commit: e9e29af500ac424719c257708c498b9bff676738 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Jan 5 12:54:19 2022 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Jan 5 12:54:19 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e9e29af5
Linux patch 5.4.170 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1169_linux-5.4.170.patch | 1469 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1473 insertions(+) diff --git a/0000_README b/0000_README index d8d56e36..75707cd8 100644 --- a/0000_README +++ b/0000_README @@ -719,6 +719,10 @@ Patch: 1168_linux-5.4.169.patch From: http://www.kernel.org Desc: Linux 5.4.169 +Patch: 1169_linux-5.4.170.patch +From: http://www.kernel.org +Desc: Linux 5.4.170 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1169_linux-5.4.170.patch b/1169_linux-5.4.170.patch new file mode 100644 index 00000000..e78f6fa0 --- /dev/null +++ b/1169_linux-5.4.170.patch @@ -0,0 +1,1469 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index e7f71df9daf1c..165abcb656c5b 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1487,6 +1487,8 @@ + architectures force reset to be always executed + i8042.unlock [HW] Unlock (ignore) the keylock + i8042.kbdreset [HW] Reset device connected to KBD port ++ i8042.probe_defer ++ [HW] Allow deferred probing upon i8042 probe errors + + i810= [HW,DRM] + +diff --git a/Makefile b/Makefile +index 151fd24540125..7380354e49513 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 169 ++SUBLEVEL = 170 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 3526bb1488e5e..b5022a7f6bae1 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -613,7 +613,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); + + if (buffer->async_transaction) { +- alloc->free_async_space += size + sizeof(struct binder_buffer); ++ alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, + "%d: binder_free_buf size %zd async free %zd\n", +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 0cfcfb116a03d..5169a38ee47a9 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -149,6 +149,7 @@ config HID_APPLEIR + + config HID_ASUS + tristate "Asus" ++ depends on USB_HID + depends on LEDS_CLASS + depends on ASUS_WMI || ASUS_WMI=n + select POWER_SUPPLY +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index c9ae1895cd48a..7da6ca26a5f56 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -536,6 +536,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo + sizeof(rdwr_arg))) + return -EFAULT; + ++ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0) ++ return -EINVAL; ++ + if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS) + return -EINVAL; + +diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c +index cf7cbcd0c29df..6971412990695 100644 +--- a/drivers/input/joystick/spaceball.c ++++ b/drivers/input/joystick/spaceball.c +@@ -19,6 +19,7 @@ + #include <linux/module.h> + #include <linux/input.h> + #include <linux/serio.h> ++#include <asm/unaligned.h> + + #define DRIVER_DESC "SpaceTec SpaceBall 2003/3003/4000 FLX driver" + +@@ -75,9 +76,15 @@ static void spaceball_process_packet(struct spaceball* spaceball) + + case 'D': /* Ball data */ + if (spaceball->idx != 15) return; +- for (i = 0; i < 6; i++) ++ /* ++ * Skip first three bytes; read six axes worth of data. ++ * Axis values are signed 16-bit big-endian. ++ */ ++ data += 3; ++ for (i = 0; i < ARRAY_SIZE(spaceball_axes); i++) { + input_report_abs(dev, spaceball_axes[i], +- (__s16)((data[2 * i + 3] << 8) | data[2 * i + 2])); ++ (__s16)get_unaligned_be16(&data[i * 2])); ++ } + break; + + case 'K': /* Button data */ +diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c +index 3f06e8a495d80..ff94388416645 100644 +--- a/drivers/input/mouse/appletouch.c ++++ b/drivers/input/mouse/appletouch.c +@@ -916,6 +916,8 @@ static int atp_probe(struct usb_interface *iface, + set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); + set_bit(BTN_LEFT, input_dev->keybit); + ++ INIT_WORK(&dev->work, atp_reinit); ++ + error = input_register_device(dev->input); + if (error) + goto err_free_buffer; +@@ -923,8 +925,6 @@ static int atp_probe(struct usb_interface *iface, + /* save our data pointer in this interface device */ + usb_set_intfdata(iface, dev); + +- INIT_WORK(&dev->work, atp_reinit); +- + return 0; + + err_free_buffer: +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 202e43a6ffae2..0282c4c55e9da 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -995,6 +995,24 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { + { } + }; + ++static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = { ++ { ++ /* ASUS ZenBook UX425UA */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"), ++ }, ++ }, ++ { ++ /* ASUS ZenBook UM325UA */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), ++ }, ++ }, ++ { } ++}; ++ + #endif /* CONFIG_X86 */ + + #ifdef CONFIG_PNP +@@ -1314,6 +1332,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_kbdreset_table)) + i8042_kbdreset = true; + ++ if (dmi_check_system(i8042_dmi_probe_defer_table)) ++ i8042_probe_defer = true; ++ + /* + * A20 was already enabled during early kernel init. But some buggy + * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 6ff6b5710dd4e..bb76ff2f6b1d8 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -44,6 +44,10 @@ static bool i8042_unlock; + module_param_named(unlock, i8042_unlock, bool, 0); + MODULE_PARM_DESC(unlock, "Ignore keyboard lock."); + ++static bool i8042_probe_defer; ++module_param_named(probe_defer, i8042_probe_defer, bool, 0); ++MODULE_PARM_DESC(probe_defer, "Allow deferred