commit: 045a2032f4973204d4e8618be515c9393aaebfcc Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Nov 8 17:46:00 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Nov 8 17:46:00 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=045a2032
Linux patch 5.10.229 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1228_linux-5.10.229.patch | 3364 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3368 insertions(+) diff --git a/0000_README b/0000_README index 451f50bd..3cfa7e81 100644 --- a/0000_README +++ b/0000_README @@ -955,6 +955,10 @@ Patch: 1227_linux-5.10.228.patch From: https://www.kernel.org Desc: Linux 5.10.228 +Patch: 1228_linux-5.10.229.patch +From: https://www.kernel.org +Desc: Linux 5.10.229 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1228_linux-5.10.229.patch b/1228_linux-5.10.229.patch new file mode 100644 index 00000000..7732d294 --- /dev/null +++ b/1228_linux-5.10.229.patch @@ -0,0 +1,3364 @@ +diff --git a/Makefile b/Makefile +index 7dbddd98e44173..ebeab12f249aff 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 228 ++SUBLEVEL = 229 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +index 3dfce4312dfc4e..a2ef43c2105aa1 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +@@ -77,7 +77,7 @@ &gpio { + }; + + &hdmi { +- hpd-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>; ++ hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>; + power-domains = <&power RPI_POWER_DOMAIN_HDMI>; + status = "okay"; + }; +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index 485b7dbd4f9e32..96dcddc358c78e 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -10,7 +10,7 @@ + # + # Copyright (C) 1995-2001 by Russell King + +-LDFLAGS_vmlinux :=--no-undefined -X ++LDFLAGS_vmlinux :=--no-undefined -X --pic-veneer + + ifeq ($(CONFIG_RELOCATABLE), y) + # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour +diff --git a/arch/arm64/include/asm/uprobes.h b/arch/arm64/include/asm/uprobes.h +index 315eef654e39a4..014b02897f8e22 100644 +--- a/arch/arm64/include/asm/uprobes.h ++++ b/arch/arm64/include/asm/uprobes.h +@@ -10,21 +10,19 @@ + #include <asm/insn.h> + #include <asm/probes.h> + +-#define MAX_UINSN_BYTES AARCH64_INSN_SIZE +- +-#define UPROBE_SWBP_INSN BRK64_OPCODE_UPROBES ++#define UPROBE_SWBP_INSN cpu_to_le32(BRK64_OPCODE_UPROBES) + #define UPROBE_SWBP_INSN_SIZE AARCH64_INSN_SIZE +-#define UPROBE_XOL_SLOT_BYTES MAX_UINSN_BYTES ++#define UPROBE_XOL_SLOT_BYTES AARCH64_INSN_SIZE + +-typedef u32 uprobe_opcode_t; ++typedef __le32 uprobe_opcode_t; + + struct arch_uprobe_task { + }; + + struct arch_uprobe { + union { +- u8 insn[MAX_UINSN_BYTES]; +- u8 ixol[MAX_UINSN_BYTES]; ++ __le32 insn; ++ __le32 ixol; + }; + struct arch_probe_insn api; + bool simulate; +diff --git a/arch/arm64/kernel/probes/uprobes.c b/arch/arm64/kernel/probes/uprobes.c +index 2c247634552b19..8a02c549e57fd3 100644 +--- a/arch/arm64/kernel/probes/uprobes.c ++++ b/arch/arm64/kernel/probes/uprobes.c +@@ -42,7 +42,7 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, + else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE)) + return -EINVAL; + +- insn = *(probe_opcode_t *)(&auprobe->insn[0]); ++ insn = le32_to_cpu(auprobe->insn); + + switch (arm_probe_decode_insn(insn, &auprobe->api)) { + case INSN_REJECTED: +@@ -108,7 +108,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs) + if (!auprobe->simulate) + return false; + +- insn = *(probe_opcode_t *)(&auprobe->insn[0]); ++ insn = le32_to_cpu(auprobe->insn); + addr = instruction_pointer(regs); + + if (auprobe->api.handler) +diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c +index 877ff65b4e1362..a3d4317309d4cb 100644 +--- a/arch/riscv/kernel/asm-offsets.c ++++ b/arch/riscv/kernel/asm-offsets.c +@@ -4,8 +4,6 @@ + * Copyright (C) 2017 SiFive + */ + +-#define GENERATING_ASM_OFFSETS +- + #include <linux/kbuild.h> + #include <linux/sched.h> + #include <asm/thread_info.h> +diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c +index df84e0c13db188..0e948e87bd8137 100644 +--- a/arch/riscv/kernel/cpu-hotplug.c ++++ b/arch/riscv/kernel/cpu-hotplug.c +@@ -69,7 +69,7 @@ void __cpu_die(unsigned int cpu) + if (cpu_ops[cpu]->cpu_is_stopped) + ret = cpu_ops[cpu]->cpu_is_stopped(cpu); + if (ret) +- pr_warn("CPU%d may not have stopped: %d\n", cpu, ret); ++ pr_warn("CPU%u may not have stopped: %d\n", cpu, ret); + } + + /* +diff --git a/arch/riscv/kernel/efi-header.S b/arch/riscv/kernel/efi-header.S +index 8e733aa48ba6cb..c306f3a6a800e2 100644 +--- a/arch/riscv/kernel/efi-header.S ++++ b/arch/riscv/kernel/efi-header.S +@@ -59,7 +59,7 @@ extra_header_fields: + .long efi_header_end - _start // SizeOfHeaders + .long 0 // CheckSum + .short IMAGE_SUBSYSTEM_EFI_APPLICATION // Subsystem +- .short 0 // DllCharacteristics ++ .short IMAGE_DLL_CHARACTERISTICS_NX_COMPAT // DllCharacteristics + .quad 0 // SizeOfStackReserve + .quad 0 // SizeOfStackCommit + .quad 0 // SizeOfHeapReserve +diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c +index b246c3dc699305..d548d6992d988b 100644 +--- a/arch/riscv/kernel/traps_misaligned.c ++++ b/arch/riscv/kernel/traps_misaligned.c +@@ -131,8 +131,6 @@ + #define REG_PTR(insn, pos, regs) \ + (ulong *)((ulong)(regs) + REG_OFFSET(insn, pos)) + +-#define GET_RM(insn) (((insn) >> 12) & 7) +- + #define GET_RS1(insn, regs) (*REG_PTR(insn, SH_RS1, regs)) + #define GET_RS2(insn, regs) (*REG_PTR(insn, SH_RS2, regs)) + #define GET_RS1S(insn, regs) (*REG_PTR(RVC_RS1S(insn), 0, regs)) +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index f4ac7ff56bceaf..53fe5e2ab32ed0 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -18,6 +18,7 @@ obj-vdso = $(patsubst %, %.o, $(vdso-syms)) note.o + + ccflags-y := -fno-stack-protector + ccflags-y += -DDISABLE_BRANCH_PROFILING ++ccflags-y += -fno-builtin + + ifneq ($(c-gettimeofday-y),) + CFLAGS_vgettimeofday.o += -fPIC -include $(c-gettimeofday-y) +diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h +index b9da71632827fb..ea340b90183985 100644 +--- a/arch/s390/include/asm/perf_event.h ++++ b/arch/s390/include/asm/perf_event.h +@@ -75,6 +75,7 @@ struct perf_sf_sde_regs { + #define SAMPLE_FREQ_MODE(hwc) (SAMPL_FLAGS(hwc) & PERF_CPUM_SF_FREQ_MODE) + + #define perf_arch_fetch_caller_regs(regs, __ip) do { \ ++ (regs)->psw.mask = 0; \ + (regs)->psw.addr = (__ip); \ + (regs)->gprs[15] = (unsigned long)__builtin_frame_address(0) - \ + offsetof(struct stack_frame, back_chain); \ +diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c +index b9f85b2dc053f5..5a880e2545243b 100644 +--- a/arch/s390/kvm/gaccess.c ++++ b/arch/s390/kvm/gaccess.c +@@ -794,46 +794,102 @@ static int low_address_protection_enabled(struct kvm_vcpu *vcpu, + return 1; + } + +-static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, +- unsigned long *pages, unsigned long nr_pages, +- const union asce asce, enum gacc_mode mode) ++/** ++ * guest_range_to_gpas() - Calculate guest physical addresses of page fragments ++ * covering a logical range ++ * @vcpu: virtual cpu ++ * @ga: guest address, start of range ++ * @ar: access register ++ * @gpas: output argument, may be NULL ++ * @len: length of range in bytes ++ * @asce: address-space-control element to use for translation ++ * @mode: access mode ++ * ++ * Translate a logical range to a series of guest absolute addresses, ++ * such that the concatenation of page fragments starting at each gpa make up ++ * the whole range. ++ * The translation is performed as if done by the cpu for the given @asce, @ar, ++ * @mode and state of the @vcpu. ++ * If the translation causes an exception, its program interruption code is ++ * returned and the &struct kvm_s390_pgm_info pgm member of @vcpu is modified ++ * such that a subsequent call to kvm_s390_inject_prog_vcpu() will inject ++ * a correct exception into the guest. ++ * The resulting gpas are stored into @gpas, unless it is NULL. ++ * ++ * Note: All fragments except the first one start at the beginning of a page. ++ * When deriving the boundaries of a fragment from a gpa, all but the last ++ * fragment end at the end of the page. ++ * ++ * Return: ++ * * 0 - success ++ * * <0 - translation could not be performed, for example if guest ++ * memory could not be accessed ++ * * >0 - an access exception occurred. In this case the returned value ++ * is the program interruption code and the contents of pgm may ++ * be used to inject an exception into the guest. ++ */ ++static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, ++ unsigned long *gpas, unsigned long len, ++ const union asce asce, enum gacc_mode mode) + { + psw_t *psw = &vcpu->arch.sie_block->gpsw; ++ unsigned int offset = offset_in_page(ga); ++ unsigned int fragment_len; + int lap_enabled, rc = 0; + enum prot_type prot; ++ unsigned long gpa; + + lap_enabled = low_address_protection_enabled(vcpu, asce); +- while (nr_pages) { ++ while (min(PAGE_SIZE - offset, len) > 0) { ++ fragment_len = min(PAGE_SIZE - offset, len); + ga = kvm_s390_logical_to_effective(vcpu, ga); + if (mode == GACC_STORE && lap_enabled && is_low_address(ga)) + return trans_exc(vcpu, PGM_PROTECTION, ga, ar, mode, + PROT_TYPE_LA); +- ga &= PAGE_MASK; + if (psw_bits(*psw).dat) { +- rc = guest_translate(vcpu, ga, pages, asce, mode, &prot); ++ rc = guest_translate(vcpu, ga, &gpa, asce, mode, &prot); + if (rc < 0) + return rc; + } else { +- *pages = kvm_s390_real_to_abs(vcpu, ga); +- if (kvm_is_error_gpa(vcpu->kvm, *pages)) ++ gpa = kvm_s390_real_to_abs(vcpu, ga); ++ if (kvm_is_error_gpa(vcpu->kvm, gpa)) + rc = PGM_ADDRESSING; + } + if (rc) + return trans_exc(vcpu, rc, ga, ar, mode, prot); +- ga += PAGE_SIZE; +- pages++; +- nr_pages--; ++ if (gpas) ++ *gpas++ = gpa; ++ offset = 0; ++ ga += fragment_len; ++ len -= fragment_len; + } + return 0; + } + ++static int access_guest_page(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa, ++ void *data, unsigned int len) ++{ ++ const unsigned int offset = offset_in_page(gpa); ++ const gfn_t gfn = gpa_to_gfn(gpa); ++ int rc; ++ ++ if (!gfn_to_memslot(kvm, gfn)) ++ return PGM_ADDRESSING; ++ if (mode == GACC_STORE) ++ rc = kvm_write_guest_page(kvm, gfn, data, offset, len); ++ else ++ rc = kvm_read_guest_page(kvm, gfn, data, offset, len); ++ return rc; ++} ++ + int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data, + unsigned long len, enum gacc_mode mode) + { + psw_t *psw = &vcpu->arch.sie_block->gpsw; +- unsigned long _len, nr_pages, gpa, idx; +- unsigned long pages_array[2]; +- unsigned long *pages; ++ unsigned long nr_pages, idx; ++ unsigned long gpa_array[2]; ++ unsigned int fragment_len; ++ unsigned long *gpas; + int need_ipte_lock; + union asce asce; + int rc; +@@ -845,50 +901,45 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data, + if (rc) + return rc; + nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1; +- pages = pages_array; +- if (nr_pages > ARRAY_SIZE(pages_array)) +- pages = vmalloc(array_size(nr_pages, sizeof(unsigned long))); +- if (!pages) ++ gpas = gpa_array; ++ if (nr_pages > ARRAY_SIZE(gpa_array)) ++ gpas = vmalloc(array_size(nr_pages, sizeof(unsigned long))); ++ if (!gpas) + return -ENOMEM; + need_ipte_lock = psw_bits(*psw).dat && !asce.r; + if (need_ipte_lock) + ipte_lock(vcpu); +- rc = guest_page_range(vcpu, ga, ar, pages, nr_pages, asce, mode); ++ rc = guest_range_to_gpas(vcpu, ga, ar, gpas, len, asce, mode); + for (idx = 0; idx < nr_pages && !rc; idx++) { +- gpa = *(pages + idx) + (ga & ~PAGE_MASK); +- _len = min(PAGE_SIZE - (gpa & ~PAGE_MASK), len); +- if (mode == GACC_STORE) +- rc = kvm_write_guest(vcpu->kvm, gpa, data, _len); +- else +- rc = kvm_read_guest(vcpu->kvm, gpa, data, _len); +- len -= _len; +- ga += _len; +- data += _len; ++ fragment_len = min(PAGE_SIZE - offset_in_page(gpas[idx]), len); ++ rc = access_guest_page(vcpu->kvm, mode, gpas[idx], data, fragment_len); ++ len -= fragment_len; ++ data += fragment_len; + } + if (need_ipte_lock) + ipte_unlock(vcpu); +- if (nr_pages > ARRAY_SIZE(pages_array)) +- vfree(pages); ++ if (nr_pages > ARRAY_SIZE(gpa_array)) ++ vfree(gpas); + return rc; + } + + int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, + void *data, unsigned long len, enum gacc_mode mode) + { +- unsigned long _len, gpa; ++ unsigned int fragment_len; ++ unsigned long gpa; + int rc = 0; + + while (len && !rc) { + gpa = kvm_s390_real_to_abs(vcpu, gra); +- _len = min(PAGE_SIZE - (gpa & ~PAGE_MASK), len); +- if (mode) +- rc = write_guest_abs(vcpu, gpa, data, _len); +- else +- rc = read_guest_abs(vcpu, gpa, data, _len); +- len -= _len; +- gra += _len; +- data += _len; ++ fragment_len = min(PAGE_SIZE - offset_in_page(gpa), len); ++ rc = access_guest_page(vcpu->kvm, mode, gpa, data, fragment_len); ++ len -= fragment_len; ++ gra += fragment_len; ++ data += fragment_len; + } ++ if (rc > 0) ++ vcpu->arch.pgm.code = rc; + return rc; + } + +@@ -904,8 +955,6 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, + int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, + unsigned long *gpa, enum gacc_mode mode) + { +- psw_t *psw = &vcpu->arch.sie_block->gpsw; +- enum prot_type prot; + union asce asce; + int rc; + +@@ -913,23 +962,7 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, + rc = get_vcpu_asce(vcpu, &asce, gva, ar, mode); + if (rc) + return rc; +- if (is_low_address(gva) && low_address_protection_enabled(vcpu, asce)) { +- if (mode == GACC_STORE) +- return trans_exc(vcpu, PGM_PROTECTION, gva, 