commit:     6aed8ad7db11b972116e7e37ac56f601dd4cb76b
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 31 16:13:22 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 31 16:13:22 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6aed8ad7

Linux patch 4.9.232

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1231_linux-4.9.232.patch | 1945 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1949 insertions(+)

diff --git a/0000_README b/0000_README
index f3d3878..cf1c30c 100644
--- a/0000_README
+++ b/0000_README
@@ -967,6 +967,10 @@ Patch:  1230_linux-4.9.231.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.231
 
+Patch:  1231_linux-4.9.232.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.232
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1231_linux-4.9.232.patch b/1231_linux-4.9.232.patch
new file mode 100644
index 0000000..4dfa101
--- /dev/null
+++ b/1231_linux-4.9.232.patch
@@ -0,0 +1,1945 @@
+diff --git a/Makefile b/Makefile
+index 1b1342a8785a..934db3609c16 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 231
++SUBLEVEL = 232
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+@@ -505,7 +505,7 @@ ifeq ($(cc-name),clang)
+ ifneq ($(CROSS_COMPILE),)
+ CLANG_FLAGS   += --target=$(notdir $(CROSS_COMPILE:%-=%))
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+-CLANG_FLAGS   += --prefix=$(GCC_TOOLCHAIN_DIR)
++CLANG_FLAGS   += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
+ GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+ endif
+ ifneq ($(GCC_TOOLCHAIN),)
+diff --git a/arch/arm64/kernel/debug-monitors.c 
b/arch/arm64/kernel/debug-monitors.c
+index a5236a3e5297..3101d1b61713 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -380,14 +380,14 @@ void user_rewind_single_step(struct task_struct *task)
+        * If single step is active for this thread, then set SPSR.SS
+        * to 1 to avoid returning to the active-pending state.
+        */
+-      if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++      if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+               set_regs_spsr_ss(task_pt_regs(task));
+ }
+ NOKPROBE_SYMBOL(user_rewind_single_step);
+ 
+ void user_fastforward_single_step(struct task_struct *task)
+ {
+-      if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++      if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+               clear_regs_spsr_ss(task_pt_regs(task));
+ }
+ 
+diff --git a/arch/parisc/include/asm/atomic.h 
b/arch/parisc/include/asm/atomic.h
+index 5394b9c5f914..1616428a5f95 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -255,6 +255,8 @@ atomic64_set(atomic64_t *v, s64 i)
+       _atomic_spin_unlock_irqrestore(v, flags);
+ }
+ 
++#define atomic64_set_release(v, i)    atomic64_set((v), (i))
++
+ static __inline__ s64
+ atomic64_read(const atomic64_t *v)
+ {
+diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
+index d258f59564e1..3b40c98bbbd4 100644
+--- a/arch/x86/math-emu/wm_sqrt.S
++++ b/arch/x86/math-emu/wm_sqrt.S
+@@ -208,7 +208,7 @@ sqrt_stage_2_finish:
+ 
+ #ifdef PARANOID
+ /* It should be possible to get here only if the arg is ffff....ffff */
+-      cmp     $0xffffffff,FPU_fsqrt_arg_1
++      cmpl    $0xffffffff,FPU_fsqrt_arg_1
+       jnz     sqrt_stage_2_error
+ #endif /* PARANOID */
+ 
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index b9beae798d72..8679fa306206 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -830,7 +830,8 @@ c_start(struct seq_file *f, loff_t *pos)
+ static void *
+ c_next(struct seq_file *f, void *v, loff_t *pos)
+ {
+-      return NULL;
++      ++*pos;
++      return c_start(f, pos);
+ }
+ 
+ static void
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c 
b/arch/xtensa/kernel/xtensa_ksyms.c
+index 9210b9cc4ec9..455c6ec4086c 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -82,13 +82,13 @@ void __xtensa_libgcc_window_spill(void)
+ }
+ EXPORT_SYMBOL(__xtensa_libgcc_window_spill);
+ 
+-unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v)
+ {
+       BUG();
+ }
+ EXPORT_SYMBOL(__sync_fetch_and_and_4);
+ 
+-unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v)
+ {
+       BUG();
+ }
+diff --git a/drivers/base/regmap/regmap-debugfs.c 
b/drivers/base/regmap/regmap-debugfs.c
+index 36ce3511c733..7d0c83b47259 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -204,6 +204,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, 
unsigned int from,
+       if (*ppos < 0 || !count)
+               return -EINVAL;
+ 
++      if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
++              count = PAGE_SIZE << (MAX_ORDER - 1);
++
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+@@ -352,6 +355,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file 
*file,
+       if (*ppos < 0 || !count)
+               return -EINVAL;
+ 
++      if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
++              count = PAGE_SIZE << (MAX_ORDER - 1);
++
+       buf = kmalloc(count, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 1799a1dfa46e..cd984b59a8a1 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1239,7 +1239,7 @@ static int dev_get_regmap_match(struct device *dev, void 
*res, void *data)
+ 
+       /* If the user didn't specify a name match any */
+       if (data)
+-              return (*r)->name == data;
++              return !strcmp((*r)->name, data);
+       else
+               return 1;
+ }
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 1389f0582e29..c5a45c57b8b8 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -38,6 +38,18 @@
+ 
+ #include "../dmaengine.h"
+ 
++int completion_timeout = 200;
++module_param(completion_timeout, int, 0644);
++MODULE_PARM_DESC(completion_timeout,
++              "set ioat completion timeout [msec] (default 200 [msec])");
++int idle_timeout = 2000;
++module_param(idle_timeout, int, 0644);
++MODULE_PARM_DESC(idle_timeout,
++              "set ioat idel timeout [msec] (default 2000 [msec])");
++
++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
++
+ static char *chanerr_str[] = {
+       "DMA Transfer Destination Address Error",
+       "Next Descriptor Address Error",
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index a9bc1a15b0d1..b0152288983b 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -111,8 +111,6 @@ struct ioatdma_chan {
+       #define IOAT_RUN 5
+       #define IOAT_CHAN_ACTIVE 6
+       struct timer_list timer;
+-      #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+-      #define IDLE_TIMEOUT msecs_to_jiffies(2000)
+       #define RESET_DELAY msecs_to_jiffies(100)
+       struct ioatdma_device *ioat_dma;
+       dma_addr_t completion_dma;
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index c16c06b3dd2f..54296e262dea 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan 
*dc)
+ 
+       ret = pm_runtime_get_sync(tdc2dev(tdc));
+       if (ret < 0) {
++              pm_runtime_put_noidle(tdc2dev(tdc));
+               free_irq(tdc->irq, tdc);
+               return ret;
+       }
+@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
+       pm_runtime_enable(&pdev->dev);
+ 
+       ret = pm_runtime_get_sync(&pdev->dev);
+-      if (ret < 0)
++      if (ret < 0) {
++              pm_runtime_put_noidle(&pdev->dev);
+               goto rpm_disable;
++      }
+ 
+       ret = tegra_adma_init(tdma);
+       if (ret)
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+index 954f5b76bfcf..d44965f805fe 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+               if (retries)
+                       udelay(400);
+ 
+-              /* transaction request, wait up to 1ms for it to complete */
++              /* transaction request, wait up to 2ms for it to complete */
+               nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl);
+ 
+-              timeout = 1000;
++              timeout = 2000;
+               do {
+                       ctrl = nvkm_rd32(device, 0x00e4e4 + base);
+                       udelay(1);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+index 61d729b82c69..a5783f4d972e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+               if (retries)
+                       udelay(400);
+ 
+-              /* transaction request, wait up to 1ms for it to complete */
++              /* transaction request, wait up to 2ms for it to complete */
+               nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl);
+ 
+-              timeout = 1000;
++              timeout = 2000;
+               do {
+                       ctrl = nvkm_rd32(device, 0x00d954 + base);
+                       udelay(1);
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 197eb75d10ef..959a9e38b4f5 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -55,6 +55,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") 
and Command (\"Flag\")
+ struct apple_sc {
+       unsigned long quirks;
+       unsigned int fn_on;
++      unsigned int fn_found;
+       DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+ 
+@@ -340,12 +341,15 @@ static int apple_input_mapping(struct hid_device *hdev, 
struct hid_input *hi,
+               struct hid_field *field, struct hid_usage *usage,
+               unsigned long **bit, int *max)
+ {
++      struct apple_sc *asc = hid_get_drvdata(hdev);
++
+       if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+                       usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