probing."); ++ + enum i8042_controller_reset_mode { + I8042_RESET_NEVER, + I8042_RESET_ALWAYS, +@@ -709,7 +713,7 @@ static int i8042_set_mux_mode(bool multiplex, unsigned char *mux_version) + * LCS/Telegraphics. + */ + +-static int __init i8042_check_mux(void) ++static int i8042_check_mux(void) + { + unsigned char mux_version; + +@@ -738,10 +742,10 @@ static int __init i8042_check_mux(void) + /* + * The following is used to test AUX IRQ delivery. + */ +-static struct completion i8042_aux_irq_delivered __initdata; +-static bool i8042_irq_being_tested __initdata; ++static struct completion i8042_aux_irq_delivered; ++static bool i8042_irq_being_tested; + +-static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) ++static irqreturn_t i8042_aux_test_irq(int irq, void *dev_id) + { + unsigned long flags; + unsigned char str, data; +@@ -768,7 +772,7 @@ static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) + * verifies success by readinng CTR. Used when testing for presence of AUX + * port. + */ +-static int __init i8042_toggle_aux(bool on) ++static int i8042_toggle_aux(bool on) + { + unsigned char param; + int i; +@@ -796,7 +800,7 @@ static int __init i8042_toggle_aux(bool on) + * the presence of an AUX interface. + */ + +-static int __init i8042_check_aux(void) ++static int i8042_check_aux(void) + { + int retval = -1; + bool irq_registered = false; +@@ -1003,7 +1007,7 @@ static int i8042_controller_init(void) + + if (i8042_command(&ctr[n++ % 2], I8042_CMD_CTL_RCTR)) { + pr_err("Can't read CTR while initializing i8042\n"); +- return -EIO; ++ return i8042_probe_defer ? -EPROBE_DEFER : -EIO; + } + + } while (n < 2 || ctr[0] != ctr[1]); +@@ -1318,7 +1322,7 @@ static void i8042_shutdown(struct platform_device *dev) + i8042_controller_reset(false); + } + +-static int __init i8042_create_kbd_port(void) ++static int i8042_create_kbd_port(void) + { + struct serio *serio; + struct i8042_port *port = &i8042_ports[I8042_KBD_PORT_NO]; +@@ -1346,7 +1350,7 @@ static int __init i8042_create_kbd_port(void) + return 0; + } + +-static int __init i8042_create_aux_port(int idx) ++static int i8042_create_aux_port(int idx) + { + struct serio *serio; + int port_no = idx < 0 ? I8042_AUX_PORT_NO : I8042_MUX_PORT_NO + idx; +@@ -1383,13 +1387,13 @@ static int __init i8042_create_aux_port(int idx) + return 0; + } + +-static void __init i8042_free_kbd_port(void) ++static void i8042_free_kbd_port(void) + { + kfree(i8042_ports[I8042_KBD_PORT_NO].serio); + i8042_ports[I8042_KBD_PORT_NO].serio = NULL; + } + +-static void __init i8042_free_aux_ports(void) ++static void i8042_free_aux_ports(void) + { + int i; + +@@ -1399,7 +1403,7 @@ static void __init i8042_free_aux_ports(void) + } + } + +-static void __init i8042_register_ports(void) ++static void i8042_register_ports(void) + { + int i; + +@@ -1440,7 +1444,7 @@ static void i8042_free_irqs(void) + i8042_aux_irq_registered = i8042_kbd_irq_registered = false; + } + +-static int __init i8042_setup_aux(void) ++static int i8042_setup_aux(void) + { + int (*aux_enable)(void); + int error; +@@ -1482,7 +1486,7 @@ static int __init i8042_setup_aux(void) + return error; + } + +-static int __init i8042_setup_kbd(void) ++static int i8042_setup_kbd(void) + { + int error; + +@@ -1532,7 +1536,7 @@ static int i8042_kbd_bind_notifier(struct notifier_block *nb, + return 0; + } + +-static int __init i8042_probe(struct platform_device *dev) ++static int i8042_probe(struct platform_device *dev) + { + int error; + +@@ -1597,6 +1601,7 @@ static struct platform_driver i8042_driver = { + .pm = &i8042_pm_ops, + #endif + }, ++ .probe = i8042_probe, + .remove = i8042_remove, + .shutdown = i8042_shutdown, + }; +@@ -1607,7 +1612,6 @@ static struct notifier_block i8042_kbd_bind_notifier_block = { + + static int __init i8042_init(void) + { +- struct platform_device *pdev; + int err; + + dbg_init(); +@@ -1623,17 +1627,29 @@ static int __init i8042_init(void) + /* Set this before creating the dev to allow i8042_command to work right away */ + i8042_present = true; + +- pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); +- if (IS_ERR(pdev)) { +- err = PTR_ERR(pdev); ++ err = platform_driver_register(&i8042_driver); ++ if (err) + goto err_platform_exit; ++ ++ i8042_platform_device = platform_device_alloc("i8042", -1); ++ if (!i8042_platform_device) { ++ err = -ENOMEM; ++ goto err_unregister_driver; + } + ++ err = platform_device_add(i8042_platform_device); ++ if (err) ++ goto err_free_device; ++ + bus_register_notifier(&serio_bus, &i8042_kbd_bind_notifier_block); + panic_blink = i8042_panic_blink; + + return 0; + ++err_free_device: ++ platform_device_put(i8042_platform_device); ++err_unregister_driver: ++ platform_driver_unregister(&i8042_driver); + err_platform_exit: + i8042_platform_exit(); + return err; +diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c +index 47f6fee1f3964..1812434cda847 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -1791,7 +1791,7 @@ static int fman_port_probe(struct platform_device *of_dev) + fman = dev_get_drvdata(&fm_pdev->dev); + if (!fman) { + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + + err = of_property_read_u32(port_node, "cell-index", &val); +@@ -1799,7 +1799,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: reading cell-index for %pOF failed\n", + __func__, port_node); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + port_id = (u8)val; + port->dts_params.id = port_id; +@@ -1833,7 +1833,7 @@ static int fman_port_probe(struct platform_device *of_dev) + } else { + dev_err(port->dev, "%s: Illegal