commit: c0678b2b22ff8412e43d12fbd0c2b879023c728c Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Sep 10 11:12:34 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Sep 10 11:12:34 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c0678b2b
Linux patch 4.19.72 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1071_linux-4.19.72.patch | 2096 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2100 insertions(+) diff --git a/0000_README b/0000_README index 807b793..5a202ee 100644 --- a/0000_README +++ b/0000_README @@ -323,6 +323,10 @@ Patch: 1070_linux-4.19.70.patch From: https://www.kernel.org Desc: Linux 4.19.70 +Patch: 1071_linux-4.19.71.patch +From: https://www.kernel.org +Desc: Linux 4.19.71 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1071_linux-4.19.72.patch b/1071_linux-4.19.72.patch new file mode 100644 index 0000000..3d76e8b --- /dev/null +++ b/1071_linux-4.19.72.patch @@ -0,0 +1,2096 @@ +diff --git a/Makefile b/Makefile +index f6c9d5757470..ef80b1dfb753 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 71 ++SUBLEVEL = 72 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c +index f8debf7aeb4c..76e1edf5bf12 100644 +--- a/arch/x86/boot/compressed/pgtable_64.c ++++ b/arch/x86/boot/compressed/pgtable_64.c +@@ -73,6 +73,8 @@ static unsigned long find_trampoline_placement(void) + + /* Find the first usable memory region under bios_start. */ + for (i = boot_params->e820_entries - 1; i >= 0; i--) { ++ unsigned long new = bios_start; ++ + entry = &boot_params->e820_table[i]; + + /* Skip all entries above bios_start. */ +@@ -85,15 +87,20 @@ static unsigned long find_trampoline_placement(void) + + /* Adjust bios_start to the end of the entry if needed. */ + if (bios_start > entry->addr + entry->size) +- bios_start = entry->addr + entry->size; ++ new = entry->addr + entry->size; + + /* Keep bios_start page-aligned. */ +- bios_start = round_down(bios_start, PAGE_SIZE); ++ new = round_down(new, PAGE_SIZE); + + /* Skip the entry if it's too small. */ +- if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr) ++ if (new - TRAMPOLINE_32BIT_SIZE < entry->addr) + continue; + ++ /* Protect against underflow. */ ++ if (new - TRAMPOLINE_32BIT_SIZE > bios_start) ++ break; ++ ++ bios_start = new; + break; + } + +diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h +index d3983fdf1012..8fa49cf1211d 100644 +--- a/arch/x86/include/asm/bootparam_utils.h ++++ b/arch/x86/include/asm/bootparam_utils.h +@@ -71,6 +71,7 @@ static void sanitize_boot_params(struct boot_params *boot_params) + BOOT_PARAM_PRESERVE(eddbuf_entries), + BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), + BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), ++ BOOT_PARAM_PRESERVE(secure_boot), + BOOT_PARAM_PRESERVE(hdr), + BOOT_PARAM_PRESERVE(e820_table), + BOOT_PARAM_PRESERVE(eddbuf), +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 90be3a1506d3..b316bd61a6ac 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1140,10 +1140,6 @@ void clear_local_APIC(void) + apic_write(APIC_LVT0, v | APIC_LVT_MASKED); + v = apic_read(APIC_LVT1); + apic_write(APIC_LVT1, v | APIC_LVT_MASKED); +- if (!x2apic_enabled()) { +- v = apic_read(APIC_LDR) & ~APIC_LDR_MASK; +- apic_write(APIC_LDR, v); +- } + if (maxlvt >= 4) { + v = apic_read(APIC_LVTPC); + apic_write(APIC_LVTPC, v | APIC_LVT_MASKED); +diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c +index ec9e03a6b778..9e70f7c7e565 100644 +--- a/drivers/bluetooth/btqca.c ++++ b/drivers/bluetooth/btqca.c +@@ -363,6 +363,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, + return err; + } + ++ /* Give the controller some time to get ready to receive the NVM */ ++ msleep(10); ++ + /* Download NVM configuration */ + config.type = TLV_TYPE_NVM; + if (soc_type == QCA_WCN3990) +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index fd83046d8376..f6389479fccb 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -220,6 +220,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) + struct mtk_drm_private *private = drm->dev_private; + struct platform_device *pdev; + struct device_node *np; ++ struct device *dma_dev; + int ret; + + if (!iommu_present(&platform_bus_type)) +@@ -282,7 +283,29 @@ static int mtk_drm_kms_init(struct drm_device *drm) + goto err_component_unbind; + } + +- private->dma_dev = &pdev->dev; ++ dma_dev = &pdev->dev; ++ private->dma_dev = dma_dev; ++ ++ /* ++ * Configure the DMA segment size to make sure we get contiguous IOVA ++ * when importing PRIME buffers. ++ */ ++ if (!dma_dev->dma_parms) { ++ private->dma_parms_allocated = true; ++ dma_dev->dma_parms = ++ devm_kzalloc(drm->dev, sizeof(*dma_dev->dma_parms), ++ GFP_KERNEL); ++ } ++ if (!dma_dev->dma_parms) { ++ ret = -ENOMEM; ++ goto err_component_unbind; ++ } ++ ++ ret = dma_set_max_seg_size(dma_dev, (unsigned int)DMA_BIT_MASK(32)); ++ if (ret) { ++ dev_err(dma_dev, "Failed to set DMA segment size\n"); ++ goto err_unset_dma_parms; ++ } + + /* + * We don't use the drm_irq_install() helpers provided by the DRM +@@ -292,13 +315,16 @@ static int mtk_drm_kms_init(struct drm_device *drm) + drm->irq_enabled = true; + ret = drm_vblank_init(drm, MAX_CRTC); + if (ret < 0) +- goto err_component_unbind; ++ goto err_unset_dma_parms; + + drm_kms_helper_poll_init(drm); + drm_mode_config_reset(drm); + + return 0; + ++err_unset_dma_parms: ++ if (private->dma_parms_allocated) ++ dma_dev->dma_parms = NULL; + err_component_unbind: + component_unbind_all(drm->dev, drm); + err_config_cleanup: +@@ -309,9 +335,14 @@ err_config_cleanup: + + static void mtk_drm_kms_deinit(struct drm_device *drm) + { ++ struct mtk_drm_private *private = drm->dev_private; ++ + drm_kms_helper_poll_fini(drm); + drm_atomic_helper_shutdown(drm); + ++ if (private->dma_parms_allocated) ++ private->dma_dev->dma_parms = NULL; ++ + component_unbind_all(drm->dev, drm); + drm_mode_config_cleanup(drm); + } +@@ -327,6 +358,18 @@ static const struct file_operations mtk_drm_fops = { + .compat_ioctl = drm_compat_ioctl, + }; + ++/* ++ * We need to override this because the device used to import the memory is ++ * not dev->dev, as drm_gem_prime_import() expects. ++ */ ++struct drm_gem_object *mtk_drm_gem_prime_import(struct drm_device *dev, ++ struct dma_buf *dma_buf) ++{ ++ struct mtk_drm_private *private = dev->dev_private; ++ ++ return drm_gem_prime_import_dev(dev, dma_buf, private->dma_dev); ++} ++ + static struct drm_driver mtk_drm_driver = { + .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME | + DRIVER_ATOMIC, +@@ -338,7 +381,7 @@ static struct drm_driver mtk_drm_driver = { + .prime_handle_to_fd = drm_gem_prime_handle_to_fd, + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, + .gem_prime_export = drm_gem_prime_export, +- .gem_prime_import = drm_gem_prime_import, ++ .gem_prime_import = mtk_drm_gem_prime_import, + .gem_prime_get_sg_table = mtk_gem_prime_get_sg_table, + .gem_prime_import_sg_table = mtk_gem_prime_import_sg_table, + .gem_prime_mmap = mtk_drm_gem_mmap_buf, +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.h b/drivers/gpu/drm/mediatek/mtk_drm_drv.h +index ecc00ca3221d..8fa60d46f860 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h +@@ -59,6 +59,8 @@ struct mtk_drm_private { + } commit; + + struct drm_atomic_state *suspend_state; ++ ++ bool dma_parms_allocated; + }; + + extern struct platform_driver mtk_ddp_driver; +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index 271f31461da4..6f65f5257236 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -1160,8 +1160,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d) + + INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback); + +- cp2112_gpio_direction_input(gc, d->hwirq); +- + if (!dev->gpio_poll) { + dev->gpio_poll = true; + schedule_delayed_work(&dev->gpio_poll_worker, 0); +@@ -1209,6 +1207,12 @@ static int __maybe_unused cp2112_allocate_irq(struct cp2112_device *dev, + return PTR_ERR(dev->desc[pin]); + } + ++ ret = cp2112_gpio_direction_input(&dev->gc, pin); ++ if (ret < 0) { ++ dev_err(dev->gc.parent, "Failed to set GPIO to input dir\n"); ++ goto err_desc; ++ } ++ + ret = gpiochip_lock_as_irq(&dev->gc, pin); + if (ret) { + dev_err(dev->gc.parent, "Failed to lock GPIO as interrupt\n"); +diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c +index 7eaff4dcbfd7..5bc811b7e6cf 100644 +--- a/drivers/infiniband/hw/hfi1/fault.c ++++ b/drivers/infiniband/hw/hfi1/fault.c +@@ -141,12 +141,14 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf, + if (!data) + return -ENOMEM; + copy = min(len, datalen - 1); +- if (copy_from_user(data, buf, copy)) +- return -EFAULT; ++ if (copy_from_user(data, buf, copy)) { ++ ret = -EFAULT; ++ goto free_data; ++ } + + ret = debugfs_file_get(file->f_path.dentry); + if (unlikely(ret)) +- return ret; ++ goto free_data; + ptr = data; + token = ptr; + for (ptr = data; *ptr; ptr = end + 1, token = ptr) { +@@ -195,6 +197,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf, + ret = len; + + debugfs_file_put(file->f_path.dentry); ++free_data: + kfree(data); + return ret; + } +@@ -214,7 +217,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf, + return -ENOMEM; + ret = debugfs_file_get(file->f_path.dentry); + if (unlikely(ret)) +- return ret; ++ goto free_data; + bit = find_first_bit(fault->opcodes, bitsize); + while (bit < bitsize) { + zero = find_next_zero_bit(fault->opcodes, bitsize, bit); +@@ -232,6 +235,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf, + data[size - 1] = '\n'; + data[size] = '\0'; + ret = simple_read_from_buffer(buf, len, pos, data, size); ++free_data: + kfree(data); + return ret; + } +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index e5466d786bb1..5aaa2a6c431b 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -1668,8 +1668,6 @@ tx_err: + tx_buf_size, DMA_TO_DEVICE); + kfree(tun_qp->tx_ring[i].buf.addr); + } +- kfree(tun_qp->tx_ring); +- tun_qp->tx_ring = NULL; + i = MLX4_NUM_TUNNEL_BUFS; + err: + while (i > 0) { +@@ -1678,6 +1676,8 @@ err: + rx_buf_size, DMA_FROM_DEVICE); + kfree(tun_qp->ring[i].addr); + } ++ kfree(tun_qp->tx_ring); ++ tun_qp->tx_ring = NULL; + kfree(tun_qp->ring); + tun_qp->ring = NULL; + return -ENOMEM; +diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c +index a8b9be3e28db..7d0a5ccf5775 100644 +--- a/drivers/input/serio/hyperv-keyboard.c ++++ b/drivers/input/serio/hyperv-keyboard.c +@@ -245,40 +245,17 @@ static void hv_kbd_handle_received_packet(struct hv_device *hv_dev, + + static void hv_kbd_on_channel_callback(void *context) + { ++ struct vmpacket_descriptor *desc; + struct hv_device *hv_dev = context; +- void *buffer; +- int bufferlen = 0x100; /* Start with sensible size */ + u32 bytes_recvd; + u64 req_id; +- int error; + +- buffer = kmalloc(bufferlen, GFP_ATOMIC); +- if (!buffer) +- return; +- +- while (1) { +- error = vmbus_recvpacket_raw(hv_dev->channel, buffer, bufferlen, +- &bytes_recvd, &req_id); +- switch (error) { +- case 0: +- if (bytes_recvd == 0) { +- kfree(buffer); +- return; +- } +- +- hv_kbd_handle_received_packet(hv_dev, buffer, +- bytes_recvd, req_id); +- break; ++ foreach_vmbus_pkt(desc, hv_dev->channel) { ++ bytes_recvd = desc->len8 * 8; ++ req_id = desc->trans_id; + +- case -ENOBUFS: +- kfree(buffer); +- /* Handle large packet */ +- bufferlen = bytes_recvd; +- buffer = kmalloc(bytes_recvd, GFP_ATOMIC); +- if (!buffer) +- return; +- break; +- } ++ hv_kbd_handle_received_packet(hv_dev, desc, bytes_recvd, ++ req_id); + } + } + +diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c +index 6aeb1045c302..1ab40c97403b 100644 +--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c ++++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c +@@ -10,7 +10,7 @@ + + #include "cavium_ptp.h" + +-#define DRV_NAME "Cavium PTP Driver" ++#define DRV_NAME "cavium_ptp" + + #define PCI_DEVICE_ID_CAVIUM_PTP 0xA00C + #define PCI_DEVICE_ID_CAVIUM_RST 0xA00E +diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c +index 8f746e1348d4..3deb3c07681f 100644 +--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c ++++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c +@@ -238,8 +238,10 @@ int octeon_setup_iq(struct octeon_device *oct, + } + + oct->num_iqs++; +- if (oct->fn_list.enable_io_queues(oct)) ++ if (oct->fn_list.enable_io_queues(oct)) { ++ octeon_delete_instr_queue(oct, iq_no); + return 1; ++ } + + return 0; + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +index 0f72f9c4ec74..b429b726b987 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -3276,8 +3276,10 @@ static ssize_t blocked_fl_write(struct file *filp, const char __user *ubuf, + return -ENOMEM; + + err = bitmap_parse_user(ubuf, count, t, adap->sge.egr_sz); +- if (err) ++ if (err) { ++ kvfree(t); + return err; ++ } + + bitmap_copy(adap->sge.blocked_fl, t, adap->sge.egr_sz); + kvfree(t); +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index f70cb4d3c684..40ad1e503255 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1618,7 +1618,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) + struct net_device *netdev; + struct ibmveth_adapter *adapter; + unsigned char *mac_addr_p; +- unsigned int *mcastFilterSize_p; ++ __be32 *mcastFilterSize_p; + long ret; + unsigned long ret_attr; + +@@ -1640,8 +1640,9 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) + return -EINVAL; + } + +- mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev, +- VETH_MCAST_FILTER_SIZE, NULL); ++ mcastFilterSize_p = (__be32 *)vio_get_attribute(dev, ++ VETH_MCAST_FILTER_SIZE, ++ NULL); + if (!mcastFilterSize_p) { + dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE " + "attribute\n"); +@@ -1658,7 +1659,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) + + adapter->vdev = dev; + adapter->netdev = netdev; +- adapter->mcastFilterSize = *mcastFilterSize_p; ++ adapter->mcastFilterSize = be32_to_cpu(*mcastFilterSize_p); + adapter->pool_config = 0; + + netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 0ae43d27cdcf..255de7d68cd3 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1586,6 +1586,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + lpar_rc = send_subcrq_indirect(adapter, handle_array[queue_num], + (u64)tx_buff->indir_dma, + (u64)num_entries); ++ dma_unmap_single(dev, tx_buff->indir_dma, ++ sizeof(tx_buff->indir_arr), DMA_TO_DEVICE); + } else { + tx_buff->num_entries = num_entries; + lpar_rc = send_subcrq(adapter, handle_array[queue_num], +@@ -2747,7 +2749,6 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter, + union sub_crq *next; + int index; + int i, j; +- u8 *first; + + restart_loop: + while (pending_scrq(adapter, scrq)) { +@@ -2777,14 +2778,6 @@ restart_loop: + + txbuff->data_dma[j] = 0; + } +- /* if sub_crq was sent indirectly */ +- first = &txbuff->indir_arr[0].generic.first; +- if (*first == IBMVNIC_CRQ_CMD) { +- dma_unmap_single(dev, txbuff->indir_dma, +- sizeof(txbuff->indir_arr), +- DMA_TO_DEVICE); +- *first = 0; +- } + + if (txbuff->last_frag) { + dev_kfree_skb_any(txbuff->skb); +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index b2d2ec8c11e2..6789eed78ff7 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -3922,7 +3922,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + * setup (if available). */ + status = myri10ge_request_irq(mgp); + if (status != 0) +- goto abort_with_firmware; ++ goto abort_with_slices; + myri10ge_free_irq(mgp); + + /* Save configuration space to be restored if the +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 5f092bbd0514..5462d2e8a1b7 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + /* Renesas Ethernet AVB device driver + * +- * Copyright (C) 2014-2015 Renesas Electronics Corporation ++ * Copyright (C) 2014-2019 Renesas Electronics Corporation + * Copyright (C) 2015 Renesas Solutions Corp. + * Copyright (C) 2015-2016 Cogent Embedded, Inc. <[email protected]> + * +@@ -514,7 +514,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev) + kfree(ts_skb); + if (tag == tfa_tag) { + skb_tstamp_tx(skb, &shhwtstamps); ++ dev_consume_skb_any(skb); + break; ++ } else { ++ dev_kfree_skb_any(skb); + } + } + ravb_modify(ndev, TCCR, TCCR_TFR, TCCR_TFR); +@@ -1556,7 +1559,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) + DMA_TO_DEVICE); + goto unmap; + } +- ts_skb->skb = skb; ++ ts_skb->skb = skb_get(skb); + ts_skb->tag = priv->ts_skb_tag++; + priv->ts_skb_tag &= 0x3ff; + list_add_tail(&ts_skb->list, &priv->ts_skb_list); +@@ -1685,6 +1688,7 @@ static int ravb_close(struct net_device *ndev) + /* Clear the timestamp list */ + list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) { + list_del(&ts_skb->list); ++ kfree_skb(ts_skb->skb); + kfree(ts_skb); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index 3b174eae77c1..f45df6df6932 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -1203,10 +1203,8 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable) + int ret; + struct device *dev = &bsp_priv->pdev->dev; + +- if (!ldo) { +- dev_err(dev, "no regulator found\n"); +- return -1; +- } ++ if (!ldo) ++ return 0; + + if (enable) { + ret = regulator_enable(ldo); +diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c +index cce9c9ed46aa..9146068979d2 100644 +--- a/drivers/net/ethernet/toshiba/tc35815.c ++++ b/drivers/net/ethernet/toshiba/tc35815.c +@@ -1497,7 +1497,7 @@ tc35815_rx(struct net_device *dev, int limit) + pci_unmap_single(lp->pci_dev, + lp->rx_skbs[cur_bd].skb_dma, + RX_BUF_SIZE, PCI_DMA_FROMDEVICE); +- if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN) ++ if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN != 0) + memmove(skb->data, skb->data - NET_IP_ALIGN, + pkt_len); + data = skb_put(skb, pkt_len); +diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c +index edcd1e60b30d..f076050c8ad3 100644 +--- a/drivers/net/ethernet/tundra/tsi108_eth.c ++++ b/drivers/net/ethernet/tundra/tsi108_eth.c +@@ -383,9 +383,10 @@ tsi108_stat_carry_one(int carry, int carry_bit, int carry_shift, + static void tsi108_stat_carry(struct net_device *dev) + { + struct tsi108_prv_data *data = netdev_priv(dev); ++ unsigned long flags; + u32 carry1, carry2; + +- spin_lock_irq(&data->misclock); ++ spin_lock_irqsave(&data->misclock, flags); + + carry1 = TSI_READ(TSI108_STAT_CARRY1); + carry2 = TSI_READ(TSI108_STAT_CARRY2); +@@ -453,7 +454,7 @@ static void tsi108_stat_carry(struct net_device *dev) + TSI108_STAT_TXPAUSEDROP_CARRY, + &data->tx_pause_drop); + +- spin_unlock_irq(&data->misclock); ++ spin_unlock_irqrestore(&data->misclock, flags); + } + + /* Read a stat counter atomically with respect to carries. +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index cc60ef9634db..6f6c0dbd91fc 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1248,12 +1248,15 @@ static void netvsc_get_stats64(struct net_device *net, + struct rtnl_link_stats64 *t) + { + struct net_device_context *ndev_ctx = netdev_priv(net); +- struct netvsc_device *nvdev = rcu_dereference_rtnl(ndev_ctx->nvdev); ++ struct netvsc_device *nvdev; + struct netvsc_vf_pcpu_stats vf_tot; + int i; + ++ rcu_read_lock(); ++ ++ nvdev = rcu_dereference(ndev_ctx->nvdev); + if (!nvdev) +- return; ++ goto out; + + netdev_stats_to_stats64(t, &net->stats); + +@@ -1292,6 +1295,8 @@ static void netvsc_get_stats64(struct net_device *net, + t->rx_packets += packets; + t->multicast += multicast; + } ++out: ++ rcu_read_unlock(); + } + + static int netvsc_set_mac_addr(struct net_device *ndev, void *p) +diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c +index 947bea81d924..dfbdea22fbad 100644 +--- a/drivers/net/usb/cx82310_eth.c ++++ b/drivers/net/usb/cx82310_eth.c +@@ -175,7 +175,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf) + } + if (!timeout) { + dev_err(&udev->dev, "firmware not ready in time\n"); +- return -ETIMEDOUT; ++ ret = -ETIMEDOUT; ++ goto err; + } + + /* enable ethernet mode (?) */ +diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c +index bd2ba3659028..0cc6993c279a 100644 +--- a/drivers/net/usb/kalmia.c ++++ b/drivers/net/usb/kalmia.c +@@ -117,16 +117,16 @@ kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr) + status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_1), + usb_buf, 24); + if (status != 0) +- return status; ++ goto out; + + memcpy(usb_buf, init_msg_2, 12); + status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_2), + usb_buf, 28); + if (status != 0) +- return status; ++ goto out; + + memcpy(ethernet_addr, usb_buf + 10, ETH_ALEN); +- ++out: + kfree(usb_buf); + return status; + } +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 8d140495da79..e20266bd209e 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3799,7 +3799,7 @@ static int lan78xx_probe(struct usb_interface *intf, + ret = register_netdev(netdev); + if (ret != 0) { + netif_err(dev, probe, netdev, "couldn't register the device\n"); +- goto out3; ++ goto out4; + } + + usb_set_intfdata(intf, dev); +@@ -3814,12 +3814,14 @@ static int lan78xx_probe(struct usb_interface *intf, + + ret = lan78xx_phy_init(dev); + if (ret < 0) +- goto out4; ++ goto out5; + + return 0; + +-out4: ++out5: + unregister_netdev(netdev); ++out4: ++ usb_free_urb(dev->urb_intr); + out3: + lan78xx_unbind(dev, intf); + out2: +diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c +index e9fc168bb734..489cba9b284d 100644 +--- a/drivers/net/wimax/i2400m/fw.c ++++ b/drivers/net/wimax/i2400m/fw.c +@@ -351,13 +351,15 @@ int i2400m_barker_db_init(const char *_options) + } + result = i2400m_barker_db_add(barker); + if (result < 0) +- goto error_add; ++ goto error_parse_add; + } + kfree(options_orig); + } + return 0; + ++error_parse_add: + error_parse: ++ kfree(options_orig); + error_add: + kfree(i2400m_barker_db); + return result; +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 05d6371c7f38..f57feb8fdea4 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -323,6 +323,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns) + "failed to create id group.\n"); + } + ++ synchronize_srcu(&ns->head->srcu); + kblockd_schedule_work(&ns->head->requeue_work); + } + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index f8f4d3ea67f3..15d493f30810 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2191,6 +2191,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport) + dma_free_coherent(&ha->pdev->dev, vha->gnl.size, vha->gnl.l, + vha->gnl.ldma); + ++ vha->gnl.l = NULL; ++ + vfree(vha->scan.l); + + if (vha->qpair && vha->qpair->vp_idx == vha->vp_idx) { +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 42b8f0d3e580..02fa81f122c2 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3395,6 +3395,12 @@ skip_dpc: + return 0; + + probe_failed: ++ if (base_vha->gnl.l) { ++ dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size, ++ base_vha->gnl.l, base_vha->gnl.ldma); ++ base_vha->gnl.l = NULL; ++ } ++ + if (base_vha->timer_active) + qla2x00_stop_timer(base_vha); + base_vha->flags.online = 0; +@@ -3624,7 +3630,7 @@ qla2x00_remove_one(struct pci_dev *pdev) + if (!atomic_read(&pdev->enable_cnt)) { + dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size, + base_vha->gnl.l, base_vha->gnl.ldma); +- ++ base_vha->gnl.l = NULL; + scsi_host_put(base_vha->host); + kfree(ha); + pci_set_drvdata(pdev, NULL); +@@ -3663,6 +3669,8 @@ qla2x00_remove_one(struct pci_dev *pdev) + dma_free_coherent(&ha->pdev->dev, + base_vha->gnl.size, base_vha->gnl.l, base_vha->gnl.ldma); + ++ base_vha->gnl.l = NULL; ++ + vfree(base_vha->scan.l); + + if (IS_QLAFX00(ha)) +@@ -4602,6 +4610,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht, + "Alloc failed for scan database.