ret) +- goto error_pages; +- +- devres_add(device, devmem); +- +- ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref); +- if (ret) { +- hmm_devmem_remove(devmem); +- return ERR_PTR(ret); +- } ++ devmem->pagemap.type = MEMORY_DEVICE_PRIVATE; ++ devmem->pagemap.res = *devmem->resource; ++ devmem->pagemap.page_fault = hmm_devmem_fault; ++ devmem->pagemap.page_free = hmm_devmem_free; ++ devmem->pagemap.altmap_valid = false; ++ devmem->pagemap.ref = &devmem->ref; ++ devmem->pagemap.data = devmem; ++ devmem->pagemap.kill = hmm_devmem_ref_kill; + ++ result = devm_memremap_pages(devmem->device, &devmem->pagemap); ++ if (IS_ERR(result)) ++ return result; + return devmem; +- +-error_pages: +- devm_release_mem_region(device, devmem->resource->start, +- resource_size(devmem->resource)); +-error_no_resource: +-error_devm_add_action: +- hmm_devmem_ref_kill(&devmem->ref); +- hmm_devmem_ref_exit(&devmem->ref); +-error_percpu_ref: +- devres_free(devmem); +- return ERR_PTR(ret); + } +-EXPORT_SYMBOL(hmm_devmem_add); ++EXPORT_SYMBOL_GPL(hmm_devmem_add); + + struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, + struct device *device, + struct resource *res) + { + struct hmm_devmem *devmem; ++ void *result; + int ret; + + if (res->desc != IORES_DESC_DEVICE_PUBLIC_MEMORY) +@@ -1308,8 +1125,7 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, + + dev_pagemap_get_ops(); + +- devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem), +- GFP_KERNEL, dev_to_node(device)); ++ devmem = devm_kzalloc(device, sizeof(*devmem), GFP_KERNEL); + if (!devmem) + return ERR_PTR(-ENOMEM); + +@@ -1323,71 +1139,32 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, + ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release, + 0, GFP_KERNEL); + if (ret) +- goto error_percpu_ref; ++ return ERR_PTR(ret); + +- ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref); ++ ret = devm_add_action_or_reset(device, hmm_devmem_ref_exit, ++ &devmem->ref); + if (ret) +- goto error_devm_add_action; +- ++ return ERR_PTR(ret); + + devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT; + devmem->pfn_last = devmem->pfn_first + + (resource_size(devmem->resource) >> PAGE_SHIFT); + +- ret = hmm_devmem_pages_create(devmem); +- if (ret) +- goto error_devm_add_action; +- +- devres_add(device, devmem); +- +- ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref); +- if (ret) { +- hmm_devmem_remove(devmem); +- return ERR_PTR(ret); +- } ++ devmem->pagemap.type = MEMORY_DEVICE_PUBLIC; ++ devmem->pagemap.res = *devmem->resource; ++ devmem->pagemap.page_fault = hmm_devmem_fault; ++ devmem->pagemap.page_free = hmm_devmem_free; ++ devmem->pagemap.altmap_valid = false; ++ devmem->pagemap.ref = &devmem->ref; ++ devmem->pagemap.data = devmem; ++ devmem->pagemap.kill = hmm_devmem_ref_kill; + ++ result = devm_memremap_pages(devmem->device, &devmem->pagemap); ++ if (IS_ERR(result)) ++ return result; + return devmem; +- +-error_devm_add_action: +- hmm_devmem_ref_kill(&devmem->ref); +- hmm_devmem_ref_exit(&devmem->ref); +-error_percpu_ref: +- devres_free(devmem); +- return ERR_PTR(ret); +-} +-EXPORT_SYMBOL(hmm_devmem_add_resource); +- +-/* +- * hmm_devmem_remove() - remove device memory (kill and free ZONE_DEVICE) +- * +- * @devmem: hmm_devmem struct use to track and manage the ZONE_DEVICE memory +- * +- * This will hot-unplug memory that was hotplugged by hmm_devmem_add on behalf +- * of the device driver. It will free struct page and remove the resource that +- * reserved the physical address