From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 7FCC2138359 for ; Wed, 22 Jul 2020 12:24:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9A20AE087C; Wed, 22 Jul 2020 12:24:27 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1A412E087C for ; Wed, 22 Jul 2020 12:24:27 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AB6F234F1CD for ; Wed, 22 Jul 2020 12:24:25 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 9CA919C for ; Wed, 22 Jul 2020 12:24:23 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1595420651.63d9f2a0d8a0a2e6bac11b4c89893967f5b36324.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.4 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1230_linux-4.4.231.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 63d9f2a0d8a0a2e6bac11b4c89893967f5b36324 X-VCS-Branch: 4.4 Date: Wed, 22 Jul 2020 12:24:23 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: bf2b0208-7e82-4cec-b935-5972632dfcfa X-Archives-Hash: eaf0c4d3ac874318eeeb3b0845779e02 commit: 63d9f2a0d8a0a2e6bac11b4c89893967f5b36324 Author: Mike Pagano gentoo org> AuthorDate: Wed Jul 22 12:24:11 2020 +0000 Commit: Mike Pagano gentoo org> CommitDate: Wed Jul 22 12:24:11 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=63d9f2a0 Linux patch 4.4.231 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1230_linux-4.4.231.patch | 1742 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1746 insertions(+) diff --git a/0000_README b/0000_README index 8148270..3d3ab8d 100644 --- a/0000_README +++ b/0000_README @@ -963,6 +963,10 @@ Patch: 1229_linux-4.4.230.patch From: http://www.kernel.org Desc: Linux 4.4.230 +Patch: 1230_linux-4.4.231.patch +From: http://www.kernel.org +Desc: Linux 4.4.231 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1230_linux-4.4.231.patch b/1230_linux-4.4.231.patch new file mode 100644 index 0000000..00335a3 --- /dev/null +++ b/1230_linux-4.4.231.patch @@ -0,0 +1,1742 @@ +diff --git a/Makefile b/Makefile +index 847f2537d39d..46178c83906c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 230 ++SUBLEVEL = 231 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h +index 8ee9113b2f8b..b060eb8ad91b 100644 +--- a/arch/arc/include/asm/elf.h ++++ b/arch/arc/include/asm/elf.h +@@ -27,7 +27,7 @@ + #define R_ARC_S25W_PCREL 0x11 + + /*to set parameters in the core dumps */ +-#define ELF_ARCH EM_ARCOMPACT ++#define ELF_ARCH EM_ARC_INUSE + #define ELF_CLASS ELFCLASS32 + + #ifdef CONFIG_CPU_BIG_ENDIAN +diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S +index db1eee5fe502..5e3f1edf5a29 100644 +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -168,7 +168,6 @@ END(EV_Extension) + tracesys: + ; save EFA in case tracer wants the PC of traced task + ; using ERET won't work since next-PC has already committed +- lr r12, [efa] + GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 + st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address + +@@ -211,15 +210,9 @@ tracesys_exit: + ; Breakpoint TRAP + ; --------------------------------------------- + trap_with_param: +- +- ; stop_pc info by gdb needs this info +- lr r0, [efa] ++ mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc + mov r1, sp + +- ; Now that we have read EFA, it is safe to do "fake" rtie +- ; and get out of CPU exception mode +- FAKE_RET_FROM_EXCPN +- + ; Save callee regs in case gdb wants to have a look + ; SP will grow up by size of CALLEE Reg-File + ; NOTE: clobbers r12 +@@ -246,6 +239,10 @@ ENTRY(EV_Trap) + + EXCEPTION_PROLOGUE + ++ lr r12, [efa] ++ ++ FAKE_RET_FROM_EXCPN ++ + ;============ TRAP 1 :breakpoints + ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) + bmsk.f 0, r9, 7 +@@ -253,9 +250,6 @@ ENTRY(EV_Trap) + + ;============ TRAP (no param): syscall top level + +- ; First return from Exception to pure K mode (Exception/IRQs renabled) +- FAKE_RET_FROM_EXCPN +- + ; If syscall tracing ongoing, invoke pre-post-hooks + GET_CURR_THR_INFO_FLAGS r10 + btst r10, TIF_SYSCALL_TRACE +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index f72743dc070d..606c21760f23 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -238,7 +238,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + if (user_mode(regs)) + return DBG_HOOK_ERROR; + +- kgdb_handle_exception(1, SIGTRAP, 0, regs); ++ kgdb_handle_exception(0, SIGTRAP, 0, regs); + return DBG_HOOK_HANDLED; + } + +diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c +index 345978cc105b..fbb99c430f13 100644 +--- a/arch/mips/kernel/time.c ++++ b/arch/mips/kernel/time.c +@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq; + static int cpufreq_callback(struct notifier_block *nb, + unsigned long val, void *data) + { +- struct cpufreq_freqs *freq = data; +- struct cpumask *cpus = freq->policy->cpus; +- unsigned long lpj; + int cpu; ++ struct cpufreq_freqs *freq = data; + + /* + * Skip lpj numbers adjustment if the CPU-freq transition is safe for +@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notifier_block *nb, + } + } + ++ cpu = freq->cpu; + /* + * Adjust global lpj variable and per-CPU udelay_val number in + * accordance with the new CPU frequency. +@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notifier_block *nb, + glb_lpj_ref_freq, + freq->new); + +- for_each_cpu(cpu, cpus) { +- lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu), +- per_cpu(pcp_lpj_ref_freq, cpu), +- freq->new); +- cpu_data[cpu].udelay_val = (unsigned int)lpj; +- } ++ cpu_data[cpu].udelay_val = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu), ++ per_cpu(pcp_lpj_ref_freq, cpu), freq->new); + } + + return NOTIFY_OK; +diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h +index 7d9c5917da2b..737bc0a39463 100644 +--- a/arch/s390/include/asm/kvm_host.h ++++ b/arch/s390/include/asm/kvm_host.h +@@ -29,12 +29,12 @@ + #define KVM_USER_MEM_SLOTS 32 + + /* +- * These seem to be used for allocating ->chip in the routing table, +- * which we don't use. 4096 is an out-of-thin-air value. If we need +- * to look at ->chip later on, we'll need to revisit this. ++ * These seem to be used for allocating ->chip in the routing table, which we ++ * don't use. 1 is as small as we can get to reduce the needed memory. If we ++ * need to look at ->chip later on, we'll need to revisit this. + */ + #define KVM_NR_IRQCHIPS 1 +-#define KVM_IRQCHIP_NUM_PINS 4096 ++#define KVM_IRQCHIP_NUM_PINS 1 + #define KVM_HALT_POLL_NS_DEFAULT 0 + + #define SIGP_CTRL_C 0x80 +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index a5b533aea958..2ff0fe32c015 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3679,7 +3679,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu, + nonleaf_bit8_rsvd | rsvd_bits(7, 7) | + rsvd_bits(maxphyaddr, 51); + rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd | +- nonleaf_bit8_rsvd | gbpages_bit_rsvd | ++ gbpages_bit_rsvd | + rsvd_bits(maxphyaddr, 51); + rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd | + rsvd_bits(maxphyaddr, 51); +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 5e0e29ee31d1..226ccb7891d4 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -2155,6 +2155,7 @@ static struct virtio_device_id id_table[] = { + { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID }, + { 0 }, + }; ++MODULE_DEVICE_TABLE(virtio, id_table); + + static unsigned int features[] = { + VIRTIO_CONSOLE_F_SIZE, +@@ -2167,6 +2168,7 @@ static struct virtio_device_id rproc_serial_id_table[] = { + #endif + { 0 }, + }; ++MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table); + + static unsigned int rproc_serial_features[] = { + }; +@@ -2319,6 +2321,5 @@ static void __exit fini(void) + module_init(init); + module_exit(fini); + +-MODULE_DEVICE_TABLE(virtio, id_table); + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c +index 915eec3cc279..c2bb8486d174 100644 +--- a/drivers/dma/fsl-edma.c ++++ b/drivers/dma/fsl-edma.c +@@ -671,6 +671,13 @@ static irqreturn_t fsl_edma_tx_handler(int irq, void *dev_id) + fsl_chan = &fsl_edma->chans[ch]; + + spin_lock(&fsl_chan->vchan.lock); ++ ++ if (!fsl_chan->edesc) { ++ /* terminate_all called before */ ++ spin_unlock(&fsl_chan->vchan.lock); ++ continue; ++ } ++ + if (!fsl_chan->edesc->iscyclic) { + list_del(&fsl_chan->edesc->vdesc.node); + vchan_cookie_complete(&fsl_chan->edesc->vdesc); +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 2ccf81168d1e..e7a245d7bdbc 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5554,6 +5554,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) + if (!rdev->pm.dpm.ps) + return -ENOMEM; + power_state_offset = (u8 *)state_array->states; ++ rdev->pm.dpm.num_ps = 0; + for (i = 0; i < state_array->ucNumEntries; i++) { + u8 *idx; + power_state = (union pplib_power_state *)power_state_offset; +@@ -5563,10 +5564,8 @@ static int ci_parse_power_table(struct radeon_device *rdev) + if (!rdev->pm.power_state[i].clock_info) + return -EINVAL; + ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(rdev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + rdev->pm.dpm.ps[i].ps_priv = ps; + ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], + non_clock_info, +@@ -5588,8 +5587,8 @@ static int ci_parse_power_table(struct radeon_device *rdev) + k++; + } + power_state_offset += 2 + power_state->v2.ucNumDPMLevels; ++ rdev->pm.dpm.num_ps = i + 1; + } +- rdev->pm.dpm.num_ps = state_array->ucNumEntries; + + /* fill in the vce power states */ + for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) { +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index d6fa496d0ca2..d15e824e39df 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd + __set_bit(MSC_RAW, input->mscbit); + } + ++ /* ++ * hid-input may mark device as using autorepeat, but neither ++ * the trackpad, nor the mouse actually want it. ++ */ ++ __clear_bit(EV_REP, input->evbit); ++ + return 0; + } + +diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c +index 952fe692d764..0ddb0677e9c8 100644 +--- a/drivers/hwmon/emc2103.c ++++ b/drivers/hwmon/emc2103.c +@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct device *dev, struct device_attribute *da, + } + + result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg); +- if (result) { ++ if (result < 0) { + count = result; + goto err; + } +diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c +index eef3aa6007f1..ffd8f9772096 100644 +--- a/drivers/i2c/busses/i2c-eg20t.c ++++ b/drivers/i2c/busses/i2c-eg20t.c +@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = { + { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, }, + {0,} + }; ++MODULE_DEVICE_TABLE(pci, pch_pcidev_id); + + static irqreturn_t pch_i2c_handler(int irq, void *pData); + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index fd1e79013cf8..bdc42923523e 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -429,6 +429,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "076804U"), + }, + }, ++ { ++ /* Lenovo XiaoXin Air 12 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "80UN"), ++ }, ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), +diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c +index 6c9fc11efb87..e77185e143ab 100644 +--- a/drivers/message/fusion/mptscsih.c ++++ b/drivers/message/fusion/mptscsih.c +@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state); + int mptscsih_resume(struct pci_dev *pdev); + #endif + +-#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE +- + + /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ + /* +@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR + /* Copy the sense received into the scsi command block. */ + req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); + sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC)); +- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc)); ++ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC); + + /* Log SMART data (asc = 0x5D, non-IM case only) if required. + */ +diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c +index e2474af7386a..ae0f6a1a4be0 100644 +--- a/drivers/misc/atmel-ssc.c ++++ b/drivers/misc/atmel-ssc.c +@@ -13,7 +13,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -21,7 +21,7 @@ + #include + + /* Serialize access to ssc_list and user count */ +-static DEFINE_SPINLOCK(user_lock); ++static DEFINE_MUTEX(user_lock); + static LIST_HEAD(ssc_list); + + struct ssc_device *ssc_request(unsigned int ssc_num) +@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num) + int ssc_valid = 0; + struct ssc_device *ssc; + +- spin_lock(&user_lock); ++ mutex_lock(&user_lock); + list_for_each_entry(ssc, &ssc_list, list) { + if (ssc->pdev->dev.of_node) { + if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc") +@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned int ssc_num) + } + + if (!ssc_valid) { +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + pr_err("ssc: ssc%d platform device is missing\n", ssc_num); + return ERR_PTR(-ENODEV); + } + + if (ssc->user) { +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + dev_dbg(&ssc->pdev->dev, "module busy\n"); + return ERR_PTR(-EBUSY); + } + ssc->user++; +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + + clk_prepare(ssc->clk); + +@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc) + { + bool disable_clk = true; + +- spin_lock(&user_lock); ++ mutex_lock(&user_lock); + if (ssc->user) + ssc->user--; + else { + disable_clk = false; + dev_dbg(&ssc->pdev->dev, "device already free\n"); + } +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + + if (disable_clk) + clk_unprepare(ssc->clk); +@@ -194,9 +194,9 @@ static int ssc_probe(struct platform_device *pdev) + return -ENXIO; + } + +- spin_lock(&user_lock); ++ mutex_lock(&user_lock); + list_add_tail(&ssc->list, &ssc_list); +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + + platform_set_drvdata(pdev, ssc); + +@@ -210,9 +210,9 @@ static int ssc_remove(struct platform_device *pdev) + { + struct ssc_device *ssc = platform_get_drvdata(pdev); + +- spin_lock(&user_lock); ++ mutex_lock(&user_lock); + list_del(&ssc->list); +- spin_unlock(&user_lock); ++ mutex_unlock(&user_lock); + + return 0; + } +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index 864c2dc728a9..4457adb16916 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -626,9 +626,8 @@ static int mei_cl_device_remove(struct device *dev) + ret = cldrv->remove(cldev); + + module_put(THIS_MODULE); +- dev->driver = NULL; +- return ret; + ++ return ret; + } + + static ssize_t name_show(struct device *dev, struct device_attribute *a, +diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c +index d125d19a35e4..8278158715c1 100644 +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -455,8 +455,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl) + } else { + ctrl->cs_offsets = brcmnand_cs_offsets; + +- /* v5.0 and earlier has a different CS0 offset layout */ +- if (ctrl->nand_version <= 0x0500) ++ /* v3.3-5.0 have a different CS0 offset layout */ ++ if (ctrl->nand_version >= 0x0303 && ++ ctrl->nand_version <= 0x0500) + ctrl->cs0_offsets = brcmnand_cs_offsets_cs0; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index 3eebb57975e3..dd2c64e2db5c 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -295,6 +295,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp) + } + } + ++ bp->pf.active_vfs = 0; + kfree(bp->pf.vf); + bp->pf.vf = NULL; + } +@@ -535,7 +536,6 @@ void bnxt_sriov_disable(struct bnxt *bp) + + bnxt_free_vf_resources(bp); + +- bp->pf.active_vfs = 0; + bp->pf.max_pf_rx_rings = bp->pf.max_rx_rings; + bp->pf.max_pf_tx_rings = bp->pf.max_tx_rings; + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index fd6492fd3dc0..9d07fa318ac3 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3093,7 +3093,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + drv_fw = &fw_info->fw_hdr; + + /* Read the header of the firmware on the card */ +- ret = -t4_read_flash(adap, FLASH_FW_START, ++ ret = t4_read_flash(adap, FLASH_FW_START, + sizeof(*card_fw) / sizeof(uint32_t), + (uint32_t *)card_fw, 1); + if (ret == 0) { +@@ -3122,8 +3122,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + should_install_fs_fw(adap, card_fw_usable, + be32_to_cpu(fs_fw->fw_ver), + be32_to_cpu(card_fw->fw_ver))) { +- ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, +- fw_size, 0); ++ ret = t4_fw_upgrade(adap, adap->mbox, fw_data, ++ fw_size, 0); + if (ret != 0) { + dev_err(adap->pdev_dev, + "failed to install firmware: %d\n", ret); +@@ -3154,7 +3154,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); +- ret = EINVAL; ++ ret = -EINVAL; + goto bye; + } + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index b6b8aec73b28..e4299852974e 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1136,11 +1136,14 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + + /* Init all registers */ + ret = smsc95xx_reset(dev); ++ if (ret) ++ goto free_pdata; + + /* detect device revision as different features may be available */ + ret = smsc95xx_read_reg(dev, ID_REV, &val); + if (ret < 0) +- return ret; ++ goto free_pdata; ++ + val >>= 16; + + if ((val == ID_REV_CHIP_ID_9500A_) || (val == ID_REV_CHIP_ID_9530_) || +@@ -1157,6 +1160,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + return 0; ++ ++free_pdata: ++ kfree(pdata); ++ return ret; + } + + static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index e51f1a577897..e2ed30b03af5 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -639,9 +639,9 @@ err: + + static void ath9k_hif_usb_rx_cb(struct urb *urb) + { +- struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +- struct hif_device_usb *hif_dev = rx_buf->hif_dev; +- struct sk_buff *skb = rx_buf->skb; ++ struct sk_buff *skb = (struct sk_buff *) urb->context; ++ struct hif_device_usb *hif_dev = ++ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); + int ret; + + if (!skb) +@@ -681,15 +681,14 @@ resubmit: + return; + free: + kfree_skb(skb); +- kfree(rx_buf); + } + + static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + { +- struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +- struct hif_device_usb *hif_dev = rx_buf->hif_dev; +- struct sk_buff *skb = rx_buf->skb; ++ struct sk_buff *skb = (struct sk_buff *) urb->context; + struct sk_buff *nskb; ++ struct hif_device_usb *hif_dev = ++ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); + int ret; + + if (!skb) +@@ -747,7 +746,6 @@ resubmit: + return; + free: + kfree_skb(skb); +- kfree(rx_buf); + urb->context = NULL; + } + +@@ -793,7 +791,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + init_usb_anchor(&hif_dev->mgmt_submitted); + + for (i = 0; i < MAX_TX_URB_NUM; i++) { +- tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL); ++ tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL); + if (!tx_buf) + goto err; + +@@ -830,9 +828,8 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + { +- struct rx_buf *rx_buf = NULL; +- struct sk_buff *skb = NULL; + struct urb *urb = NULL; ++ struct sk_buff *skb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->rx_submitted); +@@ -840,12 +837,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + + for (i = 0; i < MAX_RX_URB_NUM; i++) { + +- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); +- if (!rx_buf) { +- ret = -ENOMEM; +- goto err_rxb; +- } +- + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -860,14 +851,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + +- rx_buf->hif_dev = hif_dev; +- rx_buf->skb = skb; +- + usb_fill_bulk_urb(urb, hif_dev->udev, + usb_rcvbulkpipe(hif_dev->udev, + USB_WLAN_RX_PIPE), + skb->data, MAX_RX_BUF_SIZE, +- ath9k_hif_usb_rx_cb, rx_buf); ++ ath9k_hif_usb_rx_cb, skb); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->rx_submitted); +@@ -893,8 +881,6 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: +- kfree(rx_buf); +-err_rxb: + ath9k_hif_usb_dealloc_rx_urbs(hif_dev); + return ret; + } +@@ -906,21 +892,14 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + { +- struct rx_buf *rx_buf = NULL; +- struct sk_buff *skb = NULL; + struct urb *urb = NULL; ++ struct sk_buff *skb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->reg_in_submitted); + + for (i = 0; i < MAX_REG_IN_URB_NUM; i++) { + +- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); +- if (!rx_buf) { +- ret = -ENOMEM; +- goto err_rxb; +- } +- + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -935,14 +914,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + +- rx_buf->hif_dev = hif_dev; +- rx_buf->skb = skb; +- + usb_fill_int_urb(urb, hif_dev->udev, + usb_rcvintpipe(hif_dev->udev, + USB_REG_IN_PIPE), + skb->data, MAX_REG_IN_BUF_SIZE, +- ath9k_hif_usb_reg_in_cb, rx_buf, 1); ++ ath9k_hif_usb_reg_in_cb, skb, 1); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->reg_in_submitted); +@@ -968,8 +944,6 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: +- kfree(rx_buf); +-err_rxb: + ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); + return ret; + } +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h +index 835264c36595..a95cdf562611 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.h ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h +@@ -84,11 +84,6 @@ struct tx_buf { + struct list_head list; + }; + +-struct rx_buf { +- struct sk_buff *skb; +- struct hif_device_usb *hif_dev; +-}; +- + #define HIF_USB_TX_STOP BIT(0) + #define HIF_USB_TX_FLUSH BIT(1) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 3709088d4d24..7969f5484aee 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -635,15 +635,20 @@ err_find_dev: + static int spidev_release(struct inode *inode, struct file *filp) + { + struct spidev_data *spidev; ++ int dofree; + + mutex_lock(&device_list_lock); + spidev = filp->private_data; + filp->private_data = NULL; + ++ spin_lock_irq(&spidev->spi_lock); ++ /* ... after we unbound from the underlying device? */ ++ dofree = (spidev->spi == NULL); ++ spin_unlock_irq(&spidev->spi_lock); ++ + /* last close? */ + spidev->users--; + if (!spidev->users) { +- int dofree; + + kfree(spidev->tx_buffer); + spidev->tx_buffer = NULL; +@@ -651,19 +656,14 @@ static int spidev_release(struct inode *inode, struct file *filp) + kfree(spidev->rx_buffer); + spidev->rx_buffer = NULL; + +- spin_lock_irq(&spidev->spi_lock); +- if (spidev->spi) +- spidev->speed_hz = spidev->spi->max_speed_hz; +- +- /* ... after we unbound from the underlying device? */ +- dofree = (spidev->spi == NULL); +- spin_unlock_irq(&spidev->spi_lock); +- + if (dofree) + kfree(spidev); ++ else ++ spidev->speed_hz = spidev->spi->max_speed_hz; + } + #ifdef CONFIG_SPI_SLAVE +- spi_slave_abort(spidev->spi); ++ if (!dofree) ++ spi_slave_abort(spidev->spi); + #endif + mutex_unlock(&device_list_lock); + +@@ -769,13 +769,13 @@ static int spidev_remove(struct spi_device *spi) + { + struct spidev_data *spidev = spi_get_drvdata(spi); + ++ /* prevent new opens */ ++ mutex_lock(&device_list_lock); + /* make sure ops on existing fds can abort cleanly */ + spin_lock_irq(&spidev->spi_lock); + spidev->spi = NULL; + spin_unlock_irq(&spidev->spi_lock); + +- /* prevent new opens */ +- mutex_lock(&device_list_lock); + list_del(&spidev->device_entry); + device_destroy(spidev_class, spidev->devt); + clear_bit(MINOR(spidev->devt), minors); +diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c +index 63991c49ff23..79a8799b1262 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1500.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c +@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + unsigned int lo_mask = data[5] << shift; + unsigned int chan_mask = hi_mask | lo_mask; + unsigned int old_mask = (1 << shift) - 1; +- unsigned int pm = devpriv->pm[trig] & old_mask; +- unsigned int pt = devpriv->pt[trig] & old_mask; +- unsigned int pp = devpriv->pp[trig] & old_mask; ++ unsigned int pm; ++ unsigned int pt; ++ unsigned int pp; + + if (trig > 1) { + dev_dbg(dev->class_dev, +@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + return -EINVAL; + } + ++ pm = devpriv->pm[trig] & old_mask; ++ pt = devpriv->pt[trig] & old_mask; ++ pp = devpriv->pp[trig] & old_mask; ++ + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + /* clear trigger configuration */ +diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c +index f598ecddc8a7..b58a504240c4 100644 +--- a/drivers/uio/uio_pdrv_genirq.c ++++ b/drivers/uio/uio_pdrv_genirq.c +@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev) + if (!uioinfo->irq) { + ret = platform_get_irq(pdev, 0); + uioinfo->irq = ret; +- if (ret == -ENXIO && pdev->dev.of_node) ++ if (ret == -ENXIO) + uioinfo->irq = UIO_IRQ_NONE; + else if (ret < 0) { + dev_err(&pdev->dev, "failed to get IRQ\n"); +diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c +index 7311ed61e99a..029c8bc54b7a 100644 +--- a/drivers/usb/c67x00/c67x00-sched.c ++++ b/drivers/usb/c67x00/c67x00-sched.c +@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status) + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); +- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); ++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status); + spin_lock(&c67x00->lock); + } + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index dee22d8effda..e104c99b3a1f 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1122,6 +1122,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci) + enable_irq(ci->irq); + } + ++/* ++ * Handle the wakeup interrupt triggered by extcon connector ++ * We need to call ci_irq again for extcon since the first ++ * interrupt (wakeup int) only let the controller be out of ++ * low power mode, but not handle any interrupts. ++ */ ++static void ci_extcon_wakeup_int(struct ci_hdrc *ci) ++{ ++ struct ci_hdrc_cable *cable_id, *cable_vbus; ++ u32 otgsc = hw_read_otgsc(ci, ~0); ++ ++ cable_id = &ci->platdata->id_extcon; ++ cable_vbus = &ci->platdata->vbus_extcon; ++ ++ if (!IS_ERR(cable_id->edev) && ci->is_otg && ++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) ++ ci_irq(ci->irq, ci); ++ ++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg && ++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) ++ ci_irq(ci->irq, ci); ++} ++ + static int ci_controller_resume(struct device *dev) + { + struct ci_hdrc *ci = dev_get_drvdata(dev); +@@ -1148,6 +1171,7 @@ static int ci_controller_resume(struct device *dev) + enable_irq(ci->irq); + if (ci_otg_is_fsm_mode(ci)) + ci_otg_fsm_wakeup_by_srp(ci); ++ ci_extcon_wakeup_int(ci); + } + + return 0; +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c +index d6fcead91b32..c095cde55329 100644 +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -185,6 +185,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); + + /*-------------------------------------------------------------------*/ + ++static const int pipetypes[4] = { ++ PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT ++}; ++ ++/** ++ * usb_urb_ep_type_check - sanity check of endpoint in the given urb ++ * @urb: urb to be checked ++ * ++ * This performs a light-weight sanity check for the endpoint in the ++ * given urb. It returns 0 if the urb contains a valid endpoint, otherwise ++ * a negative error code. ++ */ ++int usb_urb_ep_type_check(const struct urb *urb) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ ep = usb_pipe_endpoint(urb->dev, urb->pipe); ++ if (!ep) ++ return -EINVAL; ++ if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) ++ return -EINVAL; ++ return 0; ++} ++EXPORT_SYMBOL_GPL(usb_urb_ep_type_check); ++ + /** + * usb_submit_urb - issue an asynchronous transfer request for an endpoint + * @urb: pointer to the urb describing the request +@@ -324,9 +349,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); + */ + int usb_submit_urb(struct urb *urb, gfp_t mem_flags) + { +- static int pipetypes[4] = { +- PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT +- }; + int xfertype, max; + struct usb_device *dev; + struct usb_host_endpoint *ep; +@@ -445,7 +467,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) + */ + + /* Check that the pipe's type matches the endpoint's type */ +- if (usb_pipetype(urb->pipe) != pipetypes[xfertype]) ++ if (usb_urb_ep_type_check(urb)) + dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", + usb_pipetype(urb->pipe), pipetypes[xfertype]); + +diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c +index 6a2346b99f55..a7782ce673d6 100644 +--- a/drivers/usb/gadget/function/f_uac1.c ++++ b/drivers/usb/gadget/function/f_uac1.c +@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req) + + /* Copy buffer is full, add it to the play_queue */ + if (audio_buf_size - copy_buf->actual < req->actual) { ++ spin_lock_irq(&audio->lock); + list_add_tail(©_buf->list, &audio->play_queue); ++ spin_unlock_irq(&audio->lock); + schedule_work(&audio->playback_work); + copy_buf = f_audio_buffer_alloc(audio_buf_size); + if (IS_ERR(copy_buf)) +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index 668ac5e8681b..e6902257d7de 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) + u32 status; + + DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n", +- ep->ep.name, req); ++ ep->ep.name, _req); + + spin_lock_irqsave(&udc->lock, flags); + +diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c +index 56200650b46b..bd7082f297bb 100644 +--- a/drivers/usb/host/ehci-platform.c ++++ b/drivers/usb/host/ehci-platform.c +@@ -375,11 +375,6 @@ static int ehci_platform_resume(struct device *dev) + } + + ehci_resume(hcd, priv->reset_on_resume); +- +- pm_runtime_disable(dev); +- pm_runtime_set_active(dev); +- pm_runtime_enable(dev); +- + return 0; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c +index 0e5580e6f35c..c2669f185f65 100644 +--- a/drivers/usb/host/ohci-platform.c ++++ b/drivers/usb/host/ohci-platform.c +@@ -339,11 +339,6 @@ static int ohci_platform_resume(struct device *dev) + } + + ohci_resume(hcd, false); +- +- pm_runtime_disable(dev); +- pm_runtime_set_active(dev); +- pm_runtime_enable(dev); +- + return 0; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 510fb7853f92..c4c40e9d4247 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -249,17 +249,8 @@ static int xhci_plat_resume(struct device *dev) + { + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +- int ret; +- +- ret = xhci_resume(xhci, 0); +- if (ret) +- return ret; + +- pm_runtime_disable(dev); +- pm_runtime_set_active(dev); +- pm_runtime_enable(dev); +- +- return 0; ++ return xhci_resume(xhci, 0); + } + + static const struct dev_pm_ops xhci_plat_pm_ops = { +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index e8a8c4fa944f..3ec59c2b4f65 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -71,6 +71,7 @@ + + static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x4348, 0x5523) }, ++ { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { }, +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index e92cd1eceefa..2c6587b5c329 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -63,6 +63,7 @@ static const struct usb_device_id id_table_earthmate[] = { + + static const struct usb_device_id id_table_cyphidcomrs232[] = { + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { } /* Terminating entry */ +@@ -77,6 +78,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) }, +diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h +index 119d2e17077b..6d9820bffc20 100644 +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -24,6 +24,9 @@ + #define VENDOR_ID_CYPRESS 0x04b4 + #define PRODUCT_ID_CYPHIDCOM 0x5500 + ++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ ++#define VENDOR_ID_SAI 0x17dd ++ + /* FRWD Dongle - a GPS sports watch */ + #define VENDOR_ID_FRWD 0x6737 + #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001 +diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c +index 7ed7d33d6c10..1a966f25b3ef 100644 +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct usb_serial_port *port, + struct iuu_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + +- if (count > 256) +- return -ENOMEM; +- + spin_lock_irqsave(&priv->lock, flags); + ++ count = min(count, 256 - priv->writelen); ++ if (count == 0) ++ goto out; ++ + /* fill the buffer */ + memcpy(priv->writebuf + priv->writelen, buf, count); + priv->writelen += count; ++out: + spin_unlock_irqrestore(&priv->lock, flags); + + return count; +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 326e7109b8f8..52b1092ed57e 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -248,6 +248,7 @@ static void option_instat_callback(struct urb *urb); + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 + #define QUECTEL_PRODUCT_EC25 0x0125 ++#define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + +@@ -1095,6 +1096,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), + .driver_info = RSVD(4) }, ++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), ++ .