port type\n", __func__); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + + port->dts_params.type = port_type; +@@ -1847,7 +1847,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: incorrect qman-channel-id\n", + __func__); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + port->dts_params.qman_channel_id = qman_channel_id; + } +@@ -1857,7 +1857,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: of_address_to_resource() failed\n", + __func__); + err = -ENOMEM; +- goto return_err; ++ goto put_device; + } + + port->dts_params.fman = fman; +@@ -1882,6 +1882,8 @@ static int fman_port_probe(struct platform_device *of_dev) + + return 0; + ++put_device: ++ put_device(&fm_pdev->dev); + return_err: + of_node_put(port_node); + free_port: +diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c +index 6e504854571cf..94541bf889a23 100644 +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -209,7 +209,7 @@ static int xrx200_hw_receive(struct xrx200_chan *ch) + skb->protocol = eth_type_trans(skb, net_dev); + netif_receive_skb(skb); + net_dev->stats.rx_packets++; +- net_dev->stats.rx_bytes += len - ETH_FCS_LEN; ++ net_dev->stats.rx_bytes += len; + + return 0; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 5f4f0f61c83c8..dea884c94568c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3907,12 +3907,11 @@ static int set_feature_arfs(struct net_device *netdev, bool enable) + + static int mlx5e_handle_feature(struct net_device *netdev, + netdev_features_t *features, +- netdev_features_t wanted_features, + netdev_features_t feature, + mlx5e_feature_handler feature_handler) + { +- netdev_features_t changes = wanted_features ^ netdev->features; +- bool enable = !!(wanted_features & feature); ++ netdev_features_t changes = *features ^ netdev->features; ++ bool enable = !!(*features & feature); + int err; + + if (!(changes & feature)) +@@ -3920,22 +3919,22 @@ static int mlx5e_handle_feature(struct net_device *netdev, + + err = feature_handler(netdev, enable); + if (err) { ++ MLX5E_SET_FEATURE(features, feature, !enable); + netdev_err(netdev, "%s feature %pNF failed, err %d\n", + enable ? "Enable" : "Disable", &feature, err); + return err; + } + +- MLX5E_SET_FEATURE(features, feature, enable); + return 0; + } + + int mlx5e_set_features(struct net_device *netdev, netdev_features_t features) + { +- netdev_features_t oper_features = netdev->features; ++ netdev_features_t oper_features = features; + int err = 0; + + #define MLX5E_HANDLE_FEATURE(feature, handler) \ +- mlx5e_handle_feature(netdev, &oper_features, features, feature, handler) ++ mlx5e_handle_feature(netdev, &oper_features, feature, handler) + + err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro); + err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +index 56bf900eb753f..dbdb6a9592f09 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +@@ -2,6 +2,7 @@ + /* Copyright (c) 2019 Mellanox Technologies. */ + + #include <linux/mlx5/eswitch.h> ++#include <linux/err.h> + #include "dr_types.h" + + static int dr_domain_init_cache(struct mlx5dr_domain *dmn) +@@ -64,9 +65,9 @@ static int dr_domain_init_resources(struct mlx5dr_domain *dmn) + } + + dmn->uar = mlx5_get_uars_page(dmn->mdev); +- if (!dmn->uar) { ++ if (IS_ERR(dmn->uar)) { + mlx5dr_err(dmn, "Couldn't allocate UAR\n"); +- ret = -ENOMEM; ++ ret = PTR_ERR(dmn->uar); + goto clean_pd; + } + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 99ba3551458fc..f9c303d76658a 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -1995,7 +1995,7 @@ static int ionic_lif_init(struct ionic_lif *lif) + return -EINVAL; + } + +- lif->dbid_inuse = bitmap_alloc(lif->dbid_count, GFP_KERNEL); ++ lif->dbid_inuse = bitmap_zalloc(lif->dbid_count, GFP_KERNEL); + if (!lif->dbid_inuse) { + dev_err(dev, "Failed alloc doorbell id bitmap, aborting\n"); + return -ENOMEM; +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index b744c09346a7c..dda051c94fb4d 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -495,11 +495,11 @@ static void read_bulk_callback(struct urb *urb) + goto goon; + + rx_status = buf[count - 2]; +- if (rx_status & 0x1e) { ++ if (rx_status & 0x1c) { + netif_dbg(pegasus, rx_err, net, + "RX packet error %x\n", rx_status); + net->stats.rx_errors++; +- if (rx_status & 0x06) /* long or runt */ ++ if (rx_status & 0x04) /* runt */ + net->stats.rx_length_errors++; + if (rx_status & 0x08) + net->stats.rx_crc_errors++; +diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c +index 23ed11f91213d..6ea59426ab0bf 100644 +--- a/drivers/nfc/st21nfca/i2c.c ++++ b/drivers/nfc/st21nfca/i2c.c +@@ -533,7 +533,8 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); + if (IS_ERR(phy->gpiod_ena)) { + nfc_err(dev, "Unable to get ENABLE GPIO\n"); +- return PTR_ERR(phy->gpiod_ena); ++ r = PTR_ERR(phy->gpiod_ena); ++ goto out_free; + } + + phy->se_status.is_ese_present = +@@ -544,7 +545,7 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + r = st21nfca_hci_platform_init(phy); + if (r < 0) { + nfc_err(&client->dev, "Unable to reboot st21nfca\n"); +- return r; ++ goto out_free; + } + + r = devm_request_threaded_irq(&client->dev, client->irq, NULL, +@@ -553,15 +554,23 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + ST21NFCA_HCI_DRIVER_NAME, phy); + if (r < 0) { + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +- return r; ++ goto out_free; + } + +- return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, +- ST21NFCA_FRAME_HEADROOM, +- ST21NFCA_FRAME_TAILROOM, +- ST21NFCA_HCI_LLC_MAX_PAYLOAD, +- &phy->hdev, +- &phy->se_status); ++ r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, ++ ST21NFCA_FRAME_HEADROOM, ++ ST21NFCA_FRAME_TAILROOM, ++ ST21NFCA_HCI_LLC_MAX_PAYLOAD, ++ &phy->hdev, ++ &phy->se_status); ++ if (r) ++ goto out_free; ++ ++ return 0; ++ ++out_free: ++ kfree_skb(phy->pending_skb); ++ return r; + } + + static int st21nfca_hci_i2c_remove(struct i2c_client *client) +@@ -574,6 +583,8 @@ static int st21nfca_hci_i2c_remove(struct i2c_client *client) + + if (phy->powered) + st21nfca_hci_i2c_disable(phy); ++ if (phy->pending_skb) ++ kfree_skb(phy->pending_skb); + + return 0; + } +diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c +index 7e3083deb1c5d..1b86005c0f5f4 100644 +--- a/drivers/platform/x86/apple-gmux.c ++++ b/drivers/platform/x86/apple-gmux.c +@@ -625,7 +625,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + } + + gmux_data->iostart = res->start; +- gmux_data->iolen = res->end - res->start; ++ gmux_data->iolen = resource_size(res); + + if (gmux_data->iolen < GMUX_MIN_IO_LEN) { + pr_err("gmux I/O region too small (%lu < %u)\n", +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index 3c9248d2435e1..e15bb3dfe9956 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2757,8 +2757,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > 63) ++ nbytes = 63; + + memset(mybuf, 0, sizeof(mybuf)); + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 0ac342b1deb95..0370ff6dd2efd 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -578,9 +578,12 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + * Commands like INQUIRY may transfer less data than + * requested by the initiator via bufflen. Set residual + * count to make upper layer aware of the actual amount +- * of data returned. ++ * of data returned. There are cases when controller ++ * returns zero dataLen with non zero data - do not set ++ * residual count in that case. + */ +- scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); ++ if (e->dataLen && (e->dataLen < scsi_bufflen(cmd))) ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); + cmd->result = (DID_OK << 16); + break; + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index d6491e973fa4c..0d5ae80530498 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -1,26 +1,18 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2015-2016, Linaro Limited ++ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited + */ ++#include <linux/anon_inodes.h> + #include <linux/device.h> +-#include <linux/dma-buf.h> +-#include <linux/fdtable.h> + #include <linux/idr.h> ++#include <linux/mm.h> + #include <linux/sched.h> + #include <linux/slab.h> + #include <linux/tee_drv.h> + #include "tee_private.h" + +-static void tee_shm_release(struct tee_shm *shm) ++static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) + { +- struct tee_device *teedev = shm->teedev; +- +- mutex_lock(&teedev->mutex); +- idr_remove(&teedev->idr, shm->id); +- if (shm->ctx) +- list_del(&shm->link); +- mutex_unlock(&teedev->mutex); +- + if (shm->flags & TEE_SHM_POOL) { + struct tee_shm_pool_mgr *poolm; + +@@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm) + tee_device_put(teedev); + } + +-static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment +- *attach, enum dma_data_direction dir) +-{ +- return NULL; +-} +- +-static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach, +- struct sg_table *table, +- enum dma_data_direction dir) +-{ +-} +- +-static void tee_shm_op_release(struct dma_buf *dmabuf) +-{ +- struct tee_shm *shm = dmabuf->priv; +- +- tee_shm_release(shm); +-} +- +-static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) +-{ +- return NULL; +-} +- +-static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) +-{ +- struct tee_shm *shm = dmabuf->priv; +- size_t size = vma->vm_end - vma->vm_start; +- +- /* Refuse sharing shared memory provided by application */ +- if (shm->flags & TEE_SHM_REGISTER) +- return -EINVAL; +- +- return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, +- size, vma->vm_page_prot); +-} +- +-static const struct dma_buf_ops tee_shm_dma_buf_ops = { +- .map_dma_buf = tee_shm_op_map_dma_buf, +- .unmap_dma_buf = tee_shm_op_unmap_dma_buf, +- .release = tee_shm_op_release, +- .map = tee_shm_op_map, +- .mmap = tee_shm_op_mmap, +-}; +- + static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + struct tee_device *teedev, + size_t size, u32 flags) +@@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + goto err_dev_put; + } + ++ refcount_set(&shm->refcount, 1); + shm->flags = flags | TEE_SHM_POOL; + shm->teedev = teedev; + shm->ctx = ctx; +@@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + goto err_pool_free; + } + +- if (flags & TEE_SHM_DMA_BUF) { +- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); +- +- exp_info.ops = &tee_shm_dma_buf_ops; +- exp_info.size = shm->size; +- exp_info.flags = O_RDWR; +- exp_info.priv = shm; +- +- shm->dmabuf = dma_buf_export(&exp_info); +- if (IS_ERR(shm->dmabuf)) { +- ret = ERR_CAST(shm->dmabuf); +- goto err_rem; +- } +- } +- + if (ctx) { + teedev_ctx_get(ctx); + mutex_lock(&teedev->mutex); +@@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + } + + return shm; +-err_rem: +- mutex_lock(&teedev->mutex); +- idr_remove(&teedev->idr, shm->id); +- mutex_unlock(&teedev->mutex); + err_pool_free: + poolm->ops->free(poolm, shm); + err_kfree: +@@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, + goto err; + } + ++ refcount_set(&shm->refcount, 1); + shm->flags = flags | TEE_SHM_REGISTER; + shm->teedev = teedev; + shm->ctx = ctx; +@@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, + goto