commit: 7aafa127ab58b92f1f36ad314214159e0a6b8557 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Jul 27 09:17:44 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Jul 27 09:17:44 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7aafa127
Linux patch 5.15.164 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1163_linux-5.15.164.patch | 3386 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3390 insertions(+) diff --git a/0000_README b/0000_README index 387620a9..c13e1156 100644 --- a/0000_README +++ b/0000_README @@ -695,6 +695,10 @@ Patch: 1162_linux-5.15.163.patch From: https://www.kernel.org Desc: Linux 5.15.163 +Patch: 1163_linux-5.15.164.patch +From: https://www.kernel.org +Desc: Linux 5.15.164 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1163_linux-5.15.164.patch b/1163_linux-5.15.164.patch new file mode 100644 index 00000000..c37f0636 --- /dev/null +++ b/1163_linux-5.15.164.patch @@ -0,0 +1,3386 @@ +diff --git a/Documentation/admin-guide/filesystem-monitoring.rst b/Documentation/admin-guide/filesystem-monitoring.rst +index 5a3c84e60095f..ab8dba76283c5 100644 +--- a/Documentation/admin-guide/filesystem-monitoring.rst ++++ b/Documentation/admin-guide/filesystem-monitoring.rst +@@ -35,9 +35,11 @@ notifications is Ext4. + + A FAN_FS_ERROR Notification has the following format:: + +- [ Notification Metadata (Mandatory) ] +- [ Generic Error Record (Mandatory) ] +- [ FID record (Mandatory) ] ++ :: ++ ++ [ Notification Metadata (Mandatory) ] ++ [ Generic Error Record (Mandatory) ] ++ [ FID record (Mandatory) ] + + The order of records is not guaranteed, and new records might be added + in the future. Therefore, applications must not rely on the order and +@@ -53,11 +55,13 @@ providing any additional details about the problem. This record is + identified by ``struct fanotify_event_info_header.info_type`` being set + to FAN_EVENT_INFO_TYPE_ERROR. + +- struct fanotify_event_info_error { +- struct fanotify_event_info_header hdr; +- __s32 error; +- __u32 error_count; +- }; ++ :: ++ ++ struct fanotify_event_info_error { ++ struct fanotify_event_info_header hdr; ++ __s32 error; ++ __u32 error_count; ++ }; + + The `error` field identifies the type of error using errno values. + `error_count` tracks the number of errors that occurred and were +diff --git a/Makefile b/Makefile +index a9b6f1ff96197..78f5cc32b7298 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 15 +-SUBLEVEL = 163 ++SUBLEVEL = 164 + EXTRAVERSION = + NAME = Trick or Treat + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 32dbfd81f42a4..0df4c3addf62e 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -124,16 +124,6 @@ extern int __get_user_64t_1(void *); + extern int __get_user_64t_2(void *); + extern int __get_user_64t_4(void *); + +-#define __GUP_CLOBBER_1 "lr", "cc" +-#ifdef CONFIG_CPU_USE_DOMAINS +-#define __GUP_CLOBBER_2 "ip", "lr", "cc" +-#else +-#define __GUP_CLOBBER_2 "lr", "cc" +-#endif +-#define __GUP_CLOBBER_4 "lr", "cc" +-#define __GUP_CLOBBER_32t_8 "lr", "cc" +-#define __GUP_CLOBBER_8 "lr", "cc" +- + #define __get_user_x(__r2, __p, __e, __l, __s) \ + __asm__ __volatile__ ( \ + __asmeq("%0", "r0") __asmeq("%1", "r2") \ +@@ -141,7 +131,7 @@ extern int __get_user_64t_4(void *); + "bl __get_user_" #__s \ + : "=&r" (__e), "=r" (__r2) \ + : "0" (__p), "r" (__l) \ +- : __GUP_CLOBBER_##__s) ++ : "ip", "lr", "cc") + + /* narrowing a double-word get into a single 32bit word register: */ + #ifdef __ARMEB__ +@@ -163,7 +153,7 @@ extern int __get_user_64t_4(void *); + "bl __get_user_64t_" #__s \ + : "=&r" (__e), "=r" (__r2) \ + : "0" (__p), "r" (__l) \ +- : __GUP_CLOBBER_##__s) ++ : "ip", "lr", "cc") + #else + #define __get_user_x_64t __get_user_x + #endif +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index fd9ffe8448b04..8b3e753c1a2a1 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2634,6 +2634,7 @@ usb3_dwc3: dwc3@6a00000 { + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; + snps,is-utmi-l1-suspend; ++ snps,parkmode-disable-ss-quirk; + tx-fifo-resize; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi +index e00c0577cef70..70dfde9d24ec5 100644 +--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi +@@ -1236,6 +1236,7 @@ usb3_dwc3: usb@a800000 { + interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>; + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; ++ snps,parkmode-disable-ss-quirk; + + /* + * SDM630 technically supports USB3 but I +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index 91eabe56093d6..91c29979aea79 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -471,6 +471,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu) + for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) { + struct insn_emulation *insn = insn_emulations[i]; + bool enable = READ_ONCE(insn->current_mode) == INSN_HW; ++ if (insn->status == INSN_UNAVAILABLE) ++ continue; ++ + if (insn->set_hw_mode && insn->set_hw_mode(enable)) { + pr_warn("CPU[%u] cannot support the emulation of %s", + cpu, insn->name); +diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl +index ec1119760cd3c..cd107ca10e69a 100644 +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -27,7 +27,7 @@ + 17 o32 break sys_ni_syscall + # 18 was sys_stat + 18 o32 unused18 sys_ni_syscall +-19 o32 lseek sys_lseek ++19 o32 lseek sys_lseek compat_sys_lseek + 20 o32 getpid sys_getpid + 21 o32 mount sys_mount + 22 o32 umount sys_oldumount +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c +index 845e024321d47..a856d9ba42d20 100644 +--- a/arch/powerpc/kernel/eeh_pe.c ++++ b/arch/powerpc/kernel/eeh_pe.c +@@ -849,6 +849,7 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + { + struct eeh_dev *edev; + struct pci_dev *pdev; ++ struct pci_bus *bus = NULL; + + if (pe->type & EEH_PE_PHB) + return pe->phb->bus; +@@ -859,9 +860,11 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + + /* Retrieve the parent PCI bus of first (top) PCI device */ + edev = list_first_entry_or_null(&pe->edevs, struct eeh_dev, entry); ++ pci_lock_rescan_remove(); + pdev = eeh_dev_to_pci_dev(edev); + if (pdev) +- return pdev->bus; ++ bus = pdev->bus; ++ pci_unlock_rescan_remove(); + +- return NULL; ++ return bus; + } +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 3cb2e05a7ee83..a8e5eefee794f 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -117,14 +117,16 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + } + rcu_read_unlock(); + +- fdput(f); +- +- if (!found) ++ if (!found) { ++ fdput(f); + return -EINVAL; ++ } + + table_group = iommu_group_get_iommudata(grp); +- if (WARN_ON(!table_group)) ++ if (WARN_ON(!table_group)) { ++ fdput(f); + return -EFAULT; ++ } + + for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) { + struct iommu_table *tbltmp = table_group->tables[i]; +@@ -145,8 +147,10 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + break; + } + } +- if (!tbl) ++ if (!tbl) { ++ fdput(f); + return -EINVAL; ++ } + + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { +@@ -157,6 +161,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + /* stit is being destroyed */ + iommu_tce_table_put(tbl); + rcu_read_unlock(); ++ fdput(f); + return -ENOTTY; + } + /* +@@ -164,6 +169,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + * its KVM reference counter and can return. + */ + rcu_read_unlock(); ++ fdput(f); + return 0; + } + rcu_read_unlock(); +@@ -171,6 +177,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + stit = kzalloc(sizeof(*stit), GFP_KERNEL); + if (!stit) { + iommu_tce_table_put(tbl); ++ fdput(f); + return -ENOMEM; + } + +@@ -179,6 +186,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + + list_add_rcu(&stit->next, &stt->iommu_tables); + ++ fdput(f); + return 0; + } + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index d25053755c8b8..309a72518ecc3 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -314,8 +314,8 @@ static int alloc_dispatch_log_kmem_cache(void) + { + void (*ctor)(void *) = get_dtl_cache_ctor(); + +- dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, +- DISPATCH_LOG_BYTES, 0, ctor); ++ dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, ++ DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); + if (!dtl_cache) { + pr_warn("Failed to create dispatch trace log buffer cache\n"); + pr_warn("Stolen time statistics will be unreliable\n"); +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 94721c484d638..95b4ad1b6708c 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -34,6 +34,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + bool (*fn)(void *, unsigned long), void *arg) + { + unsigned long fp, sp, pc; ++ int graph_idx = 0; + int level = 0; + + if (regs) { +@@ -70,7 +71,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + pc = regs->ra; + } else { + fp = frame->fp; +- pc = ftrace_graph_ret_addr(current, NULL, frame->ra, ++ pc = ftrace_graph_ret_addr(current, &graph_idx, frame->ra, + &frame->ra); + if (pc == (unsigned long)ret_from_exception) { + if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc))) +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 472418a0e0cab..59e617ab12a51 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1303,10 +1303,13 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + if (ec->busy_polling || bits > 8) + acpi_ec_burst_enable(ec); + +- for (i = 0; i < bytes; ++i, ++address, ++value) ++ for (i = 0; i < bytes; ++i, ++address, ++value) { + result = (function == ACPI_READ) ? + acpi_ec_read(ec, address, value) : + acpi_ec_write(ec, address, *value); ++ if (result < 0) ++ break; ++ } + + if (ec->busy_polling || bits > 8) + acpi_ec_burst_disable(ec); +@@ -1318,8 +1321,10 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + return AE_NOT_FOUND; + case -ETIME: + return AE_TIME; +- default: ++ case 0: + return AE_OK; ++ default: ++ return AE_ERROR; + } + } + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 4cb44d80bf520..5289c344de900 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -16,7 +16,6 @@ + #include <linux/acpi.h> + #include <linux/dmi.h> + #include <linux/sched.h> /* need_resched() */ +-#include <linux/sort.h> + #include <linux/tick.h> + #include <linux/cpuidle.h> + #include <linux/cpu.h> +@@ -385,28 +384,24 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr, + return; + } + +-static int acpi_cst_latency_cmp(const void *a, const void *b) ++static void acpi_cst_latency_sort(struct acpi_processor_cx *states, size_t length) + { +- const struct acpi_processor_cx *x = a, *y = b; ++ int i, j, k; + +- if (!(x->valid && y->valid)) +- return 0; +- if (x->latency > y->latency) +- return 1; +- if (x->latency < y->latency) +- return -1; +- return 0; +-} +-static void acpi_cst_latency_swap(void *a, void *b, int n) +-{ +- struct acpi_processor_cx *x = a, *y = b; +- u32 tmp; ++ for (i = 1; i < length; i++) { ++ if (!states[i].valid) ++ continue; + +- if (!(x->valid && y->valid)) +- return; +- tmp = x->latency; +- x->latency = y->latency; +- y->latency = tmp; ++ for (j = i - 1, k = i; j >= 0; j--) { ++ if (!states[j].valid) ++ continue; ++ ++ if (states[j].latency > states[k].latency) ++ swap(states[j].latency, states[k].latency); ++ ++ k = j; ++ } ++ } + } + + static int acpi_processor_power_verify(struct acpi_processor *pr) +@@ -451,10 +446,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr) + + if (buggy_latency) { + pr_notice("FW issue: working around C-state latencies out of order\n"); +- sort(&pr->power.states[1], max_cstate, +- sizeof(struct acpi_processor_cx), +- acpi_cst_latency_cmp, +- acpi_cst_latency_swap); ++ acpi_cst_latency_sort(&pr->power.states[1], max_cstate); + } + + lapic_timer_propagate_broadcast(pr); +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index ec78d9ad3e9bc..23c4a7b3d4e53 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1749,8 +1749,8 @@ static int null_validate_conf(struct nullb_device *dev) + return -EINVAL; + } + +- dev->blocksize = round_down(dev->blocksize, 512); +- dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096); ++ if (blk_validate_block_size(dev->blocksize)) ++ return -EINVAL; + + if (dev->queue_mode == NULL_Q_MQ && dev->use_per_node_hctx) { + if (dev->submit_queues != nr_online_nodes) +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index c189e7ae68386..a3352b98ced17 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -2148,7 +2148,7 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, + struct amdgpu_irq_src *source, + struct amdgpu_iv_entry *entry) + { +- uint32_t instance; ++ int instance; + + DRM_DEBUG("IH: SDMA trap\n"); + instance = sdma_v4_0_irq_id_to_seq(entry->client_id); +diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c +index 57218263ef3b1..277a313432b28 100644 +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -653,7 +653,7 @@ static void radeon_gem_va_update_vm(struct radeon_device *rdev, + if (r) + goto error_unlock; + +- if (bo_va->it.start) ++ if (bo_va->it.start && bo_va->bo) + r = radeon_vm_bo_update(rdev, bo_va, bo_va->bo->tbo.resource); + + error_unlock: +diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig +index c9ce47c448e03..5b9a9fba85421 100644 +--- a/drivers/gpu/drm/vmwgfx/Kconfig ++++ b/drivers/gpu/drm/vmwgfx/Kconfig +@@ -2,7 +2,7 @@ + config DRM_VMWGFX + tristate "DRM driver for VMware Virtual GPU" + depends on DRM && PCI && MMU +- depends on X86 || ARM64 ++ depends on (X86 && HYPERVISOR_GUEST) || ARM64 + select DRM_TTM + select MAPPING_DIRTY_HELPERS + # Only needed for the transitional use of drm_crtc_init - can be removed +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 4e38229404b4b..b4723ea395eb9 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1476,16 +1476,47 @@ static void elantech_disconnect(struct psmouse *psmouse) + psmouse->private = NULL; + } + ++/* ++ * Some hw_version 4 models fail to properly activate absolute mode on ++ * resume without going through disable/enable cycle. ++ */ ++static const struct dmi_system_id elantech_needs_reenable[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Lenovo N24 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "81AF"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + /* + * Put the touchpad back into absolute mode when reconnecting + */ + static int elantech_reconnect(struct psmouse *psmouse) + { ++ int err; ++ + psmouse_reset(psmouse); + + if (elantech_detect(psmouse, 0)) + return -1; + ++ if (dmi_check_system(elantech_needs_reenable)) { ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to deactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to reactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ } ++ + if (elantech_set_absolute_mode(psmouse)) { + psmouse_err(psmouse, + "failed to put touchpad back into absolute mode.