commit:     63d9f2a0d8a0a2e6bac11b4c89893967f5b36324
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 22 12:24:11 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 22 12:24:11 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=63d9f2a0

Linux patch 4.4.231

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1230_linux-4.4.231.patch | 1742 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1746 insertions(+)

diff --git a/0000_README b/0000_README
index 8148270..3d3ab8d 100644
--- a/0000_README
+++ b/0000_README
@@ -963,6 +963,10 @@ Patch:  1229_linux-4.4.230.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.230
 
+Patch:  1230_linux-4.4.231.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.231
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1230_linux-4.4.231.patch b/1230_linux-4.4.231.patch
new file mode 100644
index 0000000..00335a3
--- /dev/null
+++ b/1230_linux-4.4.231.patch
@@ -0,0 +1,1742 @@
+diff --git a/Makefile b/Makefile
+index 847f2537d39d..46178c83906c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 230
++SUBLEVEL = 231
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
+index 8ee9113b2f8b..b060eb8ad91b 100644
+--- a/arch/arc/include/asm/elf.h
++++ b/arch/arc/include/asm/elf.h
+@@ -27,7 +27,7 @@
+ #define  R_ARC_S25W_PCREL     0x11
+ 
+ /*to set parameters in the core dumps */
+-#define ELF_ARCH              EM_ARCOMPACT
++#define ELF_ARCH              EM_ARC_INUSE
+ #define ELF_CLASS             ELFCLASS32
+ 
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index db1eee5fe502..5e3f1edf5a29 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -168,7 +168,6 @@ END(EV_Extension)
+ tracesys:
+       ; save EFA in case tracer wants the PC of traced task
+       ; using ERET won't work since next-PC has already committed
+-      lr  r12, [efa]
+       GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
+       st  r12, [r11, THREAD_FAULT_ADDR]       ; thread.fault_address
+ 
+@@ -211,15 +210,9 @@ tracesys_exit:
+ ; Breakpoint TRAP
+ ; ---------------------------------------------
+ trap_with_param:
+-
+-      ; stop_pc info by gdb needs this info
+-      lr  r0, [efa]
++      mov r0, r12     ; EFA in case ptracer/gdb wants stop_pc
+       mov r1, sp
+ 
+-      ; Now that we have read EFA, it is safe to do "fake" rtie
+-      ;   and get out of CPU exception mode
+-      FAKE_RET_FROM_EXCPN
+-
+       ; Save callee regs in case gdb wants to have a look
+       ; SP will grow up by size of CALLEE Reg-File
+       ; NOTE: clobbers r12
+@@ -246,6 +239,10 @@ ENTRY(EV_Trap)
+ 
+       EXCEPTION_PROLOGUE
+ 
++      lr  r12, [efa]
++
++      FAKE_RET_FROM_EXCPN
++
+       ;============ TRAP 1   :breakpoints
+       ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
+       bmsk.f 0, r9, 7
+@@ -253,9 +250,6 @@ ENTRY(EV_Trap)
+ 
+       ;============ TRAP  (no param): syscall top level
+ 
+-      ; First return from Exception to pure K mode (Exception/IRQs renabled)
+-      FAKE_RET_FROM_EXCPN
+-
+       ; If syscall tracing ongoing, invoke pre-post-hooks
+       GET_CURR_THR_INFO_FLAGS   r10
+       btst r10, TIF_SYSCALL_TRACE
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index f72743dc070d..606c21760f23 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -238,7 +238,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned 
int esr)
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+ 
+-      kgdb_handle_exception(1, SIGTRAP, 0, regs);
++      kgdb_handle_exception(0, SIGTRAP, 0, regs);
+       return DBG_HOOK_HANDLED;
+ }
+ 
+diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
+index 345978cc105b..fbb99c430f13 100644
+--- a/arch/mips/kernel/time.c
++++ b/arch/mips/kernel/time.c
+@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq;
+ static int cpufreq_callback(struct notifier_block *nb,
+                           unsigned long val, void *data)
+ {
+-      struct cpufreq_freqs *freq = data;
+-      struct cpumask *cpus = freq->policy->cpus;
+-      unsigned long lpj;
+       int cpu;
++      struct cpufreq_freqs *freq = data;
+ 
+       /*
+        * Skip lpj numbers adjustment if the CPU-freq transition is safe for
+@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notifier_block *nb,
+               }
+       }
+ 
++      cpu = freq->cpu;
+       /*
+        * Adjust global lpj variable and per-CPU udelay_val number in
+        * accordance with the new CPU frequency.
+@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notifier_block *nb,
+                                               glb_lpj_ref_freq,
+                                               freq->new);
+ 
+-              for_each_cpu(cpu, cpus) {
+-                      lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
+-                                          per_cpu(pcp_lpj_ref_freq, cpu),
+-                                          freq->new);
+-                      cpu_data[cpu].udelay_val = (unsigned int)lpj;
+-              }
++              cpu_data[cpu].udelay_val = cpufreq_scale(per_cpu(pcp_lpj_ref, 
cpu),
++                                         per_cpu(pcp_lpj_ref_freq, cpu), 
freq->new);
+       }
+ 
+       return NOTIFY_OK;
+diff --git a/arch/s390/include/asm/kvm_host.h 
b/arch/s390/include/asm/kvm_host.h
+index 7d9c5917da2b..737bc0a39463 100644
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -29,12 +29,12 @@
+ #define KVM_USER_MEM_SLOTS 32
+ 
+ /*
+- * These seem to be used for allocating ->chip in the routing table,
+- * which we don't use. 4096 is an out-of-thin-air value. If we need
+- * to look at ->chip later on, we'll need to revisit this.
++ * These seem to be used for allocating ->chip in the routing table, which we
++ * don't use. 1 is as small as we can get to reduce the needed memory. If we
++ * need to look at ->chip later on, we'll need to revisit this.
