commit: 264a36c6bd3a583d84f56357edd4772b3aa69c79 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Jul 10 11:02:38 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Jul 10 11:02:38 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=264a36c6
Linux patch 4.9.185 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1184_linux-4.9.185.patch | 2773 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2777 insertions(+) diff --git a/0000_README b/0000_README index 0978678..d75882a 100644 --- a/0000_README +++ b/0000_README @@ -779,6 +779,10 @@ Patch: 1183_linux-4.9.184.patch From: http://www.kernel.org Desc: Linux 4.9.184 +Patch: 1184_linux-4.9.185.patch +From: http://www.kernel.org +Desc: Linux 4.9.185 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1184_linux-4.9.185.patch b/1184_linux-4.9.185.patch new file mode 100644 index 0000000..1954f63 --- /dev/null +++ b/1184_linux-4.9.185.patch @@ -0,0 +1,2773 @@ +diff --git a/Makefile b/Makefile +index 3b0dd4e90c44..c80dad45334e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 184 ++SUBLEVEL = 185 + EXTRAVERSION = + NAME = Roaring Lionus + +@@ -647,6 +647,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) + KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) + KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) + KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) ++KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) + KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) + + ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION +@@ -718,7 +719,6 @@ ifeq ($(cc-name),clang) + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) + KBUILD_CFLAGS += $(call cc-disable-warning, gnu) +-KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) + # Quiet clang warning: comparison of unsigned expression < 0 is always false + KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare) + # CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig +index c7a081c583b9..2de75779a247 100644 +--- a/arch/arc/Kconfig ++++ b/arch/arc/Kconfig +@@ -23,7 +23,7 @@ config ARC + select GENERIC_SMP_IDLE_THREAD + select HAVE_ARCH_KGDB + select HAVE_ARCH_TRACEHOOK +- select HAVE_FUTEX_CMPXCHG ++ select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_IOREMAP_PROT + select HAVE_KPROBES + select HAVE_KRETPROBES +diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h +index ea022d47896c..21ec82466d62 100644 +--- a/arch/arc/include/asm/bug.h ++++ b/arch/arc/include/asm/bug.h +@@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address); + + #define BUG() do { \ + pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ +- dump_stack(); \ ++ barrier_before_unreachable(); \ ++ __builtin_trap(); \ + } while (0) + + #define HAVE_ARCH_BUG +diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h +index d819de1c5d10..3ea4112c8302 100644 +--- a/arch/arc/include/asm/cmpxchg.h ++++ b/arch/arc/include/asm/cmpxchg.h +@@ -92,8 +92,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new) + + #endif /* CONFIG_ARC_HAS_LLSC */ + +-#define cmpxchg(ptr, o, n) ((typeof(*(ptr)))__cmpxchg((ptr), \ +- (unsigned long)(o), (unsigned long)(n))) ++#define cmpxchg(ptr, o, n) ({ \ ++ (typeof(*(ptr)))__cmpxchg((ptr), \ ++ (unsigned long)(o), \ ++ (unsigned long)(n)); \ ++}) + + /* + * atomic_cmpxchg is same as cmpxchg +@@ -198,8 +201,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr, + return __xchg_bad_pointer(); + } + +-#define xchg(ptr, with) ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), \ +- sizeof(*(ptr)))) ++#define xchg(ptr, with) ({ \ ++ (typeof(*(ptr)))__xchg((unsigned long)(with), \ ++ (ptr), \ ++ sizeof(*(ptr))); \ ++}) + + #endif /* CONFIG_ARC_PLAT_EZNPS */ + +diff --git a/arch/arc/kernel/traps.c b/arch/arc/kernel/traps.c +index c927aa84e652..2fb0cd39a31c 100644 +--- a/arch/arc/kernel/traps.c ++++ b/arch/arc/kernel/traps.c +@@ -155,3 +155,11 @@ void do_insterror_or_kprobe(unsigned long address, struct pt_regs *regs) + + insterror_is_error(address, regs); + } ++ ++/* ++ * abort() call generated by older gcc for __builtin_trap() ++ */ ++void abort(void) ++{ ++ __asm__ __volatile__("trap_s 5\n"); ++} +diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c +index a4dc881da277..3c88ccbe01af 100644 +--- a/arch/arc/mm/tlb.c ++++ b/arch/arc/mm/tlb.c +@@ -890,9 +890,11 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, + struct pt_regs *regs) + { + struct cpuinfo_arc_mmu *mmu = &cpuinfo_arc700[smp_processor_id()].mmu; +- unsigned int pd0[mmu->ways]; + unsigned long flags; +- int set; ++ int set, n_ways = mmu->ways; ++ ++ n_ways = min(n_ways, 4); ++ BUG_ON(mmu->ways > 4); + + local_irq_save(flags); + +@@ -900,9 +902,10 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, + for (set = 0; set < mmu->sets; set++) { + + int is_valid, way; ++ unsigned int pd0[4]; + + /* read out all the ways of current set */ +- for (way = 0, is_valid = 0; way < mmu->ways; way++) { ++ for (way = 0, is_valid = 0; way < n_ways; way++) { + write_aux_reg(ARC_REG_TLBINDEX, + SET_WAY_TO_IDX(mmu, set, way)); + write_aux_reg(ARC_REG_TLBCOMMAND, TLBRead); +@@ -916,14 +919,14 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, + continue; + + /* Scan the set for duplicate ways: needs a nested loop */ +- for (way = 0; way < mmu->ways - 1; way++) { ++ for (way = 0; way < n_ways - 1; way++) { + + int n; + + if (!pd0[way]) + continue; + +- for (n = way + 1; n < mmu->ways; n++) { ++ for (n = way + 1; n < n_ways; n++) { + if (pd0[way] != pd0[n]) + continue; + +diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c +index edb888ac5ad3..c6aa77dfd00a 100644 +--- a/arch/arm/mach-imx/cpuidle-imx6sx.c ++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c +@@ -15,6 +15,7 @@ + + #include "common.h" + #include "cpuidle.h" ++#include "hardware.h" + + static int imx6sx_idle_finish(unsigned long val) + { +@@ -108,7 +109,7 @@ int __init imx6sx_cpuidle_init(void) + * except for power up sw2iso which need to be + * larger than LDO ramp up time. + */ +- imx_gpc_set_arm_power_up_timing(0xf, 1); ++ imx_gpc_set_arm_power_up_timing(cpu_is_imx6sx() ? 0xf : 0x2, 1); + imx_gpc_set_arm_power_down_timing(1, 1); + + return cpuidle_register(&imx6sx_cpuidle_driver, NULL); +diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c +index 7f316982ce00..4130f1f26852 100644 +--- a/arch/arm64/kernel/module.c ++++ b/arch/arm64/kernel/module.c +@@ -33,10 +33,14 @@ + void *module_alloc(unsigned long size) + { + void *p; ++ u64 module_alloc_end = module_alloc_base + MODULES_VSIZE; ++ ++ if (IS_ENABLED(CONFIG_KASAN)) ++ /* don't exceed the static module region - see below */ ++ module_alloc_end = MODULES_END; + + p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base, +- module_alloc_base + MODULES_VSIZE, +- GFP_KERNEL, PAGE_KERNEL_EXEC, 0, ++ module_alloc_end, GFP_KERNEL, PAGE_KERNEL_EXEC, 0, + NUMA_NO_NODE, __builtin_return_address(0)); + + if (!p && IS_ENABLED(CONFIG_ARM64_MODULE_PLTS) && +diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c +index c9b9a5a322eb..c0f315ecfa7c 100644 +--- a/arch/arm64/kernel/vdso.c ++++ b/arch/arm64/kernel/vdso.c +@@ -37,7 +37,7 @@ + #include <asm/vdso.h> + #include <asm/vdso_datapage.h> + +-extern char vdso_start, vdso_end; ++extern char vdso_start[], vdso_end[]; + static unsigned long vdso_pages __ro_after_init; + + /* +@@ -124,14 +124,14 @@ static int __init vdso_init(void) + int i; + struct page **vdso_pagelist; + +- if (memcmp(&vdso_start, "\177ELF", 4)) { ++ if (memcmp(vdso_start, "\177ELF", 4)) { + pr_err("vDSO is not a valid ELF object!\n"); + return -EINVAL; + } + +- vdso_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT; ++ vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT; + pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n", +- vdso_pages + 1, vdso_pages, &vdso_start, 1L, vdso_data); ++ vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data); + + /* Allocate the vDSO pagelist, plus a page for the data. */ + vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *), +@@ -144,7 +144,7 @@ static int __init vdso_init(void) + + /* Grab the vDSO code pages. */ + for (i = 0; i < vdso_pages; i++) +- vdso_pagelist[i + 1] = pfn_to_page(PHYS_PFN(__pa(&vdso_start)) + i); ++ vdso_pagelist[i + 1] = pfn_to_page(PHYS_PFN(__pa(vdso_start)) + i); + + vdso_spec[0].pages = &vdso_pagelist[0]; + vdso_spec[1].pages = &vdso_pagelist[1]; +diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h +index 823616b5020b..19067821249f 100644 +--- a/arch/ia64/include/asm/bug.h ++++ b/arch/ia64/include/asm/bug.h +@@ -3,7 +3,11 @@ + + #ifdef CONFIG_BUG + #define ia64_abort() __builtin_trap() +-#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0) ++#define BUG() do { \ ++ printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ ++ ia64_abort(); \ ++} while (0) + + /* should this BUG be made generic? */ + #define HAVE_ARCH_BUG +diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h +index ef9a2e47352f..21ddbf925e22 100644 +--- a/arch/m68k/include/asm/bug.h ++++ b/arch/m68k/include/asm/bug.h +@@ -7,16 +7,19 @@ + #ifndef CONFIG_SUN3 + #define BUG() do { \ + printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #else + #define BUG() do { \ + printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + panic("BUG!"); \ + } while (0) + #endif + #else + #define BUG() do { \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #endif +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index bb9940c6927e..6cd230434f32 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -13,6 +13,7 @@ config MIPS + select HAVE_OPROFILE + select HAVE_PERF_EVENTS + select PERF_USE_VMALLOC ++ select HAVE_ARCH_COMPILER_H + select HAVE_ARCH_KGDB + select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_TRACEHOOK +diff --git a/arch/mips/include/asm/compiler.h b/arch/mips/include/asm/compiler.h +index e081a265f422..cc2eb1b06050 100644 +--- a/arch/mips/include/asm/compiler.h ++++ b/arch/mips/include/asm/compiler.h +@@ -8,6 +8,41 @@ + #ifndef _ASM_COMPILER_H + #define _ASM_COMPILER_H + ++/* ++ * With GCC 4.5 onwards we can use __builtin_unreachable to indicate to the ++ * compiler that a particular code path will never be hit. This allows it to be ++ * optimised out of the generated binary. ++ * ++ * Unfortunately at least GCC 4.6.3 through 7.3.0 inclusive suffer from a bug ++ * that can lead to instructions from beyond an unreachable statement being ++ * incorrectly reordered into earlier delay slots if the unreachable statement ++ * is the only content of a case in a switch statement. This can lead to ++ * seemingly random behaviour, such as invalid memory accesses from incorrectly ++ * reordered loads or stores. See this potential GCC fix for details: ++ * ++ * https://gcc.gnu.org/ml/gcc-patches/2015-09/msg00360.html ++ * ++ * It is unclear whether GCC 8 onwards suffer from the same issue - nothing ++ * relevant is mentioned in GCC 8 release notes and nothing obviously relevant ++ * stands out in GCC commit logs, but these newer GCC versions generate very ++ * different code for the testcase which doesn't exhibit the bug. ++ * ++ * GCC also handles stack allocation suboptimally when calling noreturn ++ * functions or calling __builtin_unreachable(): ++ * ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 ++ * ++ * We work around both of these issues by placing a volatile asm statement, ++ * which GCC is prevented from reordering past, prior to __builtin_unreachable ++ * calls. ++ * ++ * The .insn statement is required to ensure that any branches to the ++ * statement, which sadly must be kept due to the asm statement, are known to ++ * be branches to code and satisfy linker requirements for microMIPS kernels. ++ */ ++#undef barrier_before_unreachable ++#define barrier_before_unreachable() asm volatile(".insn") ++ + #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4) + #define GCC_IMM_ASM() "n" + #define GCC_REG_ACCUM "$0" +diff --git a/arch/mips/include/asm/netlogic/xlr/fmn.h b/arch/mips/include/asm/netlogic/xlr/fmn.h +index 5604db3d1836..d79c68fa78d9 100644 +--- a/arch/mips/include/asm/netlogic/xlr/fmn.h ++++ b/arch/mips/include/asm/netlogic/xlr/fmn.h +@@ -301,8 +301,6 @@ static inline int nlm_fmn_send(unsigned int size, unsigned int code, + for (i = 0; i < 8; i++) { + nlm_msgsnd(dest); + status = nlm_read_c2_status0(); +- if ((status & 0x2) == 1) +- pr_info("Send pending fail!