Muehlenhoff has submitted this change and it was merged. Change subject: Update to 3.19.8-ckt20 ......................................................................
Update to 3.19.8-ckt20 Also amend two CVE assignment for vulnerabilities fixed earlier in ckt18. Change-Id: I11ec7ecc045395146682d03b03d0da50e0171bf6 --- M debian/changelog A debian/patches/bugfix/all/stable-3.19.8-ckt20.patch M debian/patches/series 3 files changed, 1,815 insertions(+), 0 deletions(-) Approvals: Muehlenhoff: Verified; Looks good to me, approved diff --git a/debian/changelog b/debian/changelog index ae5b8b3..9567e61 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,5 +1,10 @@ linux (3.19.3-11) jessie-wikimedia; urgency=medium + * http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt20: + CVE-2016-3951 (4d06dd537f95683aba3651098ae288b7cbff8274, + 1666984c8625b3db19a9abc298931d35ab7bc64b) + CVE-2016-3961 (103f6112f253017d7062cd74d17f4a514ed4485c) + CVE-2016-2187 (162f98dea487206d9ab79fc12ed64700667a894d) * http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt19: CVE-2016-3136 (4e9a0b05257f29cf4b75f3209243ed71614d062e) CVE-2016-3137 (c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754) @@ -13,6 +18,8 @@ CVE-2016-0821 (8a5e5e02fc83aaf67053ab53b359af08c6c49aaf) CVE-2016-2185 (950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d) CVE-2016-3138 (8835ba4a39cf53f705417b3b3a94eb067673f2c9) + CVE-2016-3138 (8835ba4a39cf53f705417b3b3a94eb067673f2c9) + CVE-2016-3157 (b7a584598aea7ca73140cb87b40319944dd3393f) * http://kernel.ubuntu.com/stable/ChangeLog-3.19.8-ckt17: CVE-2015-8830 (4c185ce06dca14f5cea192f5a2c981ef50663f2b, stable-specific backport used) diff --git a/debian/patches/bugfix/all/stable-3.19.8-ckt20.patch b/debian/patches/bugfix/all/stable-3.19.8-ckt20.patch new file mode 100644 index 0000000..4502575 --- /dev/null +++ b/debian/patches/bugfix/all/stable-3.19.8-ckt20.patch @@ -0,0 +1,1807 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index c7e8f40..acb49c0 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -3724,6 +3724,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + sector if the number is odd); + i = IGNORE_DEVICE (don't bind to this + device); ++ j = NO_REPORT_LUNS (don't use report luns ++ command, uas only); + l = NOT_LOCKABLE (don't try to lock and + unlock ejectable media); + m = MAX_SECTORS_64 (don't transfer more +diff --git a/Makefile b/Makefile +index b1f6b34..187e013 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + VERSION = 3 + PATCHLEVEL = 19 + SUBLEVEL = 8 +-EXTRAVERSION = -ckt19 ++EXTRAVERSION = -ckt20 + NAME = Sedated Swine + + # *DOCUMENTATION* +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index c692451..c5f3942 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -1390,9 +1390,7 @@ static void _enable_sysc(struct omap_hwmod *oh) + (sf & SYSC_HAS_CLOCKACTIVITY)) + _set_clockactivity(oh, oh->class->sysc->clockact, &v); + +- /* If the cached value is the same as the new value, skip the write */ +- if (oh->_sysc_cache != v) +- _write_sysconfig(v, oh); ++ _write_sysconfig(v, oh); + + /* + * Set the autoidle bit only after setting the smartidle bit +@@ -1455,7 +1453,9 @@ static void _idle_sysc(struct omap_hwmod *oh) + _set_master_standbymode(oh, idlemode, &v); + } + +- _write_sysconfig(v, oh); ++ /* If the cached value is the same as the new value, skip the write */ ++ if (oh->_sysc_cache != v) ++ _write_sysconfig(v, oh); + } + + /** +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index de2c0e4..67de80a 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -31,6 +31,7 @@ + #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \ + 0x00000040 + ++/* Reserved - do not use 0x00000004 */ + #define PPC_FEATURE_TRUE_LE 0x00000002 + #define PPC_FEATURE_PPC_LE 0x00000001 + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 6a799b3..46b5ecf 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -149,23 +149,25 @@ static struct ibm_pa_feature { + unsigned long cpu_features; /* CPU_FTR_xxx bit */ + unsigned long mmu_features; /* MMU_FTR_xxx bit */ + unsigned int cpu_user_ftrs; /* PPC_FEATURE_xxx bit */ ++ unsigned int cpu_user_ftrs2; /* PPC_FEATURE2_xxx bit */ + unsigned char pabyte; /* byte number in ibm,pa-features */ + unsigned char pabit; /* bit number (big-endian) */ + unsigned char invert; /* if 1, pa bit set => clear feature */ + } ibm_pa_features[] __initdata = { +- {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0}, +- {0, 0, PPC_FEATURE_HAS_FPU, 0, 1, 0}, +- {CPU_FTR_CTRL, 0, 0, 0, 3, 0}, +- {CPU_FTR_NOEXECUTE, 0, 0, 0, 6, 0}, +- {CPU_FTR_NODSISRALIGN, 0, 0, 1, 1, 1}, +- {0, MMU_FTR_CI_LARGE_PAGE, 0, 1, 2, 0}, +- {CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0}, ++ {0, 0, PPC_FEATURE_HAS_MMU, 0, 0, 0, 0}, ++ {0, 0, PPC_FEATURE_HAS_FPU, 0, 0, 1, 0}, ++ {CPU_FTR_CTRL, 0, 0, 0, 0, 3, 0}, ++ {CPU_FTR_NOEXECUTE, 0, 0, 0, 0, 6, 0}, ++ {CPU_FTR_NODSISRALIGN, 0, 0, 0, 1, 1, 1}, ++ {0, MMU_FTR_CI_LARGE_PAGE, 0, 0, 1, 2, 0}, ++ {CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0}, + /* +- * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n), +- * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP +- * which is 0 if the kernel doesn't support TM. ++ * If the kernel doesn't support TM (ie CONFIG_PPC_TRANSACTIONAL_MEM=n), ++ * we don't want to turn on TM here, so we use the *_COMP versions ++ * which are 0 if the kernel doesn't support TM. + */ +- {CPU_FTR_TM_COMP, 0, 0, 22, 0, 0}, ++ {CPU_FTR_TM_COMP, 0, 0, ++ PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0}, + }; + + static void __init scan_features(unsigned long node, const unsigned char *ftrs, +@@ -196,10 +198,12 @@ static void __init scan_features(unsigned long node, const unsigned char *ftrs, + if (bit ^ fp->invert) { + cur_cpu_spec->cpu_features |= fp->cpu_features; + cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftrs; ++ cur_cpu_spec->cpu_user_features2 |= fp->cpu_user_ftrs2; + cur_cpu_spec->mmu_features |= fp->mmu_features; + } else { + cur_cpu_spec->cpu_features &= ~fp->cpu_features; + cur_cpu_spec->cpu_user_features &= ~fp->cpu_user_ftrs; ++ cur_cpu_spec->cpu_user_features2 &= ~fp->cpu_user_ftrs2; + cur_cpu_spec->mmu_features &= ~fp->mmu_features; + } + } +diff --git a/arch/s390/lib/spinlock.c b/arch/s390/lib/spinlock.c +index 034a35a..bc73e95 100644 +--- a/arch/s390/lib/spinlock.c ++++ b/arch/s390/lib/spinlock.c +@@ -75,6 +75,7 @@ void arch_spin_lock_wait_flags(arch_spinlock_t *lp, unsigned long flags) + if (_raw_compare_and_swap(&lp->lock, 0, cpu)) + return; + local_irq_restore(flags); ++ continue; + } + /* Check if the lock owner is running. */ + if (!smp_vcpu_scheduled(~owner)) { +diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c +index fd9f6b0..c5e6e23 100644 +--- a/arch/x86/crypto/sha-mb/sha1_mb.c ++++ b/arch/x86/crypto/sha-mb/sha1_mb.c +@@ -456,10 +456,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx, + + req = cast_mcryptd_ctx_to_req(req_ctx); + if (irqs_disabled()) +- rctx->complete(&req->base, ret); ++ req_ctx->complete(&req->base, ret); + else { + local_bh_disable(); +- rctx->complete(&req->base, ret); ++ req_ctx->complete(&req->base, ret); + local_bh_enable(); + } + } +diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h +index 68c0539..7aadd3c 100644 +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -4,6 +4,7 @@ + #include <asm/page.h> + #include <asm-generic/hugetlb.h> + ++#define hugepages_supported() cpu_has_pse + + static inline int is_hugepage_only_range(struct mm_struct *mm, + unsigned long addr, +diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +index 5c93afb..f10b499 100644 +--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c ++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +@@ -206,6 +206,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out) + struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); + struct ccp_aes_cmac_exp_ctx state; + ++ /* Don't let anything leak to 'out' */ ++ memset(&state, 0, sizeof(state)); ++ + state.null_msg = rctx->null_msg; + memcpy(state.iv, rctx->iv, sizeof(state.iv)); + state.buf_count = rctx->buf_count; +diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c +index b368e98..ced9f38 100644 +--- a/drivers/crypto/ccp/ccp-crypto-sha.c ++++ b/drivers/crypto/ccp/ccp-crypto-sha.c +@@ -198,6 +198,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out) + struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); + struct ccp_sha_exp_ctx state; + ++ /* Don't let anything leak to 'out' */ ++ memset(&state, 0, sizeof(state)); ++ + state.type = rctx->type; + state.msg_bits = rctx->msg_bits; + state.first = rctx->first; +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 82ca07f..1d7a1c1 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -123,26 +123,14 @@ static void dwc_desc_put(struct dw_dma_chan *dwc, struct dw_desc *desc) + static void dwc_initialize(struct dw_dma_chan *dwc) + { + struct dw_dma *dw = to_dw_dma(dwc->chan.device); +- struct dw_dma_slave *dws = dwc->chan.private; + u32 cfghi = DWC_CFGH_FIFO_MODE; + u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); + + if (dwc->initialized == true) + return; + +- if (dws) { +- /* +- * We need controller-specific data to set up slave +- * transfers. +- */ +- BUG_ON(!dws->dma_dev || dws->dma_dev != dw->dma.dev); +- +- cfghi |= DWC_CFGH_DST_PER(dws->dst_id); +- cfghi |= DWC_CFGH_SRC_PER(dws->src_id); +- } else { +- cfghi |= DWC_CFGH_DST_PER(dwc->dst_id); +- cfghi |= DWC_CFGH_SRC_PER(dwc->src_id); +- } ++ cfghi |= DWC_CFGH_DST_PER(dwc->dst_id); ++ cfghi |= DWC_CFGH_SRC_PER(dwc->src_id); + + channel_writel(dwc, CFG_LO, cfglo); + channel_writel(dwc, CFG_HI, cfghi); +@@ -932,7 +920,7 @@ bool dw_dma_filter(struct dma_chan *chan, void *param) + struct dw_dma_chan *dwc = to_dw_dma_chan(chan); + struct dw_dma_slave *dws = param; + +- if (!dws || dws->dma_dev != chan->device->dev) ++ if (dws->dma_dev != chan->device->dev) + return false; + + /* We have to copy data since dws can be temporary storage */ +@@ -1153,6 +1141,14 @@ static int dwc_alloc_chan_resources(struct dma_chan *chan) + * doesn't mean what you think it means), and status writeback. + */ + ++ /* ++ * We need controller-specific data to set up slave transfers. ++ */ ++ if (chan->private && !dw_dma_filter(chan, chan->private)) { ++ dev_warn(chan2dev(chan), "Wrong controller-specific data\n"); ++ return -EINVAL; ++ } ++ + /* Enable controller here if needed */ + if (!dw->in_use) + dw_dma_on(dw); +@@ -1214,6 +1210,14 @@ static void dwc_free_chan_resources(struct dma_chan *chan) + spin_lock_irqsave(&dwc->lock, flags); + list_splice_init(&dwc->free_list, &list); + dwc->descs_allocated = 0; ++ ++ /* Clear custom channel configuration */ ++ dwc->src_id = 0; ++ dwc->dst_id = 0; ++ ++ dwc->src_master = 0; ++ dwc->dst_master = 0; ++ + dwc->initialized = false; + + /* Disable interrupts */ +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 0af67b5..56b4019 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -322,6 +322,7 @@ struct sbridge_pvt { + + /* Memory type detection */ + bool is_mirrored, is_lockstep, is_close_pg; ++ bool is_chan_hash; + + /* Fifo double buffers */ + struct mce mce_entry[MCE_LOG_LEN]; +@@ -782,6 +783,20 @@ static inline u8 sad_pkg_ha(u8 pkg) + return (pkg >> 2) & 0x1; + } + ++static int haswell_chan_hash(int idx, u64 addr) ++{ ++ int i; ++ ++ /* ++ * XOR even bits from 12:26 to bit0 of idx, ++ * odd bits from 13:27 to bit1 ++ */ ++ for (i = 12; i < 28; i += 2) ++ idx ^= (addr >> i) & 3; ++ ++ return idx; ++} ++ + /**************************************************************************** + Memory check routines + ****************************************************************************/ +@@ -853,6 +868,10 @@ static int get_dimm_config(struct mem_ctl_info *mci) + enum edac_type mode; + enum mem_type mtype; + ++ if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) { ++ pci_read_config_dword(pvt->pci_ha0, HASWELL_HASYSDEFEATURE2, ®); ++ pvt->is_chan_hash = GET_BITFIELD(reg, 21, 21); ++ } + if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) + pci_read_config_dword(pvt->pci_sad1, SAD_TARGET, ®); + else +@@ -1316,12 +1335,15 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + } + + ch_way = TAD_CH(reg) + 1; +- sck_way = 1 << TAD_SOCK(reg); ++ sck_way = TAD_SOCK(reg); + + if (ch_way == 3) + idx = addr >> 6; +- else ++ else { + idx = (addr >> (6 + sck_way + shiftup)) & 0x3; ++ if (pvt->is_chan_hash) ++ idx = haswell_chan_hash(idx, addr); ++ } + idx = idx % ch_way; + + /* +@@ -1355,7 +1377,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + switch(ch_way) { + case 2: + case 4: +- sck_xch = 1 << sck_way * (ch_way >> 1); ++ sck_xch = (1 << sck_way) * (ch_way >> 1); + break; + default: + sprintf(msg, "Invalid mirror set. Can't decode addr"); +@@ -1391,7 +1413,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + + ch_addr = addr - offset; + ch_addr >>= (6 + shiftup); +- ch_addr /= ch_way * sck_way; ++ ch_addr /= sck_xch; + ch_addr <<= (6 + shiftup); + ch_addr |= addr & ((1 << (6 + shiftup)) - 1); + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index aafd687..aab5614 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1653,13 +1653,19 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr, + struct drm_dp_mst_branch *mstb; + int