+  */
+ #define KVM_NR_IRQCHIPS 1
+-#define KVM_IRQCHIP_NUM_PINS 4096
++#define KVM_IRQCHIP_NUM_PINS 1
+ #define KVM_HALT_POLL_NS_DEFAULT 0
+ 
+ #define SIGP_CTRL_C           0x80
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a5b533aea958..2ff0fe32c015 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3679,7 +3679,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
+                       nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
+                       rsvd_bits(maxphyaddr, 51);
+               rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd |
+-                      nonleaf_bit8_rsvd | gbpages_bit_rsvd |
++                      gbpages_bit_rsvd |
+                       rsvd_bits(maxphyaddr, 51);
+               rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
+                       rsvd_bits(maxphyaddr, 51);
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 5e0e29ee31d1..226ccb7891d4 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -2155,6 +2155,7 @@ static struct virtio_device_id id_table[] = {
+       { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
+       { 0 },
+ };
++MODULE_DEVICE_TABLE(virtio, id_table);
+ 
+ static unsigned int features[] = {
+       VIRTIO_CONSOLE_F_SIZE,
+@@ -2167,6 +2168,7 @@ static struct virtio_device_id rproc_serial_id_table[] = 
{
+ #endif
+       { 0 },
+ };
++MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table);
+ 
+ static unsigned int rproc_serial_features[] = {
+ };
+@@ -2319,6 +2321,5 @@ static void __exit fini(void)
+ module_init(init);
+ module_exit(fini);
+ 
+-MODULE_DEVICE_TABLE(virtio, id_table);
+ MODULE_DESCRIPTION("Virtio console driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
+index 915eec3cc279..c2bb8486d174 100644
+--- a/drivers/dma/fsl-edma.c
++++ b/drivers/dma/fsl-edma.c
+@@ -671,6 +671,13 @@ static irqreturn_t fsl_edma_tx_handler(int irq, void 
*dev_id)
+                       fsl_chan = &fsl_edma->chans[ch];
+ 
+                       spin_lock(&fsl_chan->vchan.lock);
++
++                      if (!fsl_chan->edesc) {
++                              /* terminate_all called before */
++                              spin_unlock(&fsl_chan->vchan.lock);
++                              continue;
++                      }
++
+                       if (!fsl_chan->edesc->iscyclic) {
+                               list_del(&fsl_chan->edesc->vdesc.node);
+                               vchan_cookie_complete(&fsl_chan->edesc->vdesc);
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 2ccf81168d1e..e7a245d7bdbc 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -5554,6 +5554,7 @@ static int ci_parse_power_table(struct radeon_device 
*rdev)
+       if (!rdev->pm.dpm.ps)
+               return -ENOMEM;
+       power_state_offset = (u8 *)state_array->states;
++      rdev->pm.dpm.num_ps = 0;
+       for (i = 0; i < state_array->ucNumEntries; i++) {
+               u8 *idx;
+               power_state = (union pplib_power_state *)power_state_offset;
+@@ -5563,10 +5564,8 @@ static int ci_parse_power_table(struct radeon_device 
*rdev)
+               if (!rdev->pm.power_state[i].clock_info)
+                       return -EINVAL;
+               ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
+-              if (ps == NULL) {
+-                      kfree(rdev->pm.dpm.ps);
++              if (ps == NULL)
+                       return -ENOMEM;
+-              }
+               rdev->pm.dpm.ps[i].ps_priv = ps;
+               ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
+                                             non_clock_info,
+@@ -5588,8 +5587,8 @@ static int ci_parse_power_table(struct radeon_device 
*rdev)
+                       k++;
+               }
+               power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
++              rdev->pm.dpm.num_ps = i + 1;
+       }
+-      rdev->pm.dpm.num_ps = state_array->ucNumEntries;
+ 
+       /* fill in the vce power states */
+       for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) {
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index d6fa496d0ca2..d15e824e39df 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct input_dev 
*input, struct hid_device *hd
+               __set_bit(MSC_RAW, input->mscbit);
+       }
+ 
++      /*
++       * hid-input may mark device as using autorepeat, but neither
++       * the trackpad, nor the mouse actually want it.
++       */
++      __clear_bit(EV_REP, input->evbit);
++
+       return 0;
+ }
+ 
+diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c
+index 952fe692d764..0ddb0677e9c8 100644
+--- a/drivers/hwmon/emc2103.c
++++ b/drivers/hwmon/emc2103.c
+@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct device *dev, struct 
device_attribute *da,
+       }
+ 
+       result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg);
+-      if (result) {
++      if (result < 0) {
+               count = result;
+               goto err;
+       }
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index eef3aa6007f1..ffd8f9772096 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = {
+       { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, },
+       {0,}
+ };
++MODULE_DEVICE_TABLE(pci, pch_pcidev_id);
+ 
+ static irqreturn_t pch_i2c_handler(int irq, void *pData);
+ 
+diff --git a/drivers/input/serio/i8042-x86ia64io.h 
b/drivers/input/serio/i8042-x86ia64io.h
+index fd1e79013cf8..bdc42923523e 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -429,6 +429,13 @@ static const struct dmi_system_id __initconst 
i8042_dmi_nomux_table[] = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+               },
+       },
++      {
++              /* Lenovo XiaoXin Air 12 */
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
++              },
++      },
+       {
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+diff --git a/drivers/message/fusion/mptscsih.c 
b/drivers/message/fusion/mptscsih.c
+index 6c9fc11efb87..e77185e143ab 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -118,8 +118,6 @@ int                mptscsih_suspend(struct pci_dev *pdev, 
pm_message_t state);
+ int           mptscsih_resume(struct pci_dev *pdev);
+ #endif
+ 
+-#define SNS_LEN(scp)  SCSI_SENSE_BUFFERSIZE
+-
+ 
+ 
/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ /*
+@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, 
MPT_SCSI_HOST *hd, MPT_FRAME_HDR
+               /* Copy the sense received into the scsi command block. */
+               req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
+               sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * 
MPT_SENSE_BUFFER_ALLOC));
+-              memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc));
++              memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC);
+ 
+               /* Log SMART data (asc = 0x5D, non-IM case only) if required.
+                */
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index e2474af7386a..ae0f6a1a4be0 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -13,7 +13,7 @@
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/io.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/atmel-ssc.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
+@@ -21,7 +21,7 @@
+ #include <linux/of.h>
+ 
+ /* Serialize access to ssc_list and user count */
+-static DEFINE_SPINLOCK(user_lock);
++static DEFINE_MUTEX(user_lock);
+ static LIST_HEAD(ssc_list);
+ 
+ struct ssc_device *ssc_request(unsigned int ssc_num)
+@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
+       int ssc_valid = 0;
+       struct ssc_device *ssc;
+ 
+-      spin_lock(&user_lock);
++      mutex_lock(&user_lock);
+       list_for_each_entry(ssc, &ssc_list, list) {
+               if (ssc->pdev->dev.of_node) {
+                       if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
+@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
+       }
+ 
+       if (!ssc_valid) {
+-              spin_unlock(&user_lock);
++              mutex_unlock(&user_lock);
+               pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
+               return ERR_PTR(-ENODEV);
+       }
+ 
+       if (ssc->user) {
+-              spin_unlock(&user_lock);
++              mutex_unlock(&user_lock);
+               dev_dbg(&ssc->pdev->dev, "module busy\n");
+               return ERR_PTR(-EBUSY);
+       }
+       ssc->user++;
+-      spin_unlock(&user_lock);
++      mutex_unlock(&user_lock);
+ 
+       clk_prepare(ssc->clk);
+ 
+@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc)
+ {
+       bool disable_clk = true;
+ 
+-      spin_lock(&user_lock);
++      mutex_lock(&user_lock);
+       if (ssc->user)
+               ssc->user--;
+       else {
+               disable_clk = false;
