From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 67A8115808B for ; Wed, 13 Apr 2022 19:49:03 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 652AFE0920; Wed, 13 Apr 2022 19:49:02 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9F5BBE0920 for ; Wed, 13 Apr 2022 19:49:01 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 1CC6B341E48 for ; Wed, 13 Apr 2022 19:49:00 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id AD437395 for ; Wed, 13 Apr 2022 19:48:58 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1649879319.ae54ff91489cdbd4a65c38d7c453b4dfa1523c20.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:5.10 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1110_linux-5.10.111.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: ae54ff91489cdbd4a65c38d7c453b4dfa1523c20 X-VCS-Branch: 5.10 Date: Wed, 13 Apr 2022 19:48:58 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: c01d8610-7c71-4506-9a61-b942f7e3ccd7 X-Archives-Hash: 095403dcf8a5d4fb34693101855f97d7 commit: ae54ff91489cdbd4a65c38d7c453b4dfa1523c20 Author: Mike Pagano gentoo org> AuthorDate: Wed Apr 13 19:48:39 2022 +0000 Commit: Mike Pagano gentoo org> CommitDate: Wed Apr 13 19:48:39 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ae54ff91 Linux patch 5.10.111 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1110_linux-5.10.111.patch | 5693 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 5697 insertions(+) diff --git a/0000_README b/0000_README index 958564ab..9076962f 100644 --- a/0000_README +++ b/0000_README @@ -483,6 +483,10 @@ Patch: 1109_linux-5.10.110.patch From: http://www.kernel.org Desc: Linux 5.10.110 +Patch: 1110_linux-5.10.111.patch +From: http://www.kernel.org +Desc: Linux 5.10.111 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1110_linux-5.10.111.patch b/1110_linux-5.10.111.patch new file mode 100644 index 00000000..c67cdbaa --- /dev/null +++ b/1110_linux-5.10.111.patch @@ -0,0 +1,5693 @@ +diff --git a/Makefile b/Makefile +index c4674e8bb3e81..8695a13fe7cd6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 110 ++SUBLEVEL = 111 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index bfbf0c4c7c5e5..39f5c1672f480 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -75,6 +75,7 @@ + #define ARM_CPU_PART_CORTEX_A77 0xD0D + #define ARM_CPU_PART_NEOVERSE_V1 0xD40 + #define ARM_CPU_PART_CORTEX_A78 0xD41 ++#define ARM_CPU_PART_CORTEX_A78AE 0xD42 + #define ARM_CPU_PART_CORTEX_X1 0xD44 + #define ARM_CPU_PART_CORTEX_A510 0xD46 + #define ARM_CPU_PART_CORTEX_A710 0xD47 +@@ -123,6 +124,7 @@ + #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) + #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) + #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) ++#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) + #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) + #define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) + #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) +diff --git a/arch/arm64/include/asm/module.lds.h b/arch/arm64/include/asm/module.lds.h +index 810045628c66e..0522337d600a7 100644 +--- a/arch/arm64/include/asm/module.lds.h ++++ b/arch/arm64/include/asm/module.lds.h +@@ -1,7 +1,7 @@ + #ifdef CONFIG_ARM64_MODULE_PLTS + SECTIONS { +- .plt 0 (NOLOAD) : { BYTE(0) } +- .init.plt 0 (NOLOAD) : { BYTE(0) } +- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) } ++ .plt 0 : { BYTE(0) } ++ .init.plt 0 : { BYTE(0) } ++ .text.ftrace_trampoline 0 : { BYTE(0) } + } + #endif +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index 6c0de2f60ea96..7d4fdf9745428 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -216,8 +216,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg) + int i, ret = 0; + struct aarch64_insn_patch *pp = arg; + +- /* The first CPU becomes master */ +- if (atomic_inc_return(&pp->cpu_count) == 1) { ++ /* The last CPU becomes master */ ++ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { + for (i = 0; ret == 0 && i < pp->insn_cnt; i++) + ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], + pp->new_insns[i]); +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 3dd489b62b29f..6ae53d8cd576f 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -861,6 +861,7 @@ u8 spectre_bhb_loop_affected(int scope) + if (scope == SCOPE_LOCAL_CPU) { + static const struct midr_range spectre_bhb_k32_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), +diff --git a/arch/mips/boot/dts/ingenic/jz4780.dtsi b/arch/mips/boot/dts/ingenic/jz4780.dtsi +index dfb5a7e1bb21d..830e5dd3550e2 100644 +--- a/arch/mips/boot/dts/ingenic/jz4780.dtsi ++++ b/arch/mips/boot/dts/ingenic/jz4780.dtsi +@@ -429,7 +429,7 @@ + #address-cells = <1>; + #size-cells = <1>; + +- eth0_addr: eth-mac-addr@0x22 { ++ eth0_addr: eth-mac-addr@22 { + reg = <0x22 0x6>; + }; + }; +diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h +index bb36a400203df..8c56b862fd9c2 100644 +--- a/arch/mips/include/asm/setup.h ++++ b/arch/mips/include/asm/setup.h +@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, + unsigned int reg_shift, unsigned int timeout) {} + #endif + +-extern void set_handler(unsigned long offset, void *addr, unsigned long len); ++void set_handler(unsigned long offset, const void *addr, unsigned long len); + extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); + + typedef void (*vi_handler_t)(void); +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index e0352958e2f72..b1fe4518bd221 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2097,19 +2097,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) + * If no shadow set is selected then use the default handler + * that does normal register saving and standard interrupt exit + */ +- extern char except_vec_vi, except_vec_vi_lui; +- extern char except_vec_vi_ori, except_vec_vi_end; +- extern char rollback_except_vec_vi; +- char *vec_start = using_rollback_handler() ? +- &rollback_except_vec_vi : &except_vec_vi; ++ extern const u8 except_vec_vi[], except_vec_vi_lui[]; ++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; ++ extern const u8 rollback_except_vec_vi[]; ++ const u8 *vec_start = using_rollback_handler() ? ++ rollback_except_vec_vi : except_vec_vi; + #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) +- const int lui_offset = &except_vec_vi_lui - vec_start + 2; +- const int ori_offset = &except_vec_vi_ori - vec_start + 2; ++ const int lui_offset = except_vec_vi_lui - vec_start + 2; ++ const int ori_offset = except_vec_vi_ori - vec_start + 2; + #else +- const int lui_offset = &except_vec_vi_lui - vec_start; +- const int ori_offset = &except_vec_vi_ori - vec_start; ++ const int lui_offset = except_vec_vi_lui - vec_start; ++ const int ori_offset = except_vec_vi_ori - vec_start; + #endif +- const int handler_len = &except_vec_vi_end - vec_start; ++ const int handler_len = except_vec_vi_end - vec_start; + + if (handler_len > VECTORSPACING) { + /* +@@ -2317,7 +2317,7 @@ void per_cpu_trap_init(bool is_boot_cpu) + } + + /* Install CPU exception handler */ +-void set_handler(unsigned long offset, void *addr, unsigned long size) ++void set_handler(unsigned long offset, const void *addr, unsigned long size) + { + #ifdef CONFIG_CPU_MICROMIPS + memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); +diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c +index bdf53807d7c2b..bea857c9da8b7 100644 +--- a/arch/mips/ralink/ill_acc.c ++++ b/arch/mips/ralink/ill_acc.c +@@ -61,6 +61,7 @@ static int __init ill_acc_of_setup(void) + pdev = of_find_device_by_node(np); + if (!pdev) { + pr_err("%pOFn: failed to lookup pdev\n", np); ++ of_node_put(np); + return -EINVAL; + } + +diff --git a/arch/parisc/kernel/patch.c b/arch/parisc/kernel/patch.c +index 80a0ab372802d..e59574f65e641 100644 +--- a/arch/parisc/kernel/patch.c ++++ b/arch/parisc/kernel/patch.c +@@ -40,10 +40,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags, + + *need_unmap = 1; + set_fixmap(fixmap, page_to_phys(page)); +- if (flags) +- raw_spin_lock_irqsave(&patch_lock, *flags); +- else +- __acquire(&patch_lock); ++ raw_spin_lock_irqsave(&patch_lock, *flags); + + return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK)); + } +@@ -52,10 +49,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) + { + clear_fixmap(fixmap); + +- if (flags) +- raw_spin_unlock_irqrestore(&patch_lock, *flags); +- else +- __release(&patch_lock); ++ raw_spin_unlock_irqrestore(&patch_lock, *flags); + } + + void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) +@@ -67,8 +61,9 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + int mapped; + + /* Make sure we don't have any aliases in cache */ +- flush_kernel_vmap_range(addr, len); +- flush_icache_range(start, end); ++ flush_kernel_dcache_range_asm(start, end); ++ flush_kernel_icache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped); + +@@ -81,8 +76,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + * We're crossing a page boundary, so + * need to remap + */ +- flush_kernel_vmap_range((void *)fixmap, +- (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, ++ (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, ++ (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, +@@ -90,10 +87,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + } + } + +- flush_kernel_vmap_range((void *)fixmap, (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); +- flush_icache_range(start, end); + } + + void __kprobes __patch_text(void *addr, u32 insn) +diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +index 099a598c74c00..bfe1ed5be3374 100644 +--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +@@ -139,12 +139,12 @@ + fman@400000 { + ethernet@e6000 { + phy-handle = <&phy_rgmii_0>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + ethernet@e8000 { + phy-handle = <&phy_rgmii_1>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + mdio0: mdio@fc000 { +diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h +index 254687258f42b..f2c5c26869f1a 100644 +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -132,7 +132,11 @@ static inline bool pfn_valid(unsigned long pfn) + #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr)) + #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT) + +-#define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) ++#define virt_addr_valid(vaddr) ({ \ ++ unsigned long _addr = (unsigned long)vaddr; \ ++ _addr >= PAGE_OFFSET && _addr < (unsigned long)high_memory && \ ++ pfn_valid(virt_to_pfn(_addr)); \ ++}) + + /* + * On Book-E parts we need __va to parse the device tree and we can't +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index cccb32cf0e08c..cf421eb7f90d4 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -1296,6 +1296,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, + entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); + sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); + ++#ifdef CONFIG_PPC64 ++ /* need this feature to decide the crashkernel offset */ ++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) ++ powerpc_firmware_features |= FW_FEATURE_LPAR; ++#endif ++ + if (basep && entryp && sizep) { + rtas.base = *basep; + rtas.entry = *entryp; +diff --git a/arch/powerpc/kernel/secvar-sysfs.c b/arch/powerpc/kernel/secvar-sysfs.c +index a0a78aba2083e..1ee4640a26413 100644 +--- a/arch/powerpc/kernel/secvar-sysfs.c ++++ b/arch/powerpc/kernel/secvar-sysfs.c +@@ -26,15 +26,18 @@ static ssize_t format_show(struct kobject *kobj, struct kobj_attribute *attr, + const char *format; + + node = of_find_compatible_node(NULL, NULL, "ibm,secvar-backend"); +- if (!of_device_is_available(node)) +- return -ENODEV; ++ if (!of_device_is_available(node)) { ++ rc = -ENODEV; ++ goto out; ++ } + + rc = of_property_read_string(node, "format", &format); + if (rc) +- return rc; ++ goto out; + + rc = sprintf(buf, "%s\n", format); + ++out: + of_node_put(node); + + return rc; +diff --git a/arch/powerpc/kexec/core.c b/arch/powerpc/kexec/core.c +index 56da5eb2b923a..80c79cb5010c5 100644 +--- a/arch/powerpc/kexec/core.c ++++ b/arch/powerpc/kexec/core.c +@@ -147,11 +147,18 @@ void __init reserve_crashkernel(void) + if (!crashk_res.start) { + #ifdef CONFIG_PPC64 + /* +- * On 64bit we split the RMO in half but cap it at half of +- * a small SLB (128MB) since the crash kernel needs to place +- * itself and some stacks to be in the first segment. ++ * On the LPAR platform place the crash kernel to mid of ++ * RMA size (512MB or more) to ensure the crash kernel ++ * gets enough space to place itself and some stack to be ++ * in the first segment. At the same time normal kernel ++ * also get enough space to allocate memory for essential ++ * system resource in the first segment. Keep the crash ++ * kernel starts at 128MB offset on other platforms. + */ +- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); ++ if (firmware_has_feature(FW_FEATURE_LPAR)) ++ crashk_res.start = ppc64_rma_size / 2; ++ else ++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); + #else + crashk_res.start = KDUMP_KERNELBASE; + #endif +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index fb873a7bb65c8..db95ac482e0ef 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2865,6 +2865,11 @@ config IA32_AOUT + config X86_X32 + bool "x32 ABI for 64-bit mode" + depends on X86_64 ++ # llvm-objcopy does not convert x86_64 .note.gnu.property or ++ # compressed debug sections to x86_x32 properly: ++ # https://github.com/ClangBuiltLinux/linux/issues/514 ++ # https://github.com/ClangBuiltLinux/linux/issues/1141 ++ depends on $(success,$(OBJCOPY) --version | head -n1 | grep -qv llvm) + help + Include code to run binaries for the x32 native 32-bit ABI + for 64-bit processors. An x32 process gets access to the +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index a63df19ef4dad..71e1a2d39f218 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -3611,8 +3611,10 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) + { + u64 tsc_aux = 0; + +- if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) ++ if (!ctxt->ops->guest_has_rdpid(ctxt)) + return emulate_ud(ctxt); ++ ++ ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux); + ctxt->dst.val = tsc_aux; + return X86EMUL_CONTINUE; + } +diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h +index 7d5be04dc6616..aeed6da60e0c7 100644 +--- a/arch/x86/kvm/kvm_emulate.h ++++ b/arch/x86/kvm/kvm_emulate.h +@@ -225,6 +225,7 @@ struct x86_emulate_ops { + bool (*guest_has_long_mode)(struct x86_emulate_ctxt *ctxt); + bool (*guest_has_movbe)(struct x86_emulate_ctxt *ctxt); + bool (*guest_has_fxsr)(struct x86_emulate_ctxt *ctxt); ++ bool (*guest_has_rdpid)(struct x86_emulate_ctxt *ctxt); + + void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); + +diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c +index 4e7093bcb64b6..0e9c2322d3988 100644 +--- a/arch/x86/kvm/svm/pmu.c ++++ b/arch/x86/kvm/svm/pmu.c +@@ -253,12 +253,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_EVNTSELn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); + if (pmc) { +- if (data == pmc->eventsel) +- return 0; +- if (!