commit: 7d0d034aaa54dcff040633c7c1aa872df68b784f Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Oct 6 14:05:30 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Oct 6 14:05:30 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7d0d034a
Linux patch 4.19.209 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1208_linux-4.19.209.patch | 3383 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3387 insertions(+) diff --git a/0000_README b/0000_README index e4a501b..fbfd59f 100644 --- a/0000_README +++ b/0000_README @@ -871,6 +871,10 @@ Patch: 1207_linux-4.19.208.patch From: https://www.kernel.org Desc: Linux 4.19.208 +Patch: 1208_linux-4.19.209.patch +From: https://www.kernel.org +Desc: Linux 4.19.209 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1208_linux-4.19.209.patch b/1208_linux-4.19.209.patch new file mode 100644 index 0000000..21387e2 --- /dev/null +++ b/1208_linux-4.19.209.patch @@ -0,0 +1,3383 @@ +diff --git a/Makefile b/Makefile +index a4c2526409831..a144a7117a1bd 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 208 ++SUBLEVEL = 209 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h +index 0bba9e991189d..d4eab4f20249f 100644 +--- a/arch/alpha/include/asm/io.h ++++ b/arch/alpha/include/asm/io.h +@@ -61,7 +61,7 @@ extern inline void set_hae(unsigned long new_hae) + * Change virtual addresses to physical addresses and vv. + */ + #ifdef USE_48_BIT_KSEG +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + return (unsigned long)address - IDENT_ADDR; + } +@@ -71,7 +71,7 @@ static inline void * phys_to_virt(unsigned long address) + return (void *) (address + IDENT_ADDR); + } + #else +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + unsigned long phys = (unsigned long)address; + +@@ -112,7 +112,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page) + extern unsigned long __direct_map_base; + extern unsigned long __direct_map_size; + +-static inline unsigned long __deprecated virt_to_bus(void *address) ++static inline unsigned long __deprecated virt_to_bus(volatile void *address) + { + unsigned long phys = virt_to_phys(address); + unsigned long bus = phys + __direct_map_base; +diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h +index 9e842ff41768c..faeb6b1c00897 100644 +--- a/arch/arm/include/asm/ftrace.h ++++ b/arch/arm/include/asm/ftrace.h +@@ -19,6 +19,9 @@ struct dyn_arch_ftrace { + #ifdef CONFIG_OLD_MCOUNT + bool old_mcount; + #endif ++#ifdef CONFIG_ARM_MODULE_PLTS ++ struct module *mod; ++#endif + }; + + static inline unsigned long ftrace_call_adjust(unsigned long addr) +diff --git a/arch/arm/include/asm/insn.h b/arch/arm/include/asm/insn.h +index f20e08ac85aeb..5475cbf9fb6b4 100644 +--- a/arch/arm/include/asm/insn.h ++++ b/arch/arm/include/asm/insn.h +@@ -13,18 +13,18 @@ arm_gen_nop(void) + } + + unsigned long +-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link); ++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn); + + static inline unsigned long + arm_gen_branch(unsigned long pc, unsigned long addr) + { +- return __arm_gen_branch(pc, addr, false); ++ return __arm_gen_branch(pc, addr, false, true); + } + + static inline unsigned long +-arm_gen_branch_link(unsigned long pc, unsigned long addr) ++arm_gen_branch_link(unsigned long pc, unsigned long addr, bool warn) + { +- return __arm_gen_branch(pc, addr, true); ++ return __arm_gen_branch(pc, addr, true, warn); + } + + #endif +diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h +index 9e81b7c498d8b..6b36656eed830 100644 +--- a/arch/arm/include/asm/module.h ++++ b/arch/arm/include/asm/module.h +@@ -19,8 +19,18 @@ enum { + }; + #endif + ++#define PLT_ENT_STRIDE L1_CACHE_BYTES ++#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) ++#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) ++ ++struct plt_entries { ++ u32 ldr[PLT_ENT_COUNT]; ++ u32 lit[PLT_ENT_COUNT]; ++}; ++ + struct mod_plt_sec { + struct elf32_shdr *plt; ++ struct plt_entries *plt_ent; + int plt_count; + }; + +diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c +index ee673c09aa6c0..51839250e49a3 100644 +--- a/arch/arm/kernel/ftrace.c ++++ b/arch/arm/kernel/ftrace.c +@@ -96,9 +96,10 @@ int ftrace_arch_code_modify_post_process(void) + return 0; + } + +-static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr) ++static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr, ++ bool warn) + { +- return arm_gen_branch_link(pc, addr); ++ return arm_gen_branch_link(pc, addr, warn); + } + + static int ftrace_modify_code(unsigned long pc, unsigned long old, +@@ -137,14 +138,14 @@ int ftrace_update_ftrace_func(ftrace_func_t func) + int ret; + + pc = (unsigned long)&ftrace_call; +- new = ftrace_call_replace(pc, (unsigned long)func); ++ new = ftrace_call_replace(pc, (unsigned long)func, true); + + ret = ftrace_modify_code(pc, 0, new, false); + + #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS + if (!ret) { + pc = (unsigned long)&ftrace_regs_call; +- new = ftrace_call_replace(pc, (unsigned long)func); ++ new = ftrace_call_replace(pc, (unsigned long)func, true); + + ret = ftrace_modify_code(pc, 0, new, false); + } +@@ -153,7 +154,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func) + #ifdef CONFIG_OLD_MCOUNT + if (!ret) { + pc = (unsigned long)&ftrace_call_old; +- new = ftrace_call_replace(pc, (unsigned long)func); ++ new = ftrace_call_replace(pc, (unsigned long)func, true); + + ret = ftrace_modify_code(pc, 0, new, false); + } +@@ -166,10 +167,22 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + { + unsigned long new, old; + unsigned long ip = rec->ip; ++ unsigned long aaddr = adjust_address(rec, addr); ++ struct module *mod = NULL; ++ ++#ifdef CONFIG_ARM_MODULE_PLTS ++ mod = rec->arch.mod; ++#endif + + old = ftrace_nop_replace(rec); + +- new = ftrace_call_replace(ip, adjust_address(rec, addr)); ++ new = ftrace_call_replace(ip, aaddr, !mod); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ if (!new && mod) { ++ aaddr = get_module_plt(mod, ip, aaddr); ++ new = ftrace_call_replace(ip, aaddr, true); ++ } ++#endif + + return ftrace_modify_code(rec->ip, old, new, true); + } +@@ -182,9 +195,9 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + unsigned long new, old; + unsigned long ip = rec->ip; + +- old = ftrace_call_replace(ip, adjust_address(rec, old_addr)); ++ old = ftrace_call_replace(ip, adjust_address(rec, old_addr), true); + +- new = ftrace_call_replace(ip, adjust_address(rec, addr)); ++ new = ftrace_call_replace(ip, adjust_address(rec, addr), true); + + return ftrace_modify_code(rec->ip, old, new, true); + } +@@ -194,12 +207,29 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + int ftrace_make_nop(struct module *mod, + struct dyn_ftrace *rec, unsigned long addr) + { ++ unsigned long aaddr = adjust_address(rec, addr); + unsigned long ip = rec->ip; + unsigned long old; + unsigned long new; + int ret; + +- old = ftrace_call_replace(ip, adjust_address(rec, addr)); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ /* mod is only supplied during module loading */ ++ if (!mod) ++ mod = rec->arch.mod; ++ else ++ rec->arch.mod = mod; ++#endif ++ ++ old = ftrace_call_replace(ip, aaddr, ++ !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ if (!old && mod) { ++ aaddr = get_module_plt(mod, ip, aaddr); ++ old = ftrace_call_replace(ip, aaddr, true); ++ } ++#endif ++ + new = ftrace_nop_replace(rec); + ret = ftrace_modify_code(ip, old, new, true); + +@@ -207,7 +237,7 @@ int ftrace_make_nop(struct module *mod, + if (ret == -EINVAL && addr == MCOUNT_ADDR) { + rec->arch.old_mcount = true; + +- old = ftrace_call_replace(ip, adjust_address(rec, addr)); ++ old = ftrace_call_replace(ip, adjust_address(rec, addr), true); + new = ftrace_nop_replace(rec); + ret = ftrace_modify_code(ip, old, new, true); + } +diff --git a/arch/arm/kernel/insn.c b/arch/arm/kernel/insn.c +index 2e844b70386b3..db0acbb7d7a02 100644 +--- a/arch/arm/kernel/insn.c ++++ b/arch/arm/kernel/insn.c +@@ -3,8 +3,9 @@ + #include <linux/kernel.h> + #include <asm/opcodes.h> + +-static unsigned long +-__arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) ++static unsigned long __arm_gen_branch_thumb2(unsigned long pc, ++ unsigned long addr, bool link, ++ bool warn) + { + unsigned long s, j1, j2, i1, i2, imm10, imm11; + unsigned long first, second; +@@ -12,7 +13,7 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) + + offset = (long)addr - (long)(pc + 4); + if (offset < -16777216 || offset > 16777214) { +- WARN_ON_ONCE(1); ++ WARN_ON_ONCE(warn); + return 0; + } + +@@ -33,8 +34,8 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) + return __opcode_thumb32_compose(first, second); + } + +-static unsigned long +-__arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) ++static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr, ++ bool link, bool warn) + { + unsigned long opcode = 0xea000000; + long offset; +@@ -44,7 +45,7 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) + + offset = (long)addr - (long)(pc + 8); + if (unlikely(offset < -33554432 || offset > 33554428)) { +- WARN_ON_ONCE(1); ++ WARN_ON_ONCE(warn); + return 0; + } + +@@ -54,10 +55,10 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) + } + + unsigned long +-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link) ++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn) + { + if (IS_ENABLED(CONFIG_THUMB2_KERNEL)) +- return __arm_gen_branch_thumb2(pc, addr, link); ++ return __arm_gen_branch_thumb2(pc, addr, link, warn); + else +- return __arm_gen_branch_arm(pc, addr, link); ++ return __arm_gen_branch_arm(pc, addr, link, warn); + } +diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c +index 3d0c2e4dda1d2..ed0e09cc735f0 100644 +--- a/arch/arm/kernel/module-plts.c ++++ b/arch/arm/kernel/module-plts.c +@@ -7,6 +7,7 @@ + */ + + #include <linux/elf.h> ++#include <linux/ftrace.h> + #include <linux/kernel.h> + #include <linux/module.h> + #include <linux/sort.h> +@@ -14,10 +15,6 @@ + #include <asm/cache.h> + #include <asm/opcodes.h> + +-#define PLT_ENT_STRIDE L1_CACHE_BYTES +-#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) +-#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) +- + #ifdef CONFIG_THUMB2_KERNEL + #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \ + (PLT_ENT_STRIDE - 4)) +@@ -26,9 +23,11 @@ + (PLT_ENT_STRIDE - 8)) + #endif + +-struct plt_entries { +- u32 ldr[PLT_ENT_COUNT]; +- u32 lit[PLT_ENT_COUNT]; ++static const u32 fixed_plts[] = { ++#ifdef CONFIG_DYNAMIC_FTRACE ++ FTRACE_ADDR, ++ MCOUNT_ADDR, ++#endif + }; + + static bool in_init(const struct module *mod, unsigned long loc) +@@ -36,14 +35,40 @@ static bool in_init(const struct module *mod, unsigned long loc) + return loc - (u32)mod->init_layout.base < mod->init_layout.size; + } + ++static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt) ++{ ++ int i; ++ ++ if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count) ++ return; ++ pltsec->plt_count = ARRAY_SIZE(fixed_plts); ++ ++ for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i) ++ plt->ldr[i] = PLT_ENT_LDR; ++ ++ BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit)); ++ memcpy(plt->lit, fixed_plts, sizeof(fixed_plts)); ++} ++ + u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val) + { + struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core : + &mod->arch.init; ++ struct plt_entries *plt; ++ int idx; ++ ++ /* cache the address, ELF header is available only during module load */ ++ if (!pltsec->plt_ent) ++ pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr; ++ plt = pltsec->plt_ent; + +- struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr; +- int idx = 0; ++ prealloc_fixed(pltsec, plt); ++ ++ for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx) ++ if (plt->lit[idx] == val) ++ return (u32)&plt->ldr[idx]; + ++ idx = 0; + /* + * Look for an existing entry pointing to 'val'. Given that the + * relocations are sorted, this will be the last entry we allocated. +@@ -191,8 +216,8 @@ static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base, + int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + char *secstrings, struct module *mod) + { +- unsigned long core_plts = 0; +- unsigned long init_plts = 0; ++ unsigned long core_plts = ARRAY_SIZE(fixed_plts); ++ unsigned long init_plts = ARRAY_SIZE(fixed_plts); + Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum; + Elf32_Sym *syms = NULL; + +@@ -247,6 +272,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE, + sizeof(struct plt_entries)); + mod->arch.core.plt_count = 0; ++ mod->arch.core.plt_ent = NULL; + + mod->arch.init.plt->sh_type = SHT_NOBITS; + mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC; +@@ -254,6 +280,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE, + sizeof(struct plt_entries)); + mod->arch.init.plt_count = 0; ++ mod->arch.init.plt_ent = NULL; + + pr_debug("%s: plt=%x, init.plt=%x\n", __func__, + mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size); +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index 1844fb8605f03..fca78eb334b19 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -376,8 +376,15 @@ + #interrupt-cells = <1>; + msi-parent = <&pcie0>; + msi-controller; +- ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */ +- 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/ ++ /* ++ * The 128 MiB address range [0xe8000000-0xf0000000] is ++ * dedicated for PCIe and can be assigned to 8 windows ++ * with size a power of two. Use one 64 KiB window for ++ * IO at the end and the remaining seven windows ++ * (totaling 127 MiB) for MEM. ++ */ ++ ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */ ++ 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc 0>, + <0 0 0 2 &pcie_intc 1>, +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index d6a49bb07a5f5..1945b8096a06a 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -61,7 +61,7 @@ + + #ifdef CONFIG_STACKPROTECTOR + #include <linux/stackprotector.h> +-unsigned long __stack_chk_guard __read_mostly; ++unsigned long __stack_chk_guard __ro_after_init; + EXPORT_SYMBOL(__stack_chk_guard); + #endif + +diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h +index 85761255dde5a..6a03aef53980b 100644 +--- a/arch/m68k/include/asm/raw_io.h ++++ b/arch/m68k/include/asm/raw_io.h +@@ -17,21 +17,21 @@ + * two accesses to memory, which may be undesirable for some devices. + */ + #define in_8(addr) \ +- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; }) ++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; }) + #define in_be16(addr) \ +- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; }) ++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; }) + #define in_be32(addr) \ +- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; }) ++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; }) + #define in_le16(addr) \ +- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; }) ++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; }) + #define in_le32(addr) \ +- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; }) ++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; }) + +-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b)) +-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w)) +-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l)) +-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w)) +-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l)) ++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b)) ++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w)) ++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l)) ++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w)) ++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l)) + + #define raw_inb in_8 + #define raw_inw in_be16 +diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h +index af00fe9bf8465..c631a8fd856a3 100644 +--- a/arch/parisc/include/asm/page.h ++++ b/arch/parisc/include/asm/page.h +@@ -179,7 +179,7 @@ extern int npmem_ranges; + #include <asm-generic/getorder.h> + #include <asm/pdc.h> + +-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET) ++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET)) + + /* DEFINITION OF THE ZERO-PAGE (PAG0) */ + /* based on work by Jason Eckhardt (ja...@equator.com) */ +diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c +index 51028abe5e903..ecec6a616e0d7 100644 +--- a/arch/sparc/kernel/mdesc.c ++++ b/arch/sparc/kernel/mdesc.c +@@ -40,6 +40,7 @@ struct mdesc_hdr { + u32 node_sz; /* node block size */ + u32 name_sz; /* name block size */ + u32 data_sz; /* data block size */ ++ char data[]; + } __attribute__((aligned(16))); + + struct mdesc_elem { +@@ -613,7 +614,7 @@ EXPORT_SYMBOL(mdesc_get_node_info); + + static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc) + { +- return (struct mdesc_elem *) (mdesc + 1); ++ return (struct mdesc_elem *) mdesc->data; + } + + static void *name_block(struct mdesc_hdr *mdesc) +diff --git a/arch/x86/include/asm/kvmclock.h b/arch/x86/include/asm/kvmclock.h +index eceea92990974..6c57651921028 100644 +--- a/arch/x86/include/asm/kvmclock.h ++++ b/arch/x86/include/asm/kvmclock.h +@@ -2,6 +2,20 @@ + #ifndef _ASM_X86_KVM_CLOCK_H + #define _ASM_X86_KVM_CLOCK_H + ++#include <linux/percpu.h> ++ + extern struct clocksource kvm_clock; + ++DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); ++ ++static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void) ++{ ++ return &this_cpu_read(hv_clock_per_cpu)->pvti; ++} ++ ++static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void) ++{ ++ return this_cpu_read(hv_clock_per_cpu); ++} ++ + #endif /* _ASM_X86_KVM_CLOCK_H */ +diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c +index 2ec202cb9dfd4..6752d3768d778 100644 +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -64,18 +64,9 @@ early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); + static struct pvclock_vsyscall_time_info + hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE); + static struct pvclock_wall_clock wall_clock __bss_decrypted; +-static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); + static struct pvclock_vsyscall_time_info *hvclock_mem; +- +-static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void) +-{ +- return &this_cpu_read(hv_clock_per_cpu)->pvti; +-} +- +-static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void) +-{ +- return this_cpu_read(hv_clock_per_cpu); +-} ++DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); ++EXPORT_PER_CPU_SYMBOL_GPL(hv_clock_per_cpu); + + /* + * The wallclock is the time of day when we booted. Since then, some time may +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 7966136352b56..8f1ff8dad2cec 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -720,8 +720,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g) + preempt_enable(); + } + +-static void xen_convert_trap_info(const struct desc_ptr *desc, +- struct trap_info *traps) ++static unsigned xen_convert_trap_info(const struct desc_ptr *desc, ++ struct trap_info *traps, bool full) + { + unsigned in, out, count; + +@@ -731,17 +731,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc, + for (in = out = 0; in < count; in++) { + gate_desc *entry = (gate_desc *)(desc->address) + in; + +- if (cvt_gate_to_trap(in, entry, &traps[out])) ++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full) + out++; + } +- traps[out].address = 0; ++ ++ return out; + } + + void xen_copy_trap_info(struct trap_info *traps) + { + const struct desc_ptr *desc = this_cpu_ptr(&idt_desc); + +- xen_convert_trap_info(desc, traps); ++ xen_convert_trap_info(desc, traps, true); + } + + /* Load a new IDT into Xen. In principle this can be per-CPU, so we +@@ -751,6 +752,7 @@ static void xen_load_idt(const struct desc_ptr *desc) + { + static DEFINE_SPINLOCK(lock); + static struct trap_info traps[257]; ++ unsigned out; + + trace_xen_cpu_load_idt(desc); + +@@ -758,7 +760,8 @@ static void xen_load_idt(const struct desc_ptr *desc) + + memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc)); + +- xen_convert_trap_info(desc, traps); ++ out = xen_convert_trap_info(desc, traps, false); ++ memset(&traps[out], 0, sizeof(traps[0])); + + xen_mc_flush(); + if (HYPERVISOR_set_trap_table(traps)) +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index c8c94e8e0f721..b2bad345c523f 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2137,15 +2137,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) + * are likely to increase the throughput. + */ + bfqq->new_bfqq = new_bfqq; +- /* +- * The above assignment schedules the following redirections: +- * each time some I/O for bfqq arrives, the process that +- * generated that I/O is disassociated from bfqq and +- * associated with new_bfqq. Here we increases new_bfqq->ref +- * in advance, adding the number of processes that are +- * expected to be associated with new_bfqq as they happen to +- * issue I/O. +- */ + new_bfqq->ref += process_refs; + return new_bfqq; + } +@@ -2205,10 +2196,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_queue *in_service_bfqq, *new_bfqq; + +- /* if a merge has already been setup, then proceed with that first */ +- if (bfqq->new_bfqq) +- return bfqq->new_bfqq; +- + /* + * Prevent bfqq from being merged if it has been created too + * long ago. The idea is that true cooperating processes, and +@@ -2223,6 +2210,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (bfq_too_late_for_merging(bfqq)) + return NULL; + ++ if (bfqq->new_bfqq) ++ return bfqq->new_bfqq; ++ + if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) + return NULL; + +diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c +index 52841f807a7eb..45fdf30cade39 100644 +--- a/drivers/cpufreq/cpufreq_governor_attr_set.c ++++ b/drivers/cpufreq/cpufreq_governor_attr_set.c +@@ -77,8 +77,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l + if (count) + return count; + +- kobject_put(&attr_set->kobj); + mutex_destroy(&attr_set->update_lock); ++ kobject_put(&attr_set->kobj); + return 0; + } + EXPORT_SYMBOL_GPL(gov_attr_set_put); +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 20ca9c9e109e0..453d27d2a4ffa 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -783,7 +783,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + in_place ? DMA_BIDIRECTIONAL + : DMA_TO_DEVICE); + if (ret) +- goto e_ctx; ++ goto e_aad; + + if (in_place) { + dst = src; +@@ -868,7 +868,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + op.u.aes.size = 0; + ret = cmd_q->ccp->vdata->perform->aes(&op); + if (ret) +- goto e_dst; ++ goto e_final_wa; + + if (aes->action == CCP_AES_ACTION_ENCRYPT) { + /* Put the ciphered tag after the ciphertext. */ +@@ -878,17 +878,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + ret = ccp_init_dm_workarea(&tag, cmd_q, authsize, + DMA_BIDIRECTIONAL); + if (ret) +- goto e_tag; ++ goto e_final_wa; + ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize); +- if (ret) +- goto e_tag; ++ if (ret) { ++ ccp_dm_free(&tag); ++ goto e_final_wa; ++ } + + ret = crypto_memneq(tag.address, final_wa.address, + authsize) ? -EBADMSG : 0; + ccp_dm_free(&tag); + } + +-e_tag: ++e_final_wa: + ccp_dm_free(&final_wa); + + e_dst: +diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c +index 0c9c59e2b5a3f..ba9de54a701e2 100644 +--- a/drivers/edac/synopsys_edac.c ++++ b/drivers/edac/synopsys_edac.c +@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci) + + for (j = 0; j < csi->nr_channels; j++) { + dimm = csi->channels[j]->dimm; +- dimm->edac_mode = EDAC_FLAG_SECDED; ++ dimm->edac_mode = EDAC_SECDED; + dimm->mtype = synps_edac_get_mtype(priv->baseaddr); + dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels; + dimm->grain = SYNPS_EDAC_ERR_GRAIN; +diff --git a/drivers/fpga/machxo2-spi.c b/drivers/fpga/machxo2-spi.c +index a582e0000c97a..fa76239f979be 100644 +--- a/drivers/fpga/machxo2-spi.c ++++ b/drivers/fpga/machxo2-spi.c +@@ -223,8 +223,10 @@ static int machxo2_write_init(struct fpga_manager *mgr, + goto fail; + + get_status(spi, &status); +- if (test_bit(FAIL, &status)) ++ if (test_bit(FAIL, &status)) { ++ ret = -EINVAL; + goto fail; ++ } + dump_status_reg(&status); + + spi_message_init(&msg); +@@ -310,6 +312,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr, + dump_status_reg(&status); + if (!test_bit(DONE, &status)) { + machxo2_cleanup(mgr); ++ ret = -EINVAL; + goto fail; + } + +@@ -331,6 +334,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr, + break; + if (++refreshloop == MACHXO2_MAX_REFRESH_LOOP) { + machxo2_cleanup(mgr); ++ ret = -EINVAL; + goto fail; + } + } while (1); +diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c +index 7fdac90609798..c72ec3ddf90b7 100644 +--- a/drivers/gpio/gpio-uniphier.c ++++ b/drivers/gpio/gpio-uniphier.c +@@ -197,7 +197,7 @@ static void uniphier_gpio_irq_mask(struct irq_data *data) + + uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, 0); + +- return irq_chip_mask_parent(data); ++ irq_chip_mask_parent(data); + } + + static void uniphier_gpio_irq_unmask(struct irq_data *data) +@@ -207,7 +207,7 @@ static void uniphier_gpio_irq_unmask(struct irq_data *data) + + uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, mask); + +- return irq_chip_unmask_parent(data); ++ irq_chip_unmask_parent(data); + } + + static int uniphier_gpio_irq_set_type(struct irq_data *data, unsigned int type) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 62a2f0491117d..ed02bb6b2cd07 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -412,6 +412,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + + init_data.asic_id.pci_revision_id = adev->rev_id; + init_data.asic_id.hw_internal_rev = adev->external_rev_id; ++ init_data.asic_id.chip_id = adev->pdev->device; + + init_data.asic_id.vram_width = adev->gmc.vram_width; + /* TODO: initialize init_data.asic_id.vram_type here!!!! */ +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c +index 69cfc8dc6af1e..9b60efe6ec441 100644 +--- a/drivers/hid/hid-betopff.c ++++ b/drivers/hid/hid-betopff.c +@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid) + { + struct betopff_device *betopff; + struct hid_report *report; +- struct hid_input *hidinput = +- list_first_entry(&hid->inputs, struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int field_count = 0; + int error; + int i, j; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index 6b6db57b49d69..e28227040c64c 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -506,7 +506,7 @@ static void hid_ctrl(struct urb *urb) + + if (unplug) { + usbhid->ctrltail = usbhid->ctrlhead; +- } else { ++ } else if (usbhid->ctrlhead != usbhid->ctrltail) { + usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1); + + if (usbhid->ctrlhead != usbhid->ctrltail && +@@ -1224,9 +1224,20 @@ static void usbhid_stop(struct hid_device *hid) + mutex_lock(&usbhid->mutex); + + clear_bit(HID_STARTED, &usbhid->iofl); ++ + spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ + set_bit(HID_DISCONNECTED, &usbhid->iofl); ++ while (usbhid->ctrltail != usbhid->ctrlhead) { ++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) { ++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report); ++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL; ++ } ++ ++ usbhid->ctrltail = (usbhid->ctrltail + 1) & ++ (HID_CONTROL_FIFO_SIZE - 1); ++ } + spin_unlock_irq(&usbhid->lock); ++ + usb_kill_urb(usbhid->urbin); + usb_kill_urb(usbhid->urbout); + usb_kill_urb(usbhid->urbctrl); +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index d8fa4bea4bc84..e57b0c5119ce4 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -307,8 +307,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + { + struct mlxreg_fan *fan = cdev->devdata; + unsigned long cur_state; ++ int i, config = 0; + u32 regval; +- int i; + int err; + + /* +@@ -321,6 +321,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + * overwritten. + */ + if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) { ++ /* ++ * This is configuration change, which is only supported through sysfs. ++ * For configuration non-zero value is to be returned to avoid thermal ++ * statistics update. ++ */ ++ config = 1; + state -= MLXREG_FAN_MAX_STATE; + for (i = 0; i < state; i++) + fan->cooling_levels[i] = state; +@@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + + cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval); + if (state < cur_state) +- return 0; ++ return config; + + state = cur_state; + } +@@ -351,7 +357,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + dev_err(fan->dev, "Failed to write PWM duty\n"); + return err; + } +- return 0; ++ return config; + } + + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { +diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c +index ceb3db6f3fdda..cdd01a8483011 100644 +--- a/drivers/hwmon/tmp421.c ++++ b/drivers/hwmon/tmp421.c +@@ -109,23 +109,17 @@ struct tmp421_data { + s16 temp[4]; + }; + +-static int temp_from_s16(s16 reg) ++static int temp_from_raw(u16 reg, bool extended) + { + /* Mask out status bits */ + int temp = reg & ~0xf; + +- return (temp * 1000 + 128) / 256; +-} +- +-static int temp_from_u16(u16 reg) +-{ +- /* Mask out status bits */ +- int temp = reg & ~0xf; +- +- /* Add offset for extended temperature range. */ +- temp -= 64 * 256; ++ if (extended) ++ temp = temp - 64 * 256; ++ else ++ temp = (s16)temp; + +- return (temp * 1000 + 128) / 256; ++ return DIV_ROUND_CLOSEST(temp * 1000, 256); + } + + static struct tmp421_data *tmp421_update_device(struct device *dev) +@@ -162,17 +156,15 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type, + + switch (attr) { + case hwmon_temp_input: +- if (tmp421->config & TMP421_CONFIG_RANGE) +- *val = temp_from_u16(tmp421->temp[channel]); +- else +- *val = temp_from_s16(tmp421->temp[channel]); ++ *val = temp_from_raw(tmp421->temp[channel], ++ tmp421->config & TMP421_CONFIG_RANGE); + return 0; + case hwmon_temp_fault: + /* +- * The OPEN bit signals a fault. This is bit 0 of the temperature +- * register (low byte). ++ * Any of OPEN or /PVLD bits indicate a hardware mulfunction ++ * and the conversion result may be incorrect + */ +- *val = tmp421->temp[channel] & 0x01; ++ *val = !!(tmp421->temp[channel] & 0x03); + return 0; + default: + return -EOPNOTSUPP; +@@ -185,11 +177,8 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type, + { + switch (attr) { + case hwmon_temp_fault: +- if (channel == 0) +- return 0; +- return S_IRUGO; + case hwmon_temp_input: +- return S_IRUGO; ++ return 0444; + default: + return 0; + } +diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c +index 75dd15d66df6f..f558aeb8f8884 100644 +--- a/drivers/ipack/devices/ipoctal.c ++++ b/drivers/ipack/devices/ipoctal.c +@@ -38,6 +38,7 @@ struct ipoctal_channel { + unsigned int pointer_read; + unsigned int pointer_write; + struct tty_port tty_port; ++ bool tty_registered; + union scc2698_channel __iomem *regs; + union scc2698_block __iomem *block_regs; + unsigned int board_id; +@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) + return 0; + } + +-static int ipoctal_open(struct tty_struct *tty, struct file *file) ++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) + { + struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); + struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); +- int err; +- +- tty->driver_data = channel; ++ int res; + + if (!ipack_get_carrier(ipoctal->dev)) + return -EBUSY; + +- err = tty_port_open(&channel->tty_port, tty, file); +- if (err) +- ipack_put_carrier(ipoctal->dev); ++ res = tty_standard_install(driver, tty); ++ if (res) ++ goto err_put_carrier; ++ ++ tty->driver_data = channel; ++ ++ return 0; ++ ++err_put_carrier: ++ ipack_put_carrier(ipoctal->dev); ++ ++ return res; ++} ++ ++static int ipoctal_open(struct tty_struct *tty, struct file *file) ++{ ++ struct ipoctal_channel *channel = tty->driver_data; + +- return err; ++ return tty_port_open(&channel->tty_port, tty, file); + } + + static void ipoctal_reset_stats(struct ipoctal_stats *stats) +@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + int res; + int i; + struct tty_driver *tty; +- char name[20]; + struct ipoctal_channel *channel; + struct ipack_region *region; + void __iomem *addr; +@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + /* Fill struct tty_driver with ipoctal data */ + tty->owner = THIS_MODULE; + tty->driver_name = KBUILD_MODNAME; +- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); +- tty->name = name; ++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); ++ if (!tty->name) { ++ res = -ENOMEM; ++ goto err_put_driver; ++ } + tty->major = 0; + + tty->minor_start = 0; +@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + res = tty_register_driver(tty); + if (res) { + dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n"); +- put_tty_driver(tty); +- return res; ++ goto err_free_name; + } + + /* Save struct tty_driver for use it when uninstalling the device */ +@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + + channel = &ipoctal->channel[i]; + tty_port_init(&channel->tty_port); +- tty_port_alloc_xmit_buf(&channel->tty_port); ++ res = tty_port_alloc_xmit_buf(&channel->tty_port); ++ if (res) ++ continue; + channel->tty_port.ops = &ipoctal_tty_port_ops; + + ipoctal_reset_stats(&channel->stats); +@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + spin_lock_init(&channel->lock); + channel->pointer_read = 0; + channel->pointer_write = 0; +- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL); ++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty, ++ i, NULL, channel, NULL); + if (IS_ERR(tty_dev)) { + dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n"); ++ tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + continue; + } +- dev_set_drvdata(tty_dev, channel); ++ channel->tty_registered = true; + } + + /* +@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + ipoctal_irq_handler, ipoctal); + + return 0; ++ ++err_free_name: ++ kfree(tty->name); ++err_put_driver: ++ put_tty_driver(tty); ++ ++ return res; + } + + static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel, +@@ -655,6 +680,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) + + static const struct tty_operations ipoctal_fops = { + .ioctl = NULL, ++ .install = ipoctal_install, + .open = ipoctal_open, + .close = ipoctal_close, + .write = ipoctal_write_tty, +@@ -697,12 +723,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal) + + for (i = 0; i < NR_CHANNELS; i++) { + struct ipoctal_channel *channel = &ipoctal->channel[i]; ++ ++ if (!channel->tty_registered) ++ continue; ++ + tty_unregister_device(ipoctal->tty_drv, i); + tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + } + + tty_unregister_driver(ipoctal->tty_drv); ++ kfree(ipoctal->tty_drv->name); + put_tty_driver(ipoctal->tty_drv); + kfree(ipoctal); + } +diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig +index 8cb6800dbdfb7..9d3812cd668eb 100644 +--- a/drivers/irqchip/Kconfig ++++ b/drivers/irqchip/Kconfig +@@ -357,6 +357,7 @@ config MESON_IRQ_GPIO + config GOLDFISH_PIC + bool "Goldfish programmable interrupt controller" + depends on MIPS && (GOLDFISH || COMPILE_TEST) ++ select GENERIC_IRQ_CHIP + select IRQ_DOMAIN + help + Say yes here to enable Goldfish interrupt controller driver used +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index cd58c123f547e..b55dff1aa50b3 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2996,7 +2996,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq + + if (err) { + if (i > 0) +- its_vpe_irq_domain_free(domain, virq, i - 1); ++ its_vpe_irq_domain_free(domain, virq, i); + + its_lpi_free(bitmap, base, nr_ids); + its_free_prop_table(vprop_page); +diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c +index bb5c5692dedc5..118d27ee31c2f 100644 +--- a/drivers/mcb/mcb-core.c ++++ b/drivers/mcb/mcb-core.c +@@ -280,8 +280,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier) + + bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL); + if (bus_nr < 0) { +- rc = bus_nr; +- goto err_free; ++ kfree(bus); ++ return ERR_PTR(bus_nr); + } + + bus->bus_nr = bus_nr; +@@ -296,12 +296,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier) + dev_set_name(&bus->dev, "mcb:%d", bus_nr); + rc = device_add(&bus->dev); + if (rc) +- goto err_free; ++ goto err_put; + + return bus; +-err_free: +- put_device(carrier); +- kfree(bus); ++ ++err_put: ++ put_device(&bus->dev); + return ERR_PTR(rc); + } + EXPORT_SYMBOL_GPL(mcb_alloc_bus); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index fae6a983ceee1..7e0477e883c7b 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5401,10 +5401,6 @@ static int md_alloc(dev_t dev, char *name) + */ + disk->flags |= GENHD_FL_EXT_DEVT; + mddev->gendisk = disk; +- /* As soon as we call add_disk(), another thread could get +- * through to md_open, so make sure it doesn't get too far +- */ +- mutex_lock(&mddev->open_mutex); + add_disk(disk); + + error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md"); +@@ -5419,7 +5415,6 @@ static int md_alloc(dev_t dev, char *name) + if (mddev->kobj.sd && + sysfs_create_group(&mddev->kobj, &md_bitmap_group)) + pr_debug("pointless warning\n"); +- mutex_unlock(&mddev->open_mutex); + abort: + mutex_unlock(&disks_mutex); + if (!error && mddev->kobj.sd) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 55827ac65a154..5e30299bcf646 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -294,7 +294,7 @@ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, + * netif_tx_queue_stopped(). + */ + smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ if (bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh) { + netif_tx_wake_queue(txq); + return false; + } +@@ -625,7 +625,7 @@ next_tx_int: + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh && + READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) + netif_tx_wake_queue(txq); + } +@@ -1909,7 +1909,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { + tx_pkts++; + /* return full budget so NAPI will complete. */ +- if (unlikely(tx_pkts > bp->tx_wake_thresh)) { ++ if (unlikely(tx_pkts >= bp->tx_wake_thresh)) { + rx_pkts = budget; + raw_cons = NEXT_RAW_CMP(raw_cons); + break; +@@ -2712,7 +2712,7 @@ static int bnxt_init_tx_rings(struct bnxt *bp) + u16 i; + + bp->tx_wake_thresh = max_t(int, bp->tx_ring_size / 2, +- MAX_SKB_FRAGS + 1); ++ BNXT_MIN_TX_DESC_CNT); + + for (i = 0; i < bp->tx_nr_rings; i++) { + struct bnxt_tx_ring_info *txr = &bp->tx_ring[i]; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index f3f5484c43e4a..5c1c3a0ed9285 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -484,6 +484,11 @@ struct rx_tpa_end_cmp_ext { + #define BNXT_MAX_RX_JUM_DESC_CNT (RX_DESC_CNT * MAX_RX_AGG_PAGES - 1) + #define BNXT_MAX_TX_DESC_CNT (TX_DESC_CNT * MAX_TX_PAGES - 1) + ++/* Minimum TX BDs for a TX packet with MAX_SKB_FRAGS + 1. We need one extra ++ * BD because the first TX BD is always a long BD. ++ */ ++#define BNXT_MIN_TX_DESC_CNT (MAX_SKB_FRAGS + 2) ++ + #define RX_RING(x) (((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4)) + #define RX_IDX(x) ((x) & (RX_DESC_CNT - 1)) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 511240e8246f0..e75a47a9f5119 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -446,7 +446,7 @@ static int bnxt_set_ringparam(struct net_device *dev, + + if ((ering->rx_pending > BNXT_MAX_RX_DESC_CNT) || + (ering->tx_pending > BNXT_MAX_TX_DESC_CNT) || +- (ering->tx_pending <= MAX_SKB_FRAGS)) ++ (ering->tx_pending < BNXT_MIN_TX_DESC_CNT)) + return -EINVAL; + + if (netif_running(dev)) +diff --git a/drivers/net/ethernet/cadence/macb_pci.c b/drivers/net/ethernet/cadence/macb_pci.c +index 248a8fc450691..f06fddf9919bf 