From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 75C82138359 for ; Fri, 31 Jul 2020 16:13:38 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id AED2FE069C; Fri, 31 Jul 2020 16:13:37 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 89547E069C for ; Fri, 31 Jul 2020 16:13:37 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 6891734F0A2 for ; Fri, 31 Jul 2020 16:13:36 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 250A4275 for ; Fri, 31 Jul 2020 16:13:35 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1596212002.6aed8ad7db11b972116e7e37ac56f601dd4cb76b.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.9 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1231_linux-4.9.232.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 6aed8ad7db11b972116e7e37ac56f601dd4cb76b X-VCS-Branch: 4.9 Date: Fri, 31 Jul 2020 16:13:35 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 60e85a81-85a6-43dd-98a9-ea31a48c61b3 X-Archives-Hash: d965d201b49daffe1a6504d581c5e7d8 commit: 6aed8ad7db11b972116e7e37ac56f601dd4cb76b Author: Mike Pagano gentoo org> AuthorDate: Fri Jul 31 16:13:22 2020 +0000 Commit: Mike Pagano gentoo org> CommitDate: Fri Jul 31 16:13:22 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6aed8ad7 Linux patch 4.9.232 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1231_linux-4.9.232.patch | 1945 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1949 insertions(+) diff --git a/0000_README b/0000_README index f3d3878..cf1c30c 100644 --- a/0000_README +++ b/0000_README @@ -967,6 +967,10 @@ Patch: 1230_linux-4.9.231.patch From: http://www.kernel.org Desc: Linux 4.9.231 +Patch: 1231_linux-4.9.232.patch +From: http://www.kernel.org +Desc: Linux 4.9.232 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1231_linux-4.9.232.patch b/1231_linux-4.9.232.patch new file mode 100644 index 0000000..4dfa101 --- /dev/null +++ b/1231_linux-4.9.232.patch @@ -0,0 +1,1945 @@ +diff --git a/Makefile b/Makefile +index 1b1342a8785a..934db3609c16 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 231 ++SUBLEVEL = 232 + EXTRAVERSION = + NAME = Roaring Lionus + +@@ -505,7 +505,7 @@ ifeq ($(cc-name),clang) + ifneq ($(CROSS_COMPILE),) + CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%)) + GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit)) +-CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR) ++CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) + GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) + endif + ifneq ($(GCC_TOOLCHAIN),) +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index a5236a3e5297..3101d1b61713 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -380,14 +380,14 @@ void user_rewind_single_step(struct task_struct *task) + * If single step is active for this thread, then set SPSR.SS + * to 1 to avoid returning to the active-pending state. + */ +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + set_regs_spsr_ss(task_pt_regs(task)); + } + NOKPROBE_SYMBOL(user_rewind_single_step); + + void user_fastforward_single_step(struct task_struct *task) + { +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + clear_regs_spsr_ss(task_pt_regs(task)); + } + +diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h +index 5394b9c5f914..1616428a5f95 100644 +--- a/arch/parisc/include/asm/atomic.h ++++ b/arch/parisc/include/asm/atomic.h +@@ -255,6 +255,8 @@ atomic64_set(atomic64_t *v, s64 i) + _atomic_spin_unlock_irqrestore(v, flags); + } + ++#define atomic64_set_release(v, i) atomic64_set((v), (i)) ++ + static __inline__ s64 + atomic64_read(const atomic64_t *v) + { +diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S +index d258f59564e1..3b40c98bbbd4 100644 +--- a/arch/x86/math-emu/wm_sqrt.S ++++ b/arch/x86/math-emu/wm_sqrt.S +@@ -208,7 +208,7 @@ sqrt_stage_2_finish: + + #ifdef PARANOID + /* It should be possible to get here only if the arg is ffff....ffff */ +- cmp $0xffffffff,FPU_fsqrt_arg_1 ++ cmpl $0xffffffff,FPU_fsqrt_arg_1 + jnz sqrt_stage_2_error + #endif /* PARANOID */ + +diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c +index b9beae798d72..8679fa306206 100644 +--- a/arch/xtensa/kernel/setup.c ++++ b/arch/xtensa/kernel/setup.c +@@ -830,7 +830,8 @@ c_start(struct seq_file *f, loff_t *pos) + static void * + c_next(struct seq_file *f, void *v, loff_t *pos) + { +- return NULL; ++ ++*pos; ++ return c_start(f, pos); + } + + static void +diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c +index 9210b9cc4ec9..455c6ec4086c 100644 +--- a/arch/xtensa/kernel/xtensa_ksyms.c ++++ b/arch/xtensa/kernel/xtensa_ksyms.c +@@ -82,13 +82,13 @@ void __xtensa_libgcc_window_spill(void) + } + EXPORT_SYMBOL(__xtensa_libgcc_window_spill); + +-unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v) ++unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v) + { + BUG(); + } + EXPORT_SYMBOL(__sync_fetch_and_and_4); + +-unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v) ++unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v) + { + BUG(); + } +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index 36ce3511c733..7d0c83b47259 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -204,6 +204,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from, + if (*ppos < 0 || !count) + return -EINVAL; + ++ if (count > (PAGE_SIZE << (MAX_ORDER - 1))) ++ count = PAGE_SIZE << (MAX_ORDER - 1); ++ + buf = kmalloc(count, GFP_KERNEL); + if (!buf) + return -ENOMEM; +@@ -352,6 +355,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file, + if (*ppos < 0 || !count) + return -EINVAL; + ++ if (count > (PAGE_SIZE << (MAX_ORDER - 1))) ++ count = PAGE_SIZE << (MAX_ORDER - 1); ++ + buf = kmalloc(count, GFP_KERNEL); + if (!buf) + return -ENOMEM; +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1799a1dfa46e..cd984b59a8a1 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1239,7 +1239,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) + + /* If the user didn't specify a name match any */ + if (data) +- return (*r)->name == data; ++ return !strcmp((*r)->name, data); + else + return 1; + } +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 1389f0582e29..c5a45c57b8b8 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -38,6 +38,18 @@ + + #include "../dmaengine.h" + ++int completion_timeout = 200; ++module_param(completion_timeout, int, 0644); ++MODULE_PARM_DESC(completion_timeout, ++ "set ioat completion timeout [msec] (default 200 [msec])"); ++int idle_timeout = 2000; ++module_param(idle_timeout, int, 0644); ++MODULE_PARM_DESC(idle_timeout, ++ "set ioat idel timeout [msec] (default 2000 [msec])"); ++ ++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) ++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) ++ + static char *chanerr_str[] = { + "DMA Transfer Destination Address Error", + "Next Descriptor Address Error", +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index a9bc1a15b0d1..b0152288983b 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -111,8 +111,6 @@ struct ioatdma_chan { + #define IOAT_RUN 5 + #define IOAT_CHAN_ACTIVE 6 + struct timer_list timer; +- #define COMPLETION_TIMEOUT msecs_to_jiffies(100) +- #define IDLE_TIMEOUT msecs_to_jiffies(2000) + #define RESET_DELAY msecs_to_jiffies(100) + struct ioatdma_device *ioat_dma; + dma_addr_t completion_dma; +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index c16c06b3dd2f..54296e262dea 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) + + ret = pm_runtime_get_sync(tdc2dev(tdc)); + if (ret < 0) { ++ pm_runtime_put_noidle(tdc2dev(tdc)); + free_irq(tdc->irq, tdc); + return ret; + } +@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + goto rpm_disable; ++ } + + ret = tegra_adma_init(tdma); + if (ret) +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c +index 954f5b76bfcf..d44965f805fe 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c +@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry, + if (retries) + udelay(400); + +- /* transaction request, wait up to 1ms for it to complete */ ++ /* transaction request, wait up to 2ms for it to complete */ + nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl); + +- timeout = 1000; ++ timeout = 2000; + do { + ctrl = nvkm_rd32(device, 0x00e4e4 + base); + udelay(1); +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +index 61d729b82c69..a5783f4d972e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry, + if (retries) + udelay(400); + +- /* transaction request, wait up to 1ms for it to complete */ ++ /* transaction request, wait up to 2ms for it to complete */ + nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl); + +- timeout = 1000; ++ timeout = 2000; + do { + ctrl = nvkm_rd32(device, 0x00d954 + base); + udelay(1); +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 197eb75d10ef..959a9e38b4f5 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -55,6 +55,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") + struct apple_sc { + unsigned long quirks; + unsigned int fn_on; ++ unsigned int fn_found; + DECLARE_BITMAP(pressed_numlock, KEY_CNT); + }; + +@@ -340,12 +341,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) + { ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ + if (usage->hid == (HID_UP_CUSTOM | 0x0003) || + usage->hid == (HID_UP_MSVENDOR | 0x0003) || + usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); ++ asc->fn_found = true; + apple_setup_input(hi->input); + return 1; + } +@@ -372,6 +376,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, + return 0; + } + ++static int apple_input_configured(struct hid_device *hdev, ++ struct hid_input *hidinput) ++{ ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ ++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { ++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); ++ asc->quirks = 0; ++ } ++ ++ return 0; ++} ++ + static int apple_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +@@ -593,6 +610,7 @@ static struct hid_driver apple_driver = { + .event = apple_event, + .input_mapping = apple_input_mapping, + .input_mapped = apple_input_mapped, ++ .input_configured = apple_input_configured, + }; + module_hid_driver(apple_driver); + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 681ac9bc68b3..f98c1e1b1dbd 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Mediacom FlexBook edge 13", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Odys Winbook 13", + .matches = { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 3a352f76e633..427d4dbc9735 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1023,8 +1023,11 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (epause->tx_pause) + link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX; + +- if (netif_running(dev)) ++ if (netif_running(dev)) { ++ mutex_lock(&bp->link_lock); + rc = bnxt_hwrm_set_pause(bp); ++ mutex_unlock(&bp->link_lock); ++ } + return rc; + } + +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index 49f692907a30..c4197d0ec4d2 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -215,7 +215,7 @@ io_error: + + static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg) + { +- u16 v; ++ u16 v = 0; + __gm_phy_read(hw, port, reg, &v); + return v; + } +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index b0c72167bade..3c221ca2cc12 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -2294,7 +2294,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, + "power", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Optional reset GPIO configured? Minimum 100 ns reset needed +@@ -2303,7 +2303,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, + "reset", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Need to wait for optional EEPROM to load, max 750 us according +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 313e006f74fe..6f3519123eb6 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev) + rrpriv->info = NULL; + } + if (rrpriv->rx_ctrl) { +- pci_free_consistent(pdev, sizeof(struct ring_ctrl), ++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl), + rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); + rrpriv->rx_ctrl = NULL; + } +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index 7e94526de51c..5649cc075ccb 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -1337,6 +1337,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V1; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: +@@ -1344,6 +1345,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L2_SYNC: +@@ -1351,6 +1353,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_SYNC: +@@ -1358,6 +1361,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; + break; + default: + return -ERANGE; +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index 2c50497cc4ed..7ec8992401fb 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -217,6 +217,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); + if (ret < ETH_ALEN) { + netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); ++ ret = -EIO; + goto free; + } + memcpy(dev->net->dev_addr, buf, ETH_ALEN); +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 6676607164d6..f5657783fad4 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev) + dev->netdev_ops = &lapbeth_netdev_ops; + dev->destructor = free_netdev; + dev->type = ARPHRD_X25; +- dev->hard_header_len = 3; + dev->mtu = 1000; + dev->addr_len = 0; + } +@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev) + if (!ndev) + goto out; + ++ /* When transmitting data: ++ * first this driver removes a pseudo header of 1 byte, ++ * then the lapb module prepends an LAPB header of at most 3 bytes, ++ * then this driver prepends a length field of 2 bytes, ++ * then the underlying Ethernet device prepends its own header. ++ */ ++ ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; ++ + lapbeth = netdev_priv(ndev); + lapbeth->axdev = ndev; + +diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c +index eb56bb5916be..3b983f645726 100644 +--- a/drivers/net/wan/x25_asy.c ++++ b/drivers/net/wan/x25_asy.c +@@ -186,7 +186,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl) + netif_wake_queue(sl->dev); + } + +-/* Send one completely decapsulated IP datagram to the IP layer. */ ++/* Send an LAPB frame to the LAPB module to process. */ + + static void x25_asy_bump(struct x25_asy *sl) + { +@@ -198,13 +198,12 @@ static void x25_asy_bump(struct x25_asy *sl) + count = sl->rcount; + dev->stats.rx_bytes += count; + +- skb = dev_alloc_skb(count+1); ++ skb = dev_alloc_skb(count); + if (skb == NULL) { + netdev_warn(sl->dev, "memory squeeze, dropping packet\n"); + dev->stats.rx_dropped++; + return; + } +- skb_push(skb, 1); /* LAPB internal control */ + memcpy(skb_put(skb, count), sl->rbuff, count); + skb->protocol = x25_type_trans(skb, sl->dev); + err = lapb_data_received(skb->dev, skb); +@@ -212,7 +211,6 @@ static void x25_asy_bump(struct x25_asy *sl) + kfree_skb(skb); + printk(KERN_DEBUG "x25_asy: data received err - %d\n", err); + } else { +- netif_rx(skb); + dev->stats.rx_packets++; + } + } +@@ -358,12 +356,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb, + */ + + /* +- * Called when I frame data arrives. We did the work above - throw it +- * at the net layer. ++ * Called when I frame data arrive. We add a pseudo header for upper ++ * layers and pass it to upper layers. + */ + + static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb) + { ++ if (skb_cow(skb, 1)) { ++ kfree_skb(skb); ++ return NET_RX_DROP; ++ } ++ skb_push(skb, 1); ++ skb->data[0] = X25_IFACE_DATA; ++ ++ skb->protocol = x25_type_trans(skb, dev); ++ + return netif_rx(skb); + } + +@@ -659,7 +666,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s) + switch (s) { + case X25_END: + if (!test_and_clear_bit(SLF_ERROR, &sl->flags) && +- sl->rcount > 2) ++ sl->rcount >= 2) + x25_asy_bump(sl); + clear_bit(SLF_ESCAPE, &sl->flags); + sl->rcount = 0; +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 84b5f8a144ff..fb5b7ce3d2c3 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -641,9 +641,9 @@ err: + + static void ath9k_hif_usb_rx_cb(struct urb *urb) + { +- struct sk_buff *skb = (struct sk_buff *) urb->context; +- struct hif_device_usb *hif_dev = +- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); ++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; ++ struct hif_device_usb *hif_dev = rx_buf->hif_dev; ++ struct sk_buff *skb = rx_buf->skb; + int ret; + + if (!skb) +@@ -683,14 +683,15 @@ resubmit: + return; + free: + kfree_skb(skb); ++ kfree(rx_buf); + } + + static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + { +- struct sk_buff *skb = (struct sk_buff *) urb->context; ++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context; ++ struct hif_device_usb *hif_dev = rx_buf->hif_dev; ++ struct sk_buff *skb = rx_buf->skb; + struct sk_buff *nskb; +- struct hif_device_usb *hif_dev = +- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0)); + int ret; + + if (!skb) +@@ -730,11 +731,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + return; + } + ++ rx_buf->skb = nskb; ++ + usb_fill_int_urb(urb, hif_dev->udev, + usb_rcvintpipe(hif_dev->udev, + USB_REG_IN_PIPE), + nskb->data, MAX_REG_IN_BUF_SIZE, +- ath9k_hif_usb_reg_in_cb, nskb, 1); ++ ath9k_hif_usb_reg_in_cb, rx_buf, 1); + } + + resubmit: +@@ -748,6 +751,7 @@ resubmit: + return; + free: + kfree_skb(skb); ++ kfree(rx_buf); + urb->context = NULL; + } + +@@ -793,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + init_usb_anchor(&hif_dev->mgmt_submitted); + + for (i = 0; i < MAX_TX_URB_NUM; i++) { +- tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL); ++ tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL); + if (!tx_buf) + goto err; + +@@ -830,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + { +- struct urb *urb = NULL; ++ struct rx_buf *rx_buf = NULL; + struct sk_buff *skb = NULL; ++ struct urb *urb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->rx_submitted); +@@ -839,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + + for (i = 0; i < MAX_RX_URB_NUM; i++) { + ++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); ++ if (!rx_buf) { ++ ret = -ENOMEM; ++ goto err_rxb; ++ } ++ + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -853,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + ++ rx_buf->hif_dev = hif_dev; ++ rx_buf->skb = skb; ++ + usb_fill_bulk_urb(urb, hif_dev->udev, + usb_rcvbulkpipe(hif_dev->udev, + USB_WLAN_RX_PIPE), + skb->data, MAX_RX_BUF_SIZE, +- ath9k_hif_usb_rx_cb, skb); ++ ath9k_hif_usb_rx_cb, rx_buf); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->rx_submitted); +@@ -883,6 +897,8 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: ++ kfree(rx_buf); ++err_rxb: + ath9k_hif_usb_dealloc_rx_urbs(hif_dev); + return ret; + } +@@ -894,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev) + + static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + { +- struct urb *urb = NULL; ++ struct rx_buf *rx_buf = NULL; + struct sk_buff *skb = NULL; ++ struct urb *urb = NULL; + int i, ret; + + init_usb_anchor(&hif_dev->reg_in_submitted); + + for (i = 0; i < MAX_REG_IN_URB_NUM; i++) { + ++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL); ++ if (!rx_buf) { ++ ret = -ENOMEM; ++ goto err_rxb; ++ } ++ + /* Allocate URB */ + urb = usb_alloc_urb(0, GFP_KERNEL); + if (urb == NULL) { +@@ -916,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev) + goto err_skb; + } + ++ rx_buf->hif_dev = hif_dev; ++ rx_buf->skb = skb; ++ + usb_fill_int_urb(urb, hif_dev->udev, + usb_rcvintpipe(hif_dev->udev, + USB_REG_IN_PIPE), + skb->data, MAX_REG_IN_BUF_SIZE, +- ath9k_hif_usb_reg_in_cb, skb, 1); ++ ath9k_hif_usb_reg_in_cb, rx_buf, 1); + + /* Anchor URB */ + usb_anchor_urb(urb, &hif_dev->reg_in_submitted); +@@ -946,6 +972,8 @@ err_submit: + err_skb: + usb_free_urb(urb); + err_urb: ++ kfree(rx_buf); ++err_rxb: + ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev); + return ret; + } +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h +index a95cdf562611..835264c36595 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.h ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h +@@ -84,6 +84,11 @@ struct tx_buf { + struct list_head list; + }; + ++struct rx_buf { ++ struct sk_buff *skb; ++ struct hif_device_usb *hif_dev; ++}; ++ + #define HIF_USB_TX_STOP BIT(0) + #define HIF_USB_TX_FLUSH BIT(1) + +diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h +index e8bbb20779d0..83597e1d6dcd 100644 +--- a/drivers/pinctrl/pinctrl-amd.h ++++ b/drivers/pinctrl/pinctrl-amd.h +@@ -250,7 +250,7 @@ static const struct amd_pingroup kerncz_groups[] = { + { + .name = "uart0", + .pins = uart0_pins, +- .npins = 9, ++ .npins = 5, + }, + { + .name = "uart1", +diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c +index 319868f3f674..083cd11ce7d7 100644 +--- a/drivers/scsi/scsi_transport_spi.c ++++ b/drivers/scsi/scsi_transport_spi.c +@@ -353,7 +353,7 @@ store_spi_transport_##field(struct device *dev, \ + struct spi_transport_attrs *tp \ + = (struct spi_transport_attrs *)&starget->starget_data; \ + \ +- if (i->f->set_##field) \ ++ if (!i->f->set_##field) \ + return -EINVAL; \ + val = simple_strtoul(buf, NULL, 0); \ + if (val > tp->max_##field) \ +diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c +index ccd1a91290bf..536a135cd00b 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1032.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1032.c +@@ -115,14 +115,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, + unsigned int *data) + { + struct apci1032_private *devpriv = dev->private; +- unsigned int shift, oldmask; ++ unsigned int shift, oldmask, himask, lomask; + + switch (data[0]) { + case INSN_CONFIG_DIGITAL_TRIG: + if (data[1] != 0) + return -EINVAL; + shift = data[3]; +- oldmask = (1U << shift) - 1; ++ if (shift < 32) { ++ oldmask = (1U << shift) - 1; ++ himask = data[4] << shift; ++ lomask = data[5] << shift; ++ } else { ++ oldmask = 0xffffffffu; ++ himask = 0; ++ lomask = 0; ++ } + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + devpriv->ctrl = 0; +@@ -145,8 +153,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, + devpriv->mode2 &= oldmask; + } + /* configure specified channels */ +- devpriv->mode1 |= data[4] << shift; +- devpriv->mode2 |= data[5] << shift; ++ devpriv->mode1 |= himask; ++ devpriv->mode2 |= lomask; + break; + case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS: + if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA | +@@ -163,8 +171,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev, + devpriv->mode2 &= oldmask; + } + /* configure specified channels */ +- devpriv->mode1 |= data[4] << shift; +- devpriv->mode2 |= data[5] << shift; ++ devpriv->mode1 |= himask; ++ devpriv->mode2 |= lomask; + break; + default: + return -EINVAL; +diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c +index 79a8799b1262..c4e36fb6df9d 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1500.