(data & pmu->reserved_bits)) { ++ data &= ~pmu->reserved_bits; ++ if (data != pmc->eventsel) + reprogram_gp_counter(pmc, data); +- return 0; +- } ++ return 0; + } + + return 1; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index a5d6d79b023bc..70d23bec09f5c 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6875,6 +6875,11 @@ static bool emulator_guest_has_fxsr(struct x86_emulate_ctxt *ctxt) + return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_FXSR); + } + ++static bool emulator_guest_has_rdpid(struct x86_emulate_ctxt *ctxt) ++{ ++ return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_RDPID); ++} ++ + static ulong emulator_read_gpr(struct x86_emulate_ctxt *ctxt, unsigned reg) + { + return kvm_register_read(emul_to_vcpu(ctxt), reg); +@@ -6958,6 +6963,7 @@ static const struct x86_emulate_ops emulate_ops = { + .guest_has_long_mode = emulator_guest_has_long_mode, + .guest_has_movbe = emulator_guest_has_movbe, + .guest_has_fxsr = emulator_guest_has_fxsr, ++ .guest_has_rdpid = emulator_guest_has_rdpid, + .set_nmi_mask = emulator_set_nmi_mask, + .get_hflags = emulator_get_hflags, + .set_hflags = emulator_set_hflags, +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index db1378c6ff262..decebcd8ee1c7 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -40,7 +40,8 @@ static void msr_save_context(struct saved_context *ctxt) + struct saved_msr *end = msr + ctxt->saved_msrs.num; + + while (msr < end) { +- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); ++ if (msr->valid) ++ rdmsrl(msr->info.msr_no, msr->info.reg.q); + msr++; + } + } +@@ -427,8 +428,10 @@ static int msr_build_context(const u32 *msr_id, const int num) + } + + for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { ++ u64 dummy; ++ + msr_array[i].info.msr_no = msr_id[j]; +- msr_array[i].valid = false; ++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); + msr_array[i].info.reg.q = 0; + } + saved_msrs->num = total_num; +@@ -503,10 +506,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c) + return ret; + } + ++static void pm_save_spec_msr(void) ++{ ++ u32 spec_msr_id[] = { ++ MSR_IA32_SPEC_CTRL, ++ MSR_IA32_TSX_CTRL, ++ MSR_TSX_FORCE_ABORT, ++ MSR_IA32_MCU_OPT_CTRL, ++ MSR_AMD64_LS_CFG, ++ }; ++ ++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); ++} ++ + static int pm_check_save_msr(void) + { + dmi_check_system(msr_save_dmi_table); + pm_cpu_check(msr_save_cpu_table); ++ pm_save_spec_msr(); + + return 0; + } +diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c +index 6ff3c887e0b99..b70afdff419ca 100644 +--- a/arch/x86/xen/smp_hvm.c ++++ b/arch/x86/xen/smp_hvm.c +@@ -19,6 +19,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) + */ + xen_vcpu_setup(0); + ++ /* ++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. ++ * Refer to comments in xen_hvm_init_time_ops(). ++ */ ++ xen_hvm_init_time_ops(); ++ + /* + * The alternative logic (which patches the unlock/lock) runs before + * the smp bootup up code is activated. Hence we need to set this up +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index 91f5b330dcc6d..8183d17e1cf17 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -556,6 +556,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + + void __init xen_hvm_init_time_ops(void) + { ++ static bool hvm_time_initialized; ++ ++ if (hvm_time_initialized) ++ return; ++ + /* + * vector callback is needed otherwise we cannot receive interrupts + * on cpu > 0 and at this point we don't know how many cpus are +@@ -565,7 +570,22 @@ void __init xen_hvm_init_time_ops(void) + return; + + if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { +- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); ++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); ++ return; ++ } ++ ++ /* ++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. ++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest ++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access ++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. ++ * ++ * The xen_hvm_init_time_ops() should be called again later after ++ * __this_cpu_read(xen_vcpu) is available. ++ */ ++ if (!__this_cpu_read(xen_vcpu)) { ++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", ++ xen_vcpu_nr(0)); + return; + } + +@@ -577,6 +597,8 @@ void __init xen_hvm_init_time_ops(void) + x86_platform.calibrate_tsc = xen_tsc_khz; + x86_platform.get_wallclock = xen_get_wallclock; + x86_platform.set_wallclock = xen_set_wallclock; ++ ++ hvm_time_initialized = true; + } + #endif + +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +index 9bf8bad1dd18a..c33932568aa73 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x00000000 0x08000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "data"; + reg = <0x00000000 0x06000000>; + }; +- partition@0x6000000 { ++ partition@6000000 { + label = "boot loader area"; + reg = <0x06000000 0x00800000>; + }; +- partition@0x6800000 { ++ partition@6800000 { + label = "kernel image"; + reg = <0x06800000 0x017e0000>; + }; +- partition@0x7fe0000 { ++ partition@7fe0000 { + label = "boot environment"; + reg = <0x07fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +index 40c2f81f7cb66..7bde2ab2d6fb5 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x08000000 0x01000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x00400000>; + }; +- partition@0x400000 { ++ partition@400000 { + label = "kernel image"; + reg = <0x00400000 0x00600000>; + }; +- partition@0xa00000 { ++ partition@a00000 { + label = "data"; + reg = <0x00a00000 0x005e0000>; + }; +- partition@0xfe0000 { ++ partition@fe0000 { + label = "boot environment"; + reg = <0x00fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +index fb8d3a9f33c23..0655b868749a4 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +@@ -8,11 +8,11 @@ + reg = <0x08000000 0x00400000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x003f0000>; + }; +- partition@0x3f0000 { ++ partition@3f0000 { + label = "boot environment"; + reg = <0x003f0000 0x00010000>; + }; +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index 982fe91125322..464260f668708 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -145,7 +145,11 @@ struct sata_dwc_device { + #endif + }; + +-#define SATA_DWC_QCMD_MAX 32 ++/* ++ * Allow one extra special slot for commands and DMA management ++ * to account for libata internal commands. ++ */ ++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) + + struct sata_dwc_device_port { + struct sata_dwc_device *hsdev; +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index 8f879e5c2f670..60b9ca53c0a35 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1644,22 +1644,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index bf7de4c7b96c1..f8d0146bf7852 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4614,7 +4614,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4656,16 +4656,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4705,16 +4706,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4754,16 +4756,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4804,13 +4807,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4861,7 +4865,7 @@ fail: + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4875,11 +4879,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4906,6 +4911,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4914,32 +4920,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4954,7 +4960,10 @@ next: + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index 0067d328f0b56..5fbaea6b77b14 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1602,7 +1602,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *last_arg = NULL; + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6abb..d5b0479bc9a66 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 3dd4deb60adbf..6d361420ffe82 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -2239,7 +2239,7 @@ static struct virtio_driver virtio_rproc_serial = { + .remove = virtcons_remove, + }; + +-static int __init init(void) ++static int __init virtio_console_init(void) + { + int err; + +@@ -2276,7 +2276,7 @@ free: + return err; + } + +-static void __exit fini(void) ++static void __exit virtio_console_fini(void) + { + reclaim_dma_bufs(); + +@@ -2286,8 +2286,8 @@ static void __exit fini(void) + class_destroy(pdrvdata.class); + debugfs_remove_recursive(pdrvdata.debugfs_dir); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_console_init); ++module_exit(virtio_console_fini); + + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 772b48ad0cd78..382a0619a0488 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -789,6 +789,15 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + u32 r_divider; + u8 r[3]; + ++ err = regmap_read(output->data->regmap, ++ SI5341_OUT_CONFIG(output), &val); ++ if (err < 0) ++ return err; ++ ++ /* If SI5341_OUT_CFG_RDIV_FORCE2 is set, r_divider is 2 */ ++ if (val & SI5341_OUT_CFG_RDIV_FORCE2) ++ return parent_rate / 2; ++ + err = regmap_bulk_read(output->data->regmap, + SI5341_OUT_R_REG(output), r, 3); + if (err < 0) +@@ -805,13 +814,6 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + r_divider += 1; + r_divider <<= 1; + +- err = regmap_read(output->data->regmap, +- SI5341_OUT_CONFIG(output), &val); +- if (err < 0) +- return err; +- +- if (val & SI5341_OUT_CFG_RDIV_FORCE2) +- r_divider = 2; + + return parent_rate / r_divider; + } +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 92fc084203b75..2e56cc0a3bce6 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -631,6 +631,24 @@ static void clk_core_get_boundaries(struct clk_core *core, + *max_rate = min(*max_rate, clk_user->max_rate); + } + ++static bool clk_core_check_boundaries(struct clk_core *core, ++ unsigned long min_rate, ++ unsigned long max_rate) ++{ ++ struct clk *user; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ if (min_rate > core->max_rate || max_rate < core->min_rate) ++ return false; ++ ++ hlist_for_each_entry(user, &core->clks, clks_node) ++ if (min_rate > user->max_rate || max_rate < user->min_rate) ++ return false; ++ ++ return true; ++} ++ + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate) + { +@@ -2332,6 +2350,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + clk->min_rate = min; + clk->max_rate = max; + ++ if (!clk_core_check_boundaries(clk->core, min, max)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + rate = clk_core_get_rate_nolock(clk->core); + if (rate < min || rate > max) { + /* +@@ -2360,6 +2383,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + } + } + ++out: + if (clk->exclusive_count) + clk_core_rate_protect(clk->core); + +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 3da33c786d77c..29eafab4353ef 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -131,7 +131,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops) + void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + { + struct ti_dt_clk *c; +- struct device_node *node, *parent; ++ struct device_node *node, *parent, *child; + struct clk *clk; + struct of_phandle_args clkspec; + char buf[64]; +@@ -171,10 +171,13 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + node = of_find_node_by_name(NULL, buf); + if (num_args && compat_mode) { + parent = node; +- node = of_get_child_by_name(parent, "clock"); +- if (!node) +- node = of_get_child_by_name(parent, "clk"); +- of_node_put(parent); ++ child = of_get_child_by_name(parent, "clock"); ++ if (!child) ++ child = of_get_child_by_name(parent, "clk"); ++ if (child) { ++ of_node_put(parent); ++ node = child; ++ } + } + + clkspec.np = node; +diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c +index 19ac95c0098f0..7f72b3f4cd1ae 100644 +--- a/drivers/dma/sh/shdma-base.c ++++ b/drivers/dma/sh/shdma-base.c +@@ -115,10 +115,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) + ret = pm_runtime_get(schan->dev); + + spin_unlock_irq(&schan->chan_lock); +- if (ret < 0) { ++ if (ret < 0) + dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); +- pm_runtime_put(schan->dev); +- } + + pm_runtime_barrier(schan->dev); + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 00526fdd7691f..d180787482009 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -1411,6 +1411,16 @@ static int gpiochip_to_irq(struct gpio_chip *gc, unsigned offset) + { + struct irq_domain *domain = gc->irq.domain; + ++#ifdef CONFIG_GPIOLIB_IRQCHIP ++ /* ++ * Avoid race condition with other code, which tries to lookup ++ * an IRQ before the irqchip has been properly registered, ++ * i.e. while gpiochip is still being brought up. ++ */ ++ if (!gc->irq.initialized) ++ return -EPROBE_DEFER; ++#endif ++ + if (!gpiochip_irqchip_irq_valid(gc, offset)) + return -ENXIO; + +@@ -1604,6 +1614,15 @@ static int gpiochip_add_irqchip(struct gpio_chip *gc, + + acpi_gpiochip_request_interrupts(gc); + ++ /* ++ * Using barrier() here to prevent compiler from reordering ++ * gc->irq.initialized before initialization of above ++ * GPIO chip irq members. ++ */ ++ barrier(); ++ ++ gc->irq.initialized = true; ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 12598a4b5c788..867fcee6b0d3b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1484,6 +1484,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, + return 0; + + default: ++ dma_fence_put(fence); + return -EINVAL; + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 9f9f55a2b257c..f84582b70d0ed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -263,7 +263,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, + * adev->gfx.mec.num_pipe_per_mec + * adev->gfx.mec.num_queue_per_pipe; + +- while (queue_bit-- >= 0) { ++ while (--queue_bit >= 0) { + if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) + continue; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index ad9863b84f1fc..f615ecc06a223 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1338,7 +1338,8 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) + return; + +- dma_resv_lock(bo->base.resv, NULL); ++ if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) ++ return; + + r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->base.resv, &fence); + if (!WARN_ON(r)) { +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index 31d793ee0836e..86b4dadf772e3 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -784,7 +784,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) + /* Fetch the CRAT table from ACPI */ + status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); + if (status == AE_NOT_FOUND) { +- pr_warn("CRAT table not found\n"); ++ pr_info("CRAT table not found\n"); + return -ENODATA; + } else if (ACPI_FAILURE(status)) { + const char *err = acpi_format_exception(status); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +index 17d1736367ea3..bd4caa36ab2e2 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +@@ -270,15 +270,6 @@ int kfd_smi_event_open(struct kfd_dev *dev, uint32_t *fd) + return ret; + } + +- ret = anon_inode_getfd(kfd_smi_name, &kfd_smi_ev_fops, (void *)client, +- O_RDWR); +- if (ret < 0) { +- kfifo_free(&client->fifo); +- kfree(client); +- return ret; +- } +- *fd = ret; +- + init_waitqueue_head(&client->wait_queue); + spin_lock_init(&client->lock); + client->events = 0; +@@ -288,5 +279,20 @@ int kfd_smi_event_open(struct kfd_dev *dev, uint32_t *fd) + list_add_rcu(&client->list, &dev->smi_clients); + spin_unlock(&dev->smi_lock); + ++ ret = anon_inode_getfd(kfd_smi_name, &kfd_smi_ev_fops, (void *)client, ++ O_RDWR); ++ if (ret < 0) { ++ spin_lock(&dev->smi_lock); ++ list_del_rcu(&client->list); ++ spin_unlock(&dev->smi_lock); ++ ++ synchronize_rcu(); ++ ++ kfifo_free(&client->fifo); ++ kfree(client); ++ return ret; ++ } ++ *fd = ret; ++ + return 0; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 5f4cdb05c4db9..5c5ccbad96588 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1674,6 +1674,9 @@ static bool are_stream_backends_same( + if (is_timing_changed(stream_a, stream_b)) + return false; + ++ if (stream_a->signal != stream_b->signal) ++ return false; ++ + if (stream_a->dpms_off != stream_b->dpms_off) + return false; + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +index e6f40ee9f3134..9d97938bd49ef 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +@@ -709,13 +709,13 @@ static int smu10_dpm_force_dpm_level(struct pp_hwmgr *hwmgr, + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetHardMinFclkByFreq, + hwmgr->display_config->num_display > 3 ? +- data->clock_vol_info.vdd_dep_on_fclk->entries[0].clk : ++ (data->clock_vol_info.vdd_dep_on_fclk->entries[0].clk / 100) : + min_mclk, + NULL); + + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetHardMinSocclkByFreq, +- data->clock_vol_info.vdd_dep_on_socclk->entries[0].clk, ++ data->clock_vol_info.vdd_dep_on_socclk->entries[0].clk / 100, + NULL); + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetHardMinVcn, +@@ -728,11 +728,11 @@ static int smu10_dpm_force_dpm_level(struct pp_hwmgr *hwmgr, + NULL); + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetSoftMaxFclkByFreq, +- data->clock_vol_info.vdd_dep_on_fclk->entries[index_fclk].clk, ++ data->clock_vol_info.vdd_dep_on_fclk->entries[index_fclk].clk / 100, + NULL); + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetSoftMaxSocclkByFreq, +- data->clock_vol_info.vdd_dep_on_socclk->entries[index_socclk].clk, ++ data->clock_vol_info.vdd_dep_on_socclk->entries[index_socclk].clk / 