+                       usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+               /* The fn key on Apple USB keyboards */
+               set_bit(EV_REP, hi->input->evbit);
+               hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
++              asc->fn_found = true;
+               apple_setup_input(hi->input);
+               return 1;
+       }
+@@ -372,6 +376,19 @@ static int apple_input_mapped(struct hid_device *hdev, 
struct hid_input *hi,
+       return 0;
+ }
+ 
++static int apple_input_configured(struct hid_device *hdev,
++              struct hid_input *hidinput)
++{
++      struct apple_sc *asc = hid_get_drvdata(hdev);
++
++      if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
++              hid_info(hdev, "Fn key not found (Apple Wireless Keyboard 
clone?), disabling Fn key handling\n");
++              asc->quirks = 0;
++      }
++
++      return 0;
++}
++
+ static int apple_probe(struct hid_device *hdev,
+               const struct hid_device_id *id)
+ {
+@@ -593,6 +610,7 @@ static struct hid_driver apple_driver = {
+       .event = apple_event,
+       .input_mapping = apple_input_mapping,
+       .input_mapped = apple_input_mapped,
++      .input_configured = apple_input_configured,
+ };
+ module_hid_driver(apple_driver);
+ 
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c 
b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 681ac9bc68b3..f98c1e1b1dbd 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -373,6 +373,14 @@ static const struct dmi_system_id 
i2c_hid_dmi_desc_override_table[] = {
+               },
+               .driver_data = (void *)&sipodev_desc
+       },
++      {
++              .ident = "Mediacom FlexBook edge 13",
++              .matches = {
++                      DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_NAME, 
"FlexBook_edge13-M-FBE13"),
++              },
++              .driver_data = (void *)&sipodev_desc
++      },
+       {
+               .ident = "Odys Winbook 13",
+               .matches = {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 3a352f76e633..427d4dbc9735 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1023,8 +1023,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+       if (epause->tx_pause)
+               link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+ 
+-      if (netif_running(dev))
++      if (netif_running(dev)) {
++              mutex_lock(&bp->link_lock);
+               rc = bnxt_hwrm_set_pause(bp);
++              mutex_unlock(&bp->link_lock);
++      }
+       return rc;
+ }
+ 
+diff --git a/drivers/net/ethernet/marvell/sky2.c 
b/drivers/net/ethernet/marvell/sky2.c
+index 49f692907a30..c4197d0ec4d2 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -215,7 +215,7 @@ io_error:
+ 
+ static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
+ {
+-      u16 v;
++      u16 v = 0;
+       __gm_phy_read(hw, port, reg, &v);
+       return v;
+ }
+diff --git a/drivers/net/ethernet/smsc/smc91x.c 
b/drivers/net/ethernet/smsc/smc91x.c
+index b0c72167bade..3c221ca2cc12 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2294,7 +2294,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+               ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+                                             "power", 0, 0, 100);
+               if (ret)
+-                      return ret;
++                      goto out_free_netdev;
+ 
+               /*
+                * Optional reset GPIO configured? Minimum 100 ns reset needed
+@@ -2303,7 +2303,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+               ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+                                             "reset", 0, 0, 100);
+               if (ret)
+-                      return ret;
++                      goto out_free_netdev;
+ 
+               /*
+                * Need to wait for optional EEPROM to load, max 750 us 
according
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 313e006f74fe..6f3519123eb6 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev)
+               rrpriv->info = NULL;
+       }
+       if (rrpriv->rx_ctrl) {
+-              pci_free_consistent(pdev, sizeof(struct ring_ctrl),
++              pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
+                                   rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
+               rrpriv->rx_ctrl = NULL;
+       }
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 7e94526de51c..5649cc075ccb 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1337,6 +1337,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, 
struct ifreq *ifr)
+               dp83640->hwts_rx_en = 1;
+               dp83640->layer = PTP_CLASS_L4;
+               dp83640->version = PTP_CLASS_V1;
++              cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+               break;
+       case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+       case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+@@ -1344,6 +1345,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, 
struct ifreq *ifr)
+               dp83640->hwts_rx_en = 1;
+               dp83640->layer = PTP_CLASS_L4;
+               dp83640->version = PTP_CLASS_V2;
++              cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+               break;
+       case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+       case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+@@ -1351,6 +1353,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, 
struct ifreq *ifr)
+               dp83640->hwts_rx_en = 1;
+               dp83640->layer = PTP_CLASS_L2;
+               dp83640->version = PTP_CLASS_V2;
++              cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+               break;
+       case HWTSTAMP_FILTER_PTP_V2_EVENT:
+       case HWTSTAMP_FILTER_PTP_V2_SYNC:
+@@ -1358,6 +1361,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, 
struct ifreq *ifr)
+               dp83640->hwts_rx_en = 1;
+               dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
+               dp83640->version = PTP_CLASS_V2;
++              cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+               break;
+       default:
+               return -ERANGE;
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index 2c50497cc4ed..7ec8992401fb 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -217,6 +217,7 @@ static int ax88172a_bind(struct usbnet *dev, struct 
usb_interface *intf)
+       ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+       if (ret < ETH_ALEN) {
+               netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
++              ret = -EIO;
+               goto free;
+       }
+       memcpy(dev->net->dev_addr, buf, ETH_ALEN);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 6676607164d6..f5657783fad4 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev)
+       dev->netdev_ops      = &lapbeth_netdev_ops;
+       dev->destructor      = free_netdev;
+       dev->type            = ARPHRD_X25;
+-      dev->hard_header_len = 3;
+       dev->mtu             = 1000;
+       dev->addr_len        = 0;
+ }
+@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev)
+       if (!ndev)
+               goto out;
+ 
++      /* When transmitting data:
++       * first this driver removes a pseudo header of 1 byte,
++       * then the lapb module prepends an LAPB header of at most 3 bytes,
++       * then this driver prepends a length field of 2 bytes,
++       * then the underlying Ethernet device prepends its own header.
++       */
++      ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
++
+       lapbeth = netdev_priv(ndev);
+       lapbeth->axdev = ndev;
+ 
+diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
+index eb56bb5916be..3b983f645726 100644
+--- a/drivers/net/wan/x25_asy.c
++++ b/drivers/net/wan/x25_asy.c
+@@ -186,7 +186,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl)
+       netif_wake_queue(sl->dev);
+ }
+ 
+-/* Send one completely decapsulated IP datagram to the IP layer. */
++/* Send an LAPB frame to the LAPB module to process. */
+ 
+ static void x25_asy_bump(struct x25_asy *sl)
+ {
+@@ -198,13 +198,12 @@ static void x25_asy_bump(struct x25_asy *sl)
+       count = sl->rcount;
+       dev->stats.rx_bytes += count;
+ 
+-      skb = dev_alloc_skb(count+1);
++      skb = dev_alloc_skb(count);
+       if (skb == NULL) {
+               netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
+               dev->stats.rx_dropped++;
+               return;
+       }
+-      skb_push(skb, 1);       /* LAPB internal control */
+       memcpy(skb_put(skb, count), sl->rbuff, count);
+       skb->protocol = x25_type_trans(skb, sl->dev);
+       err = lapb_data_received(skb->dev, skb);
+@@ -212,7 +211,6 @@ static void x25_asy_bump(struct x25_asy *sl)
+               kfree_skb(skb);
+               printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
+       } else {
+-              netif_rx(skb);
+               dev->stats.rx_packets++;
+       }
+ }
+@@ -358,12 +356,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
+  */
+ 
+ /*
+- *    Called when I frame data arrives. We did the work above - throw it
+- *    at the net layer.
++ *    Called when I frame data arrive. We add a pseudo header for upper
++ *    layers and pass it to upper layers.