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c +@@ -461,13 +461,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + struct apci1500_private *devpriv = dev->private; + unsigned int trig = data[1]; + unsigned int shift = data[3]; +- unsigned int hi_mask = data[4] << shift; +- unsigned int lo_mask = data[5] << shift; +- unsigned int chan_mask = hi_mask | lo_mask; +- unsigned int old_mask = (1 << shift) - 1; ++ unsigned int hi_mask; ++ unsigned int lo_mask; ++ unsigned int chan_mask; ++ unsigned int old_mask; + unsigned int pm; + unsigned int pt; + unsigned int pp; ++ unsigned int invalid_chan; + + if (trig > 1) { + dev_dbg(dev->class_dev, +@@ -475,7 +476,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + return -EINVAL; + } + +- if (chan_mask > 0xffff) { ++ if (shift <= 16) { ++ hi_mask = data[4] << shift; ++ lo_mask = data[5] << shift; ++ old_mask = (1U << shift) - 1; ++ invalid_chan = (data[4] | data[5]) >> (16 - shift); ++ } else { ++ hi_mask = 0; ++ lo_mask = 0; ++ old_mask = 0xffff; ++ invalid_chan = data[4] | data[5]; ++ } ++ chan_mask = hi_mask | lo_mask; ++ ++ if (invalid_chan) { + dev_dbg(dev->class_dev, "invalid digital trigger channel\n"); + return -EINVAL; + } +diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c +index 9bfb79c2e5c8..1b4ba19d599e 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1564.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1564.c +@@ -340,14 +340,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, + unsigned int *data) + { + struct apci1564_private *devpriv = dev->private; +- unsigned int shift, oldmask; ++ unsigned int shift, oldmask, himask, lomask; + + switch (data[0]) { + case INSN_CONFIG_DIGITAL_TRIG: + if (data[1] != 0) + return -EINVAL; + shift = data[3]; +- oldmask = (1U << shift) - 1; ++ if (shift < 32) { ++ oldmask = (1U << shift) - 1; ++ himask = data[4] << shift; ++ lomask = data[5] << shift; ++ } else { ++ oldmask = 0xffffffffu; ++ himask = 0; ++ lomask = 0; ++ } + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + devpriv->ctrl = 0; +@@ -371,8 +379,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, + devpriv->mode2 &= oldmask; + } + /* configure specified channels */ +- devpriv->mode1 |= data[4] << shift; +- devpriv->mode2 |= data[5] << shift; ++ devpriv->mode1 |= himask; ++ devpriv->mode2 |= lomask; + break; + case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS: + if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA | +@@ -389,8 +397,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev, + devpriv->mode2 &= oldmask; + } + /* configure specified channels */ +- devpriv->mode1 |= data[4] << shift; +- devpriv->mode2 |= data[5] << shift; ++ devpriv->mode1 |= himask; ++ devpriv->mode2 |= lomask; + break; + default: + return -EINVAL; +diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c +index 84c62e256094..6e411b634015 100644 +--- a/drivers/staging/comedi/drivers/ni_6527.c ++++ b/drivers/staging/comedi/drivers/ni_6527.c +@@ -341,7 +341,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev, + case COMEDI_DIGITAL_TRIG_ENABLE_EDGES: + /* check shift amount */ + shift = data[3]; +- if (shift >= s->n_chan) { ++ if (shift >= 32) { + mask = 0; + rising = 0; + falling = 0; +diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c +index f7149bb23180..5297e7d1c663 100644 +--- a/drivers/staging/wlan-ng/prism2usb.c ++++ b/drivers/staging/wlan-ng/prism2usb.c +@@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface, + const struct usb_device_id *id) + { + struct usb_device *dev; +- ++ const struct usb_endpoint_descriptor *epd; ++ const struct usb_host_interface *iface_desc = interface->cur_altsetting; + struct wlandevice *wlandev = NULL; + struct hfa384x *hw = NULL; + int result = 0; + ++ if (iface_desc->desc.bNumEndpoints != 2) { ++ result = -ENODEV; ++ goto failed; ++ } ++ ++ result = -EINVAL; ++ epd = &iface_desc->endpoint[1].desc; ++ if (!usb_endpoint_is_bulk_in(epd)) ++ goto failed; ++ epd = &iface_desc->endpoint[2].desc; ++ if (!usb_endpoint_is_bulk_out(epd)) ++ goto failed; ++ + dev = interface_to_usbdev(interface); + wlandev = create_wlan(); + if (!wlandev) { +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index c4e9eba36023..6624cc07ac04 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -529,6 +529,7 @@ static void __init serial8250_isa_init_ports(void) + */ + up->mcr_mask = ~ALPHA_KLUDGE_MCR; + up->mcr_force = ALPHA_KLUDGE_MCR; ++ serial8250_set_defaults(up); + } + + /* chain base port ops to support Remote Supervisor Adapter */ +@@ -552,7 +553,6 @@ static void __init serial8250_isa_init_ports(void) + port->membase = old_serial_port[i].iomem_base; + port->iotype = old_serial_port[i].io_type; + port->regshift = old_serial_port[i].iomem_reg_shift; +- serial8250_set_defaults(up); + + port->irqflags |= irqflag; + if (serial8250_isa_config != NULL) +diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c +index 91db9ca1c6c9..c54f57e4a7dd 100644 +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -45,8 +45,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, + unsigned long flags; + unsigned int baud, quot; + ++ /* ++ * Store the requested baud rate before calling the generic 8250 ++ * set_termios method. Standard 8250 port expects bauds to be ++ * no higher than (uartclk / 16) so the baud will be clamped if it ++ * gets out of that bound. Mediatek 8250 port supports speed ++ * higher than that, therefore we'll get original baud rate back ++ * after calling the generic set_termios method and recalculate ++ * the speed later in this method. ++ */ ++ baud = tty_termios_baud_rate(termios); ++ + serial8250_do_set_termios(port, termios, old); + ++ tty_termios_encode_baud_rate(termios, baud, baud); ++ + /* + * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS) + * +@@ -85,6 +98,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, + */ + spin_lock_irqsave(&port->lock, flags); + ++ /* ++ * Update the per-port timeout. ++ */ ++ uart_update_timeout(port, termios->c_cflag, baud); ++ + /* set DLAB we have cval saved in up->lcr from the call to the core */ + serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB); + serial_dl_write(up, quot); +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 29fb08c8a2fd..3e5a3614fad0 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -765,10 +765,19 @@ static const struct tty_port_operations vc_port_ops = { + .destruct = vc_port_destruct, + }; + ++/* ++ * Change # of rows and columns (0 means unchanged/the size of fg_console) ++ * [this is to be used together with some user program ++ * like resize that changes the hardware videomode] ++ */ ++#define VC_MAXCOL (32767) ++#define VC_MAXROW (32767) ++ + int vc_allocate(unsigned int currcons) /* return 0 on success */ + { + struct vt_notifier_param param; + struct vc_data *vc; ++ int err; + + WARN_CONSOLE_UNLOCKED(); + +@@ -798,6 +807,11 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ + if (!