len, ret, port_num; + ++ port = drm_dp_get_validated_port_ref(mgr, port); ++ if (!port) ++ return -EINVAL; ++ + port_num = port->port_num; + mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent); + if (!mstb) { + mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num); + +- if (!mstb) ++ if (!mstb) { ++ drm_dp_put_port(port); + return -EINVAL; ++ } + } + + txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL); +@@ -1685,6 +1691,7 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr, + kfree(txmsg); + fail_put: + drm_dp_put_mst_branch_device(mstb); ++ drm_dp_put_port(port); + return ret; + } + +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index 52921a8..1848430 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -367,10 +367,15 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc, + + qxl_bo_kunmap(user_bo); + ++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x; ++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y; ++ qcrtc->hot_spot_x = hot_x; ++ qcrtc->hot_spot_y = hot_y; ++ + cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_CURSOR_SET; +- cmd->u.set.position.x = qcrtc->cur_x; +- cmd->u.set.position.y = qcrtc->cur_y; ++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; ++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; + + cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0); + +@@ -433,8 +438,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc, + + cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_CURSOR_MOVE; +- cmd->u.position.x = qcrtc->cur_x; +- cmd->u.position.y = qcrtc->cur_y; ++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x; ++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; + qxl_release_unmap(qdev, release, &cmd->release_info); + + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); +diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h +index e66143c..eef6676 100644 +--- a/drivers/gpu/drm/qxl/qxl_drv.h ++++ b/drivers/gpu/drm/qxl/qxl_drv.h +@@ -135,6 +135,8 @@ struct qxl_crtc { + int index; + int cur_x; + int cur_y; ++ int hot_spot_x; ++ int hot_spot_y; + }; + + struct qxl_output { +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index f5c0590..50ce26a 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -235,6 +235,8 @@ static int radeon_verify_access(struct ttm_buffer_object *bo, struct file *filp) + { + struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo); + ++ if (radeon_ttm_tt_has_userptr(bo->ttm)) ++ return -EPERM; + return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp); + } + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 97a3862..6c41538 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2927,6 +2927,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { + { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 }, + { 0, 0, 0, 0 }, + }; + +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index eab5bd6..dd534c6 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -950,14 +950,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count) + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1403,6 +1395,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1452,14 +1475,14 @@ static int hid_post_reset(struct usb_interface *intf) + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1482,25 +1505,9 @@ void usbhid_put_power(struct hid_device *hid) + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1569,12 +1576,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1583,10 +1586,8 @@ static int hid_resume(struct usb_interface *intf) + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); +diff --git a/drivers/input/misc/pmic8xxx-pwrkey.c b/drivers/input/misc/pmic8xxx-pwrkey.c +index c4ca20e..b6d14bb 100644 +--- a/drivers/input/misc/pmic8xxx-pwrkey.c ++++ b/drivers/input/misc/pmic8xxx-pwrkey.c +@@ -92,7 +92,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev) + if (of_property_read_u32(pdev->dev.of_node, "debounce", &kpd_delay)) + kpd_delay = 15625; + +- if (kpd_delay > 62500 || kpd_delay == 0) { ++ /* Valid range of pwr key trigger delay is 1/64 sec to 2 seconds. */ ++ if (kpd_delay > USEC_PER_SEC * 2 || kpd_delay < USEC_PER_SEC / 64) { + dev_err(&pdev->dev, "invalid power key trigger delay\n"); + return -EINVAL; + } +@@ -122,8 +123,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev) + pwr->name = "pmic8xxx_pwrkey"; + pwr->phys = "pmic8xxx_pwrkey/input0"; + +- delay = (kpd_delay << 10) / USEC_PER_SEC; +- delay = 1 + ilog2(delay); ++ delay = (kpd_delay << 6) / USEC_PER_SEC; ++ delay = ilog2(delay); + + err = regmap_read(regmap, PON_CNTL_1, &pon_cntl); + if (err < 0) { +diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c +index 8580456..a51de54 100644 +--- a/drivers/input/tablet/gtco.c ++++ b/drivers/input/tablet/gtco.c +@@ -868,6 +868,14 @@ static int gtco_probe(struct usb_interface *usbinterface, + goto err_free_buf; + } + ++ /* Sanity check that a device has an endpoint */ ++ if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { ++ dev_err(&usbinterface->dev, ++ "Invalid number of endpoints\n"); ++ error = -EINVAL; ++ goto err_free_urb; ++ } ++ + /* + * The endpoint is always altsetting 0, we know this since we know + * this device only has one interrupt endpoint +@@ -889,7 +897,7 @@ static int gtco_probe(struct usb_interface *usbinterface, + * HID report descriptor + */ + if (usb_get_extra_descriptor(usbinterface->cur_altsetting, +- HID_DEVICE_TYPE, &hid_desc) != 0){ ++ HID_DEVICE_TYPE, &hid_desc) != 0) { + dev_err(&usbinterface->dev, + "Can't retrieve exta USB descriptor to get hid report descriptor length\n"); + error = -EIO; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 1805087..3a55b0d 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3168,6 +3168,30 @@ static int bond_close(struct net_device *bond_dev) + return 0; + } + ++/* fold stats, assuming all rtnl_link_stats64 fields are u64, but ++ * that some drivers can provide 32bit values only. ++ */ ++static void bond_fold_stats(struct rtnl_link_stats64 *_res, ++ const struct rtnl_link_stats64 *_new, ++ const struct rtnl_link_stats64 *_old) ++{ ++ const u64 *new = (const u64 *)_new; ++ const u64 *old = (const u64 *)_old; ++ u64 *res = (u64 *)_res; ++ int i; ++ ++ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { ++ u64 nv = new[i]; ++ u64 ov = old[i]; ++ ++ /* detects if this particular field is 32bit only */ ++ if (((nv | ov) >> 32) == 0) ++ res[i] += (u32)nv - (u32)ov; ++ else ++ res[i] += nv - ov; ++ } ++} ++ + static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, + struct rtnl_link_stats64 *stats) + { +@@ -3176,43 +3200,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, + struct