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), +@@ -2019,6 +2022,9 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 2c86c472f670..42b7409d4cc5 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4861,25 +4861,28 @@ err: + static void check_buffer_tree_ref(struct extent_buffer *eb) + { + int refs; +- /* the ref bit is tricky. We have to make sure it is set +- * if we have the buffer dirty. Otherwise the +- * code to free a buffer can end up dropping a dirty +- * page ++ /* ++ * The TREE_REF bit is first set when the extent_buffer is added ++ * to the radix tree. It is also reset, if unset, when a new reference ++ * is created by find_extent_buffer. + * +- * Once the ref bit is set, it won't go away while the +- * buffer is dirty or in writeback, and it also won't +- * go away while we have the reference count on the +- * eb bumped. ++ * It is only cleared in two cases: freeing the last non-tree ++ * reference to the extent_buffer when its STALE bit is set or ++ * calling releasepage when the tree reference is the only reference. + * +- * We can't just set the ref bit without bumping the +- * ref on the eb because free_extent_buffer might +- * see the ref bit and try to clear it. If this happens +- * free_extent_buffer might end up dropping our original +- * ref by mistake and freeing the page before we are able +- * to add one more ref. ++ * In both cases, care is taken to ensure that the extent_buffer's ++ * pages are not under io. However, releasepage can be concurrently ++ * called with creating new references, which is prone to race ++ * conditions between the calls to check_buffer_tree_ref in those ++ * codepaths and clearing TREE_REF in try_release_extent_buffer. + * +- * So bump the ref count first, then set the bit. If someone +- * beat us to it, drop the ref we added. ++ * The actual lifetime of the extent_buffer in the radix tree is ++ * adequately protected by the refcount, but the TREE_REF bit and ++ * its corresponding reference are not. To protect against this ++ * class of races, we call check_buffer_tree_ref from the codepaths ++ * which trigger io after they set eb->io_pages. Note that once io is ++ * initiated, TREE_REF can no longer be cleared, so that is the ++ * moment at which any such race is best fixed. + */ + refs = atomic_read(&eb->refs); + if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) +@@ -5346,6 +5349,11 @@ int read_extent_buffer_pages(struct extent_io_tree *tree, + clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags); + eb->read_mirror = 0; + atomic_set(&eb->io_pages, num_reads); ++ /* ++ * It is possible for releasepage to clear the TREE_REF bit before we ++ * set io_pages. See check_buffer_tree_ref for a more detailed comment. ++ */ ++ check_buffer_tree_ref(eb); + for (i = start_i; i < num_pages; i++) { + page = eb->pages[i]; + if (!PageUptodate(page)) { +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 6ce6754168e0..f7d025d1684c 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + static const struct file_operations fuse_direct_io_file_operations; + +@@ -2517,7 +2518,16 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, + struct iovec *iov = iov_page; + + iov->iov_base = (void __user *)arg; +- iov->iov_len = _IOC_SIZE(cmd); ++ ++ switch (cmd) { ++ case FS_IOC_GETFLAGS: ++ case FS_IOC_SETFLAGS: ++ iov->iov_len = sizeof(int); ++ break; ++ default: ++ iov->iov_len = _IOC_SIZE(cmd); ++ break; ++ } + + if (_IOC_DIR(cmd) & _IOC_WRITE) { + in_iov = iov; +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 02bffcc611c3..55ea5d625cdf 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(struct urb *urb) + return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT; + } + ++int usb_urb_ep_type_check(const struct urb *urb); ++ + void *usb_alloc_coherent(struct usb_device *dev, size_t size, + gfp_t mem_flags, dma_addr_t *dma); + void usb_free_coherent(struct usb_device *dev, size_t size, +diff --git a/include/net/dst.h b/include/net/dst.h +index 2e6e3a14a21a..dc1f26da3c61 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -470,7 +470,15 @@ static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, co + static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst, + struct sk_buff *skb) + { +- struct neighbour *n = dst->ops->neigh_lookup(dst, skb, NULL); ++ struct neighbour *n = NULL; ++ ++ /* The packets from tunnel devices (eg bareudp) may have only ++ * metadata in the dst pointer of skb. Hence a pointer check of ++ * neigh_lookup is needed. ++ */ ++ if (dst->ops->neigh_lookup) ++ n = dst->ops->neigh_lookup(dst, skb, NULL); ++ + return IS_ERR(n) ? NULL : n; + } + +diff --git a/include/net/genetlink.h b/include/net/genetlink.h +index 43c0e771f417..351766331519 100644 +--- a/include/net/genetlink.h ++++ b/include/net/genetlink.h +@@ -33,12 +33,6 @@ struct genl_info; + * do additional, common, filtering and return an error + * @post_doit: called after an operation's doit callback, it may + * undo operations done by pre_doit, for example release locks +- * @mcast_bind: a socket bound to the given multicast group (which +- * is given as the offset into the groups array) +- * @mcast_unbind: a socket was unbound from the given multicast group. +- * Note that unbind() will not be called symmetrically if the +- * generic netlink family is removed while there are still open +- * sockets. + * @attrbuf: buffer to store parsed attributes + * @family_list: family list + * @mcgrps: multicast groups used by this family (private) +@@ -61,8 +55,6 @@ struct genl_family { + void (*post_doit)(const struct genl_ops *ops, + struct sk_buff *skb, + struct genl_info *info); +- int (*mcast_bind)(struct net *net, int group); +- void (*mcast_unbind)(struct net *net, int group); + struct nlattr ** attrbuf; /* private */ + const struct genl_ops * ops; /* private */ + const struct genl_multicast_group *mcgrps; /* private */ +diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h +index a5c6e6da3d3d..57872c8f1151 100644 +--- a/include/sound/compress_driver.h ++++ b/include/sound/compress_driver.h +@@ -71,6 +71,7 @@ struct snd_compr_runtime { + * @direction: stream direction, playback/recording + * @metadata_set: metadata set flag, true when set + * @next_track: has userspace signal next track transition, true when set ++ * @partial_drain: undergoing partial_drain for stream, true when set + * @private_data: pointer to DSP private data + */ + struct snd_compr_stream { +@@ -81,6 +82,7 @@ struct snd_compr_stream { + enum snd_compr_direction direction; + bool metadata_set; + bool next_track; ++ bool partial_drain; + void *private_data; + }; + +@@ -178,7 +180,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) + if (snd_BUG_ON(!stream)) + return; + +- stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ /* for partial_drain case we are back to running state on success */ ++ if (stream->partial_drain) { ++ stream->runtime->state = SNDRV_PCM_STATE_RUNNING; ++ stream->partial_drain = false; /* clear this flag as well */ ++ } else { ++ stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ } + + wake_up(&stream->runtime->sleep); + } +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 