range for this device memory. +- */ +-void hmm_devmem_remove(struct hmm_devmem *devmem) +-{ +- resource_size_t start, size; +- struct device *device; +- bool cdm = false; +- +- if (!devmem) +- return; +- +- device = devmem->device; +- start = devmem->resource->start; +- size = resource_size(devmem->resource); +- +- cdm = devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY; +- hmm_devmem_ref_kill(&devmem->ref); +- hmm_devmem_ref_exit(&devmem->ref); +- hmm_devmem_pages_remove(devmem); +- +- if (!cdm) +- devm_release_mem_region(device, start, size); + } +-EXPORT_SYMBOL(hmm_devmem_remove); ++EXPORT_SYMBOL_GPL(hmm_devmem_add_resource); + + /* + * A device driver that wants to handle multiple devices memory through a +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 6e1469b80cb7..7e6bf74ddb1e 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1666,6 +1666,9 @@ enum oom_status { + + static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int order) + { ++ enum oom_status ret; ++ bool locked; ++ + if (order > PAGE_ALLOC_COSTLY_ORDER) + return OOM_SKIPPED; + +@@ -1700,10 +1703,23 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int + return OOM_ASYNC; + } + ++ mem_cgroup_mark_under_oom(memcg); ++ ++ locked = mem_cgroup_oom_trylock(memcg); ++ ++ if (locked) ++ mem_cgroup_oom_notify(memcg); ++ ++ mem_cgroup_unmark_under_oom(memcg); + if (mem_cgroup_out_of_memory(memcg, mask, order)) +- return OOM_SUCCESS; ++ ret = OOM_SUCCESS; ++ else ++ ret = OOM_FAILED; + +- return OOM_FAILED; ++ if (locked) ++ mem_cgroup_oom_unlock(memcg); ++ ++ return ret; + } + + /** +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 2b2b3ccbbfb5..cea0880eadfb 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -34,6 +34,7 @@ + #include <linux/hugetlb.h> + #include <linux/memblock.h> + #include <linux/compaction.h> ++#include <linux/rmap.h> + + #include <asm/tlbflush.h> + +@@ -1369,6 +1370,21 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) + pfn = page_to_pfn(compound_head(page)) + + hpage_nr_pages(page) - 1; + ++ /* ++ * HWPoison pages have elevated reference counts so the migration would ++ * fail on them. It also doesn't make any sense to migrate them in the ++ * first place. Still try to unmap such a page in case it is still mapped ++ * (e.g. current hwpoison implementation doesn't unmap KSM pages but keep ++ * the unmap as the catch all safety net). ++ */ ++ if (PageHWPoison(page)) { ++ if (WARN_ON(PageLRU(page))) ++ isolate_lru_page(page); ++ if (page_mapped(page)) ++ try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS); ++ continue; ++ } ++ + if (!get_page_unless_zero(page)) + continue; + /* +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 8688ae65ef58..20d3c0f47a5f 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2197,7 +2197,8 @@ int try_to_unuse(unsigned int type, bool frontswap, + */ + if (PageSwapCache(page) && + likely(page_private(page) == entry.val) && +- !page_swapped(page)) ++ (!PageTransCompound(page) || ++ !swap_page_trans_huge_swapped(si, entry))) + delete_from_swap_cache(compound_head(page)); + + /* +diff --git a/net/9p/client.c b/net/9p/client.c +index 2c9a17b9b46b..357214a51f13 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -181,6 +181,12 @@ static int parse_opts(char *opts, struct p9_client *clnt) + ret = r; + continue; + } ++ if (option < 4096) { ++ p9_debug(P9_DEBUG_ERROR, ++ "msize should be at least 4k\n"); ++ ret = -EINVAL; ++ continue; ++ } + clnt->msize = option; + break; + case Opt_trans: +@@ -983,10 +989,18 @@ static int p9_client_version(struct p9_client *c) + else if (!strncmp(version, "9P2000", 6)) + c->proto_version = p9_proto_legacy; + else { ++ p9_debug(P9_DEBUG_ERROR, ++ "server returned an unknown version: %s\n", version); + err = -EREMOTEIO; + goto error; + } + ++ if (msize < 4096) { ++ p9_debug(P9_DEBUG_ERROR, ++ "server returned a msize < 4096: %d\n", msize); ++ err = -EREMOTEIO; ++ goto error; ++ } + if (msize < c->msize) + c->msize = msize; + +@@ -1043,6 +1057,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) + if (clnt->msize > clnt->trans_mod->maxsize) + clnt->msize = clnt->trans_mod->maxsize; + ++ if (clnt->msize < 4096) { ++ p9_debug(P9_DEBUG_ERROR, ++ "Please specify a msize of at least 4k\n"); ++ err = -EINVAL; ++ goto free_client; ++ } ++ + err = p9_client_version(clnt); + if (err) + goto close_trans; +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index 1ece4bc3eb8d..152790ed309c 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1142,7 +1142,7 @@ static int svcauth_gss_legacy_init(struct svc_rqst *rqstp, + struct kvec *resv = &rqstp->rq_res.head[0]; + struct rsi *rsip, rsikey; + int ret; +- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); ++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); + + memset(&rsikey, 0, sizeof(rsikey)); + ret = gss_read_verf(gc, argv, authp, +@@ -1253,7 +1253,7 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp, + uint64_t handle; + int status; + int ret; +- struct net *net = rqstp->rq_xprt->xpt_net; ++ struct net *net = SVC_NET(rqstp); + struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); + + memset(&ud, 0, sizeof(ud)); +@@ -1444,7 +1444,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp) + __be32 *rpcstart; + __be32 *reject_stat = resv->iov_base + resv->iov_len; + int ret; +- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); ++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); + + dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n", + argv->iov_len); +@@ -1734,7 +1734,7 @@ svcauth_gss_release(struct svc_rqst *rqstp) + struct rpc_gss_wire_cred *gc = &gsd->clcred; + struct xdr_buf *resbuf = &rqstp->rq_res; + int stat = -EINVAL; +- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); ++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); + + if (gc->gc_proc != RPC_GSS_PROC_DATA) + goto out; +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index f96345b1180e..12bb23b8e0c5 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -54,6 +54,11 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) + h->last_refresh = now; + } + ++static void cache_fresh_locked(struct cache_head *head, time_t expiry, ++ struct cache_detail *detail); ++static void cache_fresh_unlocked(struct cache_head *head, ++ struct cache_detail *detail); ++ + static struct cache_head *sunrpc_cache_find_rcu(struct cache_detail *detail, + struct cache_head *key, + int hash) +@@ -100,6 +105,7 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + if (cache_is_expired(detail, tmp)) { + hlist_del_init_rcu(&tmp->cache_list); + detail->entries --; ++ cache_fresh_locked(tmp, 0, detail); + freeme = tmp; + break; + } +@@ -115,8 +121,10 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + cache_get(new); + spin_unlock(&detail->hash_lock); + +- if (freeme) ++ if (freeme) { ++ cache_fresh_unlocked(freeme, detail); + cache_put(freeme, detail); ++ } + return new; + } + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index fc6378cc0c1c..20ced24cc61b 