\n"); +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index d4792950bcffd..49d87f56cb909 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -75,7 +75,7 @@ static inline void i8042_write_command(int val) + #define SERIO_QUIRK_PROBE_DEFER BIT(5) + #define SERIO_QUIRK_RESET_ALWAYS BIT(6) + #define SERIO_QUIRK_RESET_NEVER BIT(7) +-#define SERIO_QUIRK_DIECT BIT(8) ++#define SERIO_QUIRK_DIRECT BIT(8) + #define SERIO_QUIRK_DUMBKBD BIT(9) + #define SERIO_QUIRK_NOLOOP BIT(10) + #define SERIO_QUIRK_NOTIMEOUT BIT(11) +@@ -1295,6 +1295,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ /* ++ * The Ayaneo Kun is a handheld device where some the buttons ++ * are handled by an AT keyboard. The keyboard is usually ++ * detected as raw, but sometimes, usually after a cold boot, ++ * it is detected as translated. Make sure that the keyboard ++ * is always in raw mode. ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_BOARD_NAME, "KUN"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_DIRECT) ++ }, + { } + }; + +@@ -1613,7 +1627,7 @@ static void __init i8042_check_quirks(void) + if (quirks & SERIO_QUIRK_RESET_NEVER) + i8042_reset = I8042_RESET_NEVER; + } +- if (quirks & SERIO_QUIRK_DIECT) ++ if (quirks & SERIO_QUIRK_DIRECT) + i8042_direct = true; + if (quirks & SERIO_QUIRK_DUMBKBD) + i8042_dumbkbd = true; +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index 1ee760bac0cfa..3be59b7239a68 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -70,7 +70,6 @@ struct silead_ts_data { + struct regulator_bulk_data regulators[2]; + char fw_name[64]; + struct touchscreen_properties prop; +- u32 max_fingers; + u32 chip_id; + struct input_mt_pos pos[SILEAD_MAX_FINGERS]; + int slots[SILEAD_MAX_FINGERS]; +@@ -98,7 +97,7 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data) + input_set_abs_params(data->input, ABS_MT_POSITION_Y, 0, 4095, 0, 0); + touchscreen_parse_properties(data->input, true, &data->prop); + +- input_mt_init_slots(data->input, data->max_fingers, ++ input_mt_init_slots(data->input, SILEAD_MAX_FINGERS, + INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED | + INPUT_MT_TRACK); + +@@ -145,10 +144,10 @@ static void silead_ts_read_data(struct i2c_client *client) + return; + } + +- if (buf[0] > data->max_fingers) { ++ if (buf[0] > SILEAD_MAX_FINGERS) { + dev_warn(dev, "More touches reported then supported %d > %d\n", +- buf[0], data->max_fingers); +- buf[0] = data->max_fingers; ++ buf[0], SILEAD_MAX_FINGERS); ++ buf[0] = SILEAD_MAX_FINGERS; + } + + touch_nr = 0; +@@ -200,7 +199,6 @@ static void silead_ts_read_data(struct i2c_client *client) + + static int silead_ts_init(struct i2c_client *client) + { +- struct silead_ts_data *data = i2c_get_clientdata(client); + int error; + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_RESET, +@@ -210,7 +208,7 @@ static int silead_ts_init(struct i2c_client *client) + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_TOUCH_NR, +- data->max_fingers); ++ SILEAD_MAX_FINGERS); + if (error) + goto i2c_write_err; + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); +@@ -437,13 +435,6 @@ static void silead_ts_read_props(struct i2c_client *client) + const char *str; + int error; + +- error = device_property_read_u32(dev, "silead,max-fingers", +- &data->max_fingers); +- if (error) { +- dev_dbg(dev, "Max fingers read error %d\n", error); +- data->max_fingers = 5; /* Most devices handle up-to 5 fingers */ +- } +- + error = device_property_read_string(dev, "firmware-name", &str); + if (!error) + snprintf(data->fw_name, sizeof(data->fw_name), +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index 786f7c8f7f619..71f15fba21ad6 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -327,7 +327,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf, + } + + if (!mei_cl_is_connected(cl)) { +- cl_err(dev, cl, "is not connected"); ++ cl_dbg(dev, cl, "is not connected"); + rets = -ENODEV; + goto out; + } +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index 573d3a66711ab..95ed200553929 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -293,7 +293,7 @@ int kvaser_usb_send_cmd_async(struct kvaser_usb_net_priv *priv, void *cmd, + } + usb_free_urb(urb); + +- return 0; ++ return err; + } + + int kvaser_usb_can_rx_over_error(struct net_device *netdev) +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index bdb05d246b86e..53eadd82f9b8c 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1139,6 +1139,11 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) + struct sk_buff *skb; + int err, depth; + ++ if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) { ++ err = -EINVAL; ++ goto err; ++ } ++ + if (q->flags & IFF_VNET_HDR) + vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index f0e34b2b072ee..959ca6b9cd138 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2422,6 +2422,9 @@ static int tun_xdp_one(struct tun_struct *tun, + bool skb_xdp = false; + struct page *page; + ++ if (unlikely(datasize < ETH_HLEN)) ++ return -EINVAL; ++ + xdp_prog = rcu_dereference(tun->xdp_prog); + if (xdp_prog) { + if (gso->gso_type) { +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 9bd145732e58b..fb09e95cbc258 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1373,6 +1373,8 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3000, 0)}, /* Telit FN912 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3001, 0)}, /* Telit FN912 series */ + {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index c4c62bcbe67de..24c1666b2c88a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -595,16 +595,25 @@ static void iwl_mvm_wowlan_gtk_type_iter(struct ieee80211_hw *hw, + void *_data) + { + struct wowlan_key_gtk_type_iter *data = _data; ++ __le32 *cipher = NULL; ++ ++ if (key->keyidx == 4 || key->keyidx == 5) ++ cipher = &data->kek_kck_cmd->igtk_cipher; ++ if (key->keyidx == 6 || key->keyidx == 7) ++ cipher = &data->kek_kck_cmd->bigtk_cipher; + + switch (key->cipher) { + default: + return; + case WLAN_CIPHER_SUITE_BIP_GMAC_256: + case WLAN_CIPHER_SUITE_BIP_GMAC_128: +- data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_GCMP); ++ if (cipher) ++ *cipher = cpu_to_le32(STA_KEY_FLG_GCMP); + return; + case WLAN_CIPHER_SUITE_AES_CMAC: +- data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_CCM); ++ case WLAN_CIPHER_SUITE_BIP_CMAC_256: ++ if (cipher) ++ *cipher = cpu_to_le32(STA_KEY_FLG_CCM); + return; + case WLAN_CIPHER_SUITE_CCMP: + if (!sta) +@@ -1796,7 +1805,8 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm, + + out: + if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, +- WOWLAN_GET_STATUSES, 0) < 10) { ++ WOWLAN_GET_STATUSES, ++ IWL_FW_CMD_VER_UNKNOWN) < 10) { + mvmvif->seqno_valid = true; + /* +0x10 because the set API expects next-to-use, not last-used */ + mvmvif->seqno = le16_to_cpu(status->non_qos_seq_ctr) + 0x10; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 0605363b62720..8179a7395bcaf 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1721,7 +1721,10 @@ iwl_mvm_umac_scan_fill_6g_chan_list(struct iwl_mvm *mvm, + break; + } + +- if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE) { ++ if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE && ++ !WARN_ONCE(!is_valid_ether_addr(scan_6ghz_params[j].bssid), ++ "scan: invalid BSSID at index %u, index_b=%u\n", ++ j, idex_b)) { + memcpy(&pp->bssid_array[idex_b++], + scan_6ghz_params[j].bssid, ETH_ALEN); + } +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c +index dec6ffdf07c42..8d86969aa2141 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c +@@ -1023,9 +1023,9 @@ static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev, + { + u32 reg, reg2; + unsigned int i; +- char put_to_sleep; +- char bbp_state; +- char rf_state; ++ bool put_to_sleep; ++ u8 bbp_state; ++ u8 rf_state; + + put_to_sleep = (state != STATE_AWAKE); + +@@ -1561,7 +1561,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *tx_power; ++ u8 *tx_power; + unsigned int i; + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2400pci.h b/drivers/net/wireless/ralink/rt2x00/rt2400pci.h +index b8187b6de1439..979d5fd8babf7 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.h +@@ -939,7 +939,7 @@ + #define DEFAULT_TXPOWER 39 + + #define __CLAMP_TX(__txpower) \ +- clamp_t(char, (__txpower), MIN_TXPOWER, MAX_TXPOWER) ++ clamp_t(u8, (__txpower), MIN_TXPOWER, MAX_TXPOWER) + + #define TXPOWER_FROM_DEV(__txpower) \ + ((__CLAMP_TX(__txpower) - MAX_TXPOWER) + MIN_TXPOWER) +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c +index 8faa0a80e73a6..cd6371e25062b 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c +@@ -1176,9 +1176,9 @@ static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev, + { + u32 reg, reg2; + unsigned int i; +- char put_to_sleep; +- char bbp_state; +- char rf_state; ++ bool put_to_sleep; ++ u8 bbp_state; ++ u8 rf_state; + + put_to_sleep = (state != STATE_AWAKE); + +@@ -1856,7 +1856,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *tx_power; ++ u8 *tx_power; + unsigned int i; + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2500pci.h b/drivers/net/wireless/ralink/rt2x00/rt2500pci.h +index 7e64aee2a172e..ba362675c52c0 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.h +@@ -1219,6 +1219,6 @@ + (((u8)(__txpower)) > MAX_TXPOWER) ? DEFAULT_TXPOWER : (__txpower) + + #define TXPOWER_TO_DEV(__txpower) \ +- clamp_t(char, __txpower, MIN_TXPOWER, MAX_TXPOWER) ++ clamp_t(u8, __txpower, MIN_TXPOWER, MAX_TXPOWER) + + #endif /* RT2500PCI_H */ +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c +index bb5ed66306458..4f3b0e6c6256c 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c +@@ -984,9 +984,9 @@ static int rt2500usb_set_state(struct rt2x00_dev *rt2x00dev, + u16 reg; + u16 reg2; + unsigned int i; +- char put_to_sleep; +- char bbp_state; +- char rf_state; ++ bool put_to_sleep; ++ u8 bbp_state; ++ u8 rf_state; + + put_to_sleep = (state != STATE_AWAKE); + +@@ -1663,7 +1663,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *tx_power; ++ u8 *tx_power; + unsigned int i; + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2500usb.h b/drivers/net/wireless/ralink/rt2x00/rt2500usb.h +index 0c070288a140f..746f0e950b76e 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.h +@@ -839,6 +839,6 @@ + (((u8)(__txpower)) > MAX_TXPOWER) ? DEFAULT_TXPOWER : (__txpower) + + #define TXPOWER_TO_DEV(__txpower) \ +- clamp_t(char, __txpower, MIN_TXPOWER, MAX_TXPOWER) ++ clamp_t(u8, __txpower, MIN_TXPOWER, MAX_TXPOWER) + + #endif /* RT2500USB_H */ +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +index 34788bfb34b7a..bff48fa1a0563 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +@@ -3310,10 +3310,10 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev, + if (rt2x00_has_cap_bt_coexist(rt2x00dev)) { + if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) { + /* r55/r59 value array of channel 1~14 */ +- static const char r55_bt_rev[] = {0x83, 0x83, ++ static const u8 r55_bt_rev[] = {0x83, 0x83, + 0x83, 0x73, 0x73, 0x63, 0x53, 0x53, + 0x53, 0x43, 0x43, 0x43, 0x43, 0x43}; +- static const char r59_bt_rev[] = {0x0e, 0x0e, ++ static const u8 r59_bt_rev[] = {0x0e, 0x0e, + 0x0e, 0x0e, 0x0e, 0x0b, 0x0a, 0x09, + 0x07, 0x07, 0x07, 0x07, 0x07, 0x07}; + +@@ -3322,7 +3322,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev, + rt2800_rfcsr_write(rt2x00dev, 59, + r59_bt_rev[idx]); + } else { +- static const char r59_bt[] = {0x8b, 0x8b, 0x8b, ++ static const u8 r59_bt[] = {0x8b, 0x8b, 0x8b, + 0x8b, 0x8b, 0x8b, 0x8b, 0x8a, 0x89, + 0x88, 0x88, 0x86, 