\n"); + if ((status & 0x4) == 0) + return 0; + } +diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c +index dbb917403131..ec951dde0999 100644 +--- a/arch/mips/kernel/uprobes.c ++++ b/arch/mips/kernel/uprobes.c +@@ -111,9 +111,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs) + */ + aup->resume_epc = regs->cp0_epc + 4; + if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) { +- unsigned long epc; +- +- epc = regs->cp0_epc; + __compute_return_epc_for_insn(regs, + (union mips_instruction) aup->insn[0]); + aup->resume_epc = regs->cp0_epc; +diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c +index 7f2519cfb5d2..15f788601b64 100644 +--- a/arch/mips/math-emu/cp1emu.c ++++ b/arch/mips/math-emu/cp1emu.c +@@ -828,12 +828,12 @@ do { \ + } while (0) + + #define DIFROMREG(di, x) \ +- ((di) = get_fpr64(&ctx->fpr[(x) & ~(cop1_64bit(xcp) == 0)], 0)) ++ ((di) = get_fpr64(&ctx->fpr[(x) & ~(cop1_64bit(xcp) ^ 1)], 0)) + + #define DITOREG(di, x) \ + do { \ + unsigned fpr, i; \ +- fpr = (x) & ~(cop1_64bit(xcp) == 0); \ ++ fpr = (x) & ~(cop1_64bit(xcp) ^ 1); \ + set_fpr64(&ctx->fpr[fpr], 0, di); \ + for (i = 1; i < ARRAY_SIZE(ctx->fpr[x].val64); i++) \ + set_fpr64(&ctx->fpr[fpr], i, 0); \ +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 2da5649fc545..3cc5b2e4263c 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -386,6 +386,7 @@ static struct work_registers build_get_work_registers(u32 **p) + static void build_restore_work_registers(u32 **p) + { + if (scratch_reg >= 0) { ++ uasm_i_ehb(p); + UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); + return; + } +@@ -674,10 +675,12 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r, + uasm_i_mtc0(p, 0, C0_PAGEMASK); + uasm_il_b(p, r, lid); + } +- if (scratch_reg >= 0) ++ if (scratch_reg >= 0) { ++ uasm_i_ehb(p); + UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); +- else ++ } else { + UASM_i_LW(p, 1, scratchpad_offset(0), 0); ++ } + } else { + /* Reset default page size */ + if (PM_DEFAULT_MASK >> 16) { +@@ -935,10 +938,12 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r, + uasm_i_jr(p, ptr); + + if (mode == refill_scratch) { +- if (scratch_reg >= 0) ++ if (scratch_reg >= 0) { ++ uasm_i_ehb(p); + UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); +- else ++ } else { + UASM_i_LW(p, 1, scratchpad_offset(0), 0); ++ } + } else { + uasm_i_nop(p); + } +@@ -1238,6 +1243,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, + UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */ + + if (c0_scratch_reg >= 0) { ++ uasm_i_ehb(p); + UASM_i_MFC0(p, scratch, c0_kscratch(), c0_scratch_reg); + build_tlb_write_entry(p, l, r, tlb_random); + uasm_l_leave(l, *p); +@@ -1592,15 +1598,17 @@ static void build_setup_pgd(void) + uasm_i_dinsm(&p, a0, 0, 29, 64 - 29); + uasm_l_tlbl_goaround1(&l, p); + UASM_i_SLL(&p, a0, a0, 11); +- uasm_i_jr(&p, 31); + UASM_i_MTC0(&p, a0, C0_CONTEXT); ++ uasm_i_jr(&p, 31); ++ uasm_i_ehb(&p); + } else { + /* PGD in c0_KScratch */ +- uasm_i_jr(&p, 31); + if (cpu_has_ldpte) + UASM_i_MTC0(&p, a0, C0_PWBASE); + else + UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); ++ uasm_i_jr(&p, 31); ++ uasm_i_ehb(&p); + } + #else + #ifdef CONFIG_SMP +@@ -1614,13 +1622,16 @@ static void build_setup_pgd(void) + UASM_i_LA_mostly(&p, a2, pgdc); + UASM_i_SW(&p, a0, uasm_rel_lo(pgdc), a2); + #endif /* SMP */ +- uasm_i_jr(&p, 31); + + /* if pgd_reg is allocated, save PGD also to scratch register */ +- if (pgd_reg != -1) ++ if (pgd_reg != -1) { + UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); +- else ++ uasm_i_jr(&p, 31); ++ uasm_i_ehb(&p); ++ } else { ++ uasm_i_jr(&p, 31); + uasm_i_nop(&p); ++ } + #endif + if (p >= tlbmiss_handler_setup_pgd_end) + panic("tlbmiss_handler_setup_pgd space exceeded"); +diff --git a/arch/parisc/math-emu/cnv_float.h b/arch/parisc/math-emu/cnv_float.h +index 933423fa5144..b0db61188a61 100644 +--- a/arch/parisc/math-emu/cnv_float.h ++++ b/arch/parisc/math-emu/cnv_float.h +@@ -60,19 +60,19 @@ + ((exponent < (SGL_P - 1)) ? \ + (Sall(sgl_value) << (SGL_EXP_LENGTH + 1 + exponent)) : FALSE) + +-#define Int_isinexact_to_sgl(int_value) (int_value << 33 - SGL_EXP_LENGTH) ++#define Int_isinexact_to_sgl(int_value) ((int_value << 33 - SGL_EXP_LENGTH) != 0) + + #define Sgl_roundnearest_from_int(int_value,sgl_value) \ + if (int_value & 1<<(SGL_EXP_LENGTH - 2)) /* round bit */ \ +- if ((int_value << 34 - SGL_EXP_LENGTH) || Slow(sgl_value)) \ ++ if (((int_value << 34 - SGL_EXP_LENGTH) != 0) || Slow(sgl_value)) \ + Sall(sgl_value)++ + + #define Dint_isinexact_to_sgl(dint_valueA,dint_valueB) \ +- ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB)) ++ (((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) != 0) || Dintp2(dint_valueB)) + + #define Sgl_roundnearest_from_dint(dint_valueA,dint_valueB,sgl_value) \ + if (Dintp1(dint_valueA) & 1<<(SGL_EXP_LENGTH - 2)) \ +- if ((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) || \ ++ if (((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) != 0) || \ + Dintp2(dint_valueB) || Slow(sgl_value)) Sall(sgl_value)++ + + #define Dint_isinexact_to_dbl(dint_value) \ +diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h +index 48e8f1f14872..b7067590f15c 100644 +--- a/arch/powerpc/include/asm/ppc-opcode.h ++++ b/arch/powerpc/include/asm/ppc-opcode.h +@@ -261,6 +261,7 @@ + #define PPC_INST_MULLI 0x1c000000 + #define PPC_INST_DIVWU 0x7c000396 + #define PPC_INST_DIVD 0x7c0003d2 ++#define PPC_INST_DIVDU 0x7c000392 + #define PPC_INST_RLWINM 0x54000000 + #define PPC_INST_RLWIMI 0x50000000 + #define PPC_INST_RLDICL 0x78000000 +diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h +index 7b1d1721a26a..83e5b255d142 100644 +--- a/arch/powerpc/net/bpf_jit.h ++++ b/arch/powerpc/net/bpf_jit.h +@@ -116,7 +116,7 @@ + ___PPC_RA(a) | IMM_L(i)) + #define PPC_DIVWU(d, a, b) EMIT(PPC_INST_DIVWU | ___PPC_RT(d) | \ + ___PPC_RA(a) | ___PPC_RB(b)) +-#define PPC_DIVD(d, a, b) EMIT(PPC_INST_DIVD | ___PPC_RT(d) | \ ++#define PPC_DIVDU(d, a, b) EMIT(PPC_INST_DIVDU | ___PPC_RT(d) | \ + ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_AND(d, a, b) EMIT(PPC_INST_AND | ___PPC_RA(d) | \ + ___PPC_RS(a) | ___PPC_RB(b)) +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index e7d78f9156ce..9f0810cfe5f3 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -419,12 +419,12 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + PPC_LI(b2p[BPF_REG_0], 0); + PPC_JMP(exit_addr); + if (BPF_OP(code) == BPF_MOD) { +- PPC_DIVD(b2p[TMP_REG_1], dst_reg, src_reg); ++ PPC_DIVDU(b2p[TMP_REG_1], dst_reg, src_reg); + PPC_MULD(b2p[TMP_REG_1], src_reg, + b2p[TMP_REG_1]); + PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); + } else +- PPC_DIVD(dst_reg, dst_reg, src_reg); ++ PPC_DIVDU(dst_reg, dst_reg, src_reg); + break; + case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */ + case BPF_ALU | BPF_DIV | BPF_K: /* (u32) dst /= (u32) imm */ +@@ -452,7 +452,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + break; + case BPF_ALU64: + if (BPF_OP(code) == BPF_MOD) { +- PPC_DIVD(b2p[TMP_REG_2], dst_reg, ++ PPC_DIVDU(b2p[TMP_REG_2], dst_reg, + b2p[TMP_REG_1]); + PPC_MULD(b2p[TMP_REG_1], + b2p[TMP_REG_1], +@@ -460,7 +460,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + PPC_SUB(dst_reg, dst_reg, + b2p[TMP_REG_1]); + } else +- PPC_DIVD(dst_reg, dst_reg, ++ PPC_DIVDU(dst_reg, dst_reg, + b2p[TMP_REG_1]); + break; + } +diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h +index eaa8f8d38125..fa85cac0285c 100644 +--- a/arch/sparc/include/asm/bug.h ++++ b/arch/sparc/include/asm/bug.h +@@ -8,10 +8,14 @@ + void do_BUG(const char *file, int line); + #define BUG() do { \ + do_BUG(__FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #else +-#define BUG() __builtin_trap() ++#define BUG() do { \ ++ barrier_before_unreachable(); \ ++ __builtin_trap(); \ ++} while (0) + #endif + + #define HAVE_ARCH_BUG +diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c +index 71e7f77f6776..84a80cd004eb 100644 +--- a/arch/sparc/kernel/perf_event.c ++++ b/arch/sparc/kernel/perf_event.c +@@ -889,6 +889,10 @@ static int sparc_perf_event_set_period(struct perf_event *event, + s64 period = hwc->sample_period; + int ret = 0; + ++ /* The period may have been changed by PERF_EVENT_IOC_PERIOD */ ++ if (unlikely(period != hwc->last_period)) ++ left = period - (hwc->last_period - left); ++ + if (unlikely(left <= -period)) { + left = period; + local64_set(&hwc->period_left, left); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 16970c39baea..07a6c1fa173b 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -828,6 +828,16 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) + break; + } + ++ /* ++ * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper ++ * bit in the mask to allow guests to use the mitigation even in the ++ * case where the host does not enable it. ++ */ ++ if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || ++ static_cpu_has(X86_FEATURE_AMD_SSBD)) { ++ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; ++ } ++ + /* + * We have three CPU feature flags that are in play here: + * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible. +@@ -845,7 +855,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) + x86_amd_ssb_disable(); + } else { + x86_spec_ctrl_base |= SPEC_CTRL_SSBD; +- x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; + wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); + } + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index c8630569e392..cf32533225bb 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1992,7 +1992,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu) + struct kvm_lapic *apic = vcpu->arch.apic; + int highest_irr; + +- if (!apic_enabled(apic)) ++ if (!kvm_apic_hw_enabled(apic)) + return -1; + + apic_update_ppr(apic); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 72efecc4288b..8b06700d1676 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1365,7 +1365,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) + vcpu->arch.tsc_always_catchup = 1; + return 0; + } else { +- WARN(1, "user requested TSC rate below hardware speed\n"); ++ pr_warn_ratelimited("user requested TSC rate below hardware speed\n"); + return -1; + } + } +@@ -1375,8 +1375,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) + user_tsc_khz, tsc_khz); + + if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) { +- WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", +- user_tsc_khz); ++ pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", ++ user_tsc_khz); + return -1; + } + +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 1c5705481c69..c90a1727cd2c 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -55,6 +55,9 @@ static struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact) + list_for_each_entry(q, &crypto_alg_list, cra_list) { + int match = 0; + ++ if (crypto_is_larval(q)) ++ continue; ++ + if ((q->cra_flags ^ p->cru_type) & p->cru_mask) + continue; + +diff --git a/drivers/clk/sunxi/clk-sun8i-bus-gates.c b/drivers/clk/sunxi/clk-sun8i-bus-gates.c +index 63fdb790df29..bee305bdddbe 100644 +--- a/drivers/clk/sunxi/clk-sun8i-bus-gates.c ++++ b/drivers/clk/sunxi/clk-sun8i-bus-gates.c +@@ -78,6 +78,10 @@ static void __init sun8i_h3_bus_gates_init(struct device_node *node) + clk_parent = APB1; + else if (index >= 96 && index <= 127) + clk_parent = APB2; ++ else { ++ WARN_ON(true); ++ continue; ++ } + + clk_reg = reg + 4 * (index / 32); + clk_bit = index % 32; +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index b9c29720aeb1..84856ac75a09 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -632,7 +632,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size, + spin_lock_irqsave(&sdma->channel_0_lock, flags); + + bd0->mode.command = C0_SETPM; +- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; ++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; + bd0->mode.count = size / 2; + bd0->buffer_addr = buf_phys; + bd0->ext_buffer_addr = address; +@@ -909,7 +909,7 @@ static int sdma_load_context(struct sdma_channel *sdmac) + context->gReg[7] = sdmac->watermark_level; + + bd0->mode.command = C0_SETDM; +- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; ++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; + bd0->mode.count = sizeof(*context) / 4; + bd0->buffer_addr = sdma->context_phys; + bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel; +diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c +index 28341b32067f..84dea276175b 100644 +--- a/drivers/gpu/drm/arm/hdlcd_crtc.c ++++ b/drivers/gpu/drm/arm/hdlcd_crtc.c +@@ -170,7 +170,8 @@ static int hdlcd_crtc_atomic_check(struct drm_crtc *crtc, + long rate, clk_rate = mode->clock * 1000; + + rate = clk_round_rate(hdlcd->clk, clk_rate); +- if (rate != clk_rate) { ++ /* 0.1% seems a close enough tolerance for the TDA19988 on Juno */ ++ if (abs(rate - clk_rate) * 1000 > clk_rate) { + /* clock required by mode not supported by hardware */ + return -EINVAL; + } +diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c +index 1ea0e1f43397..54d878cb458f 100644 +--- a/drivers/gpu/drm/i915/intel_csr.c ++++ b/drivers/gpu/drm/i915/intel_csr.c +@@ -280,10 +280,17 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, + uint32_t i; + uint32_t *dmc_payload; + uint32_t required_version; ++ size_t fsize; + + if (!fw) + return NULL; + ++ fsize = sizeof(struct intel_css_header) + ++ sizeof(struct intel_package_header) + ++ sizeof(struct intel_dmc_header); ++ if (fsize > fw->size) ++ goto error_truncated; ++ + /* Extract CSS Header information*/ + css_header = (struct intel_css_header *)fw->data; + if (sizeof(struct intel_css_header) != +@@ -349,6 +356,9 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, + return NULL; + } + readcount += dmc_offset; ++ fsize += dmc_offset; ++ if (fsize > fw->size) ++ goto error_truncated; + + /* Extract dmc_header information. */ + dmc_header = (struct intel_dmc_header *)&fw->data[readcount]; +@@ -379,6 +389,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, + + /* fw_size is in dwords, so multiplied by 4 to convert into bytes. */ + nbytes = dmc_header->fw_size * 4; ++ fsize += nbytes; ++ if (fsize > fw->size) ++ goto error_truncated; ++ + if (nbytes > CSR_MAX_FW_SIZE) { + DRM_ERROR("CSR firmware too big (%u) bytes\n", nbytes); + return NULL; +@@ -392,6 +406,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv, + } + + return memcpy(dmc_payload, &fw->data[readcount], nbytes); ++ ++error_truncated: ++ DRM_ERROR("Truncated DMC firmware, rejecting.\n"); ++ return NULL; + } + + static void csr_load_work_fn(struct work_struct *work) +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index 8dbba61a2708..82114fe2a42a 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -76,14 +76,14 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc, + drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false); + ipu_dc_disable(ipu); + ++ drm_crtc_vblank_off(crtc); ++ + spin_lock_irq(&crtc->dev->event_lock); +- if (crtc->state->event) { ++ if (crtc->state->event && !crtc->state->active) { + drm_crtc_send_vblank_event(crtc, crtc->state->event); + crtc->state->event = NULL; + } + spin_unlock_irq(&crtc->dev->event_lock); +- +- drm_crtc_vblank_off(crtc); + } + + static void imx_drm_crtc_reset(struct drm_crtc *crtc) +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index eaa5a2240c0c..bdbf358697cd 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -720,6 +720,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi) + /* Skip connector cleanup if creation was delegated to the bridge */ + if (dsi->conn.dev) + drm_connector_cleanup(&dsi->conn); ++ if (dsi->panel) ++ drm_panel_detach(dsi->panel); + } + + static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp) +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index c00bad02761a..0d75bc7b5065 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -1028,14 +1028,15 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, + const struct pmbus_driver_info *info, + const char *name, + int index, int page, +- const struct pmbus_sensor_attr *attr) ++ const struct pmbus_sensor_attr *attr, ++ bool paged) + { + struct pmbus_sensor *base; + int ret; + + if (attr->label) { + ret = pmbus_add_label(data, name, index, attr->label, +- attr->paged ? page + 1 : 0); ++ paged ? page + 1 : 0); + if (ret) + return ret; + } +@@ -1067,6 +1068,30 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, + return 0; + } + ++static bool pmbus_sensor_is_paged(const struct pmbus_driver_info *info, ++ const struct pmbus_sensor_attr *attr) ++{ ++ int p; ++ ++ if (attr->paged) ++ return true; ++ ++ /* ++ * Some attributes may be present on more than one page despite ++ * not being marked with the paged attribute. If that is the case, ++ * then treat the sensor as being paged and add the page suffix to the ++ * attribute name. ++ * We don't just add the paged attribute to all such attributes, in ++ * order to maintain the un-suffixed labels in the case where the ++ * attribute is only on page 0. ++ */ ++ for (p = 1; p < info->pages; p++) { ++ if (info->func[p] & attr->func) ++ return true; ++ } ++ return false; ++} ++ + static int pmbus_add_sensor_attrs(struct i2c_client *client, + struct pmbus_data *data, + const char *name, +@@ -1080,14 +1105,15 @@ static int pmbus_add_sensor_attrs(struct i2c_client *client, + index = 1; + for (i = 0; i < nattrs; i++) { + int page, pages; ++ bool paged = pmbus_sensor_is_paged(info, attrs); + +- pages = attrs->paged ? info->pages : 1; ++ pages = paged ? info->pages : 1; + for (page = 0; page < pages; page++) { + if (!(info->func[page] & attrs->func)) + continue; + ret = pmbus_add_sensor_attrs_one(client, data, info, + name, index, page, +- attrs); ++ attrs, paged); + if (ret) + return ret; + index++; +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index d30b3b908621..85db856047a9 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -9620,6 +9620,7 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd) + + /* disable the port */ + clear_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK); ++ cancel_work_sync(&ppd->freeze_work); + } + + static inline int init_cpu_counters(struct hfi1_devdata *dd) +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 9cbe52d21077..76e63c88a87a 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -410,10 +410,7 @@ static void sdma_flush(struct sdma_engine *sde) + sdma_flush_descq(sde); + spin_lock_irqsave(&sde->flushlist_lock, flags); + /* copy flush list */ +- list_for_each_entry_safe(txp, txp_next, &sde->flushlist, list) { +- list_del_init(&txp->list); +- list_add_tail(&txp->list, &flushlist); +- } ++ list_splice_init(&sde->flushlist, &flushlist); + spin_unlock_irqrestore(&sde->flushlist_lock, flags); + /* flush from flush list */ + list_for_each_entry_safe(txp, txp_next, &flushlist, list) +@@ -2406,7 +2403,7 @@ unlock_noconn: + wait->tx_count++; + wait->count += tx->num_desc; + } +- schedule_work(&sde->flush_worker); ++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker); + ret = -ECOMM; + goto unlock; + nodesc: +@@ -2504,7 +2501,7 @@ unlock_noconn: + } + } + spin_unlock(&sde->flushlist_lock); +- schedule_work(&sde->flush_worker); ++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker); + ret = -ECOMM; + goto update_tail; + nodesc: +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 4c111162d552..098296aaa225 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -260,7 +260,6 @@ struct user_sdma_txreq { + struct list_head list; + struct user_sdma_request *req; + u16 flags; +- unsigned busycount; + u64 seqnum; + }; + +@@ -323,25 +322,22 @@ static int defer_packet_queue( + struct hfi1_user_sdma_pkt_q *pq = + container_of(wait, struct hfi1_user_sdma_pkt_q, busy); + struct hfi1_ibdev *dev = &pq->dd->verbs_dev; +- struct user_sdma_txreq *tx = +- container_of(txreq, struct user_sdma_txreq, txreq); + +- if (sdma_progress(sde, seq, txreq)) { +- if (tx->busycount++ < MAX_DEFER_RETRY_COUNT) +- goto eagain; +- } ++ write_seqlock(&dev->iowait_lock); ++ if (sdma_progress(sde, seq, txreq)) ++ goto eagain; + /* + * We are assuming that if the list is enqueued somewhere, it + * is to the dmawait list since that is the only place where + * it is supposed to be enqueued. + */ + xchg(&pq->state, SDMA_PKT_Q_DEFERRED); +- write_seqlock(&dev->iowait_lock); + if (list_empty(&pq->busy.list)) + list_add_tail(&pq->busy.list, &sde->dmawait); + write_sequnlock(&dev->iowait_lock); + return -EBUSY; + eagain: ++ write_sequnlock(&dev->iowait_lock); + return -EAGAIN; + } + +@@ -925,7 +921,6 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts) + + tx->flags = 0; + tx->req = req; +- tx->busycount = 0; + INIT_LIST_HEAD(&tx->list); + + if (req->seqnum == req->info.npkts - 1) +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index d9c71750e22d..15054a0cbf6d 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1344,8 +1344,6 @@ static void hfi1_fill_device_attr(struct hfi1_devdata *dd) + rdi->dparms.props.max_cq = hfi1_max_cqs; + rdi->dparms.props.max_ah = hfi1_max_ahs; + rdi->dparms.props.max_cqe = hfi1_max_cqes; +- rdi->dparms.props.max_mr = rdi->lkey_table.max; +- rdi->dparms.props.max_fmr = rdi->lkey_table.max; + rdi->dparms.props.max_map_per_fmr = 32767; + rdi->dparms.props.max_pd = hfi1_max_pds; + rdi->dparms.props.max_qp_rd_atom = HFI1_MAX_RDMA_ATOMIC; +diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c +index d8a5bad49680..837729d0be46 100644 +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c +@@ -100,7 +100,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev, + if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) { + struct hfi1_qp_priv *priv; + +- tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC); ++ tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP); + if (tx) + goto out; + priv = qp->priv; +diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h +index 31ded57592ee..0bd58a0772e2 100644 +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h +@@ -71,6 +71,7 @@ struct hfi1_ibdev; + struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev, + struct rvt_qp *qp); + ++#define VERBS_TXREQ_GFP (GFP_ATOMIC | __GFP_NOWARN) + static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev, + struct rvt_qp *qp) + __must_hold(&qp->slock) +@@ -78,7 +79,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev, + struct verbs_txreq *tx; + struct hfi1_qp_priv *priv = qp->priv; + +- tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC); ++ tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP); + if (unlikely(!tx)) { + /* call slow path to get the lock */ + tx = __get_txreq(dev, qp); +diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c +index 954f15064514..d6e183775e24 100644 +--- a/drivers/infiniband/hw/qib/qib_verbs.c ++++ b/drivers/infiniband/hw/qib/qib_verbs.c +@@ -1568,8 +1568,6 @@ static void qib_fill_device_attr(struct qib_devdata *dd) + rdi->dparms.props.max_cq = ib_qib_max_cqs; + rdi->dparms.props.max_cqe = ib_qib_max_cqes; + rdi->dparms.props.max_ah = ib_qib_max_ahs; +- rdi->dparms.props.max_mr = rdi->lkey_table.max; +- rdi->dparms.props.max_fmr = rdi->lkey_table.max; + rdi->dparms.props.max_map_per_fmr = 32767; + rdi->dparms.props.max_qp_rd_atom = QIB_MAX_RDMA_ATOMIC; + rdi->dparms.props.max_qp_init_rd_atom = 255; +diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c +index 49d55a0322f6..dbd4c0d268e9 100644 +--- a/drivers/infiniband/sw/rdmavt/mr.c ++++ b/drivers/infiniband/sw/rdmavt/mr.c +@@ -94,6 +94,8 @@ int rvt_driver_mr_init(struct rvt_dev_info *rdi) + for (i = 0; i < rdi->lkey_table.max; i++) + RCU_INIT_POINTER(rdi->lkey_table.table[i], NULL); + ++ rdi->dparms.props.max_mr = rdi->lkey_table.max; ++ rdi->dparms.props.max_fmr = rdi->lkey_table.max; + return 0; + } + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index 6500c3b5a89c..8b330b53d636 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -370,7 +370,8 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt, + offset = qpt->incr | ((offset & 1) ^ 1); + } + /* there can be no set bits in low-order QoS bits */ +- WARN_ON(offset & (BIT(rdi->dparms.qos_shift) - 1)); ++ WARN_ON(rdi->dparms.qos_shift > 1 && ++ offset & ((BIT(rdi->dparms.qos_shift - 1) - 1) << 1)); + qpn = mk_qpn(qpt, map, offset); + } + +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index a306453d40d2..89d37d0d45ed 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -991,13 +991,31 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + #ifdef CONFIG_COMPAT + +-#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) ++/* ++ * These IOCTLs change their size and thus their numbers between ++ * 32 and 64 bits. ++ */ ++#define UI_SET_PHYS_COMPAT \ ++ _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) ++#define UI_BEGIN_FF_UPLOAD_COMPAT \ ++ _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat) ++#define UI_END_FF_UPLOAD_COMPAT \ ++ _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat) + + static long uinput_compat_ioctl(struct file *file, + unsigned int cmd, unsigned long arg) + { +- if (cmd == UI_SET_PHYS_COMPAT) ++ switch (cmd) { ++ case UI_SET_PHYS_COMPAT: + cmd = UI_SET_PHYS; ++ break; ++ case UI_BEGIN_FF_UPLOAD_COMPAT: ++ cmd = UI_BEGIN_FF_UPLOAD; ++ break; ++ case UI_END_FF_UPLOAD_COMPAT: ++ cmd = UI_END_FF_UPLOAD; ++ break; ++ } + + return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); + } +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index 9d167c9af2c6..e153276ed954 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -131,12 +131,12 @@ static inline u32 usbtll_read(void __iomem *base, u32 reg) + return readl_relaxed(base + reg); + } + +-static inline void usbtll_writeb(void __iomem *base, u8 reg, u8 val) ++static inline void usbtll_writeb(void __iomem *base, u32 reg, u8 val) + { + writeb_relaxed(val, base + reg); + } + +-static inline u8 usbtll_readb(void __iomem *base, u8 reg) ++static inline u8 usbtll_readb(void __iomem *base, u32 reg) + { + return readb_relaxed(base + reg); + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 93169729dfc9..fd01138c411e 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4241,12 +4241,12 @@ void bond_setup(struct net_device *bond_dev) + bond_dev->features |= NETIF_F_NETNS_LOCAL; + + bond_dev->hw_features = BOND_VLAN_FEATURES | +- NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_CTAG_FILTER; + + bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL; + bond_dev->features |= bond_dev->hw_features; ++ bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX; + } + + /* Destroy a bonding device. +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 47f43bdecd51..baef09b9449f 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -171,7 +171,7 @@ + #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16) + #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff) + +-#define FLEXCAN_TIMEOUT_US (50) ++#define FLEXCAN_TIMEOUT_US (250) + + /* FLEXCAN hardware feature flags + * +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index dc510069d37b..2edd193c96ab 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -1742,7 +1742,7 @@ static int _mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid, + int err; + + if (!vid) +- return -EINVAL; ++ return -EOPNOTSUPP; + + err = _mv88e6xxx_vtu_vid_write(chip, vid - 1); + if (err) +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 4cd163390dcc..f38848c4f69d 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -367,6 +367,7 @@ static int __lb_setup(struct net_device *ndev, + static int __lb_up(struct net_device *ndev, + enum hnae_loop loop_mode) + { ++#define NIC_LB_TEST_WAIT_PHY_LINK_TIME 300 + struct hns_nic_priv *priv = netdev_priv(ndev); + struct hnae_handle *h = priv->ae_handle; + int speed, duplex; +@@ -393,6 +394,9 @@ static int __lb_up(struct net_device *ndev, + + h->dev->ops->adjust_link(h, speed, duplex); + ++ /* wait adjust link done and phy ready */ ++ msleep(NIC_LB_TEST_WAIT_PHY_LINK_TIME); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 20de37a414fe..d10c8a8156bc 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -1700,6 +1700,7 @@ static void mtk_poll_controller(struct net_device *dev) + + static int mtk_start_dma(struct mtk_eth *eth) + { ++ u32 rx_2b_offset = (NET_IP_ALIGN == 2) ? MTK_RX_2B_OFFSET : 0; + int err; + + err = mtk_dma_init(eth); +@@ -1714,7 +1715,7 @@ static int mtk_start_dma(struct mtk_eth *eth) + MTK_QDMA_GLO_CFG); + + mtk_w32(eth, +- MTK_RX_DMA_EN | MTK_RX_2B_OFFSET | ++ MTK_RX_DMA_EN | rx_2b_offset | + MTK_RX_BT_32DWORDS | MTK_MULTI_EN, + MTK_PDMA_GLO_CFG); + +@@ -2175,13 +2176,13 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + + switch (cmd->cmd) { + case ETHTOOL_GRXRINGS: +- if (dev->features & NETIF_F_LRO) { ++ if (dev->hw_features & NETIF_F_LRO) { + cmd->data = MTK_MAX_RX_RING_NUM; + ret = 0; + } + break; + case ETHTOOL_GRXCLSRLCNT: +- if (dev->features & NETIF_F_LRO) { ++ if (dev->hw_features & NETIF_F_LRO) { + struct mtk_mac *mac = netdev_priv(dev); + + cmd->rule_cnt = mac->hwlro_ip_cnt; +@@ -2189,11 +2190,11 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + } + break; + case ETHTOOL_GRXCLSRULE: +- if (dev->features & NETIF_F_LRO) ++ if (dev->hw_features & NETIF_F_LRO) + ret = mtk_hwlro_get_fdir_entry(dev, cmd); + break; + case ETHTOOL_GRXCLSRLALL: +- if (dev->features & NETIF_F_LRO) ++ if (dev->hw_features & NETIF_F_LRO) + ret = mtk_hwlro_get_fdir_all(dev, cmd, + rule_locs); + break; +@@ -2210,11 +2211,11 @@ static int mtk_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) + + switch (cmd->cmd) { + case ETHTOOL_SRXCLSRLINS: +- if (dev->features & NETIF_F_LRO) ++ if (dev->hw_features & NETIF_F_LRO) + ret = mtk_hwlro_add_ipaddr(dev, cmd); + break; + case ETHTOOL_SRXCLSRLDEL: +- if (dev->features & NETIF_F_LRO) ++ if (dev->hw_features & NETIF_F_LRO) + ret = mtk_hwlro_del_ipaddr(dev, cmd); + break; + default: +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +index f4074e25fb71..25136941a964 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -125,7 +125,7 @@ static int stmmac_adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec, + * programmed with (2^32 – <new_sec_value>) + */ + if (gmac4) +- sec = (100000000ULL - sec); ++ sec = -sec; + + value = readl(ioaddr + PTP_TCR); + if (value & PTP_TCR_TSCTRLSSR) +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 3eb6d48c3148..0acdf73aa1b0 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2136,12 +2136,12 @@ static void team_setup(struct net_device *dev) + dev->features |= NETIF_F_NETNS_LOCAL; + + dev->hw_features = TEAM_VLAN_FEATURES | +- NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_CTAG_FILTER; + + dev->hw_features |= NETIF_F_GSO_ENCAP_ALL; + dev->features |= dev->hw_features; ++ dev->features |= NETIF_F_HW_VLAN_CTAG_TX; + } + + static int team_newlink(struct net *src_net, struct net_device *dev, +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 88fe38d6a7ef..36136a147867 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -828,18 +828,8 @@ static void tun_net_uninit(struct net_device *dev) + /* Net device open. */ + static int tun_net_open(struct net_device *dev) + { +- struct tun_struct *tun = netdev_priv(dev); +- int i; +- + netif_tx_start_all_queues(dev); + +- for (i = 0; i < tun->numqueues; i++) { +- struct tun_file *tfile; +- +- tfile = rtnl_dereference(tun->tfiles[i]); +- tfile->socket.sk->sk_write_space(tfile->socket.sk); +- } +- + return 0; + } + +@@ -2534,6 +2524,7 @@ static int tun_device_event(struct notifier_block *unused, + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct tun_struct *tun = netdev_priv(dev); ++ int i; + + if (dev->rtnl_link_ops != &tun_link_ops) + return NOTIFY_DONE; +@@ -2543,6 +2534,14 @@ static int tun_device_event(struct notifier_block *unused, + if (tun_queue_resize(tun)) + return NOTIFY_BAD; + break; ++ case NETDEV_UP: ++ for (i = 0; i < tun->numqueues; i++) { ++ struct tun_file *tfile; ++ ++ tfile = rtnl_dereference(tun->tfiles[i]); ++ tfile->socket.sk->sk_write_space(tfile->socket.sk); ++ } ++ break; + default: + break; + } +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 979c6ecc6446..8705bfe7bb73 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1765,7 +1765,8 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn) + { + struct nvme_ns *ns; + __le32 *ns_list; +- unsigned