100, + NULL); + smum_send_msg_to_smc_with_parameter(hwmgr, + PPSMC_MSG_SetSoftMaxVcn, +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 448c2f2d803a6..f5ab891731d0b 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index 75036aaa0c639..efd13e533726b 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -553,6 +553,8 @@ static int imx_ldb_panel_ddc(struct device *dev, + edidp = of_get_property(child, "edid", &edid_len); + if (edidp) { + channel->edid = kmemdup(edidp, edid_len, GFP_KERNEL); ++ if (!channel->edid) ++ return -ENOMEM; + } else if (!channel->panel) { + /* fallback to display-timings node */ + ret = of_get_drm_display_mode(child, +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index 605ac8825a591..b61bfa84b6bbd 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -70,8 +70,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ drm_mode_destroy(connector->dev, mode); + return ret; ++ } + + drm_mode_copy(mode, &imxpd->mode); + mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c +index 7938722b4da17..d82529becfdc9 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c +@@ -216,6 +216,7 @@ gm20b_pmu = { + .intr = gt215_pmu_intr, + .recv = gm20b_pmu_recv, + .initmsg = gm20b_pmu_initmsg, ++ .reset = gf100_pmu_reset, + }; + + #if IS_ENABLED(CONFIG_ARCH_TEGRA_210_SOC) +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c +index 3dfb3e8522f6a..9f32982216b6f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c +@@ -23,7 +23,7 @@ + */ + #include "priv.h" + +-static void ++void + gp102_pmu_reset(struct nvkm_pmu *pmu) + { + struct nvkm_device *device = pmu->subdev.device; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +index 7f5f9d5448360..0bd4b32ad863f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +@@ -83,6 +83,7 @@ gp10b_pmu = { + .intr = gt215_pmu_intr, + .recv = gm20b_pmu_recv, + .initmsg = gm20b_pmu_initmsg, ++ .reset = gp102_pmu_reset, + }; + + #if IS_ENABLED(CONFIG_ARCH_TEGRA_210_SOC) +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h +index b945ec320cd2e..80c4cb861d40e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h +@@ -41,6 +41,7 @@ int gt215_pmu_send(struct nvkm_pmu *, u32[2], u32, u32, u32, u32); + + bool gf100_pmu_enabled(struct nvkm_pmu *); + void gf100_pmu_reset(struct nvkm_pmu *); ++void gp102_pmu_reset(struct nvkm_pmu *pmu); + + void gk110_pmu_pgob(struct nvkm_pmu *, bool); + +diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig +index 210e532ac277f..79e5356a737a2 100644 +--- a/drivers/hv/Kconfig ++++ b/drivers/hv/Kconfig +@@ -17,7 +17,6 @@ config HYPERV_TIMER + config HYPERV_UTILS + tristate "Microsoft Hyper-V Utilities driver" + depends on HYPERV && CONNECTOR && NLS +- depends on PTP_1588_CLOCK_OPTIONAL + help + Select this option to enable the Hyper-V Utilities. + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 6476bfe193afd..5dbb949b1afd8 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -350,7 +350,7 @@ void vmbus_channel_map_relid(struct vmbus_channel *channel) + * execute: + * + * (a) In the "normal (i.e., not resuming from hibernation)" path, +- * the full barrier in smp_store_mb() guarantees that the store ++ * the full barrier in virt_store_mb() guarantees that the store + * is propagated to all CPUs before the add_channel_work work + * is queued. In turn, add_channel_work is queued before the + * channel's ring buffer is allocated/initialized and the +@@ -362,14 +362,14 @@ void vmbus_channel_map_relid(struct vmbus_channel *channel) + * recv_int_page before retrieving the channel pointer from the + * array of channels. + * +- * (b) In the "resuming from hibernation" path, the smp_store_mb() ++ * (b) In the "resuming from hibernation" path, the virt_store_mb() + * guarantees that the store is propagated to all CPUs before + * the VMBus connection is marked as ready for the resume event + * (cf. check_ready_for_resume_event()). The interrupt handler + * of the VMBus driver and vmbus_chan_sched() can not run before + * vmbus_bus_resume() has completed execution (cf. resume_noirq). + */ +- smp_store_mb( ++ virt_store_mb( + vmbus_connection.channels[channel->offermsg.child_relid], + channel); + } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 362da2a83b470..b9ac357e465db 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2673,10 +2673,15 @@ static void __exit vmbus_exit(void) + if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { + kmsg_dump_unregister(&hv_kmsg_dumper); + unregister_die_notifier(&hyperv_die_block); +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &hyperv_panic_block); + } + ++ /* ++ * The panic notifier is always registered, hence we should ++ * also unconditionally unregister it here as well. ++ */ ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &hyperv_panic_block); ++ + free_page((unsigned long)hv_panic_page); + unregister_sysctl_table(hv_ctl_table_hdr); + hv_ctl_table_hdr = NULL; +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index d213f65d4cdd0..ed8a96ae61cef 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -121,6 +121,9 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler) + unsigned long flags; + struct list_head del_list; + ++ /* Prevent freeing of mm until we are completely finished. */ ++ mmgrab(handler->mn.mm); ++ + /* Unregister first so we don't get any more notifications. */ + mmu_notifier_unregister(&handler->mn, handler->mn.mm); + +@@ -143,6 +146,9 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler) + + do_remove(handler, &del_list); + ++ /* Now the mm may be freed. */ ++ mmdrop(handler->mn.mm); ++ + kfree(handler); + } + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 6cd0cbd4fc9f6..d827a4e44c946 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -531,8 +531,10 @@ static void __cache_work_func(struct mlx5_cache_ent *ent) + spin_lock_irq(&ent->lock); + if (ent->disabled) + goto out; +- if (need_delay) ++ if (need_delay) { + queue_delayed_work(cache->wq, &ent->dwork, 300 * HZ); ++ goto out; ++ } + remove_cache_mr_locked(ent); + queue_adjust_cache_locked(ent); + } +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index 09f0dbf941c06..d8d52a00a1be9 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -3241,7 +3241,11 @@ serr_no_r_lock: + spin_lock_irqsave(&sqp->s_lock, flags); + rvt_send_complete(sqp, wqe, send_status); + if (sqp->ibqp.qp_type == IB_QPT_RC) { +- int lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ int lastwqe; ++ ++ spin_lock(&sqp->r_lock); ++ lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ spin_unlock(&sqp->r_lock); + + sqp->s_flags &= ~RVT_S_BUSY; + spin_unlock_irqrestore(&sqp->s_lock, flags); +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 7067b7c116260..483c1362cc4aa 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -1368,6 +1368,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + dev_info(smmu->dev, "\t0x%016llx\n", + (unsigned long long)evt[i]); + ++ cond_resched(); + } + + /* +diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c +index 71f29c0927fc7..ff2c692c0db47 100644 +--- a/drivers/iommu/omap-iommu.c ++++ b/drivers/iommu/omap-iommu.c +@@ -1665,7 +1665,7 @@ static struct iommu_device *omap_iommu_probe_device(struct device *dev) + num_iommus = of_property_count_elems_of_size(dev->of_node, "iommus", + sizeof(phandle)); + if (num_iommus < 0) +- return 0; ++ return ERR_PTR(-ENODEV); + + arch_data = kcalloc(num_iommus + 1, sizeof(*arch_data), GFP_KERNEL); + if (!arch_data) +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 04d1b3963b6ba..e5e3fd6b95543 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -206,11 +206,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d) + } + } + +-static void gic_do_wait_for_rwp(void __iomem *base) ++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) + { + u32 count = 1000000; /* 1s! */ + +- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { ++ while (readl_relaxed(base + GICD_CTLR) & bit) { + count--; + if (!count) { + pr_err_ratelimited("RWP timeout, gone fishing\n"); +@@ -224,13 +224,13 @@ static void gic_do_wait_for_rwp(void __iomem *base) + /* Wait for completion of a distributor change */ + static void gic_dist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data.dist_base); ++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); + } + + /* Wait for completion of a redistributor change */ + static void gic_redist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); ++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); + } + + #ifdef CONFIG_ARM64 +@@ -1467,6 +1467,12 @@ static int gic_irq_domain_translate(struct irq_domain *d, + if(fwspec->param_count != 2) + return -EINVAL; + ++ if (fwspec->param[0] < 16) { ++ pr_err(FW_BUG "Illegal GSI%d translation request\n", ++ fwspec->param[0]); ++ return -EINVAL; ++ } ++ + *hwirq = fwspec->param[0]; + *type = fwspec->param[1]; + +diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c +index 176f5f06432d1..205cbd24ff209 100644 +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -1094,6 +1094,12 @@ static int gic_irq_domain_translate(struct irq_domain *d, + if(fwspec->param_count != 2) + return -EINVAL; + ++ if (fwspec->param[0] < 16) { ++ pr_err(FW_BUG "Illegal GSI%d translation request\n", ++ fwspec->param[0]); ++ return -EINVAL; ++ } ++ + *hwirq = fwspec->param[0]; + *type = fwspec->param[1]; + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 1ca65b434f1fa..b839705654d4e 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) + if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) + return NULL; + ++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); + *ioctl_flags = _ioctls[cmd].flags; + return _ioctls[cmd].fn; + } +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index b1e867feb4f6b..4833f4b20b2c7 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -492,8 +492,13 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + + if (unlikely(!ti)) { + int srcu_idx; +- struct dm_table *map = dm_get_live_table(md, &srcu_idx); ++ struct dm_table *map; + ++ map = dm_get_live_table(md, &srcu_idx); ++ if (unlikely(!map)) { ++ dm_put_live_table(md, srcu_idx); ++ return BLK_STS_RESOURCE; ++ } + ti = dm_table_find_target(map, 0); + dm_put_live_table(md, srcu_idx); + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 6030cba5b0382..2836d44094aba 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1692,15 +1692,10 @@ static blk_qc_t dm_submit_bio(struct bio *bio) + struct dm_table *map; + + map = dm_get_live_table(md, &srcu_idx); +- if (unlikely(!map)) { +- DMERR_LIMIT("%s: mapping table unavailable, erroring io", +- dm_device_name(md)); +- bio_io_error(bio); +- goto out; +- } + +- /* If suspended, queue this IO for later */ +- if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) { ++ /* If suspended, or map not yet available, queue this IO for later */ ++ if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) || ++ unlikely(!map)) { + if (bio->bi_opf & REQ_NOWAIT) + bio_wouldblock_error(bio); + else if (bio->bi_opf & REQ_RAHEAD) +diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c +index a75d3dd34d18c..4cceb9bab0361 100644 +--- a/drivers/mmc/host/mmci_stm32_sdmmc.c ++++ b/drivers/mmc/host/mmci_stm32_sdmmc.c +@@ -62,8 +62,8 @@ static int sdmmc_idma_validate_data(struct mmci_host *host, + * excepted the last element which has no constraint on idmasize + */ + for_each_sg(data->sg, sg, data->sg_len - 1, i) { +- if (!IS_ALIGNED(data->sg->offset, sizeof(u32)) || +- !IS_ALIGNED(data->sg->length, SDMMC_IDMA_BURST)) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32)) || ++ !IS_ALIGNED(sg->length, SDMMC_IDMA_BURST)) { + dev_err(mmc_dev(host->mmc), + "unaligned scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +@@ -71,7 +71,7 @@ static int sdmmc_idma_validate_data(struct mmci_host *host, + } + } + +- if (!IS_ALIGNED(data->sg->offset, sizeof(u32))) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32))) { + dev_err(mmc_dev(host->mmc), + "unaligned last scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 782879d46ff48..ac01fb518386a 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -390,10 +390,10 @@ static void renesas_sdhi_hs400_complete(struct mmc_host *mmc) + SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) | + sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2)); + +- /* Set the sampling clock selection range of HS400 mode */ + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL, + SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN | +- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT); ++ sd_scc_read32(host, priv, ++ SH_MOBILE_SDHI_SCC_DTCNTL)); + + /* Avoid bad TAP */ + if (bad_taps & BIT(priv->tap_set)) { +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index 0e5234a5ca224..d509198c00c8a 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -240,16 +240,6 @@ static void xenon_voltage_switch(struct sdhci_host *host) + { + /* Wait for 5ms after set 1.8V signal enable bit */ + usleep_range(5000, 5500); +- +- /* +- * For some reason the controller's Host Control2 register reports +- * the bit representing 1.8V signaling as 0 when read after it was +- * written as 1. Subsequent read reports 1. +- * +- * Since this may cause some issues, do an empty read of the Host +- * Control2 register here to circumvent this. +- */ +- sdhci_readw(host, SDHCI_HOST_CONTROL2); + } + + static const struct sdhci_ops sdhci_xenon_ops = { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 92f9f7f5240b6..34affd1de91da 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -569,7 +569,8 @@ struct nqe_cn { + #define BNXT_MAX_MTU 9500 + #define BNXT_MAX_PAGE_MODE_MTU \ + ((unsigned int)PAGE_SIZE - VLAN_ETH_HLEN - NET_IP_ALIGN - \ +- XDP_PACKET_HEADROOM) ++ XDP_PACKET_HEADROOM - \ ++ SKB_DATA_ALIGN((unsigned int)sizeof(struct skb_shared_info))) + + #define BNXT_MIN_PKT_SIZE 52 + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 98087b278d1f4..f8f7756195205 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2041,9 +2041,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, + } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; +- if (bp->hwrm_spec_code >= 0x10201) +- link_info->req_flow_ctrl = +- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; ++ link_info->req_flow_ctrl = 0; + } else { + /* when transition from auto pause to force pause, + * force a link change +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index 32b5faa87bb8d..208a3459f2e29 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -168,7 +168,7 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + base = of_iomap(node, 0); + if (!base) { + err = -ENOMEM; +- goto err_close; ++ goto err_put; + } + + err = fsl_mc_allocate_irqs(mc_dev); +@@ -212,6 +212,8 @@ err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: + iounmap(base); ++err_put: ++ of_node_put(node); + err_close: + dprtc_close(mc_dev->mc_io, 0, mc_dev->mc_handle); + err_free_mcp: +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index 6a57b41ddb545..7794703c13593 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -498,7 +498,7 @@ static inline struct ice_pf *ice_netdev_to_pf(struct net_device *netdev) + + static inline bool ice_is_xdp_ena_vsi(struct ice_vsi *vsi) + { +- return !!vsi->xdp_prog; ++ return !!READ_ONCE(vsi->xdp_prog); + } + + static inline void ice_set_ring_xdp(struct ice_ring *ring) +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index 52ac6cc08e83e..ea8d868c8f30a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -1265,6 +1265,7 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi) + ring->vsi = vsi; + ring->dev = dev; + ring->count = vsi->num_tx_desc; ++ ring->txq_teid = ICE_INVAL_TEID; + WRITE_ONCE(vsi->tx_rings[i], ring); + } + +@@ -2667,6 +2668,8 @@ int ice_vsi_release(struct ice_vsi *vsi) + } + } + ++ if (ice_is_vsi_dflt_vsi(pf->first_sw, vsi)) ++ ice_clear_dflt_vsi(pf->first_sw); + ice_fltr_remove_all(vsi); + ice_rm_vsi_lan_cfg(vsi->port_info, vsi->idx); + ice_vsi_delete(vsi); +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 20c9d55f3adce..eb0625b52e453 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2475,8 +2475,10 @@ free_qmap: + + for (i = 0; i < vsi->num_xdp_txq; i++) + if (vsi->xdp_rings[i]) { +- if (vsi->xdp_rings[i]->desc) ++ if (vsi->xdp_rings[i]->desc) { ++ synchronize_rcu(); + ice_free_tx_ring(vsi->xdp_rings[i]); ++ } + kfree_rcu(vsi->xdp_rings[i], rcu); + vsi->xdp_rings[i] = NULL; + } +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +index 5134342ff70fc..a980d337861de 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +@@ -2723,9 +2723,9 @@ static int ice_vc_dis_qs_msg(struct ice_vf *vf, u8 *msg) + goto error_param; + } + +- /* Skip queue if not enabled */ + if (!test_bit(vf_q_id, vf->txq_ena)) +- continue; ++ dev_dbg(ice_pf_to_dev(vsi->back), "Queue %u on VSI %u is not enabled, but stopping it anyway\n", ++ vf_q_id, vsi->vsi_num); + + ice_fill_txq_meta(vsi, ring, &txq_meta); + +diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c +index 9f36f8d7a9854..5733526fa245c 100644 +--- a/drivers/net/ethernet/intel/ice/ice_xsk.c ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c +@@ -36,8 +36,10 @@ static void ice_qp_reset_stats(struct ice_vsi *vsi, u16 q_idx) + static void ice_qp_clean_rings(struct ice_vsi *vsi, u16 q_idx) + { + ice_clean_tx_ring(vsi->tx_rings[q_idx]); +- if (ice_is_xdp_ena_vsi(vsi)) ++ if (ice_is_xdp_ena_vsi(vsi)) { ++ synchronize_rcu(); + ice_clean_tx_ring(vsi->xdp_rings[q_idx]); ++ } + ice_clean_rx_ring(vsi->rx_rings[q_idx]); + } + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 21c906200e791..d210632676d32 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -752,6 +752,9 @@ qede_build_skb(struct qede_rx_queue *rxq, + buf = page_address(bd->data) + bd->page_offset; + skb = build_skb(buf, rxq->rx_buf_seg_size); + ++ if (unlikely(!skb)) ++ return NULL; ++ + skb_reserve(skb, pad); + skb_put(skb, len); + +diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c +index e423b17e2a148..2c09afac5beb4 100644 +--- a/drivers/net/ethernet/sfc/rx_common.c ++++ b/drivers/net/ethernet/sfc/rx_common.c +@@ -166,6 +166,9 @@ static void efx_fini_rx_recycle_ring(struct efx_rx_queue *rx_queue) + struct efx_nic *efx = rx_queue->efx; + int i; + ++ if (unlikely(!rx_queue->page_ring)) ++ return; ++ + /* Unmap and release the pages in the recycle ring. Remove the ring. */ + for (i = 0; i <= rx_queue->page_ptr_mask; i++) { + struct page *page = rx_queue->page_ring[i]; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 3183d8826981e..b40b962055fa5 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -432,8 +432,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->phylink_node = np; + + /* Get max speed of operation from device tree */ +- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) +- plat->max_speed = -1; ++ of_property_read_u32(np, "max-speed", &plat->max_speed); + + plat->bus_id = of_alias_get_id(np, "ethernet"); + if (plat->bus_id < 0) +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 694e2f5dbbe59..39801c31e5071 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -133,11 +133,17 @@ static void macvtap_setup(struct net_device *dev) + dev->tx_queue_len = TUN_READQ_SIZE; + } + ++static struct net *macvtap_link_net(const struct net_device *dev) ++{ ++ return dev_net(macvlan_dev_real_dev(dev)); ++} ++ + static struct rtnl_link_ops macvtap_link_ops __read_mostly = { + .kind = "macvtap", + .setup = macvtap_setup, + .newlink = macvtap_newlink, + .dellink = macvtap_dellink, ++ .get_link_net = macvtap_link_net, + .priv_size = sizeof(struct macvtap_dev), + }; + +diff --git a/drivers/net/mdio/mdio-mscc-miim.c b/drivers/net/mdio/mdio-mscc-miim.c +index 11f583fd4611f..1c9232fca1e2f 100644 +--- a/drivers/net/mdio/mdio-mscc-miim.c ++++ b/drivers/net/mdio/mdio-mscc-miim.c +@@ -76,6 +76,9 @@ static int mscc_miim_read(struct mii_bus *bus, int mii_id, int regnum) + u32 val; + int ret; + ++ if (regnum & MII_ADDR_C45) ++ return -EOPNOTSUPP; ++ + ret = mscc_miim_wait_pending(bus); + if (ret) + goto out; +@@ -105,6 +108,9 @@ static int mscc_miim_write(struct mii_bus *bus, int mii_id, + struct mscc_miim_dev *miim = bus->priv; + int ret; + ++ if (regnum & MII_ADDR_C45) ++ return -EOPNOTSUPP; ++ + ret = mscc_miim_wait_pending(bus); + if (ret < 0) + goto out; +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index a05d8372669c1..850915a37f4c2 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -74,6 +74,12 @@ static const struct sfp_quirk sfp_quirks[] = { + .vendor = "HUAWEI", + .part = "MA5671A", + .modes = sfp_quirk_2500basex, ++ }, { ++ // Lantech 8330-262D-E can operate at 2500base-X, but ++ // incorrectly report 2500MBd NRZ in their EEPROM ++ .vendor = "Lantech", ++ .part = "8330-262D-E", ++ .modes = sfp_quirk_2500basex, + }, { + .vendor = "UBNT", + .part = "UF-INSTANT", +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index f549d3a8e59c0..8f7bb15206e9f 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1202,7 +1202,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, + struct xdp_buff *xdp; + int i; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + for (i = 0; i < ctl->num; i++) { + xdp = &((struct xdp_buff *)ctl->ptr)[i]; + tap_get_user_xdp(q, xdp); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index ffbc7eda95eed..55ce141c93c75 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2499,7 +2499,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + if (!tun) + return -EBADFD; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + struct tun_page tpage; + int n = ctl->num; + int flush = 0; +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index 9ff6e68533142..190bc5712e965 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -366,6 +366,8 @@ static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab) + + for (j = 0; j < irq_grp->num_irq; j++) + free_irq(ab->irq_num[irq_grp->irqs[j]], irq_grp); ++ ++ netif_napi_del(&irq_grp->napi); + } + } + +diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c +index aded9a719d51e..84db9e55c3e72 100644 +--- a/drivers/net/wireless/ath/ath11k/mhi.c ++++ b/drivers/net/wireless/ath/ath11k/mhi.c +@@ -402,7 +402,7 @@ static int ath11k_mhi_set_state(struct ath11k_pci *ab_pci, + ret = 0; + break; + case ATH11K_MHI_POWER_ON: +- ret = mhi_async_power_up(ab_pci->mhi_ctrl); ++ ret = mhi_sync_power_up(ab_pci->mhi_ctrl); + break; + case ATH11K_MHI_POWER_OFF: + mhi_power_down(ab_pci->mhi_ctrl, true); +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 1fbc2c19848f2..d444b3d70ba2e 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, + } + } + ++ if (idx == AR5K_EEPROM_N_PD_CURVES) ++ goto err_out; ++ + ee->ee_pd_gains[mode] = 1; + + pd = &chinfo[pier].pd_curves[idx]; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 46255d2c555b6..17b9925266947 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1706,7 +1706,10 @@ static u8 iwl_mvm_scan_umac_chan_flags_v2(struct iwl_mvm *mvm, + IWL_SCAN_CHANNEL_FLAG_CACHE_ADD; + + /* set fragmented ebs for fragmented scan on HB channels */ +- if (iwl_mvm_is_scan_fragmented(params->hb_type)) ++ if ((!iwl_mvm_is_cdb_supported(mvm) && ++ iwl_mvm_is_scan_fragmented(params->type)) || ++ (iwl_mvm_is_cdb_supported(mvm) && ++ iwl_mvm_is_scan_fragmented(params->hb_type))) + flags |= IWL_SCAN_CHANNEL_FLAG_EBS_FRAG; + + return flags; +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 0fdfead45c77c..f01b455783b23 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -455,6 +455,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q) + + qbuf.addr = addr + offset; + qbuf.len = len - offset; ++ qbuf.skip_unmap = false; + mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL); + frames++; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 424be103093c6..1465a92ea3fc9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -1626,7 +1626,7 @@ mt7615_mac_adjust_sensitivity(struct mt7615_phy *phy, + struct mt7615_dev *dev = phy->dev; + int false_cca = ofdm ? phy->false_cca_ofdm : phy->false_cca_cck; + bool ext_phy = phy != &dev->phy; +- u16 def_th = ofdm ? -98 : -110; ++ s16 def_th = ofdm ? -98 : -110; + bool update = false; + s8 *sensitivity; + int signal; +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index 952a92504df69..e33036281327d 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -142,9 +142,8 @@ struct dino_device + { + struct pci_hba_data hba; /* 'C' inheritance - must be first */ + spinlock_t dinosaur_pen; +- unsigned long txn_addr; /* EIR addr to generate interrupt */ +- u32 txn_data; /* EIR data assign to each dino */ + u32 imr; /* IRQ's which are enabled */ ++ struct gsc_irq gsc_irq; + int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ + #ifdef DINO_DEBUG + unsigned int dino_irr0; /* save most recent IRQ line stat */ +@@ -339,14 +338,43 @@ static void dino_unmask_irq(struct irq_data *d) + if (tmp & DINO_MASK_IRQ(local_irq)) { + DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", + __func__, tmp); +- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); ++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); + } + } + ++#ifdef CONFIG_SMP ++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ u32 eim; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; ++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ + static struct irq_chip dino_interrupt_type = { + .name = "GSC-PCI", + .irq_unmask = dino_unmask_irq, + .irq_mask = dino_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = dino_set_affinity_irq, ++#endif + }; + + +@@ -806,7 +834,6 @@ static int __init dino_common_init(struct parisc_device *dev, + { + int status; + u32 eim; +- struct gsc_irq gsc_irq; + struct resource *res; + + pcibios_register_hba(&dino_dev->hba); +@@ -821,10 +848,8 @@ static int __init dino_common_init(struct parisc_device *dev, + ** still only has 11 IRQ input lines - just map some of them + ** to a different processor. + */ +- dev->irq = gsc_alloc_irq(&gsc_irq); +- dino_dev->txn_addr = gsc_irq.txn_addr; +- dino_dev->txn_data = gsc_irq.txn_data; +- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; + + /* + ** Dino needs a PA "IRQ" to get a processor's attention. +diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c +index ed9371acf37eb..ec175ae998733 100644 +--- a/drivers/parisc/gsc.c ++++ b/drivers/parisc/gsc.c +@@ -135,10 +135,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) + */ + } + ++#ifdef CONFIG_SMP ++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; ++ ++ /* switch IRQ's for devices below LASI/WAX to other CPU */ ++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ ++ + static struct irq_chip gsc_asic_interrupt_type = { + .name = "GSC-ASIC", + .irq_unmask = gsc_asic_unmask_irq, + .irq_mask = gsc_asic_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = gsc_set_affinity_irq, ++#endif + }; + + int gsc_assign_irq(struct irq_chip *type, void *data) +diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h +index 86abad3fa2150..73cbd0bb1975a 100644 +--- a/drivers/parisc/gsc.h ++++ b/drivers/parisc/gsc.h +@@ -31,6 +31,7 @@ struct gsc_asic { + int version; + int type; + int eim; ++ struct gsc_irq gsc_irq; + int global_irq[32]; + }; + +diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c +index 4e4fd12c2112e..6ef621adb63a8 100644 +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -163,7 +163,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) + { + extern void (*chassis_power_off)(void); + struct gsc_asic *lasi; +- struct gsc_irq gsc_irq; + int ret; + + lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); +@@ -185,7 +184,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) + lasi_init_irq(lasi); + + /* the IRQ lasi should use */ +- dev->irq = gsc_alloc_irq(&gsc_irq); ++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -193,9 +192,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); ++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { + kfree(lasi); + return ret; +diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c +index 5b6df15162354..73a2b01f8d9ca 100644 +--- a/drivers/parisc/wax.c ++++ b/drivers/parisc/wax.c +@@ -68,7 +68,6 @@ static int __init wax_init_chip(struct parisc_device *dev) + { + struct gsc_asic *wax; + struct parisc_device *parent; +- struct gsc_irq gsc_irq; + int ret; + + wax = kzalloc(sizeof(*wax), GFP_KERNEL); +@@ -85,7 +84,7 @@ static int __init wax_init_chip(struct parisc_device *dev) + wax_init_irq(wax); + + /* the IRQ wax should use */ +- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); ++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -93,9 +92,9 @@ static int __init wax_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); ++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); + if (ret < 0) { + kfree(wax); + return ret; +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 49ff8bf10c740..af051fb886998 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -1186,7 +1186,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, + + msg->address_lo = lower_32_bits(msi_msg); + msg->address_hi = upper_32_bits(msi_msg); +- msg->data = data->irq; ++ msg->data = data->hwirq; + } + + static int advk_msi_set_affinity(struct irq_data *irq_data, +@@ -1203,15 +1203,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + int hwirq, i; + + mutex_lock(&pcie->msi_used_lock); +- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, +- 0, nr_irqs, 0); +- if (hwirq >= MSI_IRQ_NUM) { +- mutex_unlock(&pcie->msi_used_lock); +- return -ENOSPC; +- } +- +- bitmap_set(pcie->msi_used, hwirq, nr_irqs); ++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, ++ order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); ++ if (hwirq < 0) ++ return -ENOSPC; + + for (i = 0; i < nr_irqs; i++) + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -1229,7 +1225,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, + struct advk_pcie *pcie = domain->host_data; + + mutex_lock(&pcie->msi_used_lock); +- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); + } + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index d41570715dc7f..262b2c4c70c9f 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -285,7 +285,17 @@ static int pci_epf_test_copy(struct pci_epf_test *epf_test) + if (ret) + dev_err(dev, "Data transfer failed\n"); + } else { +- memcpy(dst_addr, src_addr, reg->size); ++ void *buf; ++ ++ buf = kzalloc(reg->size, GFP_KERNEL); ++ if (!buf) { ++ ret = -ENOMEM; ++ goto err_map_addr; ++ } ++ ++ memcpy_fromio(buf, src_addr, reg->size); ++ memcpy_toio(dst_addr, buf, reg->size); ++ kfree(buf); + } + ktime_get_ts64(&end); + pci_epf_test_print_rate("COPY", reg->size, &start, &end, use_dma); +@@ -441,7 +451,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test) + if (!epf_test->dma_supported) { + dev_err(dev, "Cannot transfer data using DMA\n"); + ret = -EINVAL; +- goto err_map_addr; ++ goto err_dma_map; + } + + src_phys_addr = dma_map_single(dma_dev, buf, reg->size, +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index af4c4cc837fcd..dda9523577472 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -1060,6 +1060,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, ++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, +diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c +index 23a0e008dafa2..d58810f53727c 100644 +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -739,7 +739,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + { + u64 mpidr; + int cpu_cluster_id; +- struct cluster_pmu *cluster = NULL; ++ struct cluster_pmu *cluster; + + /* + * This assumes that the cluster_id is in MPIDR[aff1] for +@@ -761,10 +761,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + cluster->cluster_id); + cpumask_set_cpu(cpu, &cluster->cluster_cpus); + *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; +- break; ++ return cluster; + } + +- return cluster; ++ return NULL; + } + + static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +diff --git a/drivers/phy/amlogic/phy-meson8b-usb2.c b/drivers/phy/amlogic/phy-meson8b-usb2.c +index 03c061dd5f0de..8f40b9342a971 100644 +--- a/drivers/phy/amlogic/phy-meson8b-usb2.c ++++ b/drivers/phy/amlogic/phy-meson8b-usb2.c +@@ -261,8 +261,9 @@ static int phy_meson8b_usb2_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk_usb); + + priv->reset = devm_reset_control_get_optional_shared(&pdev->dev, NULL); +- if (PTR_ERR(priv->reset) == -EPROBE_DEFER) +- return PTR_ERR(priv->reset); ++ if (IS_ERR(priv->reset)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(priv->reset), ++ "Failed to get the reset line"); + + priv->dr_mode = of_usb_get_dr_mode_by_phy(pdev->dev.of_node, -1); + if (priv->dr_mode == USB_DR_MODE_UNKNOWN) { +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index e84b6e4da14a8..9fda98b950bab 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + union power_supply_propval *val) + { + struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); +- struct iio_channel *chan; + int ret = 0, reg, val1; + + switch (psp) { +@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + if (ret) + return ret; + +- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) +- chan = axp20x_batt->batt_chrg_i; +- else +- chan = axp20x_batt->batt_dischrg_i; +- +- ret = iio_read_channel_processed(chan, &val->intval); ++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { ++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); ++ } else { ++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); ++ val->intval = -val1; ++ } + if (ret) + return ret; + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index a4df1ea923864..f65bf7b295c59 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -41,11 +41,11 @@ + #define VBUS_ISPOUT_CUR_LIM_1500MA 0x1 /* 1500mA */ + #define VBUS_ISPOUT_CUR_LIM_2000MA 0x2 /* 2000mA */ + #define VBUS_ISPOUT_CUR_NO_LIM 0x3 /* 2500mA */ +-#define VBUS_ISPOUT_VHOLD_SET_MASK 0x31 ++#define VBUS_ISPOUT_VHOLD_SET_MASK 0x38 + #define VBUS_ISPOUT_VHOLD_SET_BIT_POS 0x3 + #define VBUS_ISPOUT_VHOLD_SET_OFFSET 4000 /* 4000mV */ + #define VBUS_ISPOUT_VHOLD_SET_LSB_RES 100 /* 100mV */ +-#define VBUS_ISPOUT_VHOLD_SET_4300MV 0x3 /* 4300mV */ ++#define VBUS_ISPOUT_VHOLD_SET_4400MV 0x4 /* 4400mV */ + #define VBUS_ISPOUT_VBUS_PATH_DIS BIT(7) + + #define CHRG_CCCV_CC_MASK 0xf /* 4 bits */ +@@ -744,6 +744,16 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + ret = axp288_charger_vbus_path_select(info, true); + if (ret < 0) + return ret; ++ } else { ++ /* Set Vhold to the factory default / recommended 4.4V */ ++ val = VBUS_ISPOUT_VHOLD_SET_4400MV << VBUS_ISPOUT_VHOLD_SET_BIT_POS; ++ ret = regmap_update_bits(info->regmap, AXP20X_VBUS_IPSOUT_MGMT, ++ VBUS_ISPOUT_VHOLD_SET_MASK, val); ++ if (ret < 0) { ++ dev_err(&info->pdev->dev, "register(%x) write error(%d)\n", ++ AXP20X_VBUS_IPSOUT_MGMT, ret); ++ return ret; ++ } + } + + /* Read current charge voltage and current limit */ +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index be076a91e20e6..8cd59e8481631 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -13,7 +13,7 @@ static ssize_t clock_name_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); ++ return sysfs_emit(page, "%s\n", ptp->info->name); + } + static DEVICE_ATTR_RO(clock_name); + +@@ -227,7 +227,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, + + mutex_unlock(&ptp->pincfg_mux); + +- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); ++ return sysfs_emit(page, "%u %u\n", func, chan); + } + + static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c +index 2018614f258f6..6eaa9321c0741 100644 +--- a/drivers/rtc/rtc-wm8350.c ++++ b/drivers/rtc/rtc-wm8350.c +@@ -432,14 +432,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) + return ret; + } + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, + wm8350_rtc_update_handler, 0, + "RTC Seconds", wm8350); ++ if (ret) ++ return ret; ++ + wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, + wm8350_rtc_alarm_handler, 0, + "RTC Alarm", wm8350); ++ if (ret) { ++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); ++ return ret; ++ } + + return 0; + } +diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c +index d8e19afa7a140..c6607c4686bb7 100644 +--- a/drivers/scsi/aha152x.c ++++ b/drivers/scsi/aha152x.c +@@ -3367,13 +3367,11 @@ static int __init aha152x_setup(char *str) + setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; + setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; + setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; +- if (ints[0] > 8) { /*}*/ ++ if (ints[0] > 8) + printk(KERN_NOTICE "aha152x: usage: aha152x=[,[," + "[,[,[,[,[,]]]]]]]\n"); +- } else { ++ else + setup_count++; +- return 0; +- } + + return 1; + } +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 5ae1e3f789101..e049cdb3c286c 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -711,7 +711,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, + char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; + + bfa_get_adapter_serial_num(&bfad->bfa, serial_num); +- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); ++ return sysfs_emit(buf, "%s\n", serial_num); + } + + static ssize_t +@@ -725,7 +725,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, + char model[BFA_ADAPTER_MODEL_NAME_LEN]; + + bfa_get_adapter_model(&bfad->bfa, model); +- return snprintf(buf, PAGE_SIZE, "%s\n", model); ++ return sysfs_emit(buf, "%s\n", model); + } + + static ssize_t +@@ -805,7 +805,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, + snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, + "Invalid Model"); + +- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); ++ return sysfs_emit(buf, "%s\n", model_descr); + } + + static ssize_t +@@ -819,7 +819,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, + u64 nwwn; + + nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); +- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); ++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); + } + + static ssize_t +@@ -836,7 +836,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); + strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); +- return snprintf(buf, PAGE_SIZE, "%s\n", symname); ++ return sysfs_emit(buf, "%s\n", symname); + } + + static ssize_t +@@ -850,14 +850,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, + char hw_ver[BFA_VERSION_LEN]; + + bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); ++ return sysfs_emit(buf, "%s\n", hw_ver); + } + + static ssize_t + bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); + } + + static ssize_t +@@ -871,7 +871,7 @@ bfad_im_optionrom_version_show(struct device *dev, + char optrom_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); ++ return sysfs_emit(buf, "%s\n", optrom_ver); + } + + static ssize_t +@@ -885,7 +885,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, + char fw_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); ++ return sysfs_emit(buf, "%s\n", fw_ver); + } + + static ssize_t +@@ -897,7 +897,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, + (struct bfad_im_port_s *) shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + +- return snprintf(buf, PAGE_SIZE, "%d\n", ++ return sysfs_emit(buf, "%d\n", + bfa_get_nports(&bfad->bfa)); + } + +@@ -905,7 +905,7 @@ static ssize_t + bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); + } + + static ssize_t +@@ -924,14 +924,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, + rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), + GFP_ATOMIC); + if (rports == NULL) +- return snprintf(buf, PAGE_SIZE, "Failed\n"); ++ return sysfs_emit(buf, "Failed\n"); + + spin_lock_irqsave(&bfad->bfad_lock, flags); + bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); + kfree(rports); + +- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); ++ return sysfs_emit(buf, "%d\n", nrports); + } + + static DEVICE_ATTR(serial_number, S_IRUGO, +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index a8998b016b862..cd41dc061d874 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2372,17 +2372,25 @@ static irqreturn_t cq_interrupt_v3_hw(int irq_no, void *p) + return IRQ_WAKE_THREAD; + } + ++static void hisi_sas_v3_free_vectors(void *data) ++{ ++ struct pci_dev *pdev = data; ++ ++ pci_free_irq_vectors(pdev); ++} ++ + static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + { + int vectors; + int max_msi = HISI_SAS_MSI_COUNT_V3_HW, min_msi; + struct Scsi_Host *shost = hisi_hba->shost; ++ struct pci_dev *pdev = hisi_hba->pci_dev; + struct irq_affinity desc = { + .pre_vectors = BASE_VECTORS_V3_HW, + }; + + min_msi = MIN_AFFINE_VECTORS_V3_HW; +- vectors = pci_alloc_irq_vectors_affinity(hisi_hba->pci_dev, ++ vectors = pci_alloc_irq_vectors_affinity(pdev, + min_msi, max_msi, + PCI_IRQ_MSI | + PCI_IRQ_AFFINITY, +@@ -2394,6 +2402,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW; + shost->nr_hw_queues = hisi_hba->cq_nvecs; + ++ devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); + return 0; + } + +@@ -3313,7 +3322,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + dev_err(dev, "%d hw queues\n", shost->nr_hw_queues); + rc = scsi_add_host(shost, dev); + if (rc) +- goto err_out_free_irq_vectors; ++ goto err_out_debugfs; + + rc = sas_register_ha(sha); + if (rc) +@@ -3340,8 +3349,6 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + err_out_register_ha: + scsi_remove_host(shost); +-err_out_free_irq_vectors: +- pci_free_irq_vectors(pdev); + err_out_debugfs: + hisi_sas_debugfs_exit(hisi_hba); + err_out_ha: +@@ -3369,7 +3376,6 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba) + + devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq); + } +- pci_free_irq_vectors(pdev); + } + + static void hisi_sas_v3_remove(struct pci_dev *pdev) +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index a50f1eef0e0cd..4261380af97b4 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1702,6 +1702,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) + if (cancel_delayed_work_sync(&ep->timeout_work)) { + FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); + fc_exch_release(ep); /* release from pending timer hold */ ++ return; + } + + spin_lock_bh(&ep->ex_lock); +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index b03c0f35d7b04..0cfea7b2ab13a 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -697,7 +697,7 @@ static ssize_t + mvs_show_driver_version(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); ++ return sysfs_emit(buffer, "%s\n", DRV_VERSION); + } + + static DEVICE_ATTR(driver_version, +@@ -749,7 +749,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, + static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); ++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); + } + + static DEVICE_ATTR(interrupt_coalescing, +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index cd0e1d31db701..da9fbe62a34d1 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1711,7 +1711,6 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + } + + task = sas_alloc_slow_task(GFP_ATOMIC); +- + if (!task) { + pm8001_dbg(pm8001_ha, FAIL, "cannot allocate task\n"); + return; +@@ -1720,8 +1719,10 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + task->task_done = pm8001_task_done; + + res = pm8001_tag_alloc(pm8001_ha, &ccb_tag); +- if (res) ++ if (res) { ++ sas_free_task(task); + return; ++ } + + ccb = &pm8001_ha->ccb_info[ccb_tag]; + ccb->device = pm8001_ha_dev; +@@ -1738,8 +1739,10 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &task_abort, + sizeof(task_abort), 0); +- if (ret) ++ if (ret) { ++ sas_free_task(task); + pm8001_tag_free(pm8001_ha, ccb_tag); ++ } + + } + +@@ -3669,12 +3672,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + mb(); + + if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { +- pm8001_tag_free(pm8001_ha, tag); + sas_free_task(t); +- /* clear the flag */ +- pm8001_dev->id &= 0xBFFFFFFF; +- } else ++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; ++ } else { + t->task_done(t); ++ } + + return 0; + } +@@ -4428,6 +4430,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + SAS_ADDR_SIZE); + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, + sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ + return rc; + } + +@@ -4840,6 +4845,11 @@ pm8001_chip_fw_flash_update_req(struct pm8001_hba_info *pm8001_ha, + ccb->ccb_tag = tag; + rc = pm8001_chip_fw_flash_update_build(pm8001_ha, &flash_update_info, + tag); ++ if (rc) { ++ kfree(fw_control_context); ++ pm8001_tag_free(pm8001_ha, tag); ++ } ++ + return rc; + } + +@@ -4944,6 +4954,9 @@ pm8001_chip_set_dev_state_req(struct pm8001_hba_info *pm8001_ha, + payload.nds = cpu_to_le32(state); + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, + sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ + return rc; + + } +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 75ac4d86d9c4b..ba5852548bee3 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -831,10 +831,10 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, + + res = PM8001_CHIP_DISP->task_abort(pm8001_ha, + pm8001_dev, flag, task_tag, ccb_tag); +- + if (res) { + del_timer(&task->slow_task->timer); + pm8001_dbg(pm8001_ha, FAIL, "Executing internal task failed\n"); ++ pm8001_tag_free(pm8001_ha, ccb_tag); + goto ex_err; + } + wait_for_completion(&task->slow_task->completion); +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index b5e60553acdc5..4c03bf08b543c 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -66,18 +66,16 @@ int pm80xx_bar4_shift(struct pm8001_hba_info *pm8001_ha, u32 shift_value) + } + + static void pm80xx_pci_mem_copy(struct pm8001_hba_info *pm8001_ha, u32 soffset, +- const void *destination, ++ __le32 *destination, + u32 dw_count, u32 bus_base_number) + { + u32 index, value, offset; +- u32 *destination1; +- destination1 = (u32 *)destination; + +- for (index = 0; index < dw_count; index += 4, destination1++) { ++ for (index = 0; index < dw_count; index += 4, destination++) { + offset = (soffset + index); + if (offset < (64 * 1024)) { + value = pm8001_cr32(pm8001_ha, bus_base_number, offset); +- *destination1 = cpu_to_le32(value); ++ *destination = cpu_to_le32(value); + } + } + return; +@@ -4849,8 +4847,13 @@ static int pm80xx_chip_phy_ctl_req(struct pm8001_hba_info *pm8001_ha, + payload.tag = cpu_to_le32(tag); + payload.phyop_phyid = + cpu_to_le32(((phy_op & 0xFF) << 8) | (phyId & 0xFF)); +- return pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, +- sizeof(payload), 0); ++ ++ rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, ++ sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ ++ return rc; + } + + static u32 pm80xx_chip_is_our_interrupt(struct pm8001_hba_info *pm8001_ha) +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index 27b9e2baab1a6..7acf9193a9e80 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -159,6 +159,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 4a80f043b7b17..766b00350e391 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1032,7 +1032,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + addr = op->addr.val; + len = op->data.nbytes; + +- if (bcm_qspi_bspi_ver_three(qspi) == true) { ++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { + /* + * The address coming into this function is a raw flash offset. + * But for BSPI <= V3, we need to convert it to a remapped BSPI +@@ -1051,7 +1051,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + len < 4) + mspi_read = true; + +- if (mspi_read) ++ if (!has_bspi(qspi) || mspi_read) + return bcm_qspi_mspi_exec_mem_op(spi, op); + + ret = bcm_qspi_bspi_set_mode(qspi, op, 0); +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +index 38b10fd5d9921..95b91fe45cb38 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -2280,6 +2280,9 @@ void vchiq_msg_queue_push(unsigned int handle, struct vchiq_header *header) + struct vchiq_service *service = find_service_by_handle(handle); + int pos; + ++ if (!service) ++ return; ++ + while (service->msg_queue_write == service->msg_queue_read + + VCHIQ_MAX_SLOTS) { + if (wait_for_completion_interruptible(&service->msg_queue_pop)) +@@ -2299,6 +2302,9 @@ struct vchiq_header *vchiq_msg_hold(unsigned int handle) + struct vchiq_header *header; + int pos; + ++ if (!service) ++ return NULL; ++ + if (service->msg_queue_write == service->msg_queue_read) + return NULL; + +diff --git a/drivers/staging/wfx/main.c b/drivers/staging/wfx/main.c +index e7bc1988124a8..d5dacd5583c6e 100644 +--- a/drivers/staging/wfx/main.c ++++ b/drivers/staging/wfx/main.c +@@ -309,7 +309,8 @@ struct wfx_dev *wfx_init_common(struct device *dev, + wdev->pdata.gpio_wakeup = devm_gpiod_get_optional(dev, "wakeup", + GPIOD_OUT_LOW); + if (IS_ERR(wdev->pdata.gpio_wakeup)) +- return NULL; ++ goto err; ++ + if (wdev->pdata.gpio_wakeup) + gpiod_set_consumer_name(wdev->pdata.gpio_wakeup, "wfx