0, +- mode, PROT_TYPE_LA); +- } +- +- if (psw_bits(*psw).dat && !asce.r) { /* Use DAT? */ +- rc = guest_translate(vcpu, gva, gpa, asce, mode, &prot); +- if (rc > 0) +- return trans_exc(vcpu, rc, gva, 0, mode, prot); +- } else { +- *gpa = kvm_s390_real_to_abs(vcpu, gva); +- if (kvm_is_error_gpa(vcpu->kvm, *gpa)) +- return trans_exc(vcpu, rc, gva, PGM_ADDRESSING, mode, 0); +- } +- +- return rc; ++ return guest_range_to_gpas(vcpu, gva, ar, gpa, 1, asce, mode); + } + + /** +@@ -938,17 +971,14 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, + int check_gva_range(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, + unsigned long length, enum gacc_mode mode) + { +- unsigned long gpa; +- unsigned long currlen; ++ union asce asce; + int rc = 0; + ++ rc = get_vcpu_asce(vcpu, &asce, gva, ar, mode); ++ if (rc) ++ return rc; + ipte_lock(vcpu); +- while (length > 0 && !rc) { +- currlen = min(length, PAGE_SIZE - (gva % PAGE_SIZE)); +- rc = guest_translate_address(vcpu, gva, ar, &gpa, mode); +- gva += currlen; +- length -= currlen; +- } ++ rc = guest_range_to_gpas(vcpu, gva, ar, NULL, length, asce, mode); + ipte_unlock(vcpu); + + return rc; +diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h +index 7c72a5e3449f86..8ed2d6c7404ffe 100644 +--- a/arch/s390/kvm/gaccess.h ++++ b/arch/s390/kvm/gaccess.h +@@ -344,11 +344,12 @@ int read_guest_abs(struct kvm_vcpu *vcpu, unsigned long gpa, void *data, + * @len: number of bytes to copy + * + * Copy @len bytes from @data (kernel space) to @gra (guest real address). +- * It is up to the caller to ensure that the entire guest memory range is +- * valid memory before calling this function. + * Guest low address and key protection are not checked. + * +- * Returns zero on success or -EFAULT on error. ++ * Returns zero on success, -EFAULT when copying from @data failed, or ++ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info ++ * is also stored to allow injecting into the guest (if applicable) using ++ * kvm_s390_inject_prog_cond(). + * + * If an error occurs data may have been copied partially to guest memory. + */ +@@ -367,11 +368,12 @@ int write_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, void *data, + * @len: number of bytes to copy + * + * Copy @len bytes from @gra (guest real address) to @data (kernel space). +- * It is up to the caller to ensure that the entire guest memory range is +- * valid memory before calling this function. + * Guest key protection is not checked. + * +- * Returns zero on success or -EFAULT on error. ++ * Returns zero on success, -EFAULT when copying to @data failed, or ++ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info ++ * is also stored to allow injecting into the guest (if applicable) using ++ * kvm_s390_inject_prog_cond(). + * + * If an error occurs data may have been copied partially to kernel space. + */ +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 87e1ff06402599..7978d5fe1ce6e4 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -199,7 +199,16 @@ + */ + .macro CLEAR_CPU_BUFFERS + ALTERNATIVE "jmp .Lskip_verw_\@", "", X86_FEATURE_CLEAR_CPU_BUF +- verw _ASM_RIP(mds_verw_sel) ++#ifdef CONFIG_X86_64 ++ verw mds_verw_sel(%rip) ++#else ++ /* ++ * In 32bit mode, the memory operand must be a %cs reference. The data ++ * segments may not be usable (vm86 mode), and the stack segment may not ++ * be flat (ESPFIX32). ++ */ ++ verw %cs:mds_verw_sel ++#endif + .Lskip_verw_\@: + .endm + +diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c +index e7feaa7910ab36..3e59df2ebc975c 100644 +--- a/arch/x86/kvm/svm/nested.c ++++ b/arch/x86/kvm/svm/nested.c +@@ -75,8 +75,12 @@ static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index) + u64 pdpte; + int ret; + ++ /* ++ * Note, nCR3 is "assumed" to be 32-byte aligned, i.e. the CPU ignores ++ * nCR3[4:0] when loading PDPTEs from memory. ++ */ + ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte, +- offset_in_page(cr3) + index * 8, 8); ++ (cr3 & GENMASK(11, 5)) + index * 8, 8); + if (ret) + return 0; + return pdpte; +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 515e3c1a547590..c1600e3ac33391 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2774,10 +2774,12 @@ void bfq_release_process_ref(struct bfq_data *bfqd, struct bfq_queue *bfqq) + bfq_put_queue(bfqq); + } + +-static void +-bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic, +- struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) ++static struct bfq_queue *bfq_merge_bfqqs(struct bfq_data *bfqd, ++ struct bfq_io_cq *bic, ++ struct bfq_queue *bfqq) + { ++ struct bfq_queue *new_bfqq = bfqq->new_bfqq; ++ + bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu", + (unsigned long)new_bfqq->pid); + /* Save weight raising and idle window of the merged queues */ +@@ -2845,6 +2847,8 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic, + new_bfqq->pid = -1; + bfqq->bic = NULL; + bfq_release_process_ref(bfqd, bfqq); ++ ++ return new_bfqq; + } + + static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq, +@@ -2880,14 +2884,8 @@ static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq, + * fulfilled, i.e., bic can be redirected to new_bfqq + * and bfqq can be put. + */ +- bfq_merge_bfqqs(bfqd, bfqd->bio_bic, bfqq, +- new_bfqq); +- /* +- * If we get here, bio will be queued into new_queue, +- * so use new_bfqq to decide whether bio and rq can be +- * merged. +- */ +- bfqq = new_bfqq; ++ while (bfqq != new_bfqq) ++ bfqq = bfq_merge_bfqqs(bfqd, bfqd->bio_bic, bfqq); + + /* + * Change also bqfd->bio_bfqq, as +@@ -5444,6 +5442,7 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq) + bool waiting, idle_timer_disabled = false; + + if (new_bfqq) { ++ struct bfq_queue *old_bfqq = bfqq; + /* + * Release the request's reference to the old bfqq + * and make sure one is taken to the shared queue. +@@ -5459,18 +5458,18 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq) + * then complete the merge and redirect it to + * new_bfqq. + */ +- if (bic_to_bfqq(RQ_BIC(rq), 1) == bfqq) +- bfq_merge_bfqqs(bfqd, RQ_BIC(rq), +- bfqq, new_bfqq); ++ if (bic_to_bfqq(RQ_BIC(rq), 1) == bfqq) { ++ while (bfqq != new_bfqq) ++ bfqq = bfq_merge_bfqqs(bfqd, RQ_BIC(rq), bfqq); ++ } + +- bfq_clear_bfqq_just_created(bfqq); ++ bfq_clear_bfqq_just_created(old_bfqq); + /* + * rq is about to be enqueued into new_bfqq, + * release rq reference on bfqq + */ +- bfq_put_queue(bfqq); ++ bfq_put_queue(old_bfqq); + rq->elv.priv[1] = new_bfqq; +- bfqq = new_bfqq; + } + + bfq_update_io_thinktime(bfqd, bfqq); +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index 4861aad1a9e935..4b90dd928398c1 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -124,6 +124,17 @@ static const struct dmi_system_id dmi_lid_quirks[] = { + }, + .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, + }, ++ { ++ /* ++ * Samsung galaxybook2 ,initial _LID device notification returns ++ * lid closed. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "750XED"), ++ }, ++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, ++ }, + {} + }; + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 520acfcbf9dbc0..01e91a7451b0c4 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -507,6 +507,13 @@ static const struct dmi_system_id asus_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), + }, + }, ++ { ++ /* LG Electronics 16T90SP */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), ++ DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index b81fd39226ca74..b13a60de5a863a 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -25,7 +25,6 @@ + #include <linux/mutex.h> + #include <linux/pm_runtime.h> + #include <linux/netdevice.h> +-#include <linux/rcupdate.h> + #include <linux/sched/signal.h> + #include <linux/sched/mm.h> + #include <linux/sysfs.h> +@@ -1910,7 +1909,6 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj, + struct kobj_uevent_env *env) + { + struct device *dev = kobj_to_dev(kobj); +- struct device_driver *driver; + int retval = 0; + + /* add device node properties if present */ +@@ -1939,12 +1937,8 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj, + if (dev->type && dev->type->name) + add_uevent_var(env, "DEVTYPE=%s", dev->type->name); + +- /* Synchronize with module_remove_driver() */ +- rcu_read_lock(); +- driver = READ_ONCE(dev->driver); +- if (driver) +- add_uevent_var(env, "DRIVER=%s", driver->name); +- rcu_read_unlock(); ++ if (dev->driver) ++ add_uevent_var(env, "DRIVER=%s", dev->driver->name); + + /* Add common DT information about the device */ + of_device_uevent(dev, env); +@@ -2014,8 +2008,11 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, + if (!env) + return -ENOMEM; + ++ /* Synchronize with really_probe() */ ++ device_lock(dev); + /* let the kset specific function add its keys */ + retval = kset->uevent_ops->uevent(kset, &dev->kobj, env); ++ device_unlock(dev); + if (retval) + goto out; + +diff --git a/drivers/base/module.c b/drivers/base/module.c +index 851cc5367c04c0..46ad4d636731dd 100644 +--- a/drivers/base/module.c ++++ b/drivers/base/module.c +@@ -7,7 +7,6 @@ + #include <linux/errno.h> + #include <linux/slab.h> + #include <linux/string.h> +-#include <linux/rcupdate.h> + #include "base.h" + + static char *make_driver_name(struct device_driver *drv) +@@ -78,9 +77,6 @@ void module_remove_driver(struct device_driver *drv) + if (!drv) + return; + +- /* Synchronize with dev_uevent() */ +- synchronize_rcu(); +- + sysfs_remove_link(&drv->p->kobj, "module"); + + if (drv->owner) +diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c +index 68e55ca7491e52..b160851c524cf5 100644 +--- a/drivers/firmware/arm_sdei.c ++++ b/drivers/firmware/arm_sdei.c +@@ -764,7 +764,7 @@ static int sdei_device_freeze(struct device *dev) + int err; + + /* unregister private events */ +- cpuhp_remove_state(sdei_entry_point); ++ cpuhp_remove_state(sdei_hp_state); + + err = sdei_unregister_shared(); + if (err) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 165b02e267b0ce..77886e79d75db1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -87,6 +87,7 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, + struct acpi_buffer *params) + { + acpi_status status; ++ union acpi_object *obj; + union acpi_object atif_arg_elements[2]; + struct acpi_object_list atif_arg; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; +@@ -109,16 +110,24 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, + + status = acpi_evaluate_object(atif->handle, NULL, &atif_arg, + &buffer); ++ obj = (union acpi_object *)buffer.pointer; + +- /* Fail only if calling the method fails and ATIF is supported */ ++ /* Fail if calling the method fails and ATIF is supported */ + if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { + DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n", + acpi_format_exception(status)); +- kfree(buffer.pointer); ++ kfree(obj); + return NULL; + } + +- return buffer.pointer; ++ if (obj->type != ACPI_TYPE_BUFFER) { ++ DRM_DEBUG_DRIVER("bad object returned from ATIF: %d\n", ++ obj->type); ++ kfree(obj); ++ return NULL; ++ } ++ ++ return obj; + } + + /** +diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c +index e8f07305e279a6..37f347f39c885b 100644 +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -17,6 +17,8 @@ + #include <drm/drm_prime.h> + #include <drm/drm_print.h> + ++#include "../../../mm/internal.h" /* is_cow_mapping() */ ++ + /** + * DOC: overview + * +@@ -630,6 +632,9 @@ int drm_gem_shmem_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) + return ret; + } + ++ if (is_cow_mapping(vma->vm_flags)) ++ return -EINVAL; ++ + shmem = to_drm_gem_shmem_obj(obj); + + ret = drm_gem_shmem_get_pages(shmem); +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 1e9842aac4dc9a..107a98484f5035 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -221,7 +221,7 @@ mipi_dsi_device_register_full(struct mipi_dsi_host *host, + return dsi; + } + +- device_set_node(&dsi->dev, of_fwnode_handle(info->node)); ++ dsi->dev.of_node = info->node; + dsi->channel = info->channel; + strlcpy(dsi->name, info->type, sizeof(dsi->name)); + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index fb7792ca39e2c6..b69099b533bfe2 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -685,7 +685,7 @@ static u32 dsi_get_pclk_rate(struct msm_dsi_host *msm_host, bool is_dual_dsi) + struct drm_display_mode *mode = msm_host->mode; + u32 pclk_rate; + +- pclk_rate = mode->clock * 1000; ++ pclk_rate = mode->clock * 1000u; + + /* + * For dual DSI mode, the current DRM mode has the complete width of the +diff --git a/drivers/gpu/drm/vboxvideo/hgsmi_base.c b/drivers/gpu/drm/vboxvideo/hgsmi_base.c +index 361d3193258eaf..7edc9cf6a6069d 100644 +--- a/drivers/gpu/drm/vboxvideo/hgsmi_base.c ++++ b/drivers/gpu/drm/vboxvideo/hgsmi_base.c +@@ -135,7 +135,15 @@ int hgsmi_update_pointer_shape(struct gen_pool *ctx, u32 flags, + flags |= VBOX_MOUSE_POINTER_VISIBLE; + } + +- p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len, HGSMI_CH_VBVA, ++ /* ++ * The 4 extra bytes come from switching struct vbva_mouse_pointer_shape ++ * from having a 4 bytes fixed array at the end to using a proper VLA ++ * at the end. These 4 extra bytes were not subtracted from sizeof(*p) ++ * before the switch to the VLA, so this way the behavior is unchanged. ++ * Chances are these 4 extra bytes are not necessary but they are kept ++ * to avoid regressions. ++ */ ++ p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len + 4, HGSMI_CH_VBVA, + VBVA_MOUSE_POINTER_SHAPE); + if (!p) + return -ENOMEM; +diff --git a/drivers/gpu/drm/vboxvideo/vboxvideo.h b/drivers/gpu/drm/vboxvideo/vboxvideo.h +index a5de40fe1a76a3..bed285fe083c87 100644 +--- a/drivers/gpu/drm/vboxvideo/vboxvideo.h ++++ b/drivers/gpu/drm/vboxvideo/vboxvideo.h +@@ -351,10 +351,8 @@ struct vbva_mouse_pointer_shape { + * Bytes in the gap between the AND and the XOR mask are undefined. + * XOR mask scanlines have no gap between them and size of XOR mask is: + * xor_len = width * 4 * height. +- * +- * Preallocate 4 bytes for accessing actual data as p->data. + */ +- u8 data[4]; ++ u8 data[]; + } __packed; + + /* pointer is visible */ +diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c +index f859cdb3094c72..686b2520d6b032 100644 +--- a/drivers/iio/light/veml6030.c ++++ b/drivers/iio/light/veml6030.c +@@ -522,7 +522,7 @@ static int veml6030_read_raw(struct iio_dev *indio_dev, + } + if (mask == IIO_CHAN_INFO_PROCESSED) { + *val = (reg * data->cur_resolution) / 10000; +- *val2 = (reg * data->cur_resolution) % 10000; ++ *val2 = (reg * data->cur_resolution) % 10000 * 100; + return IIO_VAL_INT_PLUS_MICRO; + } + *val = reg; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index d44b6a5c90b579..5f79371a1386f4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1476,9 +1476,11 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, + u32 tbl_indx; + int rc; + ++ spin_lock_bh(&rcfw->tbl_lock); + tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw); + rcfw->qp_tbl[tbl_indx].qp_id = BNXT_QPLIB_QP_ID_INVALID; + rcfw->qp_tbl[tbl_indx].qp_handle = NULL; ++ spin_unlock_bh(&rcfw->tbl_lock); + + RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags); + +@@ -1486,8 +1488,10 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, + rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, + (void *)&resp, NULL, 0); + if (rc) { ++ spin_lock_bh(&rcfw->tbl_lock); + rcfw->qp_tbl[tbl_indx].qp_id = qp->id; + rcfw->qp_tbl[tbl_indx].qp_handle = qp; ++ spin_unlock_bh(&rcfw->tbl_lock); + return rc; + } + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index f112f013df7d97..01cb48caa9dbd8 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -167,7 +167,7 @@ struct bnxt_qplib_swqe { + }; + u32 q_key; + u32 dst_qp; +- u16 avid; ++ u32 avid; + } send; + + /* Send Raw Ethernet and QP1 */ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 2b0c3a86293cf2..0d61a1563f480b 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -245,7 +245,7 @@ int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw, + /* failed with status */ + dev_err(&rcfw->pdev->dev, "cmdq[%#x]=%#x status %#x\n", + cookie, opcode, evnt->status); +- rc = -EFAULT; ++ rc = -EIO; + } + + return rc; +@@ -316,17 +316,21 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, + case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION: + err_event = (struct creq_qp_error_notification *)qp_event; + qp_id = le32_to_cpu(err_event->xid); ++ spin_lock(&rcfw->tbl_lock); + tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw); + qp = rcfw->qp_tbl[tbl_indx].qp_handle; ++ if (!qp) { ++ spin_unlock(&rcfw->tbl_lock); ++ break; ++ } ++ bnxt_qplib_mark_qp_error(qp); ++ rc = rcfw->creq.aeq_handler(rcfw, qp_event, qp); ++ spin_unlock(&rcfw->tbl_lock); + dev_dbg(&pdev->dev, "Received QP error notification\n"); + dev_dbg(&pdev->dev, + "qpid 0x%x, req_err=0x%x, resp_err=0x%x\n", + qp_id, err_event->req_err_state_reason, + err_event->res_err_state_reason); +- if (!qp) +- break; +- bnxt_qplib_mark_qp_error(qp); +- rc = rcfw->creq.aeq_handler(rcfw, qp_event, qp); + break; + default: + /* +@@ -627,6 +631,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res, + GFP_KERNEL); + if (!rcfw->qp_tbl) + goto fail; ++ spin_lock_init(&rcfw->tbl_lock); + + return 0; + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 7df7170c80e062..69aa1a52c7f8da 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -184,6 +184,8 @@ struct bnxt_qplib_rcfw { + struct bnxt_qplib_crsqe *crsqe_tbl; + int qp_tbl_size; + struct bnxt_qplib_qp_node *qp_tbl; ++ /* To synchronize the qp-handle hash table */ ++ spinlock_t tbl_lock; + u64 oos_prev; + u32 init_oos_stats; + u32 cmdq_depth; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c +index 123ea759f2826e..af23e57fc78ed0 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -243,6 +243,8 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, + sginfo.pgsize = npde * pg_size; + sginfo.npages = 1; + rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_0], &sginfo); ++ if (rc) ++ goto fail; + + /* Alloc PBL pages */ + sginfo.npages = npbl; +@@ -254,22 +256,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, + dst_virt_ptr = + (dma_addr_t **)hwq->pbl[PBL_LVL_0].pg_arr; + src_phys_ptr = hwq->pbl[PBL_LVL_1].pg_map_arr; +- if (hwq_attr->type == HWQ_TYPE_MR) { +- /* For MR it is expected that we supply only 1 contigous +- * page i.e only 1 entry in the PDL that will contain +- * all the PBLs for the user supplied memory region +- */ +- for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; +- i++) +- dst_virt_ptr[0][i] = src_phys_ptr[i] | +- flag; +- } else { +- for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; +- i++) +- dst_virt_ptr[PTR_PG(i)][PTR_IDX(i)] = +- src_phys_ptr[i] | +- PTU_PDE_VALID; +- } ++ for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; i++) ++ dst_virt_ptr[0][i] = src_phys_ptr[i] | flag; ++ + /* Alloc or init PTEs */ + rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_2], + hwq_attr->sginfo); +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 95300b2e1ffe94..b607c17827382e 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2086,7 +2086,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, + err = -ENOMEM; + if (n->dev->flags & IFF_LOOPBACK) { + if (iptype == 4) +- pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip); ++ pdev = __ip_dev_find(&init_net, *(__be32 *)peer_ip, false); + else if (IS_ENABLED(CONFIG_IPV6)) + for_each_netdev(&init_net, pdev) { + if (ipv6_chk_addr(&init_net, +@@ -2101,12 +2101,12 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, + err = -ENODEV; + goto out; + } ++ if (is_vlan_dev(pdev)) ++ pdev = vlan_dev_real_dev(pdev); + ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t, + n, pdev, rt_tos2priority(tos)); +- if (!ep->l2t) { +- dev_put(pdev); ++ if (!ep->l2t) + goto out; +- } + ep->mtu = pdev->mtu; + ep->tx_chan = cxgb4_port_chan(pdev); + ep->smac_idx = ((struct port_info *)netdev_priv(pdev))->smt_idx; +@@ -2119,7 +2119,6 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, + ep->rss_qid = cdev->rdev.lldi.rxq_ids[ + cxgb4_port_idx(pdev) * step]; + set_tcp_window(ep, (struct port_info *)netdev_priv(pdev)); +- dev_put(pdev); + } else { + pdev = get_real_dev(n->dev); + ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t, +diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c +index 8138c57a1e43bc..2824511e20ade7 100644 +--- a/drivers/infiniband/hw/cxgb4/provider.c ++++ b/drivers/infiniband/hw/cxgb4/provider.c +@@ -472,6 +472,7 @@ static const struct ib_device_ops c4iw_dev_ops = { + .fill_res_cq_entry = c4iw_fill_res_cq_entry, + .fill_res_cm_id_entry = c4iw_fill_res_cm_id_entry, + .fill_res_mr_entry = c4iw_fill_res_mr_entry, ++ .fill_res_qp_entry = c4iw_fill_res_qp_entry, + .get_dev_fw_str = get_dev_fw_str, + .get_dma_mr = c4iw_get_dma_mr, + .get_hw_stats = c4iw_get_mib, +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index e3cc856e70e5d8..e0db91d1e7492c 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3940,14 +3940,14 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp, + MLX5_SET(qpc, qpc, retry_count, attr->retry_cnt); + + if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC && attr->max_rd_atomic) +- MLX5_SET(qpc, qpc, log_sra_max, ilog2(attr->max_rd_atomic)); ++ MLX5_SET(qpc, qpc, log_sra_max, fls(attr->max_rd_atomic - 1)); + + if (attr_mask & IB_QP_SQ_PSN) + MLX5_SET(qpc, qpc, next_send_psn, attr->sq_psn); + + if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC && attr->max_dest_rd_atomic) + MLX5_SET(qpc, qpc, log_rra_max, +- ilog2(attr->max_dest_rd_atomic)); ++ fls(attr->max_dest_rd_atomic - 1)); + + if (attr_mask & (IB_QP_ACCESS_FLAGS | IB_QP_MAX_DEST_RD_ATOMIC)) { + err = set_qpc_atomic_flags(qp, attr, attr_mask, qpc); +diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c +index 0ea923fe6371b6..e2bdba4742930c 100644 +--- a/drivers/misc/sgi-gru/grukservices.c ++++ b/drivers/misc/sgi-gru/grukservices.c +@@ -258,7 +258,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr) + int lcpu; + + BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES); +- preempt_disable(); + bs = gru_lock_kernel_context(-1); + lcpu = uv_blade_processor_id(); + *cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE; +@@ -272,7 +271,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr) + static void gru_free_cpu_resources(void *cb, void *dsr) + { + gru_unlock_kernel_context(uv_numa_blade_id()); +- preempt_enable(); + } + + /* +diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c +index e2325e3d077ea9..4f7a0f84725561 100644 +--- a/drivers/misc/sgi-gru/grumain.c ++++ b/drivers/misc/sgi-gru/grumain.c +@@ -941,10 +941,8 @@ vm_fault_t gru_fault(struct vm_fault *vmf) + + again: + mutex_lock(>s->ts_ctxlock); +- preempt_disable(); + + if (gru_check_context_placement(gts)) { +- preempt_enable(); + mutex_unlock(>s->ts_ctxlock); + gru_unload_context(gts, 1); + return VM_FAULT_NOPAGE; +@@ -953,7 +951,6 @@ vm_fault_t gru_fault(struct vm_fault *vmf) + if (!gts->ts_gru) { + STAT(load_user_context); + if (!gru_assign_gru_context(gts)) { +- preempt_enable(); + mutex_unlock(>s->ts_ctxlock); + set_current_state(TASK_INTERRUPTIBLE); + schedule_timeout(GRU_ASSIGN_DELAY); /* true hack ZZZ */ +@@ -969,7 +966,6 @@ vm_fault_t gru_fault(struct vm_fault *vmf) + vma->vm_page_prot); + } + +- preempt_enable(); + mutex_unlock(>s->ts_ctxlock); + + return VM_FAULT_NOPAGE; +diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c +index 10921cd2608dfa..1107dd3e2e9fa4 100644 +--- a/drivers/misc/sgi-gru/grutlbpurge.c ++++ b/drivers/misc/sgi-gru/grutlbpurge.c +@@ -65,7 +65,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_state + struct gru_tlb_global_handle *tgh; + int n; + +- preempt_disable(); + if (uv_numa_blade_id() == gru->gs_blade_id) + n = get_on_blade_tgh(gru); + else +@@ -79,7 +78,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_state + static void get_unlock_tgh_handle(struct gru_tlb_global_handle *tgh) + { + unlock_tgh_handle(tgh); +- preempt_enable(); + } + + /* +diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c +index 0d56cb4f5dd9ba..c84b9acc319f7e 100644 +--- a/drivers/net/ethernet/aeroflex/greth.c ++++ b/drivers/net/ethernet/aeroflex/greth.c +@@ -484,7 +484,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) + + if (unlikely(skb->len > MAX_FRAME_SIZE)) { + dev->stats.tx_errors++; +- goto out; ++ goto len_error; + } + + /* Save skb pointer. */ +@@ -575,6 +575,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) + map_error: + if (net_ratelimit()) + dev_warn(greth->dev, "Could not create TX DMA mapping\n"); ++len_error: + dev_kfree_skb(skb); + out: + return err; +diff --git a/drivers/net/ethernet/amd/mvme147.c b/drivers/net/ethernet/amd/mvme147.c +index 3f2e4cdd0b83e3..133fe0f1166b0d 100644 +--- a/drivers/net/ethernet/amd/mvme147.c ++++ b/drivers/net/ethernet/amd/mvme147.c +@@ -106,10 +106,6 @@ struct net_device * __init mvme147lance_probe(int unit) + address = address >> 8; + dev->dev_addr[3] = address&0xff; + +- printk("%s: MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n", +- dev->name, dev->base_addr, MVME147_LANCE_IRQ, +- dev->dev_addr); +- + lp = netdev_priv(dev); + lp->ram = __get_dma_pages(GFP_ATOMIC, 3); /* 32K */ + if (!lp->ram) { +@@ -139,6 +135,9 @@ struct net_device * __init mvme147lance_probe(int unit) + return ERR_PTR(err); + } + ++ netdev_info(dev, "MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n", ++ dev->base_addr, MVME147_LANCE_IRQ, dev->dev_addr); ++ + return dev; + } + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 82d369d9f7a507..ae1cf2ead9a968 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -1343,6 +1343,7 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, + netif_err(priv, tx_err, dev, "DMA map failed at %p (len=%d)\n", + skb->data, skb_len); + ret = NETDEV_TX_OK; ++ dev_kfree_skb_any(skb); + goto out; + } + +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index edd4dd73b3e32a..f018379d13509c 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1382,10 +1382,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + be_get_wrb_params_from_skb(adapter, skb, &wrb_params); + + wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); +- if (unlikely(!wrb_cnt)) { +- dev_kfree_skb_any(skb); +- goto drop; +- } ++ if (unlikely(!wrb_cnt)) ++ goto drop_skb; + + /* if os2bmc is enabled and if the pkt is destined to bmc, + * enqueue the pkt a 2nd time with mgmt bit set. +@@ -1394,7 +1392,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); + wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); + if (unlikely(!wrb_cnt)) +- goto drop; ++ goto drop_skb; + else + skb_get(skb); + } +@@ -1408,6 +1406,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + be_xmit_flush(adapter, txo); + + return NETDEV_TX_OK; ++drop_skb: ++ dev_kfree_skb_any(skb); + drop: + tx_stats(txo)->tx_drv_drops++; + /* Flush the already enqueued tx requests */ +diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c +index 83a6114afbf90b..3278e2126dc298 100644 +--- a/drivers/net/ethernet/i825xx/sun3_82586.c ++++ b/drivers/net/ethernet/i825xx/sun3_82586.c +@@ -1015,6 +1015,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev) + if(skb->len > XMIT_BUFF_SIZE) + { + printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len); ++ dev_kfree_skb(skb); + return NETDEV_TX_OK; + } + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index e9296d63450d85..3aa1dda3406cd8 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4650,7 +4650,9 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance) + if ((status & 0xffff) == 0xffff || !