0x85, 0x84}; + +@@ -3330,10 +3330,10 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev, + } + } else { + if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) { +- static const char r55_nonbt_rev[] = {0x23, 0x23, ++ static const u8 r55_nonbt_rev[] = {0x23, 0x23, + 0x23, 0x23, 0x13, 0x13, 0x03, 0x03, + 0x03, 0x03, 0x03, 0x03, 0x03, 0x03}; +- static const char r59_nonbt_rev[] = {0x07, 0x07, ++ static const u8 r59_nonbt_rev[] = {0x07, 0x07, + 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, + 0x07, 0x07, 0x06, 0x05, 0x04, 0x04}; + +@@ -3344,14 +3344,14 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev, + } else if (rt2x00_rt(rt2x00dev, RT5390) || + rt2x00_rt(rt2x00dev, RT5392) || + rt2x00_rt(rt2x00dev, RT6352)) { +- static const char r59_non_bt[] = {0x8f, 0x8f, ++ static const u8 r59_non_bt[] = {0x8f, 0x8f, + 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8d, + 0x8a, 0x88, 0x88, 0x87, 0x87, 0x86}; + + rt2800_rfcsr_write(rt2x00dev, 59, + r59_non_bt[idx]); + } else if (rt2x00_rt(rt2x00dev, RT5350)) { +- static const char r59_non_bt[] = {0x0b, 0x0b, ++ static const u8 r59_non_bt[] = {0x0b, 0x0b, + 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0a, + 0x0a, 0x09, 0x08, 0x07, 0x07, 0x06}; + +@@ -3974,23 +3974,23 @@ static void rt2800_iq_calibrate(struct rt2x00_dev *rt2x00dev, int channel) + rt2800_bbp_write(rt2x00dev, 159, cal != 0xff ? cal : 0); + } + +-static char rt2800_txpower_to_dev(struct rt2x00_dev *rt2x00dev, ++static s8 rt2800_txpower_to_dev(struct rt2x00_dev *rt2x00dev, + unsigned int channel, +- char txpower) ++ s8 txpower) + { + if (rt2x00_rt(rt2x00dev, RT3593) || + rt2x00_rt(rt2x00dev, RT3883)) + txpower = rt2x00_get_field8(txpower, EEPROM_TXPOWER_ALC); + + if (channel <= 14) +- return clamp_t(char, txpower, MIN_G_TXPOWER, MAX_G_TXPOWER); ++ return clamp_t(s8, txpower, MIN_G_TXPOWER, MAX_G_TXPOWER); + + if (rt2x00_rt(rt2x00dev, RT3593) || + rt2x00_rt(rt2x00dev, RT3883)) +- return clamp_t(char, txpower, MIN_A_TXPOWER_3593, ++ return clamp_t(s8, txpower, MIN_A_TXPOWER_3593, + MAX_A_TXPOWER_3593); + else +- return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER); ++ return clamp_t(s8, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER); + } + + static void rt3883_bbp_adjust(struct rt2x00_dev *rt2x00dev, +@@ -8492,11 +8492,11 @@ static int rt2800_rf_lp_config(struct rt2x00_dev *rt2x00dev, bool btxcal) + return 0; + } + +-static char rt2800_lp_tx_filter_bw_cal(struct rt2x00_dev *rt2x00dev) ++static s8 rt2800_lp_tx_filter_bw_cal(struct rt2x00_dev *rt2x00dev) + { + unsigned int cnt; + u8 bbp_val; +- char cal_val; ++ s8 cal_val; + + rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x82); + +@@ -8528,7 +8528,7 @@ static void rt2800_bw_filter_calibration(struct rt2x00_dev *rt2x00dev, + u8 rx_filter_target_20m = 0x27, rx_filter_target_40m = 0x31; + int loop = 0, is_ht40, cnt; + u8 bbp_val, rf_val; +- char cal_r32_init, cal_r32_val, cal_diff; ++ s8 cal_r32_init, cal_r32_val, cal_diff; + u8 saverfb5r00, saverfb5r01, saverfb5r03, saverfb5r04, saverfb5r05; + u8 saverfb5r06, saverfb5r07; + u8 saverfb5r08, saverfb5r17, saverfb5r18, saverfb5r19, saverfb5r20; +@@ -9979,9 +9979,9 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *default_power1; +- char *default_power2; +- char *default_power3; ++ s8 *default_power1; ++ s8 *default_power2; ++ s8 *default_power3; + unsigned int i, tx_chains, rx_chains; + u32 reg; + +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h +index 1139405c0ebbe..6928f352f6319 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h +@@ -22,10 +22,10 @@ + struct rt2800_drv_data { + u8 calibration_bw20; + u8 calibration_bw40; +- char rx_calibration_bw20; +- char rx_calibration_bw40; +- char tx_calibration_bw20; +- char tx_calibration_bw40; ++ s8 rx_calibration_bw20; ++ s8 rx_calibration_bw40; ++ s8 tx_calibration_bw20; ++ s8 tx_calibration_bw40; + u8 bbp25; + u8 bbp26; + u8 txmixer_gain_24g; +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c +index 74c3d8cb31002..8b3c90231110b 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c +@@ -117,12 +117,12 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev, + const u16 buffer_length) + { + int status = 0; +- unsigned char *tb; ++ u8 *tb; + u16 off, len, bsize; + + mutex_lock(&rt2x00dev->csr_mutex); + +- tb = (char *)buffer; ++ tb = (u8 *)buffer; + off = offset; + len = buffer_length; + while (len && !status) { +@@ -215,7 +215,7 @@ void rt2x00usb_register_read_async(struct rt2x00_dev *rt2x00dev, + rd->cr.wLength = cpu_to_le16(sizeof(u32)); + + usb_fill_control_urb(urb, usb_dev, usb_rcvctrlpipe(usb_dev, 0), +- (unsigned char *)(&rd->cr), &rd->reg, sizeof(rd->reg), ++ (u8 *)(&rd->cr), &rd->reg, sizeof(rd->reg), + rt2x00usb_register_read_async_cb, rd); + usb_anchor_urb(urb, rt2x00dev->anchor); + if (usb_submit_urb(urb, GFP_ATOMIC) < 0) { +diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.c b/drivers/net/wireless/ralink/rt2x00/rt61pci.c +index 82cfc2aadc2b3..52862955e080d 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c +@@ -1709,7 +1709,7 @@ static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state) + { + u32 reg, reg2; + unsigned int i; +- char put_to_sleep; ++ bool put_to_sleep; + + put_to_sleep = (state != STATE_AWAKE); + +@@ -2656,7 +2656,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *tx_power; ++ u8 *tx_power; + unsigned int i; + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.h b/drivers/net/wireless/ralink/rt2x00/rt61pci.h +index 5f208ad509bd4..d72d0ffd11275 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.h +@@ -1484,6 +1484,6 @@ struct hw_pairwise_ta_entry { + (((u8)(__txpower)) > MAX_TXPOWER) ? DEFAULT_TXPOWER : (__txpower) + + #define TXPOWER_TO_DEV(__txpower) \ +- clamp_t(char, __txpower, MIN_TXPOWER, MAX_TXPOWER) ++ clamp_t(u8, __txpower, MIN_TXPOWER, MAX_TXPOWER) + + #endif /* RT61PCI_H */ +diff --git a/drivers/net/wireless/ralink/rt2x00/rt73usb.c b/drivers/net/wireless/ralink/rt2x00/rt73usb.c +index 5ff2c740c3ea0..3aa46933b463b 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c +@@ -1378,7 +1378,7 @@ static int rt73usb_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state) + { + u32 reg, reg2; + unsigned int i; +- char put_to_sleep; ++ bool put_to_sleep; + + put_to_sleep = (state != STATE_AWAKE); + +@@ -2090,7 +2090,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev) + { + struct hw_mode_spec *spec = &rt2x00dev->spec; + struct channel_info *info; +- char *tx_power; ++ u8 *tx_power; + unsigned int i; + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt73usb.h b/drivers/net/wireless/ralink/rt2x00/rt73usb.h +index 1b56d285c34b4..bb0a68516c08b 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.h +@@ -1063,6 +1063,6 @@ struct hw_pairwise_ta_entry { + (((u8)(__txpower)) > MAX_TXPOWER) ? DEFAULT_TXPOWER : (__txpower) + + #define TXPOWER_TO_DEV(__txpower) \ +- clamp_t(char, __txpower, MIN_TXPOWER, MAX_TXPOWER) ++ clamp_t(u8, __txpower, MIN_TXPOWER, MAX_TXPOWER) + + #endif /* RT73USB_H */ +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 960a31e3307a2..93a19588ae92a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -981,6 +981,7 @@ void nvme_cleanup_cmd(struct request *req) + clear_bit_unlock(0, &ctrl->discard_page_busy); + else + kfree(bvec_virt(&req->special_vec)); ++ req->rq_flags &= ~RQF_SPECIAL_PAYLOAD; + } + } + EXPORT_SYMBOL_GPL(nvme_cleanup_cmd); +diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c +index 88b551caeaaf4..5f9fbea8fc3c2 100644 +--- a/drivers/platform/x86/lg-laptop.c ++++ b/drivers/platform/x86/lg-laptop.c +@@ -37,8 +37,6 @@ MODULE_LICENSE("GPL"); + #define WMI_METHOD_WMBB "2B4F501A-BD3C-4394-8DCF-00A7D2BC8210" + #define WMI_EVENT_GUID WMI_EVENT_GUID0 + +-#define WMAB_METHOD "\\XINI.WMAB" +-#define WMBB_METHOD "\\XINI.WMBB" + #define SB_GGOV_METHOD "\\_SB.GGOV" + #define GOV_TLED 0x2020008 + #define WM_GET 1 +@@ -73,7 +71,7 @@ static u32 inited; + + static int battery_limit_use_wmbb; + static struct led_classdev kbd_backlight; +-static enum led_brightness get_kbd_backlight_level(void); ++static enum led_brightness get_kbd_backlight_level(struct device *dev); + + static const struct key_entry wmi_keymap[] = { + {KE_KEY, 0x70, {KEY_F15} }, /* LG control panel (F1) */ +@@ -83,7 +81,6 @@ static const struct key_entry wmi_keymap[] = { + * this key both sends an event and + * changes backlight level. + */ +- {KE_KEY, 0x80, {KEY_RFKILL} }, + {KE_END, 0} + }; + +@@ -127,11 +124,10 @@ static int ggov(u32 arg0) + return res; + } + +-static union acpi_object *lg_wmab(u32 method, u32 arg1, u32 arg2) ++static union acpi_object *lg_wmab(struct device *dev, u32 method, u32 arg1, u32 arg2) + { + union acpi_object args[3]; + acpi_status status; +- acpi_handle handle; + struct acpi_object_list arg; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + +@@ -142,29 +138,22 @@ static union acpi_object *lg_wmab(u32 method, u32 arg1, u32 arg2) + args[2].type = ACPI_TYPE_INTEGER; + args[2].integer.value = arg2; + +- status = acpi_get_handle(NULL, (acpi_string) WMAB_METHOD, &handle); +- if (ACPI_FAILURE(status)) { +- pr_err("Cannot get handle"); +- return NULL; +- } +- + arg.count = 3; + arg.pointer = args; + +- status = acpi_evaluate_object(handle, NULL, &arg, &buffer); ++ status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMAB", &arg, &buffer); + if (ACPI_FAILURE(status)) { +- acpi_handle_err(handle, "WMAB: call failed.\n"); ++ dev_err(dev, "WMAB: call failed.\n"); + return NULL; + } + + return buffer.pointer; + } + +-static union acpi_object *lg_wmbb(u32 method_id, u32 arg1, u32 arg2) ++static union acpi_object *lg_wmbb(struct device *dev, u32 method_id, u32 arg1, u32 arg2) + { + union acpi_object args[3]; + acpi_status status; +- acpi_handle handle; + struct acpi_object_list arg; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + u8 buf[32]; +@@ -180,18 +169,12 @@ static union acpi_object *lg_wmbb(u32 method_id, u32 arg1, u32 arg2) + args[2].buffer.length = 32; + args[2].buffer.pointer = buf; + +- status = acpi_get_handle(NULL, (acpi_string)WMBB_METHOD, &handle); +- if (ACPI_FAILURE(status)) { +- pr_err("Cannot get handle"); +- return NULL; +- } +- + arg.count = 3; + arg.pointer = args; + +- status = acpi_evaluate_object(handle, NULL, &arg, &buffer); ++ status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMBB", &arg, &buffer); + if (ACPI_FAILURE(status)) { +- acpi_handle_err(handle, "WMAB: call failed.\n"); ++ dev_err(dev, "WMBB: call failed.\n"); + return NULL; + } + +@@ -222,7 +205,7 @@ static void wmi_notify(u32 value, void *context) + + if (eventcode == 0x10000000) { + led_classdev_notify_brightness_hw_changed( +- &kbd_backlight, get_kbd_backlight_level()); ++ &kbd_backlight, get_kbd_backlight_level(kbd_backlight.dev->parent)); + } else { + key = sparse_keymap_entry_from_scancode( + wmi_input_dev, eventcode); +@@ -271,14 +254,7 @@ static void wmi_input_setup(void) + + static void acpi_notify(struct acpi_device *device, u32 event) + { +- struct key_entry *key; +- + acpi_handle_debug(device->handle, "notify: %d\n", event); +- if (inited & INIT_SPARSE_KEYMAP) { +- key = sparse_keymap_entry_from_scancode(wmi_input_dev, 0x80); +- if (key && key->type == KE_KEY) +- sparse_keymap_report_entry(wmi_input_dev, key, 1, true); +- } + } + + static ssize_t fan_mode_store(struct device *dev, +@@ -294,7 +270,7 @@ static ssize_t fan_mode_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_FAN_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -305,9 +281,9 @@ static ssize_t fan_mode_store(struct device *dev, + + m = r->integer.value; + kfree(r); +- r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4)); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4)); + kfree(r); +- r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value); + kfree(r); + + return count; +@@ -319,7 +295,7 @@ static ssize_t fan_mode_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_FAN_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -346,7 +322,7 @@ static ssize_t usb_charge_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmbb(WMBB_USB_CHARGE, WM_SET, value); ++ r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_SET, value); + if (!r) + return -EIO; + +@@ -360,7 +336,7 @@ static ssize_t usb_charge_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmbb(WMBB_USB_CHARGE, WM_GET, 0); ++ r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -388,7 +364,7 @@ static ssize_t reader_mode_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_READER_MODE, WM_SET, value); ++ r = lg_wmab(dev, WM_READER_MODE, WM_SET, value); + if (!r) + return -EIO; + +@@ -402,7 +378,7 @@ static ssize_t reader_mode_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_READER_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_READER_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -430,7 +406,7 @@ static ssize_t fn_lock_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_FN_LOCK, WM_SET, value); ++ r = lg_wmab(dev, WM_FN_LOCK, WM_SET, value); + if (!r) + return -EIO; + +@@ -444,7 +420,7 @@ static ssize_t fn_lock_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_FN_LOCK, WM_GET, 