commit: 0a53e909e5e248c76abbe3614ddc04b37a804191 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Nov 14 14:54:06 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Nov 14 14:54:06 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0a53e909
Linux patch 6.6.61 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1060_linux-6.6.61.patch | 3430 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3434 insertions(+) diff --git a/0000_README b/0000_README index ea33a378..021a41ee 100644 --- a/0000_README +++ b/0000_README @@ -283,6 +283,10 @@ Patch: 1059_linux-6.6.60.patch From: https://www.kernel.org Desc: Linux 6.6.60 +Patch: 1060_linux-6.6.61.patch +From: https://www.kernel.org +Desc: Linux 6.6.61 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch Desc: Enable link security restrictions by default. diff --git a/1060_linux-6.6.61.patch b/1060_linux-6.6.61.patch new file mode 100644 index 00000000..331fd049 --- /dev/null +++ b/1060_linux-6.6.61.patch @@ -0,0 +1,3430 @@ +diff --git a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +index 652d696bc9e90b..f0d98c47058562 100644 +--- a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml ++++ b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +@@ -61,7 +61,7 @@ properties: + - gmii + - rgmii + - sgmii +- - 1000BaseX ++ - 1000base-x + + xlnx,phy-type: + description: +diff --git a/Makefile b/Makefile +index bb406fea5217c8..e0bb5aaa7fed63 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 60 ++SUBLEVEL = 61 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts +index 67e1e04139e732..43926d0962bbdc 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts ++++ b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts +@@ -304,8 +304,8 @@ regulator-state-mem { + &i2c2 { + status = "okay"; + +- rt5616: rt5616@1b { +- compatible = "rt5616"; ++ rt5616: audio-codec@1b { ++ compatible = "realtek,rt5616"; + reg = <0x1b>; + clocks = <&cru SCLK_I2S_OUT>; + clock-names = "mclk"; +diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi +index c420c7c642cb0b..5bdbadd879fe88 100644 +--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi +@@ -382,12 +382,13 @@ reboot-mode { + }; + }; + +- acodec: acodec-ana@20030000 { +- compatible = "rk3036-codec"; ++ acodec: audio-codec@20030000 { ++ compatible = "rockchip,rk3036-codec"; + reg = <0x20030000 0x4000>; +- rockchip,grf = <&grf>; + clock-names = "acodec_pclk"; + clocks = <&cru PCLK_ACODEC>; ++ rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -397,7 +398,6 @@ hdmi: hdmi@20034000 { + interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&cru PCLK_HDMI>; + clock-names = "pclk"; +- rockchip,grf = <&grf>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_ctl>; + status = "disabled"; +@@ -550,11 +550,11 @@ i2c0: i2c@20072000 { + }; + + spi: spi@20074000 { +- compatible = "rockchip,rockchip-spi"; ++ compatible = "rockchip,rk3036-spi"; + reg = <0x20074000 0x1000>; + interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>; +- clock-names = "apb-pclk","spi_pclk"; ++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>; ++ clock-names = "spiclk", "apb_pclk"; + dmas = <&pdma 8>, <&pdma 9>; + dma-names = "tx", "rx"; + pinctrl-names = "default"; +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index eab866d6903347..658c6a61ab6fb8 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -2167,6 +2167,7 @@ config ARM64_SME + bool "ARM Scalable Matrix Extension support" + default y + depends on ARM64_SVE ++ depends on BROKEN + help + The Scalable Matrix Extension (SME) is an extension to the AArch64 + execution state which utilises a substantial subset of the SVE +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi +index c6540768bdb926..87211c18d65a95 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi +@@ -15,7 +15,7 @@ vpu: vpu@2c000000 { + mu_m0: mailbox@2d000000 { + compatible = "fsl,imx6sx-mu"; + reg = <0x2d000000 0x20000>; +- interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>; + #mbox-cells = <2>; + power-domains = <&pd IMX_SC_R_VPU_MU_0>; + status = "disabled"; +@@ -24,7 +24,7 @@ mu_m0: mailbox@2d000000 { + mu1_m0: mailbox@2d020000 { + compatible = "fsl,imx6sx-mu"; + reg = <0x2d020000 0x20000>; +- interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>; + #mbox-cells = <2>; + power-domains = <&pd IMX_SC_R_VPU_MU_1>; + status = "disabled"; +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index d1488ebfef3f02..69b213ed7a5943 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -1257,7 +1257,7 @@ usdhc1: mmc@30b40000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b40000 0x10000>; + interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC1_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -1271,7 +1271,7 @@ usdhc2: mmc@30b50000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b50000 0x10000>; + interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC2_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -1285,7 +1285,7 @@ usdhc3: mmc@30b60000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b60000 0x10000>; + interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC3_ROOT>; + clock-names = "ipg", "ahb", "per"; +diff --git a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi +new file mode 100644 +index 00000000000000..f81937b5fb720d +--- /dev/null ++++ b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi +@@ -0,0 +1,25 @@ ++// SPDX-License-Identifier: (GPL-2.0-or-later OR X11) ++/* ++ * Copyright 2023 TQ-Systems GmbH <[email protected]>, ++ * D-82229 Seefeld, Germany. ++ * Author: Alexander Stein ++ */ ++ ++&mu_m0 { ++ interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>; ++}; ++ ++&mu1_m0 { ++ interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>; ++}; ++ ++&vpu_core0 { ++ reg = <0x2d040000 0x10000>; ++}; ++ ++&vpu_core1 { ++ reg = <0x2d050000 0x10000>; ++}; ++ ++/delete-node/ &mu2_m0; ++/delete-node/ &vpu_core2; +diff --git a/arch/arm64/boot/dts/freescale/imx8qxp.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp.dtsi +index c80c85a4b40591..b155180cc249ba 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qxp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8qxp.dtsi +@@ -48,7 +48,6 @@ aliases { + serial3 = &lpuart3; + vpu-core0 = &vpu_core0; + vpu-core1 = &vpu_core1; +- vpu-core2 = &vpu_core2; + }; + + cpus { +@@ -317,6 +316,7 @@ map0 { + }; + + #include "imx8qxp-ss-img.dtsi" ++#include "imx8qxp-ss-vpu.dtsi" + #include "imx8qxp-ss-adma.dtsi" + #include "imx8qxp-ss-conn.dtsi" + #include "imx8qxp-ss-lsio.dtsi" +diff --git a/arch/arm64/boot/dts/rockchip/Makefile b/arch/arm64/boot/dts/rockchip/Makefile +index e7728007fd1bd8..259e59594bf204 100644 +--- a/arch/arm64/boot/dts/rockchip/Makefile ++++ b/arch/arm64/boot/dts/rockchip/Makefile +@@ -17,6 +17,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb ++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb + dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb +diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +index 12397755830bd5..5fcc5f32be2d79 100644 +--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +@@ -66,7 +66,6 @@ &emmc { + bus-width = <8>; + cap-mmc-highspeed; + mmc-hs200-1_8v; +- supports-emmc; + mmc-pwrseq = <&emmc_pwrseq>; + non-removable; + vmmc-supply = <&vcc_3v3>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +index 9232357f4fec9c..d9e191ad1d77e0 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +@@ -36,14 +36,14 @@ leds { + + power_led: led-0 { + label = "firefly:red:power"; +- linux,default-trigger = "ir-power-click"; ++ linux,default-trigger = "default-on"; + default-state = "on"; + gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>; + }; + + user_led: led-1 { + label = "firefly:blue:user"; +- linux,default-trigger = "ir-user-click"; ++ linux,default-trigger = "rc-feedback"; + default-state = "off"; + gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +new file mode 100644 +index 00000000000000..4b9ced67742d26 +--- /dev/null ++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * (C) Copyright 2018 FriendlyElec Computer Tech. Co., Ltd. ++ * (http://www.friendlyarm.com) ++ * ++ * (C) Copyright 2016 Rockchip Electronics Co., Ltd ++ */ ++ ++/dts-v1/; ++#include "rk3328-nanopi-r2s.dts" ++ ++/ { ++ compatible = "friendlyarm,nanopi-r2s-plus", "rockchip,rk3328"; ++ model = "FriendlyElec NanoPi R2S Plus"; ++ ++ aliases { ++ mmc1 = &emmc; ++ }; ++}; ++ ++&emmc { ++ bus-width = <8>; ++ cap-mmc-highspeed; ++ disable-wp; ++ mmc-hs200-1_8v; ++ non-removable; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>; ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 126165ba1ea260..5d47acbf4a2497 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -726,8 +726,7 @@ hdmi: hdmi@ff3c0000 { + compatible = "rockchip,rk3328-dw-hdmi"; + reg = <0x0 0xff3c0000 0x0 0x20000>; + reg-io-width = <4>; +- interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&cru PCLK_HDMI>, + <&cru SCLK_HDMI_SFC>, + <&cru SCLK_RTC32K>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +index 5753e57fd7161f..e8859cfd2d39b2 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +@@ -60,7 +60,6 @@ i2c_lvds_blc: i2c@0 { + fan: fan@18 { + compatible = "ti,amc6821"; + reg = <0x18>; +- #cooling-cells = <2>; + }; + + rtc_twi: rtc@6f { +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +index 6464ef4d113ddd..6c1043d678ddae 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +@@ -541,7 +541,7 @@ &i2c1 { + status = "okay"; + + rt5651: audio-codec@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts +index 61f3fec5a8b1d6..f4829b28c71e49 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts +@@ -138,7 +138,6 @@ vcc1v8_lcd: vcc1v8-lcd { + regulator-max-microvolt = <1800000>; + vin-supply = <&vcc3v3_sys>; + gpio = <&gpio3 RK_PA5 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; + }; + + /* MIPI DSI panel 2.8v supply */ +@@ -150,7 +149,6 @@ vcc2v8_lcd: vcc2v8-lcd { + regulator-max-microvolt = <2800000>; + vin-supply = <&vcc3v3_sys>; + gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; + }; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +index c920ddf44bafd0..55ac7145c08508 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +@@ -577,7 +577,7 @@ &uart0 { + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&rk808 1>; +- clock-names = "ext_clock"; ++ clock-names = "txco"; + device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index dbec2b7173a0b6..31ea3d0182c062 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -163,7 +163,7 @@ &i2c1 { + status = "okay"; + + rt5651: rt5651@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts +index 8aa93c646becfa..5f1b12166231f7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts +@@ -92,7 +92,7 @@ button-r2 { + }; + + &i2c2 { +- pintctrl-names = "default"; ++ pinctrl-names = "default"; + pinctrl-0 = <&i2c2m1_xfer>; + status = "okay"; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts +index f49ce29ba5977d..2957529a274861 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts +@@ -79,7 +79,7 @@ button-r2 { + }; + + &i2c2 { +- pintctrl-names = "default"; ++ pinctrl-names = "default"; + pinctrl-0 = <&i2c2m1_xfer>; + status = "okay"; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +index 0c18406e4c5973..7d468093382393 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +@@ -449,9 +449,9 @@ &uart1 { + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&pmucru CLK_RTC_32K>; +- clock-names = "ext_clock"; +- device-wake-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; +- host-wake-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; ++ clock-names = "txco"; ++ device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; ++ host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +index 6ecdf5d283390a..c1e611c040a2c4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts +@@ -508,7 +508,6 @@ &sdhci { + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; +- supports-emmc; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +index d899087bf0b559..9944c9d4ca9fe1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +@@ -683,11 +683,11 @@ bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&rk817 1>; + clock-names = "lpo"; +- device-wake-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>; +- host-wake-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>; ++ device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>; ++ host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>; + pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>; + pinctrl-names = "default"; ++ shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>; + vbat-supply = <&vcc_wl>; + vddio-supply = <&vcca_1v8_pmu>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +index 45de2630bb503a..1e36f73840dad2 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi +@@ -402,9 +402,9 @@ bluetooth { + clock-names = "lpo"; + device-wakeup-gpios = <&gpio2 RK_PB2 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>; ++ shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + vbat-supply = <&vcc_3v3>; + vddio-supply = <&vcc_1v8>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts +index a8a4cc190eb32e..abc33be2e74dc3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts +@@ -590,7 +590,6 @@ &sdhci { + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; +- supports-emmc; + status = "okay"; + }; + +diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c +index 5cdfcc9e3e54b9..0137d987631e08 100644 +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1445,6 +1445,7 @@ static void sve_init_regs(void) + } else { + fpsimd_to_sve(current); + current->thread.fp_type = FP_STATE_SVE; ++ fpsimd_flush_task_state(current); + } + } + +diff --git a/arch/arm64/kernel/smccc-call.S b/arch/arm64/kernel/smccc-call.S +index 487381164ff6b6..2def9d0dd3ddba 100644 +--- a/arch/arm64/kernel/smccc-call.S ++++ b/arch/arm64/kernel/smccc-call.S +@@ -7,48 +7,19 @@ + + #include <asm/asm-offsets.h> + #include <asm/assembler.h> +-#include <asm/thread_info.h> +- +-/* +- * If we have SMCCC v1.3 and (as is likely) no SVE state in +- * the registers then set the SMCCC hint bit to say there's no +- * need to preserve it. Do this by directly adjusting the SMCCC +- * function value which is already stored in x0 ready to be called. +- */ +-SYM_FUNC_START(__arm_smccc_sve_check) +- +- ldr_l x16, smccc_has_sve_hint +- cbz x16, 2f +- +- get_current_task x16 +- ldr x16, [x16, #TSK_TI_FLAGS] +- tbnz x16, #TIF_FOREIGN_FPSTATE, 1f // Any live FP state? +- tbnz x16, #TIF_SVE, 2f // Does that state include SVE? +- +-1: orr x0, x0, ARM_SMCCC_1_3_SVE_HINT +- +-2: ret +-SYM_FUNC_END(__arm_smccc_sve_check) +-EXPORT_SYMBOL(__arm_smccc_sve_check) + + .macro SMCCC instr +- stp x29, x30, [sp, #-16]! +- mov x29, sp +-alternative_if ARM64_SVE +- bl __arm_smccc_sve_check +-alternative_else_nop_endif + \instr #0 +- ldr x4, [sp, #16] ++ ldr x4, [sp] + stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS] + stp x2, x3, [x4, #ARM_SMCCC_RES_X2_OFFS] +- ldr x4, [sp, #24] ++ ldr x4, [sp, #8] + cbz x4, 1f /* no quirk structure */ + ldr x9, [x4, #ARM_SMCCC_QUIRK_ID_OFFS] + cmp x9, #ARM_SMCCC_QUIRK_QCOM_A6 + b.ne 1f + str x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS] +-1: ldp x29, x30, [sp], #16 +- ret ++1: ret + .endm + + /* +diff --git a/arch/riscv/purgatory/entry.S b/arch/riscv/purgatory/entry.S +index 0194f4554130ae..a4ede42bc15107 100644 +--- a/arch/riscv/purgatory/entry.S ++++ b/arch/riscv/purgatory/entry.S +@@ -11,6 +11,8 @@ + .macro size, sym:req + .size \sym, . - \sym + .endm ++#include <asm/asm.h> ++#include <linux/linkage.h> + + .text + +@@ -39,6 +41,7 @@ size purgatory_start + + .data + ++.align LGREG + .globl riscv_kernel_entry + riscv_kernel_entry: + .quad 0 +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index c15928b8c5cc99..dcf774d3edfe4c 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -305,7 +305,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister); + + static void scmi_device_release(struct device *dev) + { +- kfree(to_scmi_dev(dev)); ++ struct scmi_device *scmi_dev = to_scmi_dev(dev); ++ ++ kfree_const(scmi_dev->name); ++ kfree(scmi_dev); + } + + static void __scmi_device_destroy(struct scmi_device *scmi_dev) +@@ -318,7 +321,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev) + if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM) + atomic_set(&scmi_syspower_registered, 0); + +- kfree_const(scmi_dev->name); + ida_free(&scmi_bus_id, scmi_dev->id); + device_unregister(&scmi_dev->dev); + } +@@ -390,7 +392,6 @@ __scmi_device_create(struct device_node *np, struct device *parent, + + return scmi_dev; + put_dev: +- kfree_const(scmi_dev->name); + put_device(&scmi_dev->dev); + ida_free(&scmi_bus_id, id); + return NULL; +diff --git a/drivers/firmware/smccc/smccc.c b/drivers/firmware/smccc/smccc.c +index db818f9dcb8ee7..105cc7d9f4c352 100644 +--- a/drivers/firmware/smccc/smccc.c ++++ b/drivers/firmware/smccc/smccc.c +@@ -16,7 +16,6 @@ static u32 smccc_version = ARM_SMCCC_VERSION_1_0; + static enum arm_smccc_conduit smccc_conduit = SMCCC_CONDUIT_NONE; + + bool __ro_after_init smccc_trng_available = false; +-u64 __ro_after_init smccc_has_sve_hint = false; + s32 __ro_after_init smccc_soc_id_version = SMCCC_RET_NOT_SUPPORTED; + s32 __ro_after_init smccc_soc_id_revision = SMCCC_RET_NOT_SUPPORTED; + +@@ -28,9 +27,6 @@ void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit) + smccc_conduit = conduit; + + smccc_trng_available = smccc_probe_trng(); +- if (IS_ENABLED(CONFIG_ARM64_SVE) && +- smccc_version >= ARM_SMCCC_VERSION_1_3) +- smccc_has_sve_hint = true; + + if ((smccc_version >= ARM_SMCCC_VERSION_1_2) && + (smccc_conduit != SMCCC_CONDUIT_NONE)) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index fac204d6e0ea2c..12a0ac42fcfea4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -172,8 +172,8 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, + &buffer); + obj = (union acpi_object *)buffer.pointer; + +- /* Fail if calling the method fails and ATIF is supported */ +- if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { ++ /* Fail if calling the method fails */ ++ if (ACPI_FAILURE(status)) { + DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n", + acpi_format_exception(status)); + kfree(obj); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 1c2c9ff9d39df0..963e106d32eed0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -402,7 +402,7 @@ static ssize_t amdgpu_debugfs_gprwave_read(struct file *f, char __user *buf, siz + int r; + uint32_t *data, x; + +- if (size & 0x3 || *pos & 0x3) ++ if (size > 4096 || size & 0x3 || *pos & 0x3) + return -EINVAL; + + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); +@@ -1641,7 +1641,7 @@ int amdgpu_debugfs_regs_init(struct amdgpu_device *adev) + + for (i = 0; i < ARRAY_SIZE(debugfs_regs); i++) { + ent = debugfs_create_file(debugfs_regs_names[i], +- S_IFREG | 0444, root, ++ S_IFREG | 0400, root, + adev, debugfs_regs[i]); + if (!i && !IS_ERR_OR_NULL(ent)) + i_size_write(ent->d_inode, adev->rmmio_size); +@@ -2176,11 +2176,11 @@ int amdgpu_debugfs_init(struct amdgpu_device *adev) + amdgpu_securedisplay_debugfs_init(adev); + amdgpu_fw_attestation_debugfs_init(adev); + +- debugfs_create_file("amdgpu_evict_vram", 0444, root, adev, ++ debugfs_create_file("amdgpu_evict_vram", 0400, root, adev, + &amdgpu_evict_vram_fops); +- debugfs_create_file("amdgpu_evict_gtt", 0444, root, adev, ++ debugfs_create_file("amdgpu_evict_gtt", 0400, root, adev, + &amdgpu_evict_gtt_fops); +- debugfs_create_file("amdgpu_test_ib", 0444, root, adev, ++ debugfs_create_file("amdgpu_test_ib", 0400, root, adev, + &amdgpu_debugfs_test_ib_fops); + debugfs_create_file("amdgpu_vm_info", 0444, root, adev, + &amdgpu_debugfs_vm_info_fops); +diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +index 6c6f9d9b5d8978..fb20faa2c4ffb4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c ++++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +@@ -440,7 +440,7 @@ static bool __aqua_vanjaram_is_valid_mode(struct amdgpu_xcp_mgr *xcp_mgr, + case AMDGPU_SPX_PARTITION_MODE: + return adev->gmc.num_mem_partitions == 1 && num_xcc > 0; + case AMDGPU_DPX_PARTITION_MODE: +- return adev->gmc.num_mem_partitions != 8 && (num_xcc % 4) == 0; ++ return adev->gmc.num_mem_partitions <= 2 && (num_xcc % 4) == 0; + case AMDGPU_TPX_PARTITION_MODE: + return (adev->gmc.num_mem_partitions == 1 || + adev->gmc.num_mem_partitions == 3) && +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 85ddeb13a3fae8..1467c5a732db4f 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1875,7 +1875,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) + + u32 len = hid_report_len(report) + 7; + +- return kmalloc(len, flags); ++ return kzalloc(len, flags); + } + EXPORT_SYMBOL_GPL(hid_alloc_report_buf); + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index 58562700c85ee4..ced2fb4aeda8d3 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -442,7 +442,7 @@ int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev) + void __i2c_dw_disable(struct dw_i2c_dev *dev) + { + struct i2c_timings *t = &dev->timings; +- unsigned int raw_intr_stats; ++ unsigned int raw_intr_stats, ic_stats; + unsigned int enable; + int timeout = 100; + bool abort_needed; +@@ -450,9 +450,11 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev) + int ret; + + regmap_read(dev->map, DW_IC_RAW_INTR_STAT, &raw_intr_stats); ++ regmap_read(dev->map, DW_IC_STATUS, &ic_stats); + regmap_read(dev->map, DW_IC_ENABLE, &enable); + +- abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD; ++ abort_needed = (raw_intr_stats & DW_IC_INTR_MST_ON_HOLD) || ++ (ic_stats & DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY); + if (abort_needed) { + if (!(enable & DW_IC_ENABLE_ENABLE)) { + regmap_write(dev->map, DW_IC_ENABLE, DW_IC_ENABLE_ENABLE); +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 99d8c6bbc0320d..5eb130c1d67195 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -117,6 +117,7 @@ + #define DW_IC_STATUS_RFNE BIT(3) + #define DW_IC_STATUS_MASTER_ACTIVITY BIT(5) + #define DW_IC_STATUS_SLAVE_ACTIVITY BIT(6) ++#define DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY BIT(7) + + #define DW_IC_SDA_HOLD_RX_SHIFT 16 + #define DW_IC_SDA_HOLD_RX_MASK GENMASK(23, 16) +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index f59ac9586b7b1d..e7f000f90bb467 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -468,6 +468,13 @@ static int gic_irq_set_irqchip_state(struct irq_data *d, + } + + gic_poke_irq(d, reg); ++ ++ /* ++ * Force read-back to guarantee that the active state has taken ++ * effect, and won't race with a guest-driven deactivation. ++ */ ++ if (reg == GICD_ISACTIVER) ++ gic_peek_irq(d, reg); + return 0; + } + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 911f73f7ebbaa0..fb809b46d6aa76 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1909,16 +1909,13 @@ static void check_migrations(struct work_struct *ws) + * This function gets called on the error paths of the constructor, so we + * have to cope with a partially initialised struct. + */ +-static void destroy(struct cache *cache) ++static void __destroy(struct cache *cache) + { +- unsigned int i; +- + mempool_exit(&cache->migration_pool); + + if (cache->prison) + dm_bio_prison_destroy_v2(cache->prison); + +- cancel_delayed_work_sync(&cache->waker); + if (cache->wq) + destroy_workqueue(cache->wq); + +@@ -1946,13 +1943,22 @@ static void destroy(struct cache *cache) + if (cache->policy) + dm_cache_policy_destroy(cache->policy); + ++ bioset_exit(&cache->bs); ++ ++ kfree(cache); ++} ++ ++static void destroy(struct cache *cache) ++{ ++ unsigned int i; ++ ++ cancel_delayed_work_sync(&cache->waker); ++ + for (i = 0; i < cache->nr_ctr_args ; i++) + kfree(cache->ctr_args[i]); + kfree(cache->ctr_args); + +- bioset_exit(&cache->bs); +- +- kfree(cache); ++ __destroy(cache); + } + + static void cache_dtr(struct dm_target *ti) +@@ -2007,7 +2013,6 @@ struct cache_args { + sector_t cache_sectors; + + struct dm_dev *origin_dev; +- sector_t origin_sectors; + + uint32_t block_size; + +@@ -2088,6 +2093,7 @@ static int parse_cache_dev(struct cache_args *ca, struct dm_arg_set *as, + static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as, + char **error) + { ++ sector_t origin_sectors; + int r; + + if (!at_least_one_arg(as, error)) +@@ -2100,8 +2106,8 @@ static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as, + return r; + } + +- ca->origin_sectors = get_dev_size(ca->origin_dev); +- if (ca->ti->len > ca->origin_sectors) { ++ origin_sectors = get_dev_size(ca->origin_dev); ++ if (ca->ti->len > origin_sectors) { + *error = "Device size larger than cached device"; + return -EINVAL; + } +@@ -2411,7 +2417,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) + + ca->metadata_dev = ca->origin_dev = ca->cache_dev = NULL; + +- origin_blocks = cache->origin_sectors = ca->origin_sectors; ++ origin_blocks = cache->origin_sectors = ti->len; + origin_blocks = block_div(origin_blocks, ca->block_size); + cache->origin_blocks = to_oblock(origin_blocks); + +@@ -2565,7 +2571,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) + *result = cache; + return 0; + bad: +- destroy(cache); ++ __destroy(cache); + return r; + } + +@@ -2616,7 +2622,7 @@ static int cache_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3); + if (r) { +- destroy(cache); ++ __destroy(cache); + goto out; + } + +@@ -2899,19 +2905,19 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) + static bool can_resize(struct cache *cache, dm_cblock_t new_size) + { + if (from_cblock(new_size) > from_cblock(cache->cache_size)) { +- if (cache->sized) { +- DMERR("%s: unable to extend cache due to missing cache table reload", +- cache_device_name(cache)); +- return false; +- } ++ DMERR("%s: unable to extend cache due to missing cache table reload", ++ cache_device_name(cache)); ++ return false; + } + + /* + * We can't drop a dirty block when shrinking the cache. + */ +- while (from_cblock(new_size) < from_cblock(cache->cache_size)) { +- new_size = to_cblock(from_cblock(new_size) + 1); +- if (is_dirty(cache, new_size)) { ++ if (cache->loaded_mappings) { ++ new_size = to_cblock(find_next_bit(cache->dirty_bitset, ++ from_cblock(cache->cache_size), ++ from_cblock(new_size))); ++ if (new_size != cache->cache_size) { + DMERR("%s: unable to shrink cache; cache block %llu is dirty", + cache_device_name(cache), + (unsigned long long) from_cblock(new_size)); +@@ -2947,20 +2953,15 @@ static int cache_preresume(struct dm_target *ti) + /* + * Check to see if the cache has resized. + */ +- if (!cache->sized) { +- r = resize_cache_dev(cache, csize); +- if (r) +- return r; +- +- cache->sized = true; +- +- } else if (csize != cache->cache_size) { ++ if (!cache->sized || csize != cache->cache_size) { + if (!can_resize(cache, csize)) + return -EINVAL; + + r = resize_cache_dev(cache, csize); + if (r) + return r; ++ ++ cache->sized = true; + } + + if (!cache->loaded_mappings) { +diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c +index 48587c16c44570..e8a9432057dce1 100644 +--- a/drivers/md/dm-unstripe.c ++++ b/drivers/md/dm-unstripe.c +@@ -85,8 +85,8 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv) + } + uc->physical_start = start; + +- uc->unstripe_offset = uc->unstripe * uc->chunk_size; +- uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size; ++ uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size; ++ uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size; + uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0; + + tmp_len = ti->len; +diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/usb/pulse8/pulse8-cec.c +index ba67587bd43ec0..171366fe35443b 100644 +--- a/drivers/media/cec/usb/pulse8/pulse8-cec.c ++++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c +@@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio, + err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4); + if (err) + return err; +- date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; ++ date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; + dev_info(pulse8->dev, "Firmware build date %ptT\n", &date); + + dev_dbg(pulse8->dev, "Persistent config:\n"); +diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +index 642c48e8c1f584..ded11cd8dbf7c6 100644 +--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c ++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +@@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg) + unsigned p; + unsigned x; + ++ if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width)) ++ return; ++ + switch (tpg->pattern) { + case TPG_PAT_GREEN: + contrast = TPG_COLOR_100_RED; +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index 93d3378a0df4b8..344dc9dc6613fa 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -443,8 +443,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra + + default: + fepriv->auto_step++; +- fepriv->auto_sub_step = -1; /* it'll be incremented to 0 in a moment */ +- break; ++ fepriv->auto_sub_step = 0; ++ continue; + } + + if (!ready) fepriv->auto_sub_step++; +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index b43695bc51e754..14f323fbada719 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -86,10 +86,15 @@ static DECLARE_RWSEM(minor_rwsem); + static int dvb_device_open(struct inode *inode, struct file *file) + { + struct dvb_device *dvbdev; ++ unsigned int minor = iminor(inode); ++ ++ if (minor >= MAX_DVB_MINORS) ++ return -ENODEV; + + mutex_lock(&dvbdev_mutex); + down_read(&minor_rwsem); +- dvbdev = dvb_minors[iminor(inode)]; ++ ++ dvbdev = dvb_minors[minor]; + + if (dvbdev && dvbdev->fops) { + int err = 0; +@@ -525,7 +530,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + for (minor = 0; minor < MAX_DVB_MINORS; minor++) + if (!dvb_minors[minor]) + break; +- if (minor == MAX_DVB_MINORS) { ++ if (minor >= MAX_DVB_MINORS) { + if (new_node) { + list_del(&new_node->list_head); + kfree(dvbdevfops); +@@ -540,6 +545,14 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + } + #else + minor = nums2minor(adap->num, type, id); ++ if (minor >= MAX_DVB_MINORS) { ++ dvb_media_device_free(dvbdev); ++ list_del(&dvbdev->list_head); ++ kfree(dvbdev); ++ *pdvbdev = NULL; ++ mutex_unlock(&dvbdev_register_lock); ++ return ret; ++ } + #endif + dvbdev->minor = minor; + dvb_minors[minor] = dvb_device_get(dvbdev); +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index 8b978a9f74a4e5..f5dd3a81725a72 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -741,6 +741,7 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr) + { + struct cx24116_state *state = fe->demodulator_priv; + u8 snr_reading; ++ int ret; + static const u32 snr_tab[] = { /* 10 x Table (rounded up) */ + 0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667, + 0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667, +@@ -749,7 +750,11 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr) + + dprintk("%s()\n", __func__); + +- snr_reading = cx24116_readreg(state, CX24116_REG_QUALITY0); ++ ret = cx24116_readreg(state, CX24116_REG_QUALITY0); ++ if (ret < 0) ++ return ret; ++ ++ snr_reading = ret; + + if (snr_reading >= 0xa0 /* 100% */) + *snr = 0xffff; +diff --git a/drivers/media/dvb-frontends/stb0899_algo.c b/drivers/media/dvb-frontends/stb0899_algo.c +index df89c33dac23c5..40537c4ccb0d75 100644 +--- a/drivers/media/dvb-frontends/stb0899_algo.c ++++ b/drivers/media/dvb-frontends/stb0899_algo.c +@@ -269,7 +269,7 @@ static enum stb0899_status stb0899_search_carrier(struct stb0899_state *state) + + short int derot_freq = 0, last_derot_freq = 0, derot_limit, next_loop = 3; + int index = 0; +- u8 cfr[2]; ++ u8 cfr[2] = {0}; + u8 reg; + + internal->status = NOCARRIER; +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index b202a85fbeaa04..d1609bd8f0485a 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2519,10 +2519,10 @@ static int adv76xx_log_status(struct v4l2_subdev *sd) + const struct adv76xx_chip_info *info = state->info; + struct v4l2_dv_timings timings; + struct stdi_readback stdi; +- u8 reg_io_0x02 = io_read(sd, 0x02); ++ int ret; ++ u8 reg_io_0x02; + u8 edid_enabled; + u8 cable_det; +- + static const char * const csc_coeff_sel_rb[16] = { + "bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB", + "reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709", +@@ -2621,13 +2621,21 @@ static int adv76xx_log_status(struct v4l2_subdev *sd) + v4l2_info(sd, "-----Color space-----\n"); + v4l2_info(sd, "RGB quantization range ctrl: %s\n", + rgb_quantization_range_txt[state->rgb_quantization_range]); +- v4l2_info(sd, "Input color space: %s\n", +- input_color_space_txt[reg_io_0x02 >> 4]); +- v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", +- (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", +- (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? +- "(16-235)" : "(0-255)", +- (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); ++ ++ ret = io_read(sd, 0x02); ++ if (ret < 0) { ++ v4l2_info(sd, "Can't read Input/Output color space\n"); ++ } else { ++ reg_io_0x02 = ret; ++ ++ v4l2_info(sd, "Input color space: %s\n", ++ input_color_space_txt[reg_io_0x02 >> 4]); ++ v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", ++ (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", ++ (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? ++ "(16-235)" : "(0-255)", ++ (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); ++ } + v4l2_info(sd, "Color space conversion: %s\n", + csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]); + +diff --git a/drivers/media/i2c/ar0521.c b/drivers/media/i2c/ar0521.c +index 375284a59fd1ce..60ab433cafb114 100644 +--- a/drivers/media/i2c/ar0521.c ++++ b/drivers/media/i2c/ar0521.c +@@ -257,10 +257,10 @@ static u32 calc_pll(struct ar0521_dev *sensor, u32 freq, u16 *pre_ptr, u16 *mult + continue; /* Minimum value */ + if (new_mult > 254) + break; /* Maximum, larger pre won't work either */ +- if (sensor->extclk_freq * (u64)new_mult < AR0521_PLL_MIN * ++ if (sensor->extclk_freq * (u64)new_mult < (u64)AR0521_PLL_MIN * + new_pre) + continue; +- if (sensor->extclk_freq * (u64)new_mult > AR0521_PLL_MAX * ++ if (sensor->extclk_freq * (u64)new_mult > (u64)AR0521_PLL_MAX * + new_pre) + break; /* Larger pre won't work either */ + new_pll = div64_round_up(sensor->extclk_freq * (u64)new_mult, +diff --git a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c +index d2c4a0178b3c5c..1db4609b35574f 100644 +--- a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c +@@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; + jpeg_buffer.curr = 0; + +- word = 0; +- + if (get_word_be(&jpeg_buffer, &word)) + return; +- jpeg_buffer.size = (long)word - 2; ++ ++ if (word < 2) ++ jpeg_buffer.size = 0; ++ else ++ jpeg_buffer.size = (long)word - 2; ++ + jpeg_buffer.data += 2; + jpeg_buffer.curr = 0; + +@@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) + if (byte == -1) + return -1; + *word = (unsigned int)byte | temp; ++ + return 0; + } + +@@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + sof = jpeg_buffer.curr; /* after 0xffc0 */ + sof_len = length; +@@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + if (n_dqt >= S5P_JPEG_MAX_MARKER) + return false; +@@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + if (n_dht >= S5P_JPEG_MAX_MARKER) + return false; +@@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; ++ /* No need to check underflows as skip() does it */ + skip(&jpeg_buffer, length); + break; + } +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 04e7f58553db1d..37d75bc97fd8dc 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -371,7 +371,7 @@ static int uvc_parse_format(struct uvc_device *dev, + * Parse the frame descriptors. Only uncompressed, MJPEG and frame + * based formats have frame descriptors. + */ +- while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && ++ while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && + buffer[2] == ftype) { + unsigned int maxIntervalIndex; + +diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-core/v4l2-ctrls-api.c +index 002ea6588edf16..64b0c3ef27f5e5 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls-api.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c +@@ -753,9 +753,10 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c) + for (i = 0; i < master->ncontrols; i++) + cur_to_new(master->cluster[i]); + ret = call_op(master, g_volatile_ctrl); +- new_to_user(c, ctrl); ++ if (!ret) ++ ret = new_to_user(c, ctrl); + } else { +- cur_to_user(c, ctrl); ++ ret = cur_to_user(c, ctrl); + } + v4l2_ctrl_unlock(master); + return ret; +@@ -770,7 +771,10 @@ int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control) + if (!ctrl || !ctrl->is_int) + return -EINVAL; + ret = get_ctrl(ctrl, &c); +- control->value = c.value; ++ ++ if (!ret) ++ control->value = c.value; ++ + return ret; + } + EXPORT_SYMBOL(v4l2_g_ctrl); +@@ -811,10 +815,11 @@ static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, + int ret; + + v4l2_ctrl_lock(ctrl); +- user_to_new(c, ctrl); +- ret = set_ctrl(fh, ctrl, 0); ++ ret = user_to_new(c, ctrl); ++ if (!ret) ++ ret = set_ctrl(fh, ctrl, 0); + if (!ret) +- cur_to_user(c, ctrl); ++ ret = cur_to_user(c, ctrl); + v4l2_ctrl_unlock(ctrl); + return ret; + } +diff --git a/drivers/net/can/c_can/c_can_main.c b/drivers/net/can/c_can/c_can_main.c +index c63f7fc1e69177..511615dc334196 100644 +--- a/drivers/net/can/c_can/c_can_main.c ++++ b/drivers/net/can/c_can/c_can_main.c +@@ -1011,7 +1011,6 @@ static int c_can_handle_bus_err(struct net_device *dev, + + /* common for all type of bus errors */ + priv->can.can_stats.bus_error++; +- stats->rx_errors++; + + /* propagate the error condition to the CAN stack */ + skb = alloc_can_err_skb(dev, &cf); +@@ -1027,26 +1026,32 @@ static int c_can_handle_bus_err(struct net_device *dev, + case LEC_STUFF_ERROR: + netdev_dbg(dev, "stuff error\n"); + cf->data[2] |= CAN_ERR_PROT_STUFF; ++ stats->rx_errors++; + break; + case LEC_FORM_ERROR: + netdev_dbg(dev, "form error\n"); + cf->data[2] |= CAN_ERR_PROT_FORM; ++ stats->rx_errors++; + break; + case LEC_ACK_ERROR: + netdev_dbg(dev, "ack error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_ACK; ++ stats->tx_errors++; + break; + case LEC_BIT1_ERROR: + netdev_dbg(dev, "bit1 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT1; ++ stats->tx_errors++; + break; + case LEC_BIT0_ERROR: + netdev_dbg(dev, "bit0 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT0; ++ stats->tx_errors++; + break; + case LEC_CRC_ERROR: + netdev_dbg(dev, "CRC error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ; ++ stats->rx_errors++; + break; + default: + break; +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 97666a7595959d..ec6e740b032474 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1600,7 +1600,8 @@ static int m_can_close(struct net_device *dev) + netif_stop_queue(dev); + + m_can_stop(dev); +- free_irq(dev->irq, dev); ++ if (dev->irq) ++ free_irq(dev->irq, dev); + + if (cdev->is_peripheral) { + cdev->tx_skb = NULL; +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c +index 83c18035b2a24d..4ea01d3d36d56a 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c +@@ -2,7 +2,7 @@ + // + // mcp251xfd - Microchip MCP251xFD Family CAN controller driver + // +-// Copyright (c) 2019, 2020, 2021 Pengutronix, ++// Copyright (c) 2019, 2020, 2021, 2024 Pengutronix, + // Marc Kleine-Budde <[email protected]> + // + // Based on: +@@ -483,9 +483,11 @@ int mcp251xfd_ring_alloc(struct mcp251xfd_priv *priv) + }; + const struct ethtool_coalesce ec = { + .rx_coalesce_usecs_irq = priv->rx_coalesce_usecs_irq, +- .rx_max_coalesced_frames_irq = priv->rx_obj_num_coalesce_irq, ++ .rx_max_coalesced_frames_irq = priv->rx_obj_num_coalesce_irq == 0 ? ++ 1 : priv->rx_obj_num_coalesce_irq, + .tx_coalesce_usecs_irq = priv->tx_coalesce_usecs_irq, +- .tx_max_coalesced_frames_irq = priv->tx_obj_num_coalesce_irq, ++ .tx_max_coalesced_frames_irq = priv->tx_obj_num_coalesce_irq == 0 ? ++ 1 : priv->tx_obj_num_coalesce_irq, + }; + struct can_ram_layout layout; + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c +index f732556d233a7b..d3ac865933fdf6 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c +@@ -16,9 +16,9 @@ + + #include "mcp251xfd.h" + +-static inline bool mcp251xfd_tx_fifo_sta_full(u32 fifo_sta) ++static inline bool mcp251xfd_tx_fifo_sta_empty(u32 fifo_sta) + { +- return !