commit: 58da917df6c081d008c375242fe5a8a37ee8b812 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Feb 9 12:34:50 2023 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Feb 9 12:34:50 2023 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=58da917d
Linux patch 5.15.93 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1092_linux-5.15.93.patch | 3859 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3863 insertions(+) diff --git a/0000_README b/0000_README index 8cd1d43a..51919145 100644 --- a/0000_README +++ b/0000_README @@ -411,6 +411,10 @@ Patch: 1091_linux-5.15.92.patch From: http://www.kernel.org Desc: Linux 5.15.92 +Patch: 1092_linux-5.15.93.patch +From: http://www.kernel.org +Desc: Linux 5.15.93 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1092_linux-5.15.93.patch b/1092_linux-5.15.93.patch new file mode 100644 index 00000000..7a6702d4 --- /dev/null +++ b/1092_linux-5.15.93.patch @@ -0,0 +1,3859 @@ +diff --git a/Makefile b/Makefile +index 13f41e4462941..cea0bf97fd59d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 15 +-SUBLEVEL = 92 ++SUBLEVEL = 93 + EXTRAVERSION = + NAME = Trick or Treat + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +index a003e6af33533..56271abfb7e09 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h ++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +@@ -601,7 +601,7 @@ + #define MX8MM_IOMUXC_UART1_RXD_GPIO5_IO22 0x234 0x49C 0x000 0x5 0x0 + #define MX8MM_IOMUXC_UART1_RXD_TPSMP_HDATA24 0x234 0x49C 0x000 0x7 0x0 + #define MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX 0x238 0x4A0 0x000 0x0 0x0 +-#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x0 ++#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x1 + #define MX8MM_IOMUXC_UART1_TXD_ECSPI3_MOSI 0x238 0x4A0 0x000 0x1 0x0 + #define MX8MM_IOMUXC_UART1_TXD_GPIO5_IO23 0x238 0x4A0 0x000 0x5 0x0 + #define MX8MM_IOMUXC_UART1_TXD_TPSMP_HDATA25 0x238 0x4A0 0x000 0x7 0x0 +diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c +index 7034227dbdf32..8e5a906df9175 100644 +--- a/arch/parisc/kernel/firmware.c ++++ b/arch/parisc/kernel/firmware.c +@@ -1230,7 +1230,7 @@ static char __attribute__((aligned(64))) iodc_dbuf[4096]; + */ + int pdc_iodc_print(const unsigned char *str, unsigned count) + { +- unsigned int i; ++ unsigned int i, found = 0; + unsigned long flags; + + for (i = 0; i < count;) { +@@ -1239,6 +1239,7 @@ int pdc_iodc_print(const unsigned char *str, unsigned count) + iodc_dbuf[i+0] = '\r'; + iodc_dbuf[i+1] = '\n'; + i += 2; ++ found = 1; + goto print; + default: + iodc_dbuf[i] = str[i]; +@@ -1255,7 +1256,7 @@ print: + __pa(iodc_retbuf), 0, __pa(iodc_dbuf), i, 0); + spin_unlock_irqrestore(&pdc_lock, flags); + +- return i; ++ return i - found; + } + + #if !defined(BOOTLOADER) +diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c +index 65de6c4c9354d..b9398e805978d 100644 +--- a/arch/parisc/kernel/ptrace.c ++++ b/arch/parisc/kernel/ptrace.c +@@ -127,6 +127,12 @@ long arch_ptrace(struct task_struct *child, long request, + unsigned long tmp; + long ret = -EIO; + ++ unsigned long user_regs_struct_size = sizeof(struct user_regs_struct); ++#ifdef CONFIG_64BIT ++ if (is_compat_task()) ++ user_regs_struct_size /= 2; ++#endif ++ + switch (request) { + + /* Read the word at location addr in the USER area. For ptraced +@@ -182,14 +188,14 @@ long arch_ptrace(struct task_struct *child, long request, + return copy_regset_to_user(child, + task_user_regset_view(current), + REGSET_GENERAL, +- 0, sizeof(struct user_regs_struct), ++ 0, user_regs_struct_size, + datap); + + case PTRACE_SETREGS: /* Set all gp regs in the child. */ + return copy_regset_from_user(child, + task_user_regset_view(current), + REGSET_GENERAL, +- 0, sizeof(struct user_regs_struct), ++ 0, user_regs_struct_size, + datap); + + case PTRACE_GETFPREGS: /* Get the child FPU state. */ +@@ -303,6 +309,11 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + } + } + break; ++ case PTRACE_GETREGS: ++ case PTRACE_SETREGS: ++ case PTRACE_GETFPREGS: ++ case PTRACE_SETFPREGS: ++ return arch_ptrace(child, request, addr, data); + + default: + ret = compat_ptrace_request(child, request, addr, data); +diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c +index 6ec93eec03ea2..b8a100b9736c7 100644 +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -21,7 +21,7 @@ + * Used to avoid races in counting the nest-pmu units during hotplug + * register and unregister + */ +-static DEFINE_SPINLOCK(nest_init_lock); ++static DEFINE_MUTEX(nest_init_lock); + static DEFINE_PER_CPU(struct imc_pmu_ref *, local_nest_imc_refc); + static struct imc_pmu **per_nest_pmu_arr; + static cpumask_t nest_imc_cpumask; +@@ -1622,7 +1622,7 @@ static void imc_common_mem_free(struct imc_pmu *pmu_ptr) + static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr) + { + if (pmu_ptr->domain == IMC_DOMAIN_NEST) { +- spin_lock(&nest_init_lock); ++ mutex_lock(&nest_init_lock); + if (nest_pmus == 1) { + cpuhp_remove_state(CPUHP_AP_PERF_POWERPC_NEST_IMC_ONLINE); + kfree(nest_imc_refc); +@@ -1632,7 +1632,7 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr) + + if (nest_pmus > 0) + nest_pmus--; +- spin_unlock(&nest_init_lock); ++ mutex_unlock(&nest_init_lock); + } + + /* Free core_imc memory */ +@@ -1789,11 +1789,11 @@ int init_imc_pmu(struct device_node *parent, struct imc_pmu *pmu_ptr, int pmu_id + * rest. To handle the cpuhotplug callback unregister, we track + * the number of nest pmus in "nest_pmus". + */ +- spin_lock(&nest_init_lock); ++ mutex_lock(&nest_init_lock); + if (nest_pmus == 0) { + ret = init_nest_pmu_ref(); + if (ret) { +- spin_unlock(&nest_init_lock); ++ mutex_unlock(&nest_init_lock); + kfree(per_nest_pmu_arr); + per_nest_pmu_arr = NULL; + goto err_free_mem; +@@ -1801,7 +1801,7 @@ int init_imc_pmu(struct device_node *parent, struct imc_pmu *pmu_ptr, int pmu_id + /* Register for cpu hotplug notification. */ + ret = nest_pmu_cpumask_init(); + if (ret) { +- spin_unlock(&nest_init_lock); ++ mutex_unlock(&nest_init_lock); + kfree(nest_imc_refc); + kfree(per_nest_pmu_arr); + per_nest_pmu_arr = NULL; +@@ -1809,7 +1809,7 @@ int init_imc_pmu(struct device_node *parent, struct imc_pmu *pmu_ptr, int pmu_id + } + } + nest_pmus++; +- spin_unlock(&nest_init_lock); ++ mutex_unlock(&nest_init_lock); + break; + case IMC_DOMAIN_CORE: + ret = core_imc_pmu_cpumask_init(); +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index dc77857ca27db..337a686f941b5 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -76,6 +76,9 @@ ifeq ($(CONFIG_PERF_EVENTS),y) + KBUILD_CFLAGS += -fno-omit-frame-pointer + endif + ++# Avoid generating .eh_frame sections. ++KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables ++ + KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax) + KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index 00088dc6da4b6..125241ce82d6a 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -46,6 +46,21 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + ++static bool __kprobes arch_check_kprobe(struct kprobe *p) ++{ ++ unsigned long tmp = (unsigned long)p->addr - p->offset; ++ unsigned long addr = (unsigned long)p->addr; ++ ++ while (tmp <= addr) { ++ if (tmp == addr) ++ return true; ++ ++ tmp += GET_INSN_LENGTH(*(u16 *)tmp); ++ } ++ ++ return false; ++} ++ + int __kprobes arch_prepare_kprobe(struct kprobe *p) + { + unsigned long probe_addr = (unsigned long)p->addr; +@@ -56,6 +71,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + return -EINVAL; + } + ++ if (!arch_check_kprobe(p)) ++ return -EILSEQ; ++ + /* copy instruction */ + p->opcode = *p->addr; + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index f36fda2672e04..b70e1522a27ac 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -6109,6 +6109,7 @@ __init int intel_pmu_init(void) + break; + + case INTEL_FAM6_SAPPHIRERAPIDS_X: ++ case INTEL_FAM6_EMERALDRAPIDS_X: + pmem = true; + x86_pmu.late_ack = true; + memcpy(hw_cache_event_ids, spr_hw_cache_event_ids, sizeof(hw_cache_event_ids)); +diff --git a/arch/x86/include/asm/debugreg.h b/arch/x86/include/asm/debugreg.h +index cfdf307ddc012..9ed8343c9b3cb 100644 +--- a/arch/x86/include/asm/debugreg.h ++++ b/arch/x86/include/asm/debugreg.h +@@ -39,7 +39,20 @@ static __always_inline unsigned long native_get_debugreg(int regno) + asm("mov %%db6, %0" :"=r" (val)); + break; + case 7: +- asm("mov %%db7, %0" :"=r" (val)); ++ /* ++ * Apply __FORCE_ORDER to DR7 reads to forbid re-ordering them ++ * with other code. ++ * ++ * This is needed because a DR7 access can cause a #VC exception ++ * when running under SEV-ES. Taking a #VC exception is not a ++ * safe thing to do just anywhere in the entry code and ++ * re-ordering might place the access into an unsafe location. ++ * ++ * This happened in the NMI handler, where the DR7 read was ++ * re-ordered to happen before the call to sev_es_ist_enter(), ++ * causing stack recursion. ++ */ ++ asm volatile("mov %%db7, %0" : "=r" (val) : __FORCE_ORDER); + break; + default: + BUG(); +@@ -66,7 +79,16 @@ static __always_inline void native_set_debugreg(int regno, unsigned long value) + asm("mov %0, %%db6" ::"r" (value)); + break; + case 7: +- asm("mov %0, %%db7" ::"r" (value)); ++ /* ++ * Apply __FORCE_ORDER to DR7 writes to forbid re-ordering them ++ * with other code. ++ * ++ * While is didn't happen with a DR7 write (see the DR7 read ++ * comment above which explains where it happened), add the ++ * __FORCE_ORDER here too to avoid similar problems in the ++ * future. ++ */ ++ asm volatile("mov %0, %%db7" ::"r" (value), __FORCE_ORDER); + break; + default: + BUG(); +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index a8d0b4c71b05e..53e275e377a73 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -713,15 +713,15 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, + struct bfq_io_cq *bic, + struct bfq_group *bfqg) + { +- struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0); +- struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1); ++ struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false); ++ struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true); + struct bfq_entity *entity; + + if (async_bfqq) { + entity = &async_bfqq->entity; + + if (entity->sched_data != &bfqg->sched_data) { +- bic_set_bfqq(bic, NULL, 0); ++ bic_set_bfqq(bic, NULL, false); + bfq_release_process_ref(bfqd, async_bfqq); + } + } +@@ -756,8 +756,8 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, + * request from the old cgroup. + */ + bfq_put_cooperator(sync_bfqq); ++ bic_set_bfqq(bic, NULL, true); + bfq_release_process_ref(bfqd, sync_bfqq); +- bic_set_bfqq(bic, NULL, 1); + } + } + } +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 85120d7b5cf02..f54554906451e 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -3046,7 +3046,7 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic, + /* + * Merge queues (that is, let bic redirect its requests to new_bfqq) + */ +- bic_set_bfqq(bic, new_bfqq, 1); ++ bic_set_bfqq(bic, new_bfqq, true); + bfq_mark_bfqq_coop(new_bfqq); + /* + * new_bfqq now belongs to at least two bics (it is a shared queue): +@@ -5359,9 +5359,11 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio) + + bfqq = bic_to_bfqq(bic, false); + if (bfqq) { +- bfq_release_process_ref(bfqd, bfqq); +- bfqq = bfq_get_queue(bfqd, bio, BLK_RW_ASYNC, bic, true); ++ struct bfq_queue *old_bfqq = bfqq; ++ ++ bfqq = bfq_get_queue(bfqd, bio, false, bic, true); + bic_set_bfqq(bic, bfqq, false); ++ bfq_release_process_ref(bfqd, old_bfqq); + } + + bfqq = bic_to_bfqq(bic, true); +@@ -6475,7 +6477,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) + return bfqq; + } + +- bic_set_bfqq(bic, NULL, 1); ++ bic_set_bfqq(bic, NULL, true); + + bfq_put_cooperator(bfqq); + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index c430cd3cfa171..025260b80a94c 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3076,7 +3076,7 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit) + */ + if (spd > 1) + mask &= (1 << (spd - 1)) - 1; +- else ++ else if (link->sata_spd) + return -EINVAL; + + /* were we already at the bottom? */ +diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c +index 20ed77f2b9493..fac8627b04e34 100644 +--- a/drivers/bus/sunxi-rsb.c ++++ b/drivers/bus/sunxi-rsb.c +@@ -861,7 +861,13 @@ static int __init sunxi_rsb_init(void) + return ret; + } + +- return platform_driver_register(&sunxi_rsb_driver); ++ ret = platform_driver_register(&sunxi_rsb_driver); ++ if (ret) { ++ bus_unregister(&sunxi_rsb_bus); ++ return ret; ++ } ++ ++ return 0; + } + module_init(sunxi_rsb_init); + +diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c +index b0cc3f1e9bb00..16ea847ade5fd 100644 +--- a/drivers/firewire/core-cdev.c ++++ b/drivers/firewire/core-cdev.c +@@ -818,8 +818,10 @@ static int ioctl_send_response(struct client *client, union ioctl_arg *arg) + + r = container_of(resource, struct inbound_transaction_resource, + resource); +- if (is_fcp_request(r->request)) ++ if (is_fcp_request(r->request)) { ++ kfree(r->data); + goto out; ++ } + + if (a->length != fw_get_response_length(r->request)) { + ret = -EINVAL; +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index a2765d668856e..332739f3eded5 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -950,6 +950,8 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + /* first try to find a slot in an existing linked list entry */ + for (prsv = efi_memreserve_root->next; prsv; ) { + rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB); ++ if (!rsv) ++ return -ENOMEM; + index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size); + if (index < rsv->size) { + rsv->entry[index].base = addr; +diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c +index 0a9aba5f9ceff..f178b2984dfb2 100644 +--- a/drivers/firmware/efi/memattr.c ++++ b/drivers/firmware/efi/memattr.c +@@ -33,7 +33,7 @@ int __init efi_memattr_init(void) + return -ENOMEM; + } + +- if (tbl->version > 1) { ++ if (tbl->version > 2) { + pr_warn("Unexpected EFI Memory Attributes table version %d\n", + tbl->version); + goto unmap; +diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c +index 047fd7f237069..91212bab58717 100644 +--- a/drivers/fpga/stratix10-soc.c ++++ b/drivers/fpga/stratix10-soc.c +@@ -213,9 +213,9 @@ static int s10_ops_write_init(struct fpga_manager *mgr, + /* Allocate buffers from the service layer's pool. */ + for (i = 0; i < NUM_SVC_BUFS; i++) { + kbuf = stratix10_svc_allocate_memory(priv->chan, SVC_BUF_SIZE); +- if (!kbuf) { ++ if (IS_ERR(kbuf)) { + s10_free_buffers(mgr); +- ret = -ENOMEM; ++ ret = PTR_ERR(kbuf); + goto init_done; + } + +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index 84cb965bfed5c..97045a8d94224 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -640,7 +640,7 @@ static void sbefifo_collect_async_ffdc(struct sbefifo *sbefifo) + } + ffdc_iov.iov_base = ffdc; + ffdc_iov.iov_len = SBEFIFO_MAX_FFDC_SIZE; +- iov_iter_kvec(&ffdc_iter, WRITE, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); ++ iov_iter_kvec(&ffdc_iter, READ, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); + cmd[0] = cpu_to_be32(2); + cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_SBE_FFDC); + rc = sbefifo_do_command(sbefifo, cmd, 2, &ffdc_iter); +@@ -737,7 +737,7 @@ int sbefifo_submit(struct device *dev, const __be32 *command, size_t cmd_len, + rbytes = (*resp_len) * sizeof(__be32); + resp_iov.iov_base = response; + resp_iov.iov_len = rbytes; +- iov_iter_kvec(&resp_iter, WRITE, &resp_iov, 1, rbytes); ++ iov_iter_kvec(&resp_iter, READ, &resp_iov, 1, rbytes); + + /* Perform the command */ + mutex_lock(&sbefifo->lock); +@@ -817,7 +817,7 @@ static ssize_t sbefifo_user_read(struct file *file, char __user *buf, + /* Prepare iov iterator */ + resp_iov.iov_base = buf; + resp_iov.iov_len = len; +- iov_iter_init(&resp_iter, WRITE, &resp_iov, 1, len); ++ iov_iter_init(&resp_iter, READ, &resp_iov, 