list_head *iter; + struct slave *slave; + ++ spin_lock(&bond->stats_lock); + memcpy(stats, &bond->bond_stats, sizeof(*stats)); + +- bond_for_each_slave(bond, slave, iter) { +- const struct rtnl_link_stats64 *sstats = ++ rcu_read_lock(); ++ bond_for_each_slave_rcu(bond, slave, iter) { ++ const struct rtnl_link_stats64 *new = + dev_get_stats(slave->dev, &temp); +- struct rtnl_link_stats64 *pstats = &slave->slave_stats; +- +- stats->rx_packets += sstats->rx_packets - pstats->rx_packets; +- stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes; +- stats->rx_errors += sstats->rx_errors - pstats->rx_errors; +- stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped; +- +- stats->tx_packets += sstats->tx_packets - pstats->tx_packets;; +- stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes; +- stats->tx_errors += sstats->tx_errors - pstats->tx_errors; +- stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped; +- +- stats->multicast += sstats->multicast - pstats->multicast; +- stats->collisions += sstats->collisions - pstats->collisions; +- +- stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors; +- stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors; +- stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors; +- stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors; +- stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors; +- stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors; +- +- stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors; +- stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors; +- stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors; +- stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors; +- stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors; ++ ++ bond_fold_stats(stats, new, &slave->slave_stats); + + /* save off the slave stats for the next run */ +- memcpy(pstats, sstats, sizeof(*sstats)); ++ memcpy(&slave->slave_stats, new, sizeof(*new)); + } ++ rcu_read_unlock(); ++ + memcpy(&bond->bond_stats, stats, sizeof(*stats)); ++ spin_unlock(&bond->stats_lock); + + return stats; + } +@@ -4021,6 +4025,7 @@ void bond_setup(struct net_device *bond_dev) + struct bonding *bond = netdev_priv(bond_dev); + + spin_lock_init(&bond->mode_lock); ++ spin_lock_init(&bond->stats_lock); + bond->params = bonding_defaults; + + /* Initialize pointers */ +diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c +index 84a09e8..5086ec9 100644 +--- a/drivers/net/ethernet/atheros/atlx/atl2.c ++++ b/drivers/net/ethernet/atheros/atlx/atl2.c +@@ -1412,7 +1412,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = -EIO; + +- netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX; ++ netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX; + netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX); + + /* Init PHY as early as possible due to power saving issue */ +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 209b572..2a13c58 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -714,7 +714,11 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev, + else + p = (char *)priv; + p += s->stat_offset; +- data[i] = *(u32 *)p; ++ if (sizeof(unsigned long) != sizeof(u32) && ++ s->stat_sizeof == sizeof(unsigned long)) ++ data[i] = *(unsigned long *)p; ++ else ++ data[i] = *(u32 *)p; + } + } + +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index 44ce7d8..9fbabb7 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -3316,13 +3316,14 @@ jme_resume(struct device *dev) + jme_reset_phy_processor(jme); + jme_phy_calibration(jme); + jme_phy_setEA(jme); +- jme_start_irq(jme); + netif_device_attach(netdev); + + atomic_inc(&jme->link_changing); + + jme_reset_link(jme); + ++ jme_start_irq(jme); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index ef5aed3..36eec7b 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, + return; + } + skb_reserve(new_skb, NET_IP_ALIGN); ++ ++ pci_dma_sync_single_for_cpu(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); ++ + memcpy(skb_put(new_skb, length), skb->data, length); ++ ++ pci_dma_sync_single_for_device(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); + skb = new_skb; + + /* Frame error, so drop the packet. */ +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index fd6a614..80cdf1b 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -812,6 +812,7 @@ qcaspi_netdev_setup(struct net_device *dev) + dev->netdev_ops = &qcaspi_netdev_ops; + qcaspi_set_ethtool_ops(dev); + dev->watchdog_timeo = QCASPI_TX_TIMEOUT; ++ dev->priv_flags &= ~IFF_TX_SKB_SHARING; + dev->tx_queue_len = 100; + + qca = netdev_priv(dev); +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 8fd0a6b..b03d858 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1168,7 +1168,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); + + /* Mark the last entry as wrapping the ring. */ +- rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); ++ if (rxdesc) ++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); + + memset(mdp->tx_ring, 0, tx_ringsize); + +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 5fae435..0793ab8 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1874,8 +1874,6 @@ davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv) + pdata->hw_ram_addr = auxdata->hw_ram_addr; + } + +- pdev->dev.platform_data = pdata; +- + return pdata; + } + +@@ -2082,6 +2080,7 @@ static int davinci_emac_remove(struct platform_device *pdev) + cpdma_ctlr_destroy(priv->dma); + + unregister_netdev(ndev); ++ pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + + return 0; +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 73437568..005a407 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -710,6 +710,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, + macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN; + if (copylen > good_linear) + copylen = good_linear; ++ else if (copylen < ETH_HLEN) ++ copylen = ETH_HLEN; + linear = copylen; + i = *from; + iov_iter_advance(&i, copylen); +@@ -719,10 +721,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, + + if (!zerocopy) { + copylen = len; +- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear) ++ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); ++ if (linear > good_linear) + linear = good_linear; +- else +- linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); ++ else if (linear < ETH_HLEN) ++ linear = ETH_HLEN; + } + + skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen, +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index c12ce3d..deacba3 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -843,7 +843,11 @@ advance: + + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; + +- /* reset data interface */ ++ /* Reset data interface. Some devices will not reset properly ++ * unless they are configured first. Toggle the altsetting to ++ * force a reset ++ */ ++ usb_set_interface(dev->udev, iface_no, data_altsetting); + temp = usb_set_interface(dev->udev, iface_no, 0); + if (temp) { + dev_dbg(&intf->dev, "set interface failed\n"); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 71f5521..d2923cb 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -753,6 +753,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ + {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ ++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +@@ -771,8 +772,10 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */ + {QMI_FIXED_INTF(0x1199, 0x9070, 8)}, /* Sierra Wireless MC74xx/EM74xx */ + {QMI_FIXED_INTF(0x1199, 0x9070, 10)}, /* Sierra Wireless MC74xx/EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx/EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx/EM74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 7a59893..bb57091 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1755,6 +1755,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index 44541db..69b994f 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dev->mem_start = card->phys_mem + + BUF_OFFSET ( txBuffer[i][0][0]); + dev->mem_end = card->phys_mem +- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); + dev->base_addr = card->pci_conf; + dev->irq = card->irq; + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 772f7c4..64ac7b1 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -1273,9 +1273,9 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, + + /* Parse pins in each row from LSB */ + while (mask) { +- bit_pos = ffs(mask); ++ bit_pos = __ffs(mask); + pin_num_from_lsb = bit_pos / pcs->bits_per_pin; +- mask_pos = ((pcs->fmask) << (bit_pos - 1)); ++ mask_pos = ((pcs->fmask) << bit_pos); + val_pos = val & mask_pos; + submask = mask & mask_pos; + +@@ -1851,7 +1851,7 @@ static int pcs_probe(struct platform_device *pdev) + ret = of_property_read_u32(np, "pinctrl-single,function-mask", + &pcs->fmask); + if (!ret) { +- pcs->fshift = ffs(pcs->fmask) - 1; ++ pcs->fshift = __ffs(pcs->fmask); + pcs->fmax = pcs->fmask >> pcs->fshift; + } else { + /* If mask property doesn't exist, function mux is invalid. */ +diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c +index 75d9896..e6f54d3 100644 +--- a/drivers/s390/block/scm_blk.c ++++ b/drivers/s390/block/scm_blk.c +@@ -303,7 +303,7 @@ static void scm_blk_request(struct request_queue *rq) + if (req->cmd_type != REQ_TYPE_FS) { + blk_start_request(req); + blk_dump_rq_flags(req, KMSG_COMPONENT " bad request"); +- blk_end_request_all(req, -EIO); ++ __blk_end_request_all(req, -EIO); + continue; + } + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 9eb1cff..b8b580e 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd, + if (companion->bus != pdev->bus || + PCI_SLOT(companion->devfn) != slot) + continue; ++ ++ /* ++ * Companion device should be either UHCI,OHCI or EHCI host ++ * controller, otherwise skip. ++ */ ++ if (companion->class != CL_UHCI && companion->class != CL_OHCI && ++ companion->class != CL_EHCI) ++ continue; ++ + companion_hcd = pci_get_drvdata(companion); + if (!companion_hcd || !companion_hcd->self.root_hub) + continue; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 4d45551..00e9527 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1882,6 +1882,12 @@ no_bw: + kfree(xhci->rh_bw); + kfree(xhci->ext_caps); + ++ xhci->usb2_ports = NULL; ++ xhci->usb3_ports = NULL; ++ xhci->port_array = NULL; ++ xhci->rh_bw = NULL; ++ xhci->ext_caps = NULL; ++ + xhci->page_size = 0; + xhci->page_shift = 0; + xhci->bus_state[0].bus_suspended = 0; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 3f4a666..baec4e0 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -41,6 +41,7 @@ + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f + #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 ++#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8 + + static const char hcd_name[] = "xhci_hcd"; + +@@ -142,7 +143,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) { ++ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) { + xhci->quirks |= XHCI_PME_STUCK_QUIRK; + } + if (pdev->vendor == PCI_VENDOR_ID_ETRON && +@@ -284,6 +286,7 @@ static void xhci_pci_remove(struct pci_dev *dev) + struct xhci_hcd *xhci; + + xhci = hcd_to_xhci(pci_get_drvdata(dev)); ++ xhci->xhc_state |= XHCI_STATE_REMOVING; + if (xhci->shared_hcd) { + usb_remove_hcd(xhci->shared_hcd); + usb_put_hcd(xhci->shared_hcd); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index fb9c10e..24bb0bc 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3804,8 +3804,12 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd, + { + int reserved_trbs = xhci->cmd_ring_reserved_trbs; + int ret; +- if (xhci->xhc_state & XHCI_STATE_DYING) ++ ++ if ((xhci->xhc_state & XHCI_STATE_DYING) || ++ (xhci->xhc_state & XHCI_STATE_HALTED)) { ++ xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n"); + return -ESHUTDOWN; ++ } + + if (!command_must_succeed) + reserved_trbs++; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 37c469f..9efd1b4 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci) + "waited %u microseconds.\n", + XHCI_MAX_HALT_USEC); + if (!ret) +- xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING); ++ /* clear state flags. Including dying, halted or removing */ ++ xhci->xhc_state = 0; + + return ret; + } +@@ -1116,8 +1117,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + /* Resume root hubs only when have pending events. */ + status = readl(&xhci->op_regs->status); + if (status & STS_EINT) { +- usb_hcd_resume_root_hub(hcd); + usb_hcd_resume_root_hub(xhci->shared_hcd); ++ usb_hcd_resume_root_hub(hcd); + } + } + +@@ -1132,10 +1133,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + /* Re-enable port polling. */ + xhci_dbg(xhci, "%s: starting port polling.