(fifo_sta & MCP251XFD_REG_FIFOSTA_TFNRFNIF); ++ return fifo_sta & MCP251XFD_REG_FIFOSTA_TFERFFIF; + } + + static inline int +@@ -122,7 +122,11 @@ mcp251xfd_get_tef_len(struct mcp251xfd_priv *priv, u8 *len_p) + if (err) + return err; + +- if (mcp251xfd_tx_fifo_sta_full(fifo_sta)) { ++ /* If the chip says the TX-FIFO is empty, but there are no TX ++ * buffers free in the ring, we assume all have been sent. ++ */ ++ if (mcp251xfd_tx_fifo_sta_empty(fifo_sta) && ++ mcp251xfd_get_tx_free(tx_ring) == 0) { + *len_p = tx_ring->obj_num; + return 0; + } +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index 31ee477dd131e8..8283aeee35fb6d 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -111,6 +111,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -140,7 +141,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + stats->tx_bytes += skb->len; + } + +- dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), DMA_TO_DEVICE); + + /* return the sk_buff to system */ +@@ -174,6 +175,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + static int arc_emac_rx(struct net_device *ndev, int budget) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int work_done; + + for (work_done = 0; work_done < budget; work_done++) { +@@ -223,9 +225,9 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, ++ addr = dma_map_single(dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + if (net_ratelimit()) + netdev_err(ndev, "cannot map dma buffer\n"); + dev_kfree_skb(skb); +@@ -237,7 +239,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + } + + /* unmap previosly mapped skb */ +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); + + pktlen = info & LEN_MASK; +@@ -423,6 +425,7 @@ static int arc_emac_open(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct phy_device *phy_dev = ndev->phydev; ++ struct device *dev = ndev->dev.parent; + int i; + + phy_dev->autoneg = AUTONEG_ENABLE; +@@ -445,9 +448,9 @@ static int arc_emac_open(struct net_device *ndev) + if (unlikely(!rx_buff->skb)) + return -ENOMEM; + +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(dev, (void *)rx_buff->skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + netdev_err(ndev, "cannot dma map\n"); + dev_kfree_skb(rx_buff->skb); + return -ENOMEM; +@@ -548,6 +551,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev) + static void arc_free_tx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -555,7 +559,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + struct buffer_state *tx_buff = &priv->tx_buff[i]; + + if (tx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), + DMA_TO_DEVICE); +@@ -579,6 +583,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + static void arc_free_rx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < RX_BD_NUM; i++) { +@@ -586,7 +591,7 @@ static void arc_free_rx_queue(struct net_device *ndev) + struct buffer_state *rx_buff = &priv->rx_buff[i]; + + if (rx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), + DMA_FROM_DEVICE); +@@ -679,6 +684,7 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + unsigned int len, *txbd_curr = &priv->txbd_curr; + struct net_device_stats *stats = &ndev->stats; + __le32 *info = &priv->txbd[*txbd_curr].info; ++ struct device *dev = ndev->dev.parent; + dma_addr_t addr; + + if (skb_padto(skb, ETH_ZLEN)) +@@ -692,10 +698,9 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + return NETDEV_TX_BUSY; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, len, +- DMA_TO_DEVICE); ++ addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(&ndev->dev, addr))) { ++ if (unlikely(dma_mapping_error(dev, addr))) { + stats->tx_dropped++; + stats->tx_errors++; + dev_kfree_skb_any(skb); +diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c +index 87f40c2ba90404..078b1a72c16135 100644 +--- a/drivers/net/ethernet/arc/emac_mdio.c ++++ b/drivers/net/ethernet/arc/emac_mdio.c +@@ -133,6 +133,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + struct arc_emac_mdio_bus_data *data = &priv->bus_data; + struct device_node *np = priv->dev->of_node; + const char *name = "Synopsys MII Bus"; ++ struct device_node *mdio_node; + struct mii_bus *bus; + int error; + +@@ -164,7 +165,13 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + + snprintf(bus->id, MII_BUS_ID_SIZE, "%s", bus->name); + +- error = of_mdiobus_register(bus, priv->dev->of_node); ++ /* Backwards compatibility for EMAC nodes without MDIO subnode. */ ++ mdio_node = of_get_child_by_name(np, "mdio"); ++ if (!mdio_node) ++ mdio_node = of_node_get(np); ++ ++ error = of_mdiobus_register(bus, mdio_node); ++ of_node_put(mdio_node); + if (error) { + mdiobus_free(bus); + return dev_err_probe(priv->dev, error, +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index c153dc083aff0f..a856047f1dfd6b 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -665,19 +665,11 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) + + if (!num_vfs) { + enetc_msg_psi_free(pf); +- kfree(pf->vf_state); + pf->num_vfs = 0; + pci_disable_sriov(pdev); + } else { + pf->num_vfs = num_vfs; + +- pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state), +- GFP_KERNEL); +- if (!pf->vf_state) { +- pf->num_vfs = 0; +- return -ENOMEM; +- } +- + err = enetc_msg_psi_init(pf); + if (err) { + dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err); +@@ -696,7 +688,6 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) + err_en_sriov: + enetc_msg_psi_free(pf); + err_msg_psi: +- kfree(pf->vf_state); + pf->num_vfs = 0; + + return err; +@@ -1283,6 +1274,12 @@ static int enetc_pf_probe(struct pci_dev *pdev, + pf = enetc_si_priv(si); + pf->si = si; + pf->total_vfs = pci_sriov_get_totalvfs(pdev); ++ if (pf->total_vfs) { ++ pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state), ++ GFP_KERNEL); ++ if (!pf->vf_state) ++ goto err_alloc_vf_state; ++ } + + err = enetc_setup_mac_addresses(node, pf); + if (err) +@@ -1360,6 +1357,8 @@ static int enetc_pf_probe(struct pci_dev *pdev, + free_netdev(ndev); + err_alloc_netdev: + err_setup_mac_addresses: ++ kfree(pf->vf_state); ++err_alloc_vf_state: + enetc_psi_destroy(pdev); + err_psi_create: + return err; +@@ -1386,6 +1385,7 @@ static void enetc_pf_remove(struct pci_dev *pdev) + enetc_free_si_resources(priv); + + free_netdev(si->ndev); ++ kfree(pf->vf_state); + + enetc_psi_destroy(pdev); + } +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index dfcaac302e2451..b15db70769e5ee 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -78,11 +78,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct sockaddr *saddr = addr; ++ int err; + + if (!is_valid_ether_addr(saddr->sa_data)) + return -EADDRNOTAVAIL; + +- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ if (err) ++ return err; ++ ++ eth_hw_addr_set(ndev, saddr->sa_data); ++ ++ return 0; + } + + static int enetc_vf_set_features(struct net_device *ndev, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 67b0bf310daaaf..9a63fbc6940831 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo) + pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev); + if (!pci_id) + continue; +- if (IS_ENABLED(CONFIG_PCI_IOV)) ++ if (IS_ENABLED(CONFIG_PCI_IOV)) { ++ device_lock(&ae_dev->pdev->dev); + pci_disable_sriov(ae_dev->pdev); ++ device_unlock(&ae_dev->pdev->dev); ++ } + } + } + EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index ce227b56cf7243..2f9655cf5dd9ee 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1205,12 +1205,10 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx) + if (ret_val) + goto out; + +- if (hw->mac.type != e1000_pch_mtp) { +- ret_val = e1000e_force_smbus(hw); +- if (ret_val) { +- e_dbg("Failed to force SMBUS: %d\n", ret_val); +- goto release; +- } ++ ret_val = e1000e_force_smbus(hw); ++ if (ret_val) { ++ e_dbg("Failed to force SMBUS: %d\n", ret_val); ++ goto release; + } + + /* Si workaround for ULP entry flow on i127/rev6 h/w. Enable +@@ -1273,13 +1271,6 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx) + } + + release: +- if (hw->mac.type == e1000_pch_mtp) { +- ret_val = e1000e_force_smbus(hw); +- if (ret_val) +- e_dbg("Failed to force SMBUS over MTL system: %d\n", +- ret_val); +- } +- + hw->phy.ops.release(hw); + out: + if (ret_val) +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 3e6839ac1f0f1e..68f403dd2f5267 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -763,6 +763,7 @@ enum i40e_filter_state { + I40E_FILTER_ACTIVE, /* Added to switch by FW */ + I40E_FILTER_FAILED, /* Rejected by FW */ + I40E_FILTER_REMOVE, /* To be removed */ ++ I40E_FILTER_NEW_SYNC, /* New, not sent yet, is in i40e_sync_vsi_filters() */ + /* There is no 'removed' state; the filter struct is freed */ + }; + struct i40e_mac_filter { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +index 999c9708def533..a2fca58a91c332 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -106,6 +106,7 @@ static char *i40e_filter_state_string[] = { + "ACTIVE", + "FAILED", + "REMOVE", ++ "NEW_SYNC", + }; + + /** +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 80472aa1deba4e..806cec458a0726 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1265,6 +1265,7 @@ int i40e_count_filters(struct i40e_vsi *vsi) + + hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) { + if (f->state == I40E_FILTER_NEW || ++ f->state == I40E_FILTER_NEW_SYNC || + f->state == I40E_FILTER_ACTIVE) + ++cnt; + } +@@ -1451,6 +1452,8 @@ static int i40e_correct_mac_vlan_filters(struct i40e_vsi *vsi, + + new->f = add_head; + new->state = add_head->state; ++ if (add_head->state == I40E_FILTER_NEW) ++ add_head->state = I40E_FILTER_NEW_SYNC; + + /* Add the new filter to the tmp list */ + hlist_add_head(&new->hlist, tmp_add_list); +@@ -1560,6 +1563,8 @@ static int i40e_correct_vf_mac_vlan_filters(struct i40e_vsi *vsi, + return -ENOMEM; + new_mac->f = add_head; + new_mac->state = add_head->state; ++ if (add_head->state == I40E_FILTER_NEW) ++ add_head->state = I40E_FILTER_NEW_SYNC; + + /* Add the new filter to the tmp list */ + hlist_add_head(&new_mac->hlist, tmp_add_list); +@@ -2445,7 +2450,8 @@ static int + i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name, + struct i40e_mac_filter *f) + { +- bool enable = f->state == I40E_FILTER_NEW; ++ bool enable = f->state == I40E_FILTER_NEW || ++ f->state == I40E_FILTER_NEW_SYNC; + struct i40e_hw *hw = &vsi->back->hw; + int aq_ret; + +@@ -2619,6 +2625,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + + /* Add it to the hash list */ + hlist_add_head(&new->hlist, &tmp_add_list); ++ f->state = I40E_FILTER_NEW_SYNC; + } + + /* Count the number of active (current and new) VLAN +@@ -2770,7 +2777,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + spin_lock_bh(&vsi->mac_filter_hash_lock); + hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) { + /* Only update the state if we're still NEW */ +- if (new->f->state == I40E_FILTER_NEW) ++ if (new->f->state == I40E_FILTER_NEW || ++ new->f->state == I40E_FILTER_NEW_SYNC) + new->f->state = new->state; + hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +index 1839a37139dc16..b6bbf2376ef5c1 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +@@ -1694,11 +1694,12 @@ static int + ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp, + struct ice_fdir_fltr *input) + { +- u16 dest_vsi, q_index = 0; ++ s16 q_index = ICE_FDIR_NO_QUEUE_IDX; + u16 orig_q_index = 0; + struct ice_pf *pf; + struct ice_hw *hw; + int flow_type; ++ u16 dest_vsi; + u8 dest_ctl; + + if (!vsi || !fsp || !input) +diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.h b/drivers/net/ethernet/intel/ice/ice_fdir.h +index b384d2a4ab1981..063ea3d5165327 100644 +--- a/drivers/net/ethernet/intel/ice/ice_fdir.h ++++ b/drivers/net/ethernet/intel/ice/ice_fdir.h +@@ -50,6 +50,8 @@ + */ + #define ICE_FDIR_IPV4_PKT_FLAG_MF 0x20 + ++#define ICE_FDIR_NO_QUEUE_IDX -1 ++ + enum ice_fltr_prgm_desc_dest { + ICE_FLTR_PRGM_DESC_DEST_DROP_PKT, + ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX, +@@ -181,7 +183,7 @@ struct ice_fdir_fltr { + u16 flex_fltr; + + /* filter control */ +- u16 q_index; ++ s16 q_index; + u16 orig_q_index; + u16 dest_vsi; + u8 dest_ctl; +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +index 35099ad5eccc8c..f49b697ab00f89 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +@@ -385,6 +385,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + err_out_pci: + ionic_dev_teardown(ionic); + ionic_clear_pci(ionic); ++ ionic_debugfs_del_dev(ionic); + err_out: + mutex_destroy(&ionic->dev_cmd_lock); + ionic_devlink_free(ionic); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index a116423adb30a3..853851d5f3620f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3678,6 +3678,7 @@ static int stmmac_request_irq_single(struct net_device *dev) + /* Request the Wake IRQ in case of another line + * is used for WoL + */ ++ priv->wol_irq_disabled = true; + if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) { + ret = request_irq(priv->wol_irq, stmmac_interrupt, + IRQF_SHARED, dev->name, dev); +diff --git a/drivers/net/ethernet/vertexcom/mse102x.c b/drivers/net/ethernet/vertexcom/mse102x.c +index aeed2a093e3411..dd766e175f7dbd 100644 +--- a/drivers/net/ethernet/vertexcom/mse102x.c ++++ b/drivers/net/ethernet/vertexcom/mse102x.c +@@ -222,7 +222,7 @@ static int mse102x_tx_frame_spi(struct mse102x_net *mse, struct sk_buff *txp, + struct mse102x_net_spi *mses = to_mse102x_spi(mse); + struct spi_transfer *xfer = &mses->spi_xfer; + struct spi_message *msg = &mses->spi_msg; +- struct sk_buff *tskb; ++ struct sk_buff *tskb = NULL; + int ret; + + netif_dbg(mse, tx_queued, mse->ndev, "%s: skb %p, %d@%p\n", +@@ -235,7 +235,6 @@ static int mse102x_tx_frame_spi(struct mse102x_net *mse, struct sk_buff *txp, + if (!tskb) + return -ENOMEM; + +- dev_kfree_skb(txp); + txp = tskb; + } + +@@ -257,6 +256,8 @@ static int mse102x_tx_frame_spi(struct mse102x_net *mse, struct sk_buff *txp, + mse->stats.xfer_err++; + } + ++ dev_kfree_skb(tskb); ++ + return ret; + } + +diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c +index 937061acfc613a..351411f0aa6f47 100644 +--- a/drivers/net/phy/dp83848.c ++++ b/drivers/net/phy/dp83848.c +@@ -147,6 +147,8 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl); + /* IRQ related */ \ + .config_intr = dp83848_config_intr, \ + .handle_interrupt = dp83848_handle_interrupt, \ ++ \ ++ .flags = PHY_RST_AFTER_CLK_EN, \ + } + + static struct phy_driver dp83848_driver[] = { +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 2da3be3fb9423c..426c05d5b13813 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -4549,6 +4549,12 @@ static int virtnet_probe(struct virtio_device *vdev) + if (vi->has_rss || vi->has_rss_hash_report) { + vi->rss_key_size = + virtio_cread8(vdev, offsetof(struct virtio_net_config, rss_max_key_size)); ++ if (vi->rss_key_size > VIRTIO_NET_RSS_MAX_KEY_SIZE) { ++ dev_err(&vdev->dev, "rss_max_key_size=%u exceeds the limit %u.