From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E80EB138330 for ; Sun, 18 Sep 2016 12:47:21 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 94ACE21C06C; Sun, 18 Sep 2016 12:47:18 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 27A4721C06C for ; Sun, 18 Sep 2016 12:47:18 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id BA9CE340BD3 for ; Sun, 18 Sep 2016 12:47:16 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 46C762478 for ; Sun, 18 Sep 2016 12:47:14 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1474202825.859d270f730c3d0b708c6cc88ddfc3ed97fc5b3a.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.1 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1031_linux-4.1.32.patch 1032_linux-4.1.33.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 859d270f730c3d0b708c6cc88ddfc3ed97fc5b3a X-VCS-Branch: 4.1 Date: Sun, 18 Sep 2016 12:47:14 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 7f90935f-8d5f-4e08-a006-95cf38b3433d X-Archives-Hash: cc5e0b7c3ce737085f45484d102d69d8 commit: 859d270f730c3d0b708c6cc88ddfc3ed97fc5b3a Author: Mike Pagano gentoo org> AuthorDate: Sun Sep 18 12:47:05 2016 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun Sep 18 12:47:05 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=859d270f Linux patch 4.1.32. Linux patch 4.1.33 0000_README | 8 + 1031_linux-4.1.32.patch | 1489 +++++++++++++++++++++++++++++++++++++++++++++++ 1032_linux-4.1.33.patch | 982 +++++++++++++++++++++++++++++++ 3 files changed, 2479 insertions(+) diff --git a/0000_README b/0000_README index 0ce7ab6..9a2fbfa 100644 --- a/0000_README +++ b/0000_README @@ -167,6 +167,14 @@ Patch: 1030_linux-4.1.31.patch From: http://www.kernel.org Desc: Linux 4.1.31 +Patch: 1031_linux-4.1.32.patch +From: http://www.kernel.org +Desc: Linux 4.1.32 + +Patch: 1032_linux-4.1.33.patch +From: http://www.kernel.org +Desc: Linux 4.1.33 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1031_linux-4.1.32.patch b/1031_linux-4.1.32.patch new file mode 100644 index 0000000..87bef87 --- /dev/null +++ b/1031_linux-4.1.32.patch @@ -0,0 +1,1489 @@ +diff --git a/Makefile b/Makefile +index bea5ca2ca2b0..e995f28b6d37 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 1 +-SUBLEVEL = 31 ++SUBLEVEL = 32 + EXTRAVERSION = + NAME = Series 4800 + +diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h +index 884081099f80..81cdbc36699b 100644 +--- a/arch/arc/include/asm/entry.h ++++ b/arch/arc/include/asm/entry.h +@@ -143,8 +143,6 @@ + POP r13 + .endm + +-#define OFF_USER_R25_FROM_R24 (SZ_CALLEE_REGS + SZ_PT_REGS - 8)/4 +- + /*-------------------------------------------------------------- + * Collect User Mode callee regs as struct callee_regs - needed by + * fork/do_signal/unaligned-access-emulation. +@@ -157,12 +155,13 @@ + *-------------------------------------------------------------*/ + .macro SAVE_CALLEE_SAVED_USER + ++ mov r12, sp ; save SP as ref to pt_regs + SAVE_R13_TO_R24 + + #ifdef CONFIG_ARC_CURR_IN_REG +- ; Retrieve orig r25 and save it on stack +- ld.as r12, [sp, OFF_USER_R25_FROM_R24] +- st.a r12, [sp, -4] ++ ; Retrieve orig r25 and save it with rest of callee_regs ++ ld r12, [r12, PT_user_r25] ++ PUSH r12 + #else + PUSH r25 + #endif +@@ -209,12 +208,16 @@ + .macro RESTORE_CALLEE_SAVED_USER + + #ifdef CONFIG_ARC_CURR_IN_REG +- ld.ab r12, [sp, 4] +- st.as r12, [sp, OFF_USER_R25_FROM_R24] ++ POP r12 + #else + POP r25 + #endif + RESTORE_R24_TO_R13 ++ ++ ; SP is back to start of pt_regs ++#ifdef CONFIG_ARC_CURR_IN_REG ++ st r12, [sp, PT_user_r25] ++#endif + .endm + + /*-------------------------------------------------------------- +diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h +index 27ecc6975a58..853a80ee7aaa 100644 +--- a/arch/arc/include/asm/irqflags.h ++++ b/arch/arc/include/asm/irqflags.h +@@ -168,10 +168,10 @@ static inline int arch_irqs_disabled(void) + .endm + + .macro IRQ_ENABLE scratch ++ TRACE_ASM_IRQ_ENABLE + lr \scratch, [status32] + or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) + flag \scratch +- TRACE_ASM_IRQ_ENABLE + .endm + + #endif /* __ASSEMBLY__ */ +diff --git a/arch/arc/include/uapi/asm/elf.h b/arch/arc/include/uapi/asm/elf.h +index 0f99ac8fcbb2..0037a587320d 100644 +--- a/arch/arc/include/uapi/asm/elf.h ++++ b/arch/arc/include/uapi/asm/elf.h +@@ -13,8 +13,15 @@ + + /* Machine specific ELF Hdr flags */ + #define EF_ARC_OSABI_MSK 0x00000f00 +-#define EF_ARC_OSABI_ORIG 0x00000000 /* MUST be zero for back-compat */ +-#define EF_ARC_OSABI_CURRENT 0x00000300 /* v3 (no legacy syscalls) */ ++ ++#define EF_ARC_OSABI_V3 0x00000300 /* v3 (no legacy syscalls) */ ++#define EF_ARC_OSABI_V4 0x00000400 /* v4 (64bit data any reg align) */ ++ ++#if __GNUC__ < 6 ++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V3 ++#else ++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V4 ++#endif + + typedef unsigned long elf_greg_t; + typedef unsigned long elf_fpregset_t; +diff --git a/arch/arc/kernel/arcksyms.c b/arch/arc/kernel/arcksyms.c +index 4d9e77724bed..000dd041ab42 100644 +--- a/arch/arc/kernel/arcksyms.c ++++ b/arch/arc/kernel/arcksyms.c +@@ -28,6 +28,7 @@ extern void __muldf3(void); + extern void __divdf3(void); + extern void __floatunsidf(void); + extern void __floatunsisf(void); ++extern void __udivdi3(void); + + EXPORT_SYMBOL(__ashldi3); + EXPORT_SYMBOL(__ashrdi3); +@@ -45,6 +46,7 @@ EXPORT_SYMBOL(__muldf3); + EXPORT_SYMBOL(__divdf3); + EXPORT_SYMBOL(__floatunsidf); + EXPORT_SYMBOL(__floatunsisf); ++EXPORT_SYMBOL(__udivdi3); + + /* ARC optimised assembler routines */ + EXPORT_SYMBOL(memset); +diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c +index 6c3aa0edb9b5..5f14311ce59e 100644 +--- a/arch/arc/kernel/asm-offsets.c ++++ b/arch/arc/kernel/asm-offsets.c +@@ -59,5 +59,7 @@ int main(void) + + DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs)); + DEFINE(SZ_PT_REGS, sizeof(struct pt_regs)); ++ DEFINE(PT_user_r25, offsetof(struct pt_regs, user_r25)); ++ + return 0; + } +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index e095c557afdd..72d3990799d5 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -201,7 +201,7 @@ int elf_check_arch(const struct elf32_hdr *x) + return 0; + + eflags = x->e_flags; +- if ((eflags & EF_ARC_OSABI_MSK) < EF_ARC_OSABI_CURRENT) { ++ if ((eflags & EF_ARC_OSABI_MSK) != EF_ARC_OSABI_CURRENT) { + pr_err("ABI mismatch - you need newer toolchain\n"); + force_sigsegv(SIGSEGV, current); + return 0; +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index 1d167c6df8ca..321a4b67bfa0 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -237,8 +237,10 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len) + cpu->dccm.base_addr, TO_KB(cpu->dccm.sz), + cpu->iccm.base_addr, TO_KB(cpu->iccm.sz)); + +- n += scnprintf(buf + n, len - n, +- "OS ABI [v3]\t: no-legacy-syscalls\n"); ++ n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n", ++ EF_ARC_OSABI_CURRENT >> 8, ++ EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ? ++ "no-legacy-syscalls" : "64-bit data any register aligned"); + + return buf; + } +diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c +index 12b2100db073..9cfaae9887b9 100644 +--- a/arch/arc/mm/cache_arc700.c ++++ b/arch/arc/mm/cache_arc700.c +@@ -155,6 +155,15 @@ void arc_cache_init(void) + + printk(arc_cache_mumbojumbo(0, str, sizeof(str))); + ++ /* ++ * Only master CPU needs to execute rest of function: ++ * - Assume SMP so all cores will have same cache config so ++ * any geomtry checks will be same for all ++ * - IOC setup / dma callbacks only need to be setup once ++ */ ++ if (cpu) ++ return; ++ + if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) { + struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache; + +diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h +index c0ae62520d15..274d5bc6ecce 100644 +--- a/arch/parisc/include/uapi/asm/errno.h ++++ b/arch/parisc/include/uapi/asm/errno.h +@@ -97,10 +97,10 @@ + #define ENOTCONN 235 /* Transport endpoint is not connected */ + #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */ + #define ETOOMANYREFS 237 /* Too many references: cannot splice */ +-#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ + #define ETIMEDOUT 238 /* Connection timed out */ + #define ECONNREFUSED 239 /* Connection refused */ +-#define EREMOTERELEASE 240 /* Remote peer released connection */ ++#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ ++#define EREMOTERELEASE 240 /* Remote peer released connection */ + #define EHOSTDOWN 241 /* Host is down */ + #define EHOSTUNREACH 242 /* No route to host */ + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 9a4e71261fca..b264937bba68 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -678,7 +678,7 @@ int eeh_pci_enable(struct eeh_pe *pe, int function) + /* Check if the request is finished successfully */ + if (active_flag) { + rc = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC); +- if (rc <= 0) ++ if (rc < 0) + return rc; + + if (rc & active_flag) +diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S +index 1dd5bd8a8c59..133055311dce 100644 +--- a/arch/um/include/asm/common.lds.S ++++ b/arch/um/include/asm/common.lds.S +@@ -81,7 +81,7 @@ + .altinstr_replacement : { *(.altinstr_replacement) } + /* .exit.text is discard at runtime, not link time, to deal with references + from .altinstructions and .eh_frame */ +- .exit.text : { *(.exit.text) } ++ .exit.text : { EXIT_TEXT } + .exit.data : { *(.exit.data) } + + .preinit_array : { +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 307a49828826..def2e2e523f1 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1583,6 +1583,9 @@ void __init enable_IR_x2apic(void) + unsigned long flags; + int ret, ir_stat; + ++ if (skip_ioapic_setup) ++ return; ++ + ir_stat = irq_remapping_prepare(); + if (ir_stat < 0 && !x2apic_supported()) + return; +diff --git a/block/blk-core.c b/block/blk-core.c +index 7f29dc0237d1..bbbf36e6066b 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -475,7 +475,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end); + + void blk_set_queue_dying(struct request_queue *q) + { +- queue_flag_set_unlocked(QUEUE_FLAG_DYING, q); ++ spin_lock_irq(q->queue_lock); ++ queue_flag_set(QUEUE_FLAG_DYING, q); ++ spin_unlock_irq(q->queue_lock); + + if (q->mq_ops) + blk_mq_wake_waiters(q); +diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c +index 1928a8912584..b03d7919f919 100644 +--- a/drivers/clocksource/sun4i_timer.c ++++ b/drivers/clocksource/sun4i_timer.c +@@ -120,12 +120,16 @@ static struct clock_event_device sun4i_clockevent = { + .set_next_event = sun4i_clkevt_next_event, + }; + ++static void sun4i_timer_clear_interrupt(void) ++{ ++ writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG); ++} + + static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id) + { + struct clock_event_device *evt = (struct clock_event_device *)dev_id; + +- writel(0x1, timer_base + TIMER_IRQ_ST_REG); ++ sun4i_timer_clear_interrupt(); + evt->event_handler(evt); + + return IRQ_HANDLED; +@@ -190,6 +194,9 @@ static void __init sun4i_timer_init(struct device_node *node) + /* Make sure timer is stopped before playing with interrupts */ + sun4i_clkevt_time_stop(0); + ++ /* clear timer0 interrupt */ ++ sun4i_timer_clear_interrupt(); ++ + sun4i_clockevent.cpumask = cpu_possible_mask; + sun4i_clockevent.irq = irq; + +diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c +index 0436997e054b..9742b3d66288 100644 +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -1862,6 +1862,7 @@ caam_hash_alloc(struct caam_hash_template *template, + template->name); + snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", + template->driver_name); ++ t_alg->ahash_alg.setkey = NULL; + } + alg->cra_module = THIS_MODULE; + alg->cra_init = caam_hash_cra_init; +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index caefe806db5e..c88b01bbf9a3 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -50,6 +50,7 @@ config GPIO_DEVRES + config OF_GPIO + def_bool y + depends on OF ++ depends on HAS_IOMEM + + config GPIO_ACPI + def_bool y +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 800a025dd062..8a9f49b7391b 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -4923,6 +4923,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, + unsigned long flags; + int ret = -EINVAL; + ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return -EINVAL; ++ + if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || + page_flip->reserved != 0) + return -EINVAL; +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index ad90fa3045e5..084dcae37a3d 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -2115,6 +2115,7 @@ void i915_global_gtt_cleanup(struct drm_device *dev) + struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt; + + ppgtt->base.cleanup(&ppgtt->base); ++ kfree(ppgtt); + } + + if (drm_mm_initialized(&vm->mm)) { +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 79bab6fd76bb..eb2a5bac215a 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -586,7 +586,8 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev) || ASIC_IS_DCE8(rdev)) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + /* use frac fb div on RS780/RS880 */ +- if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880)) ++ if (((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880)) ++ && !radeon_crtc->ss_enabled) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + if (ASIC_IS_DCE32(rdev) && mode->clock > 165000) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; +@@ -623,7 +624,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + if (radeon_crtc->ss.refdiv) { + radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV; + radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv; +- if (ASIC_IS_AVIVO(rdev)) ++ if (ASIC_IS_AVIVO(rdev) && ++ rdev->family != CHIP_RS780 && ++ rdev->family != CHIP_RS880) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + } + } +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index 50ce26a3b314..f27d81b61536 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo, + + rdev = radeon_get_rdev(bo->bdev); + ridx = radeon_copy_ring_index(rdev); +- old_start = old_mem->start << PAGE_SHIFT; +- new_start = new_mem->start << PAGE_SHIFT; ++ old_start = (u64)old_mem->start << PAGE_SHIFT; ++ new_start = (u64)new_mem->start << PAGE_SHIFT; + + switch (old_mem->mem_type) { + case TTM_PL_VRAM: +diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c +index f97c73bd14f8..f04fbd3ef9f3 100644 +--- a/drivers/input/keyboard/tegra-kbc.c ++++ b/drivers/input/keyboard/tegra-kbc.c +@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc) + /* Reset the KBC controller to clear all previous status.*/ + reset_control_assert(kbc->rst); + udelay(100); +- reset_control_assert(kbc->rst); ++ reset_control_deassert(kbc->rst); + udelay(100); + + tegra_kbc_config_pins(kbc); +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index e7d7230a7e31..4cfb0ac797ef 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1277,6 +1277,7 @@ static int __init i8042_create_aux_port(int idx) + serio->write = i8042_aux_write; + serio->start = i8042_start; + serio->stop = i8042_stop; ++ serio->ps2_cmd_mutex = &i8042_mutex; + serio->port_data = port; + serio->dev.parent = &i8042_platform_device->dev; + if (idx < 0) { +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 2a102834c2ee..a7a03a21d78a 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1851,7 +1851,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; + + if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || +- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || ++ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || + !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) || +@@ -1876,7 +1876,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + struct block_device *bdev, struct cache *ca) + { + char name[BDEVNAME_SIZE]; +- const char *err = NULL; ++ const char *err = NULL; /* must be set for any error case */ + int ret = 0; + + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); +@@ -1893,8 +1893,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + ca->discard = CACHE_DISCARD(&ca->sb); + + ret = cache_alloc(sb, ca); +- if (ret != 0) ++ if (ret != 0) { ++ if (ret == -ENOMEM) ++ err = "cache_alloc(): -ENOMEM"; ++ else ++ err = "cache_alloc(): unknown error"; + goto err; ++ } + + if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { + err = "error calling kobject_add"; +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 0f5e1820c92d..768c9fdf0df8 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -287,15 +287,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) + pb->bio_submitted = true; + + /* +- * Map reads as normal only if corrupt_bio_byte set. ++ * Error reads if neither corrupt_bio_byte or drop_writes are set. ++ * Otherwise, flakey_end_io() will decide if the reads should be modified. + */ + if (bio_data_dir(bio) == READ) { +- /* If flags were specified, only corrupt those that match. */ +- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && +- all_corrupt_bio_flags_match(bio, fc)) +- goto map_bio; +- else ++ if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags)) + return -EIO; ++ goto map_bio; + } + + /* +@@ -332,14 +330,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error) + struct flakey_c *fc = ti->private; + struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data)); + +- /* +- * Corrupt successful READs while in down state. +- */ + if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { +- if (fc->corrupt_bio_byte) ++ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && ++ all_corrupt_bio_flags_match(bio, fc)) { ++ /* ++ * Corrupt successful matching READs while in down state. ++ */ + corrupt_bio_data(bio, fc); +- else ++ ++ } else if (!test_bit(DROP_WRITES, &fc->flags)) { ++ /* ++ * Error read during the down_interval if drop_writes ++ * wasn't configured. ++ */ + return -EIO; ++ } + } + + return error; +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 92618686604c..9cd27b703dd6 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -1369,10 +1369,10 @@ int __must_check pci_create_sysfs_dev_files(struct pci_dev *pdev) + if (!sysfs_initialized) + return -EACCES; + +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + retval = sysfs_create_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr); + if (retval) + goto err; + +@@ -1424,10 +1424,10 @@ err_rom_file: + err_resource_files: + pci_remove_resource_files(pdev); + err_config_file: +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); + err: + return retval; + } +@@ -1461,10 +1461,10 @@ void pci_remove_sysfs_dev_files(struct pci_dev *pdev) + + pci_remove_capabilities_sysfs(pdev); + +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); + + pci_remove_resource_files(pdev); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ae12c0317645..5d8c049fe503 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -288,6 +288,18 @@ static void quirk_citrine(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine); + ++/* ++ * This chip can cause bus lockups if config addresses above 0x600 ++ * are read or written. ++ */ ++static void quirk_nfp6000(struct pci_dev *dev) ++{ ++ dev->cfg_size = 0x600; ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP4000, quirk_nfp6000); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000, quirk_nfp6000); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000_VF, quirk_nfp6000); ++ + /* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */ + static void quirk_extend_bar_to_page(struct pci_dev *dev) + { +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 7de3b64bf142..4e1b3bf58093 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -48,17 +48,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset) + + spin_lock_irqsave(&gpio_dev->lock, flags); + pin_reg = readl(gpio_dev->base + offset * 4); +- /* +- * Suppose BIOS or Bootloader sets specific debounce for the +- * GPIO. if not, set debounce to be 2.75ms and remove glitch. +- */ +- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { +- pin_reg |= 0xf; +- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); +- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF; +- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); +- } +- + pin_reg &= ~BIT(OUTPUT_ENABLE_OFF); + writel(pin_reg, gpio_dev->base + offset * 4); + spin_unlock_irqrestore(&gpio_dev->lock, flags); +@@ -331,15 +320,6 @@ static void amd_gpio_irq_enable(struct irq_data *d) + + spin_lock_irqsave(&gpio_dev->lock, flags); + pin_reg = readl(gpio_dev->base + (d->hwirq)*4); +- /* +- Suppose BIOS or Bootloader sets specific debounce for the +- GPIO. if not, set debounce to be 2.75ms. +- */ +- if ((pin_reg & DB_TMR_OUT_MASK) == 0) { +- pin_reg |= 0xf; +- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF); +- pin_reg &= ~BIT(DB_TMR_LARGE_OFF); +- } + pin_reg |= BIT(INTERRUPT_ENABLE_OFF); + pin_reg |= BIT(INTERRUPT_MASK_OFF); + writel(pin_reg, gpio_dev->base + (d->hwirq)*4); +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index 57fd66357b95..028d7f76e94e 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1582,9 +1582,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, + unsigned long long now; + int expires; + ++ cqr = (struct dasd_ccw_req *) intparm; + if (IS_ERR(irb)) { + switch (PTR_ERR(irb)) { + case -EIO: ++ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) { ++ device = (struct dasd_device *) cqr->startdev; ++ cqr->status = DASD_CQR_CLEARED; ++ dasd_device_clear_timer(device); ++ wake_up(&dasd_flush_wq); ++ dasd_schedule_device_bh(device); ++ return; ++ } + break; + case -ETIMEDOUT: + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: " +@@ -1600,7 +1609,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, + } + + now = get_tod_clock(); +- cqr = (struct dasd_ccw_req *) intparm; + /* check for conditions that should be handled immediately */ + if (!cqr || + !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) && +diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c +index 54195a117f72..f78cc943d230 100644 +--- a/drivers/scsi/aacraid/commctrl.c ++++ b/drivers/scsi/aacraid/commctrl.c +@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + struct fib *fibptr; + struct hw_fib * hw_fib = (struct hw_fib *)0; + dma_addr_t hw_fib_pa = (dma_addr_t)0LL; +- unsigned size; ++ unsigned int size, osize; + int retval; + + if (dev->in_reset) { +@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + * will not overrun the buffer when we copy the memory. Return + * an error if we would. + */ +- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); ++ osize = size = le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr); + if (size < le16_to_cpu(kfib->header.SenderSize)) + size = le16_to_cpu(kfib->header.SenderSize); + if (size > dev->max_fib_size) { +@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + goto cleanup; + } + ++ /* Sanity check the second copy */ ++ if ((osize != le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr)) ++ || (size < le16_to_cpu(kfib->header.SenderSize))) { ++ retval = -EINVAL; ++ goto cleanup; ++ } ++ + if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { + aac_adapter_interrupt(dev); + /* +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 09084c9da8b7..41dcefe67b43 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1346,7 +1346,6 @@ made_compressed_probe: + spin_lock_init(&acm->write_lock); + spin_lock_init(&acm->read_lock); + mutex_init(&acm->mutex); +- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress); + acm->is_int_ep = usb_endpoint_xfer_int(epread); + if (acm->is_int_ep) + acm->bInterval = epread->bInterval; +@@ -1386,14 +1385,14 @@ made_compressed_probe: + urb->transfer_dma = rb->dma; + if (acm->is_int_ep) { + usb_fill_int_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvintpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb, + acm->bInterval); + } else { + usb_fill_bulk_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb); +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index ac830e0ae38b..bae1e3717d20 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -95,7 +95,6 @@ struct acm { + struct urb *read_urbs[ACM_NR]; + struct acm_rb read_buffers[ACM_NR]; + int rx_buflimit; +- int rx_endpoint; + spinlock_t read_lock; + int write_used; /* number of non-empty write buffers */ + int transmitting; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 563d84eb484d..c98f78b0bf11 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1298,8 +1298,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) + struct usb_device *hdev = hub->hdev; + int i; + +- cancel_delayed_work_sync(&hub->init_work); +- + /* hub_wq and related activity won't re-trigger */ + hub->quiescing = 1; + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 830f020230c4..c702f5d941d9 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -24,14 +24,17 @@ + + #include "platform_data.h" + +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce +-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf +-#define PCI_DEVICE_ID_INTEL_BYT 0x0f37 +-#define PCI_DEVICE_ID_INTEL_MRFLD 0x119e +-#define PCI_DEVICE_ID_INTEL_BSW 0x22B7 +-#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 +-#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf ++#define PCI_DEVICE_ID_INTEL_BYT 0x0f37 ++#define PCI_DEVICE_ID_INTEL_MRFLD 0x119e ++#define PCI_DEVICE_ID_INTEL_BSW 0x22b7 ++#define PCI_DEVICE_ID_INTEL_SPTLP 0x9d30 ++#define PCI_DEVICE_ID_INTEL_SPTH 0xa130 ++#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa ++#define PCI_DEVICE_ID_INTEL_APL 0x5aaa ++#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 + + static int dwc3_pci_quirks(struct pci_dev *pdev) + { +@@ -166,6 +169,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTLP), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTH), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), }, + { } /* Terminating Entry */ + }; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index f4c6e81df034..a5e1b8b39ff5 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1810,7 +1810,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc) + + static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + struct dwc3_request *req, struct dwc3_trb *trb, +- const struct dwc3_event_depevt *event, int status) ++ const struct dwc3_event_depevt *event, int status, ++ int chain) + { + unsigned int count; + unsigned int s_pkt = 0; +@@ -1818,6 +1819,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + + trace_dwc3_complete_trb(dep, trb); + ++ /* ++ * If we're in the middle of series of chained TRBs and we ++ * receive a short transfer along the way, DWC3 will skip ++ * through all TRBs including the last TRB in the chain (the ++ * where CHN bit is zero. DWC3 will also avoid clearing HWO ++ * bit and SW has to do it manually. ++ * ++ * We're going to do that here to avoid problems of HW trying ++ * to use bogus TRBs for transfers. ++ */ ++ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO)) ++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN) + /* + * We continue despite the error. There is not much we +@@ -1829,6 +1843,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + */ + dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", + dep->name, trb); ++ + count = trb->size & DWC3_TRB_SIZE_MASK; + + if (dep->direction) { +@@ -1866,15 +1881,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + s_pkt = 1; + } + +- /* +- * We assume here we will always receive the entire data block +- * which we should receive. Meaning, if we program RX to +- * receive 4K but we receive only 2K, we assume that's all we +- * should receive and we simply bounce the request back to the +- * gadget driver for further processing. +- */ +- req->request.actual += req->request.length - count; +- if (s_pkt) ++ if (s_pkt && !chain) + return 1; + if ((event->status & DEPEVT_STATUS_LST) && + (trb->ctrl & (DWC3_TRB_CTRL_LST | +@@ -1893,14 +1900,19 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + struct dwc3_trb *trb; + unsigned int slot; + unsigned int i; ++ int count = 0; + int ret; + + do { ++ int chain; ++ + req = next_request(&dep->req_queued); + if (!req) { + WARN_ON_ONCE(1); + return 1; + } ++ ++ chain = req->request.num_mapped_sgs > 0; + i = 0; + do { + slot = req->start_slot + i; +@@ -1909,13 +1921,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + slot++; + slot %= DWC3_TRB_NUM; + trb = &dep->trb_pool[slot]; ++ count += trb->size & DWC3_TRB_SIZE_MASK; + + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, +- event, status); ++ event, status, chain); + if (ret) + break; + } while (++i < req->request.num_mapped_sgs); + ++ /* ++ * We assume here we will always receive the entire data block ++ * which we should receive. Meaning, if we program RX to ++ * receive 4K but we receive only 2K, we assume that's all we ++ * should receive and we simply bounce the request back to the ++ * gadget driver for further processing. ++ */ ++ req->request.actual += req->request.length - count; + dwc3_gadget_giveback(dep, req, status); + + if (ret) +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index f4d88dfb26a7..53946d107bc2 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -331,11 +331,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci) + int port = HCS_N_PORTS(ehci->hcs_params); + + while (port--) { +- ehci_writel(ehci, PORT_RWC_BITS, +- &ehci->regs->port_status[port]); + spin_unlock_irq(&ehci->lock); + ehci_port_power(ehci, port, false); + spin_lock_irq(&ehci->lock); ++ ehci_writel(ehci, PORT_RWC_BITS, ++ &ehci->regs->port_status[port]); + } + } + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index ee07ba41c8db..cc1993c5556e 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) + + ret = 0; + virt_dev = xhci->devs[slot_id]; ++ if (!virt_dev) ++ return -ENODEV; ++ + cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO); + if (!cmd) { + xhci_dbg(xhci, "Couldn't allocate command structure.\n"); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 6ef255142e01..f7e917866e05 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1331,12 +1331,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + + cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list); + +- if (cmd->command_trb != xhci->cmd_ring->dequeue) { +- xhci_err(xhci, +- "Command completion event does not match command\n"); +- return; +- } +- + del_timer(&xhci->cmd_timer); + + trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event); +@@ -1348,6 +1342,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + xhci_handle_stopped_cmd_ring(xhci, cmd); + return; + } ++ ++ if (cmd->command_trb != xhci->cmd_ring->dequeue) { ++ xhci_err(xhci, ++ "Command completion event does not match command\n"); ++ return; ++ } ++ + /* + * Host aborted the command ring, check if the current command was + * supposed to be aborted, otherwise continue normally. +diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c +index bbddc44ce8bc..c33ad2181b33 100644 +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -545,7 +545,6 @@ static void sg_timeout(unsigned long _req) + { + struct usb_sg_request *req = (struct usb_sg_request *) _req; + +- req->status = -ETIMEDOUT; + usb_sg_cancel(req); + } + +@@ -576,8 +575,10 @@ static int perform_sglist( + mod_timer(&sg_timer, jiffies + + msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); + usb_sg_wait(req); +- del_timer_sync(&sg_timer); +- retval = req->status; ++ if (!del_timer_sync(&sg_timer)) ++ retval = -ETIMEDOUT; ++ else ++ retval = req->status; + + /* FIXME check resulting data pattern */ + +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index db565f620f82..36e5b5c530bd 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -869,7 +869,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) + + /* use PIO if packet is less than pio_dma_border or pipe is DCP */ + if ((len < usbhs_get_dparam(priv, pio_dma_border)) || +- usbhs_pipe_is_dcp(pipe)) ++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) + goto usbhsf_pio_prepare_push; + + /* check data length if this driver don't use USB-DMAC */ +@@ -974,7 +974,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt, + + /* use PIO if packet is less than pio_dma_border or pipe is DCP */ + if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) || +- usbhs_pipe_is_dcp(pipe)) ++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) + goto usbhsf_pio_prepare_pop; + + fifo = usbhsf_get_dma_fifo(priv, pkt); +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 74af77a022a8..275c9aebc4c9 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -614,10 +614,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep, + * use dmaengine if possible. + * It will use pio handler if impossible. + */ +- if (usb_endpoint_dir_in(desc)) ++ if (usb_endpoint_dir_in(desc)) { + pipe->handler = &usbhs_fifo_dma_push_handler; +- else ++ } else { + pipe->handler = &usbhs_fifo_dma_pop_handler; ++ usbhs_xxxsts_clear(priv, BRDYSTS, ++ usbhs_pipe_number(pipe)); ++ } + + ret = 0; + } +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b61f12160d37..8c48c9d83d48 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) }, + { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) }, + { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) }, + { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) }, +@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, ++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 334bc600282d..48db84f25cc9 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -406,6 +406,12 @@ + #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* ++ * Ivium Technologies product IDs ++ */ ++#define FTDI_PALMSENS_PID 0xf440 ++#define FTDI_IVIUM_XSTAT_PID 0xf441 ++ ++/* + * Linx Technologies product ids + */ + #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */ +@@ -673,6 +679,12 @@ + #define INTREPID_NEOVI_PID 0x0701 + + /* ++ * WICED USB UART ++ */ ++#define WICED_VID 0x0A5C ++#define WICED_USB20706V2_PID 0x6422 ++ ++/* + * Definitions for ID TECH (www.idt-net.com) devices + */ + #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2a7bf26c68e6..ca03fbfa2a32 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -277,6 +277,12 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 ++#define TELIT_PRODUCT_LE920A4_1207 0x1207 ++#define TELIT_PRODUCT_LE920A4_1208 0x1208 ++#define TELIT_PRODUCT_LE920A4_1211 0x1211 ++#define TELIT_PRODUCT_LE920A4_1212 0x1212 ++#define TELIT_PRODUCT_LE920A4_1213 0x1213 ++#define TELIT_PRODUCT_LE920A4_1214 0x1214 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -636,6 +642,11 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = { + .reserved = BIT(8) | BIT(10) | BIT(11), + }; + ++static const struct option_blacklist_info telit_le920a4_blacklist_1 = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(1), ++}; ++ + static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup = BIT(2), + .reserved = BIT(0) | BIT(1) | BIT(3), +@@ -1215,6 +1226,16 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, +@@ -1978,6 +1999,7 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index 46f1f13b41f1..a0ca291bc07f 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1432,7 +1432,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] + + rc = usb_register(udriver); + if (rc) +- return rc; ++ goto failed_usb_register; + + for (sd = serial_drivers; *sd; ++sd) { + (*sd)->usb_driver = udriver; +@@ -1450,6 +1450,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] + while (sd-- > serial_drivers) + usb_serial_deregister(*sd); + usb_deregister(udriver); ++failed_usb_register: ++ kfree(udriver); + return rc; + } + EXPORT_SYMBOL_GPL(usb_serial_register_drivers); +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 636435b41293..2209040bff95 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -89,7 +89,7 @@ struct vhost_scsi_cmd { + struct scatterlist *tvc_prot_sgl; + struct page **tvc_upages; + /* Pointer to response header iovec */ +- struct iovec *tvc_resp_iov; ++ struct iovec tvc_resp_iov; + /* Pointer to vhost_scsi for our device */ + struct vhost_scsi *tvc_vhost; + /* Pointer to vhost_virtqueue for the cmd */ +@@ -716,7 +716,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + memcpy(v_rsp.sense, cmd->tvc_sense_buf, + se_cmd->scsi_sense_length); + +- iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov, ++ iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); + ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); + if (likely(ret == sizeof(v_rsp))) { +@@ -1212,7 +1212,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + } + cmd->tvc_vhost = vs; + cmd->tvc_vq = vq; +- cmd->tvc_resp_iov = &vq->iov[out]; ++ cmd->tvc_resp_iov = vq->iov[out]; + cmd->tvc_in_iovs = in; + + pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n", +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 531e76474983..0e0eb10f82a0 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type, + rc = -ENOMEM; + goto out; + } +- } else { ++ } else if (msg_type == XS_TRANSACTION_END) { + list_for_each_entry(trans, &u->transactions, list) + if (trans->handle.id == u->u.msg.tx_id) + break; +diff --git a/fs/seq_file.c b/fs/seq_file.c +index 555f82155be8..4408057d1dc8 100644 +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -212,8 +212,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) + size -= n; + buf += n; + copied += n; +- if (!m->count) ++ if (!m->count) { ++ m->from = 0; + m->index++; ++ } + if (!size) + goto Done; + } +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index b45345d701e7..51157da3f76e 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + + p = c->gap_lebs; + do { +- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs); ++ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs); + written = layout_leb_in_gaps(c, p); + if (written < 0) { + err = written; +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 