0); ++ r = lg_wmab(dev, WM_FN_LOCK, WM_GET, 0); + if (!r) + return -EIO; + +@@ -474,9 +450,9 @@ static ssize_t battery_care_limit_store(struct device *dev, + union acpi_object *r; + + if (battery_limit_use_wmbb) +- r = lg_wmbb(WMBB_BATT_LIMIT, WM_SET, value); ++ r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_SET, value); + else +- r = lg_wmab(WM_BATT_LIMIT, WM_SET, value); ++ r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_SET, value); + if (!r) + return -EIO; + +@@ -495,7 +471,7 @@ static ssize_t battery_care_limit_show(struct device *dev, + union acpi_object *r; + + if (battery_limit_use_wmbb) { +- r = lg_wmbb(WMBB_BATT_LIMIT, WM_GET, 0); ++ r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_GET, 0); + if (!r) + return -EIO; + +@@ -506,7 +482,7 @@ static ssize_t battery_care_limit_show(struct device *dev, + + status = r->buffer.pointer[0x10]; + } else { +- r = lg_wmab(WM_BATT_LIMIT, WM_GET, 0); ++ r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_GET, 0); + if (!r) + return -EIO; + +@@ -548,7 +524,7 @@ static void tpad_led_set(struct led_classdev *cdev, + { + union acpi_object *r; + +- r = lg_wmab(WM_TLED, WM_SET, brightness > LED_OFF); ++ r = lg_wmab(cdev->dev->parent, WM_TLED, WM_SET, brightness > LED_OFF); + kfree(r); + } + +@@ -570,16 +546,16 @@ static void kbd_backlight_set(struct led_classdev *cdev, + val = 0; + if (brightness >= LED_FULL) + val = 0x24; +- r = lg_wmab(WM_KEY_LIGHT, WM_SET, val); ++ r = lg_wmab(cdev->dev->parent, WM_KEY_LIGHT, WM_SET, val); + kfree(r); + } + +-static enum led_brightness get_kbd_backlight_level(void) ++static enum led_brightness get_kbd_backlight_level(struct device *dev) + { + union acpi_object *r; + int val; + +- r = lg_wmab(WM_KEY_LIGHT, WM_GET, 0); ++ r = lg_wmab(dev, WM_KEY_LIGHT, WM_GET, 0); + + if (!r) + return LED_OFF; +@@ -607,7 +583,7 @@ static enum led_brightness get_kbd_backlight_level(void) + + static enum led_brightness kbd_backlight_get(struct led_classdev *cdev) + { +- return get_kbd_backlight_level(); ++ return get_kbd_backlight_level(cdev->dev->parent); + } + + static LED_DEVICE(kbd_backlight, 255, LED_BRIGHT_HW_CHANGED); +@@ -634,6 +610,11 @@ static struct platform_driver pf_driver = { + + static int acpi_add(struct acpi_device *device) + { ++ struct platform_device_info pdev_info = { ++ .fwnode = acpi_fwnode_handle(device), ++ .name = PLATFORM_NAME, ++ .id = PLATFORM_DEVID_NONE, ++ }; + int ret; + const char *product; + int year = 2017; +@@ -645,9 +626,7 @@ static int acpi_add(struct acpi_device *device) + if (ret) + return ret; + +- pf_device = platform_device_register_simple(PLATFORM_NAME, +- PLATFORM_DEVID_NONE, +- NULL, 0); ++ pf_device = platform_device_register_full(&pdev_info); + if (IS_ERR(pf_device)) { + ret = PTR_ERR(pf_device); + pf_device = NULL; +@@ -726,7 +705,7 @@ static int acpi_remove(struct acpi_device *device) + } + + static const struct acpi_device_id device_ids[] = { +- {"LGEX0815", 0}, ++ {"LGEX0820", 0}, + {"", 0} + }; + MODULE_DEVICE_TABLE(acpi, device_ids); +diff --git a/drivers/platform/x86/wireless-hotkey.c b/drivers/platform/x86/wireless-hotkey.c +index 11c60a2734468..61ae722643e5a 100644 +--- a/drivers/platform/x86/wireless-hotkey.c ++++ b/drivers/platform/x86/wireless-hotkey.c +@@ -19,6 +19,7 @@ MODULE_AUTHOR("Alex Hung"); + MODULE_ALIAS("acpi*:HPQ6001:*"); + MODULE_ALIAS("acpi*:WSTADEF:*"); + MODULE_ALIAS("acpi*:AMDI0051:*"); ++MODULE_ALIAS("acpi*:LGEX0815:*"); + + static struct input_dev *wl_input_dev; + +@@ -26,6 +27,7 @@ static const struct acpi_device_id wl_ids[] = { + {"HPQ6001", 0}, + {"WSTADEF", 0}, + {"AMDI0051", 0}, ++ {"LGEX0815", 0}, + {"", 0}, + }; + +diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c +index 2cf7fe131ecec..0830ea42e7c80 100644 +--- a/drivers/s390/char/sclp.c ++++ b/drivers/s390/char/sclp.c +@@ -1292,6 +1292,7 @@ sclp_init(void) + fail_unregister_reboot_notifier: + unregister_reboot_notifier(&sclp_reboot_notifier); + fail_init_state_uninitialized: ++ list_del(&sclp_state_change_event.list); + sclp_init_state = sclp_init_state_uninitialized; + free_page((unsigned long) sclp_read_sccb); + free_page((unsigned long) sclp_init_sccb); +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index a9c4a5e2ccb90..60792f257c235 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -406,28 +406,40 @@ static char print_alua_state(unsigned char state) + } + } + +-static enum scsi_disposition alua_check_sense(struct scsi_device *sdev, +- struct scsi_sense_hdr *sense_hdr) ++static void alua_handle_state_transition(struct scsi_device *sdev) + { + struct alua_dh_data *h = sdev->handler_data; + struct alua_port_group *pg; + ++ rcu_read_lock(); ++ pg = rcu_dereference(h->pg); ++ if (pg) ++ pg->state = SCSI_ACCESS_STATE_TRANSITIONING; ++ rcu_read_unlock(); ++ alua_check(sdev, false); ++} ++ ++static enum scsi_disposition alua_check_sense(struct scsi_device *sdev, ++ struct scsi_sense_hdr *sense_hdr) ++{ + switch (sense_hdr->sense_key) { + case NOT_READY: + if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) { + /* + * LUN Not Accessible - ALUA state transition + */ +- rcu_read_lock(); +- pg = rcu_dereference(h->pg); +- if (pg) +- pg->state = SCSI_ACCESS_STATE_TRANSITIONING; +- rcu_read_unlock(); +- alua_check(sdev, false); ++ alua_handle_state_transition(sdev); + return NEEDS_RETRY; + } + break; + case UNIT_ATTENTION: ++ if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) { ++ /* ++ * LUN Not Accessible - ALUA state transition ++ */ ++ alua_handle_state_transition(sdev); ++ return NEEDS_RETRY; ++ } + if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00) { + /* + * Power On, Reset, or Bus Device Reset. +@@ -494,7 +506,8 @@ static int alua_tur(struct scsi_device *sdev) + + retval = scsi_test_unit_ready(sdev, ALUA_FAILOVER_TIMEOUT * HZ, + ALUA_FAILOVER_RETRIES, &sense_hdr); +- if (sense_hdr.sense_key == NOT_READY && ++ if ((sense_hdr.sense_key == NOT_READY || ++ sense_hdr.sense_key == UNIT_ATTENTION) && + sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) + return SCSI_DH_RETRY; + else if (retval) +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 4caee4e324612..eb3e8b41adb10 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -182,6 +182,15 @@ void scsi_remove_host(struct Scsi_Host *shost) + scsi_proc_host_rm(shost); + scsi_proc_hostdir_rm(shost->hostt); + ++ /* ++ * New SCSI devices cannot be attached anymore because of the SCSI host ++ * state so drop the tag set refcnt. Wait until the tag set refcnt drops ++ * to zero because .exit_cmd_priv implementations may need the host ++ * pointer. ++ */ ++ kref_put(&shost->tagset_refcnt, scsi_mq_free_tags); ++ wait_for_completion(&shost->tagset_freed); ++ + spin_lock_irqsave(shost->host_lock, flags); + if (scsi_host_set_state(shost, SHOST_DEL)) + BUG_ON(scsi_host_set_state(shost, SHOST_DEL_RECOVERY)); +@@ -240,6 +249,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + + shost->dma_dev = dma_dev; + ++ kref_init(&shost->tagset_refcnt); ++ init_completion(&shost->tagset_freed); ++ + /* + * Increase usage count temporarily here so that calling + * scsi_autopm_put_host() will trigger runtime idle if there is +@@ -312,6 +324,7 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + pm_runtime_disable(&shost->shost_gendev); + pm_runtime_set_suspended(&shost->shost_gendev); + pm_runtime_put_noidle(&shost->shost_gendev); ++ kref_put(&shost->tagset_refcnt, scsi_mq_free_tags); + fail: + return error; + } +@@ -344,9 +357,6 @@ static void scsi_host_dev_release(struct device *dev) + kfree(dev_name(&shost->shost_dev)); + } + +- if (shost->tag_set.tags) +- scsi_mq_destroy_tags(shost); +- + kfree(shost->shost_data); + + ida_simple_remove(&host_index_ida, shost->host_no); +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index d7a1fb5c10c6e..5028bc394c4f9 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -111,6 +111,20 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); ++ ++ /* ++ * If the device probe failed, the expander phy attached address ++ * needs to be reset so that the phy will not be treated as flutter ++ * in the next revalidation ++ */ ++ if (dev->parent && !dev_is_expander(dev->dev_type)) { ++ struct sas_phy *phy = dev->phy; ++ struct domain_device *parent = dev->parent; ++ struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; ++ ++ memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); ++ } ++ + sas_unregister_dev(dev->port, dev); + } + +diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h +index ba94413fe2ead..1d457831f153c 100644 +--- a/drivers/scsi/qedf/qedf.h ++++ b/drivers/scsi/qedf/qedf.h +@@ -354,6 +354,7 @@ struct qedf_ctx { + #define QEDF_IN_RECOVERY 5 + #define QEDF_DBG_STOP_IO 6 + #define QEDF_PROBING 8 ++#define QEDF_STAG_IN_PROGRESS 9 + unsigned long flags; /* Miscellaneous state flags */ + int fipvlan_retries; + u8 num_queues; +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 18380a932ab61..690d3464f8766 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -318,11 +318,18 @@ static struct fc_seq *qedf_elsct_send(struct fc_lport *lport, u32 did, + */ + if (resp == fc_lport_flogi_resp) { + qedf->flogi_cnt++; ++ qedf->flogi_pending++; ++ ++ if (test_bit(QEDF_UNLOADING, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n"); ++ qedf->flogi_pending = 0; ++ } ++ + if (qedf->flogi_pending >= QEDF_FLOGI_RETRY_CNT) { + schedule_delayed_work(&qedf->stag_work, 2); + return NULL; + } +- qedf->flogi_pending++; ++ + return fc_elsct_send(lport, did, fp, op, qedf_flogi_resp, + arg, timeout); + } +@@ -911,13 +918,14 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + struct qedf_ctx *qedf; + struct qed_link_output if_link; + ++ qedf = lport_priv(lport); ++ + if (lport->vport) { ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + printk_ratelimited("Cannot issue host reset on NPIV port.\n"); + return; + } + +- qedf = lport_priv(lport); +- + qedf->flogi_pending = 0; + /* For host reset, essentially do a soft link up/down */ + atomic_set(&qedf->link_state, QEDF_LINK_DOWN); +@@ -937,6 +945,7 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + if (!if_link.link_up) { + QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, + "Physical link is not up.\n"); ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + return; + } + /* Flush and wait to make sure link down is processed */ +@@ -949,6 +958,7 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + "Queue link up work.\n"); + queue_delayed_work(qedf->link_update_wq, &qedf->link_update, + 0); ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + } + + /* Reset the host by gracefully logging out and then logging back in */ +@@ -3467,6 +3477,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + } + + /* Start the Slowpath-process */ ++ memset(&slowpath_params, 0, sizeof(struct qed_slowpath_params)); + slowpath_params.int_mode = QED_INT_MODE_MSIX; + slowpath_params.drv_major = QEDF_DRIVER_MAJOR_VER; + slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER; +@@ -3725,6 +3736,7 @@ static void __qedf_remove(struct pci_dev *pdev, int mode) + { + struct qedf_ctx *qedf; + int rc; ++ int cnt = 0; + + if (!pdev) { + QEDF_ERR(NULL, "pdev is NULL.\n"); +@@ -3742,6 +3754,17 @@ static void __qedf_remove(struct pci_dev *pdev, int mode) + return; + } + ++stag_in_prog: ++ if (test_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Stag in progress, cnt=%d.\n", cnt); ++ cnt++; ++ ++ if (cnt < 5) { ++ msleep(500); ++ goto stag_in_prog; ++ } ++ } ++ + if (mode != QEDF_MODE_RECOVERY) + set_bit(QEDF_UNLOADING, &qedf->flags); + +@@ -4001,6 +4024,24 @@ void qedf_stag_change_work(struct work_struct *work) + struct qedf_ctx *qedf = + container_of(work, struct qedf_ctx, stag_work.work); + ++ if (!qedf) { ++ QEDF_ERR(&qedf->dbg_ctx, "qedf is NULL"); ++ return; ++ } ++ ++ if (test_bit(QEDF_IN_RECOVERY, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, ++ "Already is in recovery, hence not calling software context reset.