1, len); + + /* Perform the command */ + mutex_lock(&sbefifo->lock); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index a2d9e0af06544..e9797439bb0eb 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10136,6 +10136,13 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + if (!dm_old_crtc_state->stream) + goto skip_modeset; + ++ /* Unset freesync video if it was active before */ ++ if (dm_old_crtc_state->freesync_config.state == VRR_STATE_ACTIVE_FIXED) { ++ dm_new_crtc_state->freesync_config.state = VRR_STATE_INACTIVE; ++ dm_new_crtc_state->freesync_config.fixed_refresh_in_uhz = 0; ++ } ++ ++ /* Now check if we should set freesync video mode */ + if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream && + is_timing_unchanged_for_freesync(new_crtc_state, + old_crtc_state)) { +diff --git a/drivers/gpu/drm/i915/display/intel_cdclk.c b/drivers/gpu/drm/i915/display/intel_cdclk.c +index 34fa4130d5c4f..745ffa7572e85 100644 +--- a/drivers/gpu/drm/i915/display/intel_cdclk.c ++++ b/drivers/gpu/drm/i915/display/intel_cdclk.c +@@ -1269,7 +1269,7 @@ static const struct intel_cdclk_vals adlp_cdclk_table[] = { + { .refclk = 24000, .cdclk = 192000, .divider = 2, .ratio = 16 }, + { .refclk = 24000, .cdclk = 312000, .divider = 2, .ratio = 26 }, + { .refclk = 24000, .cdclk = 552000, .divider = 2, .ratio = 46 }, +- { .refclk = 24400, .cdclk = 648000, .divider = 2, .ratio = 54 }, ++ { .refclk = 24000, .cdclk = 648000, .divider = 2, .ratio = 54 }, + + { .refclk = 38400, .cdclk = 179200, .divider = 3, .ratio = 14 }, + { .refclk = 38400, .cdclk = 192000, .divider = 2, .ratio = 10 }, +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c +index ef4d0f7dc1186..d4897ce0ad0c0 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c +@@ -294,10 +294,6 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, + spin_unlock(&obj->vma.lock); + + obj->tiling_and_stride = tiling | stride; +- i915_gem_object_unlock(obj); +- +- /* Force the fence to be reacquired for GTT access */ +- i915_gem_object_release_mmap_gtt(obj); + + /* Try to preallocate memory required to save swizzling on put-pages */ + if (i915_gem_object_needs_bit17_swizzle(obj)) { +@@ -310,6 +306,11 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, + obj->bit_17 = NULL; + } + ++ i915_gem_object_unlock(obj); ++ ++ /* Force the fence to be reacquired for GTT access */ ++ i915_gem_object_release_mmap_gtt(obj); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 6e09a1cca37b4..97b5ba2fc834f 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -2845,6 +2845,8 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine) + return; + + xa_for_each(&guc->context_lookup, index, ce) { ++ bool found; ++ + if (!intel_context_is_pinned(ce)) + continue; + +@@ -2856,10 +2858,18 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine) + continue; + } + ++ found = false; ++ spin_lock(&ce->guc_state.lock); + list_for_each_entry(rq, &ce->guc_active.requests, sched.link) { + if (i915_test_request_state(rq) != I915_REQUEST_ACTIVE) + continue; + ++ found = true; ++ break; ++ } ++ spin_unlock(&ce->guc_state.lock); ++ ++ if (found) { + intel_engine_set_hung_context(engine, ce); + + /* Can only cope with one hang at a time... */ +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 9b3e642a08e1a..665f772f9ffc4 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1854,7 +1854,8 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi) + } + + vc4_hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops, +- vc4_hdmi, "vc4", ++ vc4_hdmi, ++ vc4_hdmi->variant->card_name, + CEC_CAP_DEFAULTS | + CEC_CAP_CONNECTOR_INFO, 1); + ret = PTR_ERR_OR_ZERO(vc4_hdmi->cec_adap); +diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c +index 5b45941bcbddc..de8dd3e3333ed 100644 +--- a/drivers/i2c/busses/i2c-designware-pcidrv.c ++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c +@@ -398,6 +398,8 @@ static const struct pci_device_id i2_designware_pci_ids[] = { + { PCI_VDEVICE(ATI, 0x73a4), navi_amd }, + { PCI_VDEVICE(ATI, 0x73e4), navi_amd }, + { PCI_VDEVICE(ATI, 0x73c4), navi_amd }, ++ { PCI_VDEVICE(ATI, 0x7444), navi_amd }, ++ { PCI_VDEVICE(ATI, 0x7464), navi_amd }, + { 0,} + }; + MODULE_DEVICE_TABLE(pci, i2_designware_pci_ids); +diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c +index 68f67d084c63a..b353732f593b1 100644 +--- a/drivers/i2c/busses/i2c-mxs.c ++++ b/drivers/i2c/busses/i2c-mxs.c +@@ -826,8 +826,8 @@ static int mxs_i2c_probe(struct platform_device *pdev) + /* Setup the DMA */ + i2c->dmach = dma_request_chan(dev, "rx-tx"); + if (IS_ERR(i2c->dmach)) { +- dev_err(dev, "Failed to request dma\n"); +- return PTR_ERR(i2c->dmach); ++ return dev_err_probe(dev, PTR_ERR(i2c->dmach), ++ "Failed to request dma\n"); + } + + platform_set_drvdata(pdev, i2c); +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index 02ddb237f69af..13c14eb175e94 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -80,7 +80,7 @@ enum { + #define DEFAULT_SCL_RATE (100 * 1000) /* Hz */ + + /** +- * struct i2c_spec_values: ++ * struct i2c_spec_values - I2C specification values for various modes + * @min_hold_start_ns: min hold time (repeated) START condition + * @min_low_ns: min LOW period of the SCL clock + * @min_high_ns: min HIGH period of the SCL cloc +@@ -136,7 +136,7 @@ static const struct i2c_spec_values fast_mode_plus_spec = { + }; + + /** +- * struct rk3x_i2c_calced_timings: ++ * struct rk3x_i2c_calced_timings - calculated V1 timings + * @div_low: Divider output for low + * @div_high: Divider output for high + * @tuning: Used to adjust setup/hold data time, +@@ -159,7 +159,7 @@ enum rk3x_i2c_state { + }; + + /** +- * struct rk3x_i2c_soc_data: ++ * struct rk3x_i2c_soc_data - SOC-specific data + * @grf_offset: offset inside the grf regmap for setting the i2c type + * @calc_timings: Callback function for i2c timing information calculated + */ +@@ -239,7 +239,8 @@ static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c) + } + + /** +- * Generate a START condition, which triggers a REG_INT_START interrupt. ++ * rk3x_i2c_start - Generate a START condition, which triggers a REG_INT_START interrupt. ++ * @i2c: target controller data + */ + static void rk3x_i2c_start(struct rk3x_i2c *i2c) + { +@@ -258,8 +259,8 @@ static void rk3x_i2c_start(struct rk3x_i2c *i2c) + } + + /** +- * Generate a STOP condition, which triggers a REG_INT_STOP interrupt. +- * ++ * rk3x_i2c_stop - Generate a STOP condition, which triggers a REG_INT_STOP interrupt. ++ * @i2c: target controller data + * @error: Error code to return in rk3x_i2c_xfer + */ + static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error) +@@ -298,7 +299,8 @@ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error) + } + + /** +- * Setup a read according to i2c->msg ++ * rk3x_i2c_prepare_read - Setup a read according to i2c->msg ++ * @i2c: target controller data + */ + static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c) + { +@@ -329,7 +331,8 @@ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c) + } + + /** +- * Fill the transmit buffer with data from i2c->msg ++ * rk3x_i2c_fill_transmit_buf - Fill the transmit buffer with data from i2c->msg ++ * @i2c: target controller data + */ + static void rk3x_i2c_fill_transmit_buf(struct rk3x_i2c *i2c) + { +@@ -532,11 +535,10 @@ out: + } + + /** +- * Get timing values of I2C specification +- * ++ * rk3x_i2c_get_spec - Get timing values of I2C specification + * @speed: Desired SCL frequency + * +- * Returns: Matched i2c spec values. ++ * Return: Matched i2c_spec_values. + */ + static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed) + { +@@ -549,13 +551,12 @@ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed) + } + + /** +- * Calculate divider values for desired SCL frequency +- * ++ * rk3x_i2c_v0_calc_timings - Calculate divider values for desired SCL frequency + * @clk_rate: I2C input clock rate + * @t: Known I2C timing information + * @t_calc: Caculated rk3x private timings that would be written into regs + * +- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case ++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case + * a best-effort divider value is returned in divs. If the target rate is + * too high, we silently use the highest possible rate. + */ +@@ -710,13 +711,12 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate, + } + + /** +- * Calculate timing values for desired SCL frequency +- * ++ * rk3x_i2c_v1_calc_timings - Calculate timing values for desired SCL frequency + * @clk_rate: I2C input clock rate + * @t: Known I2C timing information + * @t_calc: Caculated rk3x private timings that would be written into regs + * +- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case ++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case + * a best-effort divider value is returned in divs. If the target rate is + * too high, we silently use the highest possible rate. + * The following formulas are v1's method to calculate timings. +@@ -960,14 +960,14 @@ static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long + } + + /** +- * Setup I2C registers for an I2C operation specified by msgs, num. +- * +- * Must be called with i2c->lock held. +- * ++ * rk3x_i2c_setup - Setup I2C registers for an I2C operation specified by msgs, num. ++ * @i2c: target controller data + * @msgs: I2C msgs to process + * @num: Number of msgs + * +- * returns: Number of I2C msgs processed or negative in case of error ++ * Must be called with i2c->lock held. ++ * ++ * Return: Number of I2C msgs processed or negative in case of error + */ + static int rk3x_i2c_setup(struct rk3x_i2c *i2c, struct i2c_msg *msgs, int num) + { +diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c +index a2def6f9380a3..5eac7ea199931 100644 +--- a/drivers/iio/accel/hid-sensor-accel-3d.c ++++ b/drivers/iio/accel/hid-sensor-accel-3d.c +@@ -280,6 +280,7 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev, + hid_sensor_convert_timestamp( + &accel_state->common_attributes, + *(int64_t *)raw_data); ++ ret = 0; + break; + default: + break; +diff --git a/drivers/iio/adc/berlin2-adc.c b/drivers/iio/adc/berlin2-adc.c +index 8b04b95b7b7ae..fa2c87946e16f 100644 +--- a/drivers/iio/adc/berlin2-adc.c ++++ b/drivers/iio/adc/berlin2-adc.c +@@ -289,8 +289,10 @@ static int berlin2_adc_probe(struct platform_device *pdev) + int ret; + + indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*priv)); +- if (!indio_dev) ++ if (!indio_dev) { ++ of_node_put(parent_np); + return -ENOMEM; ++ } + + priv = iio_priv(indio_dev); + platform_set_drvdata(pdev, indio_dev); +diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c +index 1cfefb3b5e56c..6592221cbe21d 100644 +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -1521,6 +1521,7 @@ static const struct of_device_id stm32_dfsdm_adc_match[] = { + }, + {} + }; ++MODULE_DEVICE_TABLE(of, stm32_dfsdm_adc_match); + + static int stm32_dfsdm_adc_probe(struct platform_device *pdev) + { +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index 256177b15c511..024bdc1ef77e6 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -57,6 +57,18 @@ + #define TWL6030_GPADCS BIT(1) + #define TWL6030_GPADCR BIT(0) + ++#define USB_VBUS_CTRL_SET 0x04 ++#define USB_ID_CTRL_SET 0x06 ++ ++#define TWL6030_MISC1 0xE4 ++#define VBUS_MEAS 0x01 ++#define ID_MEAS 0x01 ++ ++#define VAC_MEAS 0x04 ++#define VBAT_MEAS 0x02 ++#define BB_MEAS 0x01 ++ ++ + /** + * struct twl6030_chnl_calib - channel calibration + * @gain: slope coefficient for ideal curve +@@ -927,6 +939,26 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) + return ret; + } + ++ ret = twl_i2c_write_u8(TWL_MODULE_USB, VBUS_MEAS, USB_VBUS_CTRL_SET); ++ if (ret < 0) { ++ dev_err(dev, "failed to wire up inputs\n"); ++ return ret; ++ } ++ ++ ret = twl_i2c_write_u8(TWL_MODULE_USB, ID_MEAS, USB_ID_CTRL_SET); ++ if (ret < 0) { ++ dev_err(dev, "failed to wire up inputs\n"); ++ return ret; ++ } ++ ++ ret = twl_i2c_write_u8(TWL6030_MODULE_ID0, ++ VBAT_MEAS | BB_MEAS | VAC_MEAS, ++ TWL6030_MISC1); ++ if (ret < 0) { ++ dev_err(dev, "failed to wire up inputs\n"); ++ return ret; ++ } ++ + indio_dev->name = DRIVER_NAME; + indio_dev->info = &twl6030_gpadc_iio_info; + indio_dev->modes = INDIO_DIRECT_MODE; +diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c +index 8f0ad022c7f1b..698c50da1f109 100644 +--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c ++++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c +@@ -231,6 +231,7 @@ static int gyro_3d_capture_sample(struct hid_sensor_hub_device *hsdev, + gyro_state->timestamp = + hid_sensor_convert_timestamp(&gyro_state->common_attributes, + *(s64 *)raw_data); ++ ret = 0; + break; + default: + break; +diff --git a/drivers/iio/imu/fxos8700_core.c b/drivers/iio/imu/fxos8700_core.c +index ab288186f36e4..04d3778fcc153 100644 +--- a/drivers/iio/imu/fxos8700_core.c ++++ b/drivers/iio/imu/fxos8700_core.c +@@ -10,6 +10,7 @@ + #include <linux/regmap.h> + #include <linux/acpi.h> + #include <linux/bitops.h> ++#include <linux/bitfield.h> + + #include <linux/iio/iio.h> + #include <linux/iio/sysfs.h> +@@ -144,9 +145,8 @@ + #define FXOS8700_NVM_DATA_BNK0 0xa7 + + /* Bit definitions for FXOS8700_CTRL_REG1 */ +-#define FXOS8700_CTRL_ODR_MSK 0x38 + #define FXOS8700_CTRL_ODR_MAX 0x00 +-#define FXOS8700_CTRL_ODR_MIN GENMASK(4, 3) ++#define FXOS8700_CTRL_ODR_MSK GENMASK(5, 3) + + /* Bit definitions for FXOS8700_M_CTRL_REG1 */ + #define FXOS8700_HMS_MASK GENMASK(1, 0) +@@ -320,7 +320,7 @@ static enum fxos8700_sensor fxos8700_to_sensor(enum iio_chan_type iio_type) + switch (iio_type) { + case IIO_ACCEL: + return FXOS8700_ACCEL; +- case IIO_ANGL_VEL: ++ case IIO_MAGN: + return FXOS8700_MAGN; + default: + return -EINVAL; +@@ -345,15 +345,35 @@ static int fxos8700_set_active_mode(struct fxos8700_data *data, + static int fxos8700_set_scale(struct fxos8700_data *data, + enum fxos8700_sensor t, int uscale) + { +- int i; ++ int i, ret, val; ++ bool active_mode; + static const int scale_num = ARRAY_SIZE(fxos8700_accel_scale); + struct device *dev = regmap_get_device(data->regmap); + + if (t == FXOS8700_MAGN) { +- dev_err(dev, "Magnetometer scale is locked at 1200uT\n"); ++ dev_err(dev, "Magnetometer scale is locked at 0.001Gs\n"); + return -EINVAL; + } + ++ /* ++ * When device is in active mode, it failed to set an ACCEL ++ * full-scale range(2g/4g/8g) in FXOS8700_XYZ_DATA_CFG. ++ * This is not align with the datasheet, but it is a fxos8700 ++ * chip behavier. Set the device in standby mode before setting ++ * an ACCEL full-scale range. ++ */ ++ ret = regmap_read(data->regmap, FXOS8700_CTRL_REG1, &val); ++ if (ret) ++ return ret; ++ ++ active_mode = val & FXOS8700_ACTIVE; ++ if (active_mode) { ++ ret = regmap_write(data->regmap, FXOS8700_CTRL_REG1, ++ val & ~FXOS8700_ACTIVE); ++ if (ret) ++ return ret; ++ } ++ + for (i = 0; i < scale_num; i++) + if (fxos8700_accel_scale[i].uscale == uscale) + break; +@@ -361,8 +381,12 @@ static int fxos8700_set_scale(struct fxos8700_data *data, + if (i == scale_num) + return -EINVAL; + +- return regmap_write(data->regmap, FXOS8700_XYZ_DATA_CFG, ++ ret = regmap_write(data->regmap, FXOS8700_XYZ_DATA_CFG, + fxos8700_accel_scale[i].bits); ++ if (ret) ++ return ret; ++ return regmap_write(data->regmap, FXOS8700_CTRL_REG1, ++ active_mode); + } + + static int fxos8700_get_scale(struct fxos8700_data *data, +@@ -372,7 +396,7 @@ static int fxos8700_get_scale(struct fxos8700_data *data, + static const int scale_num = ARRAY_SIZE(fxos8700_accel_scale); + + if (t == FXOS8700_MAGN) { +- *uscale = 1200; /* Magnetometer is locked at 1200uT */ ++ *uscale = 1000; /* Magnetometer is locked at 0.001Gs */ + return 0; + } + +@@ -394,22 +418,61 @@ static int fxos8700_get_data(struct fxos8700_data *data, int chan_type, + int axis, int *val) + { + u8 base, reg; ++ s16 tmp; + int ret; +- enum fxos8700_sensor type = fxos8700_to_sensor(chan_type); + +- base = type ? FXOS8700_OUT_X_MSB : FXOS8700_M_OUT_X_MSB; ++ /* ++ * Different register base addresses varies with channel types. ++ * This bug hasn't been noticed before because using an enum is ++ * really hard to read. Use an a switch statement to take over that. ++ */ ++ switch (chan_type) { ++ case IIO_ACCEL: ++ base = FXOS8700_OUT_X_MSB; ++ break; ++ case IIO_MAGN: ++ base = FXOS8700_M_OUT_X_MSB; ++ break; ++ default: ++ return -EINVAL; ++ } + + /* Block read 6 bytes of device output registers to avoid data loss */ + ret = regmap_bulk_read(data->regmap, base, data->buf, +- FXOS8700_DATA_BUF_SIZE); ++ sizeof(data->buf)); + if (ret) + return ret; + + /* Convert axis to buffer index */ + reg = axis - IIO_MOD_X; + ++ /* ++ * Convert to native endianness. The accel data and magn data ++ * are signed, so a forced type conversion is needed. ++ */ ++ tmp = be16_to_cpu(data->buf[reg]); ++ ++ /* ++ * ACCEL output data registers contain the X-axis, Y-axis, and Z-axis ++ * 14-bit left-justified sample data and MAGN output data registers ++ * contain the X-axis, Y-axis, and Z-axis 16-bit sample data. Apply ++ * a signed 2 bits right shift to the readback raw data from ACCEL ++ * output data register and keep that from MAGN sensor as the origin. ++ * Value should be extended to 32 bit. ++ */ ++ switch (chan_type) { ++ case IIO_ACCEL: ++ tmp = tmp >> 2; ++ break; ++ case IIO_MAGN: ++ /* Nothing to do */ ++ break; ++ default: ++ return -EINVAL; ++ } ++ + /* Convert to native endianness */ +- *val = sign_extend32(be16_to_cpu(data->buf[reg]), 15); ++ *val = sign_extend32(tmp, 15); + + return 0; + } +@@ -445,10 +508,9 @@ static int fxos8700_set_odr(struct fxos8700_data *data, enum fxos8700_sensor t, + if (i >= odr_num) + return -EINVAL; + +- return regmap_update_bits(data->regmap, +- FXOS8700_CTRL_REG1, +- FXOS8700_CTRL_ODR_MSK + FXOS8700_ACTIVE, +- fxos8700_odr[i].bits << 3 | active_mode); ++ val &= ~FXOS8700_CTRL_ODR_MSK; ++ val |= FIELD_PREP(FXOS8700_CTRL_ODR_MSK, fxos8700_odr[i].bits) | FXOS8700_ACTIVE; ++ return regmap_write(data->regmap, FXOS8700_CTRL_REG1, val); + } + + static int fxos8700_get_odr(struct fxos8700_data *data, enum fxos8700_sensor t, +@@ -461,7 +523,7 @@ static int fxos8700_get_odr(struct fxos8700_data *data, enum fxos8700_sensor t, + if (ret) + return ret; + +- val &= FXOS8700_CTRL_ODR_MSK; ++ val = FIELD_GET(FXOS8700_CTRL_ODR_MSK, val); + + for (i = 0; i < odr_num; i++) + if (val == fxos8700_odr[i].bits) +@@ -526,7 +588,7 @@ static IIO_CONST_ATTR(in_accel_sampling_frequency_available, + static IIO_CONST_ATTR(in_magn_sampling_frequency_available, + "1.5625 6.25 12.5 50 100 200 400 800"); + static IIO_CONST_ATTR(in_accel_scale_available, "0.000244 0.000488 0.000976"); +-static IIO_CONST_ATTR(in_magn_scale_available, "0.000001200"); ++static IIO_CONST_ATTR(in_magn_scale_available, "0.001000"); + + static struct attribute *fxos8700_attrs[] = { + &iio_const_attr_in_accel_sampling_frequency_available.dev_attr.attr, +@@ -592,14 +654,19 @@ static int fxos8700_chip_init(struct fxos8700_data *data, bool use_spi) + if (ret) + return ret; + +- /* Max ODR (800Hz individual or 400Hz hybrid), active mode */ +- ret = regmap_write(data->regmap, FXOS8700_CTRL_REG1, +- FXOS8700_CTRL_ODR_MAX | FXOS8700_ACTIVE); ++ /* ++ * Set max full-scale range (+/-8G) for ACCEL sensor in chip ++ * initialization then activate the device. ++ */ ++ ret = regmap_write(data->regmap, FXOS8700_XYZ_DATA_CFG, MODE_8G); + if (ret) + return ret; + +- /* Set for max full-scale range (+/-8G) */ +- return regmap_write(data->regmap, FXOS8700_XYZ_DATA_CFG, MODE_8G); ++ /* Max ODR (800Hz individual or 400Hz hybrid), active mode */ ++ return regmap_update_bits(data->regmap, FXOS8700_CTRL_REG1, ++ FXOS8700_CTRL_ODR_MSK | FXOS8700_ACTIVE, ++ FIELD_PREP(FXOS8700_CTRL_ODR_MSK, FXOS8700_CTRL_ODR_MAX) | ++ FXOS8700_ACTIVE); + } + + static void fxos8700_chip_uninit(void *data) +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index c644617725a88..54eb6556c63db 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -967,7 +967,7 @@ static void rtrs_clt_init_req(struct rtrs_clt_io_req *req, + refcount_set(&req->ref, 1); + req->mp_policy = clt_path->clt->mp_policy; + +- iov_iter_kvec(&iter, READ, vec, 1, usr_len); ++ iov_iter_kvec(&iter, WRITE, vec, 1, usr_len); + len = _copy_from_iter(req->iu->buf, usr_len, &iter); + WARN_ON(len != usr_len); + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 3a41ac9af2e76..239c777f8271c 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -1229,6 +1229,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X170SM"), +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 685d2d8a3b366..fe5fc2b3406f9 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2395,6 +2395,9 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget) + + cleaned = qman_p_poll_dqrr(np->p, budget); + ++ if (np->xdp_act & XDP_REDIRECT) ++ xdp_do_flush(); ++ + if (cleaned < budget) { + napi_complete_done(napi, cleaned); + qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); +@@ -2402,9 +2405,6 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget) + qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); + } + +- if (np->xdp_act & XDP_REDIRECT) +- xdp_do_flush(); +- + return cleaned; + } + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 5899139aec97a..c48d410936517 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1597,10 +1597,15 @@ static int dpaa2_eth_poll(struct napi_struct *napi, int budget) + if (rx_cleaned >= budget || + txconf_cleaned >= DPAA2_ETH_TXCONF_PER_NAPI) { + work_done = budget; ++ if (ch->xdp.res & XDP_REDIRECT) ++ xdp_do_flush(); + goto out; + } + } while (store_cleaned); + ++ if (ch->xdp.res & XDP_REDIRECT) ++ xdp_do_flush(); ++ + /* We didn't consume the entire budget, so finish napi and + * re-enable data availability notifications + */ +@@ -1625,9 +1630,7 @@ out: + txc_fq->dq_bytes = 0; + } + +- if (ch->xdp.res & XDP_REDIRECT) +- xdp_do_flush_map(); +- else if (rx_cleaned && ch->xdp.res & XDP_TX) ++ if (rx_cleaned && ch->xdp.res & XDP_TX) + dpaa2_eth_xdp_tx_flush(priv, ch, &priv->fq[flowid]); + + return work_done; +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index 89bca2ed895a0..a5bc804dc67ad 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -641,7 +641,7 @@ void ice_set_ethtool_ops(struct net_device *netdev); + void ice_set_ethtool_safe_mode_ops(struct net_device *netdev); + u16 ice_get_avail_txq_count(struct ice_pf *pf); + u16 ice_get_avail_rxq_count(struct ice_pf *pf); +-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx); ++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked); + void ice_update_vsi_stats(struct ice_vsi *vsi); + void ice_update_pf_stats(struct ice_pf *pf); + int ice_up(struct ice_vsi *vsi); +diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c +index 926cf748c5ecd..dd4195e964faf 100644 +--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c +@@ -355,7 +355,7 @@ int ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked) + goto out; + } + +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, false); + + out: + ice_ena_vsi(pf_vsi, true); +@@ -644,12 +644,13 @@ static int ice_dcb_noncontig_cfg(struct ice_pf *pf) + /** + * ice_pf_dcb_recfg - Reconfigure all VEBs and VSIs + * @pf: pointer to the PF struct ++ * @locked: is adev device lock held + * + * Assumed caller has already disabled all VSIs before + * calling this function. Reconfiguring DCB based on + * local_dcbx_cfg. + */ +-void ice_pf_dcb_recfg(struct ice_pf *pf) ++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) + { + struct ice_dcbx_cfg *dcbcfg = &pf->hw.port_info->qos_cfg.local_dcbx_cfg; + struct iidc_event *event; +@@ -688,14 +689,16 @@ void ice_pf_dcb_recfg(struct ice_pf *pf) + if (vsi->type == ICE_VSI_PF) + ice_dcbnl_set_all(vsi); + } +- /* Notify the AUX drivers that TC change is finished */ +- event = kzalloc(sizeof(*event), GFP_KERNEL); +- if (!event) +- return; ++ if (!locked) { ++ /* Notify the AUX drivers that TC change is finished */ ++ event = kzalloc(sizeof(*event), GFP_KERNEL); ++ if (!event) ++ return; + +- set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); +- ice_send_event_to_aux(pf, event); +- kfree(event); ++ set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); ++ ice_send_event_to_aux(pf, event); ++ kfree(event); ++ } + } + + /** +@@ -943,7 +946,7 @@ ice_dcb_process_lldp_set_mib_change(struct ice_pf *pf, + } + + /* changes in configuration update VSI */ +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, false); + + ice_ena_vsi(pf_vsi, true); + unlock_rtnl: +diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h +index 261b6e2ed7bc2..33a609e92d253 100644 +--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h ++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h +@@ -23,7 +23,7 @@ u8 ice_dcb_get_tc(struct ice_vsi *vsi, int queue_index); + int + ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked); + int ice_dcb_bwchk(struct ice_pf *pf, struct ice_dcbx_cfg *dcbcfg); +-void ice_pf_dcb_recfg(struct ice_pf *pf); ++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked); + void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi); + int ice_init_pf_dcb(struct ice_pf *pf, bool locked); + void ice_update_dcb_stats(struct ice_pf *pf); +@@ -113,7 +113,7 @@ ice_is_pfc_causing_hung_q(struct ice_pf __always_unused *pf, + return false; + } + +-static inline void ice_pf_dcb_recfg(struct ice_pf *pf) { } ++static inline void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) { } + static inline void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi) { } + static inline void ice_update_dcb_stats(struct ice_pf *pf) { } + static inline void +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index f10d9c377c744..24001035910e0 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -3393,7 +3393,9 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + struct ice_vsi *vsi = np->vsi; + struct ice_pf *pf = vsi->back; + int new_rx = 0, new_tx = 0; ++ bool locked = false; + u32 curr_combined; ++ int ret = 0; + + /* do not support changing channels in Safe Mode */ + if (ice_is_safe_mode(pf)) { +@@ -3442,15 +3444,33 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + return -EINVAL; + } + +- ice_vsi_recfg_qs(vsi, new_rx, new_tx); ++ if (pf->adev) { ++ mutex_lock(&pf->adev_mutex); ++ device_lock(&pf->adev->dev); ++ locked = true; ++ if (pf->adev->dev.driver) { ++ netdev_err(dev, "Cannot change channels when RDMA is active\n"); ++ ret = -EBUSY; ++ goto adev_unlock; ++ } ++ } ++ ++ ice_vsi_recfg_qs(vsi, new_rx, new_tx, locked); + +- if (!netif_is_rxfh_configured(dev)) +- return ice_vsi_set_dflt_rss_lut(vsi, new_rx); ++ if (!netif_is_rxfh_configured(dev)) { ++ ret = ice_vsi_set_dflt_rss_lut(vsi, new_rx); ++ goto adev_unlock; ++ } + + /* Update rss_size due to change in Rx queues */ + vsi->rss_size = ice_get_valid_rss_size(&pf->hw, new_rx); + +- return 0; ++adev_unlock: ++ if (locked) { ++ device_unlock(&pf->adev->dev); ++ mutex_unlock(&pf->adev_mutex); ++ } ++ return ret; + } + + /** +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index ffbba5f6b7a5f..348105aa5cf54 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3776,12 +3776,13 @@ bool ice_is_wol_supported(struct ice_hw *hw) + * @vsi: VSI being changed + * @new_rx: new number of Rx queues + * @new_tx: new number of Tx queues ++ * @locked: is adev device_lock held + * + * Only change the number of queues if new_tx, or new_rx is non-0. + * + * Returns 0 on success. + */ +-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx) ++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + { + struct ice_pf *pf = vsi->back; + int err = 0, timeout = 50; +@@ -3810,7 +3811,7 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx) + + ice_vsi_close(vsi); + ice_vsi_rebuild(vsi, false); +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, locked); + ice_vsi_open(vsi); + done: + clear_bit(ICE_CFG_BUSY, pf->state); +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index fbde7826927b3..743c31659709b 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -418,10 +418,12 @@ static int igc_ptp_verify_pin(struct ptp_clock_info *ptp, unsigned int pin, + * + * We need to convert the system time value stored in the RX/TXSTMP registers + * into a hwtstamp which can be used by the upper level timestamping functions. ++ * ++ * Returns 0 on success. + **/ +-static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, +- struct skb_shared_hwtstamps *hwtstamps, +- u64 systim) ++static int igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, ++ struct skb_shared_hwtstamps *hwtstamps, ++ u64 systim) + { + switch (adapter->hw.mac.type) { + case igc_i225: +@@ -431,8 +433,9 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, + systim & 0xFFFFFFFF); + break; + default: +- break; ++ return -EINVAL; + } ++ return 0; + } + + /** +@@ -657,7 +660,8 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) + + regval = rd32(IGC_TXSTMPL); + regval |= (u64)rd32(IGC_TXSTMPH) << 32; +- igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval); ++ if (igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval)) ++ return; + + switch (adapter->link_speed) { + case SPEED_10: +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 17f895250e041..d67d4e74b326d 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1439,6 +1439,10 @@ int qede_poll(struct napi_struct *napi, int budget) + rx_work_done = (likely(fp->type & QEDE_FASTPATH_RX) && + qede_has_rx_work(fp->rxq)) ? + qede_rx_int(fp, budget) : 0; ++ ++ if (fp->xdp_xmit & QEDE_XDP_REDIRECT) ++ xdp_do_flush(); ++ + /* Handle case where we are called by netpoll with a budget of 0 */ + if (rx_work_done < budget || !budget) { + if (!qede_poll_is_more_work(fp)) { +@@ -1458,9 +1462,6 @@ int qede_poll(struct napi_struct *napi, int budget) + qede_update_tx_producer(fp->xdp_tx); + } + +- if (fp->xdp_xmit & QEDE_XDP_REDIRECT) +- xdp_do_flush_map(); +- + return rx_work_done; + } + +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 43ef4f5290281..b6243f03e953d 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1005,8 +1005,11 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) + /* Determine netdevice features */ + net_dev->features |= (efx->type->offload_features | NETIF_F_SG | + NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); +- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) ++ if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { + net_dev->features |= NETIF_F_TSO6; ++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) ++ net_dev->hw_enc_features |= NETIF_F_TSO6; ++ } + /* Check whether device supports TSO */ + if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) + net_dev->features &= ~NETIF_F_ALL_TSO; +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index 0b511abb5422e..f070aa97c77b4 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -232,7 +232,8 @@ static int dp83822_config_intr(struct phy_device *phydev) + DP83822_ENERGY_DET_INT_EN | + DP83822_LINK_QUAL_INT_EN); + +- if (!dp83822->fx_enabled) ++ /* Private data pointer is NULL on DP83825/26 */ ++ if (!dp83822 || !dp83822->fx_enabled) + misr_status |= DP83822_ANEG_COMPLETE_INT_EN | + DP83822_DUP_MODE_CHANGE_INT_EN | + DP83822_SPEED_CHANGED_INT_EN; +@@ -252,7 +253,8 @@ static int dp83822_config_intr(struct phy_device *phydev) + DP83822_PAGE_RX_INT_EN | + DP83822_EEE_ERROR_CHANGE_INT_EN); + +- if (!dp83822->fx_enabled) ++ /* Private data pointer is NULL on DP83825/26 */ ++ if (!dp83822 || !dp83822->fx_enabled) + misr_status |= DP83822_ANEG_ERR_INT_EN | + DP83822_WOL_PKT_INT_EN; + +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index c49062ad72c6c..5e41658b1e2fa 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -271,6 +271,8 @@ static struct phy_driver meson_gxl_phy[] = { + .handle_interrupt = meson_gxl_handle_interrupt, + .suspend = genphy_suspend, + .resume = genphy_resume, ++ .read_mmd = genphy_read_mmd_unsupported, ++ .write_mmd = genphy_write_mmd_unsupported, + }, + }; + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 9222be208abad..66ca2ea19ba60 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1580,13 +1580,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget) + + received = virtnet_receive(rq, budget, &xdp_xmit); + ++ if (xdp_xmit & VIRTIO_XDP_REDIR) ++ xdp_do_flush(); ++ + /* Out of packets? */ + if (received < budget) + virtqueue_napi_complete(napi, rq->vq, received); + +- if (xdp_xmit & VIRTIO_XDP_REDIR) +- xdp_do_flush(); +- + if (xdp_xmit & VIRTIO_XDP_TX) { + sq = virtnet_xdp_get_sq(vi); + if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { +@@ -1995,8 +1995,8 @@ static int virtnet_close(struct net_device *dev) + cancel_delayed_work_sync(&vi->refill); + + for (i = 0; i < vi->max_queue_pairs; i++) { +- xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); + napi_disable(&vi->rq[i].napi); ++ xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); + virtnet_napi_tx_disable(&vi->sq[i].napi); + } + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 9db12ffd2ff80..fc622e6b329a3 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -90,6 +90,9 @@ + #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \ + (sizeof(struct brcmf_assoc_params_le) - sizeof(u16)) + ++#define BRCMF_MAX_CHANSPEC_LIST \ ++ (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1) ++ + static bool check_vif_up(struct brcmf_cfg80211_vif *vif) + { + if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) { +@@ -6557,6 +6560,13 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, + band->channels[i].flags = IEEE80211_CHAN_DISABLED; + + total = le32_to_cpu(list->count); ++ if (total > BRCMF_MAX_CHANSPEC_LIST) { ++ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n", ++ total); ++ err = -EINVAL; ++ goto fail_pbuf; ++ } ++ + for (i = 0; i < total; i++) { + ch.chspec = (u16)le32_to_cpu(list->element[i]); + cfg->d11inf.decchspec(&ch); +@@ -6702,6 +6712,13 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg) + band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ]; + list = (struct brcmf_chanspec_list *)pbuf; + num_chan = le32_to_cpu(list->count); ++ if (num_chan > BRCMF_MAX_CHANSPEC_LIST) { ++ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n", ++ num_chan); ++ kfree(pbuf); ++ return -EINVAL; ++ } ++ + for (i = 0; i < num_chan; i++) { + ch.chspec = (u16)le32_to_cpu(list->element[i]); + cfg->d11inf.decchspec(&ch); +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 38bab84f3c8ae..ee86022c4f2b8 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -766,9 +766,9 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + return ERR_PTR(rval); + } + +- if (config->wp_gpio) +- nvmem->wp_gpio = config->wp_gpio; +- else if (!config->ignore_wp) ++ nvmem->id = rval; ++ ++ if (!config->ignore_wp) + nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", + GPIOD_OUT_HIGH); + if (IS_ERR(nvmem->wp_gpio)) { +@@ -781,7 +781,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + kref_init(&nvmem->refcnt); + INIT_LIST_HEAD(&nvmem->cells); + +- nvmem->id = rval; + nvmem->owner = config->owner; + if (!nvmem->owner && config->dev->driver) + nvmem->owner = config->dev->driver->owner; +@@ -845,7 +844,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + if (config->cells) { + rval = nvmem_add_cells(nvmem, config->cells, config->ncells); + if (rval) +- goto err_teardown_compat; ++ goto err_remove_cells; + } + + rval = nvmem_add_cells_from_table(nvmem); +@@ -862,7 +861,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + + err_remove_cells: + nvmem_device_remove_all_cells(nvmem); +-err_teardown_compat: + if (config->compat) + nvmem_sysfs_remove_compat(nvmem, config); + err_device_del: +diff --git a/drivers/nvmem/qcom-spmi-sdam.c b/drivers/nvmem/qcom-spmi-sdam.c +index 4fcb63507ecd1..8499892044b7b 100644 +--- a/drivers/nvmem/qcom-spmi-sdam.c ++++ b/drivers/nvmem/qcom-spmi-sdam.c +@@ -166,6 +166,7 @@ static const struct of_device_id sdam_match_table[] = { + { .compatible = "qcom,spmi-sdam" }, + {}, + }; ++MODULE_DEVICE_TABLE(of, sdam_match_table); + + static struct platform_driver sdam_driver = { + .driver = { +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c +index a9687e0409600..eef863108bfe2 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c +@@ -2919,6 +2919,7 @@ struct qcom_qmp { + struct regulator_bulk_data *vregs; + + struct qmp_phy **phys; ++ struct qmp_phy *usb_phy; + + struct mutex phy_mutex; + int init_count; +@@ -4554,7 +4555,7 @@ static int qcom_qmp_phy_com_init(struct qmp_phy *qphy) + struct qcom_qmp *qmp = qphy->qmp; + const struct qmp_phy_cfg *cfg = qphy->cfg; + void __iomem *serdes = qphy->serdes; +- void __iomem *pcs = qphy->pcs; ++ struct qmp_phy *usb_phy = qmp->usb_phy; + void __iomem *dp_com = qmp->dp_com; + int ret, i; + +@@ -4620,13 +4621,13 @@ static int qcom_qmp_phy_com_init(struct qmp_phy *qphy) + qphy_setbits(serdes, cfg->regs[QPHY_COM_POWER_DOWN_CONTROL], + SW_PWRDN); + } else { +- if (cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL]) +- qphy_setbits(pcs, +- cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], +- cfg->pwrdn_ctrl); ++ if (usb_phy->cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL]) ++ qphy_setbits(usb_phy->pcs, ++ usb_phy->cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], ++ usb_phy->cfg->pwrdn_ctrl); + else +- qphy_setbits(pcs, QPHY_POWER_DOWN_CONTROL, +- cfg->pwrdn_ctrl); ++ qphy_setbits(usb_phy->pcs, QPHY_POWER_DOWN_CONTROL, ++ usb_phy->cfg->pwrdn_ctrl); + } + + mutex_unlock(&qmp->phy_mutex); +@@ -4984,7 +4985,7 @@ static void qcom_qmp_phy_disable_autonomous_mode(struct qmp_phy *qphy) + static int __maybe_unused qcom_qmp_phy_runtime_suspend(struct device *dev) + { + struct qcom_qmp *qmp = dev_get_drvdata(dev); +- struct qmp_phy *qphy = qmp->phys[0]; ++ struct qmp_phy *qphy = qmp->usb_phy; + const struct qmp_phy_cfg *cfg = qphy->cfg; + + dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qphy->mode); +@@ -5009,7 +5010,7 @@ static int __maybe_unused qcom_qmp_phy_runtime_suspend(struct device *dev) + static int __maybe_unused qcom_qmp_phy_runtime_resume(struct device *dev) + { + struct qcom_qmp *qmp = dev_get_drvdata(dev); +- struct qmp_phy *qphy = qmp->phys[0]; ++ struct qmp_phy *qphy = qmp->usb_phy; + const struct qmp_phy_cfg *cfg = qphy->cfg; + int ret = 0; + +@@ -5387,6 +5388,21 @@ static void qcom_qmp_reset_control_put(void *data) + reset_control_put(data); + } + ++static void __iomem *qmp_usb_iomap(struct device *dev, struct device_node *np, ++ int index, bool exclusive) ++{ ++ struct resource res; ++ ++ if (!exclusive) { ++ if (of_address_to_resource(np, index, &res)) ++ return IOMEM_ERR_PTR(-EINVAL); ++ ++ return devm_ioremap(dev, res.start, resource_size(&res)); ++ } ++ ++ return devm_of_iomap(dev, np, index, NULL); ++} ++ + static + int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + void __iomem *serdes, const struct qmp_phy_cfg *cfg) +@@ -5396,8 +5412,18 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + struct qmp_phy *qphy; + const struct phy_ops *ops; + char prop_name[MAX_PROP_NAME]; ++ bool exclusive = true; + int ret; + ++ /* ++ * FIXME: These bindings should be fixed to not rely on overlapping ++ * mappings for PCS. ++ */ ++ if (of_device_is_compatible(dev->of_node, "qcom,sdx65-qmp-usb3-uni-phy")) ++ exclusive = false; ++ if (of_device_is_compatible(dev->of_node, "qcom,sm8350-qmp-usb3-uni-phy")) ++ exclusive = false; ++ + qphy = devm_kzalloc(dev, sizeof(*qphy), GFP_KERNEL); + if (!qphy) + return -ENOMEM; +@@ -5410,17 +5436,17 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + * For dual lane PHYs: tx2 -> 3, rx2 -> 4, pcs_misc (optional) -> 5 + * For single lane PHYs: pcs_misc (optional) -> 3. + */ +- qphy->tx = of_iomap(np, 0); +- if (!qphy->tx) +- return -ENOMEM; ++ qphy->tx = devm_of_iomap(dev, np, 0, NULL); ++ if (IS_ERR(qphy->tx)) ++ return PTR_ERR(qphy->tx); + +- qphy->rx = of_iomap(np, 1); +- if (!qphy->rx) +- return -ENOMEM; ++ qphy->rx = devm_of_iomap(dev, np, 1, NULL); ++ if (IS_ERR(qphy->rx)) ++ return PTR_ERR(qphy->rx); + +- qphy->pcs = of_iomap(np, 2); +- if (!qphy->pcs) +- return -ENOMEM; ++ qphy->pcs = qmp_usb_iomap(dev, np, 2, exclusive); ++ if (IS_ERR(qphy->pcs)) ++ return PTR_ERR(qphy->pcs); + + /* + * If this is a dual-lane PHY, then there should be registers for the +@@ -5429,9 +5455,9 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + * offset from the first lane. + */ + if (cfg->is_dual_lane_phy) { +- qphy->tx2 = of_iomap(np, 3); +- qphy->rx2 = of_iomap(np, 4); +- if (!qphy->tx2 || !qphy->rx2) { ++ qphy->tx2 = devm_of_iomap(dev, np, 3, NULL); ++ qphy->rx2 = devm_of_iomap(dev, np, 4, NULL); ++ if (IS_ERR(qphy->tx2) || IS_ERR(qphy->rx2)) { + dev_warn(dev, + "Underspecified device tree, falling back to legacy register regions\n"); + +@@ -5441,15 +5467,17 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + qphy->rx2 = qphy->rx + QMP_PHY_LEGACY_LANE_STRIDE; + + } else { +- qphy->pcs_misc = of_iomap(np, 5); ++ qphy->pcs_misc = devm_of_iomap(dev, np, 5, NULL); + } + + } else { +- qphy->pcs_misc = of_iomap(np, 3); ++ qphy->pcs_misc = devm_of_iomap(dev, np, 3, NULL); + } + +- if (!qphy->pcs_misc) ++ if (IS_ERR(qphy->pcs_misc)) { + dev_vdbg(dev, "PHY pcs_misc-reg not used\n"); ++ qphy->pcs_misc = NULL; ++ } + + /* + * Get PHY's Pipe clock, if any. USB3 and PCIe are PIPE3 +@@ -5740,7 +5768,9 @@ static int qcom_qmp_phy_probe(struct platform_device *pdev) + return -ENOMEM; + + pm_runtime_set_active(dev); +- pm_runtime_enable(dev); ++ ret = devm_pm_runtime_enable(dev); ++ if (ret) ++ return ret; + /* + * Prevent runtime pm from being ON by default. Users can enable + * it using power/control in sysfs. +@@ -5765,6 +5795,9 @@ static int qcom_qmp_phy_probe(struct platform_device *pdev) + goto err_node_put; + } + ++ if (cfg->type != PHY_TYPE_DP) ++ qmp->usb_phy = qmp->phys[id]; ++ + /* + * Register the pipe clock provided by phy. + * See function description to see details of this pipe clock. +@@ -5787,16 +5820,16 @@ static int qcom_qmp_phy_probe(struct platform_device *pdev) + id++; + } + ++ if (!qmp->usb_phy) ++ return -EINVAL; ++ + phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + if (!IS_ERR(phy_provider)) + dev_info(dev, "Registered Qcom-QMP phy\n"); +- else +- pm_runtime_disable(dev); + + return PTR_ERR_OR_ZERO(phy_provider); + + err_node_put: +- pm_runtime_disable(dev); + of_node_put(child); + return ret; + } +diff --git a/drivers/platform/x86/dell/dell-wmi-base.c b/drivers/platform/x86/dell/dell-wmi-base.c +index 089c125e18f70..b83d6fa6e39b3 100644 +--- a/drivers/platform/x86/dell/dell-wmi-base.c ++++ b/drivers/platform/x86/dell/dell-wmi-base.c +@@ -260,6 +260,9 @@ static const struct key_entry dell_wmi_keymap_type_0010[] = { + { KE_KEY, 0x57, { KEY_BRIGHTNESSDOWN } }, + { KE_KEY, 0x58, { KEY_BRIGHTNESSUP } }, + ++ /*Speaker Mute*/ ++ { KE_KEY, 0x109, { KEY_MUTE} }, ++ + /* Mic mute */ + { KE_KEY, 0x150, { KEY_MICMUTE } }, + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index ebd15c1d13ec5..0163e912fafec 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -141,6 +141,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev) + + static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"), ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H WIFI-CF"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"), +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 4d2f330878065..5943360041907 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -848,7 +848,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + enum iscsi_host_param param, char *buf) + { + struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost); +- struct iscsi_session *session = tcp_sw_host->session; ++ struct iscsi_session *session; + struct iscsi_conn *conn; + struct iscsi_tcp_conn *tcp_conn; + struct iscsi_sw_tcp_conn *tcp_sw_conn; +@@ -858,6 +858,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + + switch (param) { + case ISCSI_HOST_PARAM_IPADDRESS: ++ session = tcp_sw_host->session; + if (!session) + return -ENOTCONN; + +@@ -958,11 +959,13 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max, + if (!cls_session) + goto remove_host; + session = cls_session->dd_data; +- tcp_sw_host = iscsi_host_priv(shost); +- tcp_sw_host->session = session; + + if (iscsi_tcp_r2tpool_alloc(session)) + goto remove_session; ++ ++ /* We are now fully setup so expose the session to sysfs. */ ++ tcp_sw_host = iscsi_host_priv(shost); ++ tcp_sw_host->session = session; + return cls_session; + + remove_session: +@@ -982,10 +985,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) + if (WARN_ON_ONCE(session->leadconn)) + return; + ++ iscsi_session_remove(cls_session); ++ /* ++ * Our get_host_param needs to access the session, so remove the ++ * host from sysfs before freeing the session to make sure userspace ++ * is no longer accessing the callout. ++ */ ++ iscsi_host_remove(shost, false); ++ + iscsi_tcp_r2tpool_free(cls_session->dd_data); +- iscsi_session_teardown(cls_session); + +- iscsi_host_remove(shost, false); ++ iscsi_session_free(cls_session); + iscsi_host_free(shost); + } + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 73d235540b986..d422e8fd7137f 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -3024,17 +3024,32 @@ dec_session_count: + } + EXPORT_SYMBOL_GPL(iscsi_session_setup); + +-/** +- * iscsi_session_teardown - destroy session, host, and cls_session +- * @cls_session: iscsi session ++/* ++ * issi_session_remove - Remove session from iSCSI class. + */ +-void iscsi_session_teardown(struct iscsi_cls_session *cls_session) ++void iscsi_session_remove(struct iscsi_cls_session *cls_session) + { + struct iscsi_session *session = cls_session->dd_data; +- struct module *owner = cls_session->transport->owner; + struct Scsi_Host *shost = session->host; + + iscsi_remove_session(cls_session); ++ /* ++ * host removal only has to wait for its children to be removed from ++ * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing ++ * the session, so drop the session count here. ++ */ ++ iscsi_host_dec_session_cnt(shost); ++} ++EXPORT_SYMBOL_GPL(iscsi_session_remove); ++ ++/** ++ * iscsi_session_free - Free iscsi session and it's resources ++ * @cls_session: iscsi session ++ */ ++void iscsi_session_free(struct iscsi_cls_session *cls_session) ++{ ++ struct iscsi_session *session = cls_session->dd_data; ++ struct module *owner = cls_session->transport->owner; + + iscsi_pool_free(&session->cmdpool); + kfree(session->password); +@@ -3052,10 +3067,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) + kfree(session->discovery_parent_type); + + iscsi_free_session(cls_session); +- +- iscsi_host_dec_session_cnt(shost); + module_put(owner); + } ++EXPORT_SYMBOL_GPL(iscsi_session_free); ++ ++/** ++ * iscsi_session_teardown - destroy session and cls_session ++ * @cls_session: iscsi session ++ */ ++void iscsi_session_teardown(struct iscsi_cls_session *cls_session) ++{ ++ iscsi_session_remove(cls_session); ++ iscsi_session_free(cls_session); ++} + EXPORT_SYMBOL_GPL(iscsi_session_teardown); + + /** +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 9466474ff01b6..86c10edbb5f1e 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -1206,8 +1206,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + * that no LUN is present, so don't add sdev in these cases. + * Two specific examples are: + * 1) NetApp targets: return PQ=1, PDT=0x1f +- * 2) IBM/2145 targets: return PQ=1, PDT=0 +- * 3) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved" ++ * 2) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved" + * in the UFI 1.0 spec (we cannot rely on reserved bits). + * + * References: +@@ -1221,8 +1220,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + * PDT=00h Direct-access device (floppy) + * PDT=1Fh none (no FDD connected to the requested logical unit) + */ +- if (((result[0] >> 5) == 1 || +- (starget->pdt_1f_for_no_lun && (result[0] & 0x1f) == 0x1f)) && ++ if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) && ++ (result[0] & 0x1f) == 0x1f && + !scsi_is_wlun(lun)) { + SCSI_LOG_SCAN_BUS(3, sdev_printk(KERN_INFO, sdev, + "scsi scan: peripheral device type" +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index ef4a8e189fba0..014860716605b 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -332,7 +332,7 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + len += sg->length; + } + +- iov_iter_bvec(&iter, READ, bvec, sgl_nents, len); ++ iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len); + if (is_write) + ret = vfs_iter_write(fd, &iter, &pos, 0); + else +@@ -469,7 +469,7 @@ fd_execute_write_same(struct se_cmd *cmd) + len += se_dev->dev_attrib.block_size; + } + +- iov_iter_bvec(&iter, READ, bvec, nolb, len); ++ iov_iter_bvec(&iter, WRITE, bvec, nolb, len); + ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0); + + kfree(bvec); +diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c +index bac111456fa1d..2b95b4550a637 100644 +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -73,8 +73,8 @@ static bool __target_check_io_state(struct se_cmd *se_cmd, + { + struct se_session *sess = se_cmd->se_sess; + +- assert_spin_locked(&sess->sess_cmd_lock); +- WARN_ON_ONCE(!irqs_disabled()); ++ lockdep_assert_held(&sess->sess_cmd_lock); ++ + /* + * If command already reached CMD_T_COMPLETE state within + * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown, +diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c +index 1bdc8d6432fef..ec3cd723256fb 100644 +--- a/drivers/tty/serial/8250/8250_dma.c ++++ b/drivers/tty/serial/8250/8250_dma.c +@@ -46,19 +46,39 @@ static void __dma_rx_complete(void *param) + struct uart_8250_dma *dma = p->dma; + struct tty_port *tty_port = &p->port.state->port; + struct dma_tx_state state; ++ enum dma_status dma_status; + int count; + +- dma->rx_running = 0; +- dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state); ++ /* ++ * New DMA Rx can be started during the completion handler before it ++ * could acquire port's lock and it might still be ongoing. Don't to ++ * anything in such case. ++ */ ++ dma_status = dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state); ++ if (dma_status == DMA_IN_PROGRESS) ++ return; + + count = dma->rx_size - state.residue; + + tty_insert_flip_string(tty_port, dma->rx_buf, count); + p->port.icount.rx += count; ++ dma->rx_running = 0; + + tty_flip_buffer_push(tty_port); + } + ++static void dma_rx_complete(void *param) ++{ ++ struct uart_8250_port *p = param; ++ struct uart_8250_dma *dma = p->dma; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&p->port.lock, flags); ++ if (dma->rx_running) ++ __dma_rx_complete(p); ++ spin_unlock_irqrestore(&p->port.lock, flags); ++} ++ + int serial8250_tx_dma(struct uart_8250_port *p) + { + struct uart_8250_dma *dma = p->dma; +@@ -134,7 +154,7 @@ int serial8250_rx_dma(struct uart_8250_port *p) + return -EBUSY; + + dma->rx_running = 1; +- desc->callback = __dma_rx_complete; ++ desc->callback = dma_rx_complete; + desc->callback_param = p; + + dma->rx_cookie = dmaengine_submit(desc); +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index 1850bacdb5b0e..f566eb1839dc5 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -386,10 +386,6 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) + + uni_mode = use_unicode(inode); + attr = use_attributes(inode); +- ret = -ENXIO; +- vc = vcs_vc(inode, &viewed); +- if (!vc) +- goto unlock_out; + + ret = -EINVAL; + if (pos < 0) +@@ -407,6 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) + unsigned int this_round, skip = 0; + int size; + ++ ret = -ENXIO; ++ vc = vcs_vc(inode, &viewed); ++ if (!vc) ++ goto unlock_out; ++ + /* Check whether we are above size each round, + * as copy_to_user at the end of this loop + * could sleep. +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index ec1de6f6c2903..28bc7480acf3c 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -836,7 +836,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + qcom->mode = usb_get_dr_mode(&qcom->dwc3->dev); + + /* enable vbus override for device mode */ +- if (qcom->mode == USB_DR_MODE_PERIPHERAL) ++ if (qcom->mode != USB_DR_MODE_HOST) + dwc3_qcom_vbus_override_enable(qcom, true); + + /* register extcon to override sw_vbus on Vbus change later */ +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index c9145ee959569..f975111bd974f 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -279,8 +279,10 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) + struct usb_request *req = ffs->ep0req; + int ret; + +- if (!req) ++ if (!req) { ++ spin_unlock_irq(&ffs->ev.waitq.lock); + return -EINVAL; ++ } + + req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); + +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 885a7f593d85e..850394ed8eb14 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -1069,6 +1069,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + } + std_as_out_if0_desc.bInterfaceNumber = ret; + std_as_out_if1_desc.bInterfaceNumber = ret; ++ std_as_out_if1_desc.bNumEndpoints = 1; + uac2->as_out_intf = ret; + uac2->as_out_alt = 0; + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 297b5db474545..32148f0112004 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -1517,6 +1517,9 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) + nvq = &n->vqs[index]; + mutex_lock(&vq->mutex); + ++ if (fd == -1) ++ vhost_clear_msg(&n->dev); ++ + /* Verify that ring has been setup correctly. */ + if (!vhost_vq_access_ok(vq)) { + r = -EFAULT; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 0a9746bc9228d..c0f926a9c298f 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -669,7 +669,7 @@ void vhost_dev_stop(struct vhost_dev *dev) + } + EXPORT_SYMBOL_GPL(vhost_dev_stop); + +-static void vhost_clear_msg(struct vhost_dev *dev) ++void vhost_clear_msg(struct vhost_dev *dev) + { + struct vhost_msg_node *node, *n; + +@@ -687,6 +687,7 @@ static void vhost_clear_msg(struct vhost_dev *dev) + + spin_unlock(&dev->iotlb_lock); + } ++EXPORT_SYMBOL_GPL(vhost_clear_msg); + + void vhost_dev_cleanup(struct vhost_dev *dev) + { +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index 638bb640d6b4b..f2675c0aa08ee 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -182,6 +182,7 @@ long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, void __user *argp); + long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp); + bool vhost_vq_access_ok(struct vhost_virtqueue *vq); + bool vhost_log_access_ok(struct vhost_dev *); ++void vhost_clear_msg(struct vhost_dev *dev); + + int vhost_get_vq_desc(struct vhost_virtqueue *, + struct iovec iov[], unsigned int iov_count, +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index df40360e04ff7..d90d807c67561 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2507,9 +2507,12 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, + h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres)) + return -EINVAL; + ++ if (font->width > 32 || font->height > 32) ++ return -EINVAL; ++ + /* Make sure drawing engine can handle the font */ +- if (!(info->pixmap.blit_x & (1 << (font->width - 1))) || +- !(info->pixmap.blit_y & (1 << (font->height - 1)))) ++ if (!(info->pixmap.blit_x & BIT(font->width - 1)) || ++ !(info->pixmap.blit_y & BIT(font->height - 1))) + return -EINVAL; + + /* Make sure driver can handle the font length */ +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index 5fa3f1e5dfe88..b3295cd7fd4f9 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -1621,7 +1621,7 @@ static int ufx_usb_probe(struct usb_interface *interface, + struct usb_device *usbdev; + struct ufx_data *dev; + struct fb_info *info; +- int retval; ++ int retval = -ENOMEM; + u32 id_rev, fpga_rev; + + /* usb initialization */ +@@ -1653,15 +1653,17 @@ static int ufx_usb_probe(struct usb_interface *interface, + + if (!ufx_alloc_urb_list(dev, WRITES_IN_FLIGHT, MAX_TRANSFER)) { + dev_err(dev->gdev, "ufx_alloc_urb_list failed\n"); +- goto e_nomem; ++ goto put_ref; + } + + /* We don't register a new USB class. Our client interface is fbdev */ + + /* allocates framebuffer driver structure, not framebuffer memory */ + info = framebuffer_alloc(0, &usbdev->dev); +- if (!info) +- goto e_nomem; ++ if (!info) { ++ dev_err(dev->gdev, "framebuffer_alloc failed\n"); ++ goto free_urb_list; ++ } + + dev->info = info; + info->par = dev; +@@ -1704,22 +1706,34 @@ static int ufx_usb_probe(struct usb_interface *interface, + check_warn_goto_error(retval, "unable to find common mode for display and adapter"); + + retval = ufx_reg_set_bits(dev, 0x4000, 0x00000001); +- check_warn_goto_error(retval, "error %d enabling graphics engine", retval); ++ if (retval < 0) { ++ dev_err(dev->gdev, "error %d enabling graphics engine", retval); ++ goto setup_modes; ++ } + + /* ready to begin using device */ + atomic_set(&dev->usb_active, 1); + + dev_dbg(dev->gdev, "checking var"); + retval = ufx_ops_check_var(&info->var, info); +- check_warn_goto_error(retval, "error %d ufx_ops_check_var", retval); ++ if (retval < 0) { ++ dev_err(dev->gdev, "error %d ufx_ops_check_var", retval); ++ goto reset_active; ++ } + + dev_dbg(dev->gdev, "setting par"); + retval = ufx_ops_set_par(info); +- check_warn_goto_error(retval, "error %d ufx_ops_set_par", retval); ++ if (retval < 0) { ++ dev_err(dev->gdev, "error %d ufx_ops_set_par", retval); ++ goto reset_active; ++ } + + dev_dbg(dev->gdev, "registering framebuffer"); + retval = register_framebuffer(info); +- check_warn_goto_error(retval, "error %d register_framebuffer", retval); ++ if (retval < 0) { ++ dev_err(dev->gdev, "error %d register_framebuffer", retval); ++ goto reset_active; ++ } + + dev_info(dev->gdev, "SMSC UDX USB device /dev/fb%d attached. %dx%d resolution." + " Using %dK framebuffer memory\n", info->node, +@@ -1727,21 +1741,23 @@ static int ufx_usb_probe(struct usb_interface *interface, + + return 0; + +-error: +- fb_dealloc_cmap(&info->cmap); +-destroy_modedb: ++reset_active: ++ atomic_set(&dev->usb_active, 0); ++setup_modes: + fb_destroy_modedb(info->monspecs.modedb); + vfree(info->screen_base); + fb_destroy_modelist(&info->modelist); ++error: ++ fb_dealloc_cmap(&info->cmap); ++destroy_modedb: + framebuffer_release(info); ++free_urb_list: ++ if (dev->urbs.count > 0) ++ ufx_free_urb_list(dev); + put_ref: + kref_put(&dev->kref, ufx_free); /* ref for framebuffer */ + kref_put(&dev->kref, ufx_free); /* last ref from kref_init */ + return retval; +- +-e_nomem: +- retval = -ENOMEM; +- goto put_ref; + } + + static void ufx_usb_disconnect(struct usb_interface *interface) +diff --git a/drivers/watchdog/diag288_wdt.c b/drivers/watchdog/diag288_wdt.c +index 4cb10877017c7..6ca5d9515d85c 100644 +--- a/drivers/watchdog/diag288_wdt.c ++++ b/drivers/watchdog/diag288_wdt.c +@@ -86,7 +86,7 @@ static int __diag288(unsigned int func, unsigned int timeout, + "1:\n" + EX_TABLE(0b, 1b) + : "+d" (err) : "d"(__func), "d"(__timeout), +- "d"(__action), "d"(__len) : "1", "cc"); ++ "d"(__action), "d"(__len) : "1", "cc", "memory"); + return err; + } + +@@ -268,12 +268,21 @@ static int __init diag288_init(void) + char ebc_begin[] = { + 194, 197, 199, 201, 213 + }; ++ char *ebc_cmd; + + watchdog_set_nowayout(&wdt_dev, nowayout_info); + + if (MACHINE_IS_VM) { +- if (__diag288_vm(WDT_FUNC_INIT, 15, +- ebc_begin, sizeof(ebc_begin)) != 0) { ++ ebc_cmd = kmalloc(sizeof(ebc_begin), GFP_KERNEL); ++ if (!ebc_cmd) { ++ pr_err("The watchdog cannot be initialized\n"); ++ return -ENOMEM; ++ } ++ memcpy(ebc_cmd, ebc_begin, sizeof(ebc_begin)); ++ ret = __diag288_vm(WDT_FUNC_INIT, 15, ++ ebc_cmd, sizeof(ebc_begin)); ++ kfree(ebc_cmd); ++ if (ret != 0) { + pr_err("The watchdog cannot be initialized\n"); + return -EINVAL; + } +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index b47fd8435061a..e18df9aea5313 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -129,13 +129,13 @@ static bool pvcalls_conn_back_read(void *opaque) + if (masked_prod < masked_cons) { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = wanted; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, wanted); ++ iov_iter_kvec(&msg.msg_iter, READ, vec, 1, wanted); + } else { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = array_size - masked_prod; + vec[1].iov_base = data->in; + vec[1].iov_len = wanted - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, wanted); ++ iov_iter_kvec(&msg.msg_iter, READ, vec, 2, wanted); + } + + atomic_set(&map->read, 0); +@@ -188,13 +188,13 @@ static bool pvcalls_conn_back_write(struct sock_mapping *map) + if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = size; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 1, size); ++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, size); + } else { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = array_size - pvcalls_mask(cons, array_size); + vec[1].iov_base = data->out; + vec[1].iov_len = size - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 2, size); ++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, size); + } + + atomic_set(&map->write, 0); +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 280a93855eafe..fa1f5fb750b39 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1002,7 +1002,7 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + { + struct page *node_page; + nid_t nid; +- unsigned int ofs_in_node, max_addrs; ++ unsigned int ofs_in_node, max_addrs, base; + block_t source_blkaddr; + + nid = le32_to_cpu(sum->nid); +@@ -1028,11 +1028,17 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + return false; + } + +- max_addrs = IS_INODE(node_page) ? DEF_ADDRS_PER_INODE : +- DEF_ADDRS_PER_BLOCK; +- if (ofs_in_node >= max_addrs) { +- f2fs_err(sbi, "Inconsistent ofs_in_node:%u in summary, ino:%u, nid:%u, max:%u", +- ofs_in_node, dni->ino, dni->nid, max_addrs); ++ if (IS_INODE(node_page)) { ++ base = offset_in_addr(F2FS_INODE(node_page)); ++ max_addrs = DEF_ADDRS_PER_INODE; ++ } else { ++ base = 0; ++ max_addrs = DEF_ADDRS_PER_BLOCK; ++ } ++ ++ if (base + ofs_in_node >= max_addrs) { ++ f2fs_err(sbi, "Inconsistent blkaddr offset: base:%u, ofs_in_node:%u, max:%u, ino:%u, nid:%u", ++ base, ofs_in_node, max_addrs, dni->ino, dni->nid); + f2fs_put_page(node_page, 1); + return false; + } +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index 005e920f5d4a3..4bbfb156e6a40 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -452,8 +452,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) + return error; + + kaddr = kmap_atomic(page); +- if (dsize > gfs2_max_stuffed_size(ip)) +- dsize = gfs2_max_stuffed_size(ip); + memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); + memset(kaddr + dsize, 0, PAGE_SIZE - dsize); + kunmap_atomic(kaddr); +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index f785af2aa23cf..0ec1eaf338338 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -61,9 +61,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, + void *kaddr = kmap(page); + u64 dsize = i_size_read(inode); + +- if (dsize > gfs2_max_stuffed_size(ip)) +- dsize = gfs2_max_stuffed_size(ip); +- + memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); + memset(kaddr + dsize, 0, PAGE_SIZE - dsize); + kunmap(page); +diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c +index 79c621c7863d2..450032b4c886e 100644 +--- a/fs/gfs2/glops.c ++++ b/fs/gfs2/glops.c +@@ -398,38 +398,39 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) + struct timespec64 atime; + u16 height, depth; + umode_t mode = be32_to_cpu(str->di_mode); +- bool is_new = ip->i_inode.i_state & I_NEW; ++ struct inode *inode = &ip->i_inode; ++ bool is_new = inode->i_state & I_NEW; + + if (unlikely(ip->i_no_addr != be64_to_cpu(str->di_num.no_addr))) + goto