100644 +--- a/drivers/net/ethernet/cadence/macb_pci.c ++++ b/drivers/net/ethernet/cadence/macb_pci.c +@@ -123,9 +123,9 @@ static void macb_remove(struct pci_dev *pdev) + struct platform_device *plat_dev = pci_get_drvdata(pdev); + struct macb_platform_data *plat_data = dev_get_platdata(&plat_dev->dev); + +- platform_device_unregister(plat_dev); + clk_unregister(plat_data->pclk); + clk_unregister(plat_data->hclk); ++ platform_device_unregister(plat_dev); + } + + static const struct pci_device_id dev_id_table[] = { +diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c +index d719668a6684a..8efcec305fc54 100644 +--- a/drivers/net/ethernet/i825xx/82596.c ++++ b/drivers/net/ethernet/i825xx/82596.c +@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit) + err = -ENODEV; + goto out; + } +- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */ ++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */ + dev->base_addr = MVME_I596_BASE; + dev->irq = (unsigned) MVME16x_IRQ_I596; + goto found; +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index bf64fab383851..ba5b515c86e25 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -2433,11 +2433,15 @@ static void e100_get_drvinfo(struct net_device *netdev, + sizeof(info->bus_info)); + } + +-#define E100_PHY_REGS 0x1C ++#define E100_PHY_REGS 0x1D + static int e100_get_regs_len(struct net_device *netdev) + { + struct nic *nic = netdev_priv(netdev); +- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf); ++ ++ /* We know the number of registers, and the size of the dump buffer. ++ * Calculate the total size in bytes. ++ */ ++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf); + } + + static void e100_get_regs(struct net_device *netdev, +@@ -2451,14 +2455,18 @@ static void e100_get_regs(struct net_device *netdev, + buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 | + ioread8(&nic->csr->scb.cmd_lo) << 16 | + ioread16(&nic->csr->scb.status); +- for (i = E100_PHY_REGS; i >= 0; i--) +- buff[1 + E100_PHY_REGS - i] = +- mdio_read(netdev, nic->mii.phy_id, i); ++ for (i = 0; i < E100_PHY_REGS; i++) ++ /* Note that we read the registers in reverse order. This ++ * ordering is the ABI apparently used by ethtool and other ++ * applications. ++ */ ++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id, ++ E100_PHY_REGS - 1 - i); + memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf)); + e100_exec_cb(nic, NULL, e100_dump); + msleep(10); +- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf, +- sizeof(nic->mem->dump_buf)); ++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf, ++ sizeof(nic->mem->dump_buf)); + } + + static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol) +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index f3a0617733d8f..943bd189e895e 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -372,6 +372,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb, + int nhoff = skb_network_offset(skb); + int ret = 0; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + if (skb->protocol != htons(ETH_P_IP)) + return -EPROTONOSUPPORT; + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index af59761ddfa07..064e13bd2c8b5 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -227,7 +227,7 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv) + priv->clk_csr = STMMAC_CSR_100_150M; + else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M)) + priv->clk_csr = STMMAC_CSR_150_250M; +- else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M)) ++ else if ((clk_rate >= CSR_F_250M) && (clk_rate <= CSR_F_300M)) + priv->clk_csr = STMMAC_CSR_250_300M; + } + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 1001e9a2edd4f..af776d7be7806 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -68,9 +68,9 @@ + #define SIXP_DAMA_OFF 0 + + /* default level 2 parameters */ +-#define SIXP_TXDELAY (HZ/4) /* in 1 s */ ++#define SIXP_TXDELAY 25 /* 250 ms */ + #define SIXP_PERSIST 50 /* in 256ths */ +-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */ ++#define SIXP_SLOTTIME 10 /* 100 ms */ + #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */ + #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */ + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index a66077f514572..77a7a7ddb6310 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2511,7 +2511,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + hso_net_init); + if (!net) { + dev_err(&interface->dev, "Unable to create ethernet device\n"); +- goto exit; ++ goto err_hso_dev; + } + + hso_net = netdev_priv(net); +@@ -2524,13 +2524,13 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + USB_DIR_IN); + if (!hso_net->in_endp) { + dev_err(&interface->dev, "Can't find BULK IN endpoint\n"); +- goto exit; ++ goto err_net; + } + hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, + USB_DIR_OUT); + if (!hso_net->out_endp) { + dev_err(&interface->dev, "Can't find BULK OUT endpoint\n"); +- goto exit; ++ goto err_net; + } + SET_NETDEV_DEV(net, &interface->dev); + SET_NETDEV_DEVTYPE(net, &hso_type); +@@ -2539,18 +2539,18 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { + hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_rx_urb_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE, + GFP_KERNEL); + if (!hso_net->mux_bulk_rx_buf_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_urb) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_buf) +- goto exit; ++ goto err_free_tx_urb; + + add_net_device(hso_dev); + +@@ -2558,7 +2558,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + result = register_netdev(net); + if (result) { + dev_err(&interface->dev, "Failed to register device\n"); +- goto exit; ++ goto err_free_tx_buf; + } + + hso_log_port(hso_dev); +@@ -2566,8 +2566,21 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + hso_create_rfkill(hso_dev, interface); + + return hso_dev; +-exit: +- hso_free_net_device(hso_dev); ++ ++err_free_tx_buf: ++ remove_net_device(hso_dev); ++ kfree(hso_net->mux_bulk_tx_buf); ++err_free_tx_urb: ++ usb_free_urb(hso_net->mux_bulk_tx_urb); ++err_mux_bulk_rx: ++ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { ++ usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]); ++ kfree(hso_net->mux_bulk_rx_buf_pool[i]); ++ } ++err_net: ++ free_netdev(net); ++err_hso_dev: ++ kfree(hso_dev); + return NULL; + } + +@@ -2714,14 +2727,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, + + serial = kzalloc(sizeof(*serial), GFP_KERNEL); + if (!serial) +- goto exit; ++ goto err_free_dev; + + hso_dev->port_data.dev_serial = serial; + serial->parent = hso_dev; + + if (hso_serial_common_create + (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE)) +- goto exit; ++ goto err_free_serial; + + serial->tx_data_length--; + serial->write_data = hso_mux_serial_write_data; +@@ -2737,11 +2750,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, + /* done, return it */ + return hso_dev; + +-exit: +- if (serial) { +- tty_unregister_device(tty_drv, serial->minor); +- kfree(serial); +- } ++err_free_serial: ++ kfree(serial); ++err_free_dev: + kfree(hso_dev); + return NULL; + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 64f699a1afd72..022e03643dace 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -398,14 +398,17 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl, + + down_read(&ctrl->namespaces_rwsem); + list_for_each_entry(ns, &ctrl->namespaces, list) { +- unsigned nsid = le32_to_cpu(desc->nsids[n]); +- ++ unsigned nsid; ++again: ++ nsid = le32_to_cpu(desc->nsids[n]); + if (ns->head->ns_id < nsid) + continue; + if (ns->head->ns_id == nsid) + nvme_update_ns_ana_state(desc, ns); + if (++n == nr_nsids) + break; ++ if (ns->head->ns_id > nsid) ++ goto again; + } + up_read(&ctrl->namespaces_rwsem); + return 0; +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index a9669b28c2a6d..68afd4fa7ec9e 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -55,6 +55,7 @@ + #define PIO_COMPLETION_STATUS_CRS 2 + #define PIO_COMPLETION_STATUS_CA 4 + #define PIO_NON_POSTED_REQ BIT(10) ++#define PIO_ERR_STATUS BIT(11) + #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8) + #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc) + #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10) +@@ -330,7 +331,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) + advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG); + } + +-static void advk_pcie_check_pio_status(struct advk_pcie *pcie) ++static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val) + { + struct device *dev = &pcie->pdev->dev; + u32 reg; +@@ -341,14 +342,49 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) + status = (reg & PIO_COMPLETION_STATUS_MASK) >> + PIO_COMPLETION_STATUS_SHIFT; + +- if (!status) +- return; +- ++ /* ++ * According to HW spec, the PIO status check sequence as below: ++ * 1) even if COMPLETION_STATUS(bit9:7) indicates successful, ++ * it still needs to check Error Status(bit11), only when this bit ++ * indicates no error happen, the operation is successful. ++ * 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only ++ * means a PIO write error, and for PIO read it is successful with ++ * a read value of 0xFFFFFFFF. ++ * 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7) ++ * only means a PIO write error, and for PIO read it is successful ++ * with a read value of 0xFFFF0001. ++ * 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means ++ * error for both PIO read and PIO write operation. ++ * 5) other errors are indicated as 'unknown'. ++ */ + switch (status) { ++ case PIO_COMPLETION_STATUS_OK: ++ if (reg & PIO_ERR_STATUS) { ++ strcomp_status = "COMP_ERR"; ++ break; ++ } ++ /* Get the read result */ ++ if (val) ++ *val = advk_readl(pcie, PIO_RD_DATA); ++ /* No error */ ++ strcomp_status = NULL; ++ break; + case PIO_COMPLETION_STATUS_UR: + strcomp_status = "UR"; + break; + case PIO_COMPLETION_STATUS_CRS: ++ /* PCIe r4.0, sec 2.3.2, says: ++ * If CRS Software Visibility is not enabled, the Root Complex ++ * must re-issue the Configuration Request as a new Request. ++ * A Root Complex implementation may choose to limit the number ++ * of Configuration Request/CRS Completion Status loops before ++ * determining that something is wrong with the target of the ++ * Request and taking appropriate action, e.g., complete the ++ * Request to the host as a failed transaction. ++ * ++ * To simplify implementation do not re-issue the Configuration ++ * Request and complete the Request as a failed transaction. ++ */ + strcomp_status = "CRS"; + break; + case PIO_COMPLETION_STATUS_CA: +@@ -359,6 +395,9 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) + break; + } + ++ if (!strcomp_status) ++ return 0; ++ + if (reg & PIO_NON_POSTED_REQ) + str_posted = "Non-posted"; + else +@@ -366,6 +405,8 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) + + dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n", + str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); ++ ++ return -EFAULT; + } + + static int advk_pcie_wait_pio(struct advk_pcie *pcie) +@@ -467,10 +508,13 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + if (ret < 0) + return PCIBIOS_SET_FAILED; + +- advk_pcie_check_pio_status(pcie); ++ /* Check PIO status and get the read result */ ++ ret = advk_pcie_check_pio_status(pcie, val); ++ if (ret < 0) { ++ *val = 0xffffffff; ++ return PCIBIOS_SET_FAILED; ++ } + +- /* Get the read result */ +- *val = advk_readl(pcie, PIO_RD_DATA); + if (size == 1) + *val = (*val >> (8 * (where & 3))) & 0xff; + else if (size == 2) +@@ -530,7 +574,9 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, + if (ret < 0) + return PCIBIOS_SET_FAILED; + +- advk_pcie_check_pio_status(pcie); ++ ret = advk_pcie_check_pio_status(pcie, NULL); ++ if (ret < 0) ++ return PCIBIOS_SET_FAILED; + + return PCIBIOS_SUCCESSFUL; + } +diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c +index 1793981337dd9..b59bcd2553d15 100644 +--- a/drivers/scsi/csiostor/csio_init.c ++++ b/drivers/scsi/csiostor/csio_init.c +@@ -1263,3 +1263,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl); + MODULE_VERSION(CSIO_DRV_VERSION); + MODULE_FIRMWARE(FW_FNAME_T5); + MODULE_FIRMWARE(FW_FNAME_T6); ++MODULE_SOFTDEP("pre: cxgb4"); +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 20e69052161e6..c06e648a415b5 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -429,9 +429,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, + struct iscsi_transport *t = iface->transport; + int param = -1; + +- if (attr == &dev_attr_iface_enabled.attr) +- param = ISCSI_NET_PARAM_IFACE_ENABLE; +- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) ++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) + param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO; + else if (attr == &dev_attr_iface_header_digest.attr) + param = ISCSI_IFACE_PARAM_HDRDGST_EN; +@@ -471,7 +469,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, + if (param != -1) + return t->attr_is_visible(ISCSI_IFACE_PARAM, param); + +- if (attr == &dev_attr_iface_vlan_id.attr) ++ if (attr == &dev_attr_iface_enabled.attr) ++ param = ISCSI_NET_PARAM_IFACE_ENABLE; ++ else if (attr == &dev_attr_iface_vlan_id.attr) + param = ISCSI_NET_PARAM_VLAN_ID; + else