+  */
+ 
+ static int x25_asy_data_indication(struct net_device *dev, struct sk_buff 
*skb)
+ {
++      if (skb_cow(skb, 1)) {
++              kfree_skb(skb);
++              return NET_RX_DROP;
++      }
++      skb_push(skb, 1);
++      skb->data[0] = X25_IFACE_DATA;
++
++      skb->protocol = x25_type_trans(skb, dev);
++
+       return netif_rx(skb);
+ }
+ 
+@@ -659,7 +666,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned 
char s)
+       switch (s) {
+       case X25_END:
+               if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
+-                  sl->rcount > 2)
++                  sl->rcount >= 2)
+                       x25_asy_bump(sl);
+               clear_bit(SLF_ESCAPE, &sl->flags);
+               sl->rcount = 0;
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c 
b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 84b5f8a144ff..fb5b7ce3d2c3 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -641,9 +641,9 @@ err:
+ 
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+-      struct sk_buff *skb = (struct sk_buff *) urb->context;
+-      struct hif_device_usb *hif_dev =
+-              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
++      struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++      struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++      struct sk_buff *skb = rx_buf->skb;
+       int ret;
+ 
+       if (!skb)
+@@ -683,14 +683,15 @@ resubmit:
+       return;
+ free:
+       kfree_skb(skb);
++      kfree(rx_buf);
+ }
+ 
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+-      struct sk_buff *skb = (struct sk_buff *) urb->context;
++      struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++      struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++      struct sk_buff *skb = rx_buf->skb;
+       struct sk_buff *nskb;
+-      struct hif_device_usb *hif_dev =
+-              usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+       int ret;
+ 
+       if (!skb)
+@@ -730,11 +731,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+                       return;
+               }
+ 
++              rx_buf->skb = nskb;
++
+               usb_fill_int_urb(urb, hif_dev->udev,
+                                usb_rcvintpipe(hif_dev->udev,
+                                                USB_REG_IN_PIPE),
+                                nskb->data, MAX_REG_IN_BUF_SIZE,
+-                               ath9k_hif_usb_reg_in_cb, nskb, 1);
++                               ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+       }
+ 
+ resubmit:
+@@ -748,6 +751,7 @@ resubmit:
+       return;
+ free:
+       kfree_skb(skb);
++      kfree(rx_buf);
+       urb->context = NULL;
+ }
+ 
+@@ -793,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct 
hif_device_usb *hif_dev)
+       init_usb_anchor(&hif_dev->mgmt_submitted);
+ 
+       for (i = 0; i < MAX_TX_URB_NUM; i++) {
+-              tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
++              tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
+               if (!tx_buf)
+                       goto err;
+ 
+@@ -830,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+-      struct urb *urb = NULL;
++      struct rx_buf *rx_buf = NULL;
+       struct sk_buff *skb = NULL;
++      struct urb *urb = NULL;
+       int i, ret;
+ 
+       init_usb_anchor(&hif_dev->rx_submitted);
+@@ -839,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+ 
+       for (i = 0; i < MAX_RX_URB_NUM; i++) {
+ 
++              rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++              if (!rx_buf) {
++                      ret = -ENOMEM;
++                      goto err_rxb;
++              }
++
+               /* Allocate URB */
+               urb = usb_alloc_urb(0, GFP_KERNEL);
+               if (urb == NULL) {
+@@ -853,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct 
hif_device_usb *hif_dev)
+                       goto err_skb;
+               }
+ 
++              rx_buf->hif_dev = hif_dev;
++              rx_buf->skb = skb;
++
+               usb_fill_bulk_urb(urb, hif_dev->udev,
+                                 usb_rcvbulkpipe(hif_dev->udev,
+                                                 USB_WLAN_RX_PIPE),
+                                 skb->data, MAX_RX_BUF_SIZE,
+-                                ath9k_hif_usb_rx_cb, skb);
++                                ath9k_hif_usb_rx_cb, rx_buf);
+ 
+               /* Anchor URB */
+               usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -883,6 +897,8 @@ err_submit:
+ err_skb:
+       usb_free_urb(urb);
+ err_urb:
++      kfree(rx_buf);
++err_rxb:
+       ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+       return ret;
+ }
+@@ -894,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct 
hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+-      struct urb *urb = NULL;
++      struct rx_buf *rx_buf = NULL;
+       struct sk_buff *skb = NULL;
++      struct urb *urb = NULL;
+       int i, ret;
+ 
+       init_usb_anchor(&hif_dev->reg_in_submitted);
+ 
+       for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+ 
++              rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++              if (!rx_buf) {
++                      ret = -ENOMEM;
++                      goto err_rxb;
++              }
++
+               /* Allocate URB */
+               urb = usb_alloc_urb(0, GFP_KERNEL);
+               if (urb == NULL) {
+@@ -916,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct 
hif_device_usb *hif_dev)
+                       goto err_skb;
+               }
+ 
++              rx_buf->hif_dev = hif_dev;
++              rx_buf->skb = skb;
++
+               usb_fill_int_urb(urb, hif_dev->udev,
+                                 usb_rcvintpipe(hif_dev->udev,
+                                                 USB_REG_IN_PIPE),
+                                 skb->data, MAX_REG_IN_BUF_SIZE,
+-                                ath9k_hif_usb_reg_in_cb, skb, 1);
++                                ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+ 
+               /* Anchor URB */
+               usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -946,6 +972,8 @@ err_submit:
+ err_skb:
+       usb_free_urb(urb);
+ err_urb:
++      kfree(rx_buf);
++err_rxb:
+       ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+       return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h 
b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index a95cdf562611..835264c36595 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -84,6 +84,11 @@ struct tx_buf {
+       struct list_head list;
+ };
+ 
++struct rx_buf {
++      struct sk_buff *skb;
++      struct hif_device_usb *hif_dev;
++};
++
+ #define HIF_USB_TX_STOP  BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+ 
+diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
+index e8bbb20779d0..83597e1d6dcd 100644
+--- a/drivers/pinctrl/pinctrl-amd.h
++++ b/drivers/pinctrl/pinctrl-amd.h
+@@ -250,7 +250,7 @@ static const struct amd_pingroup kerncz_groups[] = {
+       {
+               .name = "uart0",
+               .pins = uart0_pins,
+-              .npins = 9,
++              .npins = 5,
+       },
+       {
+               .name = "uart1",
+diff --git a/drivers/scsi/scsi_transport_spi.c 
b/drivers/scsi/scsi_transport_spi.c
+index 319868f3f674..083cd11ce7d7 100644
+--- a/drivers/scsi/scsi_transport_spi.c
++++ b/drivers/scsi/scsi_transport_spi.c
+@@ -353,7 +353,7 @@ store_spi_transport_##field(struct device *dev,            
        \
+       struct spi_transport_attrs *tp                                  \
+               = (struct spi_transport_attrs *)&starget->starget_data; \
+                                                                       \
+-      if (i->f->set_##field)                                          \
++      if (!i->f->set_##field)                                         \
+               return -EINVAL;                                         \
+       val = simple_strtoul(buf, NULL, 0);                             \
+       if (val > tp->max_##field)                                      \
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c 
b/drivers/staging/comedi/drivers/addi_apci_1032.c
+index ccd1a91290bf..536a135cd00b 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
+@@ -115,14 +115,22 @@ static int apci1032_cos_insn_config(struct comedi_device 
*dev,
+                                   unsigned int *data)
+ {
+       struct apci1032_private *devpriv = dev->private;
+-      unsigned int shift, oldmask;
++      unsigned int shift, oldmask, himask, lomask;
+ 
+       switch (data[0]) {
+       case INSN_CONFIG_DIGITAL_TRIG:
+               if (data[1] != 0)
+                       return -EINVAL;
+               shift = data[3];
+-              oldmask = (1U << shift) - 1;
++              if (shift < 32) {
++                      oldmask = (1U << shift) - 1;
++                      himask = data[4] << shift;
++                      lomask = data[5] << shift;
++              } else {
++                      oldmask = 0xffffffffu;
++                      himask = 0;
++                      lomask = 0;
++              }