(status & tp->irq_mask)) + return IRQ_NONE; + +- if (unlikely(status & SYSErr)) { ++ /* At least RTL8168fp may unexpectedly set the SYSErr bit */ ++ if (unlikely(status & SYSErr && ++ tp->mac_version <= RTL_GIGA_MAC_VER_06)) { + rtl8169_pcierr_interrupt(tp->dev); + goto out; + } +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 24cb7b97e4fcc9..42839cb853f83c 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -842,20 +842,24 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) + unsigned int role = GTP_ROLE_GGSN; + + if (data[IFLA_GTP_FD0]) { +- u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]); ++ int fd0 = nla_get_u32(data[IFLA_GTP_FD0]); + +- sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); +- if (IS_ERR(sk0)) +- return PTR_ERR(sk0); ++ if (fd0 >= 0) { ++ sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); ++ if (IS_ERR(sk0)) ++ return PTR_ERR(sk0); ++ } + } + + if (data[IFLA_GTP_FD1]) { +- u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]); ++ int fd1 = nla_get_u32(data[IFLA_GTP_FD1]); + +- sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); +- if (IS_ERR(sk1u)) { +- gtp_encap_disable_sock(sk0); +- return PTR_ERR(sk1u); ++ if (fd1 >= 0) { ++ sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); ++ if (IS_ERR(sk1u)) { ++ gtp_encap_disable_sock(sk0); ++ return PTR_ERR(sk1u); ++ } + } + } + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 0fc0f9cb3f34b5..9ae4f88ab45546 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -2789,6 +2789,31 @@ static struct hv_driver netvsc_drv = { + }, + }; + ++/* Set VF's namespace same as the synthetic NIC */ ++static void netvsc_event_set_vf_ns(struct net_device *ndev) ++{ ++ struct net_device_context *ndev_ctx = netdev_priv(ndev); ++ struct net_device *vf_netdev; ++ int ret; ++ ++ vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev); ++ if (!vf_netdev) ++ return; ++ ++ if (!net_eq(dev_net(ndev), dev_net(vf_netdev))) { ++ ret = dev_change_net_namespace(vf_netdev, dev_net(ndev), ++ "eth%d"); ++ if (ret) ++ netdev_err(vf_netdev, ++ "Cannot move to same namespace as %s: %d\n", ++ ndev->name, ret); ++ else ++ netdev_info(vf_netdev, ++ "Moved VF to namespace with: %s\n", ++ ndev->name); ++ } ++} ++ + /* + * On Hyper-V, every VF interface is matched with a corresponding + * synthetic interface. The synthetic interface is presented first +@@ -2801,6 +2826,11 @@ static int netvsc_netdev_event(struct notifier_block *this, + struct net_device *event_dev = netdev_notifier_info_to_dev(ptr); + int ret = 0; + ++ if (event_dev->netdev_ops == &device_ops && event == NETDEV_REGISTER) { ++ netvsc_event_set_vf_ns(event_dev); ++ return NOTIFY_DONE; ++ } ++ + ret = check_dev_is_matching_vf(event_dev); + if (ret != 0) + return NOTIFY_DONE; +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 83b02dc7dfd2de..5e30fd017b3acd 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -159,19 +159,6 @@ static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr) + return sa; + } + +-static struct macsec_rx_sa *macsec_active_rxsa_get(struct macsec_rx_sc *rx_sc) +-{ +- struct macsec_rx_sa *sa = NULL; +- int an; +- +- for (an = 0; an < MACSEC_NUM_AN; an++) { +- sa = macsec_rxsa_get(rx_sc->sa[an]); +- if (sa) +- break; +- } +- return sa; +-} +- + static void free_rx_sc_rcu(struct rcu_head *head) + { + struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head); +@@ -1196,15 +1183,12 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + /* If validateFrames is Strict or the C bit in the + * SecTAG is set, discard + */ +- struct macsec_rx_sa *active_rx_sa = macsec_active_rxsa_get(rx_sc); + if (hdr->tci_an & MACSEC_TCI_C || + secy->validate_frames == MACSEC_VALIDATE_STRICT) { + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsNotUsingSA++; + u64_stats_update_end(&rxsc_stats->syncp); + DEV_STATS_INC(secy->netdev, rx_errors); +- if (active_rx_sa) +- this_cpu_inc(active_rx_sa->stats->InPktsNotUsingSA); + goto drop_nosa; + } + +@@ -1214,8 +1198,6 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsUnusedSA++; + u64_stats_update_end(&rxsc_stats->syncp); +- if (active_rx_sa) +- this_cpu_inc(active_rx_sa->stats->InPktsUnusedSA); + goto deliver; + } + +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index 14c5e082ccc8f3..c3828beccbad87 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -40,8 +40,8 @@ + /* Control Register 2 bits */ + #define DP83822_FX_ENABLE BIT(14) + +-#define DP83822_HW_RESET BIT(15) +-#define DP83822_SW_RESET BIT(14) ++#define DP83822_SW_RESET BIT(15) ++#define DP83822_DIG_RESTART BIT(14) + + /* PHY STS bits */ + #define DP83822_PHYSTS_DUPLEX BIT(2) +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 669cd20cfe00a4..b3d363ebea26e6 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1717,7 +1717,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) + // can rename the link if it knows better. + if ((dev->driver_info->flags & FLAG_ETHER) != 0 && + ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 || +- (net->dev_addr [0] & 0x02) == 0)) ++ /* somebody touched it*/ ++ !is_zero_ether_addr(net->dev_addr))) + strscpy(net->name, "eth%d", sizeof(net->name)); + /* WLAN devices should always be named "wlan%d" */ + if ((dev->driver_info->flags & FLAG_WLAN) != 0) +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 0eeb74245372fb..7e65788238bb56 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -3035,9 +3035,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar, + struct sk_buff *msdu) + { + struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); ++ struct ath10k_mgmt_tx_pkt_addr *pkt_addr; + struct ath10k_wmi *wmi = &ar->wmi; + +- idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); ++ spin_lock_bh(&ar->data_lock); ++ pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); ++ spin_unlock_bh(&ar->data_lock); ++ ++ kfree(pkt_addr); + + return 0; + } +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 9cfd35dc87ba32..dc5d9f9be34f0e 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -2440,6 +2440,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *ar, struct mgmt_tx_compl_params *param) + dma_unmap_single(ar->dev, pkt_addr->paddr, + msdu->len, DMA_TO_DEVICE); + info = IEEE80211_SKB_CB(msdu); ++ kfree(pkt_addr); + + if (param->status) { + info->flags &= ~IEEE80211_TX_STAT_ACK; +@@ -9581,6 +9582,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr, + dma_unmap_single(ar->dev, pkt_addr->paddr, + msdu->len, DMA_TO_DEVICE); + ieee80211_free_txskb(ar->hw, msdu); ++ kfree(pkt_addr); + + return 0; + } +diff --git a/drivers/net/wireless/broadcom/brcm80211/Kconfig b/drivers/net/wireless/broadcom/brcm80211/Kconfig +index 5bf2318763c55b..8f51099e15c90d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig ++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig +@@ -23,6 +23,7 @@ source "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig" + config BRCM_TRACING + bool "Broadcom device tracing" + depends on BRCMSMAC || BRCMFMAC ++ depends on TRACING + help + If you say Y here, the Broadcom wireless drivers will register + with ftrace to dump event information into the trace ringbuffer. +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 4b55779de00a98..3bcb85fcbe19e6 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -4963,6 +4963,8 @@ il_pci_resume(struct device *device) + */ + pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00); + ++ _il_wr(il, CSR_INT, 0xffffffff); ++ _il_wr(il, CSR_FH_INT_STATUS, 0xffffffff); + il_enable_interrupts(il); + + if (!(_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 793208d99b5f94..553117e8fdd90b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1251,11 +1251,18 @@ static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm) + } + #endif /* CONFIG_ACPI */ + ++static void iwl_mvm_disconnect_iterator(void *data, u8 *mac, ++ struct ieee80211_vif *vif) ++{ ++ if (vif->type == NL80211_IFTYPE_STATION) ++ ieee80211_hw_restart_disconnect(vif); ++} ++ + void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) + { + u32 error_log_size = mvm->fw->ucode_capa.error_log_size; ++ u32 status = 0; + int ret; +- u32 resp; + + struct iwl_fw_error_recovery_cmd recovery_cmd = { + .flags = cpu_to_le32(flags), +@@ -1263,7 +1270,6 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) + }; + struct iwl_host_cmd host_cmd = { + .id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD), +- .flags = CMD_WANT_SKB, + .data = {&recovery_cmd, }, + .len = {sizeof(recovery_cmd), }, + }; +@@ -1283,7 +1289,7 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) + recovery_cmd.buf_size = cpu_to_le32(error_log_size); + } + +- ret = iwl_mvm_send_cmd(mvm, &host_cmd); ++ ret = iwl_mvm_send_cmd_status(mvm, &host_cmd, &status); + kfree(mvm->error_recovery_buf); + mvm->error_recovery_buf = NULL; + +@@ -1294,11 +1300,15 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) + + /* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */ + if (flags & ERROR_RECOVERY_UPDATE_DB) { +- resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data); +- if (resp) ++ if (status) { + IWL_ERR(mvm, + "Failed to send recovery cmd blob was invalid %d\n", +- resp); ++ status); ++ ++ ieee80211_iterate_interfaces(mvm->hw, 0, ++ iwl_mvm_disconnect_iterator, ++ mvm); ++ } + } + } + +diff --git a/drivers/staging/iio/frequency/ad9832.c b/drivers/staging/iio/frequency/ad9832.c +index 447937e04ebdc5..61c5f33ac27196 100644 +--- a/drivers/staging/iio/frequency/ad9832.c ++++ b/drivers/staging/iio/frequency/ad9832.c +@@ -129,12 +129,15 @@ static unsigned long ad9832_calc_freqreg(unsigned long mclk, unsigned long fout) + static int ad9832_write_frequency(struct ad9832_state *st, + unsigned int addr, unsigned long fout) + { ++ unsigned long clk_freq; + unsigned long regval; + +- if (fout > (clk_get_rate(st->mclk) / 2)) ++ clk_freq = clk_get_rate(st->mclk); ++ ++ if (!clk_freq || fout > (clk_freq / 2)) + return -EINVAL; + +- regval = ad9832_calc_freqreg(clk_get_rate(st->mclk), fout); ++ regval = ad9832_calc_freqreg(clk_freq, fout); + + st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) | + (addr << ADD_SHIFT) | +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index daa4d06ce2336e..50135f8df1b4a9 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -727,7 +727,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + + dev->queues = kcalloc(nr_cpu_ids, sizeof(*dev->queues), GFP_KERNEL); + if (!dev->queues) { +- dev->transport->free_device(dev); ++ hba->backend->ops->free_device(dev); + return NULL; + } + +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index c283e45ac300bd..2ac973291b1ffc 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -1988,7 +1988,7 @@ static int tcmu_netlink_event_send(struct tcmu_dev *udev, + } + + ret = genlmsg_multicast_allns(&tcmu_genl_family, skb, 0, +- TCMU_MCGRP_CONFIG, GFP_KERNEL); ++ TCMU_MCGRP_CONFIG); + + /* Wait during an add as the listener may not be up yet */ + if (ret == 0 || +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index c7adcf97e2a33a..6d7d448d0fbf56 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -286,14 +286,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) + /* + * Turn off DTR and RTS early. + */ +- if (uport && uart_console(uport) && tty) { +- uport->cons->cflag = tty->termios.c_cflag; +- uport->cons->ispeed = tty->termios.c_ispeed; +- uport->cons->ospeed = tty->termios.c_ospeed; +- } ++ if (uport) { ++ if (uart_console(uport) && tty) { ++ uport->cons->cflag = tty->termios.c_cflag; ++ uport->cons->ispeed = tty->termios.c_ispeed; ++ uport->cons->ospeed = tty->termios.c_ospeed; ++ } + +- if (!tty || C_HUPCL(tty)) +- uart_port_dtr_rts(uport, 0); ++ if (!tty || C_HUPCL(tty)) ++ uart_port_dtr_rts(uport, 0); ++ } + + uart_port_shutdown(port); + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index a070f2e7d960f7..5d9de3a53548b1 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4603,7 +4603,7 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op) + int c; + + if (op->data) { +- font.data = kmalloc(max_font_size, GFP_KERNEL); ++ font.data = kzalloc(max_font_size, GFP_KERNEL); + if (!font.data) + return -ENOMEM; + } else +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index ace65992e0da43..572e44811805da 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -516,7 +516,7 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + pm_runtime_put_noidle(&dev->dev); + + if (pci_choose_state(dev, PMSG_SUSPEND) == PCI_D0) +- pm_runtime_forbid(&dev->dev); ++ pm_runtime_get(&dev->dev); + else