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -117,15 +117,15 @@ static void + frwr_mr_recycle_worker(struct work_struct *work) + { + struct rpcrdma_mr *mr = container_of(work, struct rpcrdma_mr, mr_recycle); +- enum rpcrdma_frwr_state state = mr->frwr.fr_state; + struct rpcrdma_xprt *r_xprt = mr->mr_xprt; + + trace_xprtrdma_mr_recycle(mr); + +- if (state != FRWR_FLUSHED_LI) { ++ if (mr->mr_dir != DMA_NONE) { + trace_xprtrdma_mr_unmap(mr); + ib_dma_unmap_sg(r_xprt->rx_ia.ri_device, + mr->mr_sg, mr->mr_nents, mr->mr_dir); ++ mr->mr_dir = DMA_NONE; + } + + spin_lock(&r_xprt->rx_buf.rb_mrlock); +@@ -150,6 +150,8 @@ frwr_op_init_mr(struct rpcrdma_ia *ia, struct rpcrdma_mr *mr) + if (!mr->mr_sg) + goto out_list_err; + ++ frwr->fr_state = FRWR_IS_INVALID; ++ mr->mr_dir = DMA_NONE; + INIT_LIST_HEAD(&mr->mr_list); + INIT_WORK(&mr->mr_recycle, frwr_mr_recycle_worker); + sg_init_table(mr->mr_sg, depth); +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 3ddba94c939f..b9bc7f9f6bb9 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1329,9 +1329,12 @@ rpcrdma_mr_unmap_and_put(struct rpcrdma_mr *mr) + { + struct rpcrdma_xprt *r_xprt = mr->mr_xprt; + +- trace_xprtrdma_mr_unmap(mr); +- ib_dma_unmap_sg(r_xprt->rx_ia.ri_device, +- mr->mr_sg, mr->mr_nents, mr->mr_dir); ++ if (mr->mr_dir != DMA_NONE) { ++ trace_xprtrdma_mr_unmap(mr); ++ ib_dma_unmap_sg(r_xprt->rx_ia.ri_device, ++ mr->mr_sg, mr->mr_nents, mr->mr_dir); ++ mr->mr_dir = DMA_NONE; ++ } + __rpcrdma_mr_put(&r_xprt->rx_buf, mr); + } + +diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c +index f4eadd3f7350..b63ef865ce1e 100644 +--- a/security/selinux/ss/policydb.c ++++ b/security/selinux/ss/policydb.c +@@ -2108,6 +2108,7 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, + { + int i, j, rc; + u32 nel, len; ++ __be64 prefixbuf[1]; + __le32 buf[3]; + struct ocontext *l, *c; + u32 nodebuf[8]; +@@ -2217,21 +2218,30 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, + goto out; + break; + } +- case OCON_IBPKEY: +- rc = next_entry(nodebuf, fp, sizeof(u32) * 4); ++ case OCON_IBPKEY: { ++ u32 pkey_lo, pkey_hi; ++ ++ rc = next_entry(prefixbuf, fp, sizeof(u64)); ++ if (rc) ++ goto out; ++ ++ /* we need to have subnet_prefix in CPU order */ ++ c->u.ibpkey.subnet_prefix = be64_to_cpu(prefixbuf[0]); ++ ++ rc = next_entry(buf, fp, sizeof(u32) * 2); + if (rc) + goto out; + +- c->u.ibpkey.subnet_prefix = be64_to_cpu(*((__be64 *)nodebuf)); ++ pkey_lo = le32_to_cpu(buf[0]); ++ pkey_hi = le32_to_cpu(buf[1]); + +- if (nodebuf[2] > 0xffff || +- nodebuf[3] > 0xffff) { ++ if (pkey_lo > U16_MAX || pkey_hi > U16_MAX) { + rc = -EINVAL; + goto out; + } + +- c->u.ibpkey.low_pkey = le32_to_cpu(nodebuf[2]); +- c->u.ibpkey.high_pkey = le32_to_cpu(nodebuf[3]); ++ c->u.ibpkey.low_pkey = pkey_lo; ++ c->u.ibpkey.high_pkey = pkey_hi; + + rc = context_read_and_validate(&c->context[0], + p, +@@ -2239,7 +2249,10 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, + if (rc) + goto out; + break; +- case OCON_IBENDPORT: ++ } ++ case OCON_IBENDPORT: { ++ u32 port; ++ + rc = next_entry(buf, fp, sizeof(u32) * 2); + if (rc) + goto out; +@@ -2249,12 +2262,13 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, + if (rc) + goto out; + +- if (buf[1] > 0xff || buf[1] == 0) { ++ port = le32_to_cpu(buf[1]); ++ if (port > U8_MAX || port == 0) { + rc = -EINVAL; + goto out; + } + +- c->u.ibendport.port = le32_to_cpu(buf[1]); ++ c->u.ibendport.port = port; + + rc = context_read_and_validate(&c->context[0], + p, +@@ -2262,7 +2276,8 