err; + } + +- if (flags & TEE_SHM_DMA_BUF) { +- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); +- +- exp_info.ops = &tee_shm_dma_buf_ops; +- exp_info.size = shm->size; +- exp_info.flags = O_RDWR; +- exp_info.priv = shm; +- +- shm->dmabuf = dma_buf_export(&exp_info); +- if (IS_ERR(shm->dmabuf)) { +- ret = ERR_CAST(shm->dmabuf); +- teedev->desc->ops->shm_unregister(ctx, shm); +- goto err; +- } +- } +- + mutex_lock(&teedev->mutex); + list_add_tail(&shm->link, &ctx->list_shm); + mutex_unlock(&teedev->mutex); +@@ -352,6 +266,35 @@ err: + } + EXPORT_SYMBOL_GPL(tee_shm_register); + ++static int tee_shm_fop_release(struct inode *inode, struct file *filp) ++{ ++ tee_shm_put(filp->private_data); ++ return 0; ++} ++ ++static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma) ++{ ++ struct tee_shm *shm = filp->private_data; ++ size_t size = vma->vm_end - vma->vm_start; ++ ++ /* Refuse sharing shared memory provided by application */ ++ if (shm->flags & TEE_SHM_USER_MAPPED) ++ return -EINVAL; ++ ++ /* check for overflowing the buffer's size */ ++ if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT) ++ return -EINVAL; ++ ++ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, ++ size, vma->vm_page_prot); ++} ++ ++static const struct file_operations tee_shm_fops = { ++ .owner = THIS_MODULE, ++ .release = tee_shm_fop_release, ++ .mmap = tee_shm_fop_mmap, ++}; ++ + /** + * tee_shm_get_fd() - Increase reference count and return file descriptor + * @shm: Shared memory handle +@@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm) + if (!(shm->flags & TEE_SHM_DMA_BUF)) + return -EINVAL; + +- get_dma_buf(shm->dmabuf); +- fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); ++ /* matched by tee_shm_put() in tee_shm_op_release() */ ++ refcount_inc(&shm->refcount); ++ fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR); + if (fd < 0) +- dma_buf_put(shm->dmabuf); ++ tee_shm_put(shm); + return fd; + } + +@@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm) + */ + void tee_shm_free(struct tee_shm *shm) + { +- /* +- * dma_buf_put() decreases the dmabuf reference counter and will +- * call tee_shm_release() when the last reference is gone. +- * +- * In the case of driver private memory we call tee_shm_release +- * directly instead as it doesn't have a reference counter. +- */ +- if (shm->flags & TEE_SHM_DMA_BUF) +- dma_buf_put(shm->dmabuf); +- else +- tee_shm_release(shm); ++ tee_shm_put(shm); + } + EXPORT_SYMBOL_GPL(tee_shm_free); + +@@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id) + teedev = ctx->teedev; + mutex_lock(&teedev->mutex); + shm = idr_find(&teedev->idr, id); ++ /* ++ * If the tee_shm was found in the IDR it must have a refcount ++ * larger than 0 due to the guarantee in tee_shm_put() below. So ++ * it's safe to use refcount_inc(). ++ */ + if (!shm || shm->ctx != ctx) + shm = ERR_PTR(-EINVAL); +- else if (shm->flags & TEE_SHM_DMA_BUF) +- get_dma_buf(shm->dmabuf); ++ else ++ refcount_inc(&shm->refcount); + mutex_unlock(&teedev->mutex); + return shm; + } +@@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- if (shm->flags & TEE_SHM_DMA_BUF) +- dma_buf_put(shm->dmabuf); ++ struct tee_device *teedev = shm->teedev; ++ bool do_release = false; ++ ++ mutex_lock(&teedev->mutex); ++ if (refcount_dec_and_test(&shm->refcount)) { ++ /* ++ * refcount has reached 0, we must now remove it from the ++ * IDR before releasing the mutex. This will guarantee that ++ * the refcount_inc() in tee_shm_get_from_id() never starts ++ * from 0. ++ */ ++ idr_remove(&teedev->idr, shm->id); ++ if (shm->ctx) ++ list_del(&shm->link); ++ do_release = true; ++ } ++ mutex_unlock(&teedev->mutex); ++ ++ if (do_release) ++ tee_shm_release(teedev, shm); + } + EXPORT_SYMBOL_GPL(tee_shm_put); +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 94ccf43368dfc..3f5c21f7f9905 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1791,11 +1791,15 @@ static void ffs_data_clear(struct ffs_data *ffs) + + BUG_ON(ffs->gadget); + +- if (ffs->epfiles) ++ if (ffs->epfiles) { + ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); ++ ffs->epfiles = NULL; ++ } + +- if (ffs->ffs_eventfd) ++ if (ffs->ffs_eventfd) { + eventfd_ctx_put(ffs->ffs_eventfd); ++ ffs->ffs_eventfd = NULL; ++ } + + kfree(ffs->raw_descs_data); + kfree(ffs->raw_strings); +@@ -1808,7 +1812,6 @@ static void ffs_data_reset(struct ffs_data *ffs) + + ffs_data_clear(ffs); + +- ffs->epfiles = NULL; + ffs->raw_descs_data = NULL; + ffs->raw_descs = NULL; + ffs->raw_strings = NULL; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index ded05c39e4d1c..e7533787db411 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -108,7 +108,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + /* Look for vendor-specific quirks */ + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && + (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK || +- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 || + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) { + if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK && + pdev->revision == 0x0) { +@@ -143,6 +142,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) + xhci->quirks |= XHCI_BROKEN_STREAMS; + ++ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && ++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100) ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ + if (pdev->vendor == PCI_VENDOR_ID_NEC) + xhci->quirks |= XHCI_NEC_HOST; + +diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c +index 619c4598e64ea..253c8b71d3c49 100644 +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -100,6 +100,13 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) + interval = clamp_val(interval, 1, 16) - 1; + mult = usb_endpoint_maxp_mult(desc) - 1; + } ++ break; ++ case USB_SPEED_FULL: ++ if (usb_endpoint_xfer_isoc(desc)) ++ interval = clamp_val(desc->bInterval, 1, 16); ++ else if (usb_endpoint_xfer_int(desc)) ++ interval = clamp_val(desc->bInterval, 1, 255); ++ + break; + default: + break; /*others are ignored */ +@@ -245,6 +252,7 @@ struct usb_request *mtu3_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) + mreq->request.dma = DMA_ADDR_INVALID; + mreq->epnum = mep->epnum; + mreq->mep = mep; ++ INIT_LIST_HEAD(&mreq->list); + trace_mtu3_alloc_request(mreq); + + return &mreq->request; +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 3f414f91b5899..2ea3157ddb6e2 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -273,6 +273,8 @@ static int mtu3_prepare_tx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) + gpd->dw3_info |= cpu_to_le32(GPD_EXT_FLAG_ZLP); + } + ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); + + mreq->gpd = gpd; +@@ -306,6 +308,8 @@ static int mtu3_prepare_rx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) + gpd->next_gpd = cpu_to_le32(lower_32_bits(enq_dma)); + ext_addr |= GPD_EXT_NGP(mtu, upper_32_bits(enq_dma)); + gpd->dw3_info = cpu_to_le32(ext_addr); ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); + + mreq->gpd = gpd; +@@ -445,7 +449,8 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) + return; + } + mtu3_setbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_TXPKTRDY); +- ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + /* by pass the current GDP */ + gpd_current->dw0_info |= cpu_to_le32(GPD_FLAGS_BPS | GPD_FLAGS_HWO); + +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index f491690d54c6c..64b971b2542d6 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -351,8 +351,8 @@ phys_addr_t memblock_phys_alloc_range(phys_addr_t size, phys_addr_t align, + phys_addr_t start, phys_addr_t end); + phys_addr_t memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid); + +-static inline phys_addr_t memblock_phys_alloc(phys_addr_t size, +- phys_addr_t align) ++static __always_inline phys_addr_t memblock_phys_alloc(phys_addr_t size, ++ phys_addr_t align) + { + return memblock_phys_alloc_range(size, align, 0, + MEMBLOCK_ALLOC_ACCESSIBLE); +diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h +index cd15c1b7fae06..e08ace76eba6a 100644 +--- a/include/linux/tee_drv.h ++++ b/include/linux/tee_drv.h +@@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev); + * @offset: offset of buffer in user space + * @pages: locked pages from userspace + * @num_pages: number of locked pages +- * @dmabuf: dmabuf used to for exporting to user space ++ * @refcount: reference counter + * @flags: defined by TEE_SHM_* in tee_drv.h + * @id: unique id of a shared memory object on this device + * +@@ -195,7 +195,7 @@ struct tee_shm { + unsigned int offset; + struct page **pages; + size_t num_pages; +- struct dma_buf *dmabuf; ++ refcount_t refcount; + u32 flags; + int id; + }; +diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h +index 3ab5c6bbb90bd..35c108a6b8720 100644 +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -103,6 +103,7 @@ extern struct percpu_counter sctp_sockets_allocated; + int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *); + struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *); + ++typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *); + void sctp_transport_walk_start(struct rhashtable_iter *iter); + void sctp_transport_walk_stop(struct rhashtable_iter *iter); + struct sctp_transport *sctp_transport_get_next(struct net *net, +@@ -113,9 +114,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), + struct net *net, + const union sctp_addr *laddr, + const union sctp_addr *paddr, void *p); +-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), +- int (*cb_done)(struct sctp_transport *, void *), +- struct net *net, int *pos, void *p); ++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, ++ struct net *net, int *pos, void *p); + int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); + int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, + struct sctp_info *info); +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index fd7c3f76040c3..cb05e503c9cd1 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -1345,6 +1345,7 @@ struct sctp_endpoint { + + u32 secid; + u32 peer_secid; ++ struct rcu_head rcu; + }; + + /* Recover the outter endpoint structure. */ +@@ -1360,7 +1361,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base) + struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t); + void sctp_endpoint_free(struct sctp_endpoint *); + void sctp_endpoint_put(struct sctp_endpoint *); +-void sctp_endpoint_hold(struct sctp_endpoint *); ++int sctp_endpoint_hold(struct sctp_endpoint *ep); + void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *); + struct sctp_association *sctp_endpoint_lookup_assoc( + const struct sctp_endpoint *ep, +diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h +index f6e3c8c9c7449..4fa4e979e948a 100644 +--- a/include/uapi/linux/nfc.h ++++ b/include/uapi/linux/nfc.h +@@ -263,7 +263,7 @@ enum nfc_sdp_attr { + #define NFC_SE_ENABLED 0x1 + + struct sockaddr_nfc { +- sa_family_t sa_family; ++ __kernel_sa_family_t sa_family; + __u32 dev_idx; + __u32 target_idx; + __u32 nfc_protocol; +@@ -271,14 +271,14 @@ struct sockaddr_nfc { + + #define NFC_LLCP_MAX_SERVICE_NAME 