if (attr == &dev_attr_iface_vlan_priority.attr) + param = ISCSI_NET_PARAM_VLAN_PRIORITY; +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index c6b80a60951b1..bc3097e5cc261 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1210,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev) + } + #endif + +-static int tegra_slink_runtime_suspend(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); +@@ -1222,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev) + return 0; + } + +-static int tegra_slink_runtime_resume(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); +diff --git a/drivers/staging/erofs/include/trace/events/erofs.h b/drivers/staging/erofs/include/trace/events/erofs.h +index 5aead93a762f1..852c94176d1bd 100644 +--- a/drivers/staging/erofs/include/trace/events/erofs.h ++++ b/drivers/staging/erofs/include/trace/events/erofs.h +@@ -32,20 +32,20 @@ TRACE_EVENT(erofs_lookup, + TP_STRUCT__entry( + __field(dev_t, dev ) + __field(erofs_nid_t, nid ) +- __field(const char *, name ) ++ __string(name, dentry->d_name.name ) + __field(unsigned int, flags ) + ), + + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->nid = EROFS_V(dir)->nid; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->flags = flags; + ), + + TP_printk("dev = (%d,%d), pnid = %llu, name:%s, flags:%x", + show_dev_nid(__entry), +- __entry->name, ++ __get_str(name), + __entry->flags) + ); + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index 2343914f7548a..2e9006a49587a 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -799,6 +799,17 @@ out: + gbphy_runtime_put_autosuspend(gb_tty->gbphy_dev); + } + ++static void gb_tty_port_destruct(struct tty_port *port) ++{ ++ struct gb_tty *gb_tty = container_of(port, struct gb_tty, port); ++ ++ if (gb_tty->minor != GB_NUM_MINORS) ++ release_minor(gb_tty); ++ kfifo_free(&gb_tty->write_fifo); ++ kfree(gb_tty->buffer); ++ kfree(gb_tty); ++} ++ + static const struct tty_operations gb_ops = { + .install = gb_tty_install, + .open = gb_tty_open, +@@ -822,6 +833,7 @@ static const struct tty_port_operations gb_port_ops = { + .dtr_rts = gb_tty_dtr_rts, + .activate = gb_tty_port_activate, + .shutdown = gb_tty_port_shutdown, ++ .destruct = gb_tty_port_destruct, + }; + + static int gb_uart_probe(struct gbphy_device *gbphy_dev, +@@ -834,17 +846,11 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + int retval; + int minor; + +- gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL); +- if (!gb_tty) +- return -ENOMEM; +- + connection = gb_connection_create(gbphy_dev->bundle, + le16_to_cpu(gbphy_dev->cport_desc->id), + gb_uart_request_handler); +- if (IS_ERR(connection)) { +- retval = PTR_ERR(connection); +- goto exit_tty_free; +- } ++ if (IS_ERR(connection)) ++ return PTR_ERR(connection); + + max_payload = gb_operation_get_payload_size_max(connection); + if (max_payload < sizeof(struct gb_uart_send_data_request)) { +@@ -852,13 +858,23 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + goto exit_connection_destroy; + } + ++ gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL); ++ if (!gb_tty) { ++ retval = -ENOMEM; ++ goto exit_connection_destroy; ++ } ++ ++ tty_port_init(&gb_tty->port); ++ gb_tty->port.ops = &gb_port_ops; ++ gb_tty->minor = GB_NUM_MINORS; ++ + gb_tty->buffer_payload_max = max_payload - + sizeof(struct gb_uart_send_data_request); + + gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL); + if (!gb_tty->buffer) { + retval = -ENOMEM; +- goto exit_connection_destroy; ++ goto exit_put_port; + } + + INIT_WORK(&gb_tty->tx_work, gb_uart_tx_write_work); +@@ -866,7 +882,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + retval = kfifo_alloc(&gb_tty->write_fifo, GB_UART_WRITE_FIFO_SIZE, + GFP_KERNEL); + if (retval) +- goto exit_buf_free; ++ goto exit_put_port; + + gb_tty->credits = GB_UART_FIRMWARE_CREDITS; + init_completion(&gb_tty->credits_complete); +@@ -880,7 +896,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + } else { + retval = minor; + } +- goto exit_kfifo_free; ++ goto exit_put_port; + } + + gb_tty->minor = minor; +@@ -889,9 +905,6 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + init_waitqueue_head(&gb_tty->wioctl); + mutex_init(&gb_tty->mutex); + +- tty_port_init(&gb_tty->port); +- gb_tty->port.ops = &gb_port_ops; +- + gb_tty->connection = connection; + gb_tty->gbphy_dev = gbphy_dev; + gb_connection_set_data(connection, gb_tty); +@@ -899,7 +912,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + + retval = gb_connection_enable_tx(connection); + if (retval) +- goto exit_release_minor; ++ goto exit_put_port; + + send_control(gb_tty, gb_tty->ctrlout); + +@@ -926,16 +939,10 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + + exit_connection_disable: + gb_connection_disable(connection); +-exit_release_minor: +- release_minor(gb_tty); +-exit_kfifo_free: +- kfifo_free(&gb_tty->write_fifo); +-exit_buf_free: +- kfree(gb_tty->buffer); ++exit_put_port: ++ tty_port_put(&gb_tty->port); + exit_connection_destroy: + gb_connection_destroy(connection); +-exit_tty_free: +- kfree(gb_tty); + + return retval; + } +@@ -966,15 +973,10 @@ static void gb_uart_remove(struct gbphy_device *gbphy_dev) + gb_connection_disable_rx(connection); + tty_unregister_device(gb_tty_driver, gb_tty->minor); + +- /* FIXME - free transmit / receive buffers */ +- + gb_connection_disable(connection); +- tty_port_destroy(&gb_tty->port); + gb_connection_destroy(connection); +- release_minor(gb_tty); +- kfifo_free(&gb_tty->write_fifo); +- kfree(gb_tty->buffer); +- kfree(gb_tty); ++ ++ tty_port_put(&gb_tty->port); + } + + static int gb_tty_init(void) +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index a24296d68f3ed..ae60599c462b9 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -228,15 +228,14 @@ int thermal_build_list_of_policies(char *buf) + { + struct thermal_governor *pos; + ssize_t count = 0; +- ssize_t size = PAGE_SIZE; + + mutex_lock(&thermal_governor_lock); + + list_for_each_entry(pos, &thermal_governor_list, governor_list) { +- size = PAGE_SIZE - count; +- count += scnprintf(buf + count, size, "%s ", pos->name); ++ count += scnprintf(buf + count, PAGE_SIZE - count, "%s ", ++ pos->name); + } +- count += scnprintf(buf + count, size, "\n"); ++ count += scnprintf(buf + count, PAGE_SIZE - count, "\n"); + + mutex_unlock(&thermal_governor_lock); + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index f0107d5df99e9..77f3f3728a79e 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -163,7 +163,7 @@ static unsigned int mvebu_uart_tx_empty(struct uart_port *port) + st = readl(port->membase + UART_STAT); + spin_unlock_irqrestore(&port->lock, flags); + +- return (st & STAT_TX_FIFO_EMP) ? TIOCSER_TEMT : 0; ++ return (st & STAT_TX_EMP) ? TIOCSER_TEMT : 0; + } + + static unsigned int mvebu_uart_get_mctrl(struct uart_port *port) +diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c +index e9779b03ee565..afe34beec7203 100644 +--- a/drivers/tty/synclink_gt.c ++++ b/drivers/tty/synclink_gt.c +@@ -137,37 +137,14 @@ MODULE_PARM_DESC(maxframe, "Maximum frame size used by device (4096 to 65535)"); + */ + static struct tty_driver *serial_driver; + +-static int open(struct tty_struct *tty, struct file * filp); +-static void close(struct tty_struct *tty, struct file * filp); +-static void hangup(struct tty_struct *tty); +-static void set_termios(struct tty_struct *tty, struct ktermios *old_termios); +- +-static int write(struct tty_struct *tty, const unsigned char *buf, int count); +-static int put_char(struct tty_struct *tty, unsigned char ch); +-static void send_xchar(struct tty_struct *tty, char ch); + static void wait_until_sent(struct tty_struct *tty, int timeout); +-static int write_room(struct tty_struct *tty); +-static void flush_chars(struct tty_struct *tty); + static void flush_buffer(struct tty_struct *tty); +-static void tx_hold(struct tty_struct *tty); + static void tx_release(struct tty_struct *tty); + +-static int ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg); +-static int chars_in_buffer(struct tty_struct *tty); +-static void throttle(struct tty_struct * tty); +-static void unthrottle(struct tty_struct * tty); +-static int set_break(struct tty_struct *tty, int break_state); +- + /* +- * generic HDLC support and callbacks ++ * generic HDLC support + */ +-#if SYNCLINK_GENERIC_HDLC + #define dev_to_port(D) (dev_to_hdlc(D)->priv) +-static void hdlcdev_tx_done(struct slgt_info *info); +-static void hdlcdev_rx(struct slgt_info *info, char *buf, int size); +-static int hdlcdev_init(struct slgt_info *info); +-static void hdlcdev_exit(struct slgt_info *info); +-#endif + + + /* +@@ -186,9 +163,6 @@ struct cond_wait { + wait_queue_entry_t wait; + unsigned int data; + }; +-static void init_cond_wait(struct cond_wait *w, unsigned int data); +-static void add_cond_wait(struct cond_wait **head, struct cond_wait *w); +-static void remove_cond_wait(struct cond_wait **head, struct cond_wait *w); + static void flush_cond_wait(struct cond_wait **head); + + /* +@@ -443,12 +417,8 @@ static void shutdown(struct slgt_info *info); + static void program_hw(struct slgt_info *info); + static void change_params(struct slgt_info *info); + +-static int register_test(struct slgt_info *info); +-static int irq_test(struct slgt_info *info); +-static int loopback_test(struct slgt_info *info); + static int adapter_test(struct slgt_info *info); + +-static void reset_adapter(struct slgt_info *info); + static void reset_port(struct slgt_info *info); + static void async_mode(struct slgt_info *info); + static void sync_mode(struct slgt_info *info); +@@ -457,41 +427,23 @@ static void rx_stop(struct slgt_info *info); + static void rx_start(struct slgt_info *info); + static void reset_rbufs(struct slgt_info *info); + static void free_rbufs(struct slgt_info *info, unsigned int first, unsigned int last); +-static void rdma_reset(struct slgt_info *info); + static bool rx_get_frame(struct slgt_info *info); + static bool rx_get_buf(struct slgt_info *info); + + static void tx_start(struct slgt_info *info); + static void tx_stop(struct slgt_info *info); + static void tx_set_idle(struct slgt_info *info); +-static unsigned int free_tbuf_count(struct slgt_info *info); + static unsigned int tbuf_bytes(struct slgt_info *info); + static void reset_tbufs(struct slgt_info *info); + static void tdma_reset(struct slgt_info *info); + static bool tx_load(struct slgt_info *info, const char *buf, unsigned int count); + +-static void get_signals(struct slgt_info *info); +-static void set_signals(struct slgt_info *info); +-static void enable_loopback(struct slgt_info *info); ++static void get_gtsignals(struct slgt_info *info); ++static void set_gtsignals(struct slgt_info *info); + static void set_rate(struct slgt_info *info, u32 data_rate); + +-static int bh_action(struct slgt_info *info); +-static void bh_handler(struct work_struct *work); + static void bh_transmit(struct slgt_info *info); +-static void isr_serial(struct slgt_info *info); +-static void isr_rdma(struct slgt_info *info); + static void isr_txeom(struct slgt_info *info, unsigned short status); +-static void isr_tdma(struct slgt_info *info); +- +-static int alloc_dma_bufs(struct slgt_info *info); +-static void free_dma_bufs(struct slgt_info *info); +-static int alloc_desc(struct slgt_info *info); +-static void free_desc(struct slgt_info *info); +-static int alloc_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count); +-static void free_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count); +- +-static int alloc_tmp_rbuf(struct slgt_info *info); +-static void free_tmp_rbuf(struct slgt_info *info); + + static void tx_timeout(struct timer_list *t); + static void rx_timeout(struct timer_list *t); +@@ -509,10 +461,6 @@ static int tx_abort(struct slgt_info *info); + static int rx_enable(struct slgt_info *info, int enable); + static int modem_input_wait(struct slgt_info *info,int arg); + static int wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr); +-static int tiocmget(struct tty_struct *tty); +-static int tiocmset(struct tty_struct *tty, +- unsigned int set, unsigned int clear); +-static int set_break(struct tty_struct *tty, int break_state); + static int get_interface(struct slgt_info *info, int __user *if_mode); + static int set_interface(struct slgt_info *info, int if_mode); + static int set_gpio(struct slgt_info *info, struct gpio_desc __user *gpio); +@@ -526,9 +474,6 @@ static int set_xctrl(struct slgt_info *info, int if_mode); + /* + * driver functions + */ +-static void add_device(struct slgt_info *info); +-static void device_init(int adapter_num, struct pci_dev *pdev); +-static int claim_resources(struct slgt_info *info); + static void release_resources(struct slgt_info *info); + + /* +@@ -776,7 +721,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios) + if ((old_termios->c_cflag & CBAUD) && !C_BAUD(tty)) { + info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR); + spin_lock_irqsave(&info->lock,flags); +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + } + +@@ -786,7 +731,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios) + if (!C_CRTSCTS(tty) || !tty_throttled(tty)) + info->signals |= SerialSignal_RTS; + spin_lock_irqsave(&info->lock,flags); +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + } + +@@ -1238,7 +1183,7 @@ static inline void line_info(struct seq_file *m, struct slgt_info *info) + + /* output current serial signal states */ + spin_lock_irqsave(&info->lock,flags); +- get_signals(info); ++ get_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + + stat_buf[0] = 0; +@@ -1338,7 +1283,7 @@ static void throttle(struct tty_struct * tty) + if (C_CRTSCTS(tty)) { + spin_lock_irqsave(&info->lock,flags); + info->signals &= ~SerialSignal_RTS; +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + } + } +@@ -1363,7 +1308,7 @@ static void unthrottle(struct tty_struct * tty) + if (C_CRTSCTS(tty)) { + spin_lock_irqsave(&info->lock,flags); + info->signals |= SerialSignal_RTS; +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + } + } +@@ -1535,7 +1480,7 @@ static int hdlcdev_open(struct net_device *dev) + + /* inform generic HDLC layer of current DCD status */ + spin_lock_irqsave(&info->lock, flags); +- get_signals(info); ++ get_gtsignals(info); + spin_unlock_irqrestore(&info->lock, flags); + if (info->signals & SerialSignal_DCD) + netif_carrier_on(dev); +@@ -2291,7 +2236,7 @@ static void isr_txeom(struct slgt_info *info, unsigned short status) + if (info->params.mode != MGSL_MODE_ASYNC && info->drop_rts_on_tx_done) { + info->signals &= ~SerialSignal_RTS; + info->drop_rts_on_tx_done = false; +- set_signals(info); ++ set_gtsignals(info); + } + + #if SYNCLINK_GENERIC_HDLC +@@ -2456,7 +2401,7 @@ static void shutdown(struct slgt_info *info) + + if (!info->port.tty || info->port.tty->termios.c_cflag & HUPCL) { + info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR); +- set_signals(info); ++ set_gtsignals(info); + } + + flush_cond_wait(&info->gpio_wait_q); +@@ -2484,7 +2429,7 @@ static void program_hw(struct slgt_info *info) + else + async_mode(info); + +- set_signals(info); ++ set_gtsignals(info); + + info->dcd_chkcount = 0; + info->cts_chkcount = 0; +@@ -2492,7 +2437,7 @@ static void program_hw(struct slgt_info *info) + info->dsr_chkcount = 0; + + slgt_irq_on(info, IRQ_DCD | IRQ_CTS | IRQ_DSR | IRQ_RI); +- get_signals(info); ++ get_gtsignals(info); + + if (info->netcount || + (info->port.tty && info->port.tty->termios.c_cflag & CREAD)) +@@ -2736,7 +2681,7 @@ static int wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr) + spin_lock_irqsave(&info->lock,flags); + + /* return immediately if state matches requested events */ +- get_signals(info); ++ get_gtsignals(info); + s = info->signals; + + events = mask & +@@ -3154,7 +3099,7 @@ static int tiocmget(struct tty_struct *tty) + unsigned long flags; + + spin_lock_irqsave(&info->lock,flags); +- get_signals(info); ++ get_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + + result = ((info->signals & SerialSignal_RTS) ? TIOCM_RTS:0) + +@@ -3193,7 +3138,7 @@ static int tiocmset(struct tty_struct *tty, + info->signals &= ~SerialSignal_DTR; + + spin_lock_irqsave(&info->lock,flags); +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + return 0; + } +@@ -3204,7 +3149,7 @@ static int carrier_raised(struct tty_port *port) + struct slgt_info *info = container_of(port, struct slgt_info, port); + + spin_lock_irqsave(&info->lock,flags); +- get_signals(info); ++ get_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + return (info->signals & SerialSignal_DCD) ? 1 : 0; + } +@@ -3219,7 +3164,7 @@ static void dtr_rts(struct tty_port *port, int on) + info->signals |= SerialSignal_RTS | SerialSignal_DTR; + else + info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR); +- set_signals(info); ++ set_gtsignals(info); + spin_unlock_irqrestore(&info->lock,flags); + } + +@@ -4018,10 +3963,10 @@ static void tx_start(struct slgt_info *info) + + if (info->params.mode != MGSL_MODE_ASYNC) { + if (info->params.flags & HDLC_FLAG_AUTO_RTS) { +- get_signals(info); ++ get_gtsignals(info); + if (!(info->signals & SerialSignal_RTS)) { + info->signals |= SerialSignal_RTS; +- set_signals(info); ++ set_gtsignals(info); + info->drop_rts_on_tx_done = true; + } + } +@@ -4075,7 +4020,7 @@ static void reset_port(struct slgt_info *info) + rx_stop(info); + + info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR); +- set_signals(info); ++ set_gtsignals(info); + + slgt_irq_off(info, IRQ_ALL | IRQ_MASTER); + } +@@ -4497,7 +4442,7 @@ static void tx_set_idle(struct slgt_info *info) + /* + * get state of V24 status (input) signals + */ +-static void get_signals(struct slgt_info *info) ++static void get_gtsignals(struct slgt_info *info) + { + unsigned short status = rd_reg16(info, SSR); + +@@ -4559,7 +4504,7 @@ static void msc_set_vcr(struct slgt_info *info) + /* + * set state of V24 control (output) signals + */ +-static void set_signals(struct slgt_info *info) ++static void set_gtsignals(struct slgt_info *info) + { + unsigned char val = rd_reg8(info, VCR); + if (info->signals & SerialSignal_DTR) +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index b2b5f19fb2fb9..72e3989dffa60 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1218,8 +1218,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + new_row_size = new_cols << 1; + new_screen_size = new_row_size * new_rows; + +- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) +- return 0; ++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { ++ /* ++ * This function is being called here to cover the case ++ * where the userspace calls the FBIOPUT_VSCREENINFO twice, ++ * passing the same fb_var_screeninfo containing the fields ++ * yres/xres equal to a number non-multiple of vc_font.height ++ * and yres_virtual/xres_virtual equal to number lesser than the ++ * vc_font.height and yres/xres. ++ * In the second call, the struct fb_var_screeninfo isn't ++ * being modified by the underlying driver because of the ++ * if above, and this causes the fbcon_display->vrows to become ++ * negative and it eventually leads to out-of-bound ++ * access by the imageblit function. ++ * To give the correct values to the struct and to not have ++ * to deal with possible errors from the code below, we call ++ * the resize_screen here as well. ++ */ ++ return resize_screen(vc, new_cols, new_rows, user); ++ } + + if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size) + return -EINVAL; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 371aae41ed655..6959231d63b3e 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -734,7 +734,8 @@ static void acm_port_destruct(struct tty_port *port) + { + struct acm *acm = container_of(port, struct acm, port); + +- acm_release_minor(acm); ++ if (acm->minor != ACM_MINOR_INVALID) ++ acm_release_minor(acm); + usb_put_intf(acm->control); + kfree(acm->country_codes); + kfree(acm); +@@ -1396,8 +1397,10 @@ made_compressed_probe: + usb_get_intf(acm->control); /* undone in destruct() */ + + minor = acm_alloc_minor(acm); +- if (minor < 0) ++ if (minor < 0) { ++ acm->minor = ACM_MINOR_INVALID; + goto alloc_fail1; ++ } + + acm->minor = minor; + acm->dev = usb_dev; +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index d8f8651425c46..02e2ad61742db 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -22,6 +22,8 @@ + #define ACM_TTY_MAJOR 166 + #define ACM_TTY_MINORS 256 + ++#define ACM_MINOR_INVALID ACM_TTY_MINORS ++ + /* + * Requests. + */ +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 7fff96dff0a03..b405c8ac8984b 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -2919,9 +2919,7 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx, + + /* In DDMA handle isochronous requests separately */ + if (using_desc_dma(hsotg) && hs_ep->isochronous) { +- /* XferCompl set along with BNA */ +- if (!(ints & DXEPINT_BNAINTR)) +- dwc2_gadget_complete_isoc_request_ddma(hs_ep); ++ dwc2_gadget_complete_isoc_request_ddma(hs_ep); + } else if (dir_in) { + /* + * We get OutDone from the FIFO, so we only +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index a766476fd742e..ca0aebb5bd0cc 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1250,7 +1250,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) + do { + tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ; + udelay(1); +- } while (tmp != CS_IDST || timeout-- > 0); ++ } while (tmp != CS_IDST && timeout-- > 0); + + if (tmp == CS_IDST) + r8a66597_bset(r8a66597, +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index 39453287b5c36..4ecfbf6bb1fa8 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) + } + if (len > 0) { + /* Write the rest 1 - 3 bytes to FIFO */ ++ val = 0; + memcpy(&val, buf, len); + musb_writel(fifo, 0, val); + } +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index eaf9155663027..894572a5e5c5c 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -234,6 +234,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */ + { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index c78dfb7fd3948..3e624b648aa68 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -113,7 +113,6 @@ + #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02 + #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44 + #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03 +-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24 + + /* This driver also supports + * ATEN UC2324 device using Moschip MCS7840 +@@ -194,7 +193,6 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)}, +- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)}, + {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)}, +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index d08b799c91fc6..524b3c6e96e2a 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1205,6 +1205,14 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +@@ -1650,7 +1658,6 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), +@@ -2068,6 +2075,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 861153d294b67..7442793fe0502 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -416,9 +416,16 @@ UNUSUAL_DEV( 0x04cb, 0x0100, 0x0000, 0x2210, + USB_SC_UFI, USB_PR_DEVICE, NULL, US_FL_FIX_INQUIRY | US_FL_SINGLE_LUN), + + /* +- * Reported by Ondrej Zary <li...@rainbow-software.org> ++ * Reported by Ondrej Zary <li...@zary.sk> + * The device reports one sector more and breaks when that sector is accessed ++ * Firmwares older than 2.6c (the latest one and the only that claims Linux ++ * support) have also broken tag handling + */ ++UNUSUAL_DEV( 0x04ce, 0x0002, 0x0000, 0x026b, ++ "ScanLogic", ++ "SL11R-IDE", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG), + UNUSUAL_DEV( 0x04ce, 0x0002, 0x026c, 0x026c, + "ScanLogic", + "SL11R-IDE", +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index c7db6c943ba51..2f72753c3e225 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -50,7 +50,7 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999, + "LaCie", + "Rugged USB3-FW", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_IGNORE_UAS), ++ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), + + /* + * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index b23edf64c2b21..2459e2afd65ec 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -43,6 +43,8 @@ + #include <linux/sched.h> + #include <linux/cred.h> + #include <linux/errno.h> ++#include <linux/freezer.h> ++#include <linux/kthread.h> + #include <linux/mm.h> + #include <linux/bootmem.h> + #include <linux/pagemap.h> +@@ -120,7 +122,7 @@ static struct ctl_table xen_root[] = { + #define EXTENT_ORDER (fls(XEN_PFN_PER_PAGE) - 1) + + /* +- * balloon_process() state: ++ * balloon_thread() state: + * + * BP_DONE: done or nothing to do, + * BP_WAIT: wait to be rescheduled, +@@ -135,6 +137,8 @@ enum bp_state { + BP_ECANCELED + }; + ++/* Main waiting point for xen-balloon thread. */ ++static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq); + + static DEFINE_MUTEX(balloon_mutex); + +@@ -149,10 +153,6 @@ static xen_pfn_t frame_list[PAGE_SIZE / sizeof(xen_pfn_t)]; + static LIST_HEAD(ballooned_pages); + static DECLARE_WAIT_QUEUE_HEAD(balloon_wq); + +-/* Main work function, always executed in process context. */ +-static void balloon_process(struct work_struct *work); +-static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); +- + /* When ballooning out (allocating memory to return to Xen) we don't really + want the kernel to try too hard since that can trigger the oom killer. */ + #define GFP_BALLOON \ +@@ -383,7 +383,7 @@ static void xen_online_page(struct page *page) + static int xen_memory_notifier(struct notifier_block *nb, unsigned long val, void *v) + { + if (val == MEM_ONLINE) +- schedule_delayed_work(&balloon_worker, 0); ++ wake_up(&balloon_thread_wq); + + return NOTIFY_OK; + } +@@ -508,18 +508,43 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) + } + + /* +- * As this is a work item it is guaranteed to run as a single instance only. ++ * Stop waiting if either state is not BP_EAGAIN and ballooning action is ++ * needed, or if the credit has changed while state is BP_EAGAIN. ++ */ ++static bool balloon_thread_cond(enum bp_state state, long credit) ++{ ++ if (state != BP_EAGAIN) ++ credit = 0; ++ ++ return current_credit() != credit || kthread_should_stop(); ++} ++ ++/* ++ * As this is a kthread it is guaranteed to run as a single instance only. + * We may of