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, + if (rc) + goto out; + break; +- } ++ } /* end case */ ++ } /* end switch */ + } + } + rc = 0; +@@ -3105,6 +3120,7 @@ static int ocontext_write(struct policydb *p, struct policydb_compat_info *info, + { + unsigned int i, j, rc; + size_t nel, len; ++ __be64 prefixbuf[1]; + __le32 buf[3]; + u32 nodebuf[8]; + struct ocontext *c; +@@ -3192,12 +3208,17 @@ static int ocontext_write(struct policydb *p, struct policydb_compat_info *info, + return rc; + break; + case OCON_IBPKEY: +- *((__be64 *)nodebuf) = cpu_to_be64(c->u.ibpkey.subnet_prefix); ++ /* subnet_prefix is in CPU order */ ++ prefixbuf[0] = cpu_to_be64(c->u.ibpkey.subnet_prefix); + +- nodebuf[2] = cpu_to_le32(c->u.ibpkey.low_pkey); +- nodebuf[3] = cpu_to_le32(c->u.ibpkey.high_pkey); ++ rc = put_entry(prefixbuf, sizeof(u64), 1, fp); ++ if (rc) ++ return rc; ++ ++ buf[0] = cpu_to_le32(c->u.ibpkey.low_pkey); ++ buf[1] = cpu_to_le32(c->u.ibpkey.high_pkey); + +- rc = put_entry(nodebuf, sizeof(u32), 4, fp); ++ rc = put_entry(buf, sizeof(u32), 2, fp); + if (rc) + return rc; + rc = context_write(p, &c->context[0], fp); +diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c +index 598d140bb7cb..5fc497c6d738 100644 +--- a/sound/pci/cs46xx/dsp_spos.c ++++ b/sound/pci/cs46xx/dsp_spos.c +@@ -903,6 +903,9 @@ int cs46xx_dsp_proc_done (struct snd_cs46xx *chip) + struct dsp_spos_instance * ins = chip->dsp_spos_instance; + int i; + ++ if (!ins) ++ return 0; ++ + snd_info_free_entry(ins->proc_sym_info_entry); + ins->proc_sym_info_entry = NULL; + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index a105947eaf55..746a72e23cf9 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -246,7 +246,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) + h1 = snd_usb_find_csint_desc(host_iface->extra, + host_iface->extralen, + NULL, UAC_HEADER); +- if (!h1) { ++ if (!h1 || h1->bLength < sizeof(*h1)) { + dev_err(&dev->dev, "cannot find UAC_HEADER\n"); + return -EINVAL; + } +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index c63c84b54969..e7d441d0e839 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -753,8 +753,9 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state, + struct uac_mixer_unit_descriptor *desc) + { + int mu_channels; ++ void *c; + +- if (desc->bLength < 11) ++ if (desc->bLength < sizeof(*desc)) + return -EINVAL; + if (!desc->bNrInPins) + return -EINVAL; +@@ -763,6 +764,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state, + case UAC_VERSION_1: + case UAC_VERSION_2: + default: ++ if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1) ++ return 0; /* no bmControls -> skip */ + mu_channels = uac_mixer_unit_bNrChannels(desc); + break; + case UAC_VERSION_3: +@@ -772,7 +775,11 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state, + } + + if (!mu_channels) +- return -EINVAL; ++ return 0; ++ ++ c = uac_mixer_unit_bmControls(desc, state->mixer->protocol); ++ if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength) ++ return 0; /* no bmControls -> skip */ + + return mu_channels; + } +@@ -944,7 +951,7 @@ static int check_input_term(struct mixer_build *state, int id, + struct uac_mixer_unit_descriptor *d = p1; + + err = uac_mixer_unit_get_channels(state, d); +- if (err < 0) ++ if (err <= 0) + return err; + + term->channels = err; +@@ -2068,11 +2075,15 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid, + + if (state->mixer->protocol == UAC_VERSION_2) { + struct uac2_input_terminal_descriptor *d_v2 = raw_desc; ++ if (d_v2->bLength < sizeof(*d_v2)) ++ return -EINVAL; + control = UAC2_TE_CONNECTOR; + term_id = d_v2->bTerminalID; + bmctls = le16_to_cpu(d_v2->bmControls); + } else if (state->mixer->protocol == UAC_VERSION_3) { + struct uac3_input_terminal_descriptor *d_v3 = raw_desc; ++ if (d_v3->bLength < sizeof(*d_v3)) ++ return -EINVAL; + control = UAC3_TE_INSERTION; + term_id = d_v3->bTerminalID; + bmctls = le32_to_cpu(d_v3->bmControls); +@@ -2118,7 +2129,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, + if (err < 0) + continue; + /* no bmControls field (e.g. Maya44) -> ignore */ +- if (desc->bLength <= 10 + input_pins) ++ if (!num_outs) + continue; + err = check_input_term(state, desc->baSourceID[pin], &iterm); + if (err < 0) +@@ -2314,7 +2325,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, + char *name) + { + struct uac_processing_unit_descriptor *desc = raw_desc; +- int num_ins = desc->bNrInPins; ++ int num_ins; + struct usb_mixer_elem_info *cval; + struct snd_kcontrol *kctl; + int i, err, nameid, type, len; +@@ -2329,7 +2340,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, + 0, NULL, default_value_info + }; + +- if (desc->bLength < 13 || desc->bLength < 13 + num_ins || ++ if (desc->bLength < 13) { ++ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); ++ return -EINVAL; ++ } ++ ++ num_ins = desc->bNrInPins; ++ if (desc->bLength < 13 + num_ins || + desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) { + usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); + return -EINVAL; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 37fc0447c071..b345beb447bd 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3326,6 +3326,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++ { ++ .ifnum = -1 ++ }, + } + } + }, +@@ -3369,6 +3372,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++ { ++ .ifnum = -1 ++ }, + } + } + }, +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index 67cf849aa16b..d9e3de495c16 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -596,12 +596,8 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, + csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT); + + if (!csep || csep->bLength < 7 || +- csep->bDescriptorSubtype != UAC_EP_GENERAL) { +- usb_audio_warn(chip, +- "%u:%d : no or invalid class specific endpoint descriptor\n", +- iface_no, altsd->bAlternateSetting); +- return 0; +- } ++ csep->bDescriptorSubtype != UAC_EP_GENERAL) ++ goto error; + + if (protocol == UAC_VERSION_1) { + attributes = csep->bmAttributes; +@@ -609,6 +605,8 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, + struct uac2_iso_endpoint_descriptor *csep2 = + (struct uac2_iso_endpoint_descriptor *) csep; + ++ if (csep2->bLength < sizeof(*csep2)) ++ goto error; + attributes = csep->bmAttributes & UAC_EP_CS_ATTR_FILL_MAX; + + /* emulate the endpoint attributes of a v1 device */ +@@ -618,12 +616,20 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, + struct uac3_iso_endpoint_descriptor *csep3 = + (struct uac3_iso_endpoint_descriptor *) csep; + ++ if (csep3->bLength < sizeof(*csep3)) ++ goto error; + /* emulate the endpoint attributes of a v1 device */ + if (le32_to_cpu(csep3->bmControls) & UAC2_CONTROL_PITCH) + attributes |= UAC_EP_CS_ATTR_PITCH_CONTROL; + } + + return attributes; ++ ++ error: ++ usb_audio_warn(chip, ++ "%u:%d : no or invalid class specific endpoint descriptor\n", ++ iface_no, altsd->bAlternateSetting); ++ return 0; + } + + /* find an input terminal descriptor (either UAC1 or UAC2) with the given +@@ -631,13 +637,17 