971e31e47bfd..15952d0e340b 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5939,7 +5939,15 @@ static int detach_tasks(struct lb_env *env) + if (!can_migrate_task(p, env)) + goto next; + +- load = task_h_load(p); ++ /* ++ * Depending of the number of CPUs and tasks and the ++ * cgroup hierarchy, task_h_load() can return a null ++ * value. Make sure that env->imbalance decreases ++ * otherwise detach_tasks() will stop only after ++ * detaching up to loop_max tasks. ++ */ ++ load = max_t(unsigned long, task_h_load(p), 1); ++ + + if (sched_feat(LB_MIN) && load < 16 && !env->sd->nr_balance_failed) + goto next; +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 82c878224bfc..a3abd136b8e7 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -802,6 +802,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + RT_SCOPE_UNIVERSE, sk->sk_protocol, + inet_sk_flowi_flags(sk), faddr, saddr, 0, 0); + ++ fl4.fl4_icmp_type = user_icmph.type; ++ fl4.fl4_icmp_code = user_icmph.code; ++ + security_sk_classify_flow(sk, flowi4_to_flowi(&fl4)); + rt = ip_route_output_flow(net, &fl4, sk); + if (IS_ERR(rt)) { +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 2ceda7ddaed5..4080cf1a369d 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2259,6 +2259,9 @@ int tcp_disconnect(struct sock *sk, int flags) + tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; + tp->snd_cwnd_cnt = 0; + tp->window_clamp = 0; ++ if (icsk->icsk_ca_ops->release) ++ icsk->icsk_ca_ops->release(sk); ++ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); + tcp_set_ca_state(sk, TCP_CA_Open); + tcp_clear_retrans(tp); + tp->total_retrans = 0; +@@ -2593,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, + + #ifdef CONFIG_TCP_MD5SIG + case TCP_MD5SIG: +- if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) +- err = tp->af_specific->md5_parse(sk, optval, optlen); +- else +- err = -EINVAL; ++ err = tp->af_specific->md5_parse(sk, optval, optlen); + break; + #endif + case TCP_USER_TIMEOUT: +@@ -3085,9 +3085,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data); + + int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key) + { ++ u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */ + struct scatterlist sg; + +- sg_init_one(&sg, key->key, key->keylen); ++ sg_init_one(&sg, key->key, keylen); ++ ++ /* tcp_md5_do_add() might change key->key under us */ + return crypto_hash_update(&hp->md5_desc, &sg, key->keylen); + } + EXPORT_SYMBOL(tcp_md5_hash_key); +diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c +index aafe68134763..f6b64efc22e8 100644 +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -201,7 +201,7 @@ static void tcp_reinit_congestion_control(struct sock *sk, + icsk->icsk_ca_ops = ca; + icsk->icsk_ca_setsockopt = 1; + +- if (sk->sk_state != TCP_CLOSE) ++ if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + tcp_init_congestion_control(sk); + } + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 12d4d2758caf..3826745a160e 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -931,9 +931,18 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, + + key = tcp_md5_do_lookup(sk, addr, family); + if (key) { +- /* Pre-existing entry - just update that one. */ ++ /* Pre-existing entry - just update that one. ++ * Note that the key might be used concurrently. ++ */ + memcpy(key->key, newkey, newkeylen); +- key->keylen = newkeylen; ++ ++ /* Pairs with READ_ONCE() in tcp_md5_hash_key(). ++ * Also note that a reader could catch new key->keylen value ++ * but old key->key[], this is the reason we use __GFP_ZERO ++ * at sock_kmalloc() time below these lines. ++ */ ++ WRITE_ONCE(key->keylen, newkeylen); ++ + return 0; + } + +@@ -950,7 +959,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, + rcu_assign_pointer(tp->md5sig_info, md5sig); + } + +- key = sock_kmalloc(sk, sizeof(*key), gfp); ++ key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO); + if (!key) + return -ENOMEM; + if (!tcp_alloc_md5sig_pool()) { +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 53c53b1c881c..653892ea8f14 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1139,6 +1139,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, + + /* Queue the packet to IP for output */ + skb->ignore_df = 1; ++ skb_dst_drop(skb); + #if IS_ENABLED(CONFIG_IPV6) + if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped) + error = inet6_csk_xmit(tunnel->sock, skb, NULL); +@@ -1203,10 +1204,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + goto out_unlock; + } + +- /* Get routing info from the tunnel socket */ +- skb_dst_drop(skb); +- skb_dst_set(skb, sk_dst_check(sk, 0)); +- + inet = inet_sk(sk); + fl = &inet->cork.fl; + switch (tunnel->encap) { +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 69f1558dfcb7..f613a1007107 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + + if (!sock_flag(sk, SOCK_ZAPPED)) + goto out; ++ if (!addr->sllc_arphrd) ++ addr->sllc_arphrd = ARPHRD_ETHER; ++ if (addr->sllc_arphrd != ARPHRD_ETHER) ++ goto out; + rc = -ENODEV; + if (sk->sk_bound_dev_if) { + llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); +@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) + goto out; + rc = -EAFNOSUPPORT; +- if (unlikely(addr->sllc_family != AF_LLC)) ++ if (!addr->sllc_arphrd) ++ addr->sllc_arphrd = ARPHRD_ETHER; ++ if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER)) + goto out; + rc = -ENODEV; + rcu_read_lock(); + if (sk->sk_bound_dev_if) { + llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); + if (llc->dev) { +- if (!addr->sllc_arphrd) +- addr->sllc_arphrd = llc->dev->type; + if (is_zero_ether_addr(addr->sllc_mac)) + memcpy(addr->sllc_mac, llc->dev->dev_addr, + IFHWADDRLEN); +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index d681dbaf00c1..3fc00c320a9f 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1007,63 +1007,11 @@ static struct genl_multicast_group genl_ctrl_groups[] = { + { .name = "notify", }, + }; + +-static int genl_bind(struct net *net, int group) +-{ +- int i, err = -ENOENT; +- +- down_read(&cb_lock); +- for (i = 0; i < GENL_FAM_TAB_SIZE; i++) { +- struct genl_family *f; +- +- list_for_each_entry(f, genl_family_chain(i), family_list) { +- if (group >= f->mcgrp_offset && +- group < f->mcgrp_offset + f->n_mcgrps) { +- int fam_grp = group - f->mcgrp_offset; +- +- if (!f->netnsok && net != &init_net) +- err = -ENOENT; +- else if (f->mcast_bind) +- err = f->mcast_bind(net, fam_grp); +- else +- err = 0; +- break; +- } +- } +- } +- up_read(&cb_lock); +- +- return err; +-} +- +-static void genl_unbind(struct net *net, int group) +-{ +- int i; +- +- down_read(&cb_lock); +- for (i = 0; i < GENL_FAM_TAB_SIZE; i++) { +- struct genl_family *f; +- +- list_for_each_entry(f, genl_family_chain(i), family_list) { +- if (group >= f->mcgrp_offset && +- group < f->mcgrp_offset + f->n_mcgrps) { +- int fam_grp = group - f->mcgrp_offset; +- +- if (f->mcast_unbind) +- f->mcast_unbind(net, fam_grp); +- break; +- } +- } +- } +- up_read(&cb_lock); +-} +- + static int __net_init genl_pernet_init(struct net *net) + { + struct netlink_kernel_cfg cfg = { + .input = genl_rcv, + .flags = NL_CFG_F_NONROOT_RECV, +- .bind = genl_bind, +- .unbind = genl_unbind, + }; + + /* we'll bump the group number right afterwards */ +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 07f5017cbea2..e788c7e1929b 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -699,6 +699,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) + + retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); + if (!retval) { ++ /* clear flags and stop any drain wait */ ++ stream->partial_drain = false; ++ stream->metadata_set = false; + snd_compr_drain_notify(stream); + stream->runtime->total_bytes_available = 0; + stream->runtime->total_bytes_transferred = 0; +@@ -809,6 +812,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) + if (stream->next_track == false) + return -EPERM; + ++ stream->partial_drain = true; + retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN); + if (retval) { + pr_debug("Partial drain returned failure\n"); +diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c +index 42920a243328..3f94746d587a 100644 +--- a/sound/drivers/opl3/opl3_synth.c ++++ b/sound/drivers/opl3/opl3_synth.c +@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw, struct file *file, + { + struct snd_dm_fm_info info; + ++ memset(&info, 0, sizeof(info)); ++ + info.fm_mode = opl3->fm_mode; + info.rhythm = opl3->rhythm; + if (copy_to_user(argp, &info, sizeof(struct snd_dm_fm_info))) +diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c +index 12d87204e373..7ac92d188f4f 100644 +--- a/sound/pci/hda/hda_auto_parser.c ++++ b/sound/pci/hda/hda_auto_parser.c +@@ -76,6 +76,12 @@ static int compare_input_type(const void *ap, const void *bp) + if (a->type != b->type) + return (int)(a->type - b->type); + ++ /* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */ ++ if (a->is_headset_mic && b->is_headphone_mic) ++ return -1; /* don't swap */ ++ else if (a->is_headphone_mic && b->is_headset_mic) ++ return 1; /* swap */ ++ + /* In case one has boost and the other one has not, + pick the one with boost first. */ + return (int)(b->has_boost_on_pin - a->has_boost_on_pin); +diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c +index f518fbbe88de..4250d26166a0 100644 +--- a/sound/usb/line6/capture.c ++++ b/sound/usb/line6/capture.c +@@ -269,6 +269,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_in_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; +diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c +index 97ed593f6010..500f0b455be9 100644 +--- a/sound/usb/line6/playback.c ++++ b/sound/usb/line6/playback.c +@@ -423,6 +423,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm) + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_out_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index b21b76690b31..5c4a3d6c4234 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1475,6 +1475,8 @@ void snd_usbmidi_disconnect(struct list_head *p) + spin_unlock_irq(&umidi->disc_lock); + up_write(&umidi->disc_rwsem); + ++ del_timer_sync(&umidi->error_timer); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; + if (ep->out) +@@ -1501,7 +1503,6 @@ void snd_usbmidi_disconnect(struct list_head *p) + ep->in = NULL; + } + } +- del_timer_sync(&umidi->error_timer); + } + EXPORT_SYMBOL(snd_usbmidi_disconnect); + +@@ -2258,16 +2259,22 @@ void snd_usbmidi_input_stop(struct list_head *p) + } + EXPORT_SYMBOL(snd_usbmidi_input_stop); + +-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) ++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, ++ struct snd_usb_midi_in_endpoint *ep) + { + unsigned int i; ++ unsigned long flags; + + if (!ep) + return; + for (i = 0; i < INPUT_URBS; ++i) { + struct urb *urb = ep->urbs[i]; +- urb->dev = ep->umidi->dev; +- snd_usbmidi_submit_urb(urb, GFP_KERNEL); ++ spin_lock_irqsave(&umidi->disc_lock, flags); ++ if (!atomic_read(&urb->use_count)) { ++ urb->dev = ep->umidi->dev; ++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC); ++ } ++ spin_unlock_irqrestore(&umidi->disc_lock, flags); + } + } + +@@ -2283,7 +2290,7 @@ void snd_usbmidi_input_start(struct list_head *p) + if (umidi->input_running || !umidi->opened[1]) + return; + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) +- snd_usbmidi_input_start_ep(umidi->endpoints[i].in); ++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); + umidi->input_running = 1; + } + EXPORT_SYMBOL(snd_usbmidi_input_start); +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index c892b4d1e733..ec56ce382061 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + }, + ++/* ++ * MacroSilicon MS2109 based HDMI capture cards ++ * ++ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch. ++ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if ++ * they pretend to be 96kHz mono as a workaround for stereo being broken ++ * by that... ++ * ++ * They also have swapped L-R channels, but that's for userspace to deal ++ * with. ++ */ ++{ ++ USB_DEVICE(0x534d, 0x2109), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "MacroSilicon", ++ .product_name = "MS2109", ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = &(const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_ALIGN_TRANSFER, ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_MIXER, ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S16_LE, ++ .channels = 2, ++ .iface = 3, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .attributes = 0, ++ .endpoint = 0x82, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC | ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_CONTINUOUS, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++ + #undef USB_DEVICE_VENDOR_SPEC +diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c +index 6ce624cb7001..699c0ec5b9bf 100644 +--- a/tools/perf/util/stat.c ++++ b/tools/perf/util/stat.c +@@ -318,8 +318,10 @@ int perf_stat_process_counter(struct perf_stat_config *config, + * interval mode, otherwise overall avg running + * averages will be shown for each interval. + */ +- if (config->interval) +- init_stats(ps->res_stats); ++ if (config->interval) { ++ for (i = 0; i < 3; i++) ++ init_stats(&ps->res_stats[i]); ++ } + + if (counter->per_pkg) + zero_per_pkg(counter);