2f7b9a40f627..9b6f5dc58732 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2483,6 +2483,13 @@ + #define PCI_DEVICE_ID_KORENIX_JETCARDF2 0x1700 + #define PCI_DEVICE_ID_KORENIX_JETCARDF3 0x17ff + ++#define PCI_VENDOR_ID_NETRONOME 0x19ee ++#define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200 ++#define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240 ++#define PCI_DEVICE_ID_NETRONOME_NFP4000 0x4000 ++#define PCI_DEVICE_ID_NETRONOME_NFP6000 0x6000 ++#define PCI_DEVICE_ID_NETRONOME_NFP6000_VF 0x6003 ++ + #define PCI_VENDOR_ID_QMI 0x1a32 + + #define PCI_VENDOR_ID_AZWAVE 0x1a3b +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index cb346f26a22d..a89bca964b1f 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -179,8 +179,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, + mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); + err = -EAGAIN; + ptep = page_check_address(page, mm, addr, &ptl, 0); +- if (!ptep) ++ if (!ptep) { ++ mem_cgroup_cancel_charge(kpage, memcg); + goto unlock; ++ } + + get_page(kpage); + page_add_new_anon_rmap(kpage, vma, addr); +@@ -207,7 +209,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, + + err = 0; + unlock: +- mem_cgroup_cancel_charge(kpage, memcg); + mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); + unlock_page(page); + return err; +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 65dbf8aee751..8fcc801fde15 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -419,7 +419,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) + do { + seq = raw_read_seqcount(&tkf->seq); + tkr = tkf->base + (seq & 0x01); +- now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr); ++ now = ktime_to_ns(tkr->base); ++ ++ now += clocksource_delta(tkr->read(tkr->clock), ++ tkr->cycle_last, tkr->mask); + } while (read_seqcount_retry(&tkf->seq, seq)); + + return now; +diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c +index f6bd65236712..107310a6f36f 100644 +--- a/kernel/time/timekeeping_debug.c ++++ b/kernel/time/timekeeping_debug.c +@@ -23,7 +23,9 @@ + + #include "timekeeping_internal.h" + +-static unsigned int sleep_time_bin[32] = {0}; ++#define NUM_BINS 32 ++ ++static unsigned int sleep_time_bin[NUM_BINS] = {0}; + + static int tk_debug_show_sleep_time(struct seq_file *s, void *data) + { +@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init); + + void tk_debug_account_sleep_time(struct timespec64 *t) + { +- sleep_time_bin[fls(t->tv_sec)]++; ++ /* Cap bin index so we don't overflow the array */ ++ int bin = min(fls(t->tv_sec), NUM_BINS-1); ++ ++ sleep_time_bin[bin]++; + } + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 87463c814896..36b93adfd7da 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -89,7 +89,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1; + EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); + + /* rfc5961 challenge ack rate limiting */ +-int sysctl_tcp_challenge_ack_limit = 100; ++int sysctl_tcp_challenge_ack_limit = 1000; + + int sysctl_tcp_stdurg __read_mostly; + int sysctl_tcp_rfc1337 __read_mostly; +@@ -3343,6 +3343,23 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 + return flag; + } + ++static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, ++ u32 *last_oow_ack_time) ++{ ++ if (*last_oow_ack_time) { ++ s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time); ++ ++ if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) { ++ NET_INC_STATS(net, mib_idx); ++ return true; /* rate-limited: don't send yet! */ ++ } ++ } ++ ++ *last_oow_ack_time = tcp_time_stamp; ++ ++ return false; /* not rate-limited: go ahead, send dupack now! */ ++} ++ + /* Return true if we're currently rate-limiting out-of-window ACKs and + * thus shouldn't send a dupack right now. We rate-limit dupacks in + * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS +@@ -3356,21 +3373,9 @@ bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb, + /* Data packets without SYNs are not likely part of an ACK loop. */ + if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) && + !tcp_hdr(skb)->syn) +- goto not_rate_limited; +- +- if (*last_oow_ack_time) { +- s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time); +- +- if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) { +- NET_INC_STATS_BH(net, mib_idx); +- return true; /* rate-limited: don't send yet! */ +- } +- } +- +- *last_oow_ack_time = tcp_time_stamp; ++ return false; + +-not_rate_limited: +- return false; /* not rate-limited: go ahead, send dupack now! */ ++ return __tcp_oow_rate_limited(net, mib_idx, last_oow_ack_time); + } + + /* RFC 5961 7 [ACK Throttling] */ +@@ -3380,21 +3385,26 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb) + static u32 challenge_timestamp; + static unsigned int challenge_count; + struct tcp_sock *tp = tcp_sk(sk); +- u32 now; ++ u32 count, now; + + /* First check our per-socket dupack rate limit. */ +- if (tcp_oow_rate_limited(sock_net(sk), skb, +- LINUX_MIB_TCPACKSKIPPEDCHALLENGE, +- &tp->last_oow_ack_time)) ++ if (__tcp_oow_rate_limited(sock_net(sk), ++ LINUX_MIB_TCPACKSKIPPEDCHALLENGE, ++ &tp->last_oow_ack_time)) + return; + +- /* Then check the check host-wide RFC 5961 rate limit. */ ++ /* Then check host-wide RFC 5961 rate limit. */ + now = jiffies / HZ; + if (now != challenge_timestamp) { ++ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1; ++ + challenge_timestamp = now; +- challenge_count = 0; ++ WRITE_ONCE(challenge_count, half + ++ prandom_u32_max(sysctl_tcp_challenge_ack_limit)); + } +- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) { ++ count = READ_ONCE(challenge_count); ++ if (count > 0) { ++ WRITE_ONCE(challenge_count, count - 1); + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK); + tcp_send_ack(sk); + } +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index f06d42267306..89ed0206882c 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -907,7 +907,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev) + + /* free all potentially still buffered bcast frames */ + local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf); +- skb_queue_purge(&sdata->u.ap.ps.bc_buf); ++ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf); + + mutex_lock(&local->mtx); + ieee80211_vif_copy_chanctx_to_vlans(sdata, true); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 5787f15a3a12..8dbdbaea70fd 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -355,7 +355,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local) + skb = skb_dequeue(&ps->bc_buf); + if (skb) { + purged++; +- dev_kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + total += skb_queue_len(&ps->bc_buf); + } +@@ -438,7 +438,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) + if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) { + ps_dbg(tx->sdata, + "BC TX buffer full - dropping the oldest frame\n"); +- dev_kfree_skb(skb_dequeue(&ps->bc_buf)); ++ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf)); + } else + tx->local->total_ps_buffered++; + +@@ -3247,7 +3247,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw, + sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); + if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb)) + break; +- dev_kfree_skb_any(skb); ++ ieee80211_free_txskb(hw, skb); + } + + info = IEEE80211_SKB_CB(skb); +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index 841d05946b88..5420f2fe717e 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -298,8 +298,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + clk_enable(ssc_p->ssc->clk); + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + +- /* Reset the SSC to keep it at a clean status */ +- ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); ++ /* Reset the SSC unless initialized to keep it in a clean state */ ++ if (!ssc_p->initialized) ++ ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + dir = 0; +diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c +index 204cc074adb9..41aa3355e920 100644 +--- a/sound/usb/line6/pcm.c ++++ b/sound/usb/line6/pcm.c +@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol, + err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE); + if (err < 0) { + line6pcm->impulse_volume = 0; +- line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE); + return err; + } + } else { +@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction, + spin_lock_irqsave(&pstr->lock, flags); + clear_bit(type, &pstr->running); + if (!pstr->running) { ++ spin_unlock_irqrestore(&pstr->lock, flags); + line6_unlink_audio_urbs(line6pcm, pstr); ++ spin_lock_irqsave(&pstr->lock, flags); + if (direction == SNDRV_PCM_STREAM_CAPTURE) { + line6pcm->prev_fbuf = NULL; + line6pcm->prev_fsize = 0; +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index daf81d169a42..45dd34874f43 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value, + static ssize_t serial_number_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct usb_interface *interface = to_usb_interface(dev); +- struct usb_line6_pod *pod = usb_get_intfdata(interface); ++ struct snd_card *card = dev_to_snd_card(dev); ++ struct usb_line6_pod *pod = card->private_data; + + return sprintf(buf, "%u\n", pod->serial_number); + } +@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev, + static ssize_t firmware_version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct usb_interface *interface = to_usb_interface(dev); +- struct usb_line6_pod *pod = usb_get_intfdata(interface); ++ struct snd_card *card = dev_to_snd_card(dev); ++ struct usb_line6_pod *pod = card->private_data; + + return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100, + pod->firmware_version % 100); +@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev, + static ssize_t device_id_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct usb_interface *interface = to_usb_interface(dev); +- struct usb_line6_pod *pod = usb_get_intfdata(interface); ++ struct snd_card *card = dev_to_snd_card(dev); ++ struct usb_line6_pod *pod = card->private_data; + + return sprintf(buf, "%d\n", pod->device_id); + } diff --git a/1032_linux-4.1.33.patch b/1032_linux-4.1.33.patch new file mode 100644 index 0000000..17c9a86 --- /dev/null +++ b/1032_linux-4.1.33.patch @@ -0,0 +1,982 @@ +diff --git a/Makefile b/Makefile +index e995f28b6d37..47c47d7c0926 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 1 +-SUBLEVEL = 32 ++SUBLEVEL = 33 + EXTRAVERSION = + NAME = Series 4800 + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index 09c549826c5f..9615fe1701c6 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -96,7 +96,7 @@ + #define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) + + /* Set of bits not changed in pte_modify */ +-#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_SPECIAL) ++#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED) + + /* More Abbrevaited helpers */ + #define PAGE_U_NONE __pgprot(___DEF) +diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c +index b83f3b7737fb..087acb569b63 100644 +--- a/arch/arm/kernel/sys_oabi-compat.c ++++ b/arch/arm/kernel/sys_oabi-compat.c +@@ -193,15 +193,44 @@ struct oabi_flock64 { + pid_t l_pid; + } __attribute__ ((packed,aligned(4))); + +-asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, ++static long do_locks(unsigned int fd, unsigned int cmd, + unsigned long arg) + { +- struct oabi_flock64 user; + struct flock64 kernel; +- mm_segment_t fs = USER_DS; /* initialized to kill a warning */ +- unsigned long local_arg = arg; +- int ret; ++ struct oabi_flock64 user; ++ mm_segment_t fs; ++ long ret; ++ ++ if (copy_from_user(&user, (struct oabi_flock64 __user *)arg, ++ sizeof(user))) ++ return -EFAULT; ++ kernel.l_type = user.l_type; ++ kernel.l_whence = user.l_whence; ++ kernel.l_start = user.l_start; ++ kernel.l_len = user.l_len; ++ kernel.l_pid = user.l_pid; ++ ++ fs = get_fs(); ++ set_fs(KERNEL_DS); ++ ret = sys_fcntl64(fd, cmd, (unsigned long)&kernel); ++ set_fs(fs); ++ ++ if (!ret && (cmd == F_GETLK64 || cmd == F_OFD_GETLK)) { ++ user.l_type = kernel.l_type; ++ user.l_whence = kernel.l_whence; ++ user.l_start = kernel.l_start; ++ user.l_len = kernel.l_len; ++ user.l_pid = kernel.l_pid; ++ if (copy_to_user((struct oabi_flock64 __user *)arg, ++ &user, sizeof(user))) ++ ret = -EFAULT; ++ } ++ return ret; ++} + ++asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, ++ unsigned long arg) ++{ + switch (cmd) { + case F_OFD_GETLK: + case F_OFD_SETLK: +@@ -209,39 +238,11 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, + case F_GETLK64: + case F_SETLK64: + case F_SETLKW64: +- if (copy_from_user(&user, (struct oabi_flock64 __user *)arg, +- sizeof(user))) +- return -EFAULT; +- kernel.l_type = user.l_type; +- kernel.l_whence = user.l_whence; +- kernel.l_start = user.l_start; +- kernel.l_len = user.l_len; +- kernel.l_pid = user.l_pid; +- local_arg = (unsigned long)&kernel; +- fs = get_fs(); +- set_fs(KERNEL_DS); +- } +- +- ret = sys_fcntl64(fd, cmd, local_arg); ++ return do_locks(fd, cmd, arg); + +- switch (cmd) { +- case F_GETLK64: +- if (!ret) { +- user.l_type = kernel.l_type; +- user.l_whence = kernel.l_whence; +- user.l_start = kernel.l_start; +- user.l_len = kernel.l_len; +- user.l_pid = kernel.l_pid; +- if (copy_to_user((struct oabi_flock64 __user *)arg, +- &user, sizeof(user))) +- ret = -EFAULT; +- } +- case F_SETLK64: +- case F_SETLKW64: +- set_fs(fs); ++ default: ++ return sys_fcntl64(fd, cmd, arg); + } +- +- return ret; + } + + struct oabi_epoll_event { +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index e4cf63301ff4..c6c4248ab138 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -618,6 +618,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c) + set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH); + } + ++#define MSR_AMD64_DE_CFG 0xC0011029 ++ ++static void init_amd_ln(struct cpuinfo_x86 *c) ++{ ++ /* ++ * Apply erratum 665 fix unconditionally so machines without a BIOS ++ * fix work. ++ */ ++ msr_set_bit(MSR_AMD64_DE_CFG, 31); ++} ++ + static void init_amd_bd(struct cpuinfo_x86 *c) + { + u64 value; +@@ -675,6 +686,7 @@ static void init_amd(struct cpuinfo_x86 *c) + case 6: init_amd_k7(c); break; + case 0xf: init_amd_k8(c); break; + case 0x10: init_amd_gh(c); break; ++ case 0x12: init_amd_ln(c); break; + case 0x15: init_amd_bd(c); break; + } + +diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c +index 1f316f066c49..68cf2ec816d5 100644 +--- a/arch/x86/kernel/paravirt.c ++++ b/arch/x86/kernel/paravirt.c +@@ -55,12 +55,12 @@ asm (".pushsection .entry.text, \"ax\"\n" + ".popsection"); + + /* identity function, which can be inlined */ +-u32 _paravirt_ident_32(u32 x) ++u32 notrace _paravirt_ident_32(u32 x) + { + return x; + } + +-u64 _paravirt_ident_64(u64 x) ++u64 notrace _paravirt_ident_64(u64 x) + { + return x; + } +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index ebd8a5f398b0..900cf63d0420 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev) + { + struct usb_dmac_chan *chan = dev; + irqreturn_t ret = IRQ_NONE; +- u32 mask = USB_DMACHCR_TE; +- u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP; ++ u32 mask = 0; + u32 chcr; ++ bool xfer_end = false; + + spin_lock(&chan->vc.lock); + + chcr = usb_dmac_chan_read(chan, USB_DMACHCR); +- if (chcr & check_bits) +- mask |= USB_DMACHCR_DE | check_bits; ++ if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) { ++ mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP; ++ if (chcr & USB_DMACHCR_DE) ++ xfer_end = true; ++ ret |= IRQ_HANDLED; ++ } + if (chcr & USB_DMACHCR_NULL) { + /* An interruption of TE will happen after we set FTE */ + mask |= USB_DMACHCR_NULL; + chcr |= USB_DMACHCR_FTE; + ret |= IRQ_HANDLED; + } +- usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask); ++ if (mask) ++ usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask); + +- if (chcr & check_bits) { ++ if (xfer_end) + usb_dmac_isr_transfer_end(chan); +- ret |= IRQ_HANDLED; +- } + + spin_unlock(&chan->vc.lock); + +diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c +index d8738d4f8df3..78c911be115d 100644 +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -160,6 +160,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev, + if (ret < 0) + goto error_ret; + *val = ret; ++ ret = IIO_VAL_INT; + break; + case IIO_CHAN_INFO_SCALE: + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 049282e6482f..ce507a405d05 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1433,7 +1433,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) + unsigned i; + int err; + +- cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), ++ cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), + GFP_KERNEL); + if (!cc->tfms) + return -ENOMEM; +@@ -1898,6 +1898,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio) + return DM_MAPIO_REMAPPED; + } + ++ /* ++ * Check if bio is too large, split as needed. ++ */ ++ if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) && ++ bio_data_dir(bio) == WRITE) ++ dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT)); ++ + io = dm_per_bio_data(bio, cc->per_bio_data_size); + crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector)); + io->ctx.req = (struct ablkcipher_request *)(io + 1); +diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c +index 93e08446a87d..9e136baf5fc5 100644 +--- a/drivers/md/dm-log-writes.c ++++ b/drivers/md/dm-log-writes.c +@@ -259,12 +259,12 @@ static int log_one_block(struct log_writes_c *lc, + goto out; + sector++; + +- bio = bio_alloc(GFP_KERNEL, block->vec_cnt); ++ atomic_inc(&lc->io_blocks); ++ bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES)); + if (!bio) { + DMERR("Couldn't alloc log bio"); + goto error; + } +- atomic_inc(&lc->io_blocks); + bio->bi_iter.bi_size = 0; + bio->bi_iter.bi_sector = sector; + bio->bi_bdev = lc->logdev->bdev; +@@ -282,7 +282,7 @@ static int log_one_block(struct log_writes_c *lc, + if (ret != block->vecs[i].bv_len) { + atomic_inc(&lc->io_blocks); + submit_bio(WRITE, bio); +- bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i); ++ bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES)); + if (!bio) { + DMERR("Couldn't alloc log bio"); + goto error; +@@ -456,7 +456,7 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv) + } + + lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write"); +- if (!lc->log_kthread) { ++ if (IS_ERR(lc->log_kthread)) { + ti->error = "Couldn't alloc kthread"; + dm_put_device(ti, lc->dev); + dm_put_device(ti, lc->logdev); +diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c +index 80d613c0fbc6..6fd2c17125fc 100644 +--- a/drivers/staging/comedi/drivers/comedi_test.c ++++ b/drivers/staging/comedi/drivers/comedi_test.c +@@ -55,10 +55,6 @@ zero volts). + + #define N_CHANS 8 + +-enum waveform_state_bits { +- WAVEFORM_AI_RUNNING = 0 +-}; +- + /* Data unique to this driver */ + struct waveform_private { + struct timer_list timer; +@@ -67,7 +63,6 @@ struct waveform_private { + unsigned long