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, + */ + static void * + snd_usb_find_input_terminal_descriptor(struct usb_host_interface *ctrl_iface, +- int terminal_id) ++ int terminal_id, bool uac23) + { + struct uac2_input_terminal_descriptor *term = NULL; ++ size_t minlen = uac23 ? sizeof(struct uac2_input_terminal_descriptor) : ++ sizeof(struct uac_input_terminal_descriptor); + + while ((term = snd_usb_find_csint_desc(ctrl_iface->extra, + ctrl_iface->extralen, + term, UAC_INPUT_TERMINAL))) { ++ if (term->bLength < minlen) ++ continue; + if (term->bTerminalID == terminal_id) + return term; + } +@@ -655,7 +665,8 @@ snd_usb_find_output_terminal_descriptor(struct usb_host_interface *ctrl_iface, + while ((term = snd_usb_find_csint_desc(ctrl_iface->extra, + ctrl_iface->extralen, + term, UAC_OUTPUT_TERMINAL))) { +- if (term->bTerminalID == terminal_id) ++ if (term->bLength >= sizeof(*term) && ++ term->bTerminalID == terminal_id) + return term; + } + +@@ -729,7 +740,8 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip, + format = le16_to_cpu(as->wFormatTag); /* remember the format value */ + + iterm = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf, +- as->bTerminalLink); ++ as->bTerminalLink, ++ false); + if (iterm) { + num_channels = iterm->bNrChannels; + chconfig = le16_to_cpu(iterm->wChannelConfig); +@@ -764,7 +776,8 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip, + * to extract the clock + */ + input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf, +- as->bTerminalLink); ++ as->bTerminalLink, ++ true); + if (input_term) { + clock = input_term->bCSourceID; + if (!chconfig && (num_channels == input_term->bNrChannels)) +@@ -998,7 +1011,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, + * to extract the clock + */ + input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf, +- as->bTerminalLink); ++ as->bTerminalLink, ++ true); + if (input_term) { + clock = input_term->bCSourceID; + goto found_clock; +diff --git a/tools/testing/nvdimm/test/iomap.c b/tools/testing/nvdimm/test/iomap.c +index ff9d3a5825e1..c6635fee27d8 100644 +--- a/tools/testing/nvdimm/test/iomap.c ++++ b/tools/testing/nvdimm/test/iomap.c +@@ -104,16 +104,29 @@ void *__wrap_devm_memremap(struct device *dev, resource_size_t offset, + } + EXPORT_SYMBOL(__wrap_devm_memremap); + ++static void nfit_test_kill(void *_pgmap) ++{ ++ struct dev_pagemap *pgmap = _pgmap; ++ ++ pgmap->kill(pgmap->ref); ++} ++ + void *__wrap_devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap) + { + resource_size_t offset = pgmap->res.start; + struct nfit_test_resource *nfit_res = get_nfit_res(offset); + +- if (nfit_res) ++ if (nfit_res) { ++ int rc; ++ ++ rc = devm_add_action_or_reset(dev, nfit_test_kill, pgmap); ++ if (rc) ++ return ERR_PTR(rc); + return nfit_res->buf + offset - nfit_res->res.start; ++ } + return devm_memremap_pages(dev, pgmap); + } +-EXPORT_SYMBOL(__wrap_devm_memremap_pages); ++EXPORT_SYMBOL_GPL(__wrap_devm_memremap_pages); + + pfn_t __wrap_phys_to_pfn_t(phys_addr_t addr, unsigned long flags) + { +diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile +index d9a725478375..72c25a3cb658 100644 +--- a/tools/testing/selftests/android/Makefile ++++ b/tools/testing/selftests/android/Makefile +@@ -6,7 +6,7 @@ TEST_PROGS := run.sh + + include ../lib.mk + +-all: khdr ++all: + @for DIR in $(SUBDIRS); do \ + BUILD_TARGET=$(OUTPUT)/$$DIR; \ + mkdir $$BUILD_TARGET -p; \ +diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile +index ad1eeb14fda7..30996306cabc 