i, j, nsid, prev = 0, num_lists = DIV_ROUND_UP(nn, 1024); ++ unsigned i, j, nsid, prev = 0; ++ unsigned num_lists = DIV_ROUND_UP_ULL((u64)nn, 1024); + int ret = 0; + + ns_list = kzalloc(0x1000, GFP_KERNEL); +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 4399de34054a..daa2eb3050df 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -895,6 +895,7 @@ parport_register_dev_model(struct parport *port, const char *name, + par_dev->devmodel = true; + ret = device_register(&par_dev->dev); + if (ret) { ++ kfree(par_dev->state); + put_device(&par_dev->dev); + goto err_put_port; + } +@@ -912,6 +913,7 @@ parport_register_dev_model(struct parport *port, const char *name, + spin_unlock(&port->physport->pardevice_lock); + pr_debug("%s: cannot grant exclusive access for device %s\n", + port->name, name); ++ kfree(par_dev->state); + device_unregister(&par_dev->dev); + goto err_put_port; + } +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 58404e69aa4b..6ba4e921d2fd 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -2124,7 +2124,7 @@ static void qeth_bridgeport_an_set_cb(void *priv, + + l2entry = (struct qdio_brinfo_entry_l2 *)entry; + code = IPA_ADDR_CHANGE_CODE_MACADDR; +- if (l2entry->addr_lnid.lnid) ++ if (l2entry->addr_lnid.lnid < VLAN_N_VID) + code |= IPA_ADDR_CHANGE_CODE_VLANID; + qeth_bridge_emit_host_event(card, anev_reg_unreg, code, + (struct net_if_token *)&l2entry->nit, +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 0b8db8a74d50..9f98c7211ec2 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4815,7 +4815,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg->reserved[0] = 0; + curr_sg->reserved[1] = 0; + curr_sg->reserved[2] = 0; +- curr_sg->chain_indicator = 0x80; ++ curr_sg->chain_indicator = IOACCEL2_CHAIN; + + curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; + } +@@ -4832,6 +4832,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg++; + } + ++ /* ++ * Set the last s/g element bit ++ */ ++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; ++ + switch (cmd->sc_data_direction) { + case DMA_TO_DEVICE: + cp->direction &= ~IOACCEL2_DIRECTION_MASK; +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index 5961705eef76..39bcbec93c60 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -516,6 +516,7 @@ struct ioaccel2_sg_element { + u8 reserved[3]; + u8 chain_indicator; + #define IOACCEL2_CHAIN 0x80 ++#define IOACCEL2_LAST_SG 0x40 + }; + + /* +diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c +index a72a4ba78125..b47decc1fb5b 100644 +--- a/drivers/scsi/ufs/ufshcd-pltfrm.c ++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c +@@ -342,24 +342,21 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, + goto dealloc_host; + } + +- pm_runtime_set_active(&pdev->dev); +- pm_runtime_enable(&pdev->dev); +- + ufshcd_init_lanes_per_dir(hba); + + err = ufshcd_init(hba, mmio_base, irq); + if (err) { + dev_err(dev, "Initialization failed\n"); +- goto out_disable_rpm; ++ goto dealloc_host; + } + + platform_set_drvdata(pdev, hba); + ++ pm_runtime_set_active(&pdev->dev); ++ pm_runtime_enable(&pdev->dev); ++ + return 0; + +-out_disable_rpm: +- pm_runtime_disable(&pdev->dev); +- pm_runtime_set_suspended(&pdev->dev); + dealloc_host: + ufshcd_dealloc_host(hba); + out: +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 0fe4f8e8c8c9..a9c172692f21 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -941,7 +941,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) + memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); + + /* Get the descriptor */ +- if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { ++ if (hba->dev_cmd.query.descriptor && ++ lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { + u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + + GENERAL_UPIU_REQUEST_SIZE; + u16 resp_len; +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index fcfbe2dcd025..df6fabcce4f7 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -766,6 +766,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd + struct pvscsi_adapter *adapter = shost_priv(host); + struct pvscsi_ctx *ctx; + unsigned long flags; ++ unsigned char op; + + spin_lock_irqsave(&adapter->hw_lock, flags); + +@@ -778,13 +779,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd + } + + cmd->scsi_done = done; ++ op = cmd->cmnd[0]; + + dev_dbg(&cmd->device->sdev_gendev, +- "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]); ++ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op); + + spin_unlock_irqrestore(&adapter->hw_lock, flags); + +- pvscsi_kick_io(adapter, cmd->cmnd[0]); ++ pvscsi_kick_io(adapter, op); + + return 0; + } +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index 3aa9e6e3dac8..4ef54436b9d4 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) + if (ret) + spi_master_put(master); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(spi_bitbang_start); + +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index e8e8973939d3..447d791bde22 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -279,7 +279,7 @@ MODULE_PARM_DESC(pc104_3, "set interface types for ISA(PC104) board #3 (e.g. pc1 + module_param_array(pc104_4, ulong, NULL, 0); + MODULE_PARM_DESC(pc104_4, "set interface types for ISA(PC104) board #4 (e.g. pc104_4=232,232,485,485,..."); + +-static int rp_init(void); ++static int __init rp_init(void); + static void rp_cleanup_module(void); + + module_init(rp_init); +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 6a15b7250e9c..0f9859478649 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1621,6 +1621,25 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on) + static int ci_udc_start(struct usb_gadget *gadget, + struct usb_gadget_driver *driver); + static int ci_udc_stop(struct usb_gadget *gadget); ++ ++/* Match ISOC IN from the highest endpoint */ ++static struct usb_ep *ci_udc_match_ep(struct usb_gadget *gadget, ++ struct usb_endpoint_descriptor *desc, ++ struct usb_ss_ep_comp_descriptor *comp_desc) ++{ ++ struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget); ++ struct usb_ep *ep; ++ ++ if (usb_endpoint_xfer_isoc(desc) && usb_endpoint_dir_in(desc)) { ++ list_for_each_entry_reverse(ep, &ci->gadget.ep_list, ep_list) { ++ if (ep->caps.dir_in && !ep->claimed) ++ return ep; ++ } ++ } ++ ++ return NULL; ++} ++ + /** + * Device operations part of the API to the USB controller hardware, + * which don't involve endpoints (or i/o) +@@ -1634,6 +1653,7 @@ static const struct usb_gadget_ops usb_gadget_ops = { + .vbus_draw = ci_udc_vbus_draw, + .udc_start = ci_udc_start, + .udc_stop = ci_udc_stop, ++ .match_ep = ci_udc_match_ep, + }; + + static int init_eps(struct ci_hdrc *ci) +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 948845c90e47..351012c498c5 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { + static int fusb300_remove(struct platform_device *pdev) + { + struct fusb300 *fusb300 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + + return 0; +@@ -1494,6 +1497,8 @@ clean_up: + if (fusb300->ep0_req) + fusb300_free_request(&fusb300->ep[0]->ep, + fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + } + if (reg) +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index 8f32b5ee7734..6df1aded4503 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -935,8 +935,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) + dma_addr_t dma; + struct lpc32xx_usbd_dd_gad *dd; + +- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( +- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); ++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); + if (dd) + dd->this_dma = dma; + +diff --git a/fs/9p/acl.c b/fs/9p/acl.c +index 082d227fa56b..6261719f6f2a 100644 +--- a/fs/9p/acl.c ++++ b/fs/9p/acl.c +@@ -276,7 +276,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, + switch (handler->flags) { + case ACL_TYPE_ACCESS: + if (acl) { +- struct iattr iattr; ++ struct iattr iattr = { 0 }; + struct posix_acl *old_acl = acl; + + retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); +diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c +index 9b2917a30294..b18543b36ae1 100644 +--- a/fs/binfmt_flat.c ++++ b/fs/binfmt_flat.c +@@ -859,9 +859,14 @@ err: + + static int load_flat_shared_library(int id, struct lib_info *libs) + { ++ /* ++ * This is a fake bprm struct; only the members "buf", "file" and ++ * "filename" are actually used. ++ */ + struct linux_binprm bprm; + int res; + char buf[16]; ++ loff_t pos = 0; + + memset(&bprm, 0, sizeof(bprm)); + +@@ -875,25 +880,11 @@ static int load_flat_shared_library(int id, struct lib_info *libs) + if (IS_ERR(bprm.file)) + return res; + +- bprm.cred = prepare_exec_creds(); +- res = -ENOMEM; +- if (!bprm.cred) +- goto out; +- +- /* We don't really care about recalculating credentials at this point +- * as we're past the point of no return and are dealing with shared +- * libraries. +- */ +- bprm.cred_prepared = 1; ++ res = kernel_read(bprm.file, pos, bprm.buf, BINPRM_BUF_SIZE); + +- res = prepare_binprm(&bprm); +- +- if (!res) ++ if (res >= 0) + res = load_flat_file(&bprm, libs, id, NULL); + +- abort_creds(bprm.cred); +- +-out: + allow_write_access(bprm.file); + fput(bprm.file); + +diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c +index fb973cc0af66..395b07764269 100644 +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -511,18 +511,27 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, + } + btrfs_wait_ordered_roots(root->fs_info, -1, 0, (u64)-1); + +- trans = btrfs_start_transaction(root, 0); +- if (IS_ERR(trans)) { +- mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); +- return PTR_ERR(trans); ++ while (1) { ++ trans = btrfs_start_transaction(root, 0); ++ if (IS_ERR(trans)) { ++ mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); ++ return PTR_ERR(trans); ++ } ++ ret = btrfs_commit_transaction(trans, root); ++ WARN_ON(ret); ++ mutex_lock(&uuid_mutex); ++ /* keep away write_all_supers() during the finishing procedure */ ++ mutex_lock(&root->fs_info->fs_devices->device_list_mutex); ++ mutex_lock(&root->fs_info->chunk_mutex); ++ if (src_device->has_pending_chunks) { ++ mutex_unlock(&root->fs_info->chunk_mutex); ++ mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); ++ mutex_unlock(&uuid_mutex); ++ } else { ++ break; ++ } + } +- ret = btrfs_commit_transaction(trans, root); +- WARN_ON(ret); + +- mutex_lock(&uuid_mutex); +- /* keep away write_all_supers() during the finishing procedure */ +- mutex_lock(&root->fs_info->fs_devices->device_list_mutex); +- mutex_lock(&root->fs_info->chunk_mutex); + btrfs_dev_replace_lock(dev_replace, 1); + dev_replace->replace_state = + scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index 75bab76739be..94441fdb1ecf 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -759,6 +759,7 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info) + u64 total = 0; + int i; + ++again: + do { + enqueued = 0; + mutex_lock(&fs_devices->device_list_mutex); +@@ -771,6 +772,10 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info) + mutex_unlock(&fs_devices->device_list_mutex); + total += enqueued; + } while (enqueued && total < 10000); ++ if (fs_devices->seed) { ++ fs_devices = fs_devices->seed; ++ goto again; ++ } + + if (enqueued == 0) + return; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index c063ac57c30e..94b61afe996c 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4876,6 +4876,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + for (i = 0; i < map->num_stripes; i++) { + num_bytes = map->stripes[i].dev->bytes_used + stripe_size; + btrfs_device_set_bytes_used(map->stripes[i].dev, num_bytes); ++ map->stripes[i].dev->has_pending_chunks = true; + } + + spin_lock(&extent_root->fs_info->free_chunk_lock); +@@ -7250,6 +7251,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_root *root, + for (i = 0; i < map->num_stripes; i++) { + dev = map->stripes[i].dev; + dev->commit_bytes_used = dev->bytes_used; ++ dev->has_pending_chunks = false; + } + } + unlock_chunks(root); +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index 9c09aa29d6bd..663d66828cca 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -62,6 +62,11 @@ struct btrfs_device { + + spinlock_t io_lock ____cacheline_aligned; + int running_pending; ++ /* When true means this device has pending chunk alloc in ++ * current transaction. Protected by chunk_mutex. ++ */ ++ bool has_pending_chunks; ++ + /* regular prio bios */ + struct btrfs_pending_bios pending_bios; + /* WRITE_SYNC bios */ +diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +index 90099896b838..c8863563c635 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -17,7 +17,7 @@ + + #define NFSDBG_FACILITY NFSDBG_PNFS_LD + +-static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS; ++static unsigned int dataserver_timeo = NFS_DEF_TCP_TIMEO; + static unsigned int dataserver_retrans; + + void nfs4_ff_layout_put_deviceid(struct nfs4_ff_layout_ds *mirror_ds) +diff --git a/fs/proc/array.c b/fs/proc/array.c +index 712b44c63701..9682bbf325d6 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -448,7 +448,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, + * a program is not able to use ptrace(2) in that case. It is + * safe because the task has stopped executing permanently. + */ +- if (permitted && (task->flags & PF_DUMPCORE)) { ++ if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) { + if (try_get_task_stack(task)) { + eip = KSTK_EIP(task); + esp = KSTK_ESP(task); +diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h +index 6f96247226a4..89f079d6b41b 100644 +--- a/include/asm-generic/bug.h ++++ b/include/asm-generic/bug.h +@@ -47,6 +47,7 @@ struct bug_entry { + #ifndef HAVE_ARCH_BUG + #define BUG() do { \ + printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ ++ barrier_before_unreachable(); \ + panic("BUG!"); \ + } while (0) + #endif +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 8e9b0cb8db41..61650c1830d4 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -233,6 +233,15 @@ + #define annotate_unreachable() + #endif + ++/* ++ * calling noreturn functions, __builtin_unreachable() and __builtin_trap() ++ * confuse the stack allocation in gcc, leading to overly large stack ++ * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 ++ * ++ * Adding an empty inline assembly before it works around the problem ++ */ ++#define barrier_before_unreachable() asm volatile("") ++ + /* + * Mark a position in code as unreachable. This can be used to + * suppress control flow warnings after asm blocks that transfer +@@ -243,7 +252,11 @@ + * unreleased. Really, we need to have autoconf for the kernel. + */ + #define unreachable() \ +- do { annotate_unreachable(); __builtin_unreachable(); } while (0) ++ do { \ ++ annotate_unreachable(); \ ++ barrier_before_unreachable(); \ ++ __builtin_unreachable(); \ ++ } while (0) + + /* Mark a function definition as prohibited from being cloned. */ + #define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 4f3dfabb680f..80a5bc623c47 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -177,6 +177,11 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); + # define barrier_data(ptr) barrier() + #endif + ++/* workaround for GCC PR82365 if needed */ ++#ifndef barrier_before_unreachable ++# define barrier_before_unreachable() do { } while (0) ++#endif ++ + /* Unreachable code */ + #ifndef unreachable + # define unreachable() do { } while (1) +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 4931787193c3..57a7dba49d29 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -176,6 +176,9 @@ struct adv_info { + + #define HCI_MAX_SHORT_NAME_LENGTH 10 + ++/* Min encryption key size to match with SMP */ ++#define HCI_MIN_ENC_KEY_SIZE 7 ++ + /* Default LE RPA expiry time, 15 minutes */ + #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60) + +diff --git a/kernel/cpu.c b/kernel/cpu.c +index be8cc6c9c87d..c947bb35b89f 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2245,6 +2245,9 @@ static int __init mitigations_parse_cmdline(char *arg) + cpu_mitigations = CPU_MITIGATIONS_AUTO; + else if (!strcmp(arg, "auto,nosmt")) + cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT; ++ else ++ pr_crit("Unsupported mitigations=%s, system may still be vulnerable\n", ++ arg); + + return 0; + } +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index f447f1e36185..ea3370e205fb 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -74,9 +74,7 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, + */ + static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) + { +- rcu_read_lock(); +- __ptrace_link(child, new_parent, __task_cred(new_parent)); +- rcu_read_unlock(); ++ __ptrace_link(child, new_parent, current_cred()); + } + + /** +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index fc59dd11090d..ea8a2760de24 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -7613,12 +7613,8 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) + + cnt++; + +- /* reset all but tr, trace, and overruns */ +- memset(&iter.seq, 0, +- sizeof(struct trace_iterator) - +- offsetof(struct trace_iterator, seq)); ++ trace_iterator_reset(&iter); + iter.iter_flags |= TRACE_FILE_LAT_FMT; +- iter.pos = -1; + + if (trace_find_next_entry_inc(&iter) != NULL) { + int ret; +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index b0d8576c27ae..476c6c4204da 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1673,4 +1673,22 @@ static inline void trace_event_enum_update(struct trace_enum_map **map, int len) + + extern struct trace_iterator *tracepoint_print_iter; + ++/* ++ * Reset the state of the trace_iterator so that it can read consumed data. ++ * Normally, the trace_iterator is used for reading the data when it is not ++ * consumed, and must retain state. ++ */ ++static __always_inline void trace_iterator_reset(struct trace_iterator *iter) ++{ ++ const size_t offset = offsetof(struct trace_iterator, seq); ++ ++ /* ++ * Keep gcc from complaining about overwriting more than just one ++ * member in the structure. ++ */ ++ memset((char *)iter + offset, 0, sizeof(struct trace_iterator) - offset); ++ ++ iter->pos = -1; ++} ++ + #endif /* _LINUX_KERNEL_TRACE_H */ +diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c +index 896458285fdd..cf6337dc41f4 100644 +--- a/kernel/trace/trace_kdb.c ++++ b/kernel/trace/trace_kdb.c +@@ -40,12 +40,8 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) + + kdb_printf("Dumping ftrace buffer:\n"); + +- /* reset all but tr, trace, and overruns */ +- memset(&iter.seq, 0, +- sizeof(struct trace_iterator) - +- offsetof(struct trace_iterator, seq)); ++ trace_iterator_reset(&iter); + iter.iter_flags |= TRACE_FILE_LAT_FMT; +- iter.pos = -1; + + if (cpu_file == RING_BUFFER_ALL_CPUS) { + for_each_tracing_cpu(cpu) { +diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c +index 468fb7cd1221..edf345b7f06b 100644 +--- a/lib/mpi/mpi-pow.c ++++ b/lib/mpi/mpi-pow.c +@@ -37,6 +37,7 @@ + int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) + { + mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL; ++ struct karatsuba_ctx karactx = {}; + mpi_ptr_t xp_marker = NULL; + mpi_ptr_t tspace = NULL; + mpi_ptr_t rp, ep, mp, bp; +@@ -164,13 +165,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) + int c; + mpi_limb_t e; + mpi_limb_t carry_limb; +- struct karatsuba_ctx karactx; + + xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1)); + if (!xp) + goto enomem; + +- memset(&karactx, 0, sizeof karactx); + negative_result = (ep[0] & 1) && base->sign; + + i = esize - 1; +@@ -295,8 +294,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) + if (mod_shift_cnt) + mpihelp_rshift(rp, rp, rsize, mod_shift_cnt); + MPN_NORMALIZE(rp, rsize); +- +- mpihelp_release_karatsuba_ctx(&karactx); + } + + if (negative_result && rsize) { +@@ -313,6 +310,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) + leave: + rc = 0; + enomem: ++ mpihelp_release_karatsuba_ctx(&karactx); + if (assign_rp) + mpi_assign_limb_space(res, rp, size); + if (mp_marker) +diff --git a/mm/mlock.c b/mm/mlock.c +index f0505692a5f4..3e7fe404bfb8 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -630,11 +630,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, + * is also counted. + * Return value: previously mlocked page counts + */ +-static int count_mm_mlocked_page_nr(struct mm_struct *mm, ++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm, + unsigned long start, size_t len) + { + struct vm_area_struct *vma; +- int count = 0; ++ unsigned long count = 0; + + if (mm == NULL) + mm = current->mm; +diff --git a/mm/page_idle.c b/mm/page_idle.c +index ae11aa914e55..ded173d6c5b5 100644 +--- a/mm/page_idle.c ++++ b/mm/page_idle.c +@@ -131,7 +131,7 @@ static ssize_t page_idle_bitmap_read(struct file *file, struct kobject *kobj, + + end_pfn = pfn + count * BITS_PER_BYTE; + if (end_pfn > max_pfn) +- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); ++ end_pfn = max_pfn; + + for (; pfn < end_pfn; pfn++) { + bit = pfn % BITMAP_CHUNK_BITS; +@@ -176,7 +176,7 @@ static ssize_t page_idle_bitmap_write(struct file *file, struct kobject *kobj, + + end_pfn = pfn + count * BITS_PER_BYTE; + if (end_pfn > max_pfn) +- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); ++ end_pfn = max_pfn; + + for (; pfn < end_pfn; pfn++) { + bit = pfn % BITMAP_CHUNK_BITS; +diff --git a/net/9p/protocol.c b/net/9p/protocol.c +index 7f1b45c082c9..ed1e39ccaebf 100644 +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -622,13 +622,19 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len, + if (ret) { + p9_debug(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret); + trace_9p_protocol_dump(clnt, &fake_pdu); +- goto out; ++ return ret; + } + +- strcpy(dirent->d_name, nameptr); ++ ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name)); ++ if (ret < 0) { ++ p9_debug(P9_DEBUG_ERROR, ++ "On the wire dirent name too long: %s\n", ++ nameptr); ++ kfree(nameptr); ++ return ret; ++ } + kfree(nameptr); + +-out: + return fake_pdu.offset; + } + EXPORT_SYMBOL(p9dirent_read); +diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c +index 38aa6345bdfa..9c0c894b56f8 100644 +--- a/net/9p/trans_common.c ++++ b/net/9p/trans_common.c +@@ -14,6 +14,7 @@ + + #include <linux/mm.h> + #include <linux/module.h> ++#include "trans_common.h" + + /** + * p9_release_req_pages - Release pages