\n"); + dma_free_coherent(&ha->pdev->dev, vha->gnl.size, + vha->gnl.l, vha->gnl.ldma); ++ vha->gnl.l = NULL; + scsi_remove_host(vha->host); + return NULL; + } +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index 3094d818cf06..12c1fa5b06c5 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -178,24 +178,14 @@ static void bcm2835aux_spi_reset_hw(struct bcm2835aux_spi *bs) + BCM2835_AUX_SPI_CNTL0_CLEARFIFO); + } + +-static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) ++static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) + { +- struct spi_master *master = dev_id; +- struct bcm2835aux_spi *bs = spi_master_get_devdata(master); +- irqreturn_t ret = IRQ_NONE; +- +- /* IRQ may be shared, so return if our interrupts are disabled */ +- if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) & +- (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE))) +- return ret; ++ u32 stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT); + + /* check if we have data to read */ +- while (bs->rx_len && +- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & +- BCM2835_AUX_SPI_STAT_RX_EMPTY))) { ++ for (; bs->rx_len && (stat & BCM2835_AUX_SPI_STAT_RX_LVL); ++ stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT)) + bcm2835aux_rd_fifo(bs); +- ret = IRQ_HANDLED; +- } + + /* check if we have data to write */ + while (bs->tx_len && +@@ -203,16 +193,21 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) + (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & + BCM2835_AUX_SPI_STAT_TX_FULL))) { + bcm2835aux_wr_fifo(bs); +- ret = IRQ_HANDLED; + } ++} + +- /* and check if we have reached "done" */ +- while (bs->rx_len && +- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & +- BCM2835_AUX_SPI_STAT_BUSY))) { +- bcm2835aux_rd_fifo(bs); +- ret = IRQ_HANDLED; +- } ++static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) ++{ ++ struct spi_master *master = dev_id; ++ struct bcm2835aux_spi *bs = spi_master_get_devdata(master); ++ ++ /* IRQ may be shared, so return if our interrupts are disabled */ ++ if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) & ++ (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE))) ++ return IRQ_NONE; ++ ++ /* do common fifo handling */ ++ bcm2835aux_spi_transfer_helper(bs); + + if (!bs->tx_len) { + /* disable tx fifo empty interrupt */ +@@ -226,8 +221,7 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) + complete(&master->xfer_completion); + } + +- /* and return */ +- return ret; ++ return IRQ_HANDLED; + } + + static int __bcm2835aux_spi_transfer_one_irq(struct spi_master *master, +@@ -273,7 +267,6 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master, + { + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + unsigned long timeout; +- u32 stat; + + /* configure spi */ + bcm2835aux_wr(bs, BCM2835_AUX_SPI_CNTL1, bs->cntl[1]); +@@ -284,24 +277,9 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master, + + /* loop until finished the transfer */ + while (bs->rx_len) { +- /* read status */ +- stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT); +- +- /* fill in tx fifo with remaining data */ +- if ((bs->tx_len) && (!(stat & BCM2835_AUX_SPI_STAT_TX_FULL))) { +- bcm2835aux_wr_fifo(bs); +- continue; +- } + +- /* read data from fifo for both cases */ +- if (!(stat & BCM2835_AUX_SPI_STAT_RX_EMPTY)) { +- bcm2835aux_rd_fifo(bs); +- continue; +- } +- if (!(stat & BCM2835_AUX_SPI_STAT_BUSY)) { +- bcm2835aux_rd_fifo(bs); +- continue; +- } ++ /* do common fifo handling */ ++ bcm2835aux_spi_transfer_helper(bs); + + /* there is still data pending to read check the timeout */ + if (bs->rx_len && time_after(jiffies, timeout)) { +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index c46efa47d68a..7159e8363b83 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -1143,14 +1143,16 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * + struct se_cmd *se_cmd = cmd->se_cmd; + struct tcmu_dev *udev = cmd->tcmu_dev; + bool read_len_valid = false; +- uint32_t read_len = se_cmd->data_length; ++ uint32_t read_len; + + /* + * cmd has been completed already from timeout, just reclaim + * data area space and free cmd + */ +- if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) ++ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) { ++ WARN_ON_ONCE(se_cmd); + goto out; ++ } + + list_del_init(&cmd->queue_entry); + +@@ -1163,6 +1165,7 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * + goto done; + } + ++ read_len = se_cmd->data_length; + if (se_cmd->data_direction == DMA_FROM_DEVICE && + (entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) { + read_len_valid = true; +@@ -1318,6 +1321,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + */ + scsi_status = SAM_STAT_CHECK_CONDITION; + list_del_init(&cmd->queue_entry); ++ cmd->se_cmd = NULL; + } else { + list_del_init(&cmd->queue_entry); + idr_remove(&udev->commands, id); +@@ -2036,6 +2040,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level) + + idr_remove(&udev->commands, i); + if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) { ++ WARN_ON(!cmd->se_cmd); + list_del_init(&cmd->queue_entry); + if (err_level == 1) { + /* +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index 6127f0fcd62c..ee07162d35c7 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -76,6 +76,7 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net, + cell = rcu_dereference_raw(net->ws_cell); + if (cell) { + afs_get_cell(cell); ++ ret = 0; + break; + } + ret = -EDESTADDRREQ; +@@ -110,6 +111,9 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net, + + done_seqretry(&net->cells_lock, seq); + ++ if (ret != 0 && cell) ++ afs_put_cell(net, cell); ++ + return ret == 0 ? cell : ERR_PTR(ret); + } + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index a11fa0b6b34d..db547af01b59 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1280,6 +1280,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, + { + struct ceph_inode_info *ci = cap->ci; + struct inode *inode = &ci->vfs_inode; ++ struct ceph_buffer *old_blob = NULL; + struct cap_msg_args arg; + int held, revoking; + int wake = 0; +@@ -1344,7 +1345,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, + ci->i_requested_max_size = arg.max_size; + + if (flushing & CEPH_CAP_XATTR_EXCL) { +- __ceph_build_xattrs_blob(ci); ++ old_blob = __ceph_build_xattrs_blob(ci); + arg.xattr_version = ci->i_xattrs.version; + arg.xattr_buf = ci->i_xattrs.blob; + } else { +@@ -1379,6 +1380,8 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, + + spin_unlock(&ci->i_ceph_lock); + ++ ceph_buffer_put(old_blob); ++ + ret = send_cap_msg(&arg); + if (ret < 0) { + dout("error sending cap msg, must requeue %p\n", inode); +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 3e518c2ae2bf..11f19432a74c 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -742,6 +742,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page, + int issued, new_issued, info_caps; + struct timespec64 mtime, atime, ctime; + struct ceph_buffer *xattr_blob = NULL; ++ struct ceph_buffer *old_blob = NULL; + struct ceph_string *pool_ns = NULL; + struct ceph_cap *new_cap = NULL; + int err = 0; +@@ -878,7 +879,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page, + if ((ci->i_xattrs.version == 0 || !(issued & CEPH_CAP_XATTR_EXCL)) && + le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) { + if (ci->i_xattrs.blob) +- ceph_buffer_put(ci->i_xattrs.blob); ++ old_blob = ci->i_xattrs.blob; + ci->i_xattrs.blob = xattr_blob; + if (xattr_blob) + memcpy(ci->i_xattrs.blob->vec.iov_base, +@@ -1017,8 +1018,8 @@ static int fill_inode(struct inode *inode, struct page *locked_page, + out: + if (new_cap) + ceph_put_cap(mdsc, new_cap); +- if (xattr_blob) +- ceph_buffer_put(xattr_blob); ++ ceph_buffer_put(old_blob); ++ ceph_buffer_put(xattr_blob); + ceph_put_string(pool_ns); + return err; + } +diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c +index 1f46b02f7314..5cf7b5f4db94 100644 +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -460,6 +460,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci) + struct inode *inode = &ci->vfs_inode; + struct ceph_cap_snap *capsnap; + struct ceph_snap_context *old_snapc, *new_snapc; ++ struct ceph_buffer *old_blob = NULL; + int used, dirty; + + capsnap = kzalloc(sizeof(*capsnap), GFP_NOFS); +@@ -536,7 +537,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci) + capsnap->gid = inode->i_gid; + + if (dirty & CEPH_CAP_XATTR_EXCL) { +- __ceph_build_xattrs_blob(ci); ++ old_blob = __ceph_build_xattrs_blob(ci); + capsnap->xattr_blob = + ceph_buffer_get(ci->i_xattrs.blob); + capsnap->xattr_version = ci->i_xattrs.version; +@@ -579,6 +580,7 @@ update_snapc: + } + spin_unlock(&ci->i_ceph_lock); + ++ ceph_buffer_put(old_blob); + kfree(capsnap); + ceph_put_snap_context(old_snapc); + } +diff --git a/fs/ceph/super.h b/fs/ceph/super.h +index d8579a56e5dc..018019309790 100644 +--- a/fs/ceph/super.h ++++ b/fs/ceph/super.h +@@ -896,7 +896,7 @@ extern int ceph_getattr(const struct path *path, struct kstat *stat, + int __ceph_setxattr(struct inode *, const char *, const void *, size_t, int); + ssize_t __ceph_getxattr(struct inode *, const char *, void *, size_t); + extern ssize_t ceph_listxattr(struct dentry *, char *, size_t); +-extern void __ceph_build_xattrs_blob(struct ceph_inode_info *ci); ++extern struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci); + extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci); + extern void __init ceph_xattr_init(void); + extern void ceph_xattr_exit(void); +diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c +index 0a2d4898ee16..5e4f3f833e85 100644 +--- a/fs/ceph/xattr.c ++++ b/fs/ceph/xattr.c +@@ -734,12 +734,15 @@ static int __get_required_blob_size(struct ceph_inode_info *ci, int name_size, + + /* + * If there are dirty xattrs, reencode xattrs into the prealloc_blob +- * and swap into place. ++ * and swap into place. It returns the old i_xattrs.blob (or NULL) so ++ * that it can be freed by the caller as the i_ceph_lock is likely to be ++ * held. + */ +-void __ceph_build_xattrs_blob(struct ceph_inode_info *ci) ++struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci) + { + struct rb_node *p; + struct ceph_inode_xattr *xattr = NULL; ++ struct ceph_buffer *old_blob = NULL; + void *dest; + + dout("__build_xattrs_blob %p\n", &ci->vfs_inode); +@@ -770,12 +773,14 @@ void __ceph_build_xattrs_blob(struct ceph_inode_info *ci) + dest - ci->i_xattrs.prealloc_blob->vec.iov_base; + + if (ci->i_xattrs.blob) +- ceph_buffer_put(ci->i_xattrs.blob); ++ old_blob = ci->i_xattrs.blob; + ci->i_xattrs.blob = ci->i_xattrs.prealloc_blob; + ci->i_xattrs.prealloc_blob = NULL; + ci->i_xattrs.dirty = false; + ci->i_xattrs.version++; + } ++ ++ return old_blob; + } + + static inline int __get_request_mask(struct inode *in) { +@@ -1011,6 +1016,7 @@ int __ceph_setxattr(struct inode *inode, const char *name, + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc; + struct ceph_cap_flush *prealloc_cf = NULL; ++ struct ceph_buffer *old_blob = NULL; + int issued; + int err; + int dirty = 0; +@@ -1084,13 +1090,15 @@ retry: + struct ceph_buffer *blob; + + spin_unlock(&ci->i_ceph_lock); +- dout(" preaallocating new blob size=%d\n", required_blob_size); ++ ceph_buffer_put(old_blob); /* Shouldn't be required */ ++ dout(" pre-allocating new blob size=%d\n", required_blob_size); + blob = ceph_buffer_new(required_blob_size, GFP_NOFS); + if (!blob) + goto do_sync_unlocked; + spin_lock(&ci->i_ceph_lock); ++ /* prealloc_blob can't be released while holding i_ceph_lock */ + if (ci->i_xattrs.prealloc_blob) +- ceph_buffer_put(ci->i_xattrs.prealloc_blob); ++ old_blob = ci->i_xattrs.prealloc_blob; + ci->i_xattrs.prealloc_blob = blob; + goto retry; + } +@@ -1106,6 +1114,7 @@ retry: + } + + spin_unlock(&ci->i_ceph_lock); ++ ceph_buffer_put(old_blob); + if (lock_snap_rwsem) + up_read(&mdsc->snap_rwsem); + if (dirty) +diff --git a/fs/read_write.c b/fs/read_write.c +index 85fd7a8ee29e..5fb5ee5b8cd7 100644 +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -1888,10 +1888,7 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in, + } + EXPORT_SYMBOL(vfs_clone_file_range); + +-/* +- * Read a page's worth of file data into the page cache. Return the page +- * locked. +- */ ++/* Read a page's worth of file data into the page cache. */ + static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset) + { + struct address_space *mapping; +@@ -1907,10 +1904,32 @@ static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset) + put_page(page); + return ERR_PTR(-EIO); + } +- lock_page(page); + return page; + } + ++/* ++ * Lock two pages, ensuring that we lock in offset order if the pages are from ++ * the same file. ++ */ ++static void vfs_lock_two_pages(struct page *page1, struct page *page2) ++{ ++ /* Always lock in order of increasing index. */ ++ if (page1->index > page2->index) ++ swap(page1, page2); ++ ++ lock_page(page1); ++ if (page1 != page2) ++ lock_page(page2); ++} ++ ++/* Unlock two pages, being careful not to unlock the same page twice. */ ++static void vfs_unlock_two_pages(struct page *page1, struct page *page2) ++{ ++ unlock_page(page1); ++ if (page1 != page2) ++ unlock_page(page2); ++} ++ + /* + * Compare extents of two files to see if they are the same. + * Caller must have locked both inodes to prevent write races. +@@ -1948,10 +1967,24 @@ int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff, + dest_page = vfs_dedupe_get_page(dest, destoff); + if (IS_ERR(dest_page)) { + error = PTR_ERR(dest_page); +- unlock_page(src_page); + put_page(src_page); + goto out_error; + } ++ ++ vfs_lock_two_pages(src_page, dest_page); ++ ++ /* ++ * Now that we've locked both pages, make sure they're still ++ * mapped to the file data we're interested in. If not, ++ * someone is invalidating pages on us and we lose. ++ */ ++ if (!PageUptodate(src_page) || !PageUptodate(dest_page) || ++ src_page->mapping != src->i_mapping || ++ dest_page->mapping != dest->i_mapping) { ++ same = false; ++ goto unlock; ++ } ++ + src_addr = kmap_atomic(src_page); + dest_addr = kmap_atomic(dest_page); + +@@ -1963,8 +1996,8 @@ int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff, + + kunmap_atomic(dest_addr); + kunmap_atomic(src_addr); +- unlock_page(dest_page); +- unlock_page(src_page); ++unlock: ++ vfs_unlock_two_pages(src_page, dest_page); + put_page(dest_page); + put_page(src_page); + +diff --git a/include/linux/ceph/buffer.h b/include/linux/ceph/buffer.h +index 5e58bb29b1a3..11cdc7c60480 100644 +--- a/include/linux/ceph/buffer.h ++++ b/include/linux/ceph/buffer.h +@@ -30,7 +30,8 @@ static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b) + + static inline void ceph_buffer_put(struct ceph_buffer *b) + { +- kref_put(&b->kref, ceph_buffer_release); ++ if (b) ++ kref_put(&b->kref, ceph_buffer_release); + } + + extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end); +diff --git a/include/linux/gpio.h b/include/linux/gpio.h +index 39745b8bdd65..b3115d1a7d49 100644 +--- a/include/linux/gpio.h ++++ b/include/linux/gpio.h +@@ -240,30 +240,6 @@ static inline int irq_to_gpio(unsigned irq) + return -EINVAL; + } + +-static inline int +-gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, +- unsigned int gpio_offset, unsigned int pin_offset, +- unsigned int npins) +-{ +- WARN_ON(1); +- return -EINVAL; +-} +- +-static inline int +-gpiochip_add_pingroup_range(struct gpio_chip *chip, +- struct pinctrl_dev *pctldev, +- unsigned int gpio_offset, const char *pin_group) +-{ +- WARN_ON(1); +- return -EINVAL; +-} +- +-static inline void +-gpiochip_remove_pin_ranges(struct gpio_chip *chip) +-{ +- WARN_ON(1); +-} +- + static inline int devm_gpio_request(struct device *dev, unsigned gpio, + const char *label) + { +diff --git a/include/net/act_api.h b/include/net/act_api.h +index 970303448c90..0c82d7ea6ee1 100644 +--- a/include/net/act_api.h ++++ b/include/net/act_api.h +@@ -15,6 +15,7 @@ + struct tcf_idrinfo { + spinlock_t lock; + struct idr action_idr; ++ struct net *net; + }; + + struct tc_action_ops; +@@ -107,7 +108,7 @@ struct tc_action_net { + }; + + static inline +-int tc_action_net_init(struct tc_action_net *tn, ++int tc_action_net_init(struct net *net, struct tc_action_net *tn, + const struct tc_action_ops *ops) + { + int err = 0; +@@ -116,6 +117,7 @@ int tc_action_net_init(struct tc_action_net *tn, + if (!tn->idrinfo) + return -ENOMEM; + tn->ops = ops; ++ tn->idrinfo->net = net; + spin_lock_init(&tn->idrinfo->lock); + idr_init(&tn->idrinfo->action_idr); + return err; +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index f2be5d041ba3..7685cbda9f28 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -418,8 +418,7 @@ struct nft_set { + unsigned char *udata; + /* runtime data below here */ + const struct nft_set_ops *ops ____cacheline_aligned; +- u16 flags:13, +- bound:1, ++ u16 flags:14, + genmask:2; + u8 klen; + u8 dlen; +@@ -1337,12 +1336,15 @@ struct nft_trans_rule { + struct nft_trans_set { + struct nft_set *set; + u32 set_id; ++ bool bound; + }; + + #define nft_trans_set(trans) \ + (((struct nft_trans_set *)trans->data)->set) + #define nft_trans_set_id(trans) \ + (((struct nft_trans_set *)trans->data)->set_id) ++#define nft_trans_set_bound(trans) \ ++ (((struct nft_trans_set *)trans->data)->bound) + + struct nft_trans_chain { + bool update; +@@ -1373,12 +1375,15 @@ struct nft_trans_table { + struct nft_trans_elem { + struct nft_set *set; + struct nft_set_elem elem; ++ bool bound; + }; + + #define nft_trans_elem_set(trans) \ + (((struct nft_trans_elem *)trans->data)->set) + #define nft_trans_elem(trans) \ + (((struct nft_trans_elem *)trans->data)->elem) ++#define nft_trans_elem_set_bound(trans) \ ++ (((struct nft_trans_elem *)trans->data)->bound) + + struct nft_trans_obj { + struct nft_object *obj; +diff --git a/include/net/psample.h b/include/net/psample.h +index 9b80f814ab04..94cb37a7bf75 100644 +--- a/include/net/psample.h ++++ b/include/net/psample.h +@@ -12,6 +12,7 @@ struct psample_group { + u32 group_num; + u32 refcount; + u32 seq; ++ struct rcu_head rcu; + }; + + struct psample_group *psample_group_get(struct net *net, u32 group_num); +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 29ff6635d259..714d63f60460 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -483,6 +483,7 @@ static DECLARE_DELAYED_WORK(optimizing_work, kprobe_optimizer); + */ + static void do_optimize_kprobes(void) + { ++ lockdep_assert_held(&text_mutex); + /* + * The optimization/unoptimization refers online_cpus via + * stop_machine() and cpu-hotplug modifies online_cpus. +@@ -500,9 +501,7 @@ static void do_optimize_kprobes(void) + list_empty(&optimizing_list)) + return; + +- mutex_lock(&text_mutex); + arch_optimize_kprobes(&optimizing_list); +- mutex_unlock(&text_mutex); + } + + /* +@@ -513,6 +512,7 @@ static void do_unoptimize_kprobes(void) + { + struct optimized_kprobe *op, *tmp; + ++ lockdep_assert_held(&text_mutex); + /* See comment in do_optimize_kprobes() */ + lockdep_assert_cpus_held(); + +@@ -520,7 +520,6 @@ static void do_unoptimize_kprobes(void) + if (list_empty(&unoptimizing_list)) + return; + +- mutex_lock(&text_mutex); + arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list); + /* Loop free_list for disarming */ + list_for_each_entry_safe(op, tmp, &freeing_list, list) { +@@ -537,7 +536,6 @@ static void do_unoptimize_kprobes(void) + } else + list_del_init(&op->list); + } +- mutex_unlock(&text_mutex); + } + + /* Reclaim all kprobes on the free_list */ +@@ -563,6 +561,7 @@ static void kprobe_optimizer(struct work_struct *work) + { + mutex_lock(&kprobe_mutex); + cpus_read_lock(); ++ mutex_lock(&text_mutex); + /* Lock modules while optimizing kprobes */ + mutex_lock(&module_mutex); + +@@ -590,6 +589,7 @@ static void kprobe_optimizer(struct work_struct *work) + do_free_cleaned_kprobes(); + + mutex_unlock(&module_mutex); ++ mutex_unlock(&text_mutex); + cpus_read_unlock(); + mutex_unlock(&kprobe_mutex); + +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index 3ae899805f8b..a581cf101cd9 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work) + txq = netdev_get_tx_queue(dev, q_index); + HARD_TX_LOCK(dev, txq, smp_processor_id()); + if (netif_xmit_frozen_or_stopped(txq) || +- netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) { ++ !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) { + skb_queue_head(&npinfo->txq, skb); + HARD_TX_UNLOCK(dev, txq); + local_irq_restore(flags); +@@ -335,7 +335,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb, + + HARD_TX_UNLOCK(dev, txq); + +- if (status == NETDEV_TX_OK) ++ if (dev_xmit_complete(status)) + break; + + } +@@ -352,7 +352,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb, + + } + +- if (status != NETDEV_TX_OK) { ++ if (!dev_xmit_complete(status)) { + skb_queue_tail(&npinfo->txq, skb); + schedule_delayed_work(&npinfo->tx_work,0); + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index b7ef367fe6a1..611ba174265c 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -934,6 +934,22 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags) + return mss_now; + } + ++/* In some cases, both sendpage() and sendmsg() could have added ++ * an skb to the write queue, but failed adding payload on it. ++ * We need to remove it to consume less memory, but more ++ * importantly be able to generate EPOLLOUT for Edge Trigger epoll() ++ * users. ++ */ ++static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb) ++{ ++ if (skb && !skb->len) { ++ tcp_unlink_write_queue(skb, sk); ++ if (tcp_write_queue_empty(sk)) ++ tcp_chrono_stop(sk, TCP_CHRONO_BUSY); ++ sk_wmem_free_skb(sk, skb); ++ } ++} ++ + ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset, + size_t size, int flags) + { +@@ -1056,6 +1072,7 @@ out: + return copied; + + do_error: ++ tcp_remove_empty_skb(sk, tcp_write_queue_tail(sk)); + if (copied) + goto out; + out_err: +@@ -1409,17 +1426,11 @@ out_nopush: + sock_zerocopy_put(uarg); + return copied + copied_syn; + ++do_error: ++ skb = tcp_write_queue_tail(sk); + do_fault: +- if (!skb->len) { +- tcp_unlink_write_queue(skb, sk); +- /* It is the one place in all of TCP, except connection +- * reset, where we can be unlinking the send_head. +- */ +- tcp_check_send_head(sk, skb); +- sk_wmem_free_skb(sk, skb); +- } ++ tcp_remove_empty_skb(sk, skb); + +-do_error: + if (copied + copied_syn) + goto out; + out_err: +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 88c7e821fd11..2697e4397e46 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2046,7 +2046,7 @@ static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len) + if (len <= skb->len) + break; + +- if (unlikely(TCP_SKB_CB(skb)->eor)) ++ if (unlikely(TCP_SKB_CB(skb)->eor) || tcp_has_tx_tstamp(skb)) + return false; + + len -= skb->len; +@@ -2162,6 +2162,7 @@ static int tcp_mtu_probe(struct sock *sk) + * we need to propagate it to the new skb. + */ + TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor; ++ tcp_skb_collapse_tstamp(nskb, skb); + tcp_unlink_write_queue(skb, sk); + sk_wmem_free_skb(sk, skb); + } else { +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index dbab62e3f0d7..2d80e913b82f 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -791,14 +791,15 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) + if (pmc) { + im->idev = pmc->idev; + if (im->mca_sfmode == MCAST_INCLUDE) { +- im->mca_tomb = pmc->mca_tomb; +- im->mca_sources = pmc->mca_sources; ++ swap(im->mca_tomb, pmc->mca_tomb); ++ swap(im->mca_sources, pmc->mca_sources); + for (psf = im->mca_sources; psf; psf = psf->sf_next) + psf->sf_crcount = idev->mc_qrv; + } else { + im->mca_crcount = idev->mc_qrv; + } + in6_dev_put(pmc->idev); ++ ip6_mc_clear_src(pmc); + kfree(pmc); + } + spin_unlock_bh(&im->mca_lock); +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 29ff59dd99ac..2145581d7b3d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -121,9 +121,14 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) + return; + + list_for_each_entry_reverse(trans, &net->nft.commit_list, list) { +- if (trans->msg_type == NFT_MSG_NEWSET && +- nft_trans_set(trans) == set) { +- set->bound = true; ++ switch (trans->msg_type) { ++ case NFT_MSG_NEWSET: ++ if (nft_trans_set(trans) == set) ++ nft_trans_set_bound(trans) = true; ++ break; ++ case NFT_MSG_NEWSETELEM: ++ if (nft_trans_elem_set(trans) == set) ++ nft_trans_elem_set_bound(trans) = true; + break; + } + } +@@ -6656,7 +6661,7 @@ static int __nf_tables_abort(struct net *net) + break; + case NFT_MSG_NEWSET: + trans->ctx.table->use--; +- if (nft_trans_set(trans)->bound) { ++ if (nft_trans_set_bound(trans)) { + nft_trans_destroy(trans); + break; + } +@@ -6668,7 +6673,7 @@ static int __nf_tables_abort(struct net *net) + nft_trans_destroy(trans); + break; + case NFT_MSG_NEWSETELEM: +- if (nft_trans_elem_set(trans)->bound) { ++ if (nft_trans_elem_set_bound(trans)) { + nft_trans_destroy(trans); + break; + } +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 6e0c26025ab1..69decbe2c988 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -71,11 +71,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + { + struct nft_flow_offload *priv = nft_expr_priv(expr); + struct