usec_period; /* waveform period in microseconds */ + unsigned long usec_current; /* current time (mod waveform period) */ + unsigned long usec_remainder; /* usec since last scan */ +- unsigned long state_bits; + unsigned int scan_period; /* scan period in usec */ + unsigned int convert_period; /* conversion period in usec */ + unsigned int ao_loopbacks[N_CHANS]; +@@ -177,10 +172,6 @@ static void waveform_ai_interrupt(unsigned long arg) + unsigned int num_scans; + ktime_t now; + +- /* check command is still active */ +- if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits)) +- return; +- + now = ktime_get(); + + elapsed_time = ktime_to_us(ktime_sub(now, devpriv->last)); +@@ -322,10 +313,6 @@ static int waveform_ai_cmd(struct comedi_device *dev, + devpriv->usec_remainder = 0; + + devpriv->timer.expires = jiffies + 1; +- /* mark command as active */ +- smp_mb__before_atomic(); +- set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits); +- smp_mb__after_atomic(); + add_timer(&devpriv->timer); + return 0; + } +@@ -335,11 +322,12 @@ static int waveform_ai_cancel(struct comedi_device *dev, + { + struct waveform_private *devpriv = dev->private; + +- /* mark command as no longer active */ +- clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits); +- smp_mb__after_atomic(); +- /* cannot call del_timer_sync() as may be called from timer routine */ +- del_timer(&devpriv->timer); ++ if (in_softirq()) { ++ /* Assume we were called from the timer routine itself. */ ++ del_timer(&devpriv->timer); ++ } else { ++ del_timer_sync(&devpriv->timer); ++ } + return 0; + } + +diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c +index f97d18d92255..63c338223548 100644 +--- a/drivers/staging/comedi/drivers/daqboard2000.c ++++ b/drivers/staging/comedi/drivers/daqboard2000.c +@@ -636,7 +636,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev, + const struct daq200_boardtype *board; + int i; + +- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH) ++ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH) + return NULL; + + for (i = 0; i < ARRAY_SIZE(boardtypes); i++) { +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 34b3a522668f..4b8da862cd7e 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -2987,7 +2987,15 @@ static int ni_ao_inttrig(struct comedi_device *dev, + int i; + static const int timeout = 1000; + +- if (trig_num != cmd->start_arg) ++ /* ++ * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT. ++ * For backwards compatibility, also allow trig_num == 0 when ++ * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT); ++ * in that case, the internal trigger is being used as a pre-trigger ++ * before the external trigger. ++ */ ++ if (!(trig_num == cmd->start_arg || ++ (trig_num == 0 && cmd->start_src != TRIG_INT))) + return -EINVAL; + + /* Null trig at beginning prevent ao start trigger from executing more than +@@ -5635,7 +5643,7 @@ static int ni_E_init(struct comedi_device *dev, + s->maxdata = (devpriv->is_m_series) ? 0xffffffff + : 0x00ffffff; + s->insn_read = ni_tio_insn_read; +- s->insn_write = ni_tio_insn_read; ++ s->insn_write = ni_tio_insn_write; + s->insn_config = ni_tio_insn_config; + #ifdef PCIDMA + if (dev->irq && devpriv->mite) { +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index a78a62bf0c96..6057a8a2d57d 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2016,6 +2016,43 @@ pci_wch_ch38x_setup(struct serial_private *priv, + #define PCI_DEVICE_ID_PERICOM_PI7C9X7954 0x7954 + #define PCI_DEVICE_ID_PERICOM_PI7C9X7958 0x7958 + ++#define PCI_VENDOR_ID_ACCESIO 0x494f ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB 0x1051 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S 0x1053 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB 0x105C ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S 0x105E ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB 0x1091 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2 0x1093 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB 0x1099 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4 0x109B ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB 0x10D1 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM 0x10D3 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB 0x10DA ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM 0x10DC ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1 0x1108 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2 0x1110 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2 0x1111 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4 0x1118 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4 0x1119 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S 0x1152 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S 0x115A ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2 0x1190 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2 0x1191 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4 0x1198 ++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4 0x1199 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM 0x11D0 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4 0x105A ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4 0x105B ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8 0x106A ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8 0x106B ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4 0x1098 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8 0x10A9 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM 0x10D9 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM 0x10E9 ++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM 0x11D8 ++ ++ ++ + /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ + #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 + #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588 +@@ -5217,6 +5254,108 @@ static struct pci_device_id serial_pci_tbl[] = { + 0, + 0, pbn_pericom_PI7C9X7958 }, + /* ++ * ACCES I/O Products quad ++ */ ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7954 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_pericom_PI7C9X7958 }, ++ /* + * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) + */ + { PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560, +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 92937c14f818..d93e43cfb6f8 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1578,8 +1578,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on) + { + struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget); + +- /* Data+ pullup controlled by OTG state machine in OTG fsm mode */ +- if (ci_otg_is_fsm_mode(ci)) ++ /* ++ * Data+ pullup controlled by OTG state machine in OTG fsm mode; ++ * and don't touch Data+ in host mode for dual role config. ++ */ ++ if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST) + return 0; + + pm_runtime_get_sync(&ci->gadget.dev); +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 986abde07683..3d46b0bae75c 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1526,11 +1526,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + as->urb->start_frame = uurb->start_frame; + as->urb->number_of_packets = number_of_packets; + as->urb->stream_id = stream_id; +- if (uurb->type == USBDEVFS_URB_TYPE_ISO || +- ps->dev->speed == USB_SPEED_HIGH) +- as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); +- else +- as->urb->interval = ep->desc.bInterval; ++ ++ if (ep->desc.bInterval) { ++ if (uurb->type == USBDEVFS_URB_TYPE_ISO || ++ ps->dev->speed == USB_SPEED_HIGH || ++ ps->dev->speed >= USB_SPEED_SUPER) ++ as->urb->interval = 1 << ++ min(15, ep->desc.bInterval - 1); ++ else ++ as->urb->interval = ep->desc.bInterval; ++ } ++ + as->urb->context = as; + as->urb->complete = async_completed; + for (totlen = u = 0; u < number_of_packets; u++) { +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c +index 4f70df33975a..9a0c610d85a9 100644 +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1239,7 +1239,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port, + + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + } +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index e4473a9109cf..f5ab4cd9e7a1 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port, + } + + if (urb->transfer_buffer == NULL) { +- urb->transfer_buffer = +- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL); ++ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + } +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index ca03fbfa2a32..a599e8a841b0 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -528,6 +528,12 @@ static void option_instat_callback(struct urb *urb); + #define VIATELECOM_VENDOR_ID 0x15eb + #define VIATELECOM_PRODUCT_CDS7 0x0001 + ++/* WeTelecom products */ ++#define WETELECOM_VENDOR_ID 0x22de ++#define WETELECOM_PRODUCT_WMD200 0x6801 ++#define WETELECOM_PRODUCT_6802 0x6802 ++#define WETELECOM_PRODUCT_WMD300 0x6803 ++ + struct option_blacklist_info { + /* bitmask of interface numbers blacklisted for send_setup */ + const unsigned long sendsetup; +@@ -2003,6 +2009,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index f01dd19adb7b..afb3eb3e8b0f 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2082,6 +2082,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group, + + /* Called at mount-time, super-block is locked */ + static int ext4_check_descriptors(struct super_block *sb, ++ ext4_fsblk_t sb_block, + ext4_group_t *first_not_zeroed) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); +@@ -2112,6 +2113,11 @@ static int ext4_check_descriptors(struct super_block *sb, + grp = i; + + block_bitmap = ext4_block_bitmap(sb, gdp); ++ if (block_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Block bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (block_bitmap < first_block || block_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Block bitmap for group %u not in group " +@@ -2119,6 +2125,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_bitmap = ext4_inode_bitmap(sb, gdp); ++ if (inode_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (inode_bitmap < first_block || inode_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode bitmap for group %u not in group " +@@ -2126,6 +2137,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_table = ext4_inode_table(sb, gdp); ++ if (inode_table == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode table for group %u overlaps " ++ "superblock", i); ++ } + if (inode_table < first_block || + inode_table + sbi->s_itb_per_group - 1 > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -3989,7 +4005,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount2; + } + } +- if (!ext4_check_descriptors(sb, &first_not_zeroed)) { ++ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { + ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); + goto failed_mount2; + } +diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c +index 2bacb9988566..9ff28bc294c0 100644 +--- a/fs/kernfs/file.c ++++ b/fs/kernfs/file.c +@@ -834,21 +834,35 @@ repeat: + mutex_lock(&kernfs_mutex); + + list_for_each_entry(info, &kernfs_root(kn)->supers, node) { ++ struct kernfs_node *parent; + struct inode *inode; +- struct dentry *dentry; + ++ /* ++ * We want fsnotify_modify() on @kn but as the ++ * modifications aren't originating from userland don't ++ * have the matching @file available. Look up the inodes ++ * and generate the events manually. ++ */ + inode = ilookup(info->sb, kn->ino); + if (!inode) + continue; + +- dentry = d_find_any_alias(inode); +- if (dentry) { +- fsnotify_parent(NULL, dentry, FS_MODIFY); +- fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, +- NULL, 0); +- dput(dentry); ++ parent = kernfs_get_parent(kn); ++ if (parent) { ++ struct inode *p_inode; ++ ++ p_inode = ilookup(info->sb, parent->ino); ++ if (p_inode) { ++ fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD, ++ inode, FSNOTIFY_EVENT_INODE, kn->name, 0); ++ iput(p_inode); ++ } ++ ++ kernfs_put(parent); + } + ++ fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, ++ kn->name, 0); + iput(inode); + } + +diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c +index 8d129bb7355a..a78558a25035 100644 +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -303,6 +303,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, struct n + err_socks: + svc_rpcb_cleanup(serv, net); + err_bind: ++ nn->cb_users[minorversion]--; + dprintk("NFS: Couldn't create callback socket: err = %d; " + "net = %p\n", ret, net); + return ret; +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index d47c188682b1..ea4fe630cdac 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1472,6 +1472,7 @@ pnfs_update_layout(struct inode *ino, + goto out; + + lookup_again: ++ nfs4_client_recover_expired_lease(clp); + first = false; + spin_lock(&ino->i_lock); + lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags); +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 758012bfd5f0..4d8aa749d9b2 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -48,6 +48,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) + } + + for (name = buf; name < (buf + list_size); name += strlen(name) + 1) { ++ if (ovl_is_private_xattr(name)) ++ continue; + retry: + size = vfs_getxattr(old, name, value, value_size); + if (size == -ERANGE) +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index 97fd65700ae2..0bb8347c0d8b 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -221,8 +221,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz) + return realinode->i_op->readlink(realpath.dentry, buf, bufsiz); + } + +- +-static bool ovl_is_private_xattr(const char *name) ++bool ovl_is_private_xattr(const char *name) + { + return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0; + } +@@ -280,7 +279,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + struct path realpath; + enum ovl_path_type type = ovl_path_real(dentry, &realpath); + ssize_t res; +- int off; ++ size_t len; ++ char *s; + + res = vfs_listxattr(realpath.dentry, list, size); + if (res <= 0 || size == 0) +@@ -290,17 +290,19 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + return res; + + /* filter out private xattrs */ +- for (off = 0; off < res;) { +- char *s = list + off; +- size_t slen = strlen(s) + 1; ++ for (s = list, len = res; len;) { ++ size_t slen = strnlen(s, len) + 1; + +- BUG_ON(off + slen > res); ++ /* underlying fs providing us with an broken xattr list? */ ++ if (WARN_ON(slen > len)) ++ return -EIO; + ++ len -= slen; + if (ovl_is_private_xattr(s)) { + res -= slen; +- memmove(s, s + slen, res - off); ++ memmove(s, s + slen, len); + } else { +- off += slen; ++ s += slen; + } + } + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 983540910ba8..32b077b07085 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -174,6 +174,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, const char *name, + ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size); + int ovl_removexattr(struct dentry *dentry, const char *name); + struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags); ++bool ovl_is_private_xattr(const char *name); + + struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, + struct ovl_entry *oe); +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 39266655d2bd..c9b740111526 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -658,6 +658,10 @@ retry: + struct kstat stat = { + .mode = S_IFDIR | 0, + }; ++ struct iattr attr = { ++ .ia_valid = ATTR_MODE, ++ .ia_mode = stat.mode, ++ }; + + if (work->d_inode) { + err = -EEXIST; +@@ -673,6 +677,21 @@ retry: + err = ovl_create_real(dir, work, &stat, NULL, NULL, true); + if (err) + goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); ++ if (err && err != -ENODATA) ++ goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); ++ if (err && err != -ENODATA) ++ goto out_dput; ++ ++ /* Clear any inherited mode bits */ ++ mutex_lock(&work->d_inode->i_mutex); ++ err = notify_change(work, &attr, NULL); ++ mutex_unlock(&work->d_inode->i_mutex); ++ if (err) ++ goto out_dput; + } + out_unlock: + mutex_unlock(&dir->i_mutex); +diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c +index 7c2867b44141..167f80e8f08d 100644 +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -108,14 +108,22 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf, + { + const struct sysfs_ops *ops = sysfs_file_ops(of->kn); + struct kobject *kobj = of->kn->parent->priv; ++ size_t len; + + /* + * If buf != of->prealloc_buf, we don't know how + * large it is, so cannot safely pass it to ->show + */ +- if (pos || WARN_ON_ONCE(buf != of->prealloc_buf)) ++ if (WARN_ON_ONCE(buf != of->prealloc_buf)) + return 0; +- return ops->show(kobj, of->kn->priv, buf); ++ len = ops->show(kobj, of->kn->priv, buf); ++ if (pos) { ++ if (len <= pos) ++ return 0; ++ len -= pos; ++ memmove(buf, buf + pos, len); ++ } ++ return min(count, len); + } + + /* kernfs write callback for regular sysfs files */ +diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c +index 535bd843f2f4..901f11b30174 100644 +--- a/fs/xfs/libxfs/xfs_sb.c ++++ b/fs/xfs/libxfs/xfs_sb.c +@@ -539,7 +539,8 @@ xfs_sb_verify( + * Only check the in progress field for the primary superblock as + * mkfs.xfs doesn't clear it from secondary superblocks. + */ +- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR, ++ return xfs_mount_validate_sb(mp, &sb, ++ bp->b_maps[0].bm_bn == XFS_SB_DADDR, + check_version); + } + +diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c +index 7dd64bf98c56..6e2b892b58ee 100644 +--- a/fs/xfs/xfs_buf.c ++++ b/fs/xfs/xfs_buf.c +@@ -1537,7 +1537,7 @@ xfs_wait_buftarg( + * ensure here that all reference counts have been dropped before we + * start walking the LRU list. + */ +- drain_workqueue(btp->bt_mount->m_buf_workqueue); ++ flush_workqueue(btp->bt_mount->m_buf_workqueue); + + /* loop until there is nothing left on the lru list. */ + while (list_lru_count(&btp->bt_lru)) { +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index f0acff0f66c9..388fc6f78c6f 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2042,6 +2042,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css) + mutex_unlock(&cpuset_mutex); + } + ++/* ++ * Make sure the new task conform to the current state of its parent, ++ * which could have been changed by cpuset just after it inherits the ++ * state from the parent and before it sits on the cgroup's task list. ++ */ ++void cpuset_fork(struct task_struct *task) ++{ ++ if (task_css_is_root(task, cpuset_cgrp_id)) ++ return; ++ ++ set_cpus_allowed_ptr(task, ¤t->cpus_allowed); ++ task->mems_allowed = current->mems_allowed; ++} ++ + struct cgroup_subsys cpuset_cgrp_subsys = { + .css_alloc = cpuset_css_alloc, + .css_online = cpuset_css_online, +@@ -2051,6 +2065,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = { + .cancel_attach = cpuset_cancel_attach, + .attach = cpuset_attach, + .bind = cpuset_bind, ++ .fork = cpuset_fork, + .legacy_cftypes = files, + .early_init = 1, + };