after the transaction. +diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c +index 5a2ad4707463..8e4313ad3f02 100644 +--- a/net/9p/trans_rdma.c ++++ b/net/9p/trans_rdma.c +@@ -254,8 +254,7 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) + case RDMA_CM_EVENT_DISCONNECTED: + if (rdma) + rdma->state = P9_RDMA_CLOSED; +- if (c) +- c->status = Disconnected; ++ c->status = Disconnected; + break; + + case RDMA_CM_EVENT_TIMEWAIT_EXIT: +@@ -454,7 +453,7 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) + + err = post_recv(client, rpl_context); + if (err) { +- p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n"); ++ p9_debug(P9_DEBUG_ERROR, "POST RECV failed: %d\n", err); + goto recv_error; + } + /* remove posted receive buffer from request structure */ +@@ -523,7 +522,7 @@ dont_need_post_recv: + recv_error: + kfree(rpl_context); + spin_lock_irqsave(&rdma->req_lock, flags); +- if (rdma->state < P9_RDMA_CLOSING) { ++ if (err != -EINTR && rdma->state < P9_RDMA_CLOSING) { + rdma->state = P9_RDMA_CLOSING; + spin_unlock_irqrestore(&rdma->req_lock, flags); + rdma_disconnect(rdma->cm_id); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index cc061495f653..bd41b78d131d 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1281,8 +1281,16 @@ auth: + return 0; + + encrypt: +- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) ++ if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { ++ /* Ensure that the encryption key size has been read, ++ * otherwise stall the upper layer responses. ++ */ ++ if (!conn->enc_key_size) ++ return 0; ++ ++ /* Nothing else needed, all requirements are met */ + return 1; ++ } + + hci_conn_encrypt(conn); + return 0; +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index d49aa4e6c916..ec9b5d159591 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1340,6 +1340,21 @@ static void l2cap_request_info(struct l2cap_conn *conn) + sizeof(req), &req); + } + ++static bool l2cap_check_enc_key_size(struct hci_conn *hcon) ++{ ++ /* The minimum encryption key size needs to be enforced by the ++ * host stack before establishing any L2CAP connections. The ++ * specification in theory allows a minimum of 1, but to align ++ * BR/EDR and LE transports, a minimum of 7 is chosen. ++ * ++ * This check might also be called for unencrypted connections ++ * that have no key size requirements. Ensure that the link is ++ * actually encrypted before enforcing a key size. ++ */ ++ return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || ++ hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE); ++} ++ + static void l2cap_do_start(struct l2cap_chan *chan) + { + struct l2cap_conn *conn = chan->conn; +@@ -1357,9 +1372,14 @@ static void l2cap_do_start(struct l2cap_chan *chan) + if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) + return; + +- if (l2cap_chan_check_security(chan, true) && +- __l2cap_no_conn_pending(chan)) ++ if (!l2cap_chan_check_security(chan, true) || ++ !__l2cap_no_conn_pending(chan)) ++ return; ++ ++ if (l2cap_check_enc_key_size(conn->hcon)) + l2cap_start_connection(chan); ++ else ++ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); + } + + static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) +@@ -1438,7 +1458,10 @@ static void l2cap_conn_start(struct l2cap_conn *conn) + continue; + } + +- l2cap_start_connection(chan); ++ if (l2cap_check_enc_key_size(conn->hcon)) ++ l2cap_start_connection(chan); ++ else ++ l2cap_chan_close(chan, ECONNREFUSED); + + } else if (chan->state == BT_CONNECT2) { + struct l2cap_conn_rsp rsp; +@@ -7447,7 +7470,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) + } + + if (chan->state == BT_CONNECT) { +- if (!status) ++ if (!status && l2cap_check_enc_key_size(hcon)) + l2cap_start_connection(chan); + else + __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); +@@ -7456,7 +7479,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) + struct l2cap_conn_rsp rsp; + __u16 res, stat; + +- if (!status) { ++ if (!status && l2cap_check_enc_key_size(hcon)) { + if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { + res = L2CAP_CR_PEND; + stat = L2CAP_CS_AUTHOR_PEND; +diff --git a/net/can/af_can.c b/net/can/af_can.c +index ac1552d8b4ad..e5a9e3d76e26 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -113,6 +113,7 @@ EXPORT_SYMBOL(can_ioctl); + static void can_sock_destruct(struct sock *sk) + { + skb_queue_purge(&sk->sk_receive_queue); ++ skb_queue_purge(&sk->sk_error_queue); + } + + static const struct can_proto *can_get_proto(int protocol) +diff --git a/net/core/dev.c b/net/core/dev.c +index 4e10bae5e3da..f693afe608d7 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5083,7 +5083,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock) + goto out; + + /* Note: ndo_busy_poll method is optional in linux-4.5 */ +- busy_poll = napi->dev->netdev_ops->ndo_busy_poll; ++ if (napi->dev->netdev_ops) ++ busy_poll = napi->dev->netdev_ops->ndo_busy_poll; ++ else ++ busy_poll = NULL; + + do { + rc = 0; +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 1d0e2284d8ad..ed53bf5d2b68 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -197,7 +197,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) + } + sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol, + iph->saddr, iph->daddr, +- skb->dev->ifindex); ++ dif); + } + out: + read_unlock(&raw_v4_hashinfo.lock); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 5d4b5e0f6b5e..1bb1e27d3d13 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -569,7 +569,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb, + struct sock *udp4_lib_lookup_skb(struct sk_buff *skb, + __be16 sport, __be16 dport) + { +- return __udp4_lib_lookup_skb(skb, sport, dport, &udp_table); ++ const struct iphdr *iph = ip_hdr(skb); ++ ++ return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport, ++ iph->daddr, dport, inet_iif(skb), ++ &udp_table, NULL); + } + EXPORT_SYMBOL_GPL(udp4_lib_lookup_skb); + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 4db5f541bca6..6a397e110b46 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -294,7 +294,7 @@ struct sock *udp6_lib_lookup_skb(struct sk_buff *skb, + + return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport, + &iph->daddr, dport, inet6_iif(skb), +- &udp_table, skb); ++ &udp_table, NULL); + } + EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb); + +@@ -479,7 +479,7 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + struct net *net = dev_net(skb->dev); + + sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source, +- inet6_iif(skb), udptable, skb); ++ inet6_iif(skb), udptable, NULL); + if (!sk) { + __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), + ICMP6_MIB_INERRORS); +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 23f6c8baae95..3b423c50ec8f 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3568,6 +3568,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + case NL80211_IFTYPE_STATION: + if (!bssid && !sdata->u.mgd.use_4addr) + return false; ++ if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta) ++ return false; + if (multicast) + return true; + return ether_addr_equal(sdata->vif.addr, hdr->addr1); +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index caa5986cb2e4..c0529c4b60f8 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -1169,7 +1169,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + struct ieee80211_key *key = rx->key; + struct ieee80211_mmie_16 *mmie; +- u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN]; ++ u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN]; + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + + if (!ieee80211_is_mgmt(hdr->frame_control)) +@@ -1200,13 +1200,18 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) + memcpy(nonce, hdr->addr2, ETH_ALEN); + memcpy(nonce + ETH_ALEN, ipn, 6); + ++ mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC); ++ if (!mic) ++ return RX_DROP_UNUSABLE; + if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, + skb->data + 24, skb->len - 24, + mic) < 0 || + crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { + key->u.aes_gmac.icverrors++; ++ kfree(mic); + return RX_DROP_UNUSABLE; + } ++ kfree(mic); + } + + memcpy(key->u.aes_gmac.rx_pn, ipn, 6); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index dcf033fea2d2..3578121da79c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2399,6 +2399,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb) + + ts = __packet_set_timestamp(po, ph, skb); + __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts); ++ ++ if (!packet_read_pending(&po->tx_ring)) ++ complete(&po->skb_completion); + } + + sock_wfree(skb); +@@ -2629,7 +2632,7 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame, + + static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + { +- struct sk_buff *skb; ++ struct sk_buff *skb = NULL; + struct net_device *dev; + struct virtio_net_hdr *vnet_hdr = NULL; + struct sockcm_cookie sockc; +@@ -2644,6 +2647,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + int len_sum = 0; + int status = TP_STATUS_AVAILABLE; + int hlen, tlen, copylen = 0; ++ long timeo = 0; + + mutex_lock(&po->pg_vec_lock); + +@@ -2690,12 +2694,21 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !po->has_vnet_hdr) + size_max = dev->mtu + reserve + VLAN_HLEN; + ++ reinit_completion(&po->skb_completion); ++ + do { + ph = packet_current_frame(po, &po->tx_ring, + TP_STATUS_SEND_REQUEST); + if (unlikely(ph == NULL)) { +- if (need_wait && need_resched()) +- schedule(); ++ if (need_wait && skb) { ++ timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); ++ timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); ++ if (timeo <= 0) { ++ err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; ++ goto out_put; ++ } ++ } ++ /* check for additional frames */ + continue; + } + +@@ -3249,6 +3262,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + sock_init_data(sock, sk); + + po = pkt_sk(sk); ++ init_completion(&po->skb_completion); + sk->sk_family = PF_PACKET; + po->num = proto; + po->xmit = dev_queue_xmit; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 1309e2a7baad..bbf8dd35df0d 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -125,6 +125,7 @@ struct packet_sock { + unsigned int tp_hdrlen; + unsigned int tp_reserve; + unsigned int tp_tstamp; ++ struct completion skb_completion; + struct net_device __rcu *cached_dev; + int (*xmit)(struct sk_buff *skb); + struct packet_type prot_hook ____cacheline_aligned_in_smp; +diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c +index 1f03065686fe..beae42bfa68f 100644 +--- a/net/sctp/endpointola.c ++++ b/net/sctp/endpointola.c +@@ -125,10 +125,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, + /* Initialize the bind addr area */ + sctp_bind_addr_init(&ep->base.bind_addr, 0); + +- /* Remember who we are attached to. */ +- ep->base.sk = sk; +- sock_hold(ep->base.sk); +- + /* Create the lists of associations. */ + INIT_LIST_HEAD(&ep->asocs); + +@@ -165,6 +161,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, + ep->auth_chunk_list = auth_chunks; + ep->prsctp_enable = net->sctp.prsctp_enable; + ++ /* Remember who we are attached