\n"); ++ return; ++ } ++ ++ if (test_bit(QEDF_UNLOADING, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n"); ++ return; ++ } ++ ++ set_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); ++ + printk_ratelimited("[%s]:[%s:%d]:%d: Performing software context reset.", + dev_name(&qedf->pdev->dev), __func__, __LINE__, + qedf->dbg_ctx.host_no); +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 0389bf281f4b2..2d37790321631 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1949,9 +1949,13 @@ int scsi_mq_setup_tags(struct Scsi_Host *shost) + return blk_mq_alloc_tag_set(tag_set); + } + +-void scsi_mq_destroy_tags(struct Scsi_Host *shost) ++void scsi_mq_free_tags(struct kref *kref) + { ++ struct Scsi_Host *shost = container_of(kref, typeof(*shost), ++ tagset_refcnt); ++ + blk_mq_free_tag_set(&shost->tag_set); ++ complete(&shost->tagset_freed); + } + + /** +diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h +index b650407690a80..b531dec3d4206 100644 +--- a/drivers/scsi/scsi_priv.h ++++ b/drivers/scsi/scsi_priv.h +@@ -95,7 +95,7 @@ extern void scsi_run_host_queues(struct Scsi_Host *shost); + extern void scsi_requeue_run_queue(struct work_struct *work); + extern void scsi_start_queue(struct scsi_device *sdev); + extern int scsi_mq_setup_tags(struct Scsi_Host *shost); +-extern void scsi_mq_destroy_tags(struct Scsi_Host *shost); ++extern void scsi_mq_free_tags(struct kref *kref); + extern void scsi_exit_queue(void); + extern void scsi_evt_thread(struct work_struct *work); + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 86c10edbb5f1e..9c155d5768144 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -324,6 +324,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + kfree(sdev); + goto out; + } ++ kref_get(&sdev->host->tagset_refcnt); + sdev->request_queue = q; + q->queuedata = sdev; + __scsi_init_queue(sdev->host, q); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 774864b54b97c..4c72116c8693c 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1490,6 +1490,7 @@ void __scsi_remove_device(struct scsi_device *sdev) + mutex_unlock(&sdev->state_mutex); + + blk_cleanup_queue(sdev->request_queue); ++ kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags); + cancel_work_sync(&sdev->requeue_work); + + if (sdev->host->hostt->slave_destroy) +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index f201653931d89..c806ee8070e5a 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1016,7 +1016,7 @@ static struct spi_imx_devtype_data imx35_cspi_devtype_data = { + .rx_available = mx31_rx_available, + .reset = mx31_reset, + .fifo_size = 8, +- .has_dmamode = true, ++ .has_dmamode = false, + .dynamic_burst = false, + .has_slavemode = false, + .devtype = IMX35_CSPI, +diff --git a/drivers/spi/spi-mux.c b/drivers/spi/spi-mux.c +index f5d32ec4634e3..e1af2d8ed51a6 100644 +--- a/drivers/spi/spi-mux.c ++++ b/drivers/spi/spi-mux.c +@@ -156,6 +156,7 @@ static int spi_mux_probe(struct spi_device *spi) + /* supported modes are the same as our parent's */ + ctlr->mode_bits = spi->controller->mode_bits; + ctlr->flags = spi->controller->flags; ++ ctlr->bits_per_word_mask = spi->controller->bits_per_word_mask; + ctlr->transfer_one_message = spi_mux_transfer_one_message; + ctlr->setup = spi_mux_setup; + ctlr->num_chipselect = mux_control_states(priv->mux); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index c50cabf69415f..1f5ab51e18dc4 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1196,7 +1196,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + + int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + { +- struct btrfs_root *quota_root; ++ struct btrfs_root *quota_root = NULL; + struct btrfs_trans_handle *trans = NULL; + int ret = 0; + +@@ -1290,9 +1290,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + btrfs_free_tree_block(trans, btrfs_root_id(quota_root), + quota_root->node, 0, 1); + +- btrfs_put_root(quota_root); + + out: ++ btrfs_put_root(quota_root); + mutex_unlock(&fs_info->qgroup_ioctl_lock); + if (ret && trans) + btrfs_end_transaction(trans); +diff --git a/fs/dcache.c b/fs/dcache.c +index 9a29cfdaa5416..43d75e7ee4785 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -3127,28 +3127,25 @@ EXPORT_SYMBOL(d_splice_alias); + + bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry) + { +- bool result; ++ bool subdir; + unsigned seq; + + if (new_dentry == old_dentry) + return true; + +- do { +- /* for restarting inner loop in case of seq retry */ +- seq = read_seqbegin(&rename_lock); +- /* +- * Need rcu_readlock to protect against the d_parent trashing +- * due to d_move +- */ +- rcu_read_lock(); +- if (d_ancestor(old_dentry, new_dentry)) +- result = true; +- else +- result = false; +- rcu_read_unlock(); +- } while (read_seqretry(&rename_lock, seq)); +- +- return result; ++ /* Access d_parent under rcu as d_move() may change it. */ ++ rcu_read_lock(); ++ seq = read_seqbegin(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ /* Try lockless once... */ ++ if (read_seqretry(&rename_lock, seq)) { ++ /* ...else acquire lock for progress even on deep chains. */ ++ read_seqlock_excl(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ read_sequnlock_excl(&rename_lock); ++ } ++ rcu_read_unlock(); ++ return subdir; + } + EXPORT_SYMBOL(is_subdir); + +diff --git a/fs/file.c b/fs/file.c +index 69a51d37b66d9..b46a4a725a0ef 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -481,12 +481,12 @@ struct files_struct init_files = { + + static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) + { +- unsigned int maxfd = fdt->max_fds; ++ unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */ + unsigned int maxbit = maxfd / BITS_PER_LONG; + unsigned int bitbit = start / BITS_PER_LONG; + + bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG; +- if (bitbit > maxfd) ++ if (bitbit >= maxfd) + return maxfd; + if (bitbit > start) + start = bitbit; +diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c +index e2855ceefd394..71fb2f8e91170 100644 +--- a/fs/hfsplus/xattr.c ++++ b/fs/hfsplus/xattr.c +@@ -699,7 +699,7 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size) + return err; + } + +- strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + ++ strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL); + if (!strbuf) { + res = -ENOMEM; +diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c +index 07df16ce80064..8ef8dfc3c1944 100644 +--- a/fs/jfs/xattr.c ++++ b/fs/jfs/xattr.c +@@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + size_t buf_size) + { + struct jfs_ea_list *ealist; +- struct jfs_ea *ea; ++ struct jfs_ea *ea, *ealist_end; + struct ea_buffer ea_buf; + int xattr_size; + ssize_t size; +@@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + goto not_found; + + ealist = (struct jfs_ea_list *) ea_buf.xattr; ++ ealist_end = END_EALIST(ealist); + + /* Find the named attribute */ +- for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) ++ for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { ++ if (unlikely(ea + 1 > ealist_end) || ++ unlikely(NEXT_EA(ea) > ealist_end)) { ++ size = -EUCLEAN; ++ goto release; ++ } ++ + if ((namelen == ea->namelen) && + memcmp(name, ea->name, namelen) == 0) { + /* Found it */ +@@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + memcpy(data, value, size); + goto release; + } ++ } + not_found: + size = -ENODATA; + release: +@@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) + ssize_t size = 0; + int xattr_size; + struct jfs_ea_list *ealist; +- struct jfs_ea *ea; ++ struct jfs_ea *ea, *ealist_end; + struct ea_buffer ea_buf; + + down_read(&JFS_IP(inode)->xattr_sem); +@@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) + goto release; + + ealist = (struct jfs_ea_list *) ea_buf.xattr; ++ ealist_end = END_EALIST(ealist); + + /* compute required size of list */ +- for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { ++ for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { ++ if (unlikely(ea + 1 > ealist_end) || ++ unlikely(NEXT_EA(ea) > ealist_end)) { ++ size = -EUCLEAN; ++ goto release; ++ } ++ + if (can_list(ea)) + size += name_size(ea) + 1; + } +diff --git a/fs/locks.c b/fs/locks.c +index 360c348ae6c8f..250559af8064b 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -2483,8 +2483,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, + error = do_lock_file_wait(filp, cmd, file_lock); + + /* +- * Attempt to detect a close/fcntl race and recover by releasing the +- * lock that was just acquired. There is no need to do that when we're ++ * Detect close/fcntl races and recover by zapping all POSIX locks ++ * associated with this file and our files_struct, just like on ++ * filp_flush(). There is no need to do that when we're + * unlocking though, or for OFD locks. + */ + if (!error && file_lock->fl_type != F_UNLCK && +@@ -2499,9 +2500,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, + f = files_lookup_fd_locked(files, fd); + spin_unlock(&files->file_lock); + if (f != filp) { +- file_lock->fl_type = F_UNLCK; +- error = do_lock_file_wait(filp, cmd, file_lock); +- WARN_ON_ONCE(error); ++ locks_remove_posix(filp, files); + error = -EBADF; + } + } +@@ -2606,8 +2605,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, + error = do_lock_file_wait(filp, cmd, file_lock); + + /* +- * Attempt to detect a close/fcntl race and recover by releasing the +- * lock that was just acquired. There is no need to do that when we're ++ * Detect close/fcntl races and recover by zapping all POSIX locks ++ * associated with this file and our files_struct, just like on ++ * filp_flush(). There is no need to do that when we're + * unlocking though, or for OFD locks. + */ + if (!error && file_lock->fl_type != F_UNLCK && +@@ -2622,9 +2622,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, + f = files_lookup_fd_locked(files, fd); + spin_unlock(&files->file_lock); + if (f != filp) { +- file_lock->fl_type = F_UNLCK; +- error = do_lock_file_wait(filp, cmd, file_lock); +- WARN_ON_ONCE(error); ++ locks_remove_posix(filp, files); + error = -EBADF; + } + } +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 369ab64a0b844..8ac677e3b250c 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -724,7 +724,8 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) + + if (!rsize || rsize > bytes || + rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts || +- le16_to_cpu(rt->total) > ne || ff > ts || lf > ts || ++ le16_to_cpu(rt->total) > ne || ++ ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) || + (ff && ff < sizeof(struct RESTART_TABLE)) || + (lf && lf < sizeof(struct RESTART_TABLE))) { + return false; +@@ -754,6 +755,9 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) + return false; + + off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off)); ++ ++ if (off > ts - sizeof(__le32)) ++ return false; + } + + return true; +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index bd8d534f11cbd..c9797dd067851 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -294,13 +294,16 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len, + * bh passed here can be an inode block or a dir data block, depending + * on the inode inline data flag. + */ +-static int ocfs2_check_dir_entry(struct inode * dir, +- struct ocfs2_dir_entry * de, +- struct buffer_head * bh, ++static int ocfs2_check_dir_entry(struct inode *dir, ++ struct ocfs2_dir_entry *de, ++ struct buffer_head *bh, ++ char *buf, ++ unsigned int size, + unsigned long offset) + { + const char *error_msg = NULL; + const int rlen = le16_to_cpu(de->rec_len); ++ const unsigned long next_offset = ((char *) de - buf) + rlen; + + if (unlikely(rlen < OCFS2_DIR_REC_LEN(1))) + error_msg = "rec_len is smaller than minimal"; +@@ -308,9 +311,11 @@ static int ocfs2_check_dir_entry(struct inode * dir, + error_msg = "rec_len % 4 != 0"; + else if (unlikely(rlen < OCFS2_DIR_REC_LEN(de->name_len))) + error_msg = "rec_len is too small for name_len"; +- else if (unlikely( +- ((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize)) +- error_msg = "directory entry across blocks"; ++ else if (unlikely(next_offset > size)) ++ error_msg = "directory entry overrun"; ++ else if (unlikely(next_offset > size - OCFS2_DIR_REC_LEN(1)) && ++ next_offset != size) ++ error_msg = "directory entry too close to end"; + + if (unlikely(error_msg != NULL)) + mlog(ML_ERROR, "bad entry in directory #%llu: %s - " +@@ -352,16 +357,17 @@ static inline int ocfs2_search_dirblock(struct buffer_head *bh, + de_buf = first_de; + dlimit = de_buf + bytes; + +- while (de_buf < dlimit) { ++ while (de_buf < dlimit - OCFS2_DIR_MEMBER_LEN) { + /* this code is executed quadratically often */ + /* do minimal checking `by hand' */ + + de = (struct ocfs2_dir_entry *) de_buf; + +- if (de_buf + namelen <= dlimit && ++ if (de->name + namelen <= dlimit && + ocfs2_match(namelen, name, de)) { + /* found a match - just to be sure, do a full check */ +- if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, first_de, ++ bytes, offset)) { + ret = -1; + goto bail; + } +@@ -1138,7 +1144,7 @@ static int __ocfs2_delete_entry(handle_t *handle, struct inode *dir, + pde = NULL; + de = (struct ocfs2_dir_entry *) first_de; + while (i < bytes) { +- if (!ocfs2_check_dir_entry(dir, de, bh, i)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, first_de, bytes, i)) { + status = -EIO; + mlog_errno(status); + goto bail; +@@ -1638,7 +1644,8 @@ int __ocfs2_add_entry(handle_t *handle, + /* These checks should've already been passed by the + * prepare function, but I guess we can leave them + * here anyway. */ +- if (!ocfs2_check_dir_entry(dir, de, insert_bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, insert_bh, data_start, ++ size, offset)) { + retval = -ENOENT; + goto bail; + } +@@ -1776,7 +1783,8 @@ static int ocfs2_dir_foreach_blk_id(struct inode *inode, + } + + de = (struct ocfs2_dir_entry *) (data->id_data + ctx->pos); +- if (!ocfs2_check_dir_entry(inode, de, di_bh, ctx->pos)) { ++ if (!ocfs2_check_dir_entry(inode, de, di_bh, (char *)data->id_data, ++ i_size_read(inode), ctx->pos)) { + /* On error, skip the f_pos to the end. */ + ctx->pos = i_size_read(inode); + break; +@@ -1869,7 +1877,8 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, + while (ctx->pos < i_size_read(inode) + && offset < sb->s_blocksize) { + de = (struct ocfs2_dir_entry *) (bh->b_data + offset); +- if (!ocfs2_check_dir_entry(inode, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(inode, de, bh, bh->b_data, ++ sb->s_blocksize, offset)) { + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +@@ -3341,7 +3350,7 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, + struct super_block *sb = dir->i_sb; + struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; + struct ocfs2_dir_entry *de, *last_de = NULL; +- char *de_buf, *limit; ++ char *first_de, *de_buf, *limit; + unsigned long offset = 0; + unsigned int rec_len, new_rec_len, free_space = dir->i_sb->s_blocksize; + +@@ -3354,14 +3363,16 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, + else + free_space = dir->i_sb->s_blocksize - i_size_read(dir); + +- de_buf = di->id2.i_data.id_data; ++ first_de = di->id2.i_data.id_data; ++ de_buf = first_de; + limit = de_buf + i_size_read(dir); + rec_len = OCFS2_DIR_REC_LEN(namelen); + + while (de_buf < limit) { + de = (struct ocfs2_dir_entry *)de_buf; + +- if (!ocfs2_check_dir_entry(dir, de, di_bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, di_bh, first_de, ++ i_size_read(dir), offset)) { + ret = -ENOENT; + goto out; + } +@@ -3443,7 +3454,8 @@ static int ocfs2_find_dir_space_el(struct inode *dir, const char *name, + /* move to next block */ + de = (struct ocfs2_dir_entry *) bh->b_data; + } +- if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, bh->b_data, blocksize, ++ offset)) { + status = -ENOENT; + goto bail; + } +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 0f7fd205ab7ea..65111de4ad6b5 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -246,6 +246,12 @@ static inline void *offset_to_ptr(const int *off) + /* &a[0] degrades to a pointer: a different type from an array */ + #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) + ++/* ++ * Whether 'type' is a signed type or an unsigned type. Supports scalar types, ++ * bool and also pointer types. ++ */ ++#define is_signed_type(type) (((type)(-1)) < (__force type)1) ++ + /* + * This is needed in functions which generate the stack canary, see + * arch/x86/kernel/smpboot.c::start_secondary() for an example. +diff --git a/include/linux/minmax.h b/include/linux/minmax.h +index 1aea34b8f19bf..dd52969698f74 100644 +--- a/include/linux/minmax.h ++++ b/include/linux/minmax.h +@@ -2,54 +2,93 @@ + #ifndef _LINUX_MINMAX_H + #define _LINUX_MINMAX_H + ++#include <linux/build_bug.h> ++#include <linux/compiler.h> + #include <linux/const.h> + + /* + * min()/max()/clamp() macros must accomplish three things: + * +- * - avoid multiple evaluations of the arguments (so side-effects like ++ * - Avoid multiple evaluations of the arguments (so side-effects like + * "x++" happen only once) when non-constant. +- * - perform strict type-checking (to generate warnings instead of +- * nasty runtime surprises). See the "unnecessary" pointer comparison +- * in __typecheck(). +- * - retain result as a constant expressions when called with only ++ * - Retain result as a constant expressions when called with only + * constant expressions (to avoid tripping VLA warnings in stack + * allocation usage). ++ * - Perform signed v unsigned type-checking (to generate compile ++ * errors instead of nasty runtime surprises). ++ * - Unsigned char/short are always promoted to signed int and can be ++ * compared against signed or unsigned arguments. ++ * - Unsigned arguments can be compared against non-negative signed constants. ++ * - Comparison of a signed argument against an unsigned constant fails ++ * even if the constant is below __INT_MAX__ and could be cast to int. + */ + #define __typecheck(x, y) \ + (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) + +-#define __no_side_effects(x, y) \ +- (__is_constexpr(x) && __is_constexpr(y)) ++/* is_signed_type() isn't a constexpr for pointer types */ ++#define __is_signed(x) \ ++ __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ ++ is_signed_type(typeof(x)), 0) + +-#define __safe_cmp(x, y) \ +- (__typecheck(x, y) && __no_side_effects(x, y)) ++/* True for a non-negative signed int constant */ ++#define __is_noneg_int(x) \ ++ (__builtin_choose_expr(__is_constexpr(x) && __is_signed(x), x, -1) >= 0) + +-#define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) ++#define __types_ok(x, y) \ ++ (__is_signed(x) == __is_signed(y) || \ ++ __is_signed((x) + 0) == __is_signed((y) + 0) || \ ++ __is_noneg_int(x) || __is_noneg_int(y)) + +-#define __cmp_once(x, y, unique_x, unique_y, op) ({ \ ++#define __cmp_op_min < ++#define __cmp_op_max > ++ ++#define __cmp(op, x, y) ((x) __cmp_op_##op (y) ? (x) : (y)) ++ ++#define __cmp_once(op, x, y, unique_x, unique_y) ({ \ + typeof(x) unique_x = (x); \ + typeof(y) unique_y = (y); \ +- __cmp(unique_x, unique_y, op); }) +- +-#define __careful_cmp(x, y, op) \ +- __builtin_choose_expr(__safe_cmp(x, y), \ +- __cmp(x, y, op), \ +- __cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y), op)) ++ static_assert(__types_ok(x, y), \ ++ #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ ++ __cmp(op, unique_x, unique_y); }) ++ ++#define __careful_cmp(op, x, y) \ ++ __builtin_choose_expr(__is_constexpr((x) - (y)), \ ++ __cmp(op, x, y), \ ++ __cmp_once(op, x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y))) ++ ++#define __clamp(val, lo, hi) \ ++ ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) ++ ++#define __clamp_once(val, lo, hi, unique_val, unique_lo, unique_hi) ({ \ ++ typeof(val) unique_val = (val); \ ++ typeof(lo) unique_lo = (lo); \ ++ typeof(hi) unique_hi = (hi); \ ++ static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ ++ (lo) <= (hi), true), \ ++ "clamp() low limit " #lo " greater than high limit " #hi); \ ++ static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ ++ static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ ++ __clamp(unique_val, unique_lo, unique_hi); }) ++ ++#define __careful_clamp(val, lo, hi) ({ \ ++ __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ ++ __clamp(val, lo, hi), \ ++ __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ ++ __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) + + /** + * min - return minimum of two values of the same or compatible types + * @x: first value + * @y: second value + */ +-#define min(x, y) __careful_cmp(x, y, <) ++#define min(x, y) __careful_cmp(min, x, y) + + /** + * max - return maximum of two values of the same or compatible types + * @x: first value + * @y: second value + */ +-#define max(x, y) __careful_cmp(x, y, >) ++#define max(x, y) __careful_cmp(max, x, y) + + /** + * umin - return minimum of two non-negative values +@@ -58,7 +97,7 @@ + * @y: second value + */ + #define umin(x, y) \ +- __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, <) ++ __careful_cmp(min, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) + + /** + * umax - return maximum of two non-negative values +@@ -66,7 +105,7 @@ + * @y: second value + */ + #define umax(x, y) \ +- __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, >) ++ __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) + + /** + * min3 - return minimum of three values +@@ -103,7 +142,7 @@ + * This macro does strict typechecking of @lo/@hi to make sure they are of the + * same type as @val. See the unnecessary pointer comparisons. + */ +-#define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi) ++#define clamp(val, lo, hi) __careful_clamp(val, lo, hi) + + /* + * ..and if you can't take the strict +@@ -118,7 +157,7 @@ + * @x: first value + * @y: second value + */ +-#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) ++#define min_t(type, x, y) __careful_cmp(min, (type)(x), (type)(y)) + + /** + * max_t - return maximum of two values, using the specified type +@@ -126,7 +165,7 @@ + * @x: first value + * @y: second value + */ +-#define max_t(type, x, y) __careful_cmp((type)(x), (type)(y), >) ++#define max_t(type, x, y) __careful_cmp(max, (type)(x), (type)(y)) + + /** + * clamp_t - return a value clamped to a given range using a given type +@@ -138,7 +177,7 @@ + * This macro does no typechecking and uses temporary variables of type + * @type to make all the comparisons. + */ +-#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi) ++#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi)) + + /** + * clamp_val - return a value clamped to a given range using val's type +diff --git a/include/linux/overflow.h b/include/linux/overflow.h +index 73bc67ec2136e..e6bf14f462e95 100644 +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -29,7 +29,6 @@ + * https://mail-index.netbsd.org/tech-misc/2007/02/05/0000.html - + * credit to Christian Biere. + */ +-#define is_signed_type(type) (((type)(-1)) < (type)1) + #define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type))) + #define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) + #define type_min(T) ((T)((T)-type_max(T)-(T)1)) +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 17575aa2a53c9..511c43ce94213 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -801,8 +801,6 @@ extern int trace_add_event_call(struct trace_event_call *call); + extern int trace_remove_event_call(struct trace_event_call *call); + extern int trace_event_get_offsets(struct trace_event_call *call); + +-#define is_signed_type(type) (((type)(-1)) < (type)1) +- + int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set); + int trace_set_clr_event(const char *system, const char *event, int set); + int trace_array_set_clr_event(struct trace_array *tr, const char *system, +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index f50861e4e88a1..3ed93982dbf07 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -565,6 +565,8 @@ struct Scsi_Host { + struct scsi_host_template *hostt; + struct scsi_transport_template *transportt; + ++ struct kref tagset_refcnt; ++ struct completion tagset_freed; + /* Area to keep a shared tag map */ + struct blk_mq_tag_set tag_set; + +diff --git a/include/sound/dmaengine_pcm.h b/include/sound/dmaengine_pcm.h +index 96666efddb396..6d9c94a570733 100644 +--- a/include/sound/dmaengine_pcm.h ++++ b/include/sound/dmaengine_pcm.h +@@ -34,6 +34,7 @@ snd_pcm_uframes_t snd_dmaengine_pcm_pointer_no_residue(struct snd_pcm_substream + int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream, + struct dma_chan *chan); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream); ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream); + + int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + dma_filter_fn filter_fn, void *filter_data); +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index 710ba9de12ce4..eb6ff0d0c06b6 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -41,9 +41,12 @@ struct bpf_ringbuf { + * mapping consumer page as r/w, but restrict producer page to r/o. + * This protects producer position from being modified by user-space + * application and ruining in-kernel position tracking. ++ * Note that the pending counter is placed in the same ++ * page as the producer, so that it shares the same cache line. + */ + unsigned long consumer_pos __aligned(PAGE_SIZE); + unsigned long producer_pos __aligned(PAGE_SIZE); ++ unsigned long pending_pos; + char data[] __aligned(PAGE_SIZE); + }; + +@@ -141,6 +144,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) + rb->mask = data_sz - 1; + rb->consumer_pos = 0; + rb->producer_pos = 0; ++ rb->pending_pos = 0; + + return rb; + } +@@ -304,9 +308,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) + + static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + { +- unsigned long cons_pos, prod_pos, new_prod_pos, flags; +- u32 len, pg_off; ++ unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; + struct bpf_ringbuf_hdr *hdr; ++ u32 len, pg_off, tmp_size, hdr_len; + + if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) + return NULL; +@@ -324,13 +328,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + spin_lock_irqsave(&rb->spinlock, flags); + } + ++ pend_pos = rb->pending_pos; + prod_pos = rb->producer_pos; + new_prod_pos = prod_pos + len; + +- /* check for out of ringbuf space by ensuring producer position +- * doesn't advance more than (ringbuf_size - 1) ahead ++ while (pend_pos < prod_pos) { ++ hdr = (void *)rb->data + (pend_pos & rb->mask); ++ hdr_len = READ_ONCE(hdr->len); ++ if (hdr_len & BPF_RINGBUF_BUSY_BIT) ++ break; ++ tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; ++ tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); ++ pend_pos += tmp_size; ++ } ++ rb->pending_pos = pend_pos; ++ ++ /* check for out of ringbuf space: ++ * - by ensuring producer position doesn't advance more than ++ * (ringbuf_size - 1) ahead ++ * - by ensuring oldest not yet committed record until newest ++ * record does not span more than (ringbuf_size - 1) + */ +- if (new_prod_pos - cons_pos > rb->mask) { ++ if (new_prod_pos - cons_pos > rb->mask || ++ new_prod_pos - pend_pos > rb->mask) { + spin_unlock_irqrestore(&rb->spinlock, flags); + return NULL; + } +diff --git a/mm/damon/core.c b/mm/damon/core.c +index 7a4912d6e65f2..4f031412f65cc 