+               dev_dbg(&ssc->pdev->dev, "device already free\n");
+       }
+-      spin_unlock(&user_lock);
++      mutex_unlock(&user_lock);
+ 
+       if (disable_clk)
+               clk_unprepare(ssc->clk);
+@@ -194,9 +194,9 @@ static int ssc_probe(struct platform_device *pdev)
+               return -ENXIO;
+       }
+ 
+-      spin_lock(&user_lock);
++      mutex_lock(&user_lock);
+       list_add_tail(&ssc->list, &ssc_list);
+-      spin_unlock(&user_lock);
++      mutex_unlock(&user_lock);
+ 
+       platform_set_drvdata(pdev, ssc);
+ 
+@@ -210,9 +210,9 @@ static int ssc_remove(struct platform_device *pdev)
+ {
+       struct ssc_device *ssc = platform_get_drvdata(pdev);
+ 
+-      spin_lock(&user_lock);
++      mutex_lock(&user_lock);
+       list_del(&ssc->list);
+-      spin_unlock(&user_lock);
++      mutex_unlock(&user_lock);
+ 
+       return 0;
+ }
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index 864c2dc728a9..4457adb16916 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -626,9 +626,8 @@ static int mei_cl_device_remove(struct device *dev)
+               ret = cldrv->remove(cldev);
+ 
+       module_put(THIS_MODULE);
+-      dev->driver = NULL;
+-      return ret;
+ 
++      return ret;
+ }
+ 
+ static ssize_t name_show(struct device *dev, struct device_attribute *a,
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c 
b/drivers/mtd/nand/brcmnand/brcmnand.c
+index d125d19a35e4..8278158715c1 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -455,8 +455,9 @@ static int brcmnand_revision_init(struct 
brcmnand_controller *ctrl)
+       } else {
+               ctrl->cs_offsets = brcmnand_cs_offsets;
+ 
+-              /* v5.0 and earlier has a different CS0 offset layout */
+-              if (ctrl->nand_version <= 0x0500)
++              /* v3.3-5.0 have a different CS0 offset layout */
++              if (ctrl->nand_version >= 0x0303 &&
++                  ctrl->nand_version <= 0x0500)
+                       ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
+       }
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+index 3eebb57975e3..dd2c64e2db5c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -295,6 +295,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp)
+               }
+       }
+ 
++      bp->pf.active_vfs = 0;
+       kfree(bp->pf.vf);
+       bp->pf.vf = NULL;
+ }
+@@ -535,7 +536,6 @@ void bnxt_sriov_disable(struct bnxt *bp)
+ 
+       bnxt_free_vf_resources(bp);
+ 
+-      bp->pf.active_vfs = 0;
+       bp->pf.max_pf_rx_rings = bp->pf.max_rx_rings;
+       bp->pf.max_pf_tx_rings = bp->pf.max_tx_rings;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c 
b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index fd6492fd3dc0..9d07fa318ac3 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3093,7 +3093,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info 
*fw_info,
+       drv_fw = &fw_info->fw_hdr;
+ 
+       /* Read the header of the firmware on the card */
+-      ret = -t4_read_flash(adap, FLASH_FW_START,
++      ret = t4_read_flash(adap, FLASH_FW_START,
+                           sizeof(*card_fw) / sizeof(uint32_t),
+                           (uint32_t *)card_fw, 1);
+       if (ret == 0) {
+@@ -3122,8 +3122,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info 
*fw_info,
+                  should_install_fs_fw(adap, card_fw_usable,
+                                       be32_to_cpu(fs_fw->fw_ver),
+                                       be32_to_cpu(card_fw->fw_ver))) {
+-              ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
+-                                   fw_size, 0);
++              ret = t4_fw_upgrade(adap, adap->mbox, fw_data,
++                                  fw_size, 0);
+               if (ret != 0) {
+                       dev_err(adap->pdev_dev,
+                               "failed to install firmware: %d\n", ret);
+@@ -3154,7 +3154,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info 
*fw_info,
+                       FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
+                       FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
+                       FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
+-              ret = EINVAL;
++              ret = -EINVAL;
+               goto bye;
+       }
+ 
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index b6b8aec73b28..e4299852974e 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1136,11 +1136,14 @@ static int smsc95xx_bind(struct usbnet *dev, struct 
usb_interface *intf)
+ 
+       /* Init all registers */
+       ret = smsc95xx_reset(dev);
++      if (ret)
++              goto free_pdata;
+ 
+       /* detect device revision as different features may be available */
+       ret = smsc95xx_read_reg(dev, ID_REV, &val);
+       if (ret < 0)
+-              return ret;
++              goto free_pdata;
++
+       val >>= 16;
+ 
+       if ((val == ID_REV_CHIP_ID_9500A_) || (val == ID_REV_CHIP_ID_9530_) ||
+@@ -1157,6 +1160,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct 
usb_interface *intf)
+       dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
+       dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+       return 0;
++
++free_pdata:
++      kfree(pdata);
++      return ret;
+ }
+ 
+ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c 
b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index e51f1a577897..e2ed30b03af5 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -639,9 +639,9 @@ err:
+ 
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+-      struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+-      struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+-      struct sk_buff *skb = rx_buf->skb;
++      struct sk_buff *skb = (struct sk_buff *) urb->context;
++      struct hif_device_usb *hif_dev =
++              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+       int ret;
+ 
+       if (!skb)
+@@ -681,15 +681,14 @@ resubmit:
+       return;
+ free:
+       kfree_skb(skb);
+-      kfree(rx_buf);
+ }
+ 
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+-      struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+-      struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+-      struct sk_buff *skb = rx_buf->skb;
++      struct sk_buff *skb = (struct sk_buff *) urb->context;
+       struct sk_buff *nskb;
++      struct hif_device_usb *hif_dev =
++              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+       int ret;
+ 
+       if (!skb)
+@@ -747,7 +746,6 @@ resubmit:
+       return;
+ free:
+       kfree_skb(skb);
+-      kfree(rx_buf);
+       urb->context = NULL;
+ }
+ 
+@@ -793,7 +791,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct 
hif_device_usb *hif_dev)
+       init_usb_anchor(&hif_dev->mgmt_submitted);
+ 
+       for (i = 0; i < MAX_TX_URB_NUM; i++) {
+-              tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
++              tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
+               if (!tx_buf)
+                       goto err;
+ 
+@@ -830,9 +828,8 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+-      struct rx_buf *rx_buf = NULL;
+-      struct sk_buff *skb = NULL;
+       struct urb *urb = NULL;
++      struct sk_buff *skb = NULL;
+       int i, ret;
+ 
+       init_usb_anchor(&hif_dev->rx_submitted);
+@@ -840,12 +837,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+ 
+       for (i = 0; i < MAX_RX_URB_NUM; i++) {
+ 
+-              rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+-              if (!rx_buf) {
+-                      ret = -ENOMEM;
+-                      goto err_rxb;
+-              }
+-
+               /* Allocate URB */
+               urb = usb_alloc_urb(0, GFP_KERNEL);
+               if (urb == NULL) {
+@@ -860,14 +851,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+                       goto err_skb;
+               }
+ 
+-              rx_buf->hif_dev = hif_dev;
+-              rx_buf->skb = skb;
+-
+               usb_fill_bulk_urb(urb, hif_dev->udev,
+                                 usb_rcvbulkpipe(hif_dev->udev,
+                                                 USB_WLAN_RX_PIPE),
+                                 skb->data, MAX_RX_BUF_SIZE,
+-                                ath9k_hif_usb_rx_cb, rx_buf);
++                                ath9k_hif_usb_rx_cb, skb);
+ 
+               /* Anchor URB */
+               usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -893,8 +881,6 @@ err_submit:
+ err_skb:
+       usb_free_urb(urb);
+ err_urb:
+-      kfree(rx_buf);
+-err_rxb:
+       ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+       return ret;
+ }
+@@ -906,21 +892,14 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct 
hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+-      struct rx_buf *rx_buf = NULL;
+-      struct sk_buff *skb = NULL;
+       struct urb *urb = NULL;
++      struct sk_buff *skb = NULL;
+       int i, ret;
+ 
+       init_usb_anchor(&hif_dev->reg_in_submitted);
+ 
+       for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+ 
+-              rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+-              if (!rx_buf) {
+-                      ret = -ENOMEM;
+-                      goto err_rxb;
+-              }
+-
+               /* Allocate URB */
+               urb = usb_alloc_urb(0, GFP_KERNEL);
+               if (urb == NULL) {
+@@ -935,14 +914,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct 
hif_device_usb *hif_dev)
+                       goto err_skb;
+               }
+ 
+-              rx_buf->hif_dev = hif_dev;
+-              rx_buf->skb = skb;
+-
+               usb_fill_int_urb(urb, hif_dev->udev,
+                                 usb_rcvintpipe(hif_dev->udev,
+                                                 USB_REG_IN_PIPE),
+                                 skb->data, MAX_REG_IN_BUF_SIZE,
+-                                ath9k_hif_usb_reg_in_cb, rx_buf, 1);
++                                ath9k_hif_usb_reg_in_cb, skb, 1);
+ 
+               /* Anchor URB */
+               usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -968,8 +944,6 @@ err_submit:
+ err_skb:
+       usb_free_urb(urb);
+ err_urb:
+-      kfree(rx_buf);
+-err_rxb:
+       ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+       return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h 
b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index 835264c36595..a95cdf562611 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -84,11 +84,6 @@ struct tx_buf {
+       struct list_head list;
+ };
+ 
+-struct rx_buf {
+-      struct sk_buff *skb;
+-      struct hif_device_usb *hif_dev;
+-};
+-
+ #define HIF_USB_TX_STOP  BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+ 
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 3709088d4d24..7969f5484aee 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -635,15 +635,20 @@ err_find_dev:
+ static int spidev_release(struct inode *inode, struct file *filp)
+ {
+       struct spidev_data      *spidev;
++      int                     dofree;
+ 
+       mutex_lock(&device_list_lock);
+       spidev = filp->private_data;
+       filp->private_data = NULL;
+ 
++      spin_lock_irq(&spidev->spi_lock);
++      /* ... after we unbound from the underlying device? */
++      dofree = (spidev->spi == NULL);
++      spin_unlock_irq(&spidev->spi_lock);
++
+       /* last close? */
+       spidev->users--;
+       if (!spidev->users) {
+-              int             dofree;
+ 
+               kfree(spidev->tx_buffer);
+               spidev->tx_buffer = NULL;
+@@ -651,19 +656,14 @@ static int spidev_release(struct inode *inode, struct 
file *filp)
+               kfree(spidev->rx_buffer);
+               spidev->rx_buffer = NULL;
+ 
+-              spin_lock_irq(&spidev->spi_lock);
+-              if (spidev->spi)
+-                      spidev->speed_hz = spidev->spi->max_speed_hz;
+-
+-              /* ... after we unbound from the underlying device? */
+-              dofree = (spidev->spi == NULL);
+-              spin_unlock_irq(&spidev->spi_lock);
+-
+               if (dofree)
+                       kfree(spidev);
++              else
++                      spidev->speed_hz = spidev->spi->max_speed_hz;
+       }
+ #ifdef CONFIG_SPI_SLAVE
+-      spi_slave_abort(spidev->spi);
++      if (!dofree)
++              spi_slave_abort(spidev->spi);
+ #endif
+       mutex_unlock(&device_list_lock);
+ 
+@@ -769,13 +769,13 @@ static int spidev_remove(struct spi_device *spi)
+ {
+       struct spidev_data      *spidev = spi_get_drvdata(spi);
+ 
++      /* prevent new opens */
++      mutex_lock(&device_list_lock);
+       /* make sure ops on existing fds can abort cleanly */
+       spin_lock_irq(&spidev->spi_lock);
+       spidev->spi = NULL;
+       spin_unlock_irq(&spidev->spi_lock);
+ 
+-      /* prevent new opens */
+-      mutex_lock(&device_list_lock);
+       list_del(&spidev->device_entry);
+       device_destroy(spidev_class, spidev->devt);
+       clear_bit(MINOR(spidev->devt), minors);
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c 
b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 63991c49ff23..79a8799b1262 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+       unsigned int lo_mask = data[5] << shift;
+       unsigned int chan_mask = hi_mask | lo_mask;
+       unsigned int old_mask = (1 << shift) - 1;
+-      unsigned int pm = devpriv->pm[trig] & old_mask;
+-      unsigned int pt = devpriv->pt[trig] & old_mask;
+-      unsigned int pp = devpriv->pp[trig] & old_mask;
++      unsigned int pm;
++      unsigned int pt;
++      unsigned int pp;
+ 
+       if (trig > 1) {
+               dev_dbg(dev->class_dev,
+@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+               return -EINVAL;
+       }
+ 
++      pm = devpriv->pm[trig] & old_mask;
++      pt = devpriv->pt[trig] & old_mask;
++      pp = devpriv->pp[trig] & old_mask;
++
+       switch (data[2]) {
+       case COMEDI_DIGITAL_TRIG_DISABLE:
+               /* clear trigger configuration */
+diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
+index f598ecddc8a7..b58a504240c4 100644
+--- a/drivers/uio/uio_pdrv_genirq.c
++++ b/drivers/uio/uio_pdrv_genirq.c
+@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(struct platform_device 
*pdev)
+       if (!uioinfo->irq) {
+               ret = platform_get_irq(pdev, 0);
+               uioinfo->irq = ret;
+-              if (ret == -ENXIO && pdev->dev.of_node)
++              if (ret == -ENXIO)
+                       uioinfo->irq = UIO_IRQ_NONE;
+               else if (ret < 0) {
+                       dev_err(&pdev->dev, "failed to get IRQ\n");
+diff --git a/drivers/usb/c67x00/c67x00-sched.c 
b/drivers/usb/c67x00/c67x00-sched.c
+index 7311ed61e99a..029c8bc54b7a 100644
+--- a/drivers/usb/c67x00/c67x00-sched.c
++++ b/drivers/usb/c67x00/c67x00-sched.c
+@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb 
*urb, int status)
+       c67x00_release_urb(c67x00, urb);
+       usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
+       spin_unlock(&c67x00->lock);
+-      usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
++      usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status);
+       spin_lock(&c67x00->lock);
+ }
+ 
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index dee22d8effda..e104c99b3a1f 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1122,6 +1122,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci)
+       enable_irq(ci->irq);
+ }
+ 
++/*
++ * Handle the wakeup interrupt triggered by extcon connector
++ * We need to call ci_irq again for extcon since the first
++ * interrupt (wakeup int) only let the controller be out of
++ * low power mode, but not handle any interrupts.
++ */
++static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
++{
++      struct ci_hdrc_cable *cable_id, *cable_vbus;
++      u32 otgsc = hw_read_otgsc(ci, ~0);
++
++      cable_id = &ci->platdata->id_extcon;
++      cable_vbus = &ci->platdata->vbus_extcon;
++
++      if (!IS_ERR(cable_id->edev) && ci->is_otg &&
++              (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
++              ci_irq(ci->irq, ci);
++
++      if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
++              (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
++              ci_irq(ci->irq, ci);
++}
++
+ static int ci_controller_resume(struct device *dev)
+ {
+       struct ci_hdrc *ci = dev_get_drvdata(dev);
+@@ -1148,6 +1171,7 @@ static int ci_controller_resume(struct device *dev)
+               enable_irq(ci->irq);
+               if (ci_otg_is_fsm_mode(ci))
+                       ci_otg_fsm_wakeup_by_srp(ci);
++              ci_extcon_wakeup_int(ci);
+       }
+ 
+       return 0;
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index d6fcead91b32..c095cde55329 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -185,6 +185,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
+ 
+ /*-------------------------------------------------------------------*/
+ 
++static const int pipetypes[4] = {
++      PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
++};
++
++/**
++ * usb_urb_ep_type_check - sanity check of endpoint in the given urb
++ * @urb: urb to be checked
++ *
++ * This performs a light-weight sanity check for the endpoint in the
++ * given urb.  It returns 0 if the urb contains a valid endpoint, otherwise
++ * a negative error code.