nf_flowtable *flowtable = &priv->flowtable->data; ++ struct tcphdr _tcph, *tcph = NULL; + enum ip_conntrack_info ctinfo; + struct nf_flow_route route; + struct flow_offload *flow; + enum ip_conntrack_dir dir; +- bool is_tcp = false; + struct nf_conn *ct; + int ret; + +@@ -88,7 +88,10 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + + switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { + case IPPROTO_TCP: +- is_tcp = true; ++ tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff, ++ sizeof(_tcph), &_tcph); ++ if (unlikely(!tcph || tcph->fin || tcph->rst)) ++ goto out; + break; + case IPPROTO_UDP: + break; +@@ -115,7 +118,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + if (!flow) + goto err_flow_alloc; + +- if (is_tcp) { ++ if (tcph) { + ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; + ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; + } +diff --git a/net/psample/psample.c b/net/psample/psample.c +index 64f95624f219..4cea353221da 100644 +--- a/net/psample/psample.c ++++ b/net/psample/psample.c +@@ -156,7 +156,7 @@ static void psample_group_destroy(struct psample_group *group) + { + psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP); + list_del(&group->list); +- kfree(group); ++ kfree_rcu(group, rcu); + } + + static struct psample_group * +diff --git a/net/rds/recv.c b/net/rds/recv.c +index 504cd6bcc54c..c0b945516cdb 100644 +--- a/net/rds/recv.c ++++ b/net/rds/recv.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved. + * + * This software is available to you under a choice of one of two + * licenses. You may choose to be licensed under the terms of the GNU +@@ -803,6 +803,7 @@ void rds6_inc_info_copy(struct rds_incoming *inc, + + minfo6.seq = be64_to_cpu(inc->i_hdr.h_sequence); + minfo6.len = be32_to_cpu(inc->i_hdr.h_len); ++ minfo6.tos = 0; + + if (flip) { + minfo6.laddr = *daddr; +@@ -816,6 +817,8 @@ void rds6_inc_info_copy(struct rds_incoming *inc, + minfo6.fport = inc->i_hdr.h_dport; + } + ++ minfo6.flags = 0; ++ + rds_info_copy(iter, &minfo6, sizeof(minfo6)); + } + #endif +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index 20fae5ca87fa..800846d77a56 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -413,7 +413,7 @@ static __net_init int bpf_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, bpf_net_id); + +- return tc_action_net_init(tn, &act_bpf_ops); ++ return tc_action_net_init(net, tn, &act_bpf_ops); + } + + static void __net_exit bpf_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c +index 605436747978..538dedd84e21 100644 +--- a/net/sched/act_connmark.c ++++ b/net/sched/act_connmark.c +@@ -215,7 +215,7 @@ static __net_init int connmark_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, connmark_net_id); + +- return tc_action_net_init(tn, &act_connmark_ops); ++ return tc_action_net_init(net, tn, &act_connmark_ops); + } + + static void __net_exit connmark_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c +index 40437197e053..1e269441065a 100644 +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -678,7 +678,7 @@ static __net_init int csum_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, csum_net_id); + +- return tc_action_net_init(tn, &act_csum_ops); ++ return tc_action_net_init(net, tn, &act_csum_ops); + } + + static void __net_exit csum_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c +index 72d3347bdd41..dfef9621375e 100644 +--- a/net/sched/act_gact.c ++++ b/net/sched/act_gact.c +@@ -263,7 +263,7 @@ static __net_init int gact_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, gact_net_id); + +- return tc_action_net_init(tn, &act_gact_ops); ++ return tc_action_net_init(net, tn, &act_gact_ops); + } + + static void __net_exit gact_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c +index 24047e0e5db0..bac353bea02f 100644 +--- a/net/sched/act_ife.c ++++ b/net/sched/act_ife.c +@@ -887,7 +887,7 @@ static __net_init int ife_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, ife_net_id); + +- return tc_action_net_init(tn, &act_ife_ops); ++ return tc_action_net_init(net, tn, &act_ife_ops); + } + + static void __net_exit ife_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 334f3a057671..01d3669ef498 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -65,12 +65,13 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t, + return 0; + } + +-static void ipt_destroy_target(struct xt_entry_target *t) ++static void ipt_destroy_target(struct xt_entry_target *t, struct net *net) + { + struct xt_tgdtor_param par = { + .target = t->u.kernel.target, + .targinfo = t->data, + .family = NFPROTO_IPV4, ++ .net = net, + }; + if (par.target->destroy != NULL) + par.target->destroy(&par); +@@ -82,7 +83,7 @@ static void tcf_ipt_release(struct tc_action *a) + struct tcf_ipt *ipt = to_ipt(a); + + if (ipt->tcfi_t) { +- ipt_destroy_target(ipt->tcfi_t); ++ ipt_destroy_target(ipt->tcfi_t, a->idrinfo->net); + kfree(ipt->tcfi_t); + } + kfree(ipt->tcfi_tname); +@@ -182,7 +183,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla, + + spin_lock_bh(&ipt->tcf_lock); + if (ret != ACT_P_CREATED) { +- ipt_destroy_target(ipt->tcfi_t); ++ ipt_destroy_target(ipt->tcfi_t, net); + kfree(ipt->tcfi_tname); + kfree(ipt->tcfi_t); + } +@@ -353,7 +354,7 @@ static __net_init int ipt_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, ipt_net_id); + +- return tc_action_net_init(tn, &act_ipt_ops); ++ return tc_action_net_init(net, tn, &act_ipt_ops); + } + + static void __net_exit ipt_exit_net(struct list_head *net_list) +@@ -403,7 +404,7 @@ static __net_init int xt_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, xt_net_id); + +- return tc_action_net_init(tn, &act_xt_ops); ++ return tc_action_net_init(net, tn, &act_xt_ops); + } + + static void __net_exit xt_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 548614bd9366..399e3beae6cf 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -419,7 +419,7 @@ static __net_init int mirred_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, mirred_net_id); + +- return tc_action_net_init(tn, &act_mirred_ops); ++ return tc_action_net_init(net, tn, &act_mirred_ops); + } + + static void __net_exit mirred_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c +index 619828920b97..d1b47a1b145c 100644 +--- a/net/sched/act_nat.c ++++ b/net/sched/act_nat.c +@@ -317,7 +317,7 @@ static __net_init int nat_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, nat_net_id); + +- return tc_action_net_init(tn, &act_nat_ops); ++ return tc_action_net_init(net, tn, &act_nat_ops); + } + + static void __net_exit nat_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 82d258b2a75a..33c0cc5ef229 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -488,7 +488,7 @@ static __net_init int pedit_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, pedit_net_id); + +- return tc_action_net_init(tn, &act_pedit_ops); ++ return tc_action_net_init(net, tn, &act_pedit_ops); + } + + static void __net_exit pedit_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_police.c b/net/sched/act_police.c +index 997c34db1491..4db25959e156 100644 +--- a/net/sched/act_police.c ++++ b/net/sched/act_police.c +@@ -342,7 +342,7 @@ static __net_init int police_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, police_net_id); + +- return tc_action_net_init(tn, &act_police_ops); ++ return tc_action_net_init(net, tn, &act_police_ops); + } + + static void __net_exit police_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c +index ac37654ca292..98635311a5a0 100644 +--- a/net/sched/act_sample.c ++++ b/net/sched/act_sample.c +@@ -99,7 +99,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + s->tcf_action = parm->action; + s->rate = rate; + s->psample_group_num = psample_group_num; +- RCU_INIT_POINTER(s->psample_group, psample_group); ++ rcu_swap_protected(s->psample_group, psample_group, ++ lockdep_is_held(&s->tcf_lock)); + + if (tb[TCA_SAMPLE_TRUNC_SIZE]) { + s->truncate = true; +@@ -107,6 +108,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + } + spin_unlock_bh(&s->tcf_lock); + ++ if (psample_group) ++ psample_group_put(psample_group); + if (ret == ACT_P_CREATED) + tcf_idr_insert(tn, *a); + return ret; +@@ -255,7 +258,7 @@ static __net_init int sample_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, sample_net_id); + +- return tc_action_net_init(tn, &act_sample_ops); ++ return tc_action_net_init(net, tn, &act_sample_ops); + } + + static void __net_exit sample_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c +index 658efae71a09..b418ef62e0a4 100644 +--- a/net/sched/act_simple.c ++++ b/net/sched/act_simple.c +@@ -215,7 +215,7 @@ static __net_init int simp_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, simp_net_id); + +- return tc_action_net_init(tn, &act_simp_ops); ++ return tc_action_net_init(net, tn, &act_simp_ops); + } + + static void __net_exit simp_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c +index 7709710a41f7..a80179c1075f 100644 +--- a/net/sched/act_skbedit.c ++++ b/net/sched/act_skbedit.c +@@ -316,7 +316,7 @@ static __net_init int skbedit_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, skbedit_net_id); + +- return tc_action_net_init(tn, &act_skbedit_ops); ++ return tc_action_net_init(net, tn, &act_skbedit_ops); + } + + static void __net_exit skbedit_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index 3038493d18ca..21d195296121 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -277,7 +277,7 @@ static __net_init int skbmod_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, skbmod_net_id); + +- return tc_action_net_init(tn, &act_skbmod_ops); ++ return tc_action_net_init(net, tn, &act_skbmod_ops); + } + + static void __net_exit skbmod_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 66bfe57e74ae..43309ff2b5dc 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -579,7 +579,7 @@ static __net_init int tunnel_key_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, tunnel_key_net_id); + +- return tc_action_net_init(tn, &act_tunnel_key_ops); ++ return tc_action_net_init(net, tn, &act_tunnel_key_ops); + } + + static void __net_exit tunnel_key_exit_net(struct list_head *net_list) +diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c +index da993edd2e40..41528b966440 100644 +--- a/net/sched/act_vlan.c ++++ b/net/sched/act_vlan.c +@@ -324,7 +324,7 @@ static __net_init int vlan_init_net(struct net *net) + { + struct tc_action_net *tn = net_generic(net, vlan_net_id); + +- return tc_action_net_init(tn, &act_vlan_ops); ++ return tc_action_net_init(net, tn, &act_vlan_ops); + } + + static void __net_exit vlan_exit_net(struct list_head *net_list) +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index fcaf00621102..be7aebff0c1e 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -238,7 +238,7 @@ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32)) + + fd = get_fd_by_id(id); + if (fd < 0) { +- p_err("can't get prog by id (%u): %s", id, strerror(errno)); ++ p_err("can't open object by id (%u): %s", id, strerror(errno)); + return -1; + } + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 0ce50c319cfd..ef8a82f29f02 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -809,7 +809,7 @@ kvp_get_ip_info(int family, char *if_name, int op, + int sn_offset = 0; + int error = 0; + char *buffer; +- struct hv_kvp_ipaddr_value *ip_buffer; ++ struct hv_kvp_ipaddr_value *ip_buffer = NULL; + char cidr_mask[5]; /* /xyz */ + int weight; + int i; +diff --git a/tools/testing/selftests/kvm/lib/x86.c b/tools/testing/selftests/kvm/lib/x86.c +index a3122f1949a8..4d35eba73dc9 100644 +--- a/tools/testing/selftests/kvm/lib/x86.c ++++ b/tools/testing/selftests/kvm/lib/x86.c +@@ -809,9 +809,11 @@ struct kvm_x86_state *vcpu_save_state(struct kvm_vm *vm, uint32_t vcpuid) + TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XSAVE, r: %i", + r); + +- r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs); +- TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i", +- r); ++ if (kvm_check_cap(KVM_CAP_XCRS)) { ++ r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs); ++ TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i", ++ r); ++ } + + r = ioctl(vcpu->fd, KVM_GET_SREGS, &state->sregs); + TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_SREGS, r: %i", +@@ -858,9 +860,11 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s + TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XSAVE, r: %i", + r); + +- r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs); +- TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i", +- r); ++ if (kvm_check_cap(KVM_CAP_XCRS)) { ++ r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs); ++ TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i", ++ r); ++ } + + r = ioctl(vcpu->fd, KVM_SET_SREGS, &state->sregs); + TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_SREGS, r: %i", +diff --git a/tools/testing/selftests/kvm/platform_info_test.c b/tools/testing/selftests/kvm/platform_info_test.c +index 3764e7121265..65db510dddc3 100644 +--- a/tools/testing/selftests/kvm/platform_info_test.c ++++ b/tools/testing/selftests/kvm/platform_info_test.c +@@ -100,8 +100,8 @@ int main(int argc, char *argv[]) + msr_platform_info = vcpu_get_msr(vm, VCPU_ID, MSR_PLATFORM_INFO); + vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO, + msr_platform_info | MSR_PLATFORM_INFO_MAX_TURBO_RATIO); +- test_msr_platform_info_disabled(vm); + test_msr_platform_info_enabled(vm); ++ test_msr_platform_info_disabled(vm); + vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO, msr_platform_info); + + kvm_vm_free(vm); +diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c +index 08443a15e6be..3caee91bca08 100644 +--- a/virt/kvm/arm/mmio.c ++++ b/virt/kvm/arm/mmio.c +@@ -98,6 +98,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) + unsigned int len; + int mask; + ++ /* Detect an already handled MMIO return */ ++ if (unlikely(!vcpu->mmio_needed)) ++ return 0; ++ ++ vcpu->mmio_needed = 0; ++ + if (!run->mmio.is_write) { + len = run->mmio.len; + if (len > sizeof(unsigned long)) +@@ -200,6 +206,7 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run, + run->mmio.is_write = is_write; + run->mmio.phys_addr = fault_ipa; + run->mmio.len = len; ++ vcpu->mmio_needed = 1; + + if (!ret) { + /* We handled the access successfully in the kernel. */ +diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c +index 8196e4f8731f..cd75df25fe14 100644 +--- a/virt/kvm/arm/vgic/vgic-init.c ++++ b/virt/kvm/arm/vgic/vgic-init.c +@@ -19,6 +19,7 @@ + #include <linux/cpu.h> + #include <linux/kvm_host.h> + #include <kvm/arm_vgic.h> ++#include <asm/kvm_emulate.h> + #include <asm/kvm_mmu.h> + #include "vgic.h" + +@@ -175,12 +176,18 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis) + irq->vcpu = NULL; + irq->target_vcpu = vcpu0; + kref_init(&irq->refcount); +- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2) { ++ switch (dist->vgic_model) { ++ case KVM_DEV_TYPE_ARM_VGIC_V2: + irq->targets = 0; + irq->group = 0; +- } else { ++ break; ++ case KVM_DEV_TYPE_ARM_VGIC_V3: + irq->mpidr = 0; + irq->group = 1; ++ break; ++ default: ++ kfree(dist->spis); ++ return -EINVAL; + } + } + return 0; +@@ -220,7 +227,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu) + irq->intid = i; + irq->vcpu = NULL; + irq->target_vcpu = vcpu; +- irq->targets = 1U << vcpu->vcpu_id; + kref_init(&irq->refcount); + if (vgic_irq_is_sgi(i)) { + /* SGIs */ +@@ -230,11 +236,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu) + /* PPIs */ + irq->config = VGIC_CONFIG_LEVEL; + } +- +- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) +- irq->group = 1; +- else +- irq->group = 0; + } + + if (!irqchip_in_kernel(vcpu->kvm)) +@@ -297,10 +298,19 @@ int vgic_init(struct kvm *kvm) + + for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) { + struct vgic_irq *irq = &vgic_cpu->private_irqs[i]; +- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) ++ switch (dist->vgic_model) { ++ case KVM_DEV_TYPE_ARM_VGIC_V3: + irq->group = 1; +- else ++ irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu); ++ break; ++ case KVM_DEV_TYPE_ARM_VGIC_V2: + irq->group = 0; ++ irq->targets = 1U << idx; ++ break; ++ default: ++ ret = -EINVAL; ++ goto out; ++ } + } + } +