100644 +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -507,14 +507,31 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres, + * access frequencies are similar. This is for minimizing the monitoring + * overhead under the dynamically changeable access pattern. If a merge was + * unnecessarily made, later 'kdamond_split_regions()' will revert it. ++ * ++ * The total number of regions could be higher than the user-defined limit, ++ * max_nr_regions for some cases. For example, the user can update ++ * max_nr_regions to a number that lower than the current number of regions ++ * while DAMON is running. For such a case, repeat merging until the limit is ++ * met while increasing @threshold up to possible maximum level. + */ + static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, + unsigned long sz_limit) + { + struct damon_target *t; +- +- damon_for_each_target(t, c) +- damon_merge_regions_of(t, threshold, sz_limit); ++ unsigned int nr_regions; ++ unsigned int max_thres; ++ ++ max_thres = c->aggr_interval / ++ (c->sample_interval ? c->sample_interval : 1); ++ do { ++ nr_regions = 0; ++ damon_for_each_target(t, c) { ++ damon_merge_regions_of(t, threshold, sz_limit); ++ nr_regions += damon_nr_regions(t); ++ } ++ threshold = max(1, threshold * 2); ++ } while (nr_regions > c->max_nr_regions && ++ threshold / 2 < max_thres); + } + + /* +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 8a3c867bdff03..fc4e02b3f26ad 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -4025,7 +4025,11 @@ void hci_unregister_dev(struct hci_dev *hdev) + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); + ++ cancel_work_sync(&hdev->rx_work); ++ cancel_work_sync(&hdev->cmd_work); ++ cancel_work_sync(&hdev->tx_work); + cancel_work_sync(&hdev->power_on); ++ cancel_work_sync(&hdev->error_reset); + + if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { + hci_suspend_clear_tasks(hdev); +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 110ac22d3ce20..20cdd0efb95b7 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -761,7 +761,9 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags, + sock_rps_record_flow(sk2); + WARN_ON(!((1 << sk2->sk_state) & + (TCPF_ESTABLISHED | TCPF_SYN_RECV | +- TCPF_CLOSE_WAIT | TCPF_CLOSE))); ++ TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | ++ TCPF_CLOSING | TCPF_CLOSE_WAIT | ++ TCPF_CLOSE))); + + sock_graft(sk2, newsock); + +diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c +index 8c1ce78956bae..9d37f7164e732 100644 +--- a/net/ipv6/ila/ila_lwt.c ++++ b/net/ipv6/ila/ila_lwt.c +@@ -58,7 +58,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + return orig_dst->lwtstate->orig_output(net, sk, skb); + } + ++ local_bh_disable(); + dst = dst_cache_get(&ilwt->dst_cache); ++ local_bh_enable(); + if (unlikely(!dst)) { + struct ipv6hdr *ip6h = ipv6_hdr(skb); + struct flowi6 fl6; +@@ -86,8 +88,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- if (ilwt->connected) ++ if (ilwt->connected) { ++ local_bh_disable(); + dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr); ++ local_bh_enable(); ++ } + } + + skb_dst_set(skb, dst); +diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c +index ff691d9f4a04f..26adbe7f8a2f0 100644 +--- a/net/ipv6/rpl_iptunnel.c ++++ b/net/ipv6/rpl_iptunnel.c +@@ -212,9 +212,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + if (unlikely(err)) + goto drop; + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); ++ local_bh_enable(); + + if (unlikely(!dst)) { + struct ipv6hdr *hdr = ipv6_hdr(skb); +@@ -234,9 +234,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- preempt_disable(); ++ local_bh_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr); +- preempt_enable(); ++ local_bh_enable(); + } + + skb_dst_drop(skb); +@@ -268,9 +268,8 @@ static int rpl_input(struct sk_buff *skb) + return err; + } + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); + + skb_dst_drop(skb); + +@@ -278,14 +277,13 @@ static int rpl_input(struct sk_buff *skb) + ip6_route_input(skb); + dst = skb_dst(skb); + if (!dst->error) { +- preempt_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, + &ipv6_hdr(skb)->saddr); +- preempt_enable(); + } + } else { + skb_dst_set(skb, dst); + } ++ local_bh_enable(); + + err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); + if (unlikely(err)) +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 03f8c8bdab765..03c238e68038b 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1803,6 +1803,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata, + void ieee80211_configure_filter(struct ieee80211_local *local); + u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata); + ++void ieee80211_handle_queued_frames(struct ieee80211_local *local); ++ + u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local); + int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb, + u64 *cookie, gfp_t gfp); +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 9617ff8e27147..1c2cdaeb353b0 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -220,9 +220,9 @@ u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata) + BSS_CHANGED_ERP_SLOT; + } + +-static void ieee80211_tasklet_handler(struct tasklet_struct *t) ++/* context: requires softirqs disabled */ ++void ieee80211_handle_queued_frames(struct ieee80211_local *local) + { +- struct ieee80211_local *local = from_tasklet(local, t, tasklet); + struct sk_buff *skb; + + while ((skb = skb_dequeue(&local->skb_queue)) || +@@ -247,6 +247,13 @@ static void ieee80211_tasklet_handler(struct tasklet_struct *t) + } + } + ++static void ieee80211_tasklet_handler(struct tasklet_struct *t) ++{ ++ struct ieee80211_local *local = from_tasklet(local, t, tasklet); ++ ++ ieee80211_handle_queued_frames(local); ++} ++ + static void ieee80211_restart_work(struct work_struct *work) + { + struct ieee80211_local *local = +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 6847fdf934392..6202157f467b1 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -1628,6 +1628,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata) + ifmsh->last_preq = jiffies; + ifmsh->next_perr = jiffies; + ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE; ++ ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE; + /* Allocate all mesh structures when creating the first mesh interface. */ + if (!mesh_allocated) + ieee80211s_init(); +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index e692a2487eb5d..3bf3dd4bafa54 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -729,15 +729,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, + local->hw_scan_ies_bufsize *= n_bands; + } + +- local->hw_scan_req = kmalloc( +- sizeof(*local->hw_scan_req) + +- req->n_channels * sizeof(req->channels[0]) + +- local->hw_scan_ies_bufsize, GFP_KERNEL); ++ local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req, ++ req.channels, ++ req->n_channels) + ++ local->hw_scan_ies_bufsize, ++ GFP_KERNEL); + if (!local->hw_scan_req) + return -ENOMEM; + + local->hw_scan_req->req.ssids = req->ssids; + local->hw_scan_req->req.n_ssids = req->n_ssids; ++ /* None of the channels are actually set ++ * up but let UBSAN know the boundaries. ++ */ ++ local->hw_scan_req->req.n_channels = req->n_channels; ++ + ies = (u8 *)local->hw_scan_req + + sizeof(*local->hw_scan_req) + + req->n_channels * sizeof(req->channels[0]); +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 354badd32793a..ef7b6d88ee00c 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2146,6 +2146,10 @@ u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata, + + void ieee80211_stop_device(struct ieee80211_local *local) + { ++ local_bh_disable(); ++ ieee80211_handle_queued_frames(local); ++ local_bh_enable(); ++ + ieee80211_led_radio(local, false); + ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO); + +diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c +index c829e4a753256..7cea95d0b78f9 100644 +--- a/net/mac802154/tx.c ++++ b/net/mac802154/tx.c +@@ -34,8 +34,8 @@ void ieee802154_xmit_worker(struct work_struct *work) + if (res) + goto err_tx; + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, skb->len); + + ieee802154_xmit_complete(&local->hw, skb, false); + +@@ -86,8 +86,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) + goto err_tx; + } + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, len); + } else { + local->tx_skb = skb; + queue_work(local->workqueue, &local->tx_work); +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 2898df10a72ae..a444eb84d621e 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -2782,10 +2782,14 @@ int cfg80211_wext_siwscan(struct net_device *dev, + wiphy = &rdev->wiphy; + + /* Determine number of channels, needed to allocate creq */ +- if (wreq && wreq->num_channels) ++ if (wreq && wreq->num_channels) { ++ /* Passed from userspace so should be checked */ ++ if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES)) ++ return -EINVAL; + n_channels = wreq->num_channels; +- else ++ } else { + n_channels = ieee80211_get_num_supported_channels(wiphy); ++ } + + creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + + n_channels * sizeof(void *), +diff --git a/samples/Kconfig b/samples/Kconfig +index b0503ef058d33..56539b21f2c73 100644 +--- a/samples/Kconfig ++++ b/samples/Kconfig +@@ -120,6 +120,15 @@ config SAMPLE_CONNECTOR + with it. + See also Documentation/driver-api/connector.rst + ++config SAMPLE_FANOTIFY_ERROR ++ bool "Build fanotify error monitoring sample" ++ depends on FANOTIFY && CC_CAN_LINK && HEADERS_INSTALL ++ help ++ When enabled, this builds an example code that uses the ++ FAN_FS_ERROR fanotify mechanism to monitor filesystem ++ errors. ++ See also Documentation/admin-guide/filesystem-monitoring.rst. ++ + config SAMPLE_HIDRAW + bool "hidraw sample" + depends on CC_CAN_LINK && HEADERS_INSTALL +diff --git a/samples/Makefile b/samples/Makefile +index 087e0988ccc56..931a81847c488 100644 +--- a/samples/Makefile ++++ b/samples/Makefile +@@ -5,6 +5,7 @@ subdir-$(CONFIG_SAMPLE_AUXDISPLAY) += auxdisplay + subdir-$(CONFIG_SAMPLE_ANDROID_BINDERFS) += binderfs + obj-$(CONFIG_SAMPLE_CONFIGFS) += configfs/ + obj-$(CONFIG_SAMPLE_CONNECTOR) += connector/ ++obj-$(CONFIG_SAMPLE_FANOTIFY_ERROR) += fanotify/ + subdir-$(CONFIG_SAMPLE_HIDRAW) += hidraw + obj-$(CONFIG_SAMPLE_HW_BREAKPOINT) += hw_breakpoint/ + obj-$(CONFIG_SAMPLE_KDB) += kdb/ +diff --git a/samples/fanotify/.gitignore b/samples/fanotify/.gitignore +new file mode 100644 +index 0000000000000..d74593e8b2dee +--- /dev/null ++++ b/samples/fanotify/.gitignore +@@ -0,0 +1 @@ ++fs-monitor +diff --git a/samples/fanotify/Makefile b/samples/fanotify/Makefile +new file mode 100644 +index 0000000000000..e20db1bdde3b4 +--- /dev/null ++++ b/samples/fanotify/Makefile +@@ -0,0 +1,5 @@ ++# SPDX-License-Identifier: GPL-2.0-only ++userprogs-always-y += fs-monitor ++ ++userccflags += -I usr/include -Wall ++ +diff --git a/samples/fanotify/fs-monitor.c b/samples/fanotify/fs-monitor.c +new file mode 100644 +index 0000000000000..a0e44cd31e6f3 +--- /dev/null ++++ b/samples/fanotify/fs-monitor.c +@@ -0,0 +1,142 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright 2021, Collabora Ltd. ++ */ ++ ++#define _GNU_SOURCE ++#include <errno.h> ++#include <err.h> ++#include <stdlib.h> ++#include <stdio.h> ++#include <fcntl.h> ++#include <sys/fanotify.h> ++#include <sys/types.h> ++#include <unistd.h> ++#include <sys/types.h> ++ ++#ifndef FAN_FS_ERROR ++#define FAN_FS_ERROR 0x00008000 ++#define FAN_EVENT_INFO_TYPE_ERROR 5 ++ ++struct fanotify_event_info_error { ++ struct fanotify_event_info_header hdr; ++ __s32 error; ++ __u32 error_count; ++}; ++#endif ++ ++#ifndef FILEID_INO32_GEN ++#define FILEID_INO32_GEN 1 ++#endif ++ ++#ifndef FILEID_INVALID ++#define FILEID_INVALID 0xff ++#endif ++ ++static void print_fh(struct file_handle *fh) ++{ ++ int i; ++ uint32_t *h = (uint32_t *) fh->f_handle; ++ ++ printf("\tfh: "); ++ for (i = 0; i < fh->handle_bytes; i++) ++ printf("%hhx", fh->f_handle[i]); ++ printf("\n"); ++ ++ printf("\tdecoded fh: "); ++ if (fh->handle_type == FILEID_INO32_GEN) ++ printf("inode=%u gen=%u\n", h[0], h[1]); ++ else if (fh->handle_type == FILEID_INVALID && !fh->handle_bytes) ++ printf("Type %d (Superblock error)\n", fh->handle_type); ++ else ++ printf("Type %d (Unknown)\n", fh->handle_type); ++ ++} ++ ++static void handle_notifications(char *buffer, int len) ++{ ++ struct fanotify_event_metadata *event = ++ (struct fanotify_event_metadata *) buffer; ++ struct fanotify_event_info_header *info; ++ struct fanotify_event_info_error *err; ++ struct fanotify_event_info_fid *fid; ++ int off; ++ ++ for (; FAN_EVENT_OK(event, len); event = FAN_EVENT_NEXT(event, len)) { ++ ++ if (event->mask != FAN_FS_ERROR) { ++ printf("unexpected FAN MARK: %llx\n", event->mask); ++ goto next_event; ++ } ++ ++ if (event->fd != FAN_NOFD) { ++ printf("Unexpected fd (!