+               switch (data[2]) {
+               case COMEDI_DIGITAL_TRIG_DISABLE:
+                       devpriv->ctrl = 0;
+@@ -145,8 +153,8 @@ static int apci1032_cos_insn_config(struct comedi_device 
*dev,
+                               devpriv->mode2 &= oldmask;
+                       }
+                       /* configure specified channels */
+-                      devpriv->mode1 |= data[4] << shift;
+-                      devpriv->mode2 |= data[5] << shift;
++                      devpriv->mode1 |= himask;
++                      devpriv->mode2 |= lomask;
+                       break;
+               case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+                       if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
+@@ -163,8 +171,8 @@ static int apci1032_cos_insn_config(struct comedi_device 
*dev,
+                               devpriv->mode2 &= oldmask;
+                       }
+                       /* configure specified channels */
+-                      devpriv->mode1 |= data[4] << shift;
+-                      devpriv->mode2 |= data[5] << shift;
++                      devpriv->mode1 |= himask;
++                      devpriv->mode2 |= lomask;
+                       break;
+               default:
+                       return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c 
b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 79a8799b1262..c4e36fb6df9d 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -461,13 +461,14 @@ static int apci1500_di_cfg_trig(struct comedi_device 
*dev,
+       struct apci1500_private *devpriv = dev->private;
+       unsigned int trig = data[1];
+       unsigned int shift = data[3];
+-      unsigned int hi_mask = data[4] << shift;
+-      unsigned int lo_mask = data[5] << shift;
+-      unsigned int chan_mask = hi_mask | lo_mask;
+-      unsigned int old_mask = (1 << shift) - 1;
++      unsigned int hi_mask;
++      unsigned int lo_mask;
++      unsigned int chan_mask;
++      unsigned int old_mask;
+       unsigned int pm;
+       unsigned int pt;
+       unsigned int pp;
++      unsigned int invalid_chan;
+ 
+       if (trig > 1) {
+               dev_dbg(dev->class_dev,
+@@ -475,7 +476,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+               return -EINVAL;
+       }
+ 
+-      if (chan_mask > 0xffff) {
++      if (shift <= 16) {
++              hi_mask = data[4] << shift;
++              lo_mask = data[5] << shift;
++              old_mask = (1U << shift) - 1;
++              invalid_chan = (data[4] | data[5]) >> (16 - shift);
++      } else {
++              hi_mask = 0;
++              lo_mask = 0;
++              old_mask = 0xffff;
++              invalid_chan = data[4] | data[5];
++      }
++      chan_mask = hi_mask | lo_mask;
++
++      if (invalid_chan) {
+               dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
+               return -EINVAL;
+       }
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c 
b/drivers/staging/comedi/drivers/addi_apci_1564.c
+index 9bfb79c2e5c8..1b4ba19d599e 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1564.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1564.c
+@@ -340,14 +340,22 @@ static int apci1564_cos_insn_config(struct comedi_device 
*dev,
+                                   unsigned int *data)
+ {
+       struct apci1564_private *devpriv = dev->private;
+-      unsigned int shift, oldmask;
++      unsigned int shift, oldmask, himask, lomask;
+ 
+       switch (data[0]) {
+       case INSN_CONFIG_DIGITAL_TRIG:
+               if (data[1] != 0)
+                       return -EINVAL;
+               shift = data[3];
+-              oldmask = (1U << shift) - 1;
++              if (shift < 32) {
++                      oldmask = (1U << shift) - 1;
++                      himask = data[4] << shift;
++                      lomask = data[5] << shift;
++              } else {
++                      oldmask = 0xffffffffu;
++                      himask = 0;
++                      lomask = 0;
++              }
+               switch (data[2]) {
+               case COMEDI_DIGITAL_TRIG_DISABLE:
+                       devpriv->ctrl = 0;
+@@ -371,8 +379,8 @@ static int apci1564_cos_insn_config(struct comedi_device 
*dev,
+                               devpriv->mode2 &= oldmask;
+                       }
+                       /* configure specified channels */
+-                      devpriv->mode1 |= data[4] << shift;
+-                      devpriv->mode2 |= data[5] << shift;
++                      devpriv->mode1 |= himask;
++                      devpriv->mode2 |= lomask;
+                       break;
+               case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+                       if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
+@@ -389,8 +397,8 @@ static int apci1564_cos_insn_config(struct comedi_device 
*dev,
+                               devpriv->mode2 &= oldmask;
+                       }
+                       /* configure specified channels */
+-                      devpriv->mode1 |= data[4] << shift;
+-                      devpriv->mode2 |= data[5] << shift;
++                      devpriv->mode1 |= himask;
++                      devpriv->mode2 |= lomask;
+                       break;
+               default:
+                       return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/ni_6527.c 
b/drivers/staging/comedi/drivers/ni_6527.c
+index 84c62e256094..6e411b634015 100644
+--- a/drivers/staging/comedi/drivers/ni_6527.c
++++ b/drivers/staging/comedi/drivers/ni_6527.c
+@@ -341,7 +341,7 @@ static int ni6527_intr_insn_config(struct comedi_device 
*dev,
+               case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
+                       /* check shift amount */
+                       shift = data[3];
+-                      if (shift >= s->n_chan) {
++                      if (shift >= 32) {
+                               mask = 0;
+                               rising = 0;
+                               falling = 0;
+diff --git a/drivers/staging/wlan-ng/prism2usb.c 
b/drivers/staging/wlan-ng/prism2usb.c
+index f7149bb23180..5297e7d1c663 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface 
*interface,
+                              const struct usb_device_id *id)
+ {
+       struct usb_device *dev;
+-
++      const struct usb_endpoint_descriptor *epd;
++      const struct usb_host_interface *iface_desc = interface->cur_altsetting;
+       struct wlandevice *wlandev = NULL;
+       struct hfa384x *hw = NULL;
+       int result = 0;
+ 
++      if (iface_desc->desc.bNumEndpoints != 2) {
++              result = -ENODEV;
++              goto failed;
++      }
++
++      result = -EINVAL;
++      epd = &iface_desc->endpoint[1].desc;
++      if (!usb_endpoint_is_bulk_in(epd))
++              goto failed;
++      epd = &iface_desc->endpoint[2].desc;
++      if (!usb_endpoint_is_bulk_out(epd))
++              goto failed;
++
+       dev = interface_to_usbdev(interface);
+       wlandev = create_wlan();
+       if (!wlandev) {
+diff --git a/drivers/tty/serial/8250/8250_core.c 
b/drivers/tty/serial/8250/8250_core.c
+index c4e9eba36023..6624cc07ac04 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -529,6 +529,7 @@ static void __init serial8250_isa_init_ports(void)
+                */
+               up->mcr_mask = ~ALPHA_KLUDGE_MCR;
+               up->mcr_force = ALPHA_KLUDGE_MCR;
++              serial8250_set_defaults(up);
+       }
+ 
+       /* chain base port ops to support Remote Supervisor Adapter */
+@@ -552,7 +553,6 @@ static void __init serial8250_isa_init_ports(void)
+               port->membase  = old_serial_port[i].iomem_base;
+               port->iotype   = old_serial_port[i].io_type;
+               port->regshift = old_serial_port[i].iomem_reg_shift;
+-              serial8250_set_defaults(up);
+ 
+               port->irqflags |= irqflag;
+               if (serial8250_isa_config != NULL)
+diff --git a/drivers/tty/serial/8250/8250_mtk.c 
b/drivers/tty/serial/8250/8250_mtk.c
+index 91db9ca1c6c9..c54f57e4a7dd 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -45,8 +45,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios 
*termios,
+       unsigned long flags;
+       unsigned int baud, quot;
+ 
++      /*
++       * Store the requested baud rate before calling the generic 8250
++       * set_termios method. Standard 8250 port expects bauds to be
++       * no higher than (uartclk / 16) so the baud will be clamped if it
++       * gets out of that bound. Mediatek 8250 port supports speed
++       * higher than that, therefore we'll get original baud rate back
++       * after calling the generic set_termios method and recalculate
++       * the speed later in this method.
++       */
++      baud = tty_termios_baud_rate(termios);
++
+       serial8250_do_set_termios(port, termios, old);
+ 
++      tty_termios_encode_baud_rate(termios, baud, baud);
++
+       /*
+        * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS)
+        *
+@@ -85,6 +98,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios 
*termios,
+        */
+       spin_lock_irqsave(&port->lock, flags);
+ 
++      /*
++       * Update the per-port timeout.