100644 +--- a/tools/testing/selftests/futex/functional/Makefile ++++ b/tools/testing/selftests/futex/functional/Makefile +@@ -19,6 +19,7 @@ TEST_GEN_FILES := \ + TEST_PROGS := run.sh + + top_srcdir = ../../../../.. ++KSFT_KHDR_INSTALL := 1 + include ../../lib.mk + + $(TEST_GEN_FILES): $(HEADERS) +diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile +index 46648427d537..07f572a1bd3f 100644 +--- a/tools/testing/selftests/gpio/Makefile ++++ b/tools/testing/selftests/gpio/Makefile +@@ -10,8 +10,6 @@ TEST_PROGS_EXTENDED := gpio-mockup-chardev + GPIODIR := $(realpath ../../../gpio) + GPIOOBJ := gpio-utils.o + +-include ../lib.mk +- + all: $(TEST_PROGS_EXTENDED) + + override define CLEAN +@@ -19,7 +17,9 @@ override define CLEAN + $(MAKE) -C $(GPIODIR) OUTPUT=$(GPIODIR)/ clean + endef + +-$(TEST_PROGS_EXTENDED):| khdr ++KSFT_KHDR_INSTALL := 1 ++include ../lib.mk ++ + $(TEST_PROGS_EXTENDED): $(GPIODIR)/$(GPIOOBJ) + + $(GPIODIR)/$(GPIOOBJ): +diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile +index 01a219229238..52bfe5e76907 100644 +--- a/tools/testing/selftests/kvm/Makefile ++++ b/tools/testing/selftests/kvm/Makefile +@@ -1,6 +1,7 @@ + all: + + top_srcdir = ../../../.. ++KSFT_KHDR_INSTALL := 1 + UNAME_M := $(shell uname -m) + + LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/ucall.c lib/sparsebit.c +@@ -44,7 +45,6 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ) + + all: $(STATIC_LIBS) + $(TEST_GEN_PROGS): $(STATIC_LIBS) +-$(STATIC_LIBS):| khdr + + cscope: include_paths = $(LINUX_TOOL_INCLUDE) $(LINUX_HDR_PATH) include lib .. + cscope: +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index 0a8e75886224..8b0f16409ed7 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS)) + TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED)) + TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES)) + ++ifdef KSFT_KHDR_INSTALL + top_srcdir ?= ../../../.. + include $(top_srcdir)/scripts/subarch.include + ARCH ?= $(SUBARCH) + +-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) +- + .PHONY: khdr + khdr: + make ARCH=$(ARCH) -C $(top_srcdir) headers_install + +-ifdef KSFT_KHDR_INSTALL +-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr ++all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) ++else ++all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) + endif + + .ONESHELL: +diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile +index 14cfcf006936..c46c0eefab9e 100644 +--- a/tools/testing/selftests/networking/timestamping/Makefile ++++ b/tools/testing/selftests/networking/timestamping/Makefile +@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp + all: $(TEST_PROGS) + + top_srcdir = ../../../../.. ++KSFT_KHDR_INSTALL := 1 + include ../../lib.mk + + clean: +diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile +index dc92eb271d9a..be5a5e542804 100644 +--- a/tools/testing/selftests/tc-testing/bpf/Makefile ++++ b/tools/testing/selftests/tc-testing/bpf/Makefile +@@ -4,6 +4,7 @@ APIDIR := ../../../../include/uapi + TEST_GEN_FILES = action.o + + top_srcdir = ../../../../.. ++KSFT_KHDR_INSTALL := 1 + include ../../lib.mk + + CLANG ?= clang +diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile +index 6e67e726e5a5..e13eb6cc8901 100644 +--- a/tools/testing/selftests/vm/Makefile ++++ b/tools/testing/selftests/vm/Makefile +@@ -25,6 +25,7 @@ TEST_GEN_FILES += virtual_address_range + + TEST_PROGS := run_vmtests + ++KSFT_KHDR_INSTALL := 1 + include ../lib.mk + + $(OUTPUT)/userfaultfd: LDLIBS += -lpthread