++ */
++int usb_urb_ep_type_check(const struct urb *urb)
++{
++      const struct usb_host_endpoint *ep;
++
++      ep = usb_pipe_endpoint(urb->dev, urb->pipe);
++      if (!ep)
++              return -EINVAL;
++      if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
++              return -EINVAL;
++      return 0;
++}
++EXPORT_SYMBOL_GPL(usb_urb_ep_type_check);
++
+ /**
+  * usb_submit_urb - issue an asynchronous transfer request for an endpoint
+  * @urb: pointer to the urb describing the request
+@@ -324,9 +349,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
+  */
+ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+ {
+-      static int                      pipetypes[4] = {
+-              PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+-      };
+       int                             xfertype, max;
+       struct usb_device               *dev;
+       struct usb_host_endpoint        *ep;
+@@ -445,7 +467,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+        */
+ 
+       /* Check that the pipe's type matches the endpoint's type */
+-      if (usb_pipetype(urb->pipe) != pipetypes[xfertype])
++      if (usb_urb_ep_type_check(urb))
+               dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
+                       usb_pipetype(urb->pipe), pipetypes[xfertype]);
+ 
+diff --git a/drivers/usb/gadget/function/f_uac1.c 
b/drivers/usb/gadget/function/f_uac1.c
+index 6a2346b99f55..a7782ce673d6 100644
+--- a/drivers/usb/gadget/function/f_uac1.c
++++ b/drivers/usb/gadget/function/f_uac1.c
+@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, 
struct usb_request *req)
+ 
+       /* Copy buffer is full, add it to the play_queue */
+       if (audio_buf_size - copy_buf->actual < req->actual) {
++              spin_lock_irq(&audio->lock);
+               list_add_tail(&copy_buf->list, &audio->play_queue);
++              spin_unlock_irq(&audio->lock);
+               schedule_work(&audio->playback_work);
+               copy_buf = f_audio_buffer_alloc(audio_buf_size);
+               if (IS_ERR(copy_buf))
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c 
b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 668ac5e8681b..e6902257d7de 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct 
usb_request *_req)
+       u32 status;
+ 
+       DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n",
+-                      ep->ep.name, req);
++                      ep->ep.name, _req);
+ 
+       spin_lock_irqsave(&udc->lock, flags);
+ 
+diff --git a/drivers/usb/host/ehci-platform.c 
b/drivers/usb/host/ehci-platform.c
+index 56200650b46b..bd7082f297bb 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -375,11 +375,6 @@ static int ehci_platform_resume(struct device *dev)
+       }
+ 
+       ehci_resume(hcd, priv->reset_on_resume);
+-
+-      pm_runtime_disable(dev);
+-      pm_runtime_set_active(dev);
+-      pm_runtime_enable(dev);
+-
+       return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/ohci-platform.c 
b/drivers/usb/host/ohci-platform.c
+index 0e5580e6f35c..c2669f185f65 100644
+--- a/drivers/usb/host/ohci-platform.c
++++ b/drivers/usb/host/ohci-platform.c
+@@ -339,11 +339,6 @@ static int ohci_platform_resume(struct device *dev)
+       }
+ 
+       ohci_resume(hcd, false);
+-
+-      pm_runtime_disable(dev);
+-      pm_runtime_set_active(dev);
+-      pm_runtime_enable(dev);
+-
+       return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 510fb7853f92..c4c40e9d4247 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -249,17 +249,8 @@ static int xhci_plat_resume(struct device *dev)
+ {
+       struct usb_hcd  *hcd = dev_get_drvdata(dev);
+       struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-      int ret;
+-
+-      ret = xhci_resume(xhci, 0);
+-      if (ret)
+-              return ret;
+ 
+-      pm_runtime_disable(dev);
+-      pm_runtime_set_active(dev);
+-      pm_runtime_enable(dev);
+-
+-      return 0;
++      return xhci_resume(xhci, 0);
+ }
+ 
+ static const struct dev_pm_ops xhci_plat_pm_ops = {
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index e8a8c4fa944f..3ec59c2b4f65 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -71,6 +71,7 @@
+ 
+ static const struct usb_device_id id_table[] = {
+       { USB_DEVICE(0x4348, 0x5523) },
++      { USB_DEVICE(0x1a86, 0x7522) },
+       { USB_DEVICE(0x1a86, 0x7523) },
+       { USB_DEVICE(0x1a86, 0x5523) },
+       { },
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index e92cd1eceefa..2c6587b5c329 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -63,6 +63,7 @@ static const struct usb_device_id id_table_earthmate[] = {
+ 
+ static const struct usb_device_id id_table_cyphidcomrs232[] = {
+       { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++      { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+       { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+       { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+       { }                                             /* Terminating entry */
+@@ -77,6 +78,7 @@ static const struct usb_device_id id_table_combined[] = {
+       { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
+       { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
+       { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++      { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+       { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+       { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+       { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
+diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
+index 119d2e17077b..6d9820bffc20 100644
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -24,6 +24,9 @@
+ #define VENDOR_ID_CYPRESS             0x04b4
+ #define PRODUCT_ID_CYPHIDCOM          0x5500
+ 
++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */
++#define VENDOR_ID_SAI                 0x17dd
++
+ /* FRWD Dongle - a GPS sports watch */
+ #define VENDOR_ID_FRWD                        0x6737
+ #define PRODUCT_ID_CYPHIDCOM_FRWD     0x0001
+diff --git a/drivers/usb/serial/iuu_phoenix.c 
b/drivers/usb/serial/iuu_phoenix.c
+index 7ed7d33d6c10..1a966f25b3ef 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct 
usb_serial_port *port,
+       struct iuu_private *priv = usb_get_serial_port_data(port);
+       unsigned long flags;
+ 
+-      if (count > 256)
+-              return -ENOMEM;
+-
+       spin_lock_irqsave(&priv->lock, flags);
+ 
++      count = min(count, 256 - priv->writelen);
++      if (count == 0)
++              goto out;
++
+       /* fill the buffer */
+       memcpy(priv->writebuf + priv->writelen, buf, count);
+       priv->writelen += count;
++out:
+       spin_unlock_irqrestore(&priv->lock, flags);
+ 
+       return count;
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 326e7109b8f8..52b1092ed57e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -248,6 +248,7 @@ static void option_instat_callback(struct urb *urb);
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21                  0x0121
+ #define QUECTEL_PRODUCT_EC25                  0x0125
++#define QUECTEL_PRODUCT_EG95                  0x0195
+ #define QUECTEL_PRODUCT_BG96                  0x0296
+ #define QUECTEL_PRODUCT_EP06                  0x0306
+ 
+@@ -1095,6 +1096,8 @@ static const struct usb_device_id option_ids[] = {
+         .driver_info = RSVD(4) },
+       { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+         .driver_info = RSVD(4) },
++      { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
++        .driver_info = RSVD(4) },
+       { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+         .driver_info = RSVD(4) },
+       { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
+@@ -2019,6 +2022,9 @@ static const struct usb_device_id option_ids[] = {
+         .driver_info = RSVD(4) | RSVD(5) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),                     
/* Fibocom NL678 series */
+         .driver_info = RSVD(6) },
++      { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },                   
/* GosunCn GM500 RNDIS */
++      { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },                   
/* GosunCn GM500 MBIM */
++      { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },                   
/* GosunCn GM500 ECM/NCM */
+       { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 2c86c472f670..42b7409d4cc5 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4861,25 +4861,28 @@ err:
+ static void check_buffer_tree_ref(struct extent_buffer *eb)
+ {
+       int refs;
+-      /* the ref bit is tricky.  We have to make sure it is set
+-       * if we have the buffer dirty.   Otherwise the
+-       * code to free a buffer can end up dropping a dirty
+-       * page
++      /*
++       * The TREE_REF bit is first set when the extent_buffer is added
++       * to the radix tree. It is also reset, if unset, when a new reference
++       * is created by find_extent_buffer.