= FAN_NOFD)\n"); ++ goto next_event; ++ } ++ ++ printf("FAN_FS_ERROR (len=%d)\n", event->event_len); ++ ++ for (off = sizeof(*event) ; off < event->event_len; ++ off += info->len) { ++ info = (struct fanotify_event_info_header *) ++ ((char *) event + off); ++ ++ switch (info->info_type) { ++ case FAN_EVENT_INFO_TYPE_ERROR: ++ err = (struct fanotify_event_info_error *) info; ++ ++ printf("\tGeneric Error Record: len=%d\n", ++ err->hdr.len); ++ printf("\terror: %d\n", err->error); ++ printf("\terror_count: %d\n", err->error_count); ++ break; ++ ++ case FAN_EVENT_INFO_TYPE_FID: ++ fid = (struct fanotify_event_info_fid *) info; ++ ++ printf("\tfsid: %x%x\n", ++ fid->fsid.val[0], fid->fsid.val[1]); ++ print_fh((struct file_handle *) &fid->handle); ++ break; ++ ++ default: ++ printf("\tUnknown info type=%d len=%d:\n", ++ info->info_type, info->len); ++ } ++ } ++next_event: ++ printf("---\n\n"); ++ } ++} ++ ++int main(int argc, char **argv) ++{ ++ int fd; ++ ++ char buffer[BUFSIZ]; ++ ++ if (argc < 2) { ++ printf("Missing path argument\n"); ++ return 1; ++ } ++ ++ fd = fanotify_init(FAN_CLASS_NOTIF|FAN_REPORT_FID, O_RDONLY); ++ if (fd < 0) ++ errx(1, "fanotify_init"); ++ ++ if (fanotify_mark(fd, FAN_MARK_ADD|FAN_MARK_FILESYSTEM, ++ FAN_FS_ERROR, AT_FDCWD, argv[1])) { ++ errx(1, "fanotify_mark"); ++ } ++ ++ while (1) { ++ int n = read(fd, buffer, BUFSIZ); ++ ++ if (n < 0) ++ errx(1, "read"); ++ ++ handle_notifications(buffer, n); ++ } ++ ++ return 0; ++} +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 3f3c37bc14e80..cba1440993450 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -570,4 +570,8 @@ static inline void debug_gimple_stmt(const_gimple s) + #define SET_DECL_MODE(decl, mode) DECL_MODE(decl) = (mode) + #endif + ++#if BUILDING_GCC_VERSION >= 14000 ++#define last_stmt(x) last_nondebug_stmt(x) ++#endif ++ + #endif +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index 81ebf8108ca74..81dfdf4470f75 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -396,35 +396,6 @@ static struct expr *expr_eliminate_yn(struct expr *e) + return e; + } + +-/* +- * bool FOO!=n => FOO +- */ +-struct expr *expr_trans_bool(struct expr *e) +-{ +- if (!e) +- return NULL; +- switch (e->type) { +- case E_AND: +- case E_OR: +- case E_NOT: +- e->left.expr = expr_trans_bool(e->left.expr); +- e->right.expr = expr_trans_bool(e->right.expr); +- break; +- case E_UNEQUAL: +- // FOO!=n -> FOO +- if (e->left.sym->type == S_TRISTATE) { +- if (e->right.sym == &symbol_no) { +- e->type = E_SYMBOL; +- e->right.sym = NULL; +- } +- } +- break; +- default: +- ; +- } +- return e; +-} +- + /* + * e1 || e2 -> ? + */ +diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h +index 9c9caca5bd5f2..c91060e19e477 100644 +--- a/scripts/kconfig/expr.h ++++ b/scripts/kconfig/expr.h +@@ -296,7 +296,6 @@ void expr_free(struct expr *e); + void expr_eliminate_eq(struct expr **ep1, struct expr **ep2); + int expr_eq(struct expr *e1, struct expr *e2); + tristate expr_calc_value(struct expr *e); +-struct expr *expr_trans_bool(struct expr *e); + struct expr *expr_eliminate_dups(struct expr *e); + struct expr *expr_transform(struct expr *e); + int expr_contains_symbol(struct expr *dep, struct symbol *sym); +diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c +index 17adabfd6e6bf..5d1404178e482 100644 +--- a/scripts/kconfig/gconf.c ++++ b/scripts/kconfig/gconf.c +@@ -1481,7 +1481,6 @@ int main(int ac, char *av[]) + + conf_parse(name); + fixup_rootmenu(&rootmenu); +- conf_read(NULL); + + /* Load the interface and connect signals */ + init_main_window(glade_file); +@@ -1489,6 +1488,8 @@ int main(int ac, char *av[]) + init_left_tree(); + init_right_tree(); + ++ conf_read(NULL); ++ + switch (view_mode) { + case SINGLE_VIEW: + display_tree_part(); +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index 606ba8a63c24e..8c53d9478be1f 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -380,8 +380,6 @@ void menu_finalize(struct menu *parent) + dep = expr_transform(dep); + dep = expr_alloc_and(expr_copy(basedep), dep); + dep = expr_eliminate_dups(dep); +- if (menu->sym && menu->sym->type != S_TRISTATE) +- dep = expr_trans_bool(dep); + prop->visible.expr = dep; + + /* +diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c +index 0fe93b423c4ed..c57485f06a6b7 100644 +--- a/sound/core/pcm_dmaengine.c ++++ b/sound/core/pcm_dmaengine.c +@@ -344,6 +344,20 @@ int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + } + EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan); + ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream) ++{ ++ struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status != DMA_PAUSED) ++ dmaengine_synchronize(prtd->dma_chan); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_sync_stop); ++ + /** + * snd_dmaengine_pcm_close - Close a dmaengine based PCM substream + * @substream: PCM substream +@@ -351,6 +365,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + kfree(prtd); +@@ -369,6 +389,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close); + int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + dma_release_channel(prtd->dma_chan); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6e3772f2d6bcd..18fda6eb27900 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -577,10 +577,14 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: ++ case 0x10ec0257: + case 0x19e58326: + case 0x10ec0283: ++ case 0x10ec0285: + case 0x10ec0286: ++ case 0x10ec0287: + case 0x10ec0288: ++ case 0x10ec0295: + case 0x10ec0298: + alc_headset_mic_no_shutup(codec); + break; +@@ -9157,6 +9161,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f1, "HP ProBook 630 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), +@@ -9268,6 +9273,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), + SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), ++ SND_PCI_QUIRK(0x10ec, 0x119e, "Positivo SU C1400", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x10ec, 0x11bc, "VAIO VJFE-IL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x124c, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), +@@ -9280,6 +9286,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc1a4, "Samsung Galaxy Book Pro 360 (NT935QBD)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP), +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 434679afa7e1a..3d2a0e8cad9a5 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -607,6 +607,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 101 CESIUM"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_JD_NOT_INV | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 4aa48c74f21a0..fa1f91c34834f 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -323,6 +323,12 @@ static int dmaengine_copy_user(struct snd_soc_component *component, + return 0; + } + ++static int dmaengine_pcm_sync_stop(struct snd_soc_component *component, ++ struct snd_pcm_substream *substream) ++{ ++ return snd_dmaengine_pcm_sync_stop(substream); ++} ++ + static const struct snd_soc_component_driver dmaengine_pcm_component = { + .name = SND_DMAENGINE_PCM_DRV_NAME, + .probe_order = SND_SOC_COMP_ORDER_LATE, +@@ -332,6 +338,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component = { + .trigger = dmaengine_pcm_trigger, + .pointer = dmaengine_pcm_pointer, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const struct snd_soc_component_driver dmaengine_pcm_component_process = { +@@ -344,6 +351,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component_process = { + .pointer = dmaengine_pcm_pointer, + .copy_user = dmaengine_copy_user, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const char * const dmaengine_pcm_dma_channel_names[] = { +diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c +index 5b82329f44401..dbd30604816e5 100644 +--- a/sound/soc/ti/davinci-mcasp.c ++++ b/sound/soc/ti/davinci-mcasp.c +@@ -1472,10 +1472,11 @@ static int davinci_mcasp_hw_rule_min_periodsize( + { + struct snd_interval *period_size = hw_param_interval(params, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE); ++ u8 numevt = *((u8 *)rule->private); + struct snd_interval frames; + + snd_interval_any(&frames); +- frames.min = 64; ++ frames.min = numevt; + frames.integer = 1; + + return snd_interval_refine(period_size, &frames); +@@ -1490,6 +1491,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + u32 max_channels = 0; + int i, dir, ret; + int tdm_slots = mcasp->tdm_slots; ++ u8 *numevt; + + /* Do not allow more then one stream per direction */ + if (mcasp->substreams[substream->stream]) +@@ -1589,9 +1591,12 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + return ret; + } + ++ numevt = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? ++ &mcasp->txnumevt : ++ &mcasp->rxnumevt; + snd_pcm_hw_rule_add(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, +- davinci_mcasp_hw_rule_min_periodsize, NULL, ++ davinci_mcasp_hw_rule_min_periodsize, numevt, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, -1); + + return 0; +diff --git a/sound/soc/ti/omap-hdmi.c b/sound/soc/ti/omap-hdmi.c +index 3328c02f93c74..1dfe439d13417 100644 +--- a/sound/soc/ti/omap-hdmi.c ++++ b/sound/soc/ti/omap-hdmi.c +@@ -353,11 +353,7 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev) + if (!card) + return -ENOMEM; + +- card->name = devm_kasprintf(dev, GFP_KERNEL, +- "HDMI %s", dev_name(ad->dssdev)); +- if (!card->name) +- return -ENOMEM; +- ++ card->name = "HDMI"; + card->owner = THIS_MODULE; + card->dai_link = + devm_kzalloc(dev, sizeof(*(card->dai_link)), GFP_KERNEL); +diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c +index 97f2c857048e1..e0a7a9b1f6d69 100644 +--- a/tools/power/cpupower/utils/helpers/amd.c ++++ b/tools/power/cpupower/utils/helpers/amd.c +@@ -38,6 +38,16 @@ union core_pstate { + unsigned res1:31; + unsigned en:1; + } pstatedef; ++ /* since fam 1Ah: */ ++ struct { ++ unsigned fid:12; ++ unsigned res1:2; ++ unsigned vid:8; ++ unsigned iddval:8; ++ unsigned idddiv:2; ++ unsigned res2:31; ++ unsigned en:1; ++ } pstatedef2; + unsigned long long val; + }; + +@@ -45,6 +55,10 @@ static int get_did(union core_pstate pstate) + { + int t; + ++ /* Fam 1Ah onward do not use did */ ++ if (cpupower_cpu_info.family >= 0x1A) ++ return 0; ++ + if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF) + t = pstate.pstatedef.did; + else if (cpupower_cpu_info.family == 0x12) +@@ -58,12 +72,18 @@ static int get_did(union core_pstate pstate) + static int get_cof(union core_pstate pstate) + { + int t; +- int fid, did, cof; ++ int fid, did, cof = 0; + + did = get_did(pstate); + if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF) { +- fid = pstate.pstatedef.fid; +- cof = 200 * fid / did; ++ if (cpupower_cpu_info.family >= 0x1A) { ++ fid = pstate.pstatedef2.fid; ++ if (fid > 0x0f) ++ cof = (fid * 5); ++ } else { ++ fid = pstate.pstatedef.fid; ++ cof = 200 * fid / did; ++ } + } else { + t = 0x10; + fid = pstate.pstate.fid; +diff --git a/tools/testing/selftests/openat2/openat2_test.c b/tools/testing/selftests/openat2/openat2_test.c +index 7fb902099de45..f9d2b0ec77564 100644 +--- a/tools/testing/selftests/openat2/openat2_test.c ++++ b/tools/testing/selftests/openat2/openat2_test.c +@@ -5,6 +5,7 @@ + */ + + #define _GNU_SOURCE ++#define __SANE_USERSPACE_TYPES__ // Use ll64 + #include <fcntl.h> + #include <sched.h> + #include <sys/stat.h> +diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c +index 413f75620a35b..4ae417372e9eb 100644 +--- a/tools/testing/selftests/vDSO/parse_vdso.c ++++ b/tools/testing/selftests/vDSO/parse_vdso.c +@@ -55,14 +55,20 @@ static struct vdso_info + ELF(Verdef) *verdef; + } vdso_info; + +-/* Straight from the ELF specification. */ +-static unsigned long elf_hash(const unsigned char *name) ++/* ++ * Straight from the ELF specification...and then tweaked slightly, in order to ++ * avoid a few clang warnings. ++ */ ++static unsigned long elf_hash(const char *name) + { + unsigned long h = 0, g; +- while (*name) ++ const unsigned char *uch_name = (const unsigned char *)name; ++ ++ while (*uch_name) + { +- h = (h << 4) + *name++; +- if (g = h & 0xf0000000) ++ h = (h << 4) + *uch_name++; ++ g = h & 0xf0000000; ++ if (g) + h ^= g >> 24; + h &= ~g; + } +diff --git a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +index 8a44ff973ee17..27f6fdf119691 100644 +--- a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c ++++ b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +@@ -18,7 +18,7 @@ + + #include "parse_vdso.h" + +-/* We need a libc functions... */ ++/* We need some libc functions... */ + int strcmp(const char *a, const char *b) + { + /* This implementation is buggy: it never returns -1. */ +@@ -34,6 +34,20 @@ int strcmp(const char *a, const char *b) + return 0; + } + ++/* ++ * The clang build needs this, although gcc does not. ++ * Stolen from lib/string.c. ++ */ ++void *memcpy(void *dest, const void *src, size_t count) ++{ ++ char *tmp = dest; ++ const char *s = src; ++ ++ while (count--) ++ *tmp++ = *s++; ++ return dest; ++} ++ + /* ...and two syscalls. This is x86-specific. */ + static inline long x86_syscall3(long nr, long a0, long a1, long a2) + { +@@ -70,7 +84,7 @@ void to_base10(char *lastdig, time_t n) + } + } + +-__attribute__((externally_visible)) void c_main(void **stack) ++void c_main(void **stack) + { + /* Parse the stack */ + long argc = (long)*stack;