if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW) + pm_runtime_allow(&dev->dev); + +@@ -543,7 +543,9 @@ static void xhci_pci_remove(struct pci_dev *dev) + + xhci->xhc_state |= XHCI_STATE_REMOVING; + +- if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW) ++ if (pci_choose_state(dev, PMSG_SUSPEND) == PCI_D0) ++ pm_runtime_put(&dev->dev); ++ else if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW) + pm_runtime_forbid(&dev->dev); + + if (xhci->shared_hcd) { +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index fbb7a5b51ef466..32c039027d7fe4 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1582,6 +1582,14 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + + trace_xhci_handle_command(xhci->cmd_ring, &cmd_trb->generic); + ++ cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); ++ ++ /* If CMD ring stopped we own the trbs between enqueue and dequeue */ ++ if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { ++ complete_all(&xhci->cmd_ring_stop_completion); ++ return; ++ } ++ + cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, + cmd_trb); + /* +@@ -1598,14 +1606,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + + cancel_delayed_work(&xhci->cmd_timer); + +- cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); +- +- /* If CMD ring stopped we own the trbs between enqueue and dequeue */ +- if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { +- complete_all(&xhci->cmd_ring_stop_completion); +- return; +- } +- + if (cmd->command_trb != xhci->cmd_ring->dequeue) { + xhci_err(xhci, + "Command completion event does not match command\n"); +diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c +index b47285f023cf77..5adbf7fd24fdbf 100644 +--- a/drivers/usb/phy/phy.c ++++ b/drivers/usb/phy/phy.c +@@ -590,7 +590,7 @@ void devm_usb_put_phy(struct device *dev, struct usb_phy *phy) + { + int r; + +- r = devres_destroy(dev, devm_usb_phy_release, devm_usb_phy_match, phy); ++ r = devres_release(dev, devm_usb_phy_release, devm_usb_phy_match, phy); + dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); + } + EXPORT_SYMBOL_GPL(devm_usb_put_phy); +diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c +index 7fa95e7012446a..dec83edb09de2d 100644 +--- a/drivers/usb/typec/class.c ++++ b/drivers/usb/typec/class.c +@@ -430,6 +430,7 @@ static void typec_altmode_release(struct device *dev) + typec_altmode_put_partner(alt); + + altmode_id_remove(alt->adev.dev.parent, alt->id); ++ put_device(alt->adev.dev.parent); + kfree(alt); + } + +@@ -479,6 +480,8 @@ typec_register_altmode(struct device *parent, + alt->adev.dev.type = &typec_altmode_dev_type; + dev_set_name(&alt->adev.dev, "%s.%u", dev_name(parent), id); + ++ get_device(alt->adev.dev.parent); ++ + /* Link partners and plugs with the ports */ + if (!is_port) + typec_altmode_set_partner(alt); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index aa3211d8cce3bd..03651cc6b7a5b6 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2961,6 +2961,15 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, + return rc; + + if (indatalen) { ++ unsigned int len; ++ ++ if (WARN_ON_ONCE(smb3_encryption_required(tcon) && ++ (check_add_overflow(total_len - 1, ++ ALIGN(indatalen, 8), &len) || ++ len > MAX_CIFS_SMALL_BUFFER_SIZE))) { ++ cifs_small_buf_release(req); ++ return -EIO; ++ } + /* + * indatalen is usually small at a couple of bytes max, so + * just allocate through generic pool +diff --git a/fs/exec.c b/fs/exec.c +index 6e5324c7e9b694..7144c541818f6d 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -144,13 +144,11 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) + goto out; + + /* +- * may_open() has already checked for this, so it should be +- * impossible to trip now. But we need to be extra cautious +- * and check again at the very end too. ++ * Check do_open_execat() for an explanation. + */ + error = -EACCES; +- if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || +- path_noexec(&file->f_path))) ++ if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) || ++ path_noexec(&file->f_path)) + goto exit; + + fsnotify_open(file); +@@ -919,16 +917,16 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) + + file = do_filp_open(fd, name, &open_exec_flags); + if (IS_ERR(file)) +- goto out; ++ return file; + + /* +- * may_open() has already checked for this, so it should be +- * impossible to trip now. But we need to be extra cautious +- * and check again at the very end too. ++ * In the past the regular type check was here. It moved to may_open() in ++ * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is ++ * an invariant that all non-regular files error out before we get here. + */ + err = -EACCES; +- if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || +- path_noexec(&file->f_path))) ++ if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) || ++ path_noexec(&file->f_path)) + goto exit; + + err = deny_write_access(file); +@@ -938,7 +936,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) + if (name->name[0] != '\0') + fsnotify_open(file); + +-out: + return file; + + exit: +diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c +index 933f234d5becd0..8a49c0d3a7b46b 100644 +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -93,7 +93,6 @@ ssize_t iomap_dio_complete(struct iomap_dio *dio) + if (offset + ret > dio->i_size && + !(dio->flags & IOMAP_DIO_WRITE)) + ret = dio->i_size - offset; +- iocb->ki_pos += ret; + } + + /* +@@ -119,15 +118,18 @@ ssize_t iomap_dio_complete(struct iomap_dio *dio) + } + + inode_dio_end(file_inode(iocb->ki_filp)); +- /* +- * If this is a DSYNC write, make sure we push it to stable storage now +- * that we've written data. +- */ +- if (ret > 0 && (dio->flags & IOMAP_DIO_NEED_SYNC)) +- ret = generic_write_sync(iocb, ret); + +- kfree(dio); ++ if (ret > 0) { ++ iocb->ki_pos += ret; + ++ /* ++ * If this is a DSYNC write, make sure we push it to stable ++ * storage now that we've written data. ++ */ ++ if (dio->flags & IOMAP_DIO_NEED_SYNC) ++ ret = generic_write_sync(iocb, ret); ++ } ++ kfree(dio); + return ret; + } + EXPORT_SYMBOL_GPL(iomap_dio_complete); +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 8efd93992946b6..559f6ebebfc0c4 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap) + } + + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); +- if (!bmp->db_numag || bmp->db_numag >= MAXAG) { ++ if (!bmp->db_numag || bmp->db_numag > MAXAG) { + err = -EINVAL; + goto err_release_metapage; + } +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index c15188d0b6b337..02d9af026ad154 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -960,6 +960,11 @@ void nfs_delegation_mark_returned(struct inode *inode, + } + + nfs_mark_delegation_revoked(delegation); ++ clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags); ++ spin_unlock(&delegation->lock); ++ if (nfs_detach_delegation(NFS_I(inode), delegation, NFS_SERVER(inode))) ++ nfs_put_delegation(delegation); ++ goto out_rcu_unlock; + + out_clear_returning: + clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags); +diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c +index 08c6d985edeb6f..eeccd69cd79743 100644 +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -156,6 +156,9 @@ static int nilfs_symlink(struct inode *dir, struct dentry *dentry, + /* slow symlink */ + inode->i_op = &nilfs_symlink_inode_operations; + inode_nohighmem(inode); ++ mapping_set_gfp_mask(inode->i_mapping, ++ mapping_gfp_constraint(inode->i_mapping, ++ ~__GFP_FS)); + inode->i_mapping->a_ops = &nilfs_aops; + err = page_symlink(inode, symname, l); + if (err) +diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c +index 81992b9a219b21..7adf74b5255032 100644 +--- a/fs/nilfs2/page.c ++++ b/fs/nilfs2/page.c +@@ -77,7 +77,8 @@ void nilfs_forget_buffer(struct buffer_head *bh) + const unsigned long clear_bits = + (BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) | + BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | +- BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected)); ++ BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | ++ BIT(BH_Delay)); + + lock_buffer(bh); + set_mask_bits(&bh->b_state, clear_bits, 0); +@@ -403,13 +404,15 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) + + ClearPageUptodate(page); + ClearPageMappedToDisk(page); ++ ClearPageChecked(page); + + if (page_has_buffers(page)) { + struct buffer_head *bh, *head; + const unsigned long clear_bits = + (BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) | + BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | +- BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected)); ++ BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | ++ BIT(BH_Delay)); + + bh = head = page_buffers(page); + do { +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 5fd565a6228f78..09a62539ab74da 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -1787,6 +1787,14 @@ int ocfs2_remove_inode_range(struct inode *inode, + return 0; + + if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { ++ int id_count = ocfs2_max_inline_data_with_xattr(inode->i_sb, di); ++ ++ if (byte_start > id_count || byte_start + byte_len > id_count) { ++ ret = -EINVAL; ++ mlog_errno(ret); ++ goto out; ++ } ++ + ret = ocfs2_truncate_inline(inode, di_bh, byte_start, + byte_start + byte_len, 0); + if (ret) { +diff --git a/fs/open.c b/fs/open.c +index 694110929519cd..7bcc26b14cd798 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -1270,6 +1270,8 @@ SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename, + + if (unlikely(usize < OPEN_HOW_SIZE_VER0)) + return -EINVAL; ++ if (unlikely(usize > PAGE_SIZE)) ++ return -E2BIG; + + err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize); + if (err) +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index ae2de4e1cd6fad..5b481a22b5fe2f 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -116,26 +116,26 @@ + #define KASAN_ABI_VERSION 3 + #endif + +-#if __has_attribute(__no_sanitize_address__) +-#define __no_sanitize_address __attribute__((no_sanitize_address)) ++#ifdef __SANITIZE_HWADDRESS__ ++#define __no_sanitize_address __attribute__((__no_sanitize__("hwaddress"))) + #else +-#define __no_sanitize_address ++#define __no_sanitize_address __attribute__((__no_sanitize_address__)) + #endif + + #if defined(__SANITIZE_THREAD__) && __has_attribute(__no_sanitize_thread__) +-#define __no_sanitize_thread __attribute__((no_sanitize_thread)) ++#define __no_sanitize_thread __attribute__((__no_sanitize_thread__)) + #else + #define __no_sanitize_thread + #endif + + #if __has_attribute(__no_sanitize_undefined__) +-#define __no_sanitize_undefined __attribute__((no_sanitize_undefined)) ++#define __no_sanitize_undefined __attribute__((__no_sanitize_undefined__)) + #else + #define __no_sanitize_undefined + #endif + + #if defined(CONFIG_KCOV) && __has_attribute(__no_sanitize_coverage__) +-#define __no_sanitize_coverage __attribute__((no_sanitize_coverage)) ++#define __no_sanitize_coverage __attribute__((__no_sanitize_coverage__)) + #else + #define __no_sanitize_coverage + #endif +diff --git a/include/linux/mm.h b/include/linux/mm.h +index b8b677f47a8da3..94e630862d58ce 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2749,6 +2749,8 @@ unsigned long change_prot_numa(struct vm_area_struct *vma, + struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); + int remap_pfn_range(struct vm_area_struct *, unsigned long addr, + unsigned long pfn, unsigned long size, pgprot_t); ++int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr, ++ unsigned long pfn, unsigned long size, pgprot_t prot); + int vm_insert_page(struct vm_area_struct *, unsigned long addr, struct page *); + int vm_insert_pages(struct vm_area_struct *vma, unsigned long addr, + struct page **pages, unsigned long *num); +diff --git a/include/net/genetlink.h b/include/net/genetlink.h +index 3057c8e6dcfe92..e00f617d4b6c88 100644 +--- a/include/net/genetlink.h ++++ b/include/net/genetlink.h +@@ -335,13 +335,12 @@ static inline int genlmsg_multicast(const struct genl_family *family, + * @skb: netlink message as socket buffer + * @portid: own netlink portid to avoid sending to yourself + * @group: offset of multicast group in groups array +- * @flags: allocation flags + * + * This function must hold the RTNL or rcu_read_lock(). + */ + int genlmsg_multicast_allns(const struct genl_family *family, + struct sk_buff *skb, u32 portid, +- unsigned int group, gfp_t flags); ++ unsigned int group); + + /** + * genlmsg_unicast - unicast a netlink message +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index f6cb68c2beadf1..cedf72924f19e1 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -247,7 +247,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, + memset(fl4, 0, sizeof(*fl4)); + + if (oif) { +- fl4->flowi4_l3mdev = l3mdev_master_upper_ifindex_by_index_rcu(net, oif); ++ fl4->flowi4_l3mdev = l3mdev_master_upper_ifindex_by_index(net, oif); + /* Legacy VRF/l3mdev use case */ + fl4->flowi4_oif = fl4->flowi4_l3mdev ? 