++       */
++      uart_update_timeout(port, termios->c_cflag, baud);
++
+       /* set DLAB we have cval saved in up->lcr from the call to the core */
+       serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB);
+       serial_dl_write(up, quot);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 29fb08c8a2fd..3e5a3614fad0 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -765,10 +765,19 @@ static const struct tty_port_operations vc_port_ops = {
+       .destruct = vc_port_destruct,
+ };
+ 
++/*
++ * Change # of rows and columns (0 means unchanged/the size of fg_console)
++ * [this is to be used together with some user program
++ * like resize that changes the hardware videomode]
++ */
++#define VC_MAXCOL (32767)
++#define VC_MAXROW (32767)
++
+ int vc_allocate(unsigned int currcons)        /* return 0 on success */
+ {
+       struct vt_notifier_param param;
+       struct vc_data *vc;
++      int err;
+ 
+       WARN_CONSOLE_UNLOCKED();
+ 
+@@ -798,6 +807,11 @@ int vc_allocate(unsigned int currcons)    /* return 0 on 
success */
+       if (!*vc->vc_uni_pagedir_loc)
+               con_set_default_unimap(vc);
+ 
++      err = -EINVAL;
++      if (vc->vc_cols > VC_MAXCOL || vc->vc_rows > VC_MAXROW ||
++          vc->vc_screenbuf_size > KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size)
++              goto err_free;
++      err = -ENOMEM;
+       vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+       if (!vc->vc_screenbuf)
+               goto err_free;
+@@ -815,7 +829,7 @@ int vc_allocate(unsigned int currcons)     /* return 0 on 
success */
+ err_free:
+       kfree(vc);
+       vc_cons[currcons].d = NULL;
+-      return -ENOMEM;
++      return err;
+ }
+ 
+ static inline int resize_screen(struct vc_data *vc, int width, int height,
+@@ -830,14 +844,6 @@ static inline int resize_screen(struct vc_data *vc, int 
width, int height,
+       return err;
+ }
+ 
+-/*
+- * Change # of rows and columns (0 means unchanged/the size of fg_console)
+- * [this is to be used together with some user program
+- * like resize that changes the hardware videomode]
+- */
+-#define VC_RESIZE_MAXCOL (32767)
+-#define VC_RESIZE_MAXROW (32767)
+-
+ /**
+  *    vc_do_resize    -       resizing method for the tty
+  *    @tty: tty being resized
+@@ -872,7 +878,7 @@ static int vc_do_resize(struct tty_struct *tty, struct 
vc_data *vc,
+       user = vc->vc_resize_user;
+       vc->vc_resize_user = 0;
+ 
+-      if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
++      if (cols > VC_MAXCOL || lines > VC_MAXROW)
+               return -EINVAL;
+ 
+       new_cols = (cols ? cols : vc->vc_cols);
+@@ -883,7 +889,7 @@ static int vc_do_resize(struct tty_struct *tty, struct 
vc_data *vc,
+       if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+               return 0;
+ 
+-      if (new_screen_size > (4 << 20))
++      if (new_screen_size > (4 << 20) || !new_screen_size)
+               return -EINVAL;
+       newscreen = kzalloc(new_screen_size, GFP_USER);
+       if (!newscreen)
+@@ -3033,6 +3039,7 @@ static int __init con_init(void)
+               INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
+               tty_port_init(&vc->port);
+               visual_init(vc, currcons, 1);
++              /* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */
+               vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
+               vc_init(vc, vc->vc_rows, vc->vc_cols,
+                       currcons || !vc->vc_sw->con_save_screen);
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 9e246d2e55ca..f2b165182b4b 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2000,9 +2000,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int 
is_in, u32 maxplimit)
+ 
+       if (num == 0) {
+               _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
++              if (!_req)
++                      return -ENOMEM;
++
+               buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
+-              if (!_req || !buf) {
+-                      /* possible _req freed by gr_probe via gr_remove */
++              if (!buf) {
++                      gr_free_request(&ep->ep, _req);
+                       return -ENOMEM;
+               }
+ 
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 144674913c78..3929ac8c6a73 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -284,6 +284,10 @@ static bool need_bw_sch(struct usb_host_endpoint *ep,
+       if (is_fs_or_ls(speed) && !has_tt)
+               return false;
+ 
++      /* skip endpoint with zero maxpkt */
++      if (usb_endpoint_maxp(&ep->desc) == 0)
++              return false;
++
+       return true;
+ }
+ 
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 4355fbc36fce..bb63cc5cbca0 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -213,6 +213,9 @@ static void xhci_pci_quirks(struct device *dev, struct 
xhci_hcd *xhci)
+       if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                       pdev->device == 0x1142)
+               xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++      if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
++                      pdev->device == 0x2142)
++              xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+ 
+       if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+               pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 2973d256bb44..bb008ac507fe 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1550,6 +1550,7 @@ static int __btrfs_find_all_roots(struct 
btrfs_trans_handle *trans,
+               if (ret < 0 && ret != -ENOENT) {
+                       ulist_free(tmp);
+                       ulist_free(*roots);
++                      *roots = NULL;
+                       return ret;
+               }
+               node = ulist_next(tmp, &uiter);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 70aa22a8a9cc..bace03a546b2 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6854,6 +6854,14 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
+       mutex_lock(&uuid_mutex);
+       lock_chunks(root);
+ 
++      /*
++       * It is possible for mount and umount to race in such a way that
++       * we execute this code path, but open_fs_devices failed to clear
++       * total_rw_bytes. We certainly want it cleared before reading the
++       * device items, so clear it here.
++       */
++      root->fs_info->fs_devices->total_rw_bytes = 0;
++
+       /*
+        * Read all device items, and then all the chunk items. All
+        * device items are found before any chunk item (their object id
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index acd8e0dccab4..5478902a0100 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1770,7 +1770,6 @@ cifs_rename2(struct inode *source_dir, struct dentry 
*source_dentry,
+       FILE_UNIX_BASIC_INFO *info_buf_target;
+       unsigned int xid;
+       int rc, tmprc;
+-      bool new_target = d_really_is_negative(target_dentry);
+ 
+       if (flags & ~RENAME_NOREPLACE)
+               return -EINVAL;
+@@ -1847,13 +1846,8 @@ cifs_rename2(struct inode *source_dir, struct dentry 
*source_dentry,
+        */
+ 
+ unlink_target:
+-      /*
+-       * If the target dentry was created during the rename, try
+-       * unlinking it if it's not negative
+-       */
+-      if (new_target &&
+-          d_really_is_positive(target_dentry) &&
+-          (rc == -EACCES || rc == -EEXIST)) {
++      /* Try unlinking the target dentry if it's not negative */
++      if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == 
-EEXIST)) {
+               if (d_is_dir(target_dentry))
+                       tmprc = cifs_rmdir(target_dir, target_dentry);
+               else
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 1affdec23729..de135d2591ff 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -379,6 +379,8 @@ static void nfs_direct_complete(struct nfs_direct_req 
*dreq)
+ {
+       struct inode *inode = dreq->inode;
+ 
++      inode_dio_end(inode);
++
+       if (dreq->iocb) {
+               long res = (long) dreq->error;
+               if (dreq->count != 0) {
+@@ -390,10 +392,7 @@ static void nfs_direct_complete(struct nfs_direct_req 
*dreq)
+ 
+       complete(&dreq->completion);
+ 
+-      igrab(inode);
+       nfs_direct_req_release(dreq);
+-      inode_dio_end(inode);
+-      iput(inode);
+ }
+ 
+ static void nfs_direct_readpage_release(struct nfs_page *req)
+@@ -535,10 +534,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct 
nfs_direct_req *dreq,
+        * generic layer handle the completion.
+        */
+       if (requested_bytes == 0) {
+-              igrab(inode);
+-              nfs_direct_req_release(dreq);
+               inode_dio_end(inode);
+-              iput(inode);
++              nfs_direct_req_release(dreq);
+               return result < 0 ? result : -EIO;
+       }
+ 
+@@ -956,10 +953,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct 
nfs_direct_req *dreq,
+        * generic layer handle the completion.