63 + struct sockaddr_nfc_llcp { +- sa_family_t sa_family; ++ __kernel_sa_family_t sa_family; + __u32 dev_idx; + __u32 target_idx; + __u32 nfc_protocol; + __u8 dsap; /* Destination SAP, if known */ + __u8 ssap; /* Source SAP to be bound to */ + char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */; +- size_t service_name_len; ++ __kernel_size_t service_name_len; + }; + + /* NFC socket protocols */ +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 70f92aaca4110..c800220c404d5 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1974,6 +1974,10 @@ static int __init inet_init(void) + + ip_init(); + ++ /* Initialise per-cpu ipv4 mibs */ ++ if (init_ipv4_mibs()) ++ panic("%s: Cannot init ipv4 mibs\n", __func__); ++ + /* Setup TCP slab cache for open requests. */ + tcp_init(); + +@@ -2004,12 +2008,6 @@ static int __init inet_init(void) + + if (init_inet_pernet_ops()) + pr_crit("%s: Cannot init ipv4 inet pernet ops\n", __func__); +- /* +- * Initialise per-cpu ipv4 mibs +- */ +- +- if (init_ipv4_mibs()) +- pr_crit("%s: Cannot init ipv4 mibs\n", __func__); + + ipv4_proc_init(); + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 818fc99756256..a71bfa5b02770 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1132,7 +1132,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, + kfree_skb(skb); + return -EINVAL; + } +- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) { ++ if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) { + kfree_skb(skb); + return -EINVAL; + } +diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c +index a33ea45dec054..27700887c3217 100644 +--- a/net/ncsi/ncsi-netlink.c ++++ b/net/ncsi/ncsi-netlink.c +@@ -112,7 +112,11 @@ static int ncsi_write_package_info(struct sk_buff *skb, + pnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR); + if (!pnest) + return -ENOMEM; +- nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); ++ rc = nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); ++ if (rc) { ++ nla_nest_cancel(skb, pnest); ++ return rc; ++ } + if ((0x1 << np->id) == ndp->package_whitelist) + nla_put_flag(skb, NCSI_PKG_ATTR_FORCED); + cnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR_CHANNEL_LIST); +diff --git a/net/sctp/diag.c b/net/sctp/diag.c +index ba9f64fdfd238..7921e77fa55a3 100644 +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -292,9 +292,8 @@ out: + return err; + } + +-static int sctp_sock_dump(struct sctp_transport *tsp, void *p) ++static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) + { +- struct sctp_endpoint *ep = tsp->asoc->ep; + struct sctp_comm_param *commp = p; + struct sock *sk = ep->base.sk; + struct sk_buff *skb = commp->skb; +@@ -304,6 +303,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) + int err = 0; + + lock_sock(sk); ++ if (ep != tsp->asoc->ep) ++ goto release; + list_for_each_entry(assoc, &ep->asocs, asocs) { + if (cb->args[4] < cb->args[1]) + goto next; +@@ -346,9 +347,8 @@ release: + return err; + } + +-static int sctp_sock_filter(struct sctp_transport *tsp, void *p) ++static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) + { +- struct sctp_endpoint *ep = tsp->asoc->ep; + struct sctp_comm_param *commp = p; + struct sock *sk = ep->base.sk; + const struct inet_diag_req_v2 *r = commp->r; +@@ -506,8 +506,8 @@ skip: + if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE))) + goto done; + +- sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump, +- net, &pos, &commp); ++ sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump, ++ net, &pos, &commp); + cb->args[2] = pos; + + done: +diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c +index 3067deb0fbec1..665a22d5c725b 100644 +--- a/net/sctp/endpointola.c ++++ b/net/sctp/endpointola.c +@@ -184,6 +184,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep) + } + + /* Final destructor for endpoint. */ ++static void sctp_endpoint_destroy_rcu(struct rcu_head *head) ++{ ++ struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu); ++ struct sock *sk = ep->base.sk; ++ ++ sctp_sk(sk)->ep = NULL; ++ sock_put(sk); ++ ++ kfree(ep); ++ SCTP_DBG_OBJCNT_DEC(ep); ++} ++ + static void sctp_endpoint_destroy(struct sctp_endpoint *ep) + { + struct sock *sk; +@@ -213,18 +225,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) + if (sctp_sk(sk)->bind_hash) + sctp_put_port(sk); + +- sctp_sk(sk)->ep = NULL; +- /* Give up our hold on the sock */ +- sock_put(sk); +- +- kfree(ep); +- SCTP_DBG_OBJCNT_DEC(ep); ++ call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu); + } + + /* Hold a reference to an endpoint. */ +-void sctp_endpoint_hold(struct sctp_endpoint *ep) ++int sctp_endpoint_hold(struct sctp_endpoint *ep) + { +- refcount_inc(&ep->base.refcnt); ++ return refcount_inc_not_zero(&ep->base.refcnt); + } + + /* Release a reference to an endpoint and clean up if there are +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 2146372adff43..565aa77fe5cbe 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5395,11 +5395,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), + } + EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); + +-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), +- int (*cb_done)(struct sctp_transport *, void *), +- struct net *net, int *pos, void *p) { ++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, ++ struct net *net, int *pos, void *p) ++{ + struct rhashtable_iter hti; + struct sctp_transport *tsp; ++ struct sctp_endpoint *ep; + int ret; + + again: +@@ -5408,26 +5409,32 @@ again: + + tsp = sctp_transport_get_idx(net, &hti, *pos + 