\n", ++ vi->rss_key_size, VIRTIO_NET_RSS_MAX_KEY_SIZE); ++ err = -EINVAL; ++ goto free; ++ } + + vi->rss_hash_types_supported = + virtio_cread32(vdev, offsetof(struct virtio_net_config, supported_hash_types)); +diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +index f4ff2198b5ef81..7c4a11f60f9111 100644 +--- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c ++++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +@@ -226,7 +226,7 @@ int t7xx_dpmaif_rx_buf_alloc(struct dpmaif_ctrl *dpmaif_ctrl, + return 0; + + err_unmap_skbs: +- while (--i > 0) ++ while (i--) + t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i); + + return ret; +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index 96caf2221d877b..f49b1bb258c73d 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -931,6 +931,11 @@ static int amd_pmc_s2d_init(struct amd_pmc_dev *dev) + amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low, dev->s2d_msg_id, true); + amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi, dev->s2d_msg_id, true); + ++ if (!phys_addr_hi && !phys_addr_low) { ++ dev_err(dev->dev, "STB is not enabled on the system; disable enable_stb or contact system vendor\n"); ++ return -EINVAL; ++ } ++ + stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low); + + /* Clear msg_port for other SMU operation */ +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index 98ab65c896850e..2fc6163eace315 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -106,7 +106,9 @@ static int pwm_imx_tpm_round_state(struct pwm_chip *chip, + p->prescale = prescale; + + period_count = (clock_unit + ((1 << prescale) >> 1)) >> prescale; +- p->mod = period_count; ++ if (period_count == 0) ++ return -EINVAL; ++ p->mod = period_count - 1; + + /* calculate real period HW can support */ + tmp = (u64)period_count << prescale; +diff --git a/drivers/regulator/rtq2208-regulator.c b/drivers/regulator/rtq2208-regulator.c +index 2d54844c4226bc..e05531c8c0298d 100644 +--- a/drivers/regulator/rtq2208-regulator.c ++++ b/drivers/regulator/rtq2208-regulator.c +@@ -513,7 +513,7 @@ static int rtq2208_probe(struct i2c_client *i2c) + struct regmap *regmap; + struct rtq2208_regulator_desc *rdesc[RTQ2208_LDO_MAX]; + struct regulator_dev *rdev; +- struct regulator_config cfg; ++ struct regulator_config cfg = {}; + struct rtq2208_rdev_map *rdev_map; + int i, ret = 0, idx, n_regulator = 0; + unsigned int regulator_idx_table[RTQ2208_LDO_MAX], +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 82d460ff477718..d877a1a1aeb4bf 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -1354,14 +1354,18 @@ static int qcom_glink_request_intent(struct qcom_glink *glink, + goto unlock; + + ret = wait_event_timeout(channel->intent_req_wq, +- READ_ONCE(channel->intent_req_result) >= 0 && +- READ_ONCE(channel->intent_received), ++ READ_ONCE(channel->intent_req_result) == 0 || ++ (READ_ONCE(channel->intent_req_result) > 0 && ++ READ_ONCE(channel->intent_received)) || ++ glink->abort_tx, + 10 * HZ); + if (!ret) { + dev_err(glink->dev, "intent request timed out\n"); + ret = -ETIMEDOUT; ++ } else if (glink->abort_tx) { ++ ret = -ECANCELED; + } else { +- ret = READ_ONCE(channel->intent_req_result) ? 0 : -ECANCELED; ++ ret = READ_ONCE(channel->intent_req_result) ? 0 : -EAGAIN; + } + + unlock: +diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c +index a25215507668d8..203df5e53b1a84 100644 +--- a/drivers/scsi/sd_zbc.c ++++ b/drivers/scsi/sd_zbc.c +@@ -221,8 +221,7 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp, + bufsize = min_t(size_t, bufsize, queue_max_segments(q) << PAGE_SHIFT); + + while (bufsize >= SECTOR_SIZE) { +- buf = __vmalloc(bufsize, +- GFP_KERNEL | __GFP_ZERO | __GFP_NORETRY); ++ buf = kvzalloc(bufsize, GFP_KERNEL | __GFP_NORETRY); + if (buf) { + *buflen = bufsize; + return buf; +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index 5225b3621a56c4..d2d49264cf83a4 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -73,7 +73,14 @@ static struct irq_chip lmh_irq_chip = { + static int lmh_irq_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw) + { + struct lmh_hw_data *lmh_data = d->host_data; ++ static struct lock_class_key lmh_lock_key; ++ static struct lock_class_key lmh_request_key; + ++ /* ++ * This lock class tells lockdep that GPIO irqs are in a different ++ * category than their parents, so it won't report false recursion. ++ */ ++ irq_set_lockdep_class(irq, &lmh_lock_key, &lmh_request_key); + irq_set_chip_and_handler(irq, &lmh_irq_chip, handle_simple_irq); + irq_set_chip_data(irq, lmh_data); + +diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c +index d8dfcd49695d3d..4e5f86c2145616 100644 +--- a/drivers/thermal/thermal_of.c ++++ b/drivers/thermal/thermal_of.c +@@ -126,18 +126,15 @@ static struct thermal_trip *thermal_of_trips_init(struct device_node *np, int *n + struct device_node *trips; + int ret, count; + ++ *ntrips = 0; ++ + trips = of_get_child_by_name(np, "trips"); +- if (!trips) { +- pr_err("Failed to find 'trips' node\n"); +- return ERR_PTR(-EINVAL); +- } ++ if (!trips) ++ return NULL; + + count = of_get_child_count(trips); +- if (!count) { +- pr_err("No trip point defined\n"); +- ret = -EINVAL; +- goto out_of_node_put; +- } ++ if (!count) ++ return NULL; + + tt = kzalloc(sizeof(*tt) * count, GFP_KERNEL); + if (!tt) { +@@ -160,7 +157,6 @@ static struct thermal_trip *thermal_of_trips_init(struct device_node *np, int *n + + out_kfree: + kfree(tt); +- *ntrips = 0; + out_of_node_put: + of_node_put(trips); + +@@ -498,11 +494,14 @@ static struct thermal_zone_device *thermal_of_zone_register(struct device_node * + + trips = thermal_of_trips_init(np, &ntrips); + if (IS_ERR(trips)) { +- pr_err("Failed to find trip points for %pOFn id=%d\n", sensor, id); ++ pr_err("Failed to parse trip points for %pOFn id=%d\n", sensor, id); + ret = PTR_ERR(trips); + goto out_kfree_of_ops; + } + ++ if (!trips) ++ pr_info("No trip points found for %pOFn id=%d\n", sensor, id); ++ + ret = thermal_of_monitor_init(np, &delay, &pdelay); + if (ret) { + pr_err("Failed to initialize monitoring delays from %pOFn\n", np); +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 8cbe19574bbcbc..fcb509059d7c49 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -2106,10 +2106,18 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { + u32 reg; + +- dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & +- DWC3_GUSB2PHYCFG_SUSPHY) || +- (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) & +- DWC3_GUSB3PIPECTL_SUSPHY); ++ if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) { ++ dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & ++ DWC3_GUSB2PHYCFG_SUSPHY) || ++ (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) & ++ DWC3_GUSB3PIPECTL_SUSPHY); ++ /* ++ * TI AM62 platform requires SUSPHY to be ++ * enabled for system suspend to work. ++ */ ++ if (!dwc->susphy_state) ++ dwc3_enable_susphy(dwc, true); ++ } + + switch (dwc->current_dr_role) { + case DWC3_GCTL_PRTCAP_DEVICE: +@@ -2158,15 +2166,6 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + break; + } + +- if (!PMSG_IS_AUTO(msg)) { +- /* +- * TI AM62 platform requires SUSPHY to be +- * enabled for system suspend to work. +- */ +- if (!dwc->susphy_state) +- dwc3_enable_susphy(dwc, true); +- } +- + return 0; + } + +diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c +index d54283fd026b22..05b6e7e52e0275 100644 +--- a/drivers/usb/musb/sunxi.c ++++ b/drivers/usb/musb/sunxi.c +@@ -293,8 +293,6 @@ static int sunxi_musb_exit(struct musb *musb) + if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) + sunxi_sram_release(musb->controller->parent); + +- devm_usb_put_phy(glue->dev, glue->xceiv); +- + return 0; + } + +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index abe4bbb0ac654f..477c0927dc1b9d 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -770,11 +770,12 @@ static void edge_bulk_out_data_callback(struct urb *urb) + static void edge_bulk_out_cmd_callback(struct urb *urb) + { + struct edgeport_port *edge_port = urb->context; ++ struct device *dev = &urb->dev->dev; + int status = urb->status; + + atomic_dec(&CmdUrbs); +- dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n", +- __func__, urb, atomic_read(&CmdUrbs)); ++ dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb, ++ atomic_read(&CmdUrbs)); + + + /* clean up the transfer buffer */ +@@ -784,8 +785,7 @@ static void edge_bulk_out_cmd_callback(struct urb *urb) + usb_free_urb(urb); + + if (status) { +- dev_dbg(&urb->dev->dev, +- "%s - nonzero write bulk status received: %d\n", ++ dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); + return; + } +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 55886b64cadd83..04f511adc00256 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_VENDOR_ID 0x2c7c + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 ++#define QUECTEL_PRODUCT_RG650V 0x0122 + #define QUECTEL_PRODUCT_EM061K_LTA 0x0123 + #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 +@@ -1273,6 +1274,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG916Q, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, +@@ -2320,6 +2323,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x30) }, /* Fibocom FG132 Diag */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x40) }, /* Fibocom FG132 AT */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0, 0) }, /* Fibocom FG132 NMEA */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 703a9c56355731..061ff754b307bc 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0x90e4)}, /* Sierra Wireless EM86xx QDL*/ ++ {DEVICE_SWI(0x1199, 0x90e5)}, /* Sierra Wireless EM86xx */ + {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ + {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ +diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c +index 52c81378e36ef4..b2f65556f3f7e8 100644 +--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c ++++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c +@@ -161,6 +161,10 @@ qcom_pmic_typec_pdphy_pd_transmit_payload(struct pmic_typec_pdphy *pmic_typec_pd + + spin_lock_irqsave(&pmic_typec_pdphy->lock, flags); + ++ hdr_len = sizeof(msg->header); ++ txbuf_len = pd_header_cnt_le(msg->header) * 4; ++ txsize_len = hdr_len + txbuf_len - 1; ++ + ret = regmap_read(pmic_typec_pdphy->regmap, + pmic_typec_pdphy->base + USB_PDPHY_RX_ACKNOWLEDGE_REG, + &val); +@@ -178,10 +182,6 @@ qcom_pmic_typec_pdphy_pd_transmit_payload(struct pmic_typec_pdphy *pmic_typec_pd + if (ret) + goto done; + +- hdr_len = sizeof(msg->header); +- txbuf_len = pd_header_cnt_le(msg->header) * 4; +- txsize_len = hdr_len + txbuf_len - 1; +- + /* Write message header sizeof(u16) to USB_PDPHY_TX_BUFFER_HDR_REG */ + ret = regmap_bulk_write(pmic_typec_pdphy->regmap, + pmic_typec_pdphy->base + USB_PDPHY_TX_BUFFER_HDR_REG, +diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c +index 607061a37eca3d..cf3c8e552defeb 100644 +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -441,6 +441,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc, + + port = uc->orig; + new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd); ++ if (new_cam >= ARRAY_SIZE(uc->updated)) ++ return; + new_port = &uc->updated[new_cam]; + cam = new_port->linked_idx; + enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd); +diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c +index 9fe4ccca50a060..6f2e48d697dd65 100644 +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -615,7 +615,7 @@ static bool insert_delayed_ref(struct btrfs_delayed_ref_root *root, + &href->ref_add_list); + else if (ref->action == BTRFS_DROP_DELAYED_REF) { + ASSERT(!list_empty(&exist->add_list)); +- list_del(&exist->add_list); ++ list_del_init(&exist->add_list); + } else { + ASSERT(0); + } +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index ca76b0b51b7791..56bbf59bda3cf6 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -206,12 +206,15 @@ void nfs_set_cache_invalid(struct inode *inode, unsigned long flags) + nfs_fscache_invalidate(inode, 0); + flags &= ~NFS_INO_REVAL_FORCED; + +- nfsi->cache_validity |= flags; ++ flags |= nfsi->cache_validity; ++ if (inode->i_mapping->nrpages == 0) ++ flags &= ~NFS_INO_INVALID_DATA; + +- if (inode->i_mapping->nrpages == 0) { +- nfsi->cache_validity &= ~NFS_INO_INVALID_DATA; +- nfs_ooo_clear(nfsi); +- } else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) { ++ /* pairs with nfs_clear_invalid_mapping()'s smp_load_acquire() */ ++ smp_store_release(&nfsi->cache_validity, flags); ++ ++ if (inode->i_mapping->nrpages == 0 || ++ nfsi->cache_validity & NFS_INO_INVALID_DATA) { + nfs_ooo_clear(nfsi); + } + trace_nfs_set_cache_invalid(inode, 0); +@@ -1340,6 +1343,13 @@ int nfs_clear_invalid_mapping(struct address_space *mapping) + TASK_KILLABLE|TASK_FREEZABLE_UNSAFE); + if (ret) + goto out; ++ smp_rmb(); /* pairs with smp_wmb() below */ ++ if (test_bit(NFS_INO_INVALIDATING, bitlock)) ++ continue; ++ /* pairs with nfs_set_cache_invalid()'s smp_store_release() */ ++ if (!