*vc->vc_uni_pagedir_loc) + con_set_default_unimap(vc); + ++ err = -EINVAL; ++ if (vc->vc_cols > VC_MAXCOL || vc->vc_rows > VC_MAXROW || ++ vc->vc_screenbuf_size > KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size) ++ goto err_free; ++ err = -ENOMEM; + vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL); + if (!vc->vc_screenbuf) + goto err_free; +@@ -815,7 +829,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ + err_free: + kfree(vc); + vc_cons[currcons].d = NULL; +- return -ENOMEM; ++ return err; + } + + static inline int resize_screen(struct vc_data *vc, int width, int height, +@@ -830,14 +844,6 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, + return err; + } + +-/* +- * Change # of rows and columns (0 means unchanged/the size of fg_console) +- * [this is to be used together with some user program +- * like resize that changes the hardware videomode] +- */ +-#define VC_RESIZE_MAXCOL (32767) +-#define VC_RESIZE_MAXROW (32767) +- + /** + * vc_do_resize - resizing method for the tty + * @tty: tty being resized +@@ -872,7 +878,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + user = vc->vc_resize_user; + vc->vc_resize_user = 0; + +- if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) ++ if (cols > VC_MAXCOL || lines > VC_MAXROW) + return -EINVAL; + + new_cols = (cols ? cols : vc->vc_cols); +@@ -883,7 +889,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) + return 0; + +- if (new_screen_size > (4 << 20)) ++ if (new_screen_size > (4 << 20) || !new_screen_size) + return -EINVAL; + newscreen = kzalloc(new_screen_size, GFP_USER); + if (!newscreen) +@@ -3033,6 +3039,7 @@ static int __init con_init(void) + INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); + tty_port_init(&vc->port); + visual_init(vc, currcons, 1); ++ /* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */ + vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT); + vc_init(vc, vc->vc_rows, vc->vc_cols, + currcons || !vc->vc_sw->con_save_screen); +diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c +index 9e246d2e55ca..f2b165182b4b 100644 +--- a/drivers/usb/gadget/udc/gr_udc.c ++++ b/drivers/usb/gadget/udc/gr_udc.c +@@ -2000,9 +2000,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) + + if (num == 0) { + _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); ++ if (!_req) ++ return -ENOMEM; ++ + buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); +- if (!_req || !buf) { +- /* possible _req freed by gr_probe via gr_remove */ ++ if (!buf) { ++ gr_free_request(&ep->ep, _req); + return -ENOMEM; + } + +diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c +index 144674913c78..3929ac8c6a73 100644 +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -284,6 +284,10 @@ static bool need_bw_sch(struct usb_host_endpoint *ep, + if (is_fs_or_ls(speed) && !has_tt) + return false; + ++ /* skip endpoint with zero maxpkt */ ++ if (usb_endpoint_maxp(&ep->desc) == 0) ++ return false; ++ + return true; + } + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 4355fbc36fce..bb63cc5cbca0 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -213,6 +213,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == 0x1142) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && ++ pdev->device == 0x2142) ++ xhci->quirks |= XHCI_NO_64BIT_SUPPORT; + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 2973d256bb44..bb008ac507fe 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1550,6 +1550,7 @@ static int __btrfs_find_all_roots(struct btrfs_trans_handle *trans, + if (ret < 0 && ret != -ENOENT) { + ulist_free(tmp); + ulist_free(*roots); ++ *roots = NULL; + return ret; + } + node = ulist_next(tmp, &uiter); +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 70aa22a8a9cc..bace03a546b2 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -6854,6 +6854,14 @@ int btrfs_read_chunk_tree(struct btrfs_root *root) + mutex_lock(&uuid_mutex); + lock_chunks(root); + ++ /* ++ * It is possible for mount and umount to race in such a way that ++ * we execute this code path, but open_fs_devices failed to clear ++ * total_rw_bytes. We certainly want it cleared before reading the ++ * device items, so clear it here. ++ */ ++ root->fs_info->fs_devices->total_rw_bytes = 0; ++ + /* + * Read all device items, and then all the chunk items. All + * device items are found before any chunk item (their object id +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index acd8e0dccab4..5478902a0100 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1770,7 +1770,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, + FILE_UNIX_BASIC_INFO *info_buf_target; + unsigned int xid; + int rc, tmprc; +- bool new_target = d_really_is_negative(target_dentry); + + if (flags & ~RENAME_NOREPLACE) + return -EINVAL; +@@ -1847,13 +1846,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, + */ + + unlink_target: +- /* +- * If the target dentry was created during the rename, try +- * unlinking it if it's not negative +- */ +- if (new_target && +- d_really_is_positive(target_dentry) && +- (rc == -EACCES || rc == -EEXIST)) { ++ /* Try unlinking the target dentry if it's not negative */ ++ if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) { + if (d_is_dir(target_dentry)) + tmprc = cifs_rmdir(target_dir, target_dentry); + else +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 1affdec23729..de135d2591ff 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -379,6 +379,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq) + { + struct inode *inode = dreq->inode; + ++ inode_dio_end(inode); ++ + if (dreq->iocb) { + long res = (long) dreq->error; + if (dreq->count != 0) { +@@ -390,10 +392,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq) + + complete(&dreq->completion); + +- igrab(inode); + nfs_direct_req_release(dreq); +- inode_dio_end(inode); +- iput(inode); + } + + static void nfs_direct_readpage_release(struct nfs_page *req) +@@ -535,10 +534,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * generic layer handle the completion. + */ + if (requested_bytes == 0) { +- igrab(inode); +- nfs_direct_req_release(dreq); + inode_dio_end(inode); +- iput(inode); ++ nfs_direct_req_release(dreq); + return result < 0 ? result : -EIO; + } + +@@ -956,10 +953,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * generic layer handle the completion. + */ + if (requested_bytes == 0) { +- igrab(inode); +- nfs_direct_req_release(dreq); + inode_dio_end(inode); +- iput(inode); ++ nfs_direct_req_release(dreq); + return result < 0 ? result : -EIO; + } + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index a89d2f793c1b..1eec947c562d 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp) + dprintk("NFS: release(%pD2)\n", filp); + + nfs_inc_stats(inode, NFSIOS_VFSRELEASE); +- inode_dio_wait(inode); + nfs_file_clear_open_context(filp); + return 0; + } +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 9ca8809ee3d0..e390a7882933 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -781,6 +781,8 @@ try_another_ag: + *logflagsp = 0; + if ((error = xfs_alloc_vextent(&args))) { + xfs_iroot_realloc(ip, -1, whichfork); ++ ASSERT(ifp->if_broot == NULL); ++ XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS); + xfs_btree_del_cursor(cur, XFS_BTREE_ERROR); + return error; + } +@@ -801,6 +803,8 @@ try_another_ag: + } + if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) { + xfs_iroot_realloc(ip, -1, whichfork); ++ ASSERT(ifp->if_broot == NULL); ++ XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS); + xfs_btree_del_cursor(cur, XFS_BTREE_ERROR); + return -ENOSPC; + } +diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h +index 58df02bd93c9..fa46183b163b 100644 +--- a/include/linux/io-mapping.h ++++ b/include/linux/io-mapping.h +@@ -120,9 +120,12 @@ io_mapping_init_wc(struct io_mapping *iomap, + resource_size_t base, + unsigned long size) + { ++ iomap->iomem = ioremap_wc(base, size); ++ if (!iomap->iomem) ++ return NULL; ++ + iomap->base = base; + iomap->size = size; +- iomap->iomem = ioremap_wc(base, size); + #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */ + iomap->prot = pgprot_noncached_wc(PAGE_KERNEL); + #elif defined(pgprot_writecombine) +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index 7f517458c64f..53eb9fecd263 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -218,6 +218,8 @@ struct tcp_sock { + u8 reord; /* reordering detected */ + } rack; + u16 advmss; /* Advertised MSS */ ++ u8 tlp_retrans:1, /* TLP is a retransmission */ ++ unused_1:7; + u8 rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ + is_sack_reneg:1, /* in recovery from loss with SACK reneg? */ + unused:6; +@@ -234,7 +236,7 @@ struct tcp_sock { + syn_data_acked:1,/* data in SYN is acked by SYN-ACK */ + save_syn:1, /* Save headers of SYN packet */ + is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */ +- u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */ ++ u32 tlp_high_seq; /* snd_nxt at the time of TLP */ + + /* RTT measurement */ + u32 srtt_us; /* smoothed round trip time << 3 in usecs */ +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index 1fcaa174ed32..3f1d008a7c28 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -1885,7 +1885,7 @@ static void handle_swbp(struct pt_regs *regs) + if (!uprobe) { + if (is_swbp > 0) { + /* No matching uprobe; signal SIGTRAP. */ +- send_sig(SIGTRAP, current, 0); ++ force_sig(SIGTRAP, current); + } else { + /* + * Either we raced with uprobe_unregister() or we can't +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 2f7f934bf435..d4232744c59f 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -4794,7 +4794,6 @@ static void __mem_cgroup_clear_mc(void) + if (!mem_cgroup_is_root(mc.to)) + page_counter_uncharge(&mc.to->memory, mc.moved_swap); + +- mem_cgroup_id_get_many(mc.to, mc.moved_swap); + css_put_many(&mc.to->css, mc.moved_swap); + + mc.moved_swap = 0; +@@ -4972,7 +4971,8 @@ put: /* get_mctgt_type() gets the page */ + ent = target.ent; + if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) { + mc.precharge--; +- /* we fixup refcnts and charges later. */ ++ mem_cgroup_id_get_many(mc.to, 1); ++ /* we fixup other refcnts and charges later. */ + mc.moved_swap++; + } + break; +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 02be8ee23271..64fede18aa33 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -1191,7 +1191,10 @@ static int __must_check ax25_connect(struct socket *sock, + if (addr_len > sizeof(struct sockaddr_ax25) && + fsa->fsa_ax25.sax25_ndigis != 0) { + /* Valid number of digipeaters ? */ +- if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) { ++ if (fsa->fsa_ax25.sax25_ndigis < 1 || ++ fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS || ++ addr_len < sizeof(struct sockaddr_ax25) + ++ sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { + err = -EINVAL; + goto out_release; + } +@@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; + + /* Valid number of digipeaters ? */ +- if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) { ++ if (usax->sax25_ndigis < 1 || ++ usax->sax25_ndigis > AX25_MAX_DIGIS || ++ addr_len < sizeof(struct sockaddr_ax25) + ++ sizeof(ax25_address) * usax->sax25_ndigis) { + err = -EINVAL; + goto out; + } +diff --git a/net/core/dev.c b/net/core/dev.c +index 267b648a0645..dd8d36feb69f 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4392,7 +4392,7 @@ static void flush_backlog(struct work_struct *work) + skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) { + if (skb->dev->reg_state == NETREG_UNREGISTERING) { + __skb_unlink(skb, &sd->input_pkt_queue); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + input_queue_head_incr(sd); + } + } +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 3333693d8052..3fb5d8ecc849 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1018,7 +1018,7 @@ static ssize_t show_trans_timeout(struct netdev_queue *queue, + trans_timeout = queue->trans_timeout; + spin_unlock_irq(&queue->_xmit_lock); + +- return sprintf(buf, "%lu", trans_timeout); ++ return sprintf(buf, fmt_ulong, trans_timeout); + } + + #ifdef CONFIG_XPS +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index b3953f789891..23246d8a3eae 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3566,10 +3566,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq) + } + } + +-/* This routine deals with acks during a TLP episode. +- * We mark the end of a TLP episode on receiving TLP dupack or when +- * ack is after tlp_high_seq. +- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe. ++/* This routine deals with acks during a TLP episode and ends an episode by ++ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack + */ + static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) + { +@@ -3578,7 +3576,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) + if (before(ack, tp->tlp_high_seq)) + return; + +- if (flag & FLAG_DSACKING_ACK) { ++ if (!tp->tlp_retrans) { ++ /* TLP of new data has been acknowledged */ ++ tp->tlp_high_seq = 0; ++ } else if (flag & FLAG_DSACKING_ACK) { + /* This DSACK means original and TLP probe arrived; no loss */ + tp->tlp_high_seq = 0; + } else if (after(ack, tp->tlp_high_seq)) { +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 84d74c431f83..b730b994b1c7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2357,6 +2357,11 @@ void tcp_send_loss_probe(struct sock *sk) + int pcount; + int mss = tcp_current_mss(sk); + ++ /* At most one outstanding TLP */ ++ if (tp->tlp_high_seq) ++ goto rearm_timer; ++ ++ tp->tlp_retrans = 0; + skb = tcp_send_head(sk); + if (skb) { + if (tcp_snd_wnd_test(tp, skb, mss)) { +@@ -2379,10 +2384,6 @@ void tcp_send_loss_probe(struct sock *sk) + return; + } + +- /* At most one outstanding TLP retransmission. */ +- if (tp->tlp_high_seq) +- goto rearm_timer; +- + if (skb_still_in_host_queue(sk, skb)) + goto rearm_timer; + +@@ -2403,10 +2404,12 @@ void tcp_send_loss_probe(struct sock *sk) + if (__tcp_retransmit_skb(sk, skb, 1)) + goto rearm_timer; + ++ tp->tlp_retrans = 1; ++ ++probe_sent: + /* Record snd_nxt for loss detection. */ + tp->tlp_high_seq = tp->snd_nxt; + +-probe_sent: + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES); + /* Reset s.t. tcp_rearm_rto will restart timer from now */ + inet_csk(sk)->icsk_pending = 0; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 1bb1e27d3d13..18a1a4890c5f 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1554,7 +1554,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) + /* + * UDP-Lite specific tests, ignored on UDP sockets + */ +- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { ++ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { + + /* + * MIB statistics other than incrementing the error count are +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index ca001ecb7197..e0a2a3d6772d 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1130,15 +1130,16 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head) + static int __net_init ip6gre_init_net(struct net *net) + { + struct ip6gre_net *ign = net_generic(net, ip6gre_net_id); ++ struct net_device *ndev; + int err; + +- ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", +- NET_NAME_UNKNOWN, +- ip6gre_tunnel_setup); +- if (!ign->fb_tunnel_dev) { ++ ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", ++ NET_NAME_UNKNOWN, ip6gre_tunnel_setup); ++ if (!ndev) { + err = -ENOMEM; + goto err_alloc_dev; + } ++ ign->fb_tunnel_dev = ndev; + dev_net_set(ign->fb_tunnel_dev, net); + /* FB netdevice is special: we have one, and only one per netns. + * Allowing to move it to another netns is clearly unsafe. +@@ -1158,7 +1159,7 @@ static int __net_init ip6gre_init_net(struct net *net) + return 0; + + err_reg_dev: +- ip6gre_dev_free(ign->fb_tunnel_dev); ++ ip6gre_dev_free(ndev); + err_alloc_dev: + return err; + } +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 6a397e110b46..1ad84e18c03b 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -601,7 +601,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) + /* + * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c). + */ +- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { ++ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { + + if (up->pcrlen == 0) { /* full coverage was set */ + net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n", +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index d3334fd84ca2..9be82ed02e0e 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2098,6 +2098,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) + + static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) + { ++ struct ieee80211_hdr *hdr = (void *)rx->skb->data; + struct sk_buff *skb = rx->skb; + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + +@@ -2108,6 +2109,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) + if (status->flag & RX_FLAG_DECRYPTED) + return 0; + ++ /* check mesh EAPOL frames first */ ++ if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) && ++ ieee80211_is_data(fc))) { ++ struct ieee80211s_hdr *mesh_hdr; ++ u16 hdr_len = ieee80211_hdrlen(fc); ++ u16 ethertype_offset; ++ __be16 ethertype; ++ ++ if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr)) ++ goto drop_check; ++ ++ /* make sure fixed part of mesh header is there, also checks skb len */ ++ if (!pskb_may_pull(rx->skb, hdr_len + 6)) ++ goto drop_check; ++ ++ mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len); ++ ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) + ++ sizeof(rfc1042_header); ++ ++ if (skb_copy_bits(rx->skb, ethertype_offset, ðertype, 2) == 0 && ++ ethertype == rx->sdata->control_port_protocol) ++ return 0; ++ } ++ ++drop_check: + /* Drop unencrypted frames if key is set. */ + if (unlikely(!ieee80211_has_protected(fc) && + !ieee80211_is_any_nullfunc(fc) && +diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c +index 72de69175476..702ebcfa18dc 100644 +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -439,7 +439,7 @@ try_again: + list_empty(&rx->recvmsg_q) && + rx->sk.sk_state != RXRPC_SERVER_LISTENING) { + release_sock(&rx->sk); +- return -ENODATA; ++ return -EAGAIN; + } + + if (list_empty(&rx->recvmsg_q)) { +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 1de27c39564b..2ec1c29eeba4 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -191,7 +191,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, + /* this should be in poll */ + sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); + +- if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) ++ if (sk->sk_shutdown & SEND_SHUTDOWN) + return -EPIPE; + + more = msg->msg_flags & MSG_MORE; +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 98cf6343afcd..61564e56e3aa 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -76,8 +76,8 @@ parse_symbol() { + return + fi + +- # Strip out the base of the path +- code=${code#$basepath/} ++ # Strip out the base of the path on each line ++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") + + # In the case of inlines, move everything to same line + code=${code//$'\n'/' '} +diff --git a/sound/core/info.c b/sound/core/info.c +index 358a6947342d..8a6fa8fd0aab 100644 +--- a/sound/core/info.c ++++ b/sound/core/info.c +@@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len) + { + int c = -1; + +- if (snd_BUG_ON(!buffer || !buffer->buffer)) ++ if (snd_BUG_ON(!buffer)) ++ return 1; ++ if (!buffer->buffer) + return 1; + if (len <= 0 || buffer->stop || buffer->error) + return 1; +diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h +index 3f1b0f1df809..e4e31e82311d 100644 +--- a/sound/soc/codecs/rt5670.h ++++ b/sound/soc/codecs/rt5670.h +@@ -760,7 +760,7 @@ + #define RT5670_PWR_VREF2_BIT 4 + #define RT5670_PWR_FV2 (0x1 << 3) + #define RT5670_PWR_FV2_BIT 3 +-#define RT5670_LDO_SEL_MASK (0x3) ++#define RT5670_LDO_SEL_MASK (0x7) + #define RT5670_LDO_SEL_SFT 0 + + /* Power Management for Analog 2 (0x64) */ +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 7228d141a789..676568286eef 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1516,7 +1516,7 @@ static int is_directory(const char *base_path, const struct dirent *dent) + char path[PATH_MAX]; + struct stat st; + +- sprintf(path, "%s/%s", base_path, dent->d_name); ++ scnprintf(path, PATH_MAX, "%s/%s", base_path, dent->d_name); + if (stat(path, &st)) + return 0; + +@@ -1702,8 +1702,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused, + } + + for_each_lang(scripts_path, scripts_dir, lang_dirent) { +- snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, +- lang_dirent->d_name); ++ scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, ++ lang_dirent->d_name); + lang_dir = opendir(lang_path); + if (!lang_dir) + continue; +@@ -1712,8 +1712,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused, + script_root = get_script_root(script_dirent, REPORT_SUFFIX); + if (script_root) { + desc = script_desc__findnew(script_root); +- snprintf(script_path, MAXPATHLEN, "%s/%s", +- lang_path, script_dirent->d_name); ++ scnprintf(script_path, MAXPATHLEN, "%s/%s", ++ lang_path, script_dirent->d_name); + read_script_info(desc, script_path); + free(script_root); + } +@@ -1749,7 +1749,7 @@ static int check_ev_match(char *dir_name, char *scriptname, + int match, len; + FILE *fp; + +- sprintf(filename, "%s/bin/%s-record", dir_name, scriptname); ++ scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, scriptname); + + fp = fopen(filename, "r"); + if (!fp) +@@ -1825,8 +1825,8 @@ int find_scripts(char **scripts_array, char **scripts_path_array) + } + + for_each_lang(scripts_path, scripts_dir, lang_dirent) { +- snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path, +- lang_dirent->d_name); ++ scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path, ++ lang_dirent->d_name); + #ifdef NO_LIBPERL + if (strstr(lang_path, "perl")) + continue; +@@ -1881,8 +1881,8 @@ static char *get_script_path(const char *script_root, const char *suffix) + return NULL; + + for_each_lang(scripts_path, scripts_dir, lang_dirent) { +- snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, +- lang_dirent->d_name); ++ scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, ++ lang_dirent->d_name); + lang_dir = opendir(lang_path); + if (!lang_dir) + continue; +@@ -1893,8 +1893,8 @@ static char *get_script_path(const char *script_root, const char *suffix) + free(__script_root); + closedir(lang_dir); + closedir(scripts_dir); +- snprintf(script_path, MAXPATHLEN, "%s/%s", +- lang_path, script_dirent->d_name); ++ scnprintf(script_path, MAXPATHLEN, "%s/%s", ++ lang_path, script_dirent->d_name); + return strdup(script_path); + } + free(__script_root); +diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c +index b60a6fd66517..a607d2a851ef 100644 +--- a/tools/perf/tests/attr.c ++++ b/tools/perf/tests/attr.c +@@ -147,8 +147,8 @@ static int run_dir(const char *d, const char *perf) + if (verbose) + vcnt++; + +- snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", +- d, d, perf, vcnt, v); ++ scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", ++ d, d, perf, vcnt, v); + + return system(cmd) ? TEST_FAIL : TEST_OK; + } +diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c +index 1e2ba2602930..1802ad3f45b6 100644 +--- a/tools/perf/tests/pmu.c ++++ b/tools/perf/tests/pmu.c +@@ -95,7 +95,7 @@ static char *test_format_dir_get(void) + struct test_format *format = &test_formats[i]; + FILE *file; + +- snprintf(name, PATH_MAX, "%s/%s", dir, format->name); ++ scnprintf(name, PATH_MAX, "%s/%s", dir, format->name); + + file = fopen(name, "w"); + if (!file) +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index 3336cbc6ec48..1d4807c46efd 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1302,7 +1302,7 @@ fallback: + int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize) + { + struct dso *dso = map->dso; +- char command[PATH_MAX * 2]; ++ char *command; + FILE *file; + char symfs_filename[PATH_MAX]; + struct kcore_extract kce; +@@ -1364,7 +1364,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize) + strcpy(symfs_filename, tmp); + } + +- snprintf(command, sizeof(command), ++ err = asprintf(&command, + "%s %s%s --start-address=0x%016" PRIx64 + " --stop-address=0x%016" PRIx64 + " -l -d %s %s -C %s 2>/dev/null|grep -v %s|expand", +@@ -1377,12 +1377,17 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize) + symbol_conf.annotate_src ? "-S" : "", + symfs_filename, symfs_filename); + ++ if (err < 0) { ++ pr_err("Failure allocating memory for the command to run\n"); ++ goto out_remove_tmp; ++ } ++ + pr_debug("Executing: %s\n", command); + + err = -1; + if (pipe(stdout_fd) < 0) { + pr_err("Failure creating the pipe to run %s\n", command); +- goto out_remove_tmp; ++ goto out_free_command; + } + + pid = fork(); +@@ -1409,7 +1414,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize) + * If we were using debug info should retry with + * original binary. + */ +- goto out_remove_tmp; ++ goto out_free_command; + } + + nline = 0; +@@ -1432,6 +1437,8 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize) + + fclose(file); + err = 0; ++out_free_command: ++ free(command); + out_remove_tmp: + close(stdout_fd[0]); + +@@ -1445,7 +1452,7 @@ out: + + out_close_stdout: + close(stdout_fd[1]); +- goto out_remove_tmp; ++ goto out_free_command; + } + + static void insert_source_line(struct rb_root *root, struct source_line *src_line) +diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c +index 8fdee24725a7..5bc2b92ace6d 100644 +--- a/tools/perf/util/cgroup.c ++++ b/tools/perf/util/cgroup.c +@@ -64,7 +64,7 @@ static int open_cgroup(char *name) + if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1)) + return -1; + +- snprintf(path, PATH_MAX, "%s/%s", mnt, name); ++ scnprintf(path, PATH_MAX, "%s/%s", mnt, name); + + fd = open(path, O_RDONLY); + if (fd == -1) +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 6193be6d7639..f9f7e35f47a7 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -195,8 +195,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config) + + for_each_event(sys_dirent, evt_dir, evt_dirent) { + +- snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path, +- evt_dirent->d_name); ++ scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path, ++ evt_dirent->d_name); + fd = open(evt_path, O_RDONLY); + if (fd < 0) + continue; +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index c86c1d5ea65c..39abbf827646 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -325,7 +325,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) + if (pmu_alias_info_file(name)) + continue; + +- snprintf(path, PATH_MAX, "%s/%s", dir, name); ++ scnprintf(path, PATH_MAX, "%s/%s", dir, name); + + file = fopen(path, "r"); + if (!file) { +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index a7452fd3b6ee..0551a02ee17c 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -118,7 +118,7 @@ static struct symbol *__find_kernel_function(u64 addr, struct map **mapp) + return machine__find_kernel_function(host_machine, addr, mapp); + } + +-static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) ++static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap) + { + /* kmap->ref_reloc_sym should be set if host_machine is initialized */ + struct kmap *kmap; +@@ -130,6 +130,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void) + kmap = map__kmap(map); + if (!kmap) + return NULL; ++ ++ if (pmap) ++ *pmap = map; ++ + return kmap->ref_reloc_sym; + } + +@@ -141,7 +145,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr, + struct map *map; + + /* ref_reloc_sym is just a label. Need a special fix*/ +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(NULL); + if (reloc_sym && strcmp(name, reloc_sym->name) == 0) + *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr; + else { +@@ -742,6 +746,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + int ntevs) + { + struct ref_reloc_sym *reloc_sym; ++ struct map *map; + char *tmp; + int i, skipped = 0; + +@@ -750,7 +755,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + return post_process_offline_probe_trace_events(tevs, ntevs, + symbol_conf.vmlinux_name); + +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(&map); + if (!reloc_sym) { + pr_warning("Relocated base symbol is not found!\n"); + return -EINVAL; +@@ -759,9 +764,13 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs, + for (i = 0; i < ntevs; i++) { + if (!tevs[i].point.address || tevs[i].point.retprobe) + continue; +- /* If we found a wrong one, mark it by NULL symbol */ ++ /* ++ * If we found a wrong one, mark it by NULL symbol. ++ * Since addresses in debuginfo is same as objdump, we need ++ * to convert it to addresses on memory. ++ */ + if (kprobe_warn_out_range(tevs[i].point.symbol, +- tevs[i].point.address)) { ++ map__objdump_2mem(map, tevs[i].point.address))) { + tmp = NULL; + skipped++; + } else { +@@ -2850,7 +2859,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, + + /* Note that the symbols in the kmodule are not relocated */ + if (!pev->uprobes && !pp->retprobe && !pev->target) { +- reloc_sym = kernel_get_ref_reloc_sym(); ++ reloc_sym = kernel_get_ref_reloc_sym(NULL); + if (!reloc_sym) { + pr_warning("Relocated base symbol is not found!\n"); + ret = -EINVAL; +diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c +index b4db3f48e3b0..2853d4728ab9 100644 +--- a/tools/perf/util/srcline.c ++++ b/tools/perf/util/srcline.c +@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data) + bfd_vma pc, vma; + bfd_size_type size; + struct a2l_data *a2l = data; ++ flagword flags; + + if (a2l->found) + return; + +- if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0) ++#ifdef bfd_get_section_flags ++ flags = bfd_get_section_flags(abfd, section); ++#else ++ flags = bfd_section_flags(section); ++#endif ++ if ((flags & SEC_ALLOC) == 0) + return; + + pc = a2l->addr; ++#ifdef bfd_get_section_vma + vma = bfd_get_section_vma(abfd, section); ++#else ++ vma = bfd_section_vma(section); ++#endif ++#ifdef bfd_get_section_size + size = bfd_get_section_size(section); ++#else ++ size = bfd_section_size(section); ++#endif + + if (pc < vma || pc >= vma + size) + return;