+        *
+-       * Once the ref bit is set, it won't go away while the
+-       * buffer is dirty or in writeback, and it also won't
+-       * go away while we have the reference count on the
+-       * eb bumped.
++       * It is only cleared in two cases: freeing the last non-tree
++       * reference to the extent_buffer when its STALE bit is set or
++       * calling releasepage when the tree reference is the only reference.
+        *
+-       * We can't just set the ref bit without bumping the
+-       * ref on the eb because free_extent_buffer might
+-       * see the ref bit and try to clear it.  If this happens
+-       * free_extent_buffer might end up dropping our original
+-       * ref by mistake and freeing the page before we are able
+-       * to add one more ref.
++       * In both cases, care is taken to ensure that the extent_buffer's
++       * pages are not under io. However, releasepage can be concurrently
++       * called with creating new references, which is prone to race
++       * conditions between the calls to check_buffer_tree_ref in those
++       * codepaths and clearing TREE_REF in try_release_extent_buffer.
+        *
+-       * So bump the ref count first, then set the bit.  If someone
+-       * beat us to it, drop the ref we added.
++       * The actual lifetime of the extent_buffer in the radix tree is
++       * adequately protected by the refcount, but the TREE_REF bit and
++       * its corresponding reference are not. To protect against this
++       * class of races, we call check_buffer_tree_ref from the codepaths
++       * which trigger io after they set eb->io_pages. Note that once io is
++       * initiated, TREE_REF can no longer be cleared, so that is the
++       * moment at which any such race is best fixed.
+        */
+       refs = atomic_read(&eb->refs);
+       if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags))
+@@ -5346,6 +5349,11 @@ int read_extent_buffer_pages(struct extent_io_tree 
*tree,
+       clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags);
+       eb->read_mirror = 0;
+       atomic_set(&eb->io_pages, num_reads);
++      /*
++       * It is possible for releasepage to clear the TREE_REF bit before we
++       * set io_pages. See check_buffer_tree_ref for a more detailed comment.
++       */
++      check_buffer_tree_ref(eb);
+       for (i = start_i; i < num_pages; i++) {
+               page = eb->pages[i];
+               if (!PageUptodate(page)) {
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 6ce6754168e0..f7d025d1684c 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -17,6 +17,7 @@
+ #include <linux/swap.h>
+ #include <linux/falloc.h>
+ #include <linux/uio.h>
++#include <linux/fs.h>
+ 
+ static const struct file_operations fuse_direct_io_file_operations;
+ 
+@@ -2517,7 +2518,16 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, 
unsigned long arg,
+               struct iovec *iov = iov_page;
+ 
+               iov->iov_base = (void __user *)arg;
+-              iov->iov_len = _IOC_SIZE(cmd);
++
++              switch (cmd) {
++              case FS_IOC_GETFLAGS:
++              case FS_IOC_SETFLAGS:
++                      iov->iov_len = sizeof(int);
++                      break;
++              default:
++                      iov->iov_len = _IOC_SIZE(cmd);
++                      break;
++              }
+ 
+               if (_IOC_DIR(cmd) & _IOC_WRITE) {
+                       in_iov = iov;
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 02bffcc611c3..55ea5d625cdf 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(struct urb *urb)
+       return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT;
+ }
+ 
++int usb_urb_ep_type_check(const struct urb *urb);
++
+ void *usb_alloc_coherent(struct usb_device *dev, size_t size,
+       gfp_t mem_flags, dma_addr_t *dma);
+ void usb_free_coherent(struct usb_device *dev, size_t size,
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 2e6e3a14a21a..dc1f26da3c61 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -470,7 +470,15 @@ static inline struct neighbour *dst_neigh_lookup(const 
struct dst_entry *dst, co
+ static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry 
*dst,
+                                                    struct sk_buff *skb)
+ {
+-      struct neighbour *n =  dst->ops->neigh_lookup(dst, skb, NULL);
++      struct neighbour *n = NULL;
++
++      /* The packets from tunnel devices (eg bareudp) may have only
++       * metadata in the dst pointer of skb. Hence a pointer check of
++       * neigh_lookup is needed.
++       */
++      if (dst->ops->neigh_lookup)
++              n = dst->ops->neigh_lookup(dst, skb, NULL);
++
+       return IS_ERR(n) ? NULL : n;
+ }
+ 
+diff --git a/include/net/genetlink.h b/include/net/genetlink.h
+index 43c0e771f417..351766331519 100644
+--- a/include/net/genetlink.h
++++ b/include/net/genetlink.h
+@@ -33,12 +33,6 @@ struct genl_info;
+  *    do additional, common, filtering and return an error
+  * @post_doit: called after an operation's doit callback, it may
+  *    undo operations done by pre_doit, for example release locks
+- * @mcast_bind: a socket bound to the given multicast group (which
+- *    is given as the offset into the groups array)
+- * @mcast_unbind: a socket was unbound from the given multicast group.
+- *    Note that unbind() will not be called symmetrically if the
+- *    generic netlink family is removed while there are still open
+- *    sockets.
+  * @attrbuf: buffer to store parsed attributes
+  * @family_list: family list
+  * @mcgrps: multicast groups used by this family (private)
+@@ -61,8 +55,6 @@ struct genl_family {
+       void                    (*post_doit)(const struct genl_ops *ops,
+                                            struct sk_buff *skb,
+                                            struct genl_info *info);
+-      int                     (*mcast_bind)(struct net *net, int group);
+-      void                    (*mcast_unbind)(struct net *net, int group);
+       struct nlattr **        attrbuf;        /* private */
+       const struct genl_ops * ops;            /* private */
+       const struct genl_multicast_group *mcgrps; /* private */
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index a5c6e6da3d3d..57872c8f1151 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -71,6 +71,7 @@ struct snd_compr_runtime {
+  * @direction: stream direction, playback/recording
+  * @metadata_set: metadata set flag, true when set
+  * @next_track: has userspace signal next track transition, true when set
++ * @partial_drain: undergoing partial_drain for stream, true when set
+  * @private_data: pointer to DSP private data
+  */
+ struct snd_compr_stream {
+@@ -81,6 +82,7 @@ struct snd_compr_stream {
+       enum snd_compr_direction direction;
+       bool metadata_set;
+       bool next_track;
++      bool partial_drain;
+       void *private_data;
+ };
+ 
+@@ -178,7 +180,13 @@ static inline void snd_compr_drain_notify(struct 
snd_compr_stream *stream)
+       if (snd_BUG_ON(!stream))
+               return;
+ 
+-      stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++      /* for partial_drain case we are back to running state on success */
++      if (stream->partial_drain) {
++              stream->runtime->state = SNDRV_PCM_STATE_RUNNING;
++              stream->partial_drain = false; /* clear this flag as well */
++      } else {
++              stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++      }
+ 
+       wake_up(&stream->runtime->sleep);
+ }
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 971e31e47bfd..15952d0e340b 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5939,7 +5939,15 @@ static int detach_tasks(struct lb_env *env)
+               if (!can_migrate_task(p, env))
+                       goto next;
+ 
+-              load = task_h_load(p);
++              /*
++               * Depending of the number of CPUs and tasks and the
++               * cgroup hierarchy, task_h_load() can return a null
++               * value. Make sure that env->imbalance decreases
++               * otherwise detach_tasks() will stop only after
++               * detaching up to loop_max tasks.