+        */
+       if (requested_bytes == 0) {
+-              igrab(inode);
+-              nfs_direct_req_release(dreq);
+               inode_dio_end(inode);
+-              iput(inode);
++              nfs_direct_req_release(dreq);
+               return result < 0 ? result : -EIO;
+       }
+ 
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index a89d2f793c1b..1eec947c562d 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp)
+       dprintk("NFS: release(%pD2)\n", filp);
+ 
+       nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
+-      inode_dio_wait(inode);
+       nfs_file_clear_open_context(filp);
+       return 0;
+ }
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 9ca8809ee3d0..e390a7882933 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -781,6 +781,8 @@ try_another_ag:
+       *logflagsp = 0;
+       if ((error = xfs_alloc_vextent(&args))) {
+               xfs_iroot_realloc(ip, -1, whichfork);
++              ASSERT(ifp->if_broot == NULL);
++              XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
+               xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+               return error;
+       }
+@@ -801,6 +803,8 @@ try_another_ag:
+       }
+       if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
+               xfs_iroot_realloc(ip, -1, whichfork);
++              ASSERT(ifp->if_broot == NULL);
++              XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
+               xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+               return -ENOSPC;
+       }
+diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
+index 58df02bd93c9..fa46183b163b 100644
+--- a/include/linux/io-mapping.h
++++ b/include/linux/io-mapping.h
+@@ -120,9 +120,12 @@ io_mapping_init_wc(struct io_mapping *iomap,
+                  resource_size_t base,
+                  unsigned long size)
+ {
++      iomap->iomem = ioremap_wc(base, size);
++      if (!iomap->iomem)
++              return NULL;
++
+       iomap->base = base;
+       iomap->size = size;
+-      iomap->iomem = ioremap_wc(base, size);
+ #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */
+       iomap->prot = pgprot_noncached_wc(PAGE_KERNEL);
+ #elif defined(pgprot_writecombine)
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 7f517458c64f..53eb9fecd263 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -218,6 +218,8 @@ struct tcp_sock {
+               u8 reord;    /* reordering detected */
+       } rack;
+       u16     advmss;         /* Advertised MSS                       */
++      u8      tlp_retrans:1,  /* TLP is a retransmission */
++              unused_1:7;
+       u8      rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
+               is_sack_reneg:1,    /* in recovery from loss with SACK reneg? */
+               unused:6;
+@@ -234,7 +236,7 @@ struct tcp_sock {
+               syn_data_acked:1,/* data in SYN is acked by SYN-ACK */
+               save_syn:1,     /* Save headers of SYN packet */
+               is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */
+-      u32     tlp_high_seq;   /* snd_nxt at the time of TLP retransmit. */
++      u32     tlp_high_seq;   /* snd_nxt at the time of TLP */
+ 
+ /* RTT measurement */
+       u32     srtt_us;        /* smoothed round trip time << 3 in usecs */
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 1fcaa174ed32..3f1d008a7c28 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1885,7 +1885,7 @@ static void handle_swbp(struct pt_regs *regs)
+       if (!uprobe) {
+               if (is_swbp > 0) {
+                       /* No matching uprobe; signal SIGTRAP. */
+-                      send_sig(SIGTRAP, current, 0);
++                      force_sig(SIGTRAP, current);
+               } else {
+                       /*
+                        * Either we raced with uprobe_unregister() or we can't
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 2f7f934bf435..d4232744c59f 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4794,7 +4794,6 @@ static void __mem_cgroup_clear_mc(void)
+               if (!mem_cgroup_is_root(mc.to))
+                       page_counter_uncharge(&mc.to->memory, mc.moved_swap);
+ 
+-              mem_cgroup_id_get_many(mc.to, mc.moved_swap);
+               css_put_many(&mc.to->css, mc.moved_swap);
+ 
+               mc.moved_swap = 0;
+@@ -4972,7 +4971,8 @@ put:                     /* get_mctgt_type() gets the 
page */
+                       ent = target.ent;
+                       if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) 
{
+                               mc.precharge--;
+-                              /* we fixup refcnts and charges later. */
++                              mem_cgroup_id_get_many(mc.to, 1);
++                              /* we fixup other refcnts and charges later. */
+                               mc.moved_swap++;
+                       }
+                       break;
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 02be8ee23271..64fede18aa33 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1191,7 +1191,10 @@ static int __must_check ax25_connect(struct socket 
*sock,
+       if (addr_len > sizeof(struct sockaddr_ax25) &&
+           fsa->fsa_ax25.sax25_ndigis != 0) {
+               /* Valid number of digipeaters ? */
+-              if (fsa->fsa_ax25.sax25_ndigis < 1 || 
fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
++              if (fsa->fsa_ax25.sax25_ndigis < 1 ||
++                  fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
++                  addr_len < sizeof(struct sockaddr_ax25) +
++                  sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
+                       err = -EINVAL;
+                       goto out_release;
+               }
+@@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct 
msghdr *msg, size_t len)
+                       struct full_sockaddr_ax25 *fsa = (struct 
full_sockaddr_ax25 *)usax;
+ 
+                       /* Valid number of digipeaters ? */
+-                      if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > 
AX25_MAX_DIGIS) {
++                      if (usax->sax25_ndigis < 1 ||
++                          usax->sax25_ndigis > AX25_MAX_DIGIS ||
++                          addr_len < sizeof(struct sockaddr_ax25) +
++                          sizeof(ax25_address) * usax->sax25_ndigis) {
+                               err = -EINVAL;
+                               goto out;
+                       }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 267b648a0645..dd8d36feb69f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4392,7 +4392,7 @@ static void flush_backlog(struct work_struct *work)
+       skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
+               if (skb->dev->reg_state == NETREG_UNREGISTERING) {
+                       __skb_unlink(skb, &sd->input_pkt_queue);
+-                      kfree_skb(skb);
++                      dev_kfree_skb_irq(skb);
+                       input_queue_head_incr(sd);
+               }
+       }
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 3333693d8052..3fb5d8ecc849 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1018,7 +1018,7 @@ static ssize_t show_trans_timeout(struct netdev_queue 
*queue,
+       trans_timeout = queue->trans_timeout;
+       spin_unlock_irq(&queue->_xmit_lock);
+ 
+-      return sprintf(buf, "%lu", trans_timeout);
++      return sprintf(buf, fmt_ulong, trans_timeout);
+ }
+ 
+ #ifdef CONFIG_XPS
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index b3953f789891..23246d8a3eae 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3566,10 +3566,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, 
u32 seq)
+       }
+ }
+ 
+-/* This routine deals with acks during a TLP episode.
+- * We mark the end of a TLP episode on receiving TLP dupack or when
+- * ack is after tlp_high_seq.
+- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
++/* This routine deals with acks during a TLP episode and ends an episode by
++ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
+  */
+ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
+ {
+@@ -3578,7 +3576,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 
ack, int flag)
+       if (before(ack, tp->tlp_high_seq))
+               return;
+ 
+-      if (flag & FLAG_DSACKING_ACK) {
++      if (!tp->tlp_retrans) {
++              /* TLP of new data has been acknowledged */
++              tp->tlp_high_seq = 0;
++      } else if (flag & FLAG_DSACKING_ACK) {
+               /* This DSACK means original and TLP probe arrived; no loss */
+               tp->tlp_high_seq = 0;
+       } else if (after(ack, tp->tlp_high_seq)) {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 84d74c431f83..b730b994b1c7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2357,6 +2357,11 @@ void tcp_send_loss_probe(struct sock *sk)
+       int pcount;
+       int mss = tcp_current_mss(sk);
+ 
++      /* At most one outstanding TLP */
++      if (tp->tlp_high_seq)
++              goto rearm_timer;
++
++      tp->tlp_retrans = 0;
+       skb = tcp_send_head(sk);
+       if (skb) {
+               if (tcp_snd_wnd_test(tp, skb, mss)) {
+@@ -2379,10 +2384,6 @@ void tcp_send_loss_probe(struct sock *sk)
+               return;
+       }
+ 
+-      /* At most one outstanding TLP retransmission. */
+-      if (tp->tlp_high_seq)
+-              goto rearm_timer;
+-
+       if (skb_still_in_host_queue(sk, skb))
+               goto rearm_timer;
+ 
+@@ -2403,10 +2404,12 @@ void tcp_send_loss_probe(struct sock *sk)
+       if (__tcp_retransmit_skb(sk, skb, 1))
+               goto rearm_timer;
+ 
++      tp->tlp_retrans = 1;
++
++probe_sent:
+       /* Record snd_nxt for loss detection. */
+       tp->tlp_high_seq = tp->snd_nxt;
+ 
+-probe_sent:
+       NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
+       /* Reset s.t. tcp_rearm_rto will restart timer from now */
+       inet_csk(sk)->icsk_pending = 0;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 1bb1e27d3d13..18a1a4890c5f 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1554,7 +1554,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff 
*skb)
+       /*
+        *      UDP-Lite specific tests, ignored on UDP sockets
+        */
+-      if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
++      if ((up->pcflag & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+ 
+               /*
+                * MIB statistics other than incrementing the error count are
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index ca001ecb7197..e0a2a3d6772d 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1130,15 +1130,16 @@ static void ip6gre_destroy_tunnels(struct net *net, 
struct list_head *head)
+ static int __net_init ip6gre_init_net(struct net *net)
+ {
+       struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
++      struct net_device *ndev;
+       int err;
+ 
+-      ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
+-                                        NET_NAME_UNKNOWN,
+-                                        ip6gre_tunnel_setup);
+-      if (!ign->fb_tunnel_dev) {
++      ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
++                          NET_NAME_UNKNOWN, ip6gre_tunnel_setup);
++      if (!ndev) {
+               err = -ENOMEM;
+               goto err_alloc_dev;
+       }
++      ign->fb_tunnel_dev = ndev;
+       dev_net_set(ign->fb_tunnel_dev, net);
+       /* FB netdevice is special: we have one, and only one per netns.