0 : oif; + } +diff --git a/include/net/mac80211.h b/include/net/mac80211.h +index 6ff49c13717bba..8f91609f928c11 100644 +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -5899,6 +5899,16 @@ void ieee80211_connection_loss(struct ieee80211_vif *vif); + */ + void ieee80211_resume_disconnect(struct ieee80211_vif *vif); + ++/** ++ * ieee80211_hw_restart_disconnect - disconnect from AP after ++ * hardware restart ++ * @vif: &struct ieee80211_vif pointer from the add_interface callback. ++ * ++ * Instructs mac80211 to disconnect from the AP after ++ * hardware restart. ++ */ ++void ieee80211_hw_restart_disconnect(struct ieee80211_vif *vif); ++ + /** + * ieee80211_cqm_rssi_notify - inform a configured connection quality monitoring + * rssi threshold triggered +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 6fbaf304648f61..798df30c2d253e 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -321,20 +321,25 @@ struct xfrm_if_cb { + void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); + void xfrm_if_unregister_cb(void); + ++struct xfrm_dst_lookup_params { ++ struct net *net; ++ int tos; ++ int oif; ++ xfrm_address_t *saddr; ++ xfrm_address_t *daddr; ++ u32 mark; ++ __u8 ipproto; ++ union flowi_uli uli; ++}; ++ + struct net_device; + struct xfrm_type; + struct xfrm_dst; + struct xfrm_policy_afinfo { + struct dst_ops *dst_ops; +- struct dst_entry *(*dst_lookup)(struct net *net, +- int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- u32 mark); +- int (*get_saddr)(struct net *net, int oif, +- xfrm_address_t *saddr, +- xfrm_address_t *daddr, +- u32 mark); ++ struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params); ++ int (*get_saddr)(xfrm_address_t *saddr, ++ const struct xfrm_dst_lookup_params *params); + int (*fill_dst)(struct xfrm_dst *xdst, + struct net_device *dev, + const struct flowi *fl); +@@ -1658,10 +1663,7 @@ static inline int xfrm_user_policy(struct sock *sk, int optname, + } + #endif + +-struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- int family, u32 mark); ++struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params); + + struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); + +diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c +index 3c2d8722d45b3a..8370b391f1d6c3 100644 +--- a/kernel/bpf/lpm_trie.c ++++ b/kernel/bpf/lpm_trie.c +@@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) + if (!key || key->prefixlen > trie->max_prefixlen) + goto find_leftmost; + +- node_stack = kmalloc_array(trie->max_prefixlen, ++ node_stack = kmalloc_array(trie->max_prefixlen + 1, + sizeof(struct lpm_trie_node *), + GFP_ATOMIC | __GFP_NOWARN); + if (!node_stack) +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 66970b74106c8c..e0fd62d56110a5 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -5437,7 +5437,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) + { + struct cgroup *cgroup; + int ret = false; +- int level = 1; ++ int level = 0; + + lockdep_assert_held(&cgroup_mutex); + +@@ -5445,7 +5445,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) + if (cgroup->nr_descendants >= cgroup->max_descendants) + goto fail; + +- if (level > cgroup->max_depth) ++ if (level >= cgroup->max_depth) + goto fail; + + level++; +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index 8127673bfc45e6..05e73d209aa87e 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -290,6 +290,9 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) + struct posix_clock_desc cd; + int err; + ++ if (!timespec64_valid_strict(ts)) ++ return -EINVAL; ++ + err = get_clock_desc(id, &cd); + if (err) + return err; +@@ -299,9 +302,6 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) + goto out; + } + +- if (!timespec64_valid_strict(ts)) +- return -EINVAL; +- + if (cd.clk->ops.clock_settime) + err = cd.clk->ops.clock_settime(cd.clk, ts); + else +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 073abbe3866b48..1893fe5460acb1 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -256,7 +256,7 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup, + if (len == 0) { + trace_probe_log_err(offset, NO_EVENT_NAME); + return -EINVAL; +- } else if (len > MAX_EVENT_NAME_LEN) { ++ } else if (len >= MAX_EVENT_NAME_LEN) { + trace_probe_log_err(offset, EVENT_TOO_LONG); + return -EINVAL; + } +diff --git a/mm/memory.c b/mm/memory.c +index 2183003687cec9..29cce8aadb6185 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2290,26 +2290,13 @@ static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd, + return 0; + } + +-/** +- * remap_pfn_range - remap kernel memory to userspace +- * @vma: user vma to map to +- * @addr: target page aligned user address to start at +- * @pfn: page frame number of kernel physical memory address +- * @size: size of mapping area +- * @prot: page protection flags for this mapping +- * +- * Note: this is only safe if the mm semaphore is held when called. +- * +- * Return: %0 on success, negative error code otherwise. +- */ +-int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, +- unsigned long pfn, unsigned long size, pgprot_t prot) ++static int remap_pfn_range_internal(struct vm_area_struct *vma, unsigned long addr, ++ unsigned long pfn, unsigned long size, pgprot_t prot) + { + pgd_t *pgd; + unsigned long next; + unsigned long end = addr + PAGE_ALIGN(size); + struct mm_struct *mm = vma->vm_mm; +- unsigned long remap_pfn = pfn; + int err; + + if (WARN_ON_ONCE(!PAGE_ALIGNED(addr))) +@@ -2339,10 +2326,6 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, + vma->vm_pgoff = pfn; + } + +- err = track_pfn_remap(vma, &prot, remap_pfn, addr, PAGE_ALIGN(size)); +- if (err) +- return -EINVAL; +- + vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; + + BUG_ON(addr >= end); +@@ -2354,12 +2337,57 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, + err = remap_p4d_range(mm, pgd, addr, next, + pfn + (addr >> PAGE_SHIFT), prot); + if (err) +- break; ++ return err; + } while (pgd++, addr = next, addr != end); + ++ return 0; ++} ++ ++/* ++ * Variant of remap_pfn_range that does not call track_pfn_remap. The caller ++ * must have pre-validated the caching bits of the pgprot_t. ++ */ ++int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr, ++ unsigned long pfn, unsigned long size, pgprot_t prot) ++{ ++ int error = remap_pfn_range_internal(vma, addr, pfn, size, prot); ++ ++ if (!error) ++ return 0; ++ ++ /* ++ * A partial pfn range mapping is dangerous: it does not ++ * maintain page reference counts, and callers may free ++ * pages due to the error. So zap it early. ++ */ ++ zap_page_range_single(vma, addr, size, NULL); ++ return error; ++} ++ ++/** ++ * remap_pfn_range - remap kernel memory to userspace ++ * @vma: user vma to map to ++ * @addr: target page aligned user address to start at ++ * @pfn: page frame number of kernel physical memory address ++ * @size: size of mapping area ++ * @prot: page protection flags for this mapping ++ * ++ * Note: this is only safe if the mm semaphore is held when called. ++ * ++ * Return: %0 on success, negative error code otherwise. ++ */ ++int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, ++ unsigned long pfn, unsigned long size, pgprot_t prot) ++{ ++ int err; ++ ++ err = track_pfn_remap(vma, &prot, pfn, addr, PAGE_ALIGN(size)); + if (err) +- untrack_pfn(vma, remap_pfn, PAGE_ALIGN(size)); ++ return -EINVAL; + ++ err = remap_pfn_range_notrack(vma, addr, pfn, size, prot); ++ if (err) ++ untrack_pfn(vma, pfn, PAGE_ALIGN(size)); + return err; + } + EXPORT_SYMBOL(remap_pfn_range); +diff --git a/mm/shmem.c b/mm/shmem.c +index e173d83b44481d..8239a0beb01c5b 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1077,7 +1077,9 @@ static int shmem_getattr(const struct path *path, struct kstat *stat, + shmem_recalc_inode(inode); + spin_unlock_irq(&info->lock); + } ++ inode_lock_shared(inode); + generic_fillattr(inode, stat); ++ inode_unlock_shared(inode); + + if (is_huge_enabled(sb_info)) + stat->blksize = HPAGE_PMD_SIZE; +diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c +index f749904272961f..0eaa47ae6e993d 100644 +--- a/net/bluetooth/bnep/core.c ++++ b/net/bluetooth/bnep/core.c +@@ -745,8 +745,7 @@ static int __init bnep_init(void) + if (flt[0]) + BT_INFO("BNEP filters: %s", flt); + +- bnep_sock_init(); +- return 0; ++ return bnep_sock_init(); + } + + static void __exit bnep_exit(void) +diff --git a/net/core/dev.c b/net/core/dev.c +index 5edab9328d5e05..2c11247509b4c8 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3647,7 +3647,22 @@ int skb_csum_hwoffload_help(struct sk_buff *skb, + return !!(features & NETIF_F_SCTP_CRC) ? 0 : + skb_crc32c_csum_help(skb); + +- return !!(features & NETIF_F_CSUM_MASK) ? 0 : skb_checksum_help(skb); ++ if (features & NETIF_F_HW_CSUM) ++ return 0; ++ ++ if (features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)) { ++ if (vlan_get_protocol(skb) == htons(ETH_P_IPV6) && ++ skb_network_header_len(skb) != sizeof(struct ipv6hdr)) ++ goto sw_checksum; ++ switch (skb->csum_offset) { ++ case offsetof(struct tcphdr, check): ++ case offsetof(struct udphdr, check): ++ return 0; ++ } ++ } ++ ++sw_checksum: ++ return skb_checksum_help(skb); + } + EXPORT_SYMBOL(skb_csum_hwoffload_help); + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 7868f316a477fe..6918b3ced67137 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -273,17 +273,19 @@ static struct in_device *inetdev_init(struct net_device *dev) + /* Account for reference dev->ip_ptr (below) */ + refcount_set(&in_dev->refcnt, 1); + +- err = devinet_sysctl_register(in_dev); +- if (err) { +- in_dev->dead = 1; +- neigh_parms_release(&arp_tbl, in_dev->arp_parms); +- in_dev_put(in_dev); +- in_dev = NULL; +- goto out; ++ if (dev != blackhole_netdev) { ++ err = devinet_sysctl_register(in_dev); ++ if (err) { ++ in_dev->dead = 1; ++ neigh_parms_release(&arp_tbl, in_dev->arp_parms); ++ in_dev_put(in_dev); ++ in_dev = NULL; ++ goto out; ++ } ++ ip_mc_init_dev(in_dev); ++ if (dev->flags & IFF_UP) ++ ip_mc_up(in_dev); + } +- ip_mc_init_dev(in_dev); +- if (dev->flags & IFF_UP) +- ip_mc_up(in_dev); + + /* we can receive as soon as ip_ptr is set -- do this last */ + rcu_assign_pointer(dev->ip_ptr, in_dev); +@@ -328,6 +330,19 @@ static void inetdev_destroy(struct in_device *in_dev) + call_rcu(&in_dev->rcu_head, in_dev_rcu_put); + } + ++static int __init inet_blackhole_dev_init(void) ++{ ++ int err = 0; ++ ++ rtnl_lock(); ++ if (!inetdev_init(blackhole_netdev)) ++ err = -ENOMEM; ++ rtnl_unlock(); ++ ++ return err; ++} ++late_initcall(inet_blackhole_dev_init); ++ + int inet_addr_onlink(struct in_device *in_dev, __be32 a, __be32 b) + { + const struct in_ifaddr *ifa; +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c +index 4548a91acdc89b..5d8e38f4ecc070 100644 +--- a/net/ipv4/xfrm4_policy.c ++++ b/net/ipv4/xfrm4_policy.c +@@ -17,47 +17,43 @@ + #include <net/ip.h> + #include <net/l3mdev.h> + +-static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, +- int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- u32 mark) ++static struct dst_entry *__xfrm4_dst_lookup(struct flowi4 *fl4, ++ const struct xfrm_dst_lookup_params *params) + { + struct rtable *rt; + + memset(fl4, 0, sizeof(*fl4)); +- fl4->daddr = daddr->a4; +- fl4->flowi4_tos = tos; +- fl4->flowi4_l3mdev = l3mdev_master_ifindex_by_index(net, oif); +- fl4->flowi4_mark = mark; +- if (saddr) +- fl4->saddr = saddr->a4; +- +- rt = __ip_route_output_key(net, fl4); ++ fl4->daddr = params->daddr->a4; ++ fl4->flowi4_tos = params->tos; ++ fl4->flowi4_l3mdev = l3mdev_master_ifindex_by_index(params->net, ++ params->oif); ++ fl4->flowi4_mark = params->mark; ++ if (params->saddr) ++ fl4->saddr = params->saddr->a4; ++ fl4->flowi4_proto = params->ipproto; ++ fl4->uli = params->uli; ++ ++ rt = __ip_route_output_key(params->net, fl4); + if (!IS_ERR(rt)) + return &rt->dst; + + return ERR_CAST(rt); + } + +-static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- u32 mark) ++static struct dst_entry *xfrm4_dst_lookup(const struct xfrm_dst_lookup_params *params) + { + struct flowi4 fl4; + +- return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark); ++ return __xfrm4_dst_lookup(&fl4, params); + } + +-static int xfrm4_get_saddr(struct net *net, int oif, +- xfrm_address_t *saddr, xfrm_address_t *daddr, +- u32 mark) ++static int xfrm4_get_saddr(xfrm_address_t *saddr, ++ const struct xfrm_dst_lookup_params *params) + { + struct dst_entry *dst; + struct flowi4 fl4; + +- dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr, mark); ++ dst = __xfrm4_dst_lookup(&fl4, params); + if (IS_ERR(dst)) + return -EHOSTUNREACH; + +diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c +index 492b9692c0dc01..f5ef5e4c88df1f 100644 +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -23,23 +23,24 @@ + #include <net/ip6_route.h> + #include <net/l3mdev.h> + +-static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- u32 mark) ++static struct dst_entry *xfrm6_dst_lookup(const struct xfrm_dst_lookup_params *params) + { + struct flowi6 fl6; + struct dst_entry *dst; + int err; + + memset(&fl6, 0, sizeof(fl6)); +- fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(net, oif); +- fl6.flowi6_mark = mark; +- memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr)); +- if (saddr) +- memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr)); ++ fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(params->net, ++ params->oif); ++ fl6.flowi6_mark = params->mark; ++ memcpy(&fl6.daddr, params->daddr, sizeof(fl6.daddr)); ++ if (params->saddr) ++ memcpy(&fl6.saddr, params->saddr, sizeof(fl6.saddr)); + +- dst = ip6_route_output(net, NULL, &fl6); ++ fl6.flowi4_proto = params->ipproto; ++ fl6.uli = params->uli; ++ ++ dst = ip6_route_output(params->net, NULL, &fl6); + + err = dst->error; + if (dst->error) { +@@ -50,15 +51,14 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif, + return dst; + } + +-static int xfrm6_get_saddr(struct net *net, int oif, +- xfrm_address_t *saddr, xfrm_address_t *daddr, +- u32 mark) ++static int xfrm6_get_saddr(xfrm_address_t *saddr, ++ const struct xfrm_dst_lookup_params *params) + { + struct dst_entry *dst; + struct net_device *dev; + struct inet6_dev *idev; + +- dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr, mark); ++ dst = xfrm6_dst_lookup(params); + if (IS_ERR(dst)) + return -EHOSTUNREACH; + +@@ -68,7 +68,8 @@ static int xfrm6_get_saddr(struct net *net, int oif, + return -EHOSTUNREACH; + } + dev = idev->dev; +- ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6); ++ ipv6_dev_get_saddr(dev_net(dev), dev, ¶ms->daddr->in6, 0, ++ &saddr->in6); + dst_release(dst); + return 0; + } +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index 96eb91be9238ba..f34ca225c21990 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -115,7 +115,7 @@ static int l2tp_tunnel_notify(struct genl_family *family, + NLM_F_ACK, tunnel, cmd); + + if (ret >= 0) { +- ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC); ++ ret = genlmsg_multicast_allns(family, msg, 0, 0); + /* We don't care if no one is listening */ + if (ret == -ESRCH) + ret = 0; +@@ -143,7 +143,7 @@ static int l2tp_session_notify(struct genl_family *family, + NLM_F_ACK, session, cmd); + + if (ret >= 0) { +- ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC); ++ ret = genlmsg_multicast_allns(family, msg, 0, 0); + /* We don't care if no one is listening */ + if (ret == -ESRCH) + ret = 0; +diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig +index 51ec8256b7fa9e..8278221a36a1d3 100644 +--- a/net/mac80211/Kconfig ++++ b/net/mac80211/Kconfig +@@ -86,7 +86,7 @@ config MAC80211_DEBUGFS + + config MAC80211_MESSAGE_TRACING + bool "Trace all mac80211 debug messages" +- depends on MAC80211 ++ depends on MAC80211 && TRACING + help + Select this option to have mac80211 register the + mac80211_msg trace subsystem with tracepoints to +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index c8d2fe8fbc0a34..f2629e56d1a59b 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2720,7 +2720,8 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, + struct ieee80211_local *local = wiphy_priv(wiphy); + struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); + +- if (local->ops->get_txpower) ++ if (local->ops->get_txpower && ++ (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) + return drv_get_txpower(local, sdata, dbm); + + if (!local->use_chanctx) +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 782ff56c5aff10..2da452ec53288c 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -762,6 +762,8 @@ struct ieee80211_if_mesh { + * back to wireless media and to the local net stack. + * @IEEE80211_SDATA_DISCONNECT_RESUME: Disconnect after resume. + * @IEEE80211_SDATA_IN_DRIVER: indicates interface was added to driver ++ * @IEEE80211_SDATA_DISCONNECT_HW_RESTART: Disconnect after hardware restart ++ * recovery + */ + enum ieee80211_sub_if_data_flags { + IEEE80211_SDATA_ALLMULTI = BIT(0), +@@ -769,6 +771,7 @@ enum ieee80211_sub_if_data_flags { + IEEE80211_SDATA_DONT_BRIDGE_PACKETS = BIT(3), + IEEE80211_SDATA_DISCONNECT_RESUME = BIT(4), + IEEE80211_SDATA_IN_DRIVER = BIT(5), ++ IEEE80211_SDATA_DISCONNECT_HW_RESTART = BIT(6), + }; + + /** +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 6b089594a9f3fe..3df4695caef6ce 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -918,6 +918,26 @@ void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata) + mutex_unlock(&sdata->local->key_mtx); + } + ++static void ++ieee80211_key_iter(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ struct ieee80211_key *key, ++ void (*iter)(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ struct ieee80211_sta *sta, ++ struct ieee80211_key_conf *key, ++ void *data), ++ void *iter_data) ++{ ++ /* skip keys of station in removal process */ ++ if (key->sta && key->sta->removed) ++ return; ++ if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) ++ return; ++ iter(hw, vif, key->sta ? &key->sta->sta : NULL, ++ &key->conf, iter_data); ++} ++ + void ieee80211_iter_keys(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + void (*iter)(struct ieee80211_hw *hw, +@@ -937,16 +957,13 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw, + if (vif) { + sdata = vif_to_sdata(vif); + list_for_each_entry_safe(key, tmp, &sdata->key_list, list) +- iter(hw, &sdata->vif, +- key->sta ? &key->sta->sta : NULL, +- &key->conf, iter_data); ++ ieee80211_key_iter(hw, vif, key, iter, iter_data); + } else { + list_for_each_entry(sdata, &local->interfaces, list) + list_for_each_entry_safe(key, tmp, + &sdata->key_list, list) +- iter(hw, &sdata->vif, +- key->sta ? &key->sta->sta : NULL, +- &key->conf, iter_data); ++ ieee80211_key_iter(hw, &sdata->vif, key, ++ iter, iter_data); + } + mutex_unlock(&local->key_mtx); + } +@@ -964,17 +981,8 @@ _ieee80211_iter_keys_rcu(struct ieee80211_hw *hw, + { + struct ieee80211_key *key; + +- list_for_each_entry_rcu(key, &sdata->key_list, list) { +- /* skip keys of station in removal process */ +- if (key->sta && key->sta->removed) +- continue; +- if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) +- continue; +- +- iter(hw, &sdata->vif, +- key->sta ? &key->sta->sta : NULL, +- &key->conf, iter_data); +- } ++ list_for_each_entry_rcu(key, &sdata->key_list, list) ++ ieee80211_key_iter(hw, &sdata->vif, key, iter, iter_data); + } + + void ieee80211_iter_keys_rcu(struct ieee80211_hw *hw, +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index c52b8eb7fb8a28..66276122aed6c5 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -4778,6 +4778,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) + + sdata_unlock(sdata); + } ++#endif + + void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) + { +@@ -4799,9 +4800,20 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) + sdata_unlock(sdata); + return; + } ++ ++ if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) { ++ sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART; ++ mlme_dbg(sdata, "driver requested disconnect after hardware restart\n"); ++ ieee80211_sta_connection_lost(sdata, ++ ifmgd->associated->bssid, ++ WLAN_REASON_UNSPECIFIED, ++ true); ++ sdata_unlock(sdata); ++ return; ++ } ++ + sdata_unlock(sdata); + } +-#endif + + /* interface setup */ + void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata) +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 7fa6efa8b83c14..e49355cbb1ce12 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2290,6 +2290,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) + struct cfg80211_sched_scan_request *sched_scan_req; + bool sched_scan_stopped = false; + bool suspended = local->suspended; ++ bool in_reconfig = false; + + /* nothing to do if HW shouldn't run */ + if (!local->open_count) +@@ -2632,7 +2633,15 @@ int ieee80211_reconfig(struct ieee80211_local *local) + mutex_unlock(&local->sta_mtx); + } + ++ /* ++ * If this is for hw restart things are still running. ++ * We may want to change that later, however. ++ */ ++ if (local->open_count && (!suspended || reconfig_due_to_wowlan)) ++ drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART); ++ + if (local->in_reconfig) { ++ in_reconfig = local->in_reconfig; + local->in_reconfig = false; + barrier(); + +@@ -2650,12 +2659,14 @@ int ieee80211_reconfig(struct ieee80211_local *local) + IEEE80211_QUEUE_STOP_REASON_SUSPEND, + false); + +- /* +- * If this is for hw restart things are still running. +- * We may want to change that later, however. +- */ +- if (local->open_count && (!suspended || reconfig_due_to_wowlan)) +- drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART); ++ if (in_reconfig) { ++ list_for_each_entry(sdata, &local->interfaces, list) { ++ if (!ieee80211_sdata_running(sdata)) ++ continue; ++ if (sdata->vif.type == NL80211_IFTYPE_STATION) ++ ieee80211_sta_restart(sdata); ++ } ++ } + + if (!suspended) + return 0; +@@ -2686,7 +2697,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) + return 0; + } + +-void ieee80211_resume_disconnect(struct ieee80211_vif *vif) ++static void ieee80211_reconfig_disconnect(struct ieee80211_vif *vif, u8 flag) + { + struct ieee80211_sub_if_data *sdata; + struct ieee80211_local *local; +@@ -2698,19 +2709,35 @@ void ieee80211_resume_disconnect(struct ieee80211_vif *vif) + sdata = vif_to_sdata(vif); + local = sdata->local; + +- if (WARN_ON(!local->resuming)) ++ if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_RESUME && ++ !local->resuming)) ++ return; ++ ++ if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_HW_RESTART && ++ !local->in_reconfig)) + return; + + if (WARN_ON(vif->type != NL80211_IFTYPE_STATION)) + return; + +- sdata->flags |= IEEE80211_SDATA_DISCONNECT_RESUME; ++ sdata->flags |= flag; + + mutex_lock(&local->key_mtx); + list_for_each_entry(key, &sdata->key_list, list) + key->flags |= KEY_FLAG_TAINTED; + mutex_unlock(&local->key_mtx); + } ++ ++void ieee80211_hw_restart_disconnect(struct ieee80211_vif *vif) ++{ ++ ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_HW_RESTART); ++} ++EXPORT_SYMBOL_GPL(ieee80211_hw_restart_disconnect); ++ ++void ieee80211_resume_disconnect(struct ieee80211_vif *vif) ++{ ++ ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_RESUME); ++} + EXPORT_SYMBOL_GPL(ieee80211_resume_disconnect); + + void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata) +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index fa64b1b8ae9189..f607cd7f203ad6 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -618,6 +618,9 @@ static void nft_payload_set_eval(const struct nft_expr *expr, + if ((priv->csum_type == NFT_PAYLOAD_CSUM_INET || priv->csum_flags) && + (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER || + skb->ip_summed != CHECKSUM_PARTIAL)) { ++ if (offset + priv->len > skb->len) ++ goto err; ++ + fsum = skb_checksum(skb, offset, priv->len, 0); + tsum = csum_partial(src, priv->len, 0); + +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index e9035de6554674..e085ceec96a4ca 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1097,15 +1097,11 @@ static int genl_ctrl_event(int event, const struct genl_family *family, + if (IS_ERR(msg)) + return PTR_ERR(msg); + +- if (!family->netnsok) { ++ if (!family->netnsok) + genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0, + 0, GFP_KERNEL); +- } else { +- rcu_read_lock(); +- genlmsg_multicast_allns(&genl_ctrl, msg, 0, +- 0, GFP_ATOMIC); +- rcu_read_unlock(); +- } ++ else ++ genlmsg_multicast_allns(&genl_ctrl, msg, 0, 0); + + return 0; + } +@@ -1449,23 +1445,23 @@ static int __init genl_init(void) + + core_initcall(genl_init); + +-static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, +- gfp_t flags) ++static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group) + { + struct sk_buff *tmp; + struct net *net, *prev = NULL; + bool delivered = false; + int err; + ++ rcu_read_lock(); + for_each_net_rcu(net) { + if (prev) { +- tmp = skb_clone(skb, flags); ++ tmp = skb_clone(skb, GFP_ATOMIC); + if (!tmp) { + err = -ENOMEM; + goto error; + } + err = nlmsg_multicast(prev->genl_sock, tmp, +- portid, group, flags); ++ portid, group, GFP_ATOMIC); + if (!err) + delivered = true; + else if (err != -ESRCH) +@@ -1474,26 +1470,30 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + + prev = net; + } ++ err = nlmsg_multicast(prev->genl_sock, skb, portid, group, GFP_ATOMIC); ++ ++ rcu_read_unlock(); + +- err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); + if (!err) + delivered = true; + else if (err != -ESRCH) + return err; + return delivered ? 