\n", __func__); +- set_bit(HCD_FLAG_POLL_RH, &hcd->flags); +- usb_hcd_poll_rh_status(hcd); + set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + usb_hcd_poll_rh_status(xhci->shared_hcd); ++ set_bit(HCD_FLAG_POLL_RH, &hcd->flags); ++ usb_hcd_poll_rh_status(hcd); + + return retval; + } +@@ -2762,7 +2763,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) + if (ret <= 0) + return ret; + xhci = hcd_to_xhci(hcd); +- if (xhci->xhc_state & XHCI_STATE_DYING) ++ if ((xhci->xhc_state & XHCI_STATE_DYING) || ++ (xhci->xhc_state & XHCI_STATE_REMOVING)) + return -ENODEV; + + xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev); +@@ -3811,7 +3813,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, + + mutex_lock(&xhci->mutex); + +- if (xhci->xhc_state) /* dying or halted */ ++ if (xhci->xhc_state) /* dying, removing or halted */ + goto out; + + if (!udev->slot_id) { +@@ -4938,6 +4940,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + goto error; + xhci_dbg(xhci, "Reset complete\n"); + ++ /* ++ * On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0) ++ * of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit ++ * address memory pointers actually. So, this driver clears the AC64 ++ * bit of xhci->hcc_params to call dma_set_coherent_mask(dev, ++ * DMA_BIT_MASK(32)) in this xhci_gen_setup(). ++ */ ++ if (xhci->quirks & XHCI_NO_64BIT_SUPPORT) ++ xhci->hcc_params &= ~BIT(0); ++ + /* Set dma_mask and coherent_dma_mask to 64-bits, + * if xHC supports 64-bit addressing */ + if (HCC_64BIT_ADDR(xhci->hcc_params) && +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 75281ba..ab1e2ec 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1534,6 +1534,7 @@ struct xhci_hcd { + */ + #define XHCI_STATE_DYING (1 << 0) + #define XHCI_STATE_HALTED (1 << 1) ++#define XHCI_STATE_REMOVING (1 << 2) + /* Statistics */ + int error_bitmask; + unsigned int quirks; +@@ -1568,6 +1569,7 @@ struct xhci_hcd { + /* For controllers with a broken beyond repair streams implementation */ + #define XHCI_BROKEN_STREAMS (1 << 19) + #define XHCI_PME_STUCK_QUIRK (1 << 20) ++#define XHCI_NO_64BIT_SUPPORT (1 << 23) + unsigned int num_active_eps; + unsigned int limit_active_eps; + /* There are two roothubs to keep track of bus suspend info for */ +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 637ee77..546bb2b 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -2,7 +2,7 @@ + * USB Attached SCSI + * Note that this is not the same as the USB Mass Storage driver + * +- * Copyright Hans de Goede <[email protected]> for Red Hat, Inc. 2013 - 2014 ++ * Copyright Hans de Goede <[email protected]> for Red Hat, Inc. 2013 - 2016 + * Copyright Matthew Wilcox for Intel Corp, 2010 + * Copyright Sarah Sharp for Intel Corp, 2010 + * +@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd) + return SUCCESS; + } + ++static int uas_target_alloc(struct scsi_target *starget) ++{ ++ struct uas_dev_info *devinfo = (struct uas_dev_info *) ++ dev_to_shost(starget->dev.parent)->hostdata; ++ ++ if (devinfo->flags & US_FL_NO_REPORT_LUNS) ++ starget->no_report_luns = 1; ++ ++ return 0; ++} ++ + static int uas_slave_alloc(struct scsi_device *sdev) + { + struct uas_dev_info *devinfo = +@@ -808,6 +819,7 @@ static struct scsi_host_template uas_host_template = { + .module = THIS_MODULE, + .name = "uas", + .queuecommand = uas_queuecommand, ++ .target_alloc = uas_target_alloc, + .slave_alloc = uas_slave_alloc, + .slave_configure = uas_slave_configure, + .eh_abort_handler = uas_eh_abort_handler, +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index ccc113e..53341a7 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_ATA_1X), + ++/* Reported-by: David Webb <[email protected]> */ ++UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999, ++ "Seagate", ++ "Expansion Desk", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_LUNS), ++ + /* Reported-by: Hans de Goede <[email protected]> */ + UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, + "Seagate", +diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c +index 9c5eb04..e1a6f49 100644 +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -480,7 +480,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) + US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 | + US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE | + US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES | +- US_FL_MAX_SECTORS_240); ++ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS); + + p = quirks; + while (*p) { +@@ -530,6 +530,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) + case 'i': + f |= US_FL_IGNORE_DEVICE; + break; ++ case 'j': ++ f |= US_FL_NO_REPORT_LUNS; ++ break; + case 'l': + f |= US_FL_NOT_LOCKABLE; + break; +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 32c0b6b..a9c5f60 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -440,13 +440,14 @@ static int clcdfb_register(struct clcd_fb *fb) + fb->off_ienb = CLCD_PL111_IENB; + fb->off_cntl = CLCD_PL111_CNTL; + } else { +-#ifdef CONFIG_ARCH_VERSATILE +- fb->off_ienb = CLCD_PL111_IENB; +- fb->off_cntl = CLCD_PL111_CNTL; +-#else +- fb->off_ienb = CLCD_PL110_IENB; +- fb->off_cntl = CLCD_PL110_CNTL; +-#endif ++ if (of_machine_is_compatible("arm,versatile-ab") || ++ of_machine_is_compatible("arm,versatile-pb")) { ++ fb->off_ienb = CLCD_PL111_IENB; ++ fb->off_cntl = CLCD_PL111_CNTL; ++ } else { ++ fb->off_ienb = CLCD_PL110_IENB; ++ fb->off_cntl = CLCD_PL110_CNTL; ++ } + } + + fb->clk = clk_get(&fb->dev->dev, NULL); +diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h +index 461a055..cebecff 100644 +--- a/include/drm/drm_cache.h ++++ b/include/drm/drm_cache.h +@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memory(void) + { + #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE) + return false; ++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3) ++ return false; + #else + return true; + #endif +diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h +index e235ec5..5070b94 100644 +--- a/include/linux/hugetlb.h ++++ b/include/linux/hugetlb.h +@@ -462,15 +462,14 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h, + return &mm->page_table_lock; + } + +-static inline bool hugepages_supported(void) +-{ +- /* +- * Some platform decide whether they support huge pages at boot +- * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when +- * there is no such support +- */ +- return HPAGE_SHIFT != 0; +-} ++#ifndef hugepages_supported ++/* ++ * Some platform decide whether they support huge pages at boot ++ * time. Some of them, such as powerpc, set HPAGE_SHIFT to 0 ++ * when there is no such support ++ */ ++#define hugepages_supported() (HPAGE_SHIFT != 0) ++#endif + + #else /* CONFIG_HUGETLB_PAGE */ + struct hstate {}; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 840fb7f..b186193 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -265,6 +265,7 @@ struct header_ops { + void (*cache_update)(struct hh_cache *hh, + const struct net_device *dev, + const unsigned char *haddr); ++ bool (*validate)(const char *ll_header, unsigned int len); + }; + + /* These flag bits are private to the generic network queueing +@@ -1356,7 +1357,7 @@ enum netdev_priv_flags { + * @dma: DMA channel + * @mtu: Interface