course race updates of the target counts (which are protected + * by the balloon lock), or with changes to the Xen hard limit, but we will + * recover from these in time. + */ +-static void balloon_process(struct work_struct *work) ++static int balloon_thread(void *unused) + { + enum bp_state state = BP_DONE; + long credit; ++ unsigned long timeout; ++ ++ set_freezable(); ++ for (;;) { ++ if (state == BP_EAGAIN) ++ timeout = balloon_stats.schedule_delay * HZ; ++ else ++ timeout = 3600 * HZ; ++ credit = current_credit(); + ++ wait_event_freezable_timeout(balloon_thread_wq, ++ balloon_thread_cond(state, credit), timeout); ++ ++ if (kthread_should_stop()) ++ return 0; + +- do { + mutex_lock(&balloon_mutex); + + credit = current_credit(); +@@ -546,12 +571,7 @@ static void balloon_process(struct work_struct *work) + mutex_unlock(&balloon_mutex); + + cond_resched(); +- +- } while (credit && state == BP_DONE); +- +- /* Schedule more work if there is some still to be done. */ +- if (state == BP_EAGAIN) +- schedule_delayed_work(&balloon_worker, balloon_stats.schedule_delay * HZ); ++ } + } + + /* Resets the Xen limit, sets new target, and kicks off processing. */ +@@ -559,7 +579,7 @@ void balloon_set_new_target(unsigned long target) + { + /* No need for lock. Not read-modify-write updates. */ + balloon_stats.target_pages = target; +- schedule_delayed_work(&balloon_worker, 0); ++ wake_up(&balloon_thread_wq); + } + EXPORT_SYMBOL_GPL(balloon_set_new_target); + +@@ -664,7 +684,7 @@ void free_xenballooned_pages(int nr_pages, struct page **pages) + + /* The balloon may be too large now. Shrink it if needed. */ + if (current_credit()) +- schedule_delayed_work(&balloon_worker, 0); ++ wake_up(&balloon_thread_wq); + + mutex_unlock(&balloon_mutex); + } +@@ -698,6 +718,8 @@ static void __init balloon_add_region(unsigned long start_pfn, + + static int __init balloon_init(void) + { ++ struct task_struct *task; ++ + if (!xen_domain()) + return -ENODEV; + +@@ -741,6 +763,12 @@ static int __init balloon_init(void) + } + #endif + ++ task = kthread_run(balloon_thread, NULL, "xen-balloon"); ++ if (IS_ERR(task)) { ++ pr_err("xen-balloon thread could not be started, ballooning will not work!\n"); ++ return PTR_ERR(task); ++ } ++ + /* Init the xen-balloon driver. */ + xen_balloon_init(); + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 975dd0dbc2527..c41c568ad1b8a 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -580,7 +580,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, + elf_prot |= PROT_EXEC; + vaddr = eppnt->p_vaddr; + if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) +- elf_type |= MAP_FIXED_NOREPLACE; ++ elf_type |= MAP_FIXED; + else if (no_base && interp_elf_ex->e_type == ET_DYN) + load_addr = -vaddr; + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6285085195c15..b5aba1c895cb5 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3374,9 +3374,10 @@ cifs_match_super(struct super_block *sb, void *data) + spin_lock(&cifs_tcp_ses_lock); + cifs_sb = CIFS_SB(sb); + tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); +- if (IS_ERR(tlink)) { ++ if (tlink == NULL) { ++ /* can not match superblock if tlink were ever null */ + spin_unlock(&cifs_tcp_ses_lock); +- return rc; ++ return 0; + } + tcon = tlink_tcon(tlink); + ses = tcon->ses; +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index ae520a7263395..aed33af7551ee 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -535,7 +535,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + struct dir_private_info *info = file->private_data; + struct inode *inode = file_inode(file); + struct fname *fname; +- int ret; ++ int ret = 0; + + if (!info) { + info = ext4_htree_create_dir_info(file, ctx->pos); +@@ -583,7 +583,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + info->curr_minor_hash, + &info->next_hash); + if (ret < 0) +- return ret; ++ goto finished; + if (ret == 0) { + ctx->pos = ext4_get_htree_eof(file); + break; +@@ -614,7 +614,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + } + finished: + info->last_pos = ctx->pos; +- return 0; ++ return ret < 0 ? ret : 0; + } + + static int ext4_dir_open(struct inode * inode, struct file * filp) +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 8149fb6f1f0d2..a906f47ce1ba7 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -3907,7 +3907,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres, + oi = OCFS2_I(inode); + oi->ip_dir_lock_gen++; + mlog(0, "generation: %u\n", oi->ip_dir_lock_gen); +- goto out; ++ goto out_forget; + } + + if (!S_ISREG(inode->i_mode)) +@@ -3938,6 +3938,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres, + filemap_fdatawait(mapping); + } + ++out_forget: + forget_all_cached_acls(inode); + + out: +diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c +index a6ee23aadd283..66645a5a35f30 100644 +--- a/fs/qnx4/dir.c ++++ b/fs/qnx4/dir.c +@@ -15,13 +15,48 @@ + #include <linux/buffer_head.h> + #include "qnx4.h" + ++/* ++ * A qnx4 directory entry is an inode entry or link info ++ * depending on the status field in the last byte. The ++ * first byte is where the name start either way, and a ++ * zero means it's empty. ++ * ++ * Also, due to a bug in gcc, we don't want to use the ++ * real (differently sized) name arrays in the inode and ++ * link entries, but always the 'de_name[]' one in the ++ * fake struct entry. ++ * ++ * See ++ * ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6 ++ * ++ * for details, but basically gcc will take the size of the ++ * 'name' array from one of the used union entries randomly. ++ * ++ * This use of 'de_name[]' (48 bytes) avoids the false positive ++ * warnings that would happen if gcc decides to use 'inode.di_name' ++ * (16 bytes) even when the pointer and size were to come from ++ * 'link.dl_name' (48 bytes). ++ * ++ * In all cases the actual name pointer itself is the same, it's ++ * only the gcc internal 'what is the size of this field' logic ++ * that can get confused. ++ */ ++union qnx4_directory_entry { ++ struct { ++ const char de_name[48]; ++ u8 de_pad[15]; ++ u8 de_status; ++ }; ++ struct qnx4_inode_entry inode; ++ struct qnx4_link_info link; ++}; ++ + static int qnx4_readdir(struct file *file, struct dir_context *ctx) + { + struct inode *inode = file_inode(file); + unsigned int offset; + struct buffer_head *bh; +- struct qnx4_inode_entry *de; +- struct qnx4_link_info *le; + unsigned long blknum; + int ix, ino; + int size; +@@ -38,27 +73,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx) + } + ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK; + for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) { ++ union qnx4_directory_entry *de; ++ + offset = ix * QNX4_DIR_ENTRY_SIZE; +- de = (struct qnx4_inode_entry *) (bh->b_data + offset); +- if (!de->di_fname[0]) ++ de = (union qnx4_directory_entry *) (bh->b_data + offset); ++ ++ if (!de->de_name[0]) + continue; +- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) ++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) + continue; +- if (!(de->di_status & QNX4_FILE_LINK)) +- size = QNX4_SHORT_NAME_MAX; +- else +- size = QNX4_NAME_MAX; +- size = strnlen(de->di_fname, size); +- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname)); +- if (!(de->di_status & QNX4_FILE_LINK)) ++ if (!(de->de_status & QNX4_FILE_LINK)) { ++ size = sizeof(de->inode.di_fname); + ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1; +- else { +- le = (struct qnx4_link_info*)de; +- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) * ++ } else { ++ size = sizeof(de->link.dl_fname); ++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) * + QNX4_INODES_PER_BLOCK + +- le->dl_inode_ndx; ++ de->link.dl_inode_ndx; + } +- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) { ++ size = strnlen(de->de_name, size); ++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name)); ++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) { + brelse(bh); + return 0; + } +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 6a53300cbd1ed..ab9dfb14f4862 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -228,6 +228,8 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, + (typeof(ptr)) (__ptr + (off)); }) + #endif + ++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0) ++ + #ifndef OPTIMIZER_HIDE_VAR + /* Make the optimizer believe the variable can be manipulated arbitrarily. */ + #define OPTIMIZER_HIDE_VAR(var) \ +diff --git a/include/linux/cred.h b/include/linux/cred.h +index 1dc351d8548bf..4b081e4911c84 100644 +--- a/include/linux/cred.h ++++ b/include/linux/cred.h +@@ -240,7 +240,7 @@ static inline struct cred *get_new_cred(struct cred *cred) + * @cred: The credentials to reference + * + * Get a reference on the specified set of credentials. The caller must +- * release the reference. ++ * release the reference. If %NULL is passed, it is returned with no action. + * + * This is used to deal with a committed set of credentials. Although the + * pointer is const, this will temporarily discard the const and increment the +@@ -251,6 +251,8 @@ static inline struct cred *get_new_cred(struct cred *cred) + static inline const struct cred *get_cred(const struct cred *cred) + { + struct cred *nonconst_cred = (struct cred *) cred; ++ if (!cred) ++ return cred; + validate_creds(cred); + nonconst_cred->non_rcu = 0; + return get_new_cred(nonconst_cred); +@@ -261,7 +263,7 @@ static inline const struct cred *get_cred(const struct cred *cred) + * @cred: The credentials to release + * + * Release a reference to a set of credentials, deleting them when the last ref +- * is released. ++ * is released. If %NULL is passed, nothing is done. + * + * This takes a const pointer to a set of credentials because the credentials + * on task_struct are attached by const pointers to prevent accidental +@@ -271,9 +273,11 @@ static inline void put_cred(const struct cred *_cred) + { + struct cred *cred = (struct cred *) _cred; + +- validate_creds(cred); +- if (atomic_dec_and_test(&(cred)->usage)) +- __put_cred(cred); ++ if (cred) { ++ validate_creds(cred); ++ if (atomic_dec_and_test(&(cred)->usage)) ++ __put_cred(cred); ++ } + } + + /** +diff --git a/include/net/sock.h b/include/net/sock.h +index 351749c694ce6..75677050c82ed 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -471,8 +471,10 @@ struct sock { + u32 sk_ack_backlog; + u32 sk_max_ack_backlog; + kuid_t sk_uid; ++ spinlock_t sk_peer_lock; + struct pid *sk_peer_pid; + const struct cred *sk_peer_cred; ++ + long sk_rcvtimeo; + ktime_t sk_stamp; + #if BITS_PER_LONG==32 +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 1b7ec822dc757..60f0e0e048f0e 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -591,9 +591,17 @@ static struct attribute *sugov_attributes[] = { + NULL + }; + ++static void sugov_tunables_free(struct kobject *kobj) ++{ ++ struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); ++ ++ kfree(to_sugov_tunables(attr_set)); ++} ++ + static struct kobj_type sugov_tunables_ktype = { + .default_attrs = sugov_attributes, + .sysfs_ops = &governor_sysfs_ops, ++ .release = &sugov_tunables_free, + }; + + /********************** cpufreq governor interface *********************/ +@@ -693,12 +701,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_polic + return tunables; + } + +-static void sugov_tunables_free(struct sugov_tunables *tunables) ++static void sugov_clear_global_tunables(void) + { + if (!have_governor_per_policy()) + global_tunables = NULL; +- +- kfree(tunables); + } + + static int sugov_init(struct cpufreq_policy *policy) +@@ -761,7 +767,7 @@ out: + fail: + kobject_put(&tunables->attr_set.kobj); + policy->governor_data = NULL; +- sugov_tunables_free(tunables); ++ sugov_clear_global_tunables(); + + stop_kthread: + sugov_kthread_stop(sg_policy); +@@ -788,7 +794,7 @@ static void sugov_exit(struct cpufreq_policy *policy) + count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook); + policy->governor_data = NULL; + if (!count) +- sugov_tunables_free(tunables); ++ sugov_clear_global_tunables(); + + mutex_unlock(&global_tunables_lock); + +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 645048bb1e869..75ea1a5be31a8 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -1661,6 +1661,14 @@ static int blk_trace_remove_queue(struct request_queue *q) + if (bt == NULL) + return -EINVAL; + ++ if (bt->trace_state == Blktrace_running) { ++ bt->trace_state = Blktrace_stopped; ++ spin_lock_irq(&running_trace_lock); ++ list_del_init(&bt->running_list); ++ spin_unlock_irq(&running_trace_lock); ++ relay_flush(bt->rchan); ++ } ++ + put_probe_ref(); + synchronize_rcu(); + blk_trace_free(bt); +diff --git a/net/core/sock.c b/net/core/sock.c +index 956af38aa0d6e..41a77027a549b 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1057,6 +1057,16 @@ set_rcvbuf: + } + EXPORT_SYMBOL(sock_setsockopt); + ++static const struct cred *sk_get_peer_cred(struct sock *sk) ++{ ++ const struct cred *cred; ++ ++ spin_lock(&sk->sk_peer_lock); ++ cred = get_cred(sk->sk_peer_cred); ++ spin_unlock(&sk->sk_peer_lock); ++ ++ return cred; ++} + + static void cred_to_ucred(struct pid *pid, const struct cred *cred, + struct ucred *ucred) +@@ -1231,7 +1241,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname, + struct ucred peercred; + if (len > sizeof(peercred)) + len = sizeof(peercred); ++ ++ spin_lock(&sk->sk_peer_lock); + cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred); ++ spin_unlock(&sk->sk_peer_lock); ++ + if (copy_to_user(optval, &peercred, len)) + return -EFAULT; + goto lenout; +@@ -1239,20 +1253,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname, + + case SO_PEERGROUPS: + { ++ const struct cred *cred; + int ret, n; + +- if (!sk->sk_peer_cred) ++ cred = sk_get_peer_cred(sk); ++ if (!cred) + return -ENODATA; + +- n = sk->sk_peer_cred->group_info->ngroups; ++ n = cred->group_info->ngroups; + if (len < n * sizeof(gid_t)) { + len = n * sizeof(gid_t); ++ put_cred(cred); + return put_user(len, optlen) ? -EFAULT : -ERANGE; + } + len = n * sizeof(gid_t); + +- ret = groups_to_user((gid_t __user *)optval, +- sk->sk_peer_cred->group_info); ++ ret = groups_to_user((gid_t __user *)optval, cred->group_info); ++ put_cred(cred); + if (ret) + return ret; + goto lenout; +@@ -1576,9 +1593,10 @@ static void __sk_destruct(struct rcu_head *head) + sk->sk_frag.page = NULL; + } + +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ /* We do not need to acquire sk->sk_peer_lock, we are the last user. */ ++ put_cred(sk->sk_peer_cred); + put_pid(sk->sk_peer_pid); ++ + if (likely(sk->sk_net_refcnt)) + put_net(sock_net(sk)); + sk_prot_free(sk->sk_prot_creator, sk); +@@ -2826,6 +2844,8 @@ void sock_init_data(struct socket *sock, struct sock *sk) + + sk->sk_peer_pid = NULL; + sk->sk_peer_cred = NULL; ++ spin_lock_init(&sk->sk_peer_lock); ++ + sk->sk_write_pending = 0; + sk->sk_rcvlowat = 1; + sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 5117e0aeea1af..757e1f60e00db 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -581,10 +581,12 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk, + u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr; + u32 delta_us; + +- if (!delta) +- delta = 1; +- delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ); +- tcp_rcv_rtt_update(tp, delta_us, 0); ++ if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) { ++ if (!delta) ++ delta = 1; ++ delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ); ++ tcp_rcv_rtt_update(tp, delta_us, 0); ++ } + } + } + +@@ -2931,9 +2933,11 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag, + if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr && + flag & FLAG_ACKED) { + u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr; +- u32 delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ); + +- seq_rtt_us = ca_rtt_us = delta_us; ++ if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) { ++ seq_rtt_us = delta * (USEC_PER_SEC / TCP_TS_HZ); ++ ca_rtt_us = seq_rtt_us; ++ } + } + rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */ + if (seq_rtt_us < 0) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index d55ee43cd1b8f..941c655cad917 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2958,13 +2958,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + #endif + TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS; + tp->retrans_out += tcp_skb_pcount(skb); +- +- /* Save stamp of the first retransmit. */ +- if (!tp->retrans_stamp) +- tp->retrans_stamp = tcp_skb_timestamp(skb); +- + } + ++ /* Save stamp of the first (attempted) retransmit. */ ++ if (!tp->retrans_stamp) ++ tp->retrans_stamp = tcp_skb_timestamp(skb); ++ + if (tp->undo_retrans < 0) + tp->undo_retrans = 0; + tp->undo_retrans += tcp_skb_pcount(skb); +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 681882a409686..d071ed6b8b9a0 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -22,33 +22,21 @@ + #include <linux/gfp.h> + #include <net/tcp.h> + +-static u32 tcp_retransmit_stamp(const struct sock *sk) +-{ +- u32 start_ts = tcp_sk(sk)->retrans_stamp; +- +- if (unlikely(!start_ts)) { +- struct sk_buff *head = tcp_rtx_queue_head(sk); +- +- if (!head) +- return 0; +- start_ts = tcp_skb_timestamp(head); +- } +- return start_ts; +-} +- + static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); + u32 elapsed, start_ts; ++ s32 remaining; + +- start_ts = tcp_retransmit_stamp(sk); +- if (!icsk->icsk_user_timeout || !start_ts) ++ start_ts = tcp_sk(sk)->retrans_stamp; ++ if (!icsk->icsk_user_timeout) + return icsk->icsk_rto; + elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts; +- if (elapsed >= icsk->icsk_user_timeout) ++ remaining = icsk->icsk_user_timeout - elapsed; ++ if (remaining <= 0) + return 1; /* user timeout has passed; fire ASAP */ +- else +- return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(icsk->icsk_user_timeout - elapsed)); ++ ++ return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining)); + } + + /** +@@ -172,7 +160,20 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); + } + ++static unsigned int tcp_model_timeout(struct sock *sk, ++ unsigned int boundary, ++ unsigned int rto_base) ++{ ++ unsigned int linear_backoff_thresh, timeout; + ++ linear_backoff_thresh = ilog2(TCP_RTO_MAX / rto_base); ++ if (boundary <= linear_backoff_thresh) ++ timeout = ((2 << boundary) - 1) * rto_base; ++ else ++ timeout = ((2 << linear_backoff_thresh) - 1) * rto_base + ++ (boundary - linear_backoff_thresh) * TCP_RTO_MAX; ++ return jiffies_to_msecs(timeout); ++} + /** + * retransmits_timed_out() - returns true if this connection has timed out + * @sk: The current socket +@@ -190,27 +191,21 @@ static bool retransmits_timed_out(struct sock *sk, + unsigned int boundary, + unsigned int timeout) + { +- const unsigned int rto_base = TCP_RTO_MIN; +- unsigned int linear_backoff_thresh, start_ts; ++ unsigned int start_ts; + + if (!inet_csk(sk)->icsk_retransmits) + return false; + +- start_ts = tcp_retransmit_stamp(sk); +- if (!start_ts) +- return false; +- ++ start_ts = tcp_sk(sk)->retrans_stamp; + if (likely(timeout == 0)) { +- linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); +- +- if (boundary <= linear_backoff_thresh) +- timeout = ((2 << boundary) - 1) * rto_base; +- else +- timeout = ((2 << linear_backoff_thresh) - 1) * rto_base + +- (boundary - linear_backoff_thresh) * TCP_RTO_MAX; +- timeout = jiffies_to_msecs(timeout); ++ unsigned int rto_base = TCP_RTO_MIN; ++ ++ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) ++ rto_base = tcp_timeout_init(sk); ++ timeout = tcp_model_timeout(sk, boundary, rto_base); + } +- return (tcp_time_stamp(tcp_sk(sk)) - start_ts) >= timeout; ++ ++ return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0; + } + + /* A write timeout has occurred. Process the after effects. */ +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 32f0d1bb3b6d5..e62de979ee30c 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -935,7 +935,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + __be16 dport; + u8 tos; + int err, is_udplite = IS_UDPLITE(sk); +- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE; ++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; + int (*getfrag)(void *, char *, int, int, int, struct sk_buff *); + struct sk_buff *skb; + struct ip_options_data opt_copy; +@@ -1243,7 +1243,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset, + } + + up->len += size; +- if (!(up->corkflag || (flags&MSG_MORE))) ++ if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE))) + ret = udp_push_pending_frames(sk); + if (!ret) + ret = size; +@@ -2468,9 +2468,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, + switch (optname) { + case UDP_CORK: + if (val != 0) { +- up->corkflag = 1; ++ WRITE_ONCE(up->corkflag, 1); + } else { +- up->corkflag = 0; ++ WRITE_ONCE(up->corkflag, 0); + lock_sock(sk); + push_pending_frames(sk); + release_sock(sk); +@@ -2583,7 +2583,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, + + switch (optname) { + case UDP_CORK: +- val = up->corkflag; ++ val = READ_ONCE(up->corkflag); + break; + + case UDP_ENCAP: +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 042ab5428a4ff..0198910c2bf27 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1169,7 +1169,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + int addr_len = msg->msg_namelen; + bool connected = false; + int ulen = len; +- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE; ++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; + int err; + int is_udplite = IS_UDPLITE(sk); + int (*getfrag)(void *, char *, int, int, int, struct sk_buff *); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 5c5908127fcb5..74045e927e044 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2126,7 +2126,11 @@ static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local, + } + + vht_mcs = iterator.this_arg[4] >> 4; ++ if (vht_mcs > 11) ++ vht_mcs = 0; + vht_nss = iterator.this_arg[4] & 0xF; ++ if (!vht_nss || vht_nss > 8) ++ vht_nss = 1; + break; + + /* +@@ -3264,6 +3268,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, + if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head)) + goto out; + ++ /* If n == 2, the "while (*frag_tail)" loop above didn't execute ++ * and frag_tail should be &skb_shinfo(head)->frag_list. ++ * However, ieee80211_amsdu_prepare_head() can reallocate it. ++ * Reload frag_tail to have it pointing to the correct place. ++ */ ++ if (n == 2) ++ frag_tail = &skb_shinfo(head)->frag_list; ++ + /* + * Pad out the previous subframe to a multiple of 4 by adding the + * padding to the next one, that's being added. Note that head->len +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index dbeccccf0fdf3..b1d2e2b54f85a 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -523,6 +523,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +@@ -752,6 +755,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 154b40f2f2a8c..b4b4745563398 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -104,11 +104,11 @@ htable_size(u8 hbits) + { + size_t hsize; + +- /* We must fit both into u32 in jhash and size_t */ ++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ + if (hbits > 31) + return 0; + hsize = jhash_size(hbits); +- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *) ++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *) + < hsize) + return 0; + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 5b2b17867cb1b..2780a847701e6 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -1399,6 +1399,10 @@ int __init ip_vs_conn_init(void) + int idx; + + /* Compute size and mask */ ++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) { ++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n"); ++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS; ++ } + ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits; + ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1; + +diff --git a/net/sctp/input.c b/net/sctp/input.c +index 8b7c07fc66d4b..64dc2923a21b0 100644 +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -687,7 +687,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb) + ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch); + + /* Break out if chunk length is less then minimal. */ +- if (ntohs(ch->length) < sizeof(_ch)) ++ if (!ch || ntohs(ch->length) < sizeof(_ch)) + break; + + ch_end = offset + SCTP_PAD4(ntohs(ch->length)); +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index aa9a17ac1f7b3..063acfbdcd893 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -162,7 +162,8 @@ static int smc_clc_prfx_set(struct socket *clcsock, + goto out_rel; + } + /* get address to which the internal TCP socket is bound */ +- kernel_getsockname(clcsock, (struct sockaddr *)&addrs); ++ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0) ++ goto out_rel; + /* analyze IP specific data of net_device belonging to TCP socket */ + addr6 = (struct sockaddr_in6 *)&addrs; + rcu_read_lock(); +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index c293a558b0d4f..82279dbd2f627 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -600,20 +600,42 @@ static void unix_release_sock(struct sock *sk, int embrion) + + static void init_peercred(struct sock *sk) + { +- put_pid(sk->sk_peer_pid); +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ const struct cred *old_cred; ++ struct pid *old_pid; ++ ++ spin_lock(&sk->sk_peer_lock); ++ old_pid = sk->sk_peer_pid; ++ old_cred = sk->sk_peer_cred; + sk->sk_peer_pid = get_pid(task_tgid(current)); + sk->sk_peer_cred = get_current_cred(); ++ spin_unlock(&sk->sk_peer_lock); ++ ++ put_pid(old_pid); ++ put_cred(old_cred); + } + + static void copy_peercred(struct sock *sk, struct sock *peersk) + { +- put_pid(sk->sk_peer_pid); +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ const struct cred *old_cred; ++ struct pid *old_pid; ++ ++ if (sk < peersk) { ++ spin_lock(&sk->sk_peer_lock); ++ spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING); ++ } else { ++ spin_lock(&peersk->sk_peer_lock); ++ spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING); ++ } ++ old_pid = sk->sk_peer_pid; ++ old_cred = sk->sk_peer_cred; + sk->sk_peer_pid = get_pid(peersk->sk_peer_pid); + sk->sk_peer_cred = get_cred(peersk->sk_peer_cred); ++ ++ spin_unlock(&sk->sk_peer_lock); ++ spin_unlock(&peersk->sk_peer_lock); ++ ++ put_pid(old_pid); ++ put_cred(old_cred); + } + + static int unix_listen(struct socket *sock, int backlog)