0 : -ESRCH; + error: ++ rcu_read_unlock(); ++ + kfree_skb(skb); + return err; + } + + int genlmsg_multicast_allns(const struct genl_family *family, + struct sk_buff *skb, u32 portid, +- unsigned int group, gfp_t flags) ++ unsigned int group) + { + if (WARN_ON_ONCE(group >= family->n_mcgrps)) + return -EINVAL; + group = family->mcgrp_offset + group; +- return genlmsg_mcast(skb, portid, group, flags); ++ return genlmsg_mcast(skb, portid, group); + } + EXPORT_SYMBOL(genlmsg_multicast_allns); + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index d0e4845ea7018e..b4e405676600f4 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -780,7 +780,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) + drops = max_t(int, n, 0); + rcu_read_lock(); + while ((parentid = sch->parent)) { +- if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) ++ if (parentid == TC_H_ROOT) + break; + + if (sch->flags & TCQ_F_NOPARENT) +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 04ed23b5f21b42..16ab7b14806611 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1590,7 +1590,8 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, + + taprio_start_sched(sch, start, new_admin); + +- rcu_assign_pointer(q->admin_sched, new_admin); ++ admin = rcu_replace_pointer(q->admin_sched, new_admin, ++ lockdep_rtnl_is_held()); + if (admin) + call_rcu(&admin->rcu, taprio_free_sched_cb); + +diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c +index ed9cfa11b589fd..7824b32cdb66c9 100644 +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -744,7 +744,7 @@ static int smc_pnet_add_pnetid(struct net *net, u8 *pnetid) + + write_lock(&sn->pnetids_ndev.lock); + list_for_each_entry(pi, &sn->pnetids_ndev.list, list) { +- if (smc_pnet_match(pnetid, pe->pnetid)) { ++ if (smc_pnet_match(pnetid, pi->pnetid)) { + refcount_inc(&pi->refcnt); + kfree(pe); + goto unlock; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index a989231198fe94..93b89f835e38b3 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -15874,10 +15874,8 @@ void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, + + genlmsg_end(msg, hdr); + +- rcu_read_lock(); + genlmsg_multicast_allns(&nl80211_fam, msg, 0, +- NL80211_MCGRP_REGULATORY, GFP_ATOMIC); +- rcu_read_unlock(); ++ NL80211_MCGRP_REGULATORY); + + return; + +@@ -16385,10 +16383,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy, + + genlmsg_end(msg, hdr); + +- rcu_read_lock(); + genlmsg_multicast_allns(&nl80211_fam, msg, 0, +- NL80211_MCGRP_REGULATORY, GFP_ATOMIC); +- rcu_read_unlock(); ++ NL80211_MCGRP_REGULATORY); + + return; + +diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c +index 8b8e957a69c36e..4d13f7a372ab64 100644 +--- a/net/xfrm/xfrm_device.c ++++ b/net/xfrm/xfrm_device.c +@@ -241,6 +241,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, + + dev = dev_get_by_index(net, xuo->ifindex); + if (!dev) { ++ struct xfrm_dst_lookup_params params; ++ + if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) { + saddr = &x->props.saddr; + daddr = &x->id.daddr; +@@ -249,9 +251,12 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, + daddr = &x->props.saddr; + } + +- dst = __xfrm_dst_lookup(net, 0, 0, saddr, daddr, +- x->props.family, +- xfrm_smark_get(0, x)); ++ memset(¶ms, 0, sizeof(params)); ++ params.net = net; ++ params.saddr = saddr; ++ params.daddr = daddr; ++ params.mark = xfrm_smark_get(0, x); ++ dst = __xfrm_dst_lookup(x->props.family, ¶ms); + if (IS_ERR(dst)) + return 0; + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 39910d4eff62b7..a1a662a55c2ae4 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -251,10 +251,8 @@ static const struct xfrm_if_cb *xfrm_if_get_cb(void) + return rcu_dereference(xfrm_if_cb); + } + +-struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, +- const xfrm_address_t *saddr, +- const xfrm_address_t *daddr, +- int family, u32 mark) ++struct dst_entry *__xfrm_dst_lookup(int family, ++ const struct xfrm_dst_lookup_params *params) + { + const struct xfrm_policy_afinfo *afinfo; + struct dst_entry *dst; +@@ -263,7 +261,7 @@ struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, + if (unlikely(afinfo == NULL)) + return ERR_PTR(-EAFNOSUPPORT); + +- dst = afinfo->dst_lookup(net, tos, oif, saddr, daddr, mark); ++ dst = afinfo->dst_lookup(params); + + rcu_read_unlock(); + +@@ -277,6 +275,7 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, + xfrm_address_t *prev_daddr, + int family, u32 mark) + { ++ struct xfrm_dst_lookup_params params; + struct net *net = xs_net(x); + xfrm_address_t *saddr = &x->props.saddr; + xfrm_address_t *daddr = &x->id.daddr; +@@ -291,7 +290,29 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, + daddr = x->coaddr; + } + +- dst = __xfrm_dst_lookup(net, tos, oif, saddr, daddr, family, mark); ++ params.net = net; ++ params.saddr = saddr; ++ params.daddr = daddr; ++ params.tos = tos; ++ params.oif = oif; ++ params.mark = mark; ++ params.ipproto = x->id.proto; ++ if (x->encap) { ++ switch (x->encap->encap_type) { ++ case UDP_ENCAP_ESPINUDP: ++ params.ipproto = IPPROTO_UDP; ++ params.uli.ports.sport = x->encap->encap_sport; ++ params.uli.ports.dport = x->encap->encap_dport; ++ break; ++ case TCP_ENCAP_ESPINTCP: ++ params.ipproto = IPPROTO_TCP; ++ params.uli.ports.sport = x->encap->encap_sport; ++ params.uli.ports.dport = x->encap->encap_dport; ++ break; ++ } ++ } ++ ++ dst = __xfrm_dst_lookup(family, ¶ms); + + if (!IS_ERR(dst)) { + if (prev_saddr != saddr) +@@ -2344,15 +2365,15 @@ int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) + } + + static int +-xfrm_get_saddr(struct net *net, int oif, xfrm_address_t *local, +- xfrm_address_t *remote, unsigned short family, u32 mark) ++xfrm_get_saddr(unsigned short family, xfrm_address_t *saddr, ++ const struct xfrm_dst_lookup_params *params) + { + int err; + const struct xfrm_policy_afinfo *afinfo = xfrm_policy_get_afinfo(family); + + if (unlikely(afinfo == NULL)) + return -EINVAL; +- err = afinfo->get_saddr(net, oif, local, remote, mark); ++ err = afinfo->get_saddr(saddr, params); + rcu_read_unlock(); + return err; + } +@@ -2381,9 +2402,14 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, + remote = &tmpl->id.daddr; + local = &tmpl->saddr; + if (xfrm_addr_any(local, tmpl->encap_family)) { +- error = xfrm_get_saddr(net, fl->flowi_oif, +- &tmp, remote, +- tmpl->encap_family, 0); ++ struct xfrm_dst_lookup_params params; ++ ++ memset(¶ms, 0, sizeof(params)); ++ params.net = net; ++ params.oif = fl->flowi_oif; ++ params.daddr = remote; ++ error = xfrm_get_saddr(tmpl->encap_family, &tmp, ++ ¶ms); + if (error) + goto fail; + local = &tmp; +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 070946d093817d..e28e49499713f6 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -149,6 +149,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, + struct nlattr **attrs) + { + int err; ++ u16 family = p->sel.family; + + err = -EINVAL; + switch (p->family) { +@@ -167,7 +168,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, + goto out; + } + +- switch (p->sel.family) { ++ if (!family && !(p->flags & XFRM_STATE_AF_UNSPEC)) ++ family = p->family; ++ ++ switch (family) { + case AF_UNSPEC: + break; + +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index d893c2280f595e..7415f49a3d81eb 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -620,6 +620,13 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, + ssize_t length; + void *data = NULL; + ++ /* no partial writes */ ++ if (*ppos) ++ return -EINVAL; ++ /* no empty policies */ ++ if (!count) ++ return -EINVAL; ++ + mutex_lock(&fsi->state->policy_mutex); + + length = avc_has_perm(&selinux_state, +@@ -628,26 +635,21 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, + if (length) + goto out; + +- /* No partial writes. */ +- length = -EINVAL; +- if (*ppos != 0) +- goto out; +- +- length = -ENOMEM; + data = vmalloc(count); +- if (!data) ++ if (!data) { ++ length = -ENOMEM; + goto out; +- +- length = -EFAULT; +- if (copy_from_user(data, buf, count) != 0) ++ } ++ if (copy_from_user(data, buf, count) != 0) { ++ length = -EFAULT; + goto out; ++ } + + length = security_load_policy(fsi->state, data, count, &load_state); + if (length) { + pr_warn_ratelimited("SELinux: failed to load policy\n"); + goto out; + } +- + length = sel_make_policy_nodes(fsi, load_state.policy); + if (length) { + selinux_policy_cancel(fsi->state, &load_state); +@@ -655,13 +657,12 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, + } + + selinux_policy_commit(fsi->state, &load_state); +- + length = count; +- + audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, + "auid=%u ses=%u lsm=selinux res=1", + from_kuid(&init_user_ns, audit_get_loginuid(current)), + audit_get_sessionid(current)); ++ + out: + mutex_unlock(&fsi->state->policy_mutex); + vfree(data); +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 7a282d8e714854..bd272ab2048e4e 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -163,6 +163,9 @@ static int apply_constraint_to_size(struct snd_pcm_hw_params *params, + step = max(step, amdtp_syt_intervals[i]); + } + ++ if (step == 0) ++ return -EINVAL; ++ + t.min = roundup(s->min, step); + t.max = rounddown(s->max, step); + t.integer = 1; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 05a2442cfc656b..ae58718383e884 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3789,20 +3789,18 @@ static void alc_default_init(struct hda_codec *codec) + + hp_pin_sense = snd_hda_jack_detect(codec, hp_pin); + +- if (hp_pin_sense) ++ if (hp_pin_sense) { + msleep(2); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); +- +- if (hp_pin_sense) +- msleep(85); ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); ++ msleep(75); + +- if (hp_pin_sense) +- msleep(100); ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); ++ msleep(75); ++ } + } + + static void alc_default_shutup(struct hda_codec *codec) +@@ -3818,22 +3816,20 @@ static void alc_default_shutup(struct hda_codec *codec) + + hp_pin_sense = snd_hda_jack_detect(codec, hp_pin); + +- if (hp_pin_sense) ++ if (hp_pin_sense) { + msleep(2); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); +- +- if (hp_pin_sense) +- msleep(85); +- +- if (!spec->no_shutup_pins) + snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); + +- if (hp_pin_sense) +- msleep(100); ++ msleep(75); + ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ ++ msleep(75); ++ } + alc_auto_setup_eapd(codec, false); + alc_shutup_pins(codec); + } +@@ -6970,6 +6966,7 @@ enum { + ALC286_FIXUP_ACER_AIO_HEADSET_MIC, + ALC256_FIXUP_ASUS_HEADSET_MIC, + ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ ALC255_FIXUP_PREDATOR_SUBWOOFER, + ALC299_FIXUP_PREDATOR_SPK, + ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, + ALC289_FIXUP_DELL_SPK2, +@@ -8204,6 +8201,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, ++ [ALC255_FIXUP_PREDATOR_SUBWOOFER] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x17, 0x90170151 }, /* use as internal speaker (LFE) */ ++ { 0x1b, 0x90170152 } /* use as internal speaker (back) */ ++ } ++ }, + [ALC299_FIXUP_PREDATOR_SPK] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -8936,6 +8940,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1166, "Acer Veriton N4640G", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x1025, 0x1167, "Acer Veriton N6640G", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x1025, 0x1177, "Acer Predator G9-593", ALC255_FIXUP_PREDATOR_SUBWOOFER), ++ SND_PCI_QUIRK(0x1025, 0x1178, "Acer Predator G9-593", ALC255_FIXUP_PREDATOR_SUBWOOFER), + SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), + SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE), +diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c +index 4b026e1c3fe3e4..09445db29aa1f8 100644 +--- a/sound/soc/codecs/cs42l51.c ++++ b/sound/soc/codecs/cs42l51.c +@@ -754,8 +754,10 @@ int cs42l51_probe(struct device *dev, struct regmap *regmap) + + cs42l51->reset_gpio = devm_gpiod_get_optional(dev, "reset", + GPIOD_OUT_LOW); +- if (IS_ERR(cs42l51->reset_gpio)) +- return PTR_ERR(cs42l51->reset_gpio); ++ if (IS_ERR(cs42l51->reset_gpio)) { ++ ret = PTR_ERR(cs42l51->reset_gpio); ++ goto error; ++ } + + if (cs42l51->reset_gpio) { + dev_dbg(dev, "Release reset gpio\n"); +@@ -787,6 +789,7 @@ int cs42l51_probe(struct device *dev, struct regmap *regmap) + return 0; + + error: ++ gpiod_set_value_cansleep(cs42l51->reset_gpio, 1); + regulator_bulk_disable(ARRAY_SIZE(cs42l51->supplies), + cs42l51->supplies); + return ret; +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 03731d14d47574..998102711da096 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -490,6 +490,9 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + + val_cr4 |= FSL_SAI_CR4_FRSZ(slots); + ++ /* Set to avoid channel swap */ ++ val_cr4 |= FSL_SAI_CR4_FCONT; ++ + /* Set to output mode to avoid tri-stated data pins */ + if (tx) + val_cr4 |= FSL_SAI_CR4_CHMOD; +@@ -515,7 +518,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + FSL_SAI_CR3_TRCE((1 << pins) - 1)); + regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | +- FSL_SAI_CR4_CHMOD_MASK, ++ FSL_SAI_CR4_CHMOD_MASK | FSL_SAI_CR4_FCONT_MASK, + val_cr4); + regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs), + FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | +diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h +index 691847d54b17df..eff3b7b2dd3e85 100644 +--- a/sound/soc/fsl/fsl_sai.h ++++ b/sound/soc/fsl/fsl_sai.h +@@ -132,6 +132,7 @@ + + /* SAI Transmit and Receive Configuration 4 Register */ + ++#define FSL_SAI_CR4_FCONT_MASK BIT(28) + #define FSL_SAI_CR4_FCONT BIT(28) + #define FSL_SAI_CR4_FCOMB_SHIFT BIT(26) + #define FSL_SAI_CR4_FCOMB_SOFT BIT(27) +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index 9e70c193d7f415..2aef6213c654e9 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -946,6 +946,8 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev) + /* Allocation for i2sctl regmap fields */ + drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl), + GFP_KERNEL); ++ if (!drvdata->i2sctl) ++ return -ENOMEM; + + /* Initialize bitfields for dai I2SCTL register */ + ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl, +diff --git a/tools/testing/selftests/vm/hmm-tests.c b/tools/testing/selftests/vm/hmm-tests.c +index 426dccc08f9067..738c34eb50afc6 100644 +--- a/tools/testing/selftests/vm/hmm-tests.c ++++ b/tools/testing/selftests/vm/hmm-tests.c +@@ -1474,7 +1474,7 @@ TEST_F(hmm2, double_map) + + buffer->fd = -1; + buffer->size = size; +- buffer->mirror = malloc(npages); ++ buffer->mirror = malloc(size); + ASSERT_NE(buffer->mirror, NULL); + + /* Reserve a range of addresses. */ +diff --git a/tools/usb/usbip/src/usbip_detach.c b/tools/usb/usbip/src/usbip_detach.c +index aec993159036f9..bc663ca79c74d6 100644 +--- a/tools/usb/usbip/src/usbip_detach.c ++++ b/tools/usb/usbip/src/usbip_detach.c +@@ -68,6 +68,7 @@ static int detach_port(char *port) + } + + if (!found) { ++ ret = -1; + err("Invalid port %s > maxports %d", + port, vhci_driver->nports); + goto call_driver_close;