MTU value + * @type: Interface hardware type +- * @hard_header_len: Hardware header length ++ * @hard_header_len: Maximum hardware header length. + * + * @needed_headroom: Extra headroom the hardware may need, but not in all + * cases can this be guaranteed +@@ -2339,6 +2340,24 @@ static inline int dev_rebuild_header(struct sk_buff *skb) + return dev->header_ops->rebuild(skb); + } + ++/* ll_header must have at least hard_header_len allocated */ ++static inline bool dev_validate_header(const struct net_device *dev, ++ char *ll_header, int len) ++{ ++ if (likely(len >= dev->hard_header_len)) ++ return true; ++ ++ if (capable(CAP_SYS_RAWIO)) { ++ memset(ll_header + len, 0, dev->hard_header_len - len); ++ return true; ++ } ++ ++ if (dev->header_ops && dev->header_ops->validate) ++ return dev->header_ops->validate(ll_header, len); ++ ++ return false; ++} ++ + typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len); + int register_gifconf(unsigned int family, gifconf_func_t *gifconf); + static inline int unregister_gifconf(unsigned int family) +diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h +index 7f5f78b..245f57d 100644 +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -79,6 +79,8 @@ + /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \ + US_FLAG(MAX_SECTORS_240, 0x08000000) \ + /* Sets max_sectors to 240 */ \ ++ US_FLAG(NO_REPORT_LUNS, 0x10000000) \ ++ /* Cannot handle REPORT_LUNS */ \ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 983a94b..bf97043 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -212,6 +212,7 @@ struct bonding { + * ALB mode (6) - to sync the use and modifications of its hash table + */ + spinlock_t mode_lock; ++ spinlock_t stats_lock; + u8 send_peer_notif; + u8 igmp_retrans; + #ifdef CONFIG_PROC_FS +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 7f68ff6..0d2cbc9 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1213,6 +1213,7 @@ static int check_ld_abs(struct verifier_env *env, struct bpf_insn *insn) + } + + if (insn->dst_reg != BPF_REG_0 || insn->off != 0 || ++ BPF_SIZE(insn->code) == BPF_DW || + (mode == BPF_ABS && insn->src_reg != BPF_REG_0)) { + verbose("BPF_LD_ABS uses reserved fields\n"); + return -EINVAL; +diff --git a/kernel/futex.c b/kernel/futex.c +index 1c43013..6992123 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1157,10 +1157,20 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this) + */ + newval = FUTEX_WAITERS | task_pid_vnr(new_owner); + +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) ++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) { + ret = -EFAULT; +- else if (curval != uval) +- ret = -EINVAL; ++ } else if (curval != uval) { ++ /* ++ * If a unconditional UNLOCK_PI operation (user space did not ++ * try the TID->0 transition) raced with a waiter setting the ++ * FUTEX_WAITERS flag between get_user() and locking the hash ++ * bucket lock, retry the operation. ++ */ ++ if ((FUTEX_TID_MASK & curval) == uval) ++ ret = -EAGAIN; ++ else ++ ret = -EINVAL; ++ } + if (ret) { + raw_spin_unlock(&pi_state->pi_mutex.wait_lock); + return ret; +@@ -1371,8 +1381,8 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1, + if (likely(&hb1->chain != &hb2->chain)) { + plist_del(&q->list, &hb1->chain); + hb_waiters_dec(hb1); +- plist_add(&q->list, &hb2->chain); + hb_waiters_inc(hb2); ++ plist_add(&q->list, &hb2->chain); + q->lock_ptr = &hb2->lock; + } + get_futex_key_refs(key2); +@@ -2419,6 +2429,15 @@ retry: + */ + if (ret == -EFAULT) + goto pi_faulted; ++ /* ++ * A unconditional UNLOCK_PI op raced against a waiter ++ * setting the FUTEX_WAITERS bit. Try again. ++ */ ++ if (ret == -EAGAIN) { ++ spin_unlock(&hb->lock); ++ put_futex_key(&key); ++ goto retry; ++ } + goto out_unlock; + } + +diff --git a/lib/assoc_array.c b/lib/assoc_array.c +index 03dd576..59fd7c0 100644 +--- a/lib/assoc_array.c ++++ b/lib/assoc_array.c +@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit, + free_slot = i; + continue; + } +- if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) { ++ if (assoc_array_ptr_is_leaf(ptr) && ++ ops->compare_object(assoc_array_ptr_to_leaf(ptr), ++ index_key)) { + pr_devel("replace in slot %d\n", i); + edit->leaf_p = &node->slots[i]; + edit->dead_leaf = node->slots[i]; +diff --git a/lib/lz4/lz4defs.h b/lib/lz4/lz4defs.h +index abcecdc..0710a62 100644 +--- a/lib/lz4/lz4defs.h ++++ b/lib/lz4/lz4defs.h +@@ -11,8 +11,7 @@ + /* + * Detects 64 bits mode + */ +-#if (defined(__x86_64__) || defined(__x86_64) || defined(__amd64__) \ +- || defined(__ppc64__) || defined(__LP64__)) ++#if defined(CONFIG_64BIT) + #define LZ4_ARCH64 1 + #else + #define LZ4_ARCH64 0 +@@ -35,6 +34,10 @@ typedef struct _U64_S { u64 v; } U64_S; + + #define PUT4(s, d) (A32(d) = A32(s)) + #define PUT8(s, d) (A64(d) = A64(s)) ++ ++#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ ++ (d = s - A16(p)) ++ + #define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ + do { \ + A16(p) = v; \ +@@ -51,10 +54,13 @@ typedef struct _U64_S { u64 v; } U64_S; + #define PUT8(s, d) \ + put_unaligned(get_unaligned((const u64 *) s), (u64 *) d) + +-#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ +- do { \ +- put_unaligned(v, (u16 *)(p)); \ +- p += 2; \ ++#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ ++ (d = s - get_unaligned_le16(p)) ++ ++#define LZ4_WRITE_LITTLEENDIAN_16(p, v) \ ++ do { \ ++ put_unaligned_le16(v, (u16 *)(p)); \ ++ p += 2; \ + } while (0) + #endif + +@@ -140,9 +146,6 @@ typedef struct _U64_S { u64 v; } U64_S; + + #endif + +-#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \ +- (d = s - get_unaligned_le16(p)) +- + #define LZ4_WILDCOPY(s, d, e) \ + do { \ + LZ4_COPYPACKET(s, d); \ +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index e732b7e..743ee58 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -871,7 +871,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, + + rtnl_link_get_size(dev) /* IFLA_LINKINFO */ + + rtnl_link_get_af_size(dev) /* IFLA_AF_SPEC */ + + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */ +- + nla_total_size(MAX_PHYS_ITEM_ID_LEN); /* IFLA_PHYS_SWITCH_ID */ ++ + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */ ++ + nla_total_size(IFNAMSIZ); /* IFLA_PHYS_PORT_NAME */ + } + + static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index d1e208b..1572ef1 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -653,6 +653,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + inner_iph = (const struct iphdr *)skb_inner_network_header(skb); + connected = (tunnel->parms.iph.daddr != 0); + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + dst = tnl_params->daddr; + if (dst == 