+        * Allowing to move it to another netns is clearly unsafe.
+@@ -1158,7 +1159,7 @@ static int __net_init ip6gre_init_net(struct net *net)
+       return 0;
+ 
+ err_reg_dev:
+-      ip6gre_dev_free(ign->fb_tunnel_dev);
++      ip6gre_dev_free(ndev);
+ err_alloc_dev:
+       return err;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 6a397e110b46..1ad84e18c03b 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -601,7 +601,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff 
*skb)
+       /*
+        * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
+        */
+-      if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
++      if ((up->pcflag & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+ 
+               if (up->pcrlen == 0) {          /* full coverage was set  */
+                       net_dbg_ratelimited("UDPLITE6: partial coverage %d 
while full coverage %d requested\n",
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index d3334fd84ca2..9be82ed02e0e 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2098,6 +2098,7 @@ static int ieee80211_802_1x_port_control(struct 
ieee80211_rx_data *rx)
+ 
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
++      struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+       struct sk_buff *skb = rx->skb;
+       struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+@@ -2108,6 +2109,31 @@ static int ieee80211_drop_unencrypted(struct 
ieee80211_rx_data *rx, __le16 fc)
+       if (status->flag & RX_FLAG_DECRYPTED)
+               return 0;
+ 
++      /* check mesh EAPOL frames first */
++      if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++                   ieee80211_is_data(fc))) {
++              struct ieee80211s_hdr *mesh_hdr;
++              u16 hdr_len = ieee80211_hdrlen(fc);
++              u16 ethertype_offset;
++              __be16 ethertype;
++
++              if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
++                      goto drop_check;
++
++              /* make sure fixed part of mesh header is there, also checks 
skb len */
++              if (!pskb_may_pull(rx->skb, hdr_len + 6))
++                      goto drop_check;
++
++              mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
++              ethertype_offset = hdr_len + 
ieee80211_get_mesh_hdrlen(mesh_hdr) +
++                                 sizeof(rfc1042_header);
++
++              if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 
0 &&
++                  ethertype == rx->sdata->control_port_protocol)
++                      return 0;
++      }
++
++drop_check:
+       /* Drop unencrypted frames if key is set. */
+       if (unlikely(!ieee80211_has_protected(fc) &&
+                    !ieee80211_is_any_nullfunc(fc) &&
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index 72de69175476..702ebcfa18dc 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -439,7 +439,7 @@ try_again:
+           list_empty(&rx->recvmsg_q) &&
+           rx->sk.sk_state != RXRPC_SERVER_LISTENING) {
+               release_sock(&rx->sk);
+-              return -ENODATA;
++              return -EAGAIN;
+       }
+ 
+       if (list_empty(&rx->recvmsg_q)) {
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 1de27c39564b..2ec1c29eeba4 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -191,7 +191,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
+       /* this should be in poll */
+       sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+ 
+-      if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
++      if (sk->sk_shutdown & SEND_SHUTDOWN)
+               return -EPIPE;
+ 
+       more = msg->msg_flags & MSG_MORE;
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 98cf6343afcd..61564e56e3aa 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -76,8 +76,8 @@ parse_symbol() {
+               return
+       fi
+ 
+-      # Strip out the base of the path
+-      code=${code#$basepath/}
++      # Strip out the base of the path on each line
++      code=$(while read -r line; do echo "${line#$basepath/}"; done <<< 
"$code")
+ 
+       # In the case of inlines, move everything to same line
+       code=${code//$'\n'/' '}
+diff --git a/sound/core/info.c b/sound/core/info.c
+index 358a6947342d..8a6fa8fd0aab 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char 
*line, int len)
+ {
+       int c = -1;
+ 
+-      if (snd_BUG_ON(!buffer || !buffer->buffer))
++      if (snd_BUG_ON(!buffer))
++              return 1;
++      if (!buffer->buffer)
+               return 1;
+       if (len <= 0 || buffer->stop || buffer->error)
+               return 1;
+diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h
+index 3f1b0f1df809..e4e31e82311d 100644
+--- a/sound/soc/codecs/rt5670.h
++++ b/sound/soc/codecs/rt5670.h
+@@ -760,7 +760,7 @@
+ #define RT5670_PWR_VREF2_BIT                  4
+ #define RT5670_PWR_FV2                                (0x1 << 3)
+ #define RT5670_PWR_FV2_BIT                    3
+-#define RT5670_LDO_SEL_MASK                   (0x3)
++#define RT5670_LDO_SEL_MASK                   (0x7)
+ #define RT5670_LDO_SEL_SFT                    0
+ 
+ /* Power Management for Analog 2 (0x64) */
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 7228d141a789..676568286eef 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1516,7 +1516,7 @@ static int is_directory(const char *base_path, const 
struct dirent *dent)
+       char path[PATH_MAX];
+       struct stat st;
+ 
+-      sprintf(path, "%s/%s", base_path, dent->d_name);
++      scnprintf(path, PATH_MAX, "%s/%s", base_path, dent->d_name);
+       if (stat(path, &st))
+               return 0;
+ 
+@@ -1702,8 +1702,8 @@ static int list_available_scripts(const struct option 
*opt __maybe_unused,
+       }
+ 
+       for_each_lang(scripts_path, scripts_dir, lang_dirent) {
+-              snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+-                       lang_dirent->d_name);
++              scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
++                        lang_dirent->d_name);
+               lang_dir = opendir(lang_path);
+               if (!lang_dir)
+                       continue;
+@@ -1712,8 +1712,8 @@ static int list_available_scripts(const struct option 
*opt __maybe_unused,
+                       script_root = get_script_root(script_dirent, 
REPORT_SUFFIX);
+                       if (script_root) {
+                               desc = script_desc__findnew(script_root);
+-                              snprintf(script_path, MAXPATHLEN, "%s/%s",
+-                                       lang_path, script_dirent->d_name);
++                              scnprintf(script_path, MAXPATHLEN, "%s/%s",
++                                        lang_path, script_dirent->d_name);
+                               read_script_info(desc, script_path);
+                               free(script_root);
+                       }
+@@ -1749,7 +1749,7 @@ static int check_ev_match(char *dir_name, char 
*scriptname,
+       int match, len;
+       FILE *fp;
+ 
+-      sprintf(filename, "%s/bin/%s-record", dir_name, scriptname);
++      scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, 
scriptname);
+ 
+       fp = fopen(filename, "r");
+       if (!fp)
+@@ -1825,8 +1825,8 @@ int find_scripts(char **scripts_array, char 
**scripts_path_array)
+       }
+ 
+       for_each_lang(scripts_path, scripts_dir, lang_dirent) {
+-              snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
+-                       lang_dirent->d_name);
++              scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
++                        lang_dirent->d_name);
+ #ifdef NO_LIBPERL
+               if (strstr(lang_path, "perl"))
+                       continue;
+@@ -1881,8 +1881,8 @@ static char *get_script_path(const char *script_root, 
const char *suffix)
+               return NULL;
+ 
+       for_each_lang(scripts_path, scripts_dir, lang_dirent) {
+-              snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+-                       lang_dirent->d_name);
++              scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
++                        lang_dirent->d_name);
+               lang_dir = opendir(lang_path);
+               if (!lang_dir)
+                       continue;
+@@ -1893,8 +1893,8 @@ static char *get_script_path(const char *script_root, 
const char *suffix)
+                               free(__script_root);
+                               closedir(lang_dir);
+                               closedir(scripts_dir);
+-                              snprintf(script_path, MAXPATHLEN, "%s/%s",
+-                                       lang_path, script_dirent->d_name);
++                              scnprintf(script_path, MAXPATHLEN, "%s/%s",
++                                        lang_path, script_dirent->d_name);
+                               return strdup(script_path);
+                       }
+                       free(__script_root);
+diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c
+index b60a6fd66517..a607d2a851ef 100644
+--- a/tools/perf/tests/attr.c
++++ b/tools/perf/tests/attr.c
+@@ -147,8 +147,8 @@ static int run_dir(const char *d, const char *perf)
+       if (verbose)
+               vcnt++;
+ 
+-      snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
+-               d, d, perf, vcnt, v);
++      scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
++                d, d, perf, vcnt, v);
+ 
+       return system(cmd) ? TEST_FAIL : TEST_OK;
+ }
+diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
+index 1e2ba2602930..1802ad3f45b6 100644
+--- a/tools/perf/tests/pmu.c
++++ b/tools/perf/tests/pmu.c
+@@ -95,7 +95,7 @@ static char *test_format_dir_get(void)
+               struct test_format *format = &test_formats[i];
+               FILE *file;
+ 
+-              snprintf(name, PATH_MAX, "%s/%s", dir, format->name);
++              scnprintf(name, PATH_MAX, "%s/%s", dir, format->name);
+ 
+               file = fopen(name, "w");
+               if (!file)
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index 3336cbc6ec48..1d4807c46efd 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1302,7 +1302,7 @@ fallback:
+ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
+ {
+       struct dso *dso = map->dso;
+-      char command[PATH_MAX * 2];
++      char *command;
+       FILE *file;
+       char symfs_filename[PATH_MAX];
+       struct kcore_extract kce;
+@@ -1364,7 +1364,7 @@ int symbol__disassemble(struct symbol *sym, struct map 
*map, size_t privsize)
+               strcpy(symfs_filename, tmp);
+       }
+ 
+-      snprintf(command, sizeof(command),
++      err = asprintf(&command,
+                "%s %s%s --start-address=0x%016" PRIx64
+                " --stop-address=0x%016" PRIx64
+                " -l -d %s %s -C %s 2>/dev/null|grep -v %s|expand",
+@@ -1377,12 +1377,17 @@ int symbol__disassemble(struct symbol *sym, struct map 
*map, size_t privsize)
+                symbol_conf.annotate_src ? "-S" : "",
+                symfs_filename, symfs_filename);
+ 
++      if (err < 0) {
++              pr_err("Failure allocating memory for the command to run\n");
++              goto out_remove_tmp;
++      }
++
+       pr_debug("Executing: %s\n", command);
+ 
+       err = -1;
+       if (pipe(stdout_fd) < 0) {
+               pr_err("Failure creating the pipe to run %s\n", command);
+-              goto out_remove_tmp;
++              goto out_free_command;
+       }
+ 
+       pid = fork();
+@@ -1409,7 +1414,7 @@ int symbol__disassemble(struct symbol *sym, struct map 
*map, size_t privsize)
+                * If we were using debug info should retry with
+                * original binary.