to. */ ++ ep->base.sk = sk; ++ sock_hold(ep->base.sk); ++ + return ep; + + nomem_hmacs: +diff --git a/net/tipc/core.c b/net/tipc/core.c +index 816c125bfc13..59980dea2ad7 100644 +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -128,7 +128,7 @@ static int __init tipc_init(void) + if (err) + goto out_sysctl; + +- err = register_pernet_subsys(&tipc_net_ops); ++ err = register_pernet_device(&tipc_net_ops); + if (err) + goto out_pernet; + +@@ -136,7 +136,7 @@ static int __init tipc_init(void) + if (err) + goto out_socket; + +- err = register_pernet_subsys(&tipc_topsrv_net_ops); ++ err = register_pernet_device(&tipc_topsrv_net_ops); + if (err) + goto out_pernet_topsrv; + +@@ -147,11 +147,11 @@ static int __init tipc_init(void) + pr_info("Started in single node mode\n"); + return 0; + out_bearer: +- unregister_pernet_subsys(&tipc_topsrv_net_ops); ++ unregister_pernet_device(&tipc_topsrv_net_ops); + out_pernet_topsrv: + tipc_socket_stop(); + out_socket: +- unregister_pernet_subsys(&tipc_net_ops); ++ unregister_pernet_device(&tipc_net_ops); + out_pernet: + tipc_unregister_sysctl(); + out_sysctl: +@@ -166,9 +166,9 @@ out_netlink: + static void __exit tipc_exit(void) + { + tipc_bearer_cleanup(); +- unregister_pernet_subsys(&tipc_topsrv_net_ops); ++ unregister_pernet_device(&tipc_topsrv_net_ops); + tipc_socket_stop(); +- unregister_pernet_subsys(&tipc_net_ops); ++ unregister_pernet_device(&tipc_net_ops); + tipc_netlink_stop(); + tipc_netlink_compat_stop(); + tipc_unregister_sysctl(); +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index 0cf9403b4c44..b7c539a51da3 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -436,7 +436,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, + if (!bearer) + return -EMSGSIZE; + +- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); ++ len = TLV_GET_DATA_LEN(msg->req); ++ if (len <= 0) ++ return -EINVAL; ++ ++ len = min_t(int, len, TIPC_MAX_BEARER_NAME); + if (!string_is_valid(name, len)) + return -EINVAL; + +@@ -528,7 +532,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, + + name = (char *)TLV_DATA(msg->req); + +- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); ++ len = TLV_GET_DATA_LEN(msg->req); ++ if (len <= 0) ++ return -EINVAL; ++ ++ len = min_t(int, len, TIPC_MAX_BEARER_NAME); + if (!string_is_valid(name, len)) + return -EINVAL; + +@@ -806,7 +814,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, + if (!link) + return -EMSGSIZE; + +- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); ++ len = TLV_GET_DATA_LEN(msg->req); ++ if (len <= 0) ++ return -EINVAL; ++ ++ len = min_t(int, len, TIPC_MAX_BEARER_NAME); + if (!string_is_valid(name, len)) + return -EINVAL; + +diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c +index 133e72654e77..05033ab05b8f 100644 +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -174,7 +174,6 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, + goto tx_error; + } + +- skb->dev = rt->dst.dev; + ttl = ip4_dst_hoplimit(&rt->dst); + udp_tunnel_xmit_skb(rt, ub->ubsock->sk, skb, src->ipv4.s_addr, + dst->ipv4.s_addr, 0, ttl, 0, src->port, +@@ -193,10 +192,9 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, + if (err) + goto tx_error; + ttl = ip6_dst_hoplimit(ndst); +- err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, +- ndst->dev, &src->ipv6, +- &dst->ipv6, 0, ttl, 0, src->port, +- dst->port, false); ++ err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL, ++ &src->ipv6, &dst->ipv6, 0, ttl, 0, ++ src->port, dst->port, false); + #endif + } + return err; +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 7fbf4dd07277..74554bdd9a5b 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -478,7 +478,7 @@ use_default_name: + &rdev->rfkill_ops, rdev); + + if (!rdev->rfkill) { +- kfree(rdev); ++ wiphy_free(&rdev->wiphy); + return NULL; + } + +diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl +index 12a6940741fe..b8f616545277 100755 +--- a/scripts/checkstack.pl ++++ b/scripts/checkstack.pl +@@ -45,7 +45,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre); + $x = "[0-9a-f]"; # hex character + $xs = "[0-9a-f ]"; # hex character or space + $funcre = qr/^$x* <(.*)>:$/; +- if ($arch eq 'aarch64') { ++ if ($arch =~ '^(aarch|arm)64$') { + #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]! + $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o; + } elsif ($arch eq 'arm') { +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index edde8250195c..381acfc4c59d 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -65,7 +65,7 @@ parse_symbol() { + if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then + local code=${cache[$module,$address]} + else +- local code=$(addr2line -i -e "$objfile" "$address") ++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address") + cache[$module,$address]=$code + fi + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 138120698f83..96a8d7115120 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -177,7 +177,7 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name) + char *tag = NULL; + size_t size = unpack_u16_chunk(e, &tag); + /* if a name is specified it must match. otherwise skip tag */ +- if (name && (!size || strcmp(name, tag))) ++ if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag))) + goto fail; + } else if (name) { + /* if a name is specified and there is no name tag fail */ +diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c +index 5b8520177b0e..7d72e3d48ad5 100644 +--- a/sound/core/seq/oss/seq_oss_ioctl.c ++++ b/sound/core/seq/oss/seq_oss_ioctl.c +@@ -62,7 +62,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg) + if (copy_from_user(ev, arg, 8)) + return -EFAULT; + memset(&tmpev, 0, sizeof(tmpev)); +- snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client); ++ snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port); + tmpev.time.tick = 0; + if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) { + snd_seq_oss_dispatch(dp, &tmpev, 0, 0); +diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c +index 6a7b6aceeca9..499f3e8f4949 100644 +--- a/sound/core/seq/oss/seq_oss_rw.c ++++ b/sound/core/seq/oss/seq_oss_rw.c +@@ -174,7 +174,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt) + memset(&event, 0, sizeof(event)); + /* set dummy -- to be sure */ + event.type = SNDRV_SEQ_EVENT_NOTEOFF; +- snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client); ++ snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port); + + if (snd_seq_oss_process_event(dp, rec, &event)) + return 0; /* invalid event - no need to insert queue */ +diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c +index bebddc60fde8..99654e7eb2d4 100644 +--- a/sound/firewire/amdtp-am824.c ++++ b/sound/firewire/amdtp-am824.c +@@ -388,7 +388,7 @@ static void read_midi_messages(struct amdtp_stream *s, + u8 *b; + + for (f = 0; f < frames; f++) { +- port = (s->data_block_counter + f) % 8; ++ port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8; + b = (u8 *)&buffer[p->midi_position]; + + len = b[0] - 0x80; +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index 6e8eb1f5a041..bed64723e5d9 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { + static bool cs4265_readable_register(struct device *dev, unsigned int reg) + { + switch (reg) { +- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: ++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: + return true; + default: + return false; +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 3e65dc74eb33..e7aef841f87d 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, + return 0; + } + ++static int max98090_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct snd_soc_component *component = dai->component; ++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); ++ unsigned int fmt = max98090->dai_fmt; ++ ++ /* Remove 24-bit format support if it is not in right justified mode. */ ++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { ++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); ++ } ++ return 0; ++} ++ + static int max98090_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); + #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) + + static const struct snd_soc_dai_ops max98090_dai_ops = { ++ .startup = max98090_dai_startup, + .set_sysclk = max98090_dai_set_sysclk, + .set_fmt = max98090_dai_set_fmt, + .set_tdm_slot = max98090_set_tdm_slot, +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 1dbcdc99dbe3..1d00f6e894ef 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2247,7 +2247,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) + continue; + + dev_dbg(be->dev, "ASoC: prepare BE %s\n", +diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c +index fab53f58d447..a9f99a6c3909 100644 +--- a/sound/usb/line6/pcm.c ++++ b/sound/usb/line6/pcm.c +@@ -558,6 +558,11 @@ int line6_init_pcm(struct usb_line6 *line6, + line6pcm->max_packet_size_out = + usb_maxpacket(line6->usbdev, + usb_sndisocpipe(line6->usbdev, ep_write), 1); ++ if (!line6pcm->max_packet_size_in || !line6pcm->max_packet_size_out) { ++ dev_err(line6pcm->line6->ifcdev, ++ "cannot get proper max packet size\n"); ++ return -EINVAL; ++ } + + spin_lock_init(&line6pcm->out.lock); + spin_lock_init(&line6pcm->in.lock); +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 5d2fc5f58bfe..f4fd9548c529 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -753,7 +753,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer, + return err; + } + +- kctl->private_value |= (value << 24); ++ kctl->private_value |= ((unsigned int)value << 24); + return 0; + } + +@@ -914,7 +914,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer, + if (err < 0) + return err; + +- kctl->private_value |= value[0] << 24; ++ kctl->private_value |= (unsigned int)value[0] << 24; + return 0; + } + +diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c +index 3bdb2c78a21b..476e24cf97fa 100644 +--- a/tools/perf/builtin-help.c ++++ b/tools/perf/builtin-help.c +@@ -186,7 +186,7 @@ static void add_man_viewer(const char *name) + while (*p) + p = &((*p)->next); + *p = zalloc(sizeof(**p) + len + 1); +- strncpy((*p)->name, name, len); ++ strcpy((*p)->name, name); + } + + static int supported_man_viewer(const char *name, size_t len) +diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c +index 88f5143a5981..3c97e27383a9 100644 +--- a/tools/perf/ui/tui/helpline.c ++++ b/tools/perf/ui/tui/helpline.c +@@ -23,7 +23,7 @@ static void tui_helpline__push(const char *msg) + SLsmg_set_color(0); + SLsmg_write_nstring((char *)msg, SLtt_Screen_Cols); + SLsmg_refresh(); +- strncpy(ui_helpline__current, msg, sz)[sz - 1] = '\0'; ++ strlcpy(ui_helpline__current, msg, sz); + } + + static int tui_helpline__show(const char *format, va_list ap) +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index a11f6760cce8..de9b369d2d2e 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3027,7 +3027,7 @@ perf_event__synthesize_event_update_name(struct perf_tool *tool, + if (ev == NULL) + return -ENOMEM; + +- strncpy(ev->data, evsel->name, len); ++ strlcpy(ev->data, evsel->name, len + 1); + err = process(tool, (union perf_event*) ev, NULL, NULL); + free(ev); + return err;