++               */
++              load = max_t(unsigned long, task_h_load(p), 1);
++
+ 
+               if (sched_feat(LB_MIN) && load < 16 && 
!env->sd->nr_balance_failed)
+                       goto next;
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 82c878224bfc..a3abd136b8e7 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -802,6 +802,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr 
*msg, size_t len)
+                          RT_SCOPE_UNIVERSE, sk->sk_protocol,
+                          inet_sk_flowi_flags(sk), faddr, saddr, 0, 0);
+ 
++      fl4.fl4_icmp_type = user_icmph.type;
++      fl4.fl4_icmp_code = user_icmph.code;
++
+       security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
+       rt = ip_route_output_flow(net, &fl4, sk);
+       if (IS_ERR(rt)) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 2ceda7ddaed5..4080cf1a369d 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2259,6 +2259,9 @@ int tcp_disconnect(struct sock *sk, int flags)
+       tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+       tp->snd_cwnd_cnt = 0;
+       tp->window_clamp = 0;
++      if (icsk->icsk_ca_ops->release)
++              icsk->icsk_ca_ops->release(sk);
++      memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+       tcp_set_ca_state(sk, TCP_CA_Open);
+       tcp_clear_retrans(tp);
+       tp->total_retrans = 0;
+@@ -2593,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+       case TCP_MD5SIG:
+-              if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
+-                      err = tp->af_specific->md5_parse(sk, optval, optlen);
+-              else
+-                      err = -EINVAL;
++              err = tp->af_specific->md5_parse(sk, optval, optlen);
+               break;
+ #endif
+       case TCP_USER_TIMEOUT:
+@@ -3085,9 +3085,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
+ 
+ int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key 
*key)
+ {
++      u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in 
tcp_md5_do_add */
+       struct scatterlist sg;
+ 
+-      sg_init_one(&sg, key->key, key->keylen);
++      sg_init_one(&sg, key->key, keylen);
++
++      /* tcp_md5_do_add() might change key->key under us */
+       return crypto_hash_update(&hp->md5_desc, &sg, key->keylen);
+ }
+ EXPORT_SYMBOL(tcp_md5_hash_key);
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index aafe68134763..f6b64efc22e8 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -201,7 +201,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
+       icsk->icsk_ca_ops = ca;
+       icsk->icsk_ca_setsockopt = 1;
+ 
+-      if (sk->sk_state != TCP_CLOSE)
++      if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+               tcp_init_congestion_control(sk);
+ }
+ 
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 12d4d2758caf..3826745a160e 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -931,9 +931,18 @@ int tcp_md5_do_add(struct sock *sk, const union 
tcp_md5_addr *addr,
+ 
+       key = tcp_md5_do_lookup(sk, addr, family);
+       if (key) {
+-              /* Pre-existing entry - just update that one. */
++              /* Pre-existing entry - just update that one.
++               * Note that the key might be used concurrently.
++               */
+               memcpy(key->key, newkey, newkeylen);
+-              key->keylen = newkeylen;
++
++              /* Pairs with READ_ONCE() in tcp_md5_hash_key().
++               * Also note that a reader could catch new key->keylen value
++               * but old key->key[], this is the reason we use __GFP_ZERO
++               * at sock_kmalloc() time below these lines.
++               */
++              WRITE_ONCE(key->keylen, newkeylen);
++
+               return 0;
+       }
+ 
+@@ -950,7 +959,7 @@ int tcp_md5_do_add(struct sock *sk, const union 
tcp_md5_addr *addr,
+               rcu_assign_pointer(tp->md5sig_info, md5sig);
+       }
+ 
+-      key = sock_kmalloc(sk, sizeof(*key), gfp);
++      key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO);
+       if (!key)
+               return -ENOMEM;
+       if (!tcp_alloc_md5sig_pool()) {
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 53c53b1c881c..653892ea8f14 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1139,6 +1139,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, 
struct sk_buff *skb,
+ 
+       /* Queue the packet to IP for output */
+       skb->ignore_df = 1;
++      skb_dst_drop(skb);
+ #if IS_ENABLED(CONFIG_IPV6)
+       if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+               error = inet6_csk_xmit(tunnel->sock, skb, NULL);
+@@ -1203,10 +1204,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct 
sk_buff *skb, int hdr_len
+               goto out_unlock;
+       }
+ 
+-      /* Get routing info from the tunnel socket */
+-      skb_dst_drop(skb);
+-      skb_dst_set(skb, sk_dst_check(sk, 0));
+-
+       inet = inet_sk(sk);
+       fl = &inet->cork.fl;
+       switch (tunnel->encap) {
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 69f1558dfcb7..f613a1007107 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socket *sock, struct 
sockaddr_llc *addr)
+ 
+       if (!sock_flag(sk, SOCK_ZAPPED))
+               goto out;
++      if (!addr->sllc_arphrd)
++              addr->sllc_arphrd = ARPHRD_ETHER;
++      if (addr->sllc_arphrd != ARPHRD_ETHER)
++              goto out;
+       rc = -ENODEV;
+       if (sk->sk_bound_dev_if) {
+               llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *sock, struct 
sockaddr *uaddr, int addrlen)
+       if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
+               goto out;
+       rc = -EAFNOSUPPORT;
+-      if (unlikely(addr->sllc_family != AF_LLC))
++      if (!addr->sllc_arphrd)
++              addr->sllc_arphrd = ARPHRD_ETHER;
++      if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != 
ARPHRD_ETHER))
+               goto out;
+       rc = -ENODEV;
+       rcu_read_lock();
+       if (sk->sk_bound_dev_if) {
+               llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
+               if (llc->dev) {
+-                      if (!addr->sllc_arphrd)
+-                              addr->sllc_arphrd = llc->dev->type;
+                       if (is_zero_ether_addr(addr->sllc_mac))
+                               memcpy(addr->sllc_mac, llc->dev->dev_addr,
+                                      IFHWADDRLEN);
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index d681dbaf00c1..3fc00c320a9f 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -1007,63 +1007,11 @@ static struct genl_multicast_group genl_ctrl_groups[] 
= {
+       { .name = "notify", },
+ };
+ 
+-static int genl_bind(struct net *net, int group)
+-{
+-      int i, err = -ENOENT;
+-
+-      down_read(&cb_lock);
+-      for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+-              struct genl_family *f;
+-
+-              list_for_each_entry(f, genl_family_chain(i), family_list) {
+-                      if (group >= f->mcgrp_offset &&
+-                          group < f->mcgrp_offset + f->n_mcgrps) {
+-                              int fam_grp = group - f->mcgrp_offset;
+-
+-                              if (!f->netnsok && net != &init_net)
+-                                      err = -ENOENT;
+-                              else if (f->mcast_bind)
+-                                      err = f->mcast_bind(net, fam_grp);
+-                              else
+-                                      err = 0;
+-                              break;
+-                      }
+-              }
+-      }
+-      up_read(&cb_lock);
+-
+-      return err;
+-}
+-
+-static void genl_unbind(struct net *net, int group)
+-{
+-      int i;
+-
+-      down_read(&cb_lock);
+-      for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+-              struct genl_family *f;
+-
+-              list_for_each_entry(f, genl_family_chain(i), family_list) {
+-                      if (group >= f->mcgrp_offset &&
+-                          group < f->mcgrp_offset + f->n_mcgrps) {
+-                              int fam_grp = group - f->mcgrp_offset;
+-
+-                              if (f->mcast_unbind)
+-                                      f->mcast_unbind(net, fam_grp);
+-                              break;
+-                      }
+-              }
+-      }
+-      up_read(&cb_lock);
+-}
+-
+ static int __net_init genl_pernet_init(struct net *net)
+ {
+       struct netlink_kernel_cfg cfg = {
+               .input          = genl_rcv,
+               .flags          = NL_CFG_F_NONROOT_RECV,
+-              .bind           = genl_bind,