1); + for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { +- ret = cb(tsp, p); +- if (ret) +- break; ++ ep = tsp->asoc->ep; ++ if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ ++ ret = cb(ep, tsp, p); ++ if (ret) ++ break; ++ sctp_endpoint_put(ep); ++ } + (*pos)++; + sctp_transport_put(tsp); + } + sctp_transport_walk_stop(&hti); + + if (ret) { +- if (cb_done && !cb_done(tsp, p)) { ++ if (cb_done && !cb_done(ep, tsp, p)) { + (*pos)++; ++ sctp_endpoint_put(ep); + sctp_transport_put(tsp); + goto again; + } ++ sctp_endpoint_put(ep); + sctp_transport_put(tsp); + } + + return ret; + } +-EXPORT_SYMBOL_GPL(sctp_for_each_transport); ++EXPORT_SYMBOL_GPL(sctp_transport_traverse_process); + + /* 7.2.1 Association Status (SCTP_STATUS) + +diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl +index a4ca050815aba..dc1d3696af6b8 100755 +--- a/scripts/recordmcount.pl ++++ b/scripts/recordmcount.pl +@@ -252,7 +252,7 @@ if ($arch eq "x86_64") { + + } elsif ($arch eq "s390" && $bits == 64) { + if ($cc =~ /-DCC_USING_HOTPATCH/) { +- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; ++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(brcl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; + $mcount_adjust = 0; + } else { + $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$"; +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 8b9cbe1e8ee22..91f2ba0b225b7 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5734,7 +5734,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, + struct common_audit_data ad; + struct lsm_network_audit net = {0,}; + char *addrp; +- u8 proto; ++ u8 proto = 0; + + if (sk == NULL) + return NF_ACCEPT; +diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c +index eba0b3395851e..861fc6f4ebfb7 100644 +--- a/security/tomoyo/util.c ++++ b/security/tomoyo/util.c +@@ -1029,6 +1029,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) + return false; + if (!domain) + return true; ++ if (READ_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED])) ++ return false; + list_for_each_entry_rcu(ptr, &domain->acl_info_list, list, + srcu_read_lock_held(&tomoyo_ss)) { + u16 perm; +@@ -1074,14 +1076,12 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) + if (count < tomoyo_profile(domain->ns, domain->profile)-> + pref[TOMOYO_PREF_MAX_LEARNING_ENTRY]) + return true; +- if (!domain->flags[TOMOYO_DIF_QUOTA_WARNED]) { +- domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true; +- /* r->granted = false; */ +- tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); ++ WRITE_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED], true); ++ /* r->granted = false; */ ++ tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); + #ifndef CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING +- pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", +- domain->domainname->name); ++ pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", ++ domain->domainname->name); + #endif +- } + return false; + } +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 3a169a026635d..bbf1f2d3387e3 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2308,7 +2308,7 @@ static int process_switch_event(struct perf_tool *tool, + if (perf_event__process_switch(tool, event, sample, machine) < 0) + return -1; + +- if (scripting_ops && scripting_ops->process_switch) ++ if (scripting_ops && scripting_ops->process_switch && !filter_cpu(sample)) + scripting_ops->process_switch(event, sample, machine); + + if (!script->show_switch_events) +diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c +index c66da6ffd6d8d..7badaf215de28 100644 +--- a/tools/testing/selftests/net/udpgso.c ++++ b/tools/testing/selftests/net/udpgso.c +@@ -156,13 +156,13 @@ struct testcase testcases_v4[] = { + }, + { + /* send max number of min sized segments */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, ++ .tlen = UDP_MAX_SEGMENTS, + .gso_len = 1, +- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, ++ .r_num_mss = UDP_MAX_SEGMENTS, + }, + { + /* send max number + 1 of min sized segments: fail */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4 + 1, ++ .tlen = UDP_MAX_SEGMENTS + 1, + .gso_len = 1, + .tfail = true, + }, +@@ -259,13 +259,13 @@ struct testcase testcases_v6[] = { + }, + { + /* send max number of min sized segments */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, ++ .tlen = UDP_MAX_SEGMENTS, + .gso_len = 1, +- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, ++ .r_num_mss = UDP_MAX_SEGMENTS, + }, + { + /* send max number + 1 of min sized segments: fail */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6 + 1, ++ .tlen = UDP_MAX_SEGMENTS + 1, + .gso_len = 1, + .tfail = true, + }, +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index 17512a43885e7..f1fdaa2702913 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -419,6 +419,7 @@ static void usage(const char *filepath) + + static void parse_opts(int argc, char **argv) + { ++ const char *bind_addr = NULL; + int max_len, hdrlen; + int c; + +@@ -446,7 +447,7 @@ static void parse_opts(int argc, char **argv) + cfg_cpu = strtol(optarg, NULL, 0); + break; + case 'D': +- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr); ++ bind_addr = optarg; + break; + case 'l': + cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; +@@ -492,6 +493,11 @@ static void parse_opts(int argc, char **argv) + } + } + ++ if (!bind_addr) ++ bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0"; ++ ++ setup_sockaddr(cfg_family, bind_addr, &cfg_dst_addr); ++ + if (optind != argc) + usage(argv[0]); +