corrupt; +- if (unlikely(!is_new && inode_wrong_type(&ip->i_inode, mode))) ++ if (unlikely(!is_new && inode_wrong_type(inode, mode))) + goto corrupt; + ip->i_no_formal_ino = be64_to_cpu(str->di_num.no_formal_ino); +- ip->i_inode.i_mode = mode; ++ inode->i_mode = mode; + if (is_new) { +- ip->i_inode.i_rdev = 0; ++ inode->i_rdev = 0; + switch (mode & S_IFMT) { + case S_IFBLK: + case S_IFCHR: +- ip->i_inode.i_rdev = MKDEV(be32_to_cpu(str->di_major), +- be32_to_cpu(str->di_minor)); ++ inode->i_rdev = MKDEV(be32_to_cpu(str->di_major), ++ be32_to_cpu(str->di_minor)); + break; + } + } + +- i_uid_write(&ip->i_inode, be32_to_cpu(str->di_uid)); +- i_gid_write(&ip->i_inode, be32_to_cpu(str->di_gid)); +- set_nlink(&ip->i_inode, be32_to_cpu(str->di_nlink)); +- i_size_write(&ip->i_inode, be64_to_cpu(str->di_size)); +- gfs2_set_inode_blocks(&ip->i_inode, be64_to_cpu(str->di_blocks)); ++ i_uid_write(inode, be32_to_cpu(str->di_uid)); ++ i_gid_write(inode, be32_to_cpu(str->di_gid)); ++ set_nlink(inode, be32_to_cpu(str->di_nlink)); ++ i_size_write(inode, be64_to_cpu(str->di_size)); ++ gfs2_set_inode_blocks(inode, be64_to_cpu(str->di_blocks)); + atime.tv_sec = be64_to_cpu(str->di_atime); + atime.tv_nsec = be32_to_cpu(str->di_atime_nsec); +- if (timespec64_compare(&ip->i_inode.i_atime, &atime) < 0) +- ip->i_inode.i_atime = atime; +- ip->i_inode.i_mtime.tv_sec = be64_to_cpu(str->di_mtime); +- ip->i_inode.i_mtime.tv_nsec = be32_to_cpu(str->di_mtime_nsec); +- ip->i_inode.i_ctime.tv_sec = be64_to_cpu(str->di_ctime); +- ip->i_inode.i_ctime.tv_nsec = be32_to_cpu(str->di_ctime_nsec); ++ if (timespec64_compare(&inode->i_atime, &atime) < 0) ++ inode->i_atime = atime; ++ inode->i_mtime.tv_sec = be64_to_cpu(str->di_mtime); ++ inode->i_mtime.tv_nsec = be32_to_cpu(str->di_mtime_nsec); ++ inode->i_ctime.tv_sec = be64_to_cpu(str->di_ctime); ++ inode->i_ctime.tv_nsec = be32_to_cpu(str->di_ctime_nsec); + + ip->i_goal = be64_to_cpu(str->di_goal_meta); + ip->i_generation = be64_to_cpu(str->di_generation); +@@ -437,7 +438,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) + ip->i_diskflags = be32_to_cpu(str->di_flags); + ip->i_eattr = be64_to_cpu(str->di_eattr); + /* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */ +- gfs2_set_inode_flags(&ip->i_inode); ++ gfs2_set_inode_flags(inode); + height = be16_to_cpu(str->di_height); + if (unlikely(height > GFS2_MAX_META_HEIGHT)) + goto corrupt; +@@ -449,8 +450,11 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) + ip->i_depth = (u8)depth; + ip->i_entries = be32_to_cpu(str->di_entries); + +- if (S_ISREG(ip->i_inode.i_mode)) +- gfs2_set_aops(&ip->i_inode); ++ if (gfs2_is_stuffed(ip) && inode->i_size > gfs2_max_stuffed_size(ip)) ++ goto corrupt; ++ ++ if (S_ISREG(inode->i_mode)) ++ gfs2_set_aops(inode); + + return 0; + corrupt: +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 0f2e0530dd433..d615974ce4183 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -378,6 +378,7 @@ out: + + void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf) + { ++ const struct inode *inode = &ip->i_inode; + struct gfs2_dinode *str = buf; + + str->di_header.mh_magic = cpu_to_be32(GFS2_MAGIC); +@@ -385,15 +386,15 @@ void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf) + str->di_header.mh_format = cpu_to_be32(GFS2_FORMAT_DI); + str->di_num.no_addr = cpu_to_be64(ip->i_no_addr); + str->di_num.no_formal_ino = cpu_to_be64(ip->i_no_formal_ino); +- str->di_mode = cpu_to_be32(ip->i_inode.i_mode); +- str->di_uid = cpu_to_be32(i_uid_read(&ip->i_inode)); +- str->di_gid = cpu_to_be32(i_gid_read(&ip->i_inode)); +- str->di_nlink = cpu_to_be32(ip->i_inode.i_nlink); +- str->di_size = cpu_to_be64(i_size_read(&ip->i_inode)); +- str->di_blocks = cpu_to_be64(gfs2_get_inode_blocks(&ip->i_inode)); +- str->di_atime = cpu_to_be64(ip->i_inode.i_atime.tv_sec); +- str->di_mtime = cpu_to_be64(ip->i_inode.i_mtime.tv_sec); +- str->di_ctime = cpu_to_be64(ip->i_inode.i_ctime.tv_sec); ++ str->di_mode = cpu_to_be32(inode->i_mode); ++ str->di_uid = cpu_to_be32(i_uid_read(inode)); ++ str->di_gid = cpu_to_be32(i_gid_read(inode)); ++ str->di_nlink = cpu_to_be32(inode->i_nlink); ++ str->di_size = cpu_to_be64(i_size_read(inode)); ++ str->di_blocks = cpu_to_be64(gfs2_get_inode_blocks(inode)); ++ str->di_atime = cpu_to_be64(inode->i_atime.tv_sec); ++ str->di_mtime = cpu_to_be64(inode->i_mtime.tv_sec); ++ str->di_ctime = cpu_to_be64(inode->i_ctime.tv_sec); + + str->di_goal_meta = cpu_to_be64(ip->i_goal); + str->di_goal_data = cpu_to_be64(ip->i_goal); +@@ -401,16 +402,16 @@ void gfs2_dinode_out(const struct gfs2_inode *ip, void *buf) + + str->di_flags = cpu_to_be32(ip->i_diskflags); + str->di_height = cpu_to_be16(ip->i_height); +- str->di_payload_format = cpu_to_be32(S_ISDIR(ip->i_inode.i_mode) && ++ str->di_payload_format = cpu_to_be32(S_ISDIR(inode->i_mode) && + !(ip->i_diskflags & GFS2_DIF_EXHASH) ? + GFS2_FORMAT_DE : 0); + str->di_depth = cpu_to_be16(ip->i_depth); + str->di_entries = cpu_to_be32(ip->i_entries); + + str->di_eattr = cpu_to_be64(ip->i_eattr); +- str->di_atime_nsec = cpu_to_be32(ip->i_inode.i_atime.tv_nsec); +- str->di_mtime_nsec = cpu_to_be32(ip->i_inode.i_mtime.tv_nsec); +- str->di_ctime_nsec = cpu_to_be32(ip->i_inode.i_ctime.tv_nsec); ++ str->di_atime_nsec = cpu_to_be32(inode->i_atime.tv_nsec); ++ str->di_mtime_nsec = cpu_to_be32(inode->i_mtime.tv_nsec); ++ str->di_ctime_nsec = cpu_to_be32(inode->i_ctime.tv_nsec); + } + + /** +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index ed640e4e3fac0..136236a25da60 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -132,6 +132,13 @@ next_attr: + if (le16_to_cpu(attr->name_off) + attr->name_len > asize) + goto out; + ++ if (attr->non_res) { ++ t64 = le64_to_cpu(attr->nres.alloc_size); ++ if (le64_to_cpu(attr->nres.data_size) > t64 || ++ le64_to_cpu(attr->nres.valid_size) > t64) ++ goto out; ++ } ++ + switch (attr->type) { + case ATTR_STD: + if (attr->non_res || +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index dbb944b5f81e5..0cc14ce8c7e83 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -791,7 +791,7 @@ static struct ovl_fh *ovl_fid_to_fh(struct fid *fid, int buflen, int fh_type) + return ERR_PTR(-ENOMEM); + + /* Copy unaligned inner fh into aligned buffer */ +- memcpy(&fh->fb, fid, buflen - OVL_FH_WIRE_OFFSET); ++ memcpy(fh->buf, fid, buflen - OVL_FH_WIRE_OFFSET); + return fh; + } + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 2df3e74cdf0f7..ae4876da2ced2 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -107,7 +107,7 @@ struct ovl_fh { + u8 padding[3]; /* make sure fb.fid is 32bit aligned */ + union { + struct ovl_fb fb; +- u8 buf[0]; ++ DECLARE_FLEX_ARRAY(u8, buf); + }; + } __packed; + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index c3b76746cce85..705a41f4d6b36 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -714,9 +714,7 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned long hmask, + page = pfn_swap_entry_to_page(swpent); + } + if (page) { +- int mapcount = page_mapcount(page); +- +- if (mapcount >= 2) ++ if (page_mapcount(page) >= 2 || hugetlb_pmd_shared(pte)) + mss->shared_hugetlb += huge_page_size(hstate_vma(vma)); + else + mss->private_hugetlb += huge_page_size(hstate_vma(vma)); +diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h +index b3fdc8212c5f5..95f8e89017689 100644 +--- a/fs/squashfs/squashfs_fs.h ++++ b/fs/squashfs/squashfs_fs.h +@@ -183,7 +183,7 @@ static inline int squashfs_block_size(__le32 raw) + #define SQUASHFS_ID_BLOCK_BYTES(A) (SQUASHFS_ID_BLOCKS(A) *\ + sizeof(u64)) + /* xattr id lookup table defines */ +-#define SQUASHFS_XATTR_BYTES(A) ((A) * sizeof(struct squashfs_xattr_id)) ++#define SQUASHFS_XATTR_BYTES(A) (((u64) (A)) * sizeof(struct squashfs_xattr_id)) + + #define SQUASHFS_XATTR_BLOCK(A) (SQUASHFS_XATTR_BYTES(A) / \ + SQUASHFS_METADATA_SIZE) +diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h +index 1e90c2575f9bf..0c1ae97897317 100644 +--- a/fs/squashfs/squashfs_fs_sb.h ++++ b/fs/squashfs/squashfs_fs_sb.h +@@ -63,7 +63,7 @@ struct squashfs_sb_info { + long long bytes_used; + unsigned int inodes; + unsigned int fragments; +- int xattr_ids; ++ unsigned int xattr_ids; + unsigned int ids; + bool panic_on_errors; + }; +diff --git a/fs/squashfs/xattr.h b/fs/squashfs/xattr.h +index d8a270d3ac4cb..f1a463d8bfa02 100644 +--- a/fs/squashfs/xattr.h ++++ b/fs/squashfs/xattr.h +@@ -10,12 +10,12 @@ + + #ifdef CONFIG_SQUASHFS_XATTR + extern __le64 *squashfs_read_xattr_id_table(struct super_block *, u64, +- u64 *, int *); ++ u64 *, unsigned int *); + extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *, + unsigned int *, unsigned long long *); + #else + static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb, +- u64 start, u64 *xattr_table_start, int *xattr_ids) ++ u64 start, u64 *xattr_table_start, unsigned int *xattr_ids) + { + struct squashfs_xattr_id_table *id_table; + +diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c +index 087cab8c78f4e..b88d19e9581e9 100644 +--- a/fs/squashfs/xattr_id.c ++++ b/fs/squashfs/xattr_id.c +@@ -56,7 +56,7 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index, + * Read uncompressed xattr id lookup table indexes from disk into memory + */ + __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, +- u64 *xattr_table_start, int *xattr_ids) ++ u64 *xattr_table_start, unsigned int *xattr_ids) + { + struct squashfs_sb_info *msblk = sb->s_fs_info; + unsigned int len, indexes; +@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, + /* Sanity check values */ + + /* there is always at least one xattr id */ +- if (*xattr_ids == 0) ++ if (*xattr_ids <= 0) + return ERR_PTR(-EINVAL); + + len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); +diff --git a/include/linux/highmem-internal.h b/include/linux/highmem-internal.h +index 4aa1031d3e4c3..de17904b7cb44 100644 +--- a/include/linux/highmem-internal.h ++++ b/include/linux/highmem-internal.h +@@ -184,7 +184,7 @@ static inline void *kmap_local_pfn(unsigned long pfn) + static inline void __kunmap_local(void *addr) + { + #ifdef ARCH_HAS_FLUSH_ON_KUNMAP +- kunmap_flush_on_unmap(addr); ++ kunmap_flush_on_unmap(PTR_ALIGN_DOWN(addr, PAGE_SIZE)); + #endif + } + +@@ -211,7 +211,7 @@ static inline void *kmap_atomic_pfn(unsigned long pfn) + static inline void __kunmap_atomic(void *addr) + { + #ifdef ARCH_HAS_FLUSH_ON_KUNMAP +- kunmap_flush_on_unmap(addr); ++ kunmap_flush_on_unmap(PTR_ALIGN_DOWN(addr, PAGE_SIZE)); + #endif + pagefault_enable(); + if (IS_ENABLED(CONFIG_PREEMPT_RT)) +diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h +index af8e7045017fd..cac25ad9d643f 100644 +--- a/include/linux/hugetlb.h ++++ b/include/linux/hugetlb.h +@@ -7,6 +7,7 @@ + #include <linux/fs.h> + #include <linux/hugetlb_inline.h> + #include <linux/cgroup.h> ++#include <linux/page_ref.h> + #include <linux/list.h> + #include <linux/kref.h> + #include <linux/pgtable.h> +@@ -1099,6 +1100,18 @@ static inline __init void hugetlb_cma_check(void) + } + #endif + ++#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE ++static inline bool hugetlb_pmd_shared(pte_t *pte) ++{ ++ return page_count(virt_to_page(pte)) > 1; ++} ++#else ++static inline bool hugetlb_pmd_shared(pte_t *pte) ++{ ++ return false; ++} ++#endif ++ + bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr); + + #ifndef __HAVE_ARCH_FLUSH_HUGETLB_TLB_RANGE +diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h +index 87932bdb25d7b..089597600e26c 100644 +--- a/include/linux/nvmem-provider.h ++++ b/include/linux/nvmem-provider.h +@@ -66,7 +66,6 @@ struct nvmem_keepout { + * @word_size: Minimum read/write access granularity. + * @stride: Minimum read/write access stride. + * @priv: User context passed to read/write callbacks. +- * @wp-gpio: Write protect pin + * @ignore_wp: Write Protect pin is managed by the provider. + * + * Note: A default "nvmem<id>" name will be assigned to the device if +@@ -81,7 +80,6 @@ struct nvmem_config { + const char *name; + int id; + struct module *owner; +- struct gpio_desc *wp_gpio; + const struct nvmem_cell_info *cells; + int ncells; + const struct nvmem_keepout *keepout; +diff --git a/include/linux/util_macros.h b/include/linux/util_macros.h +index 72299f261b253..43db6e47503c7 100644 +--- a/include/linux/util_macros.h ++++ b/include/linux/util_macros.h +@@ -38,4 +38,16 @@ + */ + #define find_closest_descending(x, a, as) __find_closest(x, a, as, >=) + ++/** ++ * is_insidevar - check if the @ptr points inside the @var memory range. ++ * @ptr: the pointer to a memory address. ++ * @var: the variable which address and size identify the memory range. ++ * ++ * Evaluates to true if the address in @ptr lies within the memory ++ * range allocated to @var. ++ */ ++#define is_insidevar(ptr, var) \ ++ ((uintptr_t)(ptr) >= (uintptr_t)(var) && \ ++ (uintptr_t)(ptr) < (uintptr_t)(var) + sizeof(var)) ++ + #endif +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index 5cf84228b51d1..c7ee5279e7fc9 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -414,6 +414,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost, + extern struct iscsi_cls_session * + iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost, + uint16_t, int, int, uint32_t, unsigned int); ++void iscsi_session_remove(struct iscsi_cls_session *cls_session); ++void iscsi_session_free(struct iscsi_cls_session *cls_session); + extern void iscsi_session_teardown(struct iscsi_cls_session *); + extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *); + extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn, +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 49e51fc0c2f40..1c95d97e7aa53 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -614,6 +614,12 @@ static bool is_spilled_reg(const struct bpf_stack_state *stack) + return stack->slot_type[BPF_REG_SIZE - 1] == STACK_SPILL; + } + ++static void scrub_spilled_slot(u8 *stype) ++{ ++ if (*stype != STACK_INVALID) ++ *stype = STACK_MISC; ++} ++ + static void print_verifier_state(struct bpf_verifier_env *env, + const struct bpf_func_state *state) + { +@@ -2218,8 +2224,6 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, + */ + if (insn->src_reg != BPF_REG_FP) + return 0; +- if (BPF_SIZE(insn->code) != BPF_DW) +- return 0; + + /* dreg = *(u64 *)[fp - off] was a fill from the stack. + * that [fp - off] slot contains scalar that needs to be +@@ -2242,8 +2246,6 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, + /* scalars can only be spilled into stack */ + if (insn->dst_reg != BPF_REG_FP) + return 0; +- if (BPF_SIZE(insn->code) != BPF_DW) +- return 0; + spi = (-insn->off - 1) / BPF_REG_SIZE; + if (spi >= 64) { + verbose(env, "BUG spi %d\n", spi); +@@ -2259,6 +2261,12 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, + if (opcode == BPF_CALL) { + if (insn->src_reg == BPF_PSEUDO_CALL) + return -ENOTSUPP; ++ /* kfunc with imm==0 is invalid and fixup_kfunc_call will ++ * catch this error later. Make backtracking conservative ++ * with ENOTSUPP. ++ */ ++ if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL && insn->imm == 0) ++ return -ENOTSUPP; + /* regular helper call sets R0 */ + *reg_mask &= ~1; + if (*reg_mask & 0x3f) { +@@ -2607,16 +2615,33 @@ static bool __is_pointer_value(bool allow_ptr_leaks, + return reg->type != SCALAR_VALUE; + } + ++/* Copy src state preserving dst->parent and dst->live fields */ ++static void copy_register_state(struct bpf_reg_state *dst, const struct bpf_reg_state *src) ++{ ++ struct bpf_reg_state *parent = dst->parent; ++ enum bpf_reg_liveness live = dst->live; ++ ++ *dst = *src; ++ dst->parent = parent; ++ dst->live = live; ++} ++ + static void save_register_state(struct bpf_func_state *state, +- int spi, struct bpf_reg_state *reg) ++ int spi, struct bpf_reg_state *reg, ++ int size) + { + int i; + +- state->stack[spi].spilled_ptr = *reg; +- state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ copy_register_state(&state->stack[spi].spilled_ptr, reg); ++ if (size == BPF_REG_SIZE) ++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ ++ for (i = BPF_REG_SIZE; i > BPF_REG_SIZE - size; i--) ++ state->stack[spi].slot_type[i - 1] = STACK_SPILL; + +- for (i = 0; i < BPF_REG_SIZE; i++) +- state->stack[spi].slot_type[i] = STACK_SPILL; ++ /* size < 8 bytes spill */ ++ for (; i; i--) ++ scrub_spilled_slot(&state->stack[spi].slot_type[i - 1]); + } + + /* check_stack_{read,write}_fixed_off functions track spill/fill of registers, +@@ -2665,7 +2690,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + env->insn_aux_data[insn_idx].sanitize_stack_spill = true; + } + +- if (reg && size == BPF_REG_SIZE && register_is_bounded(reg) && ++ if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) && + !register_is_null(reg) && env->bpf_capable) { + if (dst_reg != BPF_REG_FP) { + /* The backtracking logic can only recognize explicit +@@ -2678,7 +2703,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + if (err) + return err; + } +- save_register_state(state, spi, reg); ++ save_register_state(state, spi, reg, size); + } else if (reg && is_spillable_regtype(reg->type)) { + /* register containing pointer is being spilled into stack */ + if (size != BPF_REG_SIZE) { +@@ -2690,7 +2715,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + verbose(env, "cannot spill pointers to stack into stack frame of the caller\n"); + return -EINVAL; + } +- save_register_state(state, spi, reg); ++ save_register_state(state, spi, reg, size); + } else { + u8 type = STACK_MISC; + +@@ -2699,7 +2724,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + /* Mark slots as STACK_MISC if they belonged to spilled ptr. */ + if (is_spilled_reg(&state->stack[spi])) + for (i = 0; i < BPF_REG_SIZE; i++) +- state->stack[spi].slot_type[i] = STACK_MISC; ++ scrub_spilled_slot(&state->stack[spi].slot_type[i]); + + /* only mark the slot as written if all 8 bytes were written + * otherwise read propagation may incorrectly stop too soon +@@ -2905,35 +2930,56 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, + struct bpf_func_state *state = vstate->frame[vstate->curframe]; + int i, slot = -off - 1, spi = slot / BPF_REG_SIZE; + struct bpf_reg_state *reg; +- u8 *stype; ++ u8 *stype, type; + + stype = reg_state->stack[spi].slot_type; + reg = ®_state->stack[spi].spilled_ptr; + + if (is_spilled_reg(®_state->stack[spi])) { +- if (size != BPF_REG_SIZE) { ++ u8 spill_size = 1; ++ ++ for (i = BPF_REG_SIZE - 1; i > 0 && stype[i - 1] == STACK_SPILL; i--) ++ spill_size++; ++ ++ if (size != BPF_REG_SIZE || spill_size != BPF_REG_SIZE) { + if (reg->type != SCALAR_VALUE) { + verbose_linfo(env, env->insn_idx, "; "); + verbose(env, "invalid size of register fill\n"); + return -EACCES; + } +- if (dst_regno >= 0) { ++ ++ mark_reg_read(env, reg, reg->parent, REG_LIVE_READ64); ++ if (dst_regno < 0) ++ return 0; ++ ++ if (!(off % BPF_REG_SIZE) && size == spill_size) { ++ /* The earlier check_reg_arg() has decided the ++ * subreg_def for this insn. Save it first. ++ */ ++ s32 subreg_def = state->regs[dst_regno].subreg_def; ++ ++ copy_register_state(&state->regs[dst_regno], reg); ++ state->regs[dst_regno].subreg_def = subreg_def; ++ } else { ++ for (i = 0; i < size; i++) { ++ type = stype[(slot - i) % BPF_REG_SIZE]; ++ if (type == STACK_SPILL) ++ continue; ++ if (type == STACK_MISC) ++ continue; ++ verbose(env, "invalid read from stack off %d+%d size %d\n", ++ off, i, size); ++ return -EACCES; ++ } + mark_reg_unknown(env, state->regs, dst_regno); +- state->regs[dst_regno].live |= REG_LIVE_WRITTEN; + } +- mark_reg_read(env, reg, reg->parent, REG_LIVE_READ64); ++ state->regs[dst_regno].live |= REG_LIVE_WRITTEN; + return 0; + } +- for (i = 1; i < BPF_REG_SIZE; i++) { +- if (stype[(slot - i) % BPF_REG_SIZE] != STACK_SPILL) { +- verbose(env, "corrupted spill memory\n"); +- return -EACCES; +- } +- } + + if (dst_regno >= 0) { + /* restore register state from stack */ +- state->regs[dst_regno] = *reg; ++ copy_register_state(&state->regs[dst_regno], reg); + /* mark reg as written since spilled pointer state likely + * has its liveness marks cleared by is_state_visited() + * which resets stack/reg liveness for state transitions +@@ -2952,8 +2998,6 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, + } + mark_reg_read(env, reg, reg->parent, REG_LIVE_READ64); + } else { +- u8 type; +- + for (i = 0; i < size; i++) { + type = stype[(slot - i) % BPF_REG_SIZE]; + if (type == STACK_MISC) +@@ -4559,7 +4603,7 @@ static int check_stack_range_initialized( + if (clobber) { + __mark_reg_unknown(env, &state->stack[spi].spilled_ptr); + for (j = 0; j < BPF_REG_SIZE; j++) +- state->stack[spi].slot_type[j] = STACK_MISC; ++ scrub_spilled_slot(&state->stack[spi].slot_type[j]); + } + goto mark; + } +@@ -6867,7 +6911,7 @@ do_sim: + */ + if (!ptr_is_dst_reg) { + tmp = *dst_reg; +- *dst_reg = *ptr_reg; ++ copy_register_state(dst_reg, ptr_reg); + } + ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1, + env->insn_idx); +@@ -8123,7 +8167,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + * to propagate min/max range. + */ + src_reg->id = ++env->id_gen; +- *dst_reg = *src_reg; ++ copy_register_state(dst_reg, src_reg); + dst_reg->live |= REG_LIVE_WRITTEN; + dst_reg->subreg_def = DEF_NOT_SUBREG; + } else { +@@ -8134,7 +8178,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + insn->src_reg); + return -EACCES; + } else if (src_reg->type == SCALAR_VALUE) { +- *dst_reg = *src_reg; ++ copy_register_state(dst_reg, src_reg); + /* Make sure ID is cleared otherwise + * dst_reg min/max could be incorrectly + * propagated into src_reg by find_equal_scalars() +@@ -8930,7 +8974,7 @@ static void find_equal_scalars(struct bpf_verifier_state *vstate, + + bpf_for_each_reg_in_vstate(vstate, state, reg, ({ + if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) +- *reg = *known_reg; ++ copy_register_state(reg, known_reg); + })); + } + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 035e3038c4de4..b1e6ca98d0af4 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -1913,7 +1913,7 @@ static void debugfs_add_domain_dir(struct irq_domain *d) + + static void debugfs_remove_domain_dir(struct irq_domain *d) + { +- debugfs_remove(debugfs_lookup(d->name, domain_dir)); ++ debugfs_lookup_and_remove(d->name, domain_dir); + } + + void __init irq_domain_debugfs_init(struct dentry *root) +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 4daf1e0445565..b314e71a008ce 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -776,6 +776,7 @@ static void do_bpf_send_signal(struct irq_work *entry) + + work = container_of(entry, struct send_signal_irq_work, irq_work); + group_send_sig_info(work->sig, SEND_SIG_PRIV, work->task, work->type); ++ put_task_struct(work->task); + } + + static int bpf_send_signal_common(u32 sig, enum pid_type type) +@@ -812,7 +813,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) + * to the irq_work. The current task may change when queued + * irq works get executed. + */ +- work->task = current; ++ work->task = get_task_struct(current); + work->sig = sig; + work->type = type; + irq_work_queue(&work->irq_work); +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 22d10f7138487..1551fb89769f6 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1093,6 +1093,7 @@ start_over: + goto check_out; + pr_debug("scan_swap_map of si %d failed to find offset\n", + si->type); ++ cond_resched(); + + spin_lock(&swap_avail_lock); + nextsi: +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index a718204c4bfdd..f3c7cfba31e1b 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -871,6 +871,7 @@ static unsigned int ip_sabotage_in(void *priv, + if (nf_bridge && !nf_bridge->in_prerouting && + !netif_is_l3_master(skb->dev) && + !netif_is_l3_slave(skb->dev)) { ++ nf_bridge_info_free(skb); + state->okfn(state->net, state->sk, skb); + return NF_STOLEN; + } +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index 55f29c9f9e08e..4177e96170703 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1092,10 +1092,6 @@ static bool j1939_session_deactivate(struct j1939_session *session) + bool active; + + j1939_session_list_lock(priv); +- /* This function should be called with a session ref-count of at +- * least 2. +- */ +- WARN_ON_ONCE(kref_read(&session->kref) < 2); + active = j1939_session_deactivate_locked(session); + j1939_session_list_unlock(priv); + +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index b4b642e3de783..7f34c455651db 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -6,6 +6,7 @@ + #include <linux/bpf.h> + #include <linux/init.h> + #include <linux/wait.h> ++#include <linux/util_macros.h> + + #include <net/inet_common.h> + #include <net/tls.h> +@@ -640,10 +641,9 @@ EXPORT_SYMBOL_GPL(tcp_bpf_update_proto); + */ + void tcp_bpf_clone(const struct sock *sk, struct sock *newsk) + { +- int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4; + struct proto *prot = newsk->sk_prot; + +- if (prot == &tcp_bpf_prots[family][TCP_BPF_BASE]) ++ if (is_insidevar(prot, tcp_bpf_prots)) + newsk->sk_prot = sk->sk_prot_creator; + } + #endif /* CONFIG_BPF_SYSCALL */ +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 8800987fdb402..6ba34f51c411f 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3129,17 +3129,17 @@ static void add_v4_addrs(struct inet6_dev *idev) + offset = sizeof(struct in6_addr) - 4; + memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); + +- if (idev->dev->flags&IFF_POINTOPOINT) { ++ if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { ++ scope = IPV6_ADDR_COMPATv4; ++ plen = 96; ++ pflags |= RTF_NONEXTHOP; ++ } else { + if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE) + return; + + addr.s6_addr32[0] = htonl(0xfe800000); + scope = IFA_LINK; + plen = 64; +- } else { +- scope = IPV6_ADDR_COMPATv4; +- plen = 96; +- pflags |= RTF_NONEXTHOP; + } + + if (addr.s6_addr32[3]) { +@@ -3447,6 +3447,30 @@ static void addrconf_gre_config(struct net_device *dev) + } + #endif + ++static void addrconf_init_auto_addrs(struct net_device *dev) ++{ ++ switch (dev->type) { ++#if IS_ENABLED(CONFIG_IPV6_SIT) ++ case ARPHRD_SIT: ++ addrconf_sit_config(dev); ++ break; ++#endif ++#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) ++ case ARPHRD_IP6GRE: ++ case ARPHRD_IPGRE: ++ addrconf_gre_config(dev); ++ break; ++#endif ++ case ARPHRD_LOOPBACK: ++ init_loopback(dev); ++ break; ++ ++ default: ++ addrconf_dev_config(dev); ++ break; ++ } ++} ++ + static int fixup_permanent_addr(struct net *net, + struct inet6_dev *idev, + struct inet6_ifaddr *ifp) +@@ -3611,26 +3635,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + run_pending = 1; + } + +- switch (dev->type) { +-#if IS_ENABLED(CONFIG_IPV6_SIT) +- case ARPHRD_SIT: +- addrconf_sit_config(dev); +- break; +-#endif +-#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) +- case ARPHRD_IP6GRE: +- case ARPHRD_IPGRE: +- addrconf_gre_config(dev); +- break; +-#endif +- case ARPHRD_LOOPBACK: +- init_loopback(dev); +- break; +- +- default: +- addrconf_dev_config(dev); +- break; +- } ++ addrconf_init_auto_addrs(dev); + + if (!IS_ERR_OR_NULL(idev)) { + if (run_pending) +@@ -6385,7 +6390,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write, + + if (idev->cnf.addr_gen_mode != new_val) { + idev->cnf.addr_gen_mode = new_val; +- addrconf_dev_config(idev->dev); ++ addrconf_init_auto_addrs(idev->dev); + } + } else if (&net->ipv6.devconf_all->addr_gen_mode == ctl->data) { + struct net_device *dev; +@@ -6396,7 +6401,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write, + if (idev && + idev->cnf.addr_gen_mode != new_val) { + idev->cnf.addr_gen_mode = new_val; +- addrconf_dev_config(idev->dev); ++ addrconf_init_auto_addrs(idev->dev); + } + } + } +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index e5c8a295e6406..5c04da4cfbad0 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -400,6 +400,11 @@ static int nr_listen(struct socket *sock, int backlog) + struct sock *sk = sock->sk; + + lock_sock(sk); ++ if (sock->state != SS_UNCONNECTED) { ++ release_sock(sk); ++ return -EINVAL; ++ } ++ + if (sk->sk_state != TCP_LISTEN) { + memset(&nr_sk(sk)->user_addr, 0, AX25_ADDR_LEN); + sk->sk_max_ack_backlog = backlog; +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 795a25ecb8939..0fc98e89a1149 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -977,14 +977,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + key = kzalloc(sizeof(*key), GFP_KERNEL); + if (!key) { + error = -ENOMEM; +- goto err_kfree_key; ++ goto err_kfree_flow; + } + + ovs_match_init(&match, key, false, &mask); + error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY], + a[OVS_FLOW_ATTR_MASK], log); + if (error) +- goto err_kfree_flow; ++ goto err_kfree_key; + + ovs_flow_mask_key(&new_flow->key, key, true, &mask); + +@@ -992,14 +992,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID], + key, log); + if (error) +- goto err_kfree_flow; ++ goto err_kfree_key; + + /* Validate actions. */ + error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS], + &new_flow->key, &acts, log); + if (error) { + OVS_NLERR(log, "Flow actions may not be safe on all matching packets."); +- goto err_kfree_flow; ++ goto err_kfree_key; + } + + reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false, +@@ -1099,10 +1099,10 @@ err_unlock_ovs: + kfree_skb(reply); + err_kfree_acts: + ovs_nla_free_flow_actions(acts); +-err_kfree_flow: +- ovs_flow_free(new_flow, false); + err_kfree_key: + kfree(key); ++err_kfree_flow: ++ ovs_flow_free(new_flow, false); + error: + return error; + } +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index 1990d496fcfc0..e595079c2cafe 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -83,7 +83,10 @@ static struct qrtr_node *node_get(unsigned int node_id) + + node->id = node_id; + +- radix_tree_insert(&nodes, node_id, node); ++ if (radix_tree_insert(&nodes, node_id, node)) { ++ kfree(node); ++ return NULL; ++ } + + return node; + } +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 3a171828638b1..07f6206e7cb47 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -482,6 +482,12 @@ static int x25_listen(struct socket *sock, int backlog) + int rc = -EOPNOTSUPP; + + lock_sock(sk); ++ if (sock->state != SS_UNCONNECTED) { ++ rc = -EINVAL; ++ release_sock(sk); ++ return rc; ++ } ++ + if (sk->sk_state != TCP_LISTEN) { + memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN); + sk->sk_max_ack_backlog = backlog; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 74fe0fe858344..6a6ea25dc4cee 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8873,6 +8873,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x053c, "Dell Latitude E5430", ALC292_FIXUP_DELL_E7X), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), +diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c +index a188901a83bbe..29abc96dc146c 100644 +--- a/sound/pci/hda/patch_via.c ++++ b/sound/pci/hda/patch_via.c +@@ -821,6 +821,9 @@ static int add_secret_dac_path(struct hda_codec *codec) + return 0; + nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn, + ARRAY_SIZE(conn) - 1); ++ if (nums < 0) ++ return nums; ++ + for (i = 0; i < nums; i++) { + if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT) + return 0; +diff --git a/sound/soc/intel/boards/bdw-rt5650.c b/sound/soc/intel/boards/bdw-rt5650.c +index c5122d3b0e6c4..7c8c2557d6850 100644 +--- a/sound/soc/intel/boards/bdw-rt5650.c ++++ b/sound/soc/intel/boards/bdw-rt5650.c +@@ -299,7 +299,7 @@ static int bdw_rt5650_probe(struct platform_device *pdev) + if (!bdw_rt5650) + return -ENOMEM; + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + ret = snd_soc_fixup_dai_links_platform_name(&bdw_rt5650_card, + mach->mach_params.platform); +diff --git a/sound/soc/intel/boards/bdw-rt5677.c b/sound/soc/intel/boards/bdw-rt5677.c +index e01b7a90ca6c7..e990940179095 100644 +--- a/sound/soc/intel/boards/bdw-rt5677.c ++++ b/sound/soc/intel/boards/bdw-rt5677.c +@@ -426,7 +426,7 @@ static int bdw_rt5677_probe(struct platform_device *pdev) + if (!bdw_rt5677) + return -ENOMEM; + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + ret = snd_soc_fixup_dai_links_platform_name(&bdw_rt5677_card, + mach->mach_params.platform); +diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c +index 3c3aff9c61cc6..f18dcda23e74b 100644 +--- a/sound/soc/intel/boards/broadwell.c ++++ b/sound/soc/intel/boards/broadwell.c +@@ -292,7 +292,7 @@ static int broadwell_audio_probe(struct platform_device *pdev) + + broadwell_rt286.dev = &pdev->dev; + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + ret = snd_soc_fixup_dai_links_platform_name(&broadwell_rt286, + mach->mach_params.platform); +diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c +index e67ddfb8e4690..e49c64f54a12c 100644 +--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c ++++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c +@@ -825,7 +825,7 @@ static int broxton_audio_probe(struct platform_device *pdev) + } + } + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + platform_name = mach->mach_params.platform; + +diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c +index 47f6b1523ae6b..0d1df37ecea0b 100644 +--- a/sound/soc/intel/boards/bxt_rt298.c ++++ b/sound/soc/intel/boards/bxt_rt298.c +@@ -628,7 +628,7 @@ static int broxton_audio_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + snd_soc_card_set_drvdata(card, ctx); + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + platform_name = mach->mach_params.platform; + +diff --git a/sound/soc/intel/boards/bytcht_cx2072x.c b/sound/soc/intel/boards/bytcht_cx2072x.c +index a9e51bbf018c3..0fc57db6e92cb 100644 +--- a/sound/soc/intel/boards/bytcht_cx2072x.c ++++ b/sound/soc/intel/boards/bytcht_cx2072x.c +@@ -257,7 +257,7 @@ static int snd_byt_cht_cx2072x_probe(struct platform_device *pdev) + byt_cht_cx2072x_dais[dai_index].codecs->name = codec_name; + } + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_cx2072x_card, + mach->mach_params.platform); + if (ret) +diff --git a/sound/soc/intel/boards/bytcht_da7213.c b/sound/soc/intel/boards/bytcht_da7213.c +index a28773fb7892b..21b6bebc9a26a 100644 +--- a/sound/soc/intel/boards/bytcht_da7213.c ++++ b/sound/soc/intel/boards/bytcht_da7213.c +@@ -260,7 +260,7 @@ static int bytcht_da7213_probe(struct platform_device *pdev) + dailink[dai_index].codecs->name = codec_name; + } + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + platform_name = mach->mach_params.platform; + + ret_val = snd_soc_fixup_dai_links_platform_name(card, platform_name); +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 950457bcc28fe..b5c97d35864a6 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -497,21 +497,28 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(codec_name, sizeof(codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_cht_es8316_dais[dai_index].codecs->name = codec_name; + } else { + dev_err(dev, "Error cannot find '%s' dev\n", mach->id); + return -ENXIO; + } + +- /* override plaform name, if required */ ++ codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); ++ if (!codec_dev) ++ return -EPROBE_DEFER; ++ priv->codec_dev = get_device(codec_dev); ++ ++ /* override platform name, if required */ + byt_cht_es8316_card.dev = dev; + platform_name = mach->mach_params.platform; + + ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_es8316_card, + platform_name); +- if (ret) ++ if (ret) { ++ put_device(codec_dev); + return ret; ++ } + + /* Check for BYTCR or other platform and setup quirks */ + dmi_id = dmi_first_match(byt_cht_es8316_quirk_table); +@@ -539,14 +546,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + + /* get the clock */ + priv->mclk = devm_clk_get(dev, "pmc_plt_clk_3"); +- if (IS_ERR(priv->mclk)) ++ if (IS_ERR(priv->mclk)) { ++ put_device(codec_dev); + return dev_err_probe(dev, PTR_ERR(priv->mclk), "clk_get pmc_plt_clk_3 failed\n"); +- +- /* get speaker enable GPIO */ +- codec_dev = acpi_get_first_physical_node(adev); +- if (!codec_dev) +- return -EPROBE_DEFER; +- priv->codec_dev = get_device(codec_dev); ++ } + + if (quirk & BYT_CHT_ES8316_JD_INVERTED) + props[cnt++] = PROPERTY_ENTRY_BOOL("everest,jack-detect-inverted"); +@@ -568,6 +571,7 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + } + } + ++ /* get speaker enable GPIO */ + devm_acpi_dev_add_driver_gpios(codec_dev, byt_cht_es8316_gpios); + priv->speaker_en_gpio = + gpiod_get_optional(codec_dev, "speaker-enable", +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 888e04c577579..5f6e2bb324406 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -1561,13 +1561,18 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(byt_rt5640_codec_name, sizeof(byt_rt5640_codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_rt5640_dais[dai_index].codecs->name = byt_rt5640_codec_name; + } else { + dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id); + return -ENXIO; + } + ++ codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); ++ if (!codec_dev) ++ return -EPROBE_DEFER; ++ priv->codec_dev = get_device(codec_dev); ++ + /* + * swap SSP0 if bytcr is detected + * (will be overridden if DMI quirk is detected) +@@ -1642,11 +1647,6 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + byt_rt5640_quirk = quirk_override; + } + +- codec_dev = acpi_get_first_physical_node(adev); +- if (!codec_dev) +- return -EPROBE_DEFER; +- priv->codec_dev = get_device(codec_dev); +- + if (byt_rt5640_quirk & BYT_RT5640_JD_HP_ELITEP_1000G2) { + acpi_dev_add_driver_gpios(ACPI_COMPANION(priv->codec_dev), + byt_rt5640_hp_elitepad_1000g2_gpios); +@@ -1733,7 +1733,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + byt_rt5640_card.long_name = byt_rt5640_long_name; + #endif + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + platform_name = mach->mach_params.platform; + + ret_val = snd_soc_fixup_dai_links_platform_name(&byt_rt5640_card, +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index e94c9124d4f41..93cec4d916273 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -930,7 +930,6 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(byt_rt5651_codec_name, sizeof(byt_rt5651_codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_rt5651_dais[dai_index].codecs->name = byt_rt5651_codec_name; + } else { + dev_err(&pdev->dev, "Error cannot find '%s' dev\n", mach->id); +@@ -938,6 +937,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) + } + + codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); + if (!codec_dev) + return -EPROBE_DEFER; + priv->codec_dev = get_device(codec_dev); +@@ -1104,7 +1104,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) + byt_rt5651_card.long_name = byt_rt5651_long_name; + #endif + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + platform_name = mach->mach_params.platform; + + ret_val = snd_soc_fixup_dai_links_platform_name(&byt_rt5651_card, +diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c +index bb669d58eb8b3..9a4126f19d5f7 100644 +--- a/sound/soc/intel/boards/bytcr_wm5102.c ++++ b/sound/soc/intel/boards/bytcr_wm5102.c +@@ -411,9 +411,9 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev) + return -ENOENT; + } + snprintf(codec_name, sizeof(codec_name), "spi-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + + codec_dev = bus_find_device_by_name(&spi_bus_type, NULL, codec_name); ++ acpi_dev_put(adev); + if (!codec_dev) + return -EPROBE_DEFER; + +diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +index 131882378a594..ba6de1e389cd8 100644 +--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c ++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +@@ -296,7 +296,7 @@ static int cht_max98090_headset_init(struct snd_soc_component *component) + int ret; + + /* +- * TI supports 4 butons headset detection ++ * TI supports 4 buttons headset detection + * KEY_MEDIA + * KEY_VOICECOMMAND + * KEY_VOLUMEUP +@@ -558,7 +558,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + dev_dbg(dev, "Unable to add GPIO mapping table\n"); + } + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + snd_soc_card_cht.dev = &pdev->dev; + mach = pdev->dev.platform_data; + platform_name = mach->mach_params.platform; +diff --git a/sound/soc/intel/boards/cht_bsw_nau8824.c b/sound/soc/intel/boards/cht_bsw_nau8824.c +index da5a5cbc87590..779b388db85d3 100644 +--- a/sound/soc/intel/boards/cht_bsw_nau8824.c ++++ b/sound/soc/intel/boards/cht_bsw_nau8824.c +@@ -100,7 +100,7 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) + struct snd_soc_component *component = codec_dai->component; + int ret, jack_type; + +- /* NAU88L24 supports 4 butons headset detection ++ /* NAU88L24 supports 4 buttons headset detection + * KEY_PLAYPAUSE + * KEY_VOICECOMMAND + * KEY_VOLUMEUP +@@ -257,7 +257,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + return -ENOMEM; + snd_soc_card_set_drvdata(&snd_soc_card_cht, drv); + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + snd_soc_card_cht.dev = &pdev->dev; + mach = pdev->dev.platform_data; + platform_name = mach->mach_params.platform; +diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c +index 804dbc7911d50..381bf6054047f 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -653,7 +653,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + (cht_rt5645_quirk & CHT_RT5645_SSP0_AIF2)) + cht_dailink[dai_index].cpus->dai_name = "ssp0-port"; + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + platform_name = mach->mach_params.platform; + + ret_val = snd_soc_fixup_dai_links_platform_name(card, +diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c +index 9509b6e161b89..ba96741c7771b 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5672.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5672.c +@@ -483,7 +483,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + drv->use_ssp0 = true; + } + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + snd_soc_card_cht.dev = &pdev->dev; + platform_name = mach->mach_params.platform; + +diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c +index 71fe26a1b7011..99b3d7642cb77 100644 +--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c ++++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c +@@ -604,7 +604,7 @@ static int geminilake_audio_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + snd_soc_card_set_drvdata(card, ctx); + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + platform_name = mach->mach_params.platform; + +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index c763bfeb1f38f..b5ca3177be6a3 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -175,7 +175,7 @@ static int haswell_audio_probe(struct platform_device *pdev) + + haswell_rt5640.dev = &pdev->dev; + +- /* override plaform name, if required */ ++ /* override platform name, if required */ + mach = pdev->dev.platform_data; + ret = snd_soc_fixup_dai_links_platform_name(&haswell_rt5640, + mach->mach_params.platform); +diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh +index dc932fd653634..640bc43452faa 100755 +--- a/tools/testing/selftests/net/udpgso_bench.sh ++++ b/tools/testing/selftests/net/udpgso_bench.sh +@@ -7,6 +7,7 @@ readonly GREEN='\033[0;92m' + readonly YELLOW='\033[0;33m' + readonly RED='\033[0;31m' + readonly NC='\033[0m' # No Color ++readonly TESTPORT=8000 + + readonly KSFT_PASS=0 + readonly KSFT_FAIL=1 +@@ -56,11 +57,26 @@ trap wake_children EXIT + + run_one() { + local -r args=$@ ++ local nr_socks=0 ++ local i=0 ++ local -r timeout=10 ++ ++ ./udpgso_bench_rx -p "$TESTPORT" & ++ ./udpgso_bench_rx -p "$TESTPORT" -t & ++ ++ # Wait for the above test program to get ready to receive connections. ++ while [ "$i" -lt "$timeout" ]; do ++ nr_socks="$(ss -lnHi | grep -c "\*:${TESTPORT}")" ++ [ "$nr_socks" -eq 2 ] && break ++ i=$((i + 1)) ++ sleep 1 ++ done ++ if [ "$nr_socks" -ne 2 ]; then ++ echo "timed out while waiting for udpgso_bench_rx" ++ exit 1 ++ fi + +- ./udpgso_bench_rx & +- ./udpgso_bench_rx -t & +- +- ./udpgso_bench_tx ${args} ++ ./udpgso_bench_tx -p "$TESTPORT" ${args} + } + + run_in_netns() { +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index 6a193425c367f..4058c7451e70d 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -250,7 +250,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) + static void do_flush_udp(int fd) + { + static char rbuf[ETH_MAX_MTU]; +- int ret, len, gso_size, budget = 256; ++ int ret, len, gso_size = 0, budget = 256; + + len = cfg_read_all ? sizeof(rbuf) : 0; + while (budget--) { +@@ -336,6 +336,8 @@ static void parse_opts(int argc, char **argv) + cfg_verify = true; + cfg_read_all = true; + break; ++ default: ++ exit(1); + } + } + +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index f1fdaa2702913..477392715a9ad 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -62,6 +62,7 @@ static int cfg_payload_len = (1472 * 42); + static int cfg_port = 8000; + static int cfg_runtime_ms = -1; + static bool cfg_poll; ++static int cfg_poll_loop_timeout_ms = 2000; + static bool cfg_segment; + static bool cfg_sendmmsg; + static bool cfg_tcp; +@@ -235,16 +236,17 @@ static void flush_errqueue_recv(int fd) + } + } + +-static void flush_errqueue(int fd, const bool do_poll) ++static void flush_errqueue(int fd, const bool do_poll, ++ unsigned long poll_timeout, const bool poll_err) + { + if (do_poll) { + struct pollfd fds = {0}; + int ret; + + fds.fd = fd; +- ret = poll(&fds, 1, 500); ++ ret = poll(&fds, 1, poll_timeout); + if (ret == 0) { +- if (cfg_verbose) ++ if ((cfg_verbose) && (poll_err)) + fprintf(stderr, "poll timeout\n"); + } else if (ret < 0) { + error(1, errno, "poll"); +@@ -254,6 +256,20 @@ static void flush_errqueue(int fd, const bool do_poll) + flush_errqueue_recv(fd); + } + ++static void flush_errqueue_retry(int fd, unsigned long num_sends) ++{ ++ unsigned long tnow, tstop; ++ bool first_try = true; ++ ++ tnow = gettimeofday_ms(); ++ tstop = tnow + cfg_poll_loop_timeout_ms; ++ do { ++ flush_errqueue(fd, true, tstop - tnow, first_try); ++ first_try = false; ++ tnow = gettimeofday_ms(); ++ } while ((stat_zcopies != num_sends) && (tnow < tstop)); ++} ++ + static int send_tcp(int fd, char *data) + { + int ret, done = 0, count = 0; +@@ -413,7 +429,8 @@ static int send_udp_segment(int fd, char *data) + + static void usage(const char *filepath) + { +- error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", ++ error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] " ++ "[-L secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", + filepath); + } + +@@ -423,7 +440,7 @@ static void parse_opts(int argc, char **argv) + int max_len, hdrlen; + int c; + +- while ((c = getopt(argc, argv, "46acC:D:Hl:mM:p:s:PS:tTuvz")) != -1) { ++ while ((c = getopt(argc, argv, "46acC:D:Hl:L:mM:p:s:PS:tTuvz")) != -1) { + switch (c) { + case '4': + if (cfg_family != PF_UNSPEC) +@@ -452,6 +469,9 @@ static void parse_opts(int argc, char **argv) + case 'l': + cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; + break; ++ case 'L': ++ cfg_poll_loop_timeout_ms = strtoul(optarg, NULL, 10) * 1000; ++ break; + case 'm': + cfg_sendmmsg = true; + break; +@@ -490,6 +510,8 @@ static void parse_opts(int argc, char **argv) + case 'z': + cfg_zerocopy = true; + break; ++ default: ++ exit(1); + } + } + +@@ -677,7 +699,7 @@ int main(int argc, char **argv) + num_sends += send_udp(fd, buf[i]); + num_msgs++; + if ((cfg_zerocopy && ((num_msgs & 0xF) == 0)) || cfg_tx_tstamp) +- flush_errqueue(fd, cfg_poll); ++ flush_errqueue(fd, cfg_poll, 500, true); + + if (cfg_msg_nr && num_msgs >= cfg_msg_nr) + break; +@@ -696,7 +718,7 @@ int main(int argc, char **argv) + } while (!interrupted && (cfg_runtime_ms == -1 || tnow < tstop)); + + if (cfg_zerocopy || cfg_tx_tstamp) +- flush_errqueue(fd, true); ++ flush_errqueue_retry(fd, num_sends); + + if (close(fd)) + error(1, errno, "close");