+-              .unbind         = genl_unbind,
+       };
+ 
+       /* we'll bump the group number right afterwards */
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 07f5017cbea2..e788c7e1929b 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -699,6 +699,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
+ 
+       retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
+       if (!retval) {
++              /* clear flags and stop any drain wait */
++              stream->partial_drain = false;
++              stream->metadata_set = false;
+               snd_compr_drain_notify(stream);
+               stream->runtime->total_bytes_available = 0;
+               stream->runtime->total_bytes_transferred = 0;
+@@ -809,6 +812,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream 
*stream)
+       if (stream->next_track == false)
+               return -EPERM;
+ 
++      stream->partial_drain = true;
+       retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN);
+       if (retval) {
+               pr_debug("Partial drain returned failure\n");
+diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
+index 42920a243328..3f94746d587a 100644
+--- a/sound/drivers/opl3/opl3_synth.c
++++ b/sound/drivers/opl3/opl3_synth.c
+@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw, struct file 
*file,
+               {
+                       struct snd_dm_fm_info info;
+ 
++                      memset(&info, 0, sizeof(info));
++
+                       info.fm_mode = opl3->fm_mode;
+                       info.rhythm = opl3->rhythm;
+                       if (copy_to_user(argp, &info, sizeof(struct 
snd_dm_fm_info)))
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index 12d87204e373..7ac92d188f4f 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -76,6 +76,12 @@ static int compare_input_type(const void *ap, const void 
*bp)
+       if (a->type != b->type)
+               return (int)(a->type - b->type);
+ 
++      /* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */
++      if (a->is_headset_mic && b->is_headphone_mic)
++              return -1; /* don't swap */
++      else if (a->is_headphone_mic && b->is_headset_mic)
++              return 1; /* swap */
++
+       /* In case one has boost and the other one has not,
+          pick the one with boost first. */
+       return (int)(b->has_boost_on_pin - a->has_boost_on_pin);
+diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
+index f518fbbe88de..4250d26166a0 100644
+--- a/sound/usb/line6/capture.c
++++ b/sound/usb/line6/capture.c
+@@ -269,6 +269,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm 
*line6pcm)
+               urb->interval = LINE6_ISO_INTERVAL;
+               urb->error_count = 0;
+               urb->complete = audio_in_callback;
++              if (usb_urb_ep_type_check(urb))
++                      return -EINVAL;
+       }
+ 
+       return 0;
+diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
+index 97ed593f6010..500f0b455be9 100644
+--- a/sound/usb/line6/playback.c
++++ b/sound/usb/line6/playback.c
+@@ -423,6 +423,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm 
*line6pcm)
+               urb->interval = LINE6_ISO_INTERVAL;
+               urb->error_count = 0;
+               urb->complete = audio_out_callback;
++              if (usb_urb_ep_type_check(urb))
++                      return -EINVAL;
+       }
+ 
+       return 0;
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index b21b76690b31..5c4a3d6c4234 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1475,6 +1475,8 @@ void snd_usbmidi_disconnect(struct list_head *p)
+       spin_unlock_irq(&umidi->disc_lock);
+       up_write(&umidi->disc_rwsem);
+ 
++      del_timer_sync(&umidi->error_timer);
++
+       for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
+               struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
+               if (ep->out)
+@@ -1501,7 +1503,6 @@ void snd_usbmidi_disconnect(struct list_head *p)
+                       ep->in = NULL;
+               }
+       }
+-      del_timer_sync(&umidi->error_timer);
+ }
+ EXPORT_SYMBOL(snd_usbmidi_disconnect);
+ 
+@@ -2258,16 +2259,22 @@ void snd_usbmidi_input_stop(struct list_head *p)
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_stop);
+ 
+-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep)
++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi,
++                                     struct snd_usb_midi_in_endpoint *ep)
+ {
+       unsigned int i;
++      unsigned long flags;
+ 
+       if (!ep)
+               return;
+       for (i = 0; i < INPUT_URBS; ++i) {
+               struct urb *urb = ep->urbs[i];
+-              urb->dev = ep->umidi->dev;
+-              snd_usbmidi_submit_urb(urb, GFP_KERNEL);
++              spin_lock_irqsave(&umidi->disc_lock, flags);
++              if (!atomic_read(&urb->use_count)) {
++                      urb->dev = ep->umidi->dev;
++                      snd_usbmidi_submit_urb(urb, GFP_ATOMIC);
++              }
++              spin_unlock_irqrestore(&umidi->disc_lock, flags);
+       }
+ }
+ 
+@@ -2283,7 +2290,7 @@ void snd_usbmidi_input_start(struct list_head *p)
+       if (umidi->input_running || !umidi->opened[1])
+               return;
+       for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
+-              snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
++              snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in);
+       umidi->input_running = 1;
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_start);
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index c892b4d1e733..ec56ce382061 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+       }
+ },
+ 
++/*
++ * MacroSilicon MS2109 based HDMI capture cards
++ *
++ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
++ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if
++ * they pretend to be 96kHz mono as a workaround for stereo being broken
++ * by that...
++ *
++ * They also have swapped L-R channels, but that's for userspace to deal
++ * with.
++ */
++{
++      USB_DEVICE(0x534d, 0x2109),
++      .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++              .vendor_name = "MacroSilicon",
++              .product_name = "MS2109",
++              .ifnum = QUIRK_ANY_INTERFACE,
++              .type = QUIRK_COMPOSITE,
++              .data = &(const struct snd_usb_audio_quirk[]) {
++                      {
++                              .ifnum = 2,
++                              .type = QUIRK_AUDIO_ALIGN_TRANSFER,
++                      },
++                      {
++                              .ifnum = 2,
++                              .type = QUIRK_AUDIO_STANDARD_MIXER,
++                      },
++                      {
++                              .ifnum = 3,
++                              .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++                              .data = &(const struct audioformat) {
++                                      .formats = SNDRV_PCM_FMTBIT_S16_LE,
++                                      .channels = 2,
++                                      .iface = 3,
++                                      .altsetting = 1,
++                                      .altset_idx = 1,
++                                      .attributes = 0,
++                                      .endpoint = 0x82,
++                                      .ep_attr = USB_ENDPOINT_XFER_ISOC |
++                                              USB_ENDPOINT_SYNC_ASYNC,
++                                      .rates = SNDRV_PCM_RATE_CONTINUOUS,
++                                      .rate_min = 48000,
++                                      .rate_max = 48000,
++                              }
++                      },
++                      {
++                              .ifnum = -1
++                      }
++              }
++      }
++},
++
+ #undef USB_DEVICE_VENDOR_SPEC
+diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
+index 6ce624cb7001..699c0ec5b9bf 100644
+--- a/tools/perf/util/stat.c
++++ b/tools/perf/util/stat.c
+@@ -318,8 +318,10 @@ int perf_stat_process_counter(struct perf_stat_config 
*config,
+        * interval mode, otherwise overall avg running
+        * averages will be shown for each interval.
+        */
+-      if (config->interval)
+-              init_stats(ps->res_stats);
++      if (config->interval) {
++              for (i = 0; i < 3; i++)
++                      init_stats(&ps->res_stats[i]);
++      }
+ 
+       if (counter->per_pkg)
+               zero_per_pkg(counter);

Reply via email to