0) { + /* NBMA tunnel */ +@@ -750,7 +752,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + tunnel->err_time + IPTUNNEL_ERR_TIMEO)) { + tunnel->err_count--; + +- memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + dst_link_failure(skb); + } else + tunnel->err_count = 0; +diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c +index 1671263..83e08ac 100644 +--- a/net/ipv4/udp_tunnel.c ++++ b/net/ipv4/udp_tunnel.c +@@ -90,6 +90,8 @@ int udp_tunnel_xmit_skb(struct socket *sock, struct rtable *rt, + uh->source = src_port; + uh->len = htons(skb->len); + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + udp_set_csum(sock->sk->sk_no_check_tx, skb, src, dst, skb->len); + + return iptunnel_xmit(sock->sk, rt, skb, src, dst, IPPROTO_UDP, +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 7a40c64..e90f3c3 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -783,6 +783,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev) + __u32 mtu; + int err; + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) + encap_limit = t->parms.encap_limit; + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 91baf46..7aefab4 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1130,6 +1130,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + u8 tproto; + int err; + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + tproto = ACCESS_ONCE(t->parms.proto); + if (tproto != IPPROTO_IPIP && tproto != 0) + return -1; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index d2839a2..b762245 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -916,11 +916,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + ret = udpv6_queue_rcv_skb(sk, skb); + sock_put(sk); + +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ ++ /* a return value > 0 means to resubmit the input */ + if (ret > 0) +- return -ret; ++ return ret; + + return 0; + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 05dfc8a..cb24e2b 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 8611f1b..1f979a6 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index fe3f86d..377e1de 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3158,6 +3158,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) + i->ifindex = mreq->mr_ifindex; + i->alen = mreq->mr_alen; + memcpy(i->addr, mreq->mr_address, i->alen); ++ memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen); + i->count = 1; + i->next = po->mclist; + po->mclist = i; +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 507edcf..4900354 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -159,12 +159,15 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q, + if (validate) + skb = validate_xmit_skb_list(skb, dev); + +- if (skb) { ++ if (likely(skb)) { + HARD_TX_LOCK(dev, txq, smp_processor_id()); + if (!netif_xmit_frozen_or_stopped(txq)) + skb = dev_hard_start_xmit(skb, dev, txq, &ret); + + HARD_TX_UNLOCK(dev, txq); ++ } else { ++ spin_lock(root_lock); ++ return qdisc_qlen(q); + } + spin_lock(root_lock); + +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 3267a5c..18361cb 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -519,6 +519,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1, + } + return 0; + } ++ if (addr1->v6.sin6_port != addr2->v6.sin6_port) ++ return 0; + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; + /* If this is a linklocal address, compare the scope_id. */ +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 49cc71c..1183635 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -12473,7 +12473,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, + struct wireless_dev *wdev; + struct cfg80211_beacon_registration *reg, *tmp; + +- if (state != NETLINK_URELEASE) ++ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) + return NOTIFY_DONE; + + rcu_read_lock(); +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 85d1d47..f53c2ab 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -277,12 +277,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; + + skb_dst_force(skb); ++ dev_hold(skb->dev); + + nexthdr = x->type->input(x, skb); + + if (nexthdr == -EINPROGRESS) + return 0; + resume: ++ dev_put(skb->dev); ++ + spin_lock(&x->lock); + if (nexthdr <= 0) { + if (nexthdr == -EBADMSG) { +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 42d9f62..f093223 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1555,6 +1555,8 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll) + + mutex_lock(&per_pin->lock); + pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE); ++ eld->monitor_present = pin_eld->monitor_present; ++ + if (pin_eld->monitor_present) + eld->eld_valid = !!(present & AC_PINSENSE_ELDV); + else +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0c1bf57..9ccf879 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4966,6 +4966,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK), + SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK), + SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), +diff --git a/sound/pci/pcxhr/pcxhr_core.c b/sound/pci/pcxhr/pcxhr_core.c +index 181f772..16b0702 100644 +--- a/sound/pci/pcxhr/pcxhr_core.c ++++ b/sound/pci/pcxhr/pcxhr_core.c +@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, void *dev_id) + } + + pcxhr_msg_thread(mgr); ++ mutex_unlock(&mgr->lock); + return IRQ_HANDLED; + } +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index ddca654..1f8fb0d9 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = { + }; + + /* ++ * Dell usb dock with ALC4020 codec had a firmware problem where it got ++ * screwed up when zero volume is passed; just skip it as a workaround ++ */ ++static const struct usbmix_name_map dell_alc4020_map[] = { ++ { 16, NULL }, ++ { 19, NULL }, ++ { 0 } ++}; ++ ++/* + * Control map entries + */ + +@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .map = aureon_51_2_map, + }, + { ++ .id = USB_ID(0x0bda, 0x4014), ++ .map = dell_alc4020_map, ++ }, ++ { + .id = USB_ID(0x0dba, 0x1000), + .map = mbox1_map, + }, diff --git a/debian/patches/series b/debian/patches/series index 9bd0aa4..36e52cb 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -95,3 +95,4 @@ bugfix/all/stable-3.19.8-ckt17.patch bugfix/all/stable-3.19.8-ckt18.patch bugfix/all/stable-3.19.8-ckt19.patch +bugfix/all/stable-3.19.8-ckt20.patch -- To view, visit https://gerrit.wikimedia.org/r/286393 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I11ec7ecc045395146682d03b03d0da50e0171bf6 Gerrit-PatchSet: 1 Gerrit-Project: operations/debs/linux Gerrit-Branch: master Gerrit-Owner: Muehlenhoff <[email protected]> Gerrit-Reviewer: Muehlenhoff <[email protected]> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