(smp_load_acquire(&nfsi->cache_validity) & NFS_INO_INVALID_DATA)) ++ goto out; ++ /* Slow-path that double-checks with spinlock held */ + spin_lock(&inode->i_lock); + if (test_bit(NFS_INO_INVALIDATING, bitlock)) { + spin_unlock(&inode->i_lock); +@@ -1565,6 +1575,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) + fattr->gencount = nfs_inc_attr_generation_counter(); + fattr->owner_name = NULL; + fattr->group_name = NULL; ++ fattr->mdsthreshold = NULL; + } + EXPORT_SYMBOL_GPL(nfs_fattr_init); + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index f63513e477c50c..e1bcad5906ae7b 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -869,7 +869,15 @@ static int nfs_request_mount(struct fs_context *fc, + * Now ask the mount server to map our export path + * to a file handle. + */ +- status = nfs_mount(&request, ctx->timeo, ctx->retrans); ++ if ((request.protocol == XPRT_TRANSPORT_UDP) == ++ !(ctx->flags & NFS_MOUNT_TCP)) ++ /* ++ * NFS protocol and mount protocol are both UDP or neither UDP ++ * so timeouts are compatible. Use NFS timeouts for MOUNT ++ */ ++ status = nfs_mount(&request, ctx->timeo, ctx->retrans); ++ else ++ status = nfs_mount(&request, NFS_UNSPEC_TIMEO, NFS_UNSPEC_RETRANS); + if (status != 0) { + dfprintk(MOUNT, "NFS: unable to mount server %s, error %d\n", + request.hostname, status); +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 1cc28891807154..c2268b9e20a6d3 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -2036,8 +2036,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, + rc = 0; + ocfs2_xa_cleanup_value_truncate(loc, "removing", + orig_clusters); +- if (rc) +- goto out; ++ goto out; + } + } + +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index d06607a1f137a7..8319bcbe3ee36b 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -457,10 +457,6 @@ static vm_fault_t mmap_vmcore_fault(struct vm_fault *vmf) + #endif + } + +-static const struct vm_operations_struct vmcore_mmap_ops = { +- .fault = mmap_vmcore_fault, +-}; +- + /** + * vmcore_alloc_buf - allocate buffer in vmalloc memory + * @size: size of buffer +@@ -488,6 +484,11 @@ static inline char *vmcore_alloc_buf(size_t size) + * virtually contiguous user-space in ELF layout. + */ + #ifdef CONFIG_MMU ++ ++static const struct vm_operations_struct vmcore_mmap_ops = { ++ .fault = mmap_vmcore_fault, ++}; ++ + /* + * remap_oldmem_pfn_checked - do remap_oldmem_pfn_range replacing all pages + * reported as not being ram with the zero page. +diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c +index cac80e7bfefc74..a751793c4512af 100644 +--- a/fs/smb/server/connection.c ++++ b/fs/smb/server/connection.c +@@ -70,6 +70,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) + atomic_set(&conn->req_running, 0); + atomic_set(&conn->r_count, 0); + atomic_set(&conn->refcnt, 1); ++ atomic_set(&conn->mux_smb_requests, 0); + conn->total_credits = 1; + conn->outstanding_credits = 0; + +diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h +index 82343afc8d0499..368295fb18a70c 100644 +--- a/fs/smb/server/connection.h ++++ b/fs/smb/server/connection.h +@@ -107,6 +107,7 @@ struct ksmbd_conn { + __le16 signing_algorithm; + bool binding; + atomic_t refcnt; ++ atomic_t mux_smb_requests; + }; + + struct ksmbd_conn_ops { +diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c +index 9f40b9c473ba42..e135e1bcc3b5d3 100644 +--- a/fs/smb/server/mgmt/user_session.c ++++ b/fs/smb/server/mgmt/user_session.c +@@ -90,7 +90,7 @@ static int __rpc_method(char *rpc_name) + + int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name) + { +- struct ksmbd_session_rpc *entry; ++ struct ksmbd_session_rpc *entry, *old; + struct ksmbd_rpc_command *resp; + int method; + +@@ -106,16 +106,19 @@ int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name) + entry->id = ksmbd_ipc_id_alloc(); + if (entry->id < 0) + goto free_entry; +- xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL); ++ old = xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL); ++ if (xa_is_err(old)) ++ goto free_id; + + resp = ksmbd_rpc_open(sess, entry->id); + if (!resp) +- goto free_id; ++ goto erase_xa; + + kvfree(resp); + return entry->id; +-free_id: ++erase_xa: + xa_erase(&sess->rpc_handle_list, entry->id); ++free_id: + ksmbd_rpc_id_free(entry->id); + free_entry: + kfree(entry); +@@ -174,6 +177,7 @@ static void ksmbd_expire_session(struct ksmbd_conn *conn) + unsigned long id; + struct ksmbd_session *sess; + ++ down_write(&sessions_table_lock); + down_write(&conn->session_lock); + xa_for_each(&conn->sessions, id, sess) { + if (atomic_read(&sess->refcnt) == 0 && +@@ -187,6 +191,7 @@ static void ksmbd_expire_session(struct ksmbd_conn *conn) + } + } + up_write(&conn->session_lock); ++ up_write(&sessions_table_lock); + } + + int ksmbd_session_register(struct ksmbd_conn *conn, +@@ -228,7 +233,6 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) + } + } + } +- up_write(&sessions_table_lock); + + down_write(&conn->session_lock); + xa_for_each(&conn->sessions, id, sess) { +@@ -248,6 +252,7 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) + } + } + up_write(&conn->session_lock); ++ up_write(&sessions_table_lock); + } + + struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn, +diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c +index d5d85300560d03..b6e0b71c281dcf 100644 +--- a/fs/smb/server/server.c ++++ b/fs/smb/server/server.c +@@ -238,11 +238,11 @@ static void __handle_ksmbd_work(struct ksmbd_work *work, + } while (is_chained == true); + + send: +- if (work->sess) +- ksmbd_user_session_put(work->sess); + if (work->tcon) + ksmbd_tree_connect_put(work->tcon); + smb3_preauth_hash_rsp(work); ++ if (work->sess) ++ ksmbd_user_session_put(work->sess); + if (work->sess && work->sess->enc && work->encrypted && + conn->ops->encrypt_resp) { + rc = conn->ops->encrypt_resp(work); +@@ -270,6 +270,7 @@ static void handle_ksmbd_work(struct work_struct *wk) + + ksmbd_conn_try_dequeue_request(work); + ksmbd_free_work_struct(work); ++ atomic_dec(&conn->mux_smb_requests); + /* + * Checking waitqueue to dropping pending requests on + * disconnection. waitqueue_active is safe because it +@@ -291,6 +292,15 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) + struct ksmbd_work *work; + int err; + ++ err = ksmbd_init_smb_server(conn); ++ if (err) ++ return 0; ++ ++ if (atomic_inc_return(&conn->mux_smb_requests) >= conn->vals->max_credits) { ++ atomic_dec_return(&conn->mux_smb_requests); ++ return -ENOSPC; ++ } ++ + work = ksmbd_alloc_work_struct(); + if (!work) { + pr_err("allocation for work failed\n"); +@@ -301,12 +311,6 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) + work->request_buf = conn->request_buf; + conn->request_buf = NULL; + +- err = ksmbd_init_smb_server(work); +- if (err) { +- ksmbd_free_work_struct(work); +- return 0; +- } +- + ksmbd_conn_enqueue_request(work); + atomic_inc(&conn->r_count); + /* update activity on connection */ +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 13818ecb6e1b2f..663b014b9d1886 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -388,6 +388,10 @@ static struct smb_version_ops smb1_server_ops = { + .set_rsp_status = set_smb1_rsp_status, + }; + ++static struct smb_version_values smb1_server_values = { ++ .max_credits = SMB2_MAX_CREDITS, ++}; ++ + static int smb1_negotiate(struct ksmbd_work *work) + { + return ksmbd_smb_negotiate_common(work, SMB_COM_NEGOTIATE); +@@ -399,18 +403,18 @@ static struct smb_version_cmds smb1_server_cmds[1] = { + + static int init_smb1_server(struct ksmbd_conn *conn) + { ++ conn->vals = &smb1_server_values; + conn->ops = &smb1_server_ops; + conn->cmds = smb1_server_cmds; + conn->max_cmds = ARRAY_SIZE(smb1_server_cmds); + return 0; + } + +-int ksmbd_init_smb_server(struct ksmbd_work *work) ++int ksmbd_init_smb_server(struct ksmbd_conn *conn) + { +- struct ksmbd_conn *conn = work->conn; + __le32 proto; + +- proto = *(__le32 *)((struct smb_hdr *)work->request_buf)->Protocol; ++ proto = *(__le32 *)((struct smb_hdr *)conn->request_buf)->Protocol; + if (conn->need_neg == false) { + if (proto == SMB1_PROTO_NUMBER) + return -EINVAL; +diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h +index 4a3148b0167f54..bc832fa9a82c87 100644 +--- a/fs/smb/server/smb_common.h ++++ b/fs/smb/server/smb_common.h +@@ -427,7 +427,7 @@ bool ksmbd_smb_request(struct ksmbd_conn *conn); + + int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count); + +-int ksmbd_init_smb_server(struct ksmbd_work *work); ++int ksmbd_init_smb_server(struct ksmbd_conn *conn); + + struct ksmbd_kstat; + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, +diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h +index 083f8565371616..374ff338755ca2 100644 +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -227,8 +227,6 @@ u32 arm_smccc_get_version(void); + + void __init arm_smccc_version_init(u32 version, enum arm_smccc_conduit conduit); + +-extern u64 smccc_has_sve_hint; +- + /** + * arm_smccc_get_soc_id_version() + * +@@ -326,15 +324,6 @@ struct arm_smccc_quirk { + } state; + }; + +-/** +- * __arm_smccc_sve_check() - Set the SVE hint bit when doing SMC calls +- * +- * Sets the SMCCC hint bit to indicate if there is live state in the SVE +- * registers, this modifies x0 in place and should never be called from C +- * code. +- */ +-asmlinkage unsigned long __arm_smccc_sve_check(unsigned long x0); +- + /** + * __arm_smccc_smc() - make SMC calls + * @a0-a7: arguments passed in registers 0 to 7 +@@ -402,20 +391,6 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, + + #endif + +-/* nVHE hypervisor doesn't have a current thread so needs separate checks */ +-#if defined(CONFIG_ARM64_SVE) && !defined(__KVM_NVHE_HYPERVISOR__) +- +-#define SMCCC_SVE_CHECK ALTERNATIVE("nop \n", "bl __arm_smccc_sve_check \n", \ +- ARM64_SVE) +-#define smccc_sve_clobbers "x16", "x30", "cc", +- +-#else +- +-#define SMCCC_SVE_CHECK +-#define smccc_sve_clobbers +- +-#endif +- + #define __constraint_read_2 "r" (arg0) + #define __constraint_read_3 __constraint_read_2, "r" (arg1) + #define __constraint_read_4 __constraint_read_3, "r" (arg2) +@@ -486,12 +461,11 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, + register unsigned long r3 asm("r3"); \ + CONCATENATE(__declare_arg_, \ + COUNT_ARGS(__VA_ARGS__))(__VA_ARGS__); \ +- asm volatile(SMCCC_SVE_CHECK \ +- inst "\n" : \ ++ asm volatile(inst "\n" : \ + "=r" (r0), "=r" (r1), "=r" (r2), "=r" (r3) \ + : CONCATENATE(__constraint_read_, \ + COUNT_ARGS(__VA_ARGS__)) \ +- : smccc_sve_clobbers "memory"); \ ++ : "memory"); \ + if (___res) \ + *___res = (typeof(*___res)){r0, r1, r2, r3}; \ + } while (0) +@@ -540,7 +514,7 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, + asm ("" : \ + : CONCATENATE(__constraint_read_, \ + COUNT_ARGS(__VA_ARGS__)) \ +- : smccc_sve_clobbers "memory"); \ ++ : "memory"); \ + if (___res) \ + ___res->a0 = SMCCC_RET_NOT_SUPPORTED; \ + } while (0) +diff --git a/include/linux/tick.h b/include/linux/tick.h +index 9459fef5b85736..9701c571a5cfe9 100644 +--- a/include/linux/tick.h ++++ b/include/linux/tick.h +@@ -252,12 +252,19 @@ static inline void tick_dep_set_task(struct task_struct *tsk, + if (tick_nohz_full_enabled()) + tick_nohz_dep_set_task(tsk, bit); + } ++ + static inline void tick_dep_clear_task(struct task_struct *tsk, + enum tick_dep_bits bit) + { + if (tick_nohz_full_enabled()) + tick_nohz_dep_clear_task(tsk, bit); + } ++ ++static inline void tick_dep_init_task(struct task_struct *tsk) ++{ ++ atomic_set(&tsk->tick_dep_mask, 0); ++} ++ + static inline void tick_dep_set_signal(struct task_struct *tsk, + enum tick_dep_bits bit) + { +@@ -291,6 +298,7 @@ static inline void tick_dep_set_task(struct task_struct *tsk, + enum tick_dep_bits bit) { } + static inline void tick_dep_clear_task(struct task_struct *tsk, + enum tick_dep_bits bit) { } ++static inline void tick_dep_init_task(struct task_struct *tsk) { } + static inline void tick_dep_set_signal(struct task_struct *tsk, + enum tick_dep_bits bit) { } + static inline void tick_dep_clear_signal(struct signal_struct *signal, +diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h +index 45f09bec02c485..733f2a97589b26 100644 +--- a/include/linux/user_namespace.h ++++ b/include/linux/user_namespace.h +@@ -131,7 +131,8 @@ static inline long get_rlimit_value(struct ucounts *ucounts, enum rlimit_type ty + + long inc_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v); + bool dec_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v); +-long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type); ++long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type, ++ bool override_rlimit); + void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum rlimit_type type); + bool is_rlimit_overlimit(struct ucounts *ucounts, enum rlimit_type type, unsigned long max); + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 1b95c34a4e3d11..804dcd3a7d8f7e 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -205,6 +205,7 @@ static inline void nft_data_copy(u32 *dst, const struct nft_data *src, + * @nla: netlink attributes + * @portid: netlink portID of the original message + * @seq: netlink sequence number ++ * @flags: modifiers to new request + * @family: protocol family + * @level: depth of the chains + * @report: notify via unicast netlink message +@@ -279,6 +280,7 @@ struct nft_userdata { + * + * @key: element key + * @key_end: closing element key ++ * @data: element data + * @priv: element private data and extensions + */ + struct nft_set_elem { +@@ -330,10 +332,10 @@ struct nft_set_iter { + * @dtype: data type + * @dlen: data length + * @objtype: object type +- * @flags: flags + * @size: number of set elements + * @policy: set policy + * @gc_int: garbage collector interval ++ * @timeout: element timeout + * @field_len: length of each field in concatenation, bytes + * @field_count: number of concatenated fields in element + * @expr: set must support for expressions +@@ -356,9 +358,9 @@ struct nft_set_desc { + /** + * enum nft_set_class - performance class + * +- * @NFT_LOOKUP_O_1: constant, O(1) +- * @NFT_LOOKUP_O_LOG_N: logarithmic, O(log N) +- * @NFT_LOOKUP_O_N: linear, O(N) ++ * @NFT_SET_CLASS_O_1: constant, O(1) ++ * @NFT_SET_CLASS_O_LOG_N: logarithmic, O(log N) ++ * @NFT_SET_CLASS_O_N: linear, O(N) + */ + enum nft_set_class { + NFT_SET_CLASS_O_1, +@@ -427,9 +429,13 @@ struct nft_set_ext; + * @remove: remove element from set + * @walk: iterate over all set elements + * @get: get set elements ++ * @commit: commit set elements ++ * @abort: abort set elements + * @privsize: function to return size of set private data ++ * @estimate: estimate the required memory size and the lookup complexity class + * @init: initialize private data of new set instance + * @destroy: destroy private data of set instance ++ * @gc_init: initialize garbage collection + * @elemsize: element private size + * + * Operations lookup, update and delete have simpler interfaces, are faster +@@ -544,13 +550,16 @@ struct nft_set_elem_expr { + * @policy: set parameterization (see enum nft_set_policies) + * @udlen: user data length + * @udata: user data +- * @expr: stateful expression ++ * @pending_update: list of pending update set element + * @ops: set ops + * @flags: set flags + * @dead: set will be freed, never cleared + * @genmask: generation mask + * @klen: key length + * @dlen: data length ++ * @num_exprs: numbers of exprs ++ * @exprs: stateful expression ++ * @catchall_list: list of catch-all set element + * @data: private set data + */ + struct nft_set { +@@ -701,6 +710,7 @@ extern const struct nft_set_ext_type nft_set_ext_types[]; + * + * @len: length of extension area + * @offset: offsets of individual extension types ++ * @ext_len: length of the expected extension(used to sanity check) + */ + struct nft_set_ext_tmpl { + u16 len; +@@ -846,6 +856,7 @@ struct nft_expr_ops; + * @select_ops: function to select nft_expr_ops + * @release_ops: release nft_expr_ops + * @ops: default ops, used when no select_ops functions is present ++ * @inner_ops: inner ops, used for inner packet operation + * @list: used internally + * @name: Identifier + * @owner: module reference +@@ -887,14 +898,22 @@ struct nft_offload_ctx; + * struct nft_expr_ops - nf_tables expression operations + * + * @eval: Expression evaluation function ++ * @clone: Expression clone function + * @size: full expression size, including private data size + * @init: initialization function + * @activate: activate expression in the next generation + * @deactivate: deactivate expression in next generation + * @destroy: destruction function, called after synchronize_rcu ++ * @destroy_clone: destruction clone function + * @dump: function to dump parameters +- * @type: expression type + * @validate: validate expression, called during loop detection ++ * @reduce: reduce expression ++ * @gc: garbage collection expression ++ * @offload: hardware offload expression ++ * @offload_action: function to report true/false to allocate one slot or not in the flow ++ * offload array ++ * @offload_stats: function to synchronize hardware stats via updating the counter expression ++ * @type: expression type + * @data: extra data to attach to this expression operation + */ + struct nft_expr_ops { +@@ -1047,14 +1066,22 @@ struct nft_rule_blob { + /** + * struct nft_chain - nf_tables chain + * ++ * @blob_gen_0: rule blob pointer to the current generation ++ * @blob_gen_1: rule blob pointer to the future generation + * @rules: list of rules in the chain + * @list: used internally + * @rhlhead: used internally + * @table: table that this chain belongs to + * @handle: chain handle + * @use: number of jump references to this chain +- * @flags: bitmask of enum nft_chain_flags ++ * @flags: bitmask of enum NFTA_CHAIN_FLAGS ++ * @bound: bind or not ++ * @genmask: generation mask + * @name: name of the chain ++ * @udlen: user data length ++ * @udata: user data in the chain ++ * @rcu_head: rcu head for deferred release ++ * @blob_next: rule blob pointer to the next in the chain + */ + struct nft_chain { + struct nft_rule_blob __rcu *blob_gen_0; +@@ -1071,6 +1098,7 @@ struct nft_chain { + char *name; + u16 udlen; + u8 *udata; ++ struct rcu_head rcu_head; + + /* Only used during control plane commit phase: */ + struct nft_rule_blob *blob_next; +@@ -1131,7 +1159,7 @@ static inline bool nft_chain_is_bound(struct nft_chain *chain) + + int nft_chain_add(struct nft_table *table, struct nft_chain *chain); + void nft_chain_del(struct nft_chain *chain); +-void nf_tables_chain_destroy(struct nft_ctx *ctx); ++void nf_tables_chain_destroy(struct nft_chain *chain); + + struct nft_stats { + u64 bytes; +@@ -1152,6 +1180,7 @@ struct nft_hook { + * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family) + * @type: chain type + * @policy: default policy ++ * @flags: indicate the base chain disabled or not + * @stats: per-cpu chain stats + * @chain: the chain + * @flow_block: flow block (for hardware offload) +@@ -1213,6 +1242,7 @@ static inline void nft_use_inc_restore(u32 *use) + * @sets: sets in the table + * @objects: stateful objects in the table + * @flowtables: flow tables in the table ++ * @net: netnamespace this table belongs to + * @hgenerator: handle generator state + * @handle: table handle + * @use: number of chain references to this table +@@ -1229,6 +1259,7 @@ struct nft_table { + struct list_head sets; + struct list_head objects; + struct list_head flowtables; ++ possible_net_t net; + u64 hgenerator; + u64 handle; + u32 use; +@@ -1277,11 +1308,13 @@ struct nft_object_hash_key { + * struct nft_object - nf_tables stateful object + * + * @list: table stateful object list node +- * @key: keys that identify this object + * @rhlhead: nft_objname_ht node ++ * @key: keys that identify this object + * @genmask: generation mask + * @use: number of references to this stateful object + * @handle: unique object handle ++ * @udlen: length of user data ++ * @udata: user data + * @ops: object operations + * @data: object data, layout depends on type + */ +@@ -1349,6 +1382,7 @@ struct nft_object_type { + * @destroy: release existing stateful object + * @dump: netlink dump stateful object + * @update: update stateful object ++ * @type: pointer to object type + */ + struct nft_object_ops { + void (*eval)(struct nft_object *obj, +@@ -1384,9 +1418,8 @@ void nft_unregister_obj(struct nft_object_type *obj_type); + * @genmask: generation mask + * @use: number of references to this flow table + * @handle: unique object handle +- * @dev_name: array of device names ++ * @hook_list: hook list for hooks per net_device in flowtables + * @data: rhashtable and garbage collector +- * @ops: array of hooks + */ + struct nft_flowtable { + struct list_head list; +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index 3322fb93a260be..ed36f5f577a9d3 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -283,6 +283,7 @@ + EM(rxrpc_call_see_input, "SEE input ") \ + EM(rxrpc_call_see_release, "SEE release ") \ + EM(rxrpc_call_see_userid_exists, "SEE u-exists") \ ++ EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \ + E_(rxrpc_call_see_zap, "SEE zap ") + + #define rxrpc_txqueue_traces \ +diff --git a/kernel/fork.c b/kernel/fork.c +index 9098284720e382..23efaa2c42e4f8 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -99,6 +99,7 @@ + #include <linux/stackprotector.h> + #include <linux/user_events.h> + #include <linux/iommu.h> ++#include <linux/tick.h> + + #include <asm/pgalloc.h> + #include <linux/uaccess.h> +@@ -2418,6 +2419,7 @@ __latent_entropy struct task_struct *copy_process( + acct_clear_integrals(p); + + posix_cputimers_init(&p->posix_cputimers); ++ tick_dep_init_task(p); + + p->io_context = NULL; + audit_set_context(p, NULL); +diff --git a/kernel/signal.c b/kernel/signal.c +index 21903f524ef86f..3808eaa2f49ab6 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -428,7 +428,8 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t gfp_flags, + */ + rcu_read_lock(); + ucounts = task_ucounts(t); +- sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING); ++ sigpending = inc_rlimit_get_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, ++ override_rlimit); + rcu_read_unlock(); + if (!sigpending) + return NULL; +diff --git a/kernel/ucount.c b/kernel/ucount.c +index 4aa6166cb8563c..3456018730b6c8 100644 +--- a/kernel/ucount.c ++++ b/kernel/ucount.c +@@ -308,7 +308,8 @@ void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum rlimit_type type) + do_dec_rlimit_put_ucounts(ucounts, NULL, type); + } + +-long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type) ++long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type, ++ bool override_rlimit) + { + /* Caller must hold a reference to ucounts */ + struct ucounts *iter; +@@ -318,10 +319,11 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type) + for (iter = ucounts; iter; iter = iter->ns->ucounts) { + long new = atomic_long_add_return(1, &iter->rlimit[type]); + if (new < 0 || new > max) +- goto unwind; ++ goto dec_unwind; + if (iter == ucounts) + ret = new; +- max = get_userns_rlimit_max(iter->ns, type); ++ if (!override_rlimit) ++ max = get_userns_rlimit_max(iter->ns, type); + /* + * Grab an extra ucount reference for the caller when + * the rlimit count was previously 0. +@@ -335,7 +337,6 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type) + dec_unwind: + dec = atomic_long_sub_return(1, &iter->rlimit[type]); + WARN_ON_ONCE(dec < 0); +-unwind: + do_dec_rlimit_put_ucounts(ucounts, iter, type); + return 0; + } +diff --git a/mm/filemap.c b/mm/filemap.c +index e6c112f3a211fe..5e9359e4ff9ed3 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2660,7 +2660,7 @@ ssize_t filemap_read(struct kiocb *iocb, struct iov_iter *iter, + if (unlikely(!iov_iter_count(iter))) + return 0; + +- iov_iter_truncate(iter, inode->i_sb->s_maxbytes); ++ iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos); + folio_batch_init(&fbatch); + + do { +diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c +index c09aed6a3cfcc8..68952752b5990f 100644 +--- a/net/mac80211/chan.c ++++ b/net/mac80211/chan.c +@@ -245,9 +245,7 @@ ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata, + enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT; + struct sta_info *sta; + +- lockdep_assert_wiphy(sdata->local->hw.wiphy); +- +- list_for_each_entry(sta, &sdata->local->sta_list, list) { ++ list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) { + if (sdata != sta->sdata && + !(sta->sdata->bss && sta->sdata->bss == sdata->bss)) + continue; +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index b14c809bcdea33..42e2c84ed2484a 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -732,7 +732,7 @@ static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata, + bool disable_mu_mimo = false; + struct ieee80211_sub_if_data *other; + +- list_for_each_entry(other, &local->interfaces, list) { ++ list_for_each_entry_rcu(other, &local->interfaces, list) { + if (other->vif.bss_conf.mu_mimo_owner) { + disable_mu_mimo = true; + break; +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index d4a032f3457732..1726e3221d3c77 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -490,7 +490,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + * the scan was in progress; if there was none this will + * just be a no-op for the particular interface. + */ +- list_for_each_entry(sdata, &local->interfaces, list) { ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { + if (ieee80211_sdata_running(sdata)) + wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); + } +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 02b5aaad2a155c..d682c32821a110 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -745,9 +745,7 @@ static void __iterate_interfaces(struct ieee80211_local *local, + struct ieee80211_sub_if_data *sdata; + bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE; + +- list_for_each_entry_rcu(sdata, &local->interfaces, list, +- lockdep_is_held(&local->iflist_mtx) || +- lockdep_is_held(&local->hw.wiphy->mtx)) { ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { + switch (sdata->vif.type) { + case NL80211_IFTYPE_MONITOR: + if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE)) +diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c +index 6738bad048cece..e097b6a7b816bd 100644 +--- a/net/mptcp/pm_userspace.c ++++ b/net/mptcp/pm_userspace.c +@@ -90,6 +90,7 @@ static int mptcp_userspace_pm_delete_local_addr(struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *addr) + { + struct mptcp_pm_addr_entry *entry, *tmp; ++ struct sock *sk = (struct sock *)msk; + + list_for_each_entry_safe(entry, tmp, &msk->pm.userspace_pm_local_addr_list, list) { + if (mptcp_addresses_equal(&entry->addr, &addr->addr, false)) { +@@ -97,7 +98,7 @@ static int mptcp_userspace_pm_delete_local_addr(struct mptcp_sock *msk, + * be used multiple times (e.g. fullmesh mode). + */ + list_del_rcu(&entry->list); +- kfree(entry); ++ sock_kfree_s(sk, entry, sizeof(*entry)); + msk->pm.local_addr_used--; + return 0; + } +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index aacb0d7f82e9f8..8a583e8f3c136a 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1431,6 +1431,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, + INIT_LIST_HEAD(&table->sets); + INIT_LIST_HEAD(&table->objects); + INIT_LIST_HEAD(&table->flowtables); ++ write_pnet(&table->net, net); + table->family = family; + table->flags = flags; + table->handle = ++nft_net->table_handle; +@@ -2068,9 +2069,9 @@ static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) + kvfree(chain->blob_next); + } + +-void nf_tables_chain_destroy(struct nft_ctx *ctx) ++void nf_tables_chain_destroy(struct nft_chain *chain) + { +- struct nft_chain *chain = ctx->chain; ++ const struct nft_table *table = chain->table; + struct nft_hook *hook, *next; + + if (WARN_ON(chain->use > 0)) +@@ -2082,7 +2083,7 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx) + if (nft_is_base_chain(chain)) { + struct nft_base_chain *basechain = nft_base_chain(chain); + +- if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { ++ if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { + list_for_each_entry_safe(hook, next, + &basechain->hook_list, list) { + list_del_rcu(&hook->list); +@@ -2571,7 +2572,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + err_trans: + nft_use_dec_restore(&table->use); + err_destroy_chain: +- nf_tables_chain_destroy(ctx); ++ nf_tables_chain_destroy(chain); + + return err; + } +@@ -9415,7 +9416,7 @@ static void nft_commit_release(struct nft_trans *trans) + if (nft_trans_chain_update(trans)) + nft_hooks_destroy(&nft_trans_chain_hooks(trans)); + else +- nf_tables_chain_destroy(&trans->ctx); ++ nf_tables_chain_destroy(nft_trans_chain(trans)); + break; + case NFT_MSG_DELRULE: + case NFT_MSG_DESTROYRULE: +@@ -10406,7 +10407,7 @@ static void nf_tables_abort_release(struct nft_trans *trans) + if (nft_trans_chain_update(trans)) + nft_hooks_destroy(&nft_trans_chain_hooks(trans)); + else +- nf_tables_chain_destroy(&trans->ctx); ++ nf_tables_chain_destroy(nft_trans_chain(trans)); + break; + case NFT_MSG_NEWRULE: + nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); +@@ -11129,22 +11130,48 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, + } + EXPORT_SYMBOL_GPL(nft_data_dump); + +-int __nft_release_basechain(struct nft_ctx *ctx) ++static void __nft_release_basechain_now(struct nft_ctx *ctx) + { + struct nft_rule *rule, *nr; + +- if (WARN_ON(!nft_is_base_chain(ctx->chain))) +- return 0; +- +- nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); + list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { + list_del(&rule->list); +- nft_use_dec(&ctx->chain->use); + nf_tables_rule_release(ctx, rule); + } ++ nf_tables_chain_destroy(ctx->chain); ++} ++ ++static void nft_release_basechain_rcu(struct rcu_head *head) ++{ ++ struct nft_chain *chain = container_of(head, struct nft_chain, rcu_head); ++ struct nft_ctx ctx = { ++ .family = chain->table->family, ++ .chain = chain, ++ .net = read_pnet(&chain->table->net), ++ }; ++ ++ __nft_release_basechain_now(&ctx); ++ put_net(ctx.net); ++} ++ ++int __nft_release_basechain(struct nft_ctx *ctx) ++{ ++ struct nft_rule *rule; ++ ++ if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) ++ return 0; ++ ++ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); ++ list_for_each_entry(rule, &ctx->chain->rules, list) ++ nft_use_dec(&ctx->chain->use); ++ + nft_chain_del(ctx->chain); + nft_use_dec(&ctx->table->use); +- nf_tables_chain_destroy(ctx); ++ ++ if (maybe_get_net(ctx->net)) ++ call_rcu(&ctx->chain->rcu_head, nft_release_basechain_rcu); ++ else ++ __nft_release_basechain_now(ctx); + + return 0; + } +@@ -11219,10 +11246,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table) + nft_obj_destroy(&ctx, obj); + } + list_for_each_entry_safe(chain, nc, &table->chains, list) { +- ctx.chain = chain; + nft_chain_del(chain); + nft_use_dec(&table->use); +- nf_tables_chain_destroy(&ctx); ++ nf_tables_chain_destroy(chain); + } + nf_tables_table_destroy(&ctx); + } +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index 6475c7abc1fe35..ac2422c215e545 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -221,7 +221,7 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx, + list_del(&rule->list); + nf_tables_rule_destroy(&chain_ctx, rule); + } +- nf_tables_chain_destroy(&chain_ctx); ++ nf_tables_chain_destroy(chain); + break; + default: + break; +diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c +index 1d95f8bc769fa2..a0231b64fb6ef0 100644 +--- a/net/rxrpc/conn_client.c ++++ b/net/rxrpc/conn_client.c +@@ -507,6 +507,7 @@ void rxrpc_connect_client_calls(struct rxrpc_local *local) + + spin_lock(&local->client_call_lock); + list_move_tail(&call->wait_link, &bundle->waiting_calls); ++ rxrpc_see_call(call, rxrpc_call_see_waiting_call); + spin_unlock(&local->client_call_lock); + + if (rxrpc_bundle_has_space(bundle)) +@@ -577,7 +578,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_bundle *bundle, struct rxrpc_call + _debug("call is waiting"); + ASSERTCMP(call->call_id, ==, 0); + ASSERT(!test_bit(RXRPC_CALL_EXPOSED, &call->flags)); ++ /* May still be on ->new_client_calls. */ ++ spin_lock(&local->client_call_lock); + list_del_init(&call->wait_link); ++ spin_unlock(&local->client_call_lock); + return; + } + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 3649a4e1eb9de7..808863e047e0c0 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3750,7 +3750,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, + } + + ch = (struct sctp_chunkhdr *)ch_end; +- } while (ch_end < skb_tail_pointer(skb)); ++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); + + if (ootb_shut_ack) + return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index c1fe2a6ea7976c..50490b1e8a0d09 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2440,6 +2440,7 @@ static void xs_tcp_setup_socket(struct work_struct *work) + case -EHOSTUNREACH: + case -EADDRINUSE: + case -ENOBUFS: ++ case -ENOTCONN: + break; + default: + printk("%s: connect returned unhandled error %d\n", +diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c +index e2157e38721770..56c232cf5b0f4f 100644 +--- a/net/vmw_vsock/hyperv_transport.c ++++ b/net/vmw_vsock/hyperv_transport.c +@@ -549,6 +549,7 @@ static void hvs_destruct(struct vsock_sock *vsk) + vmbus_hvsock_device_unregister(chan); + + kfree(hvs); ++ vsk->trans = NULL; + } + + static int hvs_dgram_bind(struct vsock_sock *vsk, struct sockaddr_vm *addr) +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 78b5f4f8808b92..2a44505f4a2237 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -923,6 +923,7 @@ void virtio_transport_destruct(struct vsock_sock *vsk) + struct virtio_vsock_sock *vvs = vsk->trans; + + kfree(vvs); ++ vsk->trans = NULL; + } + EXPORT_SYMBOL_GPL(virtio_transport_destruct); + +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 4448758f643a57..f331725d5a370d 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, + for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { + ptr = READ_ONCE(node->slots[slot]); + +- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) +- goto descend_to_node; ++ if (assoc_array_ptr_is_meta(ptr)) { ++ if (node->back_pointer || ++ assoc_array_ptr_is_shortcut(ptr)) ++ goto descend_to_node; ++ } + + if (!keyring_ptr_is_keyring(ptr)) + continue; +diff --git a/sound/firewire/tascam/amdtp-tascam.c b/sound/firewire/tascam/amdtp-tascam.c +index 0b42d65590081a..079afa4bd3811b 100644 +--- a/sound/firewire/tascam/amdtp-tascam.c ++++ b/sound/firewire/tascam/amdtp-tascam.c +@@ -238,7 +238,7 @@ int amdtp_tscm_init(struct amdtp_stream *s, struct fw_unit *unit, + err = amdtp_stream_init(s, unit, dir, flags, fmt, + process_ctx_payloads, sizeof(struct amdtp_tscm)); + if (err < 0) +- return 0; ++ return err; + + if (dir == AMDTP_OUT_STREAM) { + // Use fixed value for FDF field. +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 5833623f6ffafd..a14b9cb48f69a8 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -205,8 +205,6 @@ static void cx_auto_shutdown(struct hda_codec *codec) + { + struct conexant_spec *spec = codec->spec; + +- snd_hda_gen_shutup_speakers(codec); +- + /* Turn the problematic codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ + cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false); +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 76f5d926d1eac1..e027bc1d35f4fc 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -381,6 +381,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Redmi Book Pro 15 2022"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14 2022"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +diff --git a/sound/soc/sof/sof-client-probes-ipc4.c b/sound/soc/sof/sof-client-probes-ipc4.c +index c56a85854d92c8..07bb143823d779 100644 +--- a/sound/soc/sof/sof-client-probes-ipc4.c ++++ b/sound/soc/sof/sof-client-probes-ipc4.c +@@ -125,6 +125,7 @@ static int ipc4_probes_init(struct sof_client_dev *cdev, u32 stream_tag, + msg.primary |= SOF_IPC4_MSG_TARGET(SOF_IPC4_MODULE_MSG); + msg.extension = SOF_IPC4_MOD_EXT_DST_MOD_INSTANCE(INVALID_PIPELINE_ID); + msg.extension |= SOF_IPC4_MOD_EXT_CORE_ID(0); ++ msg.extension |= SOF_IPC4_MOD_EXT_PARAM_SIZE(sizeof(cfg) / sizeof(uint32_t)); + + msg.data_size = sizeof(cfg); + msg.data_ptr = &cfg; +diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c +index a359b528b26b73..4e17909d21267f 100644 +--- a/sound/soc/stm/stm32_spdifrx.c ++++ b/sound/soc/stm/stm32_spdifrx.c +@@ -943,7 +943,7 @@ static void stm32_spdifrx_remove(struct platform_device *pdev) + { + struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev); + +- if (spdifrx->ctrl_chan) ++ if (!IS_ERR(spdifrx->ctrl_chan)) + dma_release_channel(spdifrx->ctrl_chan); + + if (spdifrx->dmab) +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 197fd07e69edd4..22b206595a4f17 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1205,6 +1205,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + } + break; + case USB_ID(0x1bcf, 0x2283): /* NexiGo N930AF FHD Webcam */ ++ case USB_ID(0x03f0, 0x654a): /* HP 320 FHD Webcam */ + if (!strcmp(kctl->id.name, "Mic Capture Volume")) { + usb_audio_info(chip, + "set resolution quirk: cval->res = 16\n"); +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 1753746430da5f..37211ad31ec894 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2016,6 +2016,8 @@ struct usb_audio_quirk_flags_table { + + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ ++ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ ++ QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */ +diff --git a/tools/lib/thermal/sampling.c b/tools/lib/thermal/sampling.c +index 70577423a9f0c2..f67c1f9ea1d785 100644 +--- a/tools/lib/thermal/sampling.c ++++ b/tools/lib/thermal/sampling.c +@@ -16,6 +16,8 @@ static int handle_thermal_sample(struct nl_msg *n, void *arg) + struct thermal_handler_param *thp = arg; + struct thermal_handler *th = thp->th; + ++ arg = thp->arg; ++ + genlmsg_parse(nlh, 0, attrs, THERMAL_GENL_ATTR_MAX, NULL); + + switch (genlhdr->cmd) { +diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c +index d2acc88752126c..0877b60ec81f69 100644 +--- a/tools/testing/selftests/bpf/network_helpers.c ++++ b/tools/testing/selftests/bpf/network_helpers.c +@@ -465,27 +465,3 @@ int get_socket_local_port(int sock_fd) + + return -1; + } +- +-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param) +-{ +- struct ifreq ifr = {0}; +- int sockfd, err; +- +- sockfd = socket(AF_INET, SOCK_DGRAM, 0); +- if (sockfd < 0) +- return -errno; +- +- memcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); +- +- ring_param->cmd = ETHTOOL_GRINGPARAM; +- ifr.ifr_data = (char *)ring_param; +- +- if (ioctl(sockfd, SIOCETHTOOL, &ifr) < 0) { +- err = errno; +- close(sockfd); +- return -err; +- } +- +- close(sockfd); +- return 0; +-} +diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h +index 11cbe194769b16..5eccc67d1a9989 100644 +--- a/tools/testing/selftests/bpf/network_helpers.h ++++ b/tools/testing/selftests/bpf/network_helpers.h +@@ -9,11 +9,8 @@ typedef __u16 __sum16; + #include <linux/if_packet.h> + #include <linux/ip.h> + #include <linux/ipv6.h> +-#include <linux/ethtool.h> +-#include <linux/sockios.h> + #include <netinet/tcp.h> + #include <bpf/bpf_endian.h> +-#include <net/if.h> + + #define MAGIC_VAL 0x1234 + #define NUM_ITER 100000 +@@ -63,7 +60,6 @@ int make_sockaddr(int family, const char *addr_str, __u16 port, + struct sockaddr_storage *addr, socklen_t *len); + char *ping_command(int family); + int get_socket_local_port(int sock_fd); +-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param); + + struct nstoken; + /** +diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c +index 3171047414a7dc..b8104680657987 100644 +--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c ++++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c +@@ -2,6 +2,7 @@ + #define _GNU_SOURCE + #include <test_progs.h> + #include <network_helpers.h> ++#include <linux/if.h> + #include <linux/if_tun.h> + #include <sys/uio.h> + +diff --git a/tools/testing/selftests/bpf/xdp_hw_metadata.c b/tools/testing/selftests/bpf/xdp_hw_metadata.c +index 79f2da8f6ead63..adb77c1a6a7404 100644 +--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c ++++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c +@@ -288,6 +288,20 @@ static int verify_metadata(struct xsk *rx_xsk, int rxq, int server_fd, clockid_t + return 0; + } + ++struct ethtool_channels { ++ __u32 cmd; ++ __u32 max_rx; ++ __u32 max_tx; ++ __u32 max_other; ++ __u32 max_combined; ++ __u32 rx_count; ++ __u32 tx_count; ++ __u32 other_count; ++ __u32 combined_count; ++}; ++ ++#define ETHTOOL_GCHANNELS 0x0000003c /* Get no of channels */ ++ + static int rxq_num(const char *ifname) + { + struct ethtool_channels ch = {