+                */
+-              goto out_remove_tmp;
++              goto out_free_command;
+       }
+ 
+       nline = 0;
+@@ -1432,6 +1437,8 @@ int symbol__disassemble(struct symbol *sym, struct map 
*map, size_t privsize)
+ 
+       fclose(file);
+       err = 0;
++out_free_command:
++      free(command);
+ out_remove_tmp:
+       close(stdout_fd[0]);
+ 
+@@ -1445,7 +1452,7 @@ out:
+ 
+ out_close_stdout:
+       close(stdout_fd[1]);
+-      goto out_remove_tmp;
++      goto out_free_command;
+ }
+ 
+ static void insert_source_line(struct rb_root *root, struct source_line 
*src_line)
+diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
+index 8fdee24725a7..5bc2b92ace6d 100644
+--- a/tools/perf/util/cgroup.c
++++ b/tools/perf/util/cgroup.c
+@@ -64,7 +64,7 @@ static int open_cgroup(char *name)
+       if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1))
+               return -1;
+ 
+-      snprintf(path, PATH_MAX, "%s/%s", mnt, name);
++      scnprintf(path, PATH_MAX, "%s/%s", mnt, name);
+ 
+       fd = open(path, O_RDONLY);
+       if (fd == -1)
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 6193be6d7639..f9f7e35f47a7 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -195,8 +195,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
+ 
+               for_each_event(sys_dirent, evt_dir, evt_dirent) {
+ 
+-                      snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
+-                               evt_dirent->d_name);
++                      scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
++                                evt_dirent->d_name);
+                       fd = open(evt_path, O_RDONLY);
+                       if (fd < 0)
+                               continue;
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index c86c1d5ea65c..39abbf827646 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -325,7 +325,7 @@ static int pmu_aliases_parse(char *dir, struct list_head 
*head)
+               if (pmu_alias_info_file(name))
+                       continue;
+ 
+-              snprintf(path, PATH_MAX, "%s/%s", dir, name);
++              scnprintf(path, PATH_MAX, "%s/%s", dir, name);
+ 
+               file = fopen(path, "r");
+               if (!file) {
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index a7452fd3b6ee..0551a02ee17c 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -118,7 +118,7 @@ static struct symbol *__find_kernel_function(u64 addr, 
struct map **mapp)
+       return machine__find_kernel_function(host_machine, addr, mapp);
+ }
+ 
+-static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
++static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap)
+ {
+       /* kmap->ref_reloc_sym should be set if host_machine is initialized */
+       struct kmap *kmap;
+@@ -130,6 +130,10 @@ static struct ref_reloc_sym 
*kernel_get_ref_reloc_sym(void)
+       kmap = map__kmap(map);
+       if (!kmap)
+               return NULL;
++
++      if (pmap)
++              *pmap = map;
++
+       return kmap->ref_reloc_sym;
+ }
+ 
+@@ -141,7 +145,7 @@ static int kernel_get_symbol_address_by_name(const char 
*name, u64 *addr,
+       struct map *map;
+ 
+       /* ref_reloc_sym is just a label. Need a special fix*/
+-      reloc_sym = kernel_get_ref_reloc_sym();
++      reloc_sym = kernel_get_ref_reloc_sym(NULL);
+       if (reloc_sym && strcmp(name, reloc_sym->name) == 0)
+               *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr;
+       else {
+@@ -742,6 +746,7 @@ post_process_kernel_probe_trace_events(struct 
probe_trace_event *tevs,
+                                      int ntevs)
+ {
+       struct ref_reloc_sym *reloc_sym;
++      struct map *map;
+       char *tmp;
+       int i, skipped = 0;
+ 
+@@ -750,7 +755,7 @@ post_process_kernel_probe_trace_events(struct 
probe_trace_event *tevs,
+               return post_process_offline_probe_trace_events(tevs, ntevs,
+                                               symbol_conf.vmlinux_name);
+ 
+-      reloc_sym = kernel_get_ref_reloc_sym();
++      reloc_sym = kernel_get_ref_reloc_sym(&map);
+       if (!reloc_sym) {
+               pr_warning("Relocated base symbol is not found!\n");
+               return -EINVAL;
+@@ -759,9 +764,13 @@ post_process_kernel_probe_trace_events(struct 
probe_trace_event *tevs,
+       for (i = 0; i < ntevs; i++) {
+               if (!tevs[i].point.address || tevs[i].point.retprobe)
+                       continue;
+-              /* If we found a wrong one, mark it by NULL symbol */
++              /*
++               * If we found a wrong one, mark it by NULL symbol.
++               * Since addresses in debuginfo is same as objdump, we need
++               * to convert it to addresses on memory.
++               */
+               if (kprobe_warn_out_range(tevs[i].point.symbol,
+-                                        tevs[i].point.address)) {
++                      map__objdump_2mem(map, tevs[i].point.address))) {
+                       tmp = NULL;
+                       skipped++;
+               } else {
+@@ -2850,7 +2859,7 @@ static int find_probe_trace_events_from_map(struct 
perf_probe_event *pev,
+ 
+       /* Note that the symbols in the kmodule are not relocated */
+       if (!pev->uprobes && !pp->retprobe && !pev->target) {
+-              reloc_sym = kernel_get_ref_reloc_sym();
++              reloc_sym = kernel_get_ref_reloc_sym(NULL);
+               if (!reloc_sym) {
+                       pr_warning("Relocated base symbol is not found!\n");
+                       ret = -EINVAL;
+diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
+index b4db3f48e3b0..2853d4728ab9 100644
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection 
*section, void *data)
+       bfd_vma pc, vma;
+       bfd_size_type size;
+       struct a2l_data *a2l = data;
++      flagword flags;
+ 
+       if (a2l->found)
+               return;
+ 
+-      if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0)
++#ifdef bfd_get_section_flags
++      flags = bfd_get_section_flags(abfd, section);
++#else
++      flags = bfd_section_flags(section);
++#endif
++      if ((flags & SEC_ALLOC) == 0)
+               return;
+ 
+       pc = a2l->addr;
++#ifdef bfd_get_section_vma
+       vma = bfd_get_section_vma(abfd, section);
++#else
++      vma = bfd_section_vma(section);
++#endif
++#ifdef bfd_get_section_size
+       size = bfd_get_section_size(section);
++#else
++      size = bfd_section_size(section);
++#endif
+ 
+       if (pc < vma || pc >= vma + size)
+               return;

Reply via email to