wakeup"); + +@@ -328,6 +329,10 @@ struct wfx_dev *wfx_init_common(struct device *dev, + return NULL; + + return wdev; ++ ++err: ++ ieee80211_free_hw(hw); ++ return NULL; + } + + int wfx_probe(struct wfx_dev *wdev) +diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c +index 8ae3e03fbd8ce..81faead3c4f80 100644 +--- a/drivers/tty/serial/samsung_tty.c ++++ b/drivers/tty/serial/samsung_tty.c +@@ -883,11 +883,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) + goto out; + } + +- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { +- spin_unlock(&port->lock); ++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- spin_lock(&port->lock); +- } + + if (uart_circ_empty(xmit)) + s3c24xx_serial_stop_tx(port); +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index e196673f5c647..efaf0db595f46 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -242,7 +242,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + break; + + case OMAP_DWC3_ID_FLOAT: +- if (omap->vbus_reg) ++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) + regulator_disable(omap->vbus_reg); + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 57ee72fead45a..de178bf264c21 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -32,9 +32,6 @@ + #include + + /* XUSB_DEV registers */ +-#define SPARAM 0x000 +-#define SPARAM_ERSTMAX_MASK GENMASK(20, 16) +-#define SPARAM_ERSTMAX(x) (((x) << 16) & SPARAM_ERSTMAX_MASK) + #define DB 0x004 + #define DB_TARGET_MASK GENMASK(15, 8) + #define DB_TARGET(x) (((x) << 8) & DB_TARGET_MASK) +@@ -275,8 +272,10 @@ BUILD_EP_CONTEXT_RW(deq_hi, deq_hi, 0, 0xffffffff) + BUILD_EP_CONTEXT_RW(avg_trb_len, tx_info, 0, 0xffff) + BUILD_EP_CONTEXT_RW(max_esit_payload, tx_info, 16, 0xffff) + BUILD_EP_CONTEXT_RW(edtla, rsvd[0], 0, 0xffffff) +-BUILD_EP_CONTEXT_RW(seq_num, rsvd[0], 24, 0xff) ++BUILD_EP_CONTEXT_RW(rsvd, rsvd[0], 24, 0x1) + BUILD_EP_CONTEXT_RW(partial_td, rsvd[0], 25, 0x1) ++BUILD_EP_CONTEXT_RW(splitxstate, rsvd[0], 26, 0x1) ++BUILD_EP_CONTEXT_RW(seq_num, rsvd[0], 27, 0x1f) + BUILD_EP_CONTEXT_RW(cerrcnt, rsvd[1], 18, 0x3) + BUILD_EP_CONTEXT_RW(data_offset, rsvd[2], 0, 0x1ffff) + BUILD_EP_CONTEXT_RW(numtrbs, rsvd[2], 22, 0x1f) +@@ -1557,6 +1556,9 @@ static int __tegra_xudc_ep_set_halt(struct tegra_xudc_ep *ep, bool halt) + ep_reload(xudc, ep->index); + + ep_ctx_write_state(ep->context, EP_STATE_RUNNING); ++ ep_ctx_write_rsvd(ep->context, 0); ++ ep_ctx_write_partial_td(ep->context, 0); ++ ep_ctx_write_splitxstate(ep->context, 0); + ep_ctx_write_seq_num(ep->context, 0); + + ep_reload(xudc, ep->index); +@@ -2812,7 +2814,10 @@ static void tegra_xudc_reset(struct tegra_xudc *xudc) + xudc->setup_seq_num = 0; + xudc->queued_setup_packet = false; + +- ep_ctx_write_seq_num(ep0->context, xudc->setup_seq_num); ++ ep_ctx_write_rsvd(ep0->context, 0); ++ ep_ctx_write_partial_td(ep0->context, 0); ++ ep_ctx_write_splitxstate(ep0->context, 0); ++ ep_ctx_write_seq_num(ep0->context, 0); + + deq_ptr = trb_virt_to_phys(ep0, &ep0->transfer_ring[ep0->deq_ptr]); + +@@ -3295,11 +3300,6 @@ static void tegra_xudc_init_event_ring(struct tegra_xudc *xudc) + unsigned int i; + u32 val; + +- val = xudc_readl(xudc, SPARAM); +- val &= ~(SPARAM_ERSTMAX_MASK); +- val |= SPARAM_ERSTMAX(XUDC_NR_EVENT_RINGS); +- xudc_writel(xudc, val, SPARAM); +- + for (i = 0; i < ARRAY_SIZE(xudc->event_ring); i++) { + memset(xudc->event_ring[i], 0, XUDC_EVENT_RING_SIZE * + sizeof(*xudc->event_ring[i])); +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index e87cf3a00fa4b..638f03b897394 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; + /* defined here to avoid adding to pci_ids.h for single instance use */ + #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 + ++#define PCI_VENDOR_ID_ASPEED 0x1a03 ++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 ++ + /*-------------------------------------------------------------------------*/ + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 + static inline bool is_intel_quark_x1000(struct pci_dev *pdev) +@@ -222,6 +225,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci->has_synopsys_hc_bug = 1; + } + break; ++ case PCI_VENDOR_ID_ASPEED: ++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { ++ ehci_info(ehci, "applying Aspeed HC workaround\n"); ++ ehci->is_aspeed = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index da02c3e96e7b2..e303f6f073d2b 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, + goto signal_used; + + msghdr->msg_control = &ctl; ++ msghdr->msg_controllen = sizeof(ctl); + err = sock->ops->sendmsg(sock, msghdr, 0); + if (unlikely(err < 0)) { + vq_err(&nvq->vq, "Fail to batch sending packets\n"); +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 974d02bb3a45c..6546d029c7fd6 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -2092,16 +2092,20 @@ static ssize_t w1_seq_show(struct device *device, + if (sl->reg_num.id == reg_num->id) + seq = i; + ++ if (w1_reset_bus(sl->master)) ++ goto error; ++ ++ /* Put the device into chain DONE state */ ++ w1_write_8(sl->master, W1_MATCH_ROM); ++ w1_write_block(sl->master, (u8 *)&rn, 8); + w1_write_8(sl->master, W1_42_CHAIN); + w1_write_8(sl->master, W1_42_CHAIN_DONE); + w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); +- w1_read_block(sl->master, &ack, sizeof(ack)); + + /* check for acknowledgment */ + ack = w1_read_8(sl->master); + if (ack != W1_42_SUCCESS_CONFIRM_BYTE) + goto error; +- + } + + /* Exit from CHAIN state */ +diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h +index f39d02e7f7efe..16f44bc481ab4 100644 +--- a/fs/btrfs/extent_io.h ++++ b/fs/btrfs/extent_io.h +@@ -121,7 +121,7 @@ struct extent_buffer { + */ + struct extent_changeset { + /* How many bytes are set/cleared in this operation */ +- unsigned int bytes_changed; ++ u64 bytes_changed; + + /* Changed ranges */ + struct ulist range_changed; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 1d9262a35473c..f7f4ac01589bc 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4023,6 +4023,13 @@ int btrfs_delete_subvolume(struct inode *dir, struct dentry *dentry) + dest->root_key.objectid); + return -EPERM; + } ++ if (atomic_read(&dest->nr_swapfiles)) { ++ spin_unlock(&dest->root_item_lock); ++ btrfs_warn(fs_info, ++ "attempt to delete subvolume %llu with active swapfile", ++ root->root_key.objectid); ++ return -EPERM; ++ } + root_flags = btrfs_root_flags(&dest->root_item); + btrfs_set_root_flags(&dest->root_item, + root_flags | BTRFS_ROOT_SUBVOL_DEAD); +@@ -10215,8 +10222,23 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + * set. We use this counter to prevent snapshots. We must increment it + * before walking the extents because we don't want a concurrent + * snapshot to run after we've already checked the extents. ++ * ++ * It is possible that subvolume is marked for deletion but still not ++ * removed yet. To prevent this race, we check the root status before ++ * activating the swapfile. + */ ++ spin_lock(&root->root_item_lock); ++ if (btrfs_root_dead(root)) { ++ spin_unlock(&root->root_item_lock); ++ ++ btrfs_exclop_finish(fs_info); ++ btrfs_warn(fs_info, ++ "cannot activate swapfile because subvolume %llu is being deleted", ++ root->root_key.objectid); ++ return -EPERM; ++ } + atomic_inc(&root->nr_swapfiles); ++ spin_unlock(&root->root_item_lock); + + isize = ALIGN_DOWN(inode->i_size, fs_info->sectorsize); + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index f63c1a090139c..1fddb9cd3e88e 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -478,8 +478,11 @@ more: + 2 : (fpos_off(rde->offset) + 1); + err = note_last_dentry(dfi, rde->name, rde->name_len, + next_offset); +- if (err) ++ if (err) { ++ ceph_mdsc_put_request(dfi->last_readdir); ++ dfi->last_readdir = NULL; + return err; ++ } + } else if (req->r_reply_info.dir_end) { + dfi->next_offset = 2; + /* keep last name */ +@@ -520,6 +523,12 @@ more: + if (!dir_emit(ctx, rde->name, rde->name_len, + ceph_present_ino(inode->i_sb, le64_to_cpu(rde->inode.in->ino)), + le32_to_cpu(rde->inode.in->mode) >> 12)) { ++ /* ++ * NOTE: Here no need to put the 'dfi->last_readdir', ++ * because when dir_emit stops us it's most likely ++ * doesn't have enough memory, etc. So for next readdir ++ * it will continue. ++ */ + dout("filldir stopping us...\n"); + return 0; + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index b34c02985d9d2..6c047570d6a94 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -2200,7 +2200,7 @@ int gfs2_setattr_size(struct inode *inode, u64 newsize) + + ret = do_shrink(inode, newsize); + out: +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_delete(ip); + gfs2_qa_put(ip); + return ret; + } +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index cfd9d03f604fe..2e6f622ed4283 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -717,7 +717,8 @@ static int gfs2_release(struct inode *inode, struct file *file) + file->private_data = NULL; + + if (file->f_mode & FMODE_WRITE) { +- gfs2_rs_delete(ip, &inode->i_writecount); ++ if (gfs2_rs_active(&ip->i_res)) ++ gfs2_rs_delete(ip); + gfs2_qa_put(ip); + } + return 0; +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 65ae4fc28ede4..74a6b0800e059 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -811,7 +811,7 @@ fail_free_inode: + if (free_vfs_inode) /* else evict will do the put for us */ + gfs2_glock_put(ip->i_gl); + } +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_deltree(&ip->i_res); + gfs2_qa_put(ip); + fail_free_acls: + posix_acl_release(default_acl); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index eb775e93de97c..dc55b029afaa4 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -664,13 +664,14 @@ void gfs2_rs_deltree(struct gfs2_blkreserv *rs) + /** + * gfs2_rs_delete - delete a multi-block reservation + * @ip: The inode for this reservation +- * @wcount: The inode's write count, or NULL + * + */ +-void gfs2_rs_delete(struct gfs2_inode *ip, atomic_t *wcount) ++void gfs2_rs_delete(struct gfs2_inode *ip) + { ++ struct inode *inode = &ip->i_inode; ++ + down_write(&ip->i_rw_mutex); +- if ((wcount == NULL) || (atomic_read(wcount) <= 1)) ++ if (atomic_read(&inode->i_writecount) <= 1) + gfs2_rs_deltree(&ip->i_res); + up_write(&ip->i_rw_mutex); + } +diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h +index 9a587ada51eda..2d3c150c55bd5 100644 +--- a/fs/gfs2/rgrp.h ++++ b/fs/gfs2/rgrp.h +@@ -45,7 +45,7 @@ extern int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n, + bool dinode, u64 *generation); + + extern void gfs2_rs_deltree(struct gfs2_blkreserv *rs); +-extern void gfs2_rs_delete(struct gfs2_inode *ip, atomic_t *wcount); ++extern void gfs2_rs_delete(struct gfs2_inode *ip); + extern void __gfs2_free_blocks(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, + u64 bstart, u32 blen, int meta); + extern void gfs2_free_meta(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index d2b7ecbd1b150..d14b98aa1c3eb 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -1434,7 +1434,7 @@ out: + truncate_inode_pages_final(&inode->i_data); + if (ip->i_qadata) + gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0); +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_deltree(&ip->i_res); + gfs2_ordered_del_inode(ip); + clear_inode(inode); + gfs2_dir_hash_inval(ip); +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 5959b0359524c..ab9290ab4cae0 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -1556,6 +1556,7 @@ static void __io_queue_deferred(struct io_ring_ctx *ctx) + + static void io_flush_timeouts(struct io_ring_ctx *ctx) + { ++ struct io_kiocb *req, *tmp; + u32 seq; + + if (list_empty(&ctx->timeout_list)) +@@ -1563,10 +1564,8 @@ static void io_flush_timeouts(struct io_ring_ctx *ctx) + + seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts); + +- do { ++ list_for_each_entry_safe(req, tmp, &ctx->timeout_list, timeout.list) { + u32 events_needed, events_got; +- struct io_kiocb *req = list_first_entry(&ctx->timeout_list, +- struct io_kiocb, timeout.list); + + if (io_is_timeout_noseq(req)) + break; +@@ -1583,9 +1582,8 @@ static void io_flush_timeouts(struct io_ring_ctx *ctx) + if (events_got < events_needed) + break; + +- list_del_init(&req->timeout.list); + io_kill_timeout(req, 0); +- } while (!list_empty(&ctx->timeout_list)); ++ } + + ctx->cq_last_tm_flush = seq; + } +@@ -5639,6 +5637,7 @@ static int io_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe, + else + data->mode = HRTIMER_MODE_REL; + ++ INIT_LIST_HEAD(&req->timeout.list); + hrtimer_init(&data->timer, CLOCK_MONOTONIC, data->mode); + return 0; + } +@@ -6282,12 +6281,12 @@ static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer) + if (!list_empty(&req->link_list)) { + prev = list_entry(req->link_list.prev, struct io_kiocb, + link_list); +- if (refcount_inc_not_zero(&prev->refs)) +- list_del_init(&req->link_list); +- else ++ list_del_init(&req->link_list); ++ if (!refcount_inc_not_zero(&prev->refs)) + prev = NULL; + } + ++ list_del(&req->timeout.list); + spin_unlock_irqrestore(&ctx->completion_lock, flags); + + if (prev) { +@@ -7346,8 +7345,12 @@ static int __io_sqe_files_scm(struct io_ring_ctx *ctx, int nr, int offset) + refcount_add(skb->truesize, &sk->sk_wmem_alloc); + skb_queue_head(&sk->sk_receive_queue, skb); + +- for (i = 0; i < nr_files; i++) +- fput(fpl->fp[i]); ++ for (i = 0; i < nr; i++) { ++ struct file *file = io_file_from_index(ctx, i + offset); ++ ++ if (file) ++ fput(file); ++ } + } else { + kfree_skb(skb); + free_uid(fpl->user); +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index b0eb9c85eea0c..980aa3300f106 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode) + dquot_initialize(inode); + + if (JFS_IP(inode)->fileset == FILESYSTEM_I) { ++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; + truncate_inode_pages_final(&inode->i_data); + + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- if (JFS_SBI(inode->i_sb)->ipimap) ++ if (ipimap && JFS_IP(ipimap)->i_imap) + diFree(inode); + + /* +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 34f546404aa11..e938f5b1e4b94 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -446,7 +446,8 @@ static const struct address_space_operations minix_aops = { + .writepage = minix_writepage, + .write_begin = minix_write_begin, + .write_end = generic_write_end, +- .bmap = minix_bmap ++ .bmap = minix_bmap, ++ .direct_IO = noop_direct_IO + }; + + static const struct inode_operations minix_symlink_inode_operations = { +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 2ad56ff4752c7..9f88ca7b20015 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1628,16 +1628,6 @@ const struct dentry_operations nfs4_dentry_operations = { + }; + EXPORT_SYMBOL_GPL(nfs4_dentry_operations); + +-static fmode_t flags_to_mode(int flags) +-{ +- fmode_t res = (__force fmode_t)flags & FMODE_EXEC; +- if ((flags & O_ACCMODE) != O_WRONLY) +- res |= FMODE_READ; +- if ((flags & O_ACCMODE) != O_RDONLY) +- res |= FMODE_WRITE; +- return res; +-} +- + static struct nfs_open_context *create_nfs_open_context(struct dentry *dentry, int open_flags, struct file *filp) + { + return alloc_nfs_open_context(dentry, flags_to_mode(open_flags), filp); +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 3c0335c15a730..c220810c61d14 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -172,8 +172,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); + + if (iov_iter_rw(iter) == READ) +- return nfs_file_direct_read(iocb, iter); +- return nfs_file_direct_write(iocb, iter); ++ return nfs_file_direct_read(iocb, iter, true); ++ return nfs_file_direct_write(iocb, iter, true); + } + + static void nfs_direct_release_pages(struct page **pages, unsigned int npages) +@@ -424,6 +424,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_read - file direct read operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers into which to read data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct reads instead of calling + * generic_file_aio_read() in order to avoid gfar's check to see if +@@ -439,7 +440,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * client must read the updated atime from the server back into its + * cache. + */ +-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + struct file *file = iocb->ki_filp; + struct address_space *mapping = file->f_mapping; +@@ -481,12 +483,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (iter_is_iovec(iter)) + dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; + +- nfs_start_io_direct(inode); ++ if (!swap) ++ nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; + requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); + +- nfs_end_io_direct(inode); ++ if (!swap) ++ nfs_end_io_direct(inode); + + if (requested > 0) { + result = nfs_direct_wait(dreq); +@@ -789,7 +793,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { + */ + static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + struct iov_iter *iter, +- loff_t pos) ++ loff_t pos, int ioflags) + { + struct nfs_pageio_descriptor desc; + struct inode *inode = dreq->inode; +@@ -797,7 +801,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + size_t requested_bytes = 0; + size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); + +- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, ++ nfs_pageio_init_write(&desc, inode, ioflags, false, + &nfs_direct_write_completion_ops); + desc.pg_dreq = dreq; + get_dreq(dreq); +@@ -875,6 +879,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_write - file direct write operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers from which to write data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct writes instead of calling + * generic_file_aio_write() in order to avoid taking the inode +@@ -891,7 +896,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * Note that O_APPEND is not supported for NFS direct writes, as there + * is no atomic O_APPEND write facility in the NFS protocol. + */ +-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + ssize_t result, requested; + size_t count; +@@ -905,7 +911,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", + file, iov_iter_count(iter), (long long) iocb->ki_pos); + +- result = generic_write_checks(iocb, iter); ++ if (swap) ++ /* bypass generic checks */ ++ result = iov_iter_count(iter); ++ else ++ result = generic_write_checks(iocb, iter); + if (result <= 0) + return result; + count = result; +@@ -936,16 +946,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dreq->iocb = iocb; + pnfs_init_ds_commit_info_ops(&dreq->ds_cinfo, inode); + +- nfs_start_io_direct(inode); ++ if (swap) { ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_STABLE); ++ } else { ++ nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_COND_STABLE); + +- if (mapping->nrpages) { +- invalidate_inode_pages2_range(mapping, +- pos >> PAGE_SHIFT, end); +- } ++ if (mapping->nrpages) { ++ invalidate_inode_pages2_range(mapping, ++ pos >> PAGE_SHIFT, end); ++ } + +- nfs_end_io_direct(inode); ++ nfs_end_io_direct(inode); ++ } + + if (requested > 0) { + result = nfs_direct_wait(dreq); +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 63940a7a70be1..7b47f9b063f1f 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -161,7 +161,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) + ssize_t result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_read(iocb, to); ++ return nfs_file_direct_read(iocb, to, false); + + dprintk("NFS: read(%pD2, %zu@%lu)\n", + iocb->ki_filp, +@@ -616,7 +616,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + return result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_write(iocb, from); ++ return nfs_file_direct_write(iocb, from, false); + + dprintk("NFS: write(%pD2, %zu@%Ld)\n", + file, iov_iter_count(from), (long long) iocb->ki_pos); +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index f27ecc2e490f2..1adece1cff3ed 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1139,7 +1139,6 @@ int nfs_open(struct inode *inode, struct file *filp) + nfs_fscache_open_file(inode, filp); + return 0; + } +-EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index 98554dd18a715..7009a8dddd45b 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -42,6 +42,16 @@ static inline bool nfs_lookup_is_soft_revalidate(const struct dentry *dentry) + return true; + } + ++static inline fmode_t flags_to_mode(int flags) ++{ ++ fmode_t res = (__force fmode_t)flags & FMODE_EXEC; ++ if ((flags & O_ACCMODE) != O_WRONLY) ++ res |= FMODE_READ; ++ if ((flags & O_ACCMODE) != O_RDONLY) ++ res |= FMODE_WRITE; ++ return res; ++} ++ + /* + * Note: RFC 1813 doesn't limit the number of auth flavors that + * a server can return, so make something up. +@@ -578,6 +588,13 @@ nfs_write_match_verf(const struct nfs_writeverf *verf, + !nfs_write_verifier_cmp(&req->wb_verf, &verf->verifier); + } + ++static inline gfp_t nfs_io_gfp_mask(void) ++{ ++ if (current->flags & PF_WQ_WORKER) ++ return GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN; ++ return GFP_KERNEL; ++} ++ + /* unlink.c */ + extern struct rpc_task * + nfs_async_rename(struct inode *old_dir, struct inode *new_dir, +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 2587b1b8e2ef7..dad32b171e677 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -567,8 +567,10 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + + ctx = get_nfs_open_context(nfs_file_open_context(src)); + l_ctx = nfs_get_lock_context(ctx); +- if (IS_ERR(l_ctx)) +- return PTR_ERR(l_ctx); ++ if (IS_ERR(l_ctx)) { ++ status = PTR_ERR(l_ctx); ++ goto out; ++ } + + status = nfs4_set_rw_stateid(&args->cna_src_stateid, ctx, l_ctx, + FMODE_READ); +@@ -576,7 +578,7 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + if (status) { + if (status == -EAGAIN) + status = -NFS4ERR_BAD_STATEID; +- return status; ++ goto out; + } + + status = nfs4_call_sync(src_server->client, src_server, &msg, +@@ -584,6 +586,7 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + if (status == -ENOTSUPP) + src_server->caps &= ~NFS_CAP_COPY_NOTIFY; + ++out: + put_nfs_open_context(nfs_file_open_context(src)); + return status; + } +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index a1e5c6b85dedc..9fdecd9090493 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -32,6 +32,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) + struct dentry *parent = NULL; + struct inode *dir; + unsigned openflags = filp->f_flags; ++ fmode_t f_mode; + struct iattr attr; + int err; + +@@ -50,8 +51,9 @@ nfs4_file_open(struct inode *inode, struct file *filp) + if (err) + return err; + ++ f_mode = filp->f_mode; + if ((openflags & O_ACCMODE) == 3) +- return nfs_open(inode, filp); ++ f_mode |= flags_to_mode(openflags); + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); +@@ -59,7 +61,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) + parent = dget_parent(dentry); + dir = d_inode(parent); + +- ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode, filp); ++ ctx = alloc_nfs_open_context(file_dentry(filp), f_mode, filp); + err = PTR_ERR(ctx); + if (IS_ERR(ctx)) + goto out; +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index cbeec29e9f21a..a8fe8f84c5ae0 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2557,9 +2558,17 @@ static void nfs4_layoutreturn_any_run(struct nfs_client *clp) + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + trace_nfs4_state_mgr(clp); +@@ -2654,6 +2663,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2671,6 +2681,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2683,6 +2694,7 @@ out_error: + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 98b9c1ed366ee..17fef6eb490c5 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -90,10 +90,10 @@ void nfs_set_pgio_error(struct nfs_pgio_header *hdr, int error, loff_t pos) + } + } + +-static inline struct nfs_page * +-nfs_page_alloc(void) ++static inline struct nfs_page *nfs_page_alloc(void) + { +- struct nfs_page *p = kmem_cache_zalloc(nfs_page_cachep, GFP_KERNEL); ++ struct nfs_page *p = ++ kmem_cache_zalloc(nfs_page_cachep, nfs_io_gfp_mask()); + if (p) + INIT_LIST_HEAD(&p->wb_list); + return p; +@@ -901,7 +901,7 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc, + struct nfs_commit_info cinfo; + struct nfs_page_array *pg_array = &hdr->page_array; + unsigned int pagecount, pageused; +- gfp_t gfp_flags = GFP_KERNEL; ++ gfp_t gfp_flags = nfs_io_gfp_mask(); + + pagecount = nfs_page_array_len(mirror->pg_base, mirror->pg_count); + pg_array->npages = pagecount; +@@ -984,7 +984,7 @@ nfs_pageio_alloc_mirrors(struct nfs_pageio_descriptor *desc, + desc->pg_mirrors_dynamic = NULL; + if (mirror_count == 1) + return desc->pg_mirrors_static; +- ret = kmalloc_array(mirror_count, sizeof(*ret), GFP_KERNEL); ++ ret = kmalloc_array(mirror_count, sizeof(*ret), nfs_io_gfp_mask()); + if (ret != NULL) { + for (i = 0; i < mirror_count; i++) + nfs_pageio_mirror_init(&ret[i], desc->pg_bsize); +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 7b9d701bef016..a2ad8bb87e2db 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -419,7 +419,7 @@ static struct nfs_commit_data * + pnfs_bucket_fetch_commitdata(struct pnfs_commit_bucket *bucket, + struct nfs_commit_info *cinfo) + { +- struct nfs_commit_data *data = nfs_commitdata_alloc(false); ++ struct nfs_commit_data *data = nfs_commitdata_alloc(); + + if (!data) + return NULL; +@@ -515,7 +515,11 @@ pnfs_generic_commit_pagelist(struct inode *inode, struct list_head *mds_pages, + unsigned int nreq = 0; + + if (!list_empty(mds_pages)) { +- data = nfs_commitdata_alloc(true); ++ data = nfs_commitdata_alloc(); ++ if (!data) { ++ nfs_retry_commit(mds_pages, NULL, cinfo, -1); ++ return -ENOMEM; ++ } + data->ds_commit_index = -1; + list_splice_init(mds_pages, &data->pages); + list_add_tail(&data->list, &list); +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index cc926e69ee9ba..5d07799513a65 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -70,27 +70,17 @@ static mempool_t *nfs_wdata_mempool; + static struct kmem_cache *nfs_cdata_cachep; + static mempool_t *nfs_commit_mempool; + +-struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail) ++struct nfs_commit_data *nfs_commitdata_alloc(void) + { + struct nfs_commit_data *p; + +- if (never_fail) +- p = mempool_alloc(nfs_commit_mempool, GFP_NOIO); +- else { +- /* It is OK to do some reclaim, not no safe to wait +- * for anything to be returned to the pool. +- * mempool_alloc() cannot handle that particular combination, +- * so we need two separate attempts. +- */ ++ p = kmem_cache_zalloc(nfs_cdata_cachep, nfs_io_gfp_mask()); ++ if (!p) { + p = mempool_alloc(nfs_commit_mempool, GFP_NOWAIT); +- if (!p) +- p = kmem_cache_alloc(nfs_cdata_cachep, GFP_NOIO | +- __GFP_NOWARN | __GFP_NORETRY); + if (!p) + return NULL; ++ memset(p, 0, sizeof(*p)); + } +- +- memset(p, 0, sizeof(*p)); + INIT_LIST_HEAD(&p->pages); + return p; + } +@@ -104,9 +94,15 @@ EXPORT_SYMBOL_GPL(nfs_commit_free); + + static struct nfs_pgio_header *nfs_writehdr_alloc(void) + { +- struct nfs_pgio_header *p = mempool_alloc(nfs_wdata_mempool, GFP_KERNEL); ++ struct nfs_pgio_header *p; + +- memset(p, 0, sizeof(*p)); ++ p = kmem_cache_zalloc(nfs_wdata_cachep, nfs_io_gfp_mask()); ++ if (!p) { ++ p = mempool_alloc(nfs_wdata_mempool, GFP_NOWAIT); ++ if (!p) ++ return NULL; ++ memset(p, 0, sizeof(*p)); ++ } + p->rw_mode = FMODE_WRITE; + return p; + } +@@ -1800,7 +1796,11 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how, + if (list_empty(head)) + return 0; + +- data = nfs_commitdata_alloc(true); ++ data = nfs_commitdata_alloc(); ++ if (!data) { ++ nfs_retry_commit(head, NULL, cinfo, -1); ++ return -ENOMEM; ++ } + + /* Set up the argument struct */ + nfs_init_commit(data, head, NULL, cinfo); +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index 5daffd46369dd..9257ee893bdb8 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -353,15 +353,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, + { + struct inode *inode; + struct ubifs_info *c = dir->i_sb->s_fs_info; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; + struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); + int err, instantiated = 0; + struct fscrypt_name nm; + + /* +- * Budget request settings: new dirty inode, new direntry, +- * budget for dirtied inode will be released via writeback. ++ * Budget request settings: new inode, new direntry, changing the ++ * parent directory inode. ++ * Allocate budget separately for new dirtied inode, the budget will ++ * be released via writeback. + */ + + dbg_gen("dent '%pd', mode %#hx in dir ino %lu", +@@ -949,7 +952,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + struct ubifs_inode *dir_ui = ubifs_inode(dir); + struct ubifs_info *c = dir->i_sb->s_fs_info; + int err, sz_change; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct fscrypt_name nm; + + /* +diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h +index 8e144306e2622..b216899b4745e 100644 +--- a/include/linux/gpio/driver.h ++++ b/include/linux/gpio/driver.h +@@ -224,6 +224,15 @@ struct gpio_irq_chip { + unsigned long *valid_mask, + unsigned int ngpios); + ++ /** ++ * @initialized: ++ * ++ * Flag to track GPIO chip irq member's initialization. ++ * This flag will make sure GPIO chip irq members are not used ++ * before they are initialized. ++ */ ++ bool initialized; ++ + /** + * @valid_mask: + * +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index f514a7dd8c9cf..510f876564796 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -50,7 +50,7 @@ struct ipv6_devconf { + __s32 use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- __s32 mc_forwarding; ++ atomic_t mc_forwarding; + #endif + __s32 disable_ipv6; + __s32 drop_unicast_in_l2_multicast; +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index c142a152d6a41..f3016b8e698ab 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -1252,13 +1252,16 @@ static inline unsigned long *section_to_usemap(struct mem_section *ms) + + static inline struct mem_section *__nr_to_section(unsigned long nr) + { ++ unsigned long root = SECTION_NR_TO_ROOT(nr); ++ ++ if (unlikely(root >= NR_SECTION_ROOTS)) ++ return NULL; ++ + #ifdef CONFIG_SPARSEMEM_EXTREME +- if (!mem_section) ++ if (!mem_section || !mem_section[root]) + return NULL; + #endif +- if (!mem_section[SECTION_NR_TO_ROOT(nr)]) +- return NULL; +- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK]; ++ return &mem_section[root][nr & SECTION_ROOT_MASK]; + } + extern unsigned long __section_nr(struct mem_section *ms); + extern size_t mem_section_usage_size(void); +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 1e0a3497bdb46..e39342945a80b 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -478,10 +478,10 @@ static inline const struct cred *nfs_file_cred(struct file *file) + * linux/fs/nfs/direct.c + */ + extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); +-extern ssize_t nfs_file_direct_read(struct kiocb *iocb, +- struct iov_iter *iter); +-extern ssize_t nfs_file_direct_write(struct kiocb *iocb, +- struct iov_iter *iter); ++ssize_t nfs_file_direct_read(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); ++ssize_t nfs_file_direct_write(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); + + /* + * linux/fs/nfs/dir.c +@@ -551,7 +551,7 @@ extern int nfs_wb_all(struct inode *inode); + extern int nfs_wb_page(struct inode *inode, struct page *page); + extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); + extern int nfs_commit_inode(struct inode *, int); +-extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail); ++extern struct nfs_commit_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_commit_data *data); + bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); + +diff --git a/include/net/arp.h b/include/net/arp.h +index 4950191f6b2bf..4a23a97195f33 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, + const unsigned char *src_hw, const unsigned char *th); + int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); + void arp_ifdown(struct net_device *dev); ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force); + + struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, + struct net_device *dev, __be32 src_ip, +diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h +index 9125effbf4483..3fecc4a411a13 100644 +--- a/include/net/bluetooth/bluetooth.h ++++ b/include/net/bluetooth/bluetooth.h +@@ -180,19 +180,21 @@ void bt_err_ratelimited(const char *fmt, ...); + #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__) + #endif + ++#define bt_dev_name(hdev) ((hdev) ? (hdev)->name : "null") ++ + #define bt_dev_info(hdev, fmt, ...) \ +- BT_INFO("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_INFO("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_warn(hdev, fmt, ...) \ +- BT_WARN("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_WARN("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_err(hdev, fmt, ...) \ +- BT_ERR("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_ERR("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_dbg(hdev, fmt, ...) \ +- BT_DBG("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_DBG("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + + #define bt_dev_warn_ratelimited(hdev, fmt, ...) \ +- bt_warn_ratelimited("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ bt_warn_ratelimited("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_err_ratelimited(hdev, fmt, ...) \ +- bt_err_ratelimited("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ bt_err_ratelimited("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + + /* Connection and socket states */ + enum { +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index b43a86d054948..0f39fdcb2273c 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -4180,7 +4180,8 @@ struct bpf_sock { + __u32 src_ip4; + __u32 src_ip6[4]; + __u32 src_port; /* host byte order */ +- __u32 dst_port; /* network byte order */ ++ __be16 dst_port; /* network byte order */ ++ __u16 :16; /* zero padding */ + __u32 dst_ip4; + __u32 dst_ip6[4]; + __u32 state; +diff --git a/include/uapi/linux/can/isotp.h b/include/uapi/linux/can/isotp.h +index c55935b64ccc8..590f8aea2b6d2 100644 +--- a/include/uapi/linux/can/isotp.h ++++ b/include/uapi/linux/can/isotp.h +@@ -137,20 +137,16 @@ struct can_isotp_ll_options { + #define CAN_ISOTP_WAIT_TX_DONE 0x400 /* wait for tx completion */ + #define CAN_ISOTP_SF_BROADCAST 0x800 /* 1-to-N functional addressing */ + +-/* default values */ ++/* protocol machine default values */ + + #define CAN_ISOTP_DEFAULT_FLAGS 0 + #define CAN_ISOTP_DEFAULT_EXT_ADDRESS 0x00 + #define CAN_ISOTP_DEFAULT_PAD_CONTENT 0xCC /* prevent bit-stuffing */ +-#define CAN_ISOTP_DEFAULT_FRAME_TXTIME 0 ++#define CAN_ISOTP_DEFAULT_FRAME_TXTIME 50000 /* 50 micro seconds */ + #define CAN_ISOTP_DEFAULT_RECV_BS 0 + #define CAN_ISOTP_DEFAULT_RECV_STMIN 0x00 + #define CAN_ISOTP_DEFAULT_RECV_WFTMAX 0 + +-#define CAN_ISOTP_DEFAULT_LL_MTU CAN_MTU +-#define CAN_ISOTP_DEFAULT_LL_TX_DL CAN_MAX_DLEN +-#define CAN_ISOTP_DEFAULT_LL_TX_FLAGS 0 +- + /* + * Remark on CAN_ISOTP_DEFAULT_RECV_* values: + * +@@ -162,4 +158,24 @@ struct can_isotp_ll_options { + * consistency and copied directly into the flow control (FC) frame. + */ + ++/* link layer default values => make use of Classical CAN frames */ ++ ++#define CAN_ISOTP_DEFAULT_LL_MTU CAN_MTU ++#define CAN_ISOTP_DEFAULT_LL_TX_DL CAN_MAX_DLEN ++#define CAN_ISOTP_DEFAULT_LL_TX_FLAGS 0 ++ ++/* ++ * The CAN_ISOTP_DEFAULT_FRAME_TXTIME has become a non-zero value as ++ * it only makes sense for isotp implementation tests to run without ++ * a N_As value. As user space applications usually do not set the ++ * frame_txtime element of struct can_isotp_options the new in-kernel ++ * default is very likely overwritten with zero when the sockopt() ++ * CAN_ISOTP_OPTS is invoked. ++ * To make sure that a N_As value of zero is only set intentional the ++ * value '0' is now interpreted as 'do not change the current value'. ++ * When a frame_txtime of zero is required for testing purposes this ++ * CAN_ISOTP_FRAME_TXTIME_ZERO u32 value has to be set in frame_txtime. ++ */ ++#define CAN_ISOTP_FRAME_TXTIME_ZERO 0xFFFFFFFF ++ + #endif /* !_UAPI_CAN_ISOTP_H */ +diff --git a/init/main.c b/init/main.c +index 4fe58ed4aca7b..3526eaec7508f 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -1104,7 +1104,7 @@ static int __init initcall_blacklist(char *str) + } + } while (str_entry); + +- return 0; ++ return 1; + } + + static bool __init_or_module initcall_blacklisted(initcall_t fn) +@@ -1367,7 +1367,9 @@ static noinline void __init kernel_init_freeable(void); + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +- return strtobool(str, &rodata_enabled); ++ if (strtobool(str, &rodata_enabled)) ++ pr_warn("Invalid option string for rodata: '%s'\n", str); ++ return 1; + } + __setup("rodata=", set_debug_rodata); + #endif +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 8f0ea12d7cee2..1a0a9f820c69b 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -505,10 +505,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of, + goto out_unlock; + + /* +- * Even if we're attaching all tasks in the thread group, we only +- * need to check permissions on one of them. ++ * Even if we're attaching all tasks in the thread group, we only need ++ * to check permissions on one of them. Check permissions using the ++ * credentials from file open to protect against inherited fd attacks. + */ +- cred = current_cred(); ++ cred = of->file->f_cred; + tcred = get_task_cred(task); + if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && + !uid_eq(cred->euid, tcred->uid) && +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 3f8447a5393e9..0853289d321a5 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -4788,6 +4788,7 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + bool locked; + +@@ -4805,9 +4806,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_attach_permissions(src_cgrp, dst_cgrp, + of->file->f_path.dentry->d_sb, true, + ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +@@ -4832,6 +4840,7 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + bool locked; + +@@ -4851,10 +4860,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + +- /* thread migrations follow the cgroup.procs delegation rule */ ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_attach_permissions(src_cgrp, dst_cgrp, + of->file->f_path.dentry->d_sb, false, + ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index 8a7724a6ce2fb..5b6705c4b2d26 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -271,8 +271,12 @@ static FORCE_INLINE int LZ4_decompress_generic( + ip += length; + op += length; + +- /* Necessarily EOF, due to parsing restrictions */ +- if (!partialDecoding || (cpy == oend)) ++ /* Necessarily EOF when !partialDecoding. ++ * When partialDecoding, it is EOF if we've either ++ * filled the output buffer or ++ * can't proceed with reading an offset for following match. ++ */ ++ if (!partialDecoding || (cpy == oend) || (ip >= (iend - 2))) + break; + } else { + /* may overwrite up to WILDCOPYLENGTH beyond cpy */ +diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c +index 9ea10adf7a66f..b1d0a6ecfe1b8 100644 +--- a/lib/test_ubsan.c ++++ b/lib/test_ubsan.c +@@ -89,16 +89,6 @@ static void test_ubsan_misaligned_access(void) + *ptr = val; + } + +-static void test_ubsan_object_size_mismatch(void) +-{ +- /* "((aligned(8)))" helps this not into be misaligned for ptr-access. */ +- volatile int val __aligned(8) = 4; +- volatile long long *ptr, val2; +- +- ptr = (long long *)&val; +- val2 = *ptr; +-} +- + static const test_ubsan_fp test_ubsan_array[] = { + test_ubsan_add_overflow, + test_ubsan_sub_overflow, +@@ -110,7 +100,6 @@ static const test_ubsan_fp test_ubsan_array[] = { + test_ubsan_load_invalid_value, + //test_ubsan_null_ptr_deref, /* exclude it because there is a crash */ + test_ubsan_misaligned_access, +- test_ubsan_object_size_mismatch, + }; + + static int __init test_ubsan_init(void) +diff --git a/mm/memory.c b/mm/memory.c +index af27127c235e2..14f91c7467d6f 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1204,6 +1204,17 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) + return ret; + } + ++/* Whether we should zap all COWed (private) pages too */ ++static inline bool should_zap_cows(struct zap_details *details) ++{ ++ /* By default, zap all pages */ ++ if (!details) ++ return true; ++ ++ /* Or, we zap COWed pages only if the caller wants to */ ++ return !details->check_mapping; ++} ++ + static unsigned long zap_pte_range(struct mmu_gather *tlb, + struct vm_area_struct *vma, pmd_t *pmd, + unsigned long addr, unsigned long end, +@@ -1295,16 +1306,18 @@ again: + continue; + } + +- /* If details->check_mapping, we leave swap entries. */ +- if (unlikely(details)) +- continue; +- +- if (!non_swap_entry(entry)) ++ if (!non_swap_entry(entry)) { ++ /* Genuine swap entry, hence a private anon page */ ++ if (!should_zap_cows(details)) ++ continue; + rss[MM_SWAPENTS]--; +- else if (is_migration_entry(entry)) { ++ } else if (is_migration_entry(entry)) { + struct page *page; + + page = migration_entry_to_page(entry); ++ if (details && details->check_mapping && ++ details->check_mapping != page_rmapping(page)) ++ continue; + rss[mm_counter(page)]--; + } + if (unlikely(!free_swap_and_cache(entry))) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index eb97aed2fbe7d..7315b978e834b 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2636,6 +2636,7 @@ alloc_new: + mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); + if (!mpol_new) + goto err_out; ++ atomic_set(&mpol_new->refcnt, 1); + goto restart; + } + +diff --git a/mm/mremap.c b/mm/mremap.c +index 138abbae4f758..d4c8d6cca3f46 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -260,6 +260,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + struct mmu_notifier_range range; + pmd_t *old_pmd, *new_pmd; + ++ if (!len) ++ return 0; ++ + old_end = old_addr + len; + flush_cache_range(vma, old_addr, old_end); + +diff --git a/mm/rmap.c b/mm/rmap.c +index 14f84f70c5571..44ad7bf2e5631 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1640,7 +1640,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + + /* MADV_FREE page check */ + if (!PageSwapBacked(page)) { +- if (!PageDirty(page)) { ++ int ref_count, map_count; ++ ++ /* ++ * Synchronize with gup_pte_range(): ++ * - clear PTE; barrier; read refcount ++ * - inc refcount; barrier; read PTE ++ */ ++ smp_mb(); ++ ++ ref_count = page_ref_count(page); ++ map_count = page_mapcount(page); ++ ++ /* ++ * Order reads for page refcount and dirty flag ++ * (see comments in __remove_mapping()). ++ */ ++ smp_rmb(); ++ ++ /* ++ * The only page refs must be one from isolation ++ * plus the rmap(s) (dropped by discard:). ++ */ ++ if (ref_count == 1 + map_count && ++ !PageDirty(page)) { + /* Invalidate as we cleared the pte */ + mmu_notifier_invalidate_range(mm, + address, address + PAGE_SIZE); +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 139894ca788b9..c8a341cd652c7 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -136,7 +136,7 @@ static u8 batadv_mcast_mla_rtr_flags_softif_get_ipv6(struct net_device *dev) + { + struct inet6_dev *in6_dev = __in6_dev_get(dev); + +- if (in6_dev && in6_dev->cnf.mc_forwarding) ++ if (in6_dev && atomic_read(&in6_dev->cnf.mc_forwarding)) + return BATADV_NO_FLAGS; + else + return BATADV_MCAST_WANT_NO_RTR6; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 72b4127360c7f..e926e80d9731b 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5061,8 +5061,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon) { ++ if (hcon && hcon->type == AMP_LINK) { + hcon->state = BT_CLOSED; ++ hci_disconn_cfm(hcon, ev->reason); + hci_conn_del(hcon); + } + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 0ddbc415ce156..012c1a0abda8c 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1438,6 +1438,7 @@ static void l2cap_ecred_connect(struct l2cap_chan *chan) + + l2cap_ecred_init(chan, 0); + ++ memset(&data, 0, sizeof(data)); + data.pdu.req.psm = chan->psm; + data.pdu.req.mtu = cpu_to_le16(chan->imtu); + data.pdu.req.mps = cpu_to_le16(chan->mps); +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 63e6e8923200b..9a4a9c5a9f24c 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -141,6 +141,7 @@ struct isotp_sock { + struct can_isotp_options opt; + struct can_isotp_fc_options rxfc, txfc; + struct can_isotp_ll_options ll; ++ u32 frame_txtime; + u32 force_tx_stmin; + u32 force_rx_stmin; + struct tpcon rx, tx; +@@ -360,7 +361,7 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) + + so->tx_gap = ktime_set(0, 0); + /* add transmission time for CAN frame N_As */ +- so->tx_gap = ktime_add_ns(so->tx_gap, so->opt.frame_txtime); ++ so->tx_gap = ktime_add_ns(so->tx_gap, so->frame_txtime); + /* add waiting time for consecutive frames N_Cs */ + if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) + so->tx_gap = ktime_add_ns(so->tx_gap, +@@ -1245,6 +1246,14 @@ static int isotp_setsockopt_locked(struct socket *sock, int level, int optname, + /* no separate rx_ext_address is given => use ext_address */ + if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR)) + so->opt.rx_ext_address = so->opt.ext_address; ++ ++ /* check for frame_txtime changes (0 => no changes) */ ++ if (so->opt.frame_txtime) { ++ if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO) ++ so->frame_txtime = 0; ++ else ++ so->frame_txtime = so->opt.frame_txtime; ++ } + break; + + case CAN_ISOTP_RECV_FC: +@@ -1446,6 +1455,7 @@ static int isotp_init(struct sock *sk) + so->opt.rxpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; + so->opt.txpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; + so->opt.frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; ++ so->frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; + so->rxfc.bs = CAN_ISOTP_DEFAULT_RECV_BS; + so->rxfc.stmin = CAN_ISOTP_DEFAULT_RECV_STMIN; + so->rxfc.wftmax = CAN_ISOTP_DEFAULT_RECV_WFTMAX; +diff --git a/net/core/filter.c b/net/core/filter.c +index 659a328024713..ddf9792c0cb2e 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6492,24 +6492,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len + if (!th->ack || th->rst || th->syn) + return -ENOENT; + ++ if (unlikely(iph_len < sizeof(struct iphdr))) ++ return -EINVAL; ++ + if (tcp_synq_no_recent_overflow(sk)) + return -ENOENT; + + cookie = ntohl(th->ack_seq) - 1; + +- switch (sk->sk_family) { +- case AF_INET: +- if (unlikely(iph_len < sizeof(struct iphdr))) ++ /* Both struct iphdr and struct ipv6hdr have the version field at the ++ * same offset so we can cast to the shorter header (struct iphdr). ++ */ ++ switch (((struct iphdr *)iph)->version) { ++ case 4: ++ if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) + return -EINVAL; + + ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); + break; + + #if IS_BUILTIN(CONFIG_IPV6) +- case AF_INET6: ++ case 6: + if (unlikely(iph_len < sizeof(struct ipv6hdr))) + return -EINVAL; + ++ if (sk->sk_family != AF_INET6) ++ return -EINVAL; ++ + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); + break; + #endif /* CONFIG_IPV6 */ +@@ -7709,6 +7718,7 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info) + { + const int size_default = sizeof(__u32); ++ int field_size; + + if (off < 0 || off >= sizeof(struct bpf_sock)) + return false; +@@ -7720,7 +7730,6 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case offsetof(struct bpf_sock, family): + case offsetof(struct bpf_sock, type): + case offsetof(struct bpf_sock, protocol): +- case offsetof(struct bpf_sock, dst_port): + case offsetof(struct bpf_sock, src_port): + case offsetof(struct bpf_sock, rx_queue_mapping): + case bpf_ctx_range(struct bpf_sock, src_ip4): +@@ -7729,6 +7738,14 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case bpf_ctx_range_till(struct bpf_sock, dst_ip6[0], dst_ip6[3]): + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); ++ case bpf_ctx_range(struct bpf_sock, dst_port): ++ field_size = size == size_default ? ++ size_default : sizeof_field(struct bpf_sock, dst_port); ++ bpf_ctx_record_field_size(info, field_size); ++ return bpf_ctx_narrow_access_ok(off, size, field_size); ++ case offsetofend(struct bpf_sock, dst_port) ... ++ offsetof(struct bpf_sock, dst_ip4) - 1: ++ return false; + } + + return size == size_default; +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 9ff6d4160daba..873081cda9507 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3626,13 +3626,24 @@ static int rtnl_alt_ifname(int cmd, struct net_device *dev, struct nlattr *attr, + bool *changed, struct netlink_ext_ack *extack) + { + char *alt_ifname; ++ size_t size; + int err; + + err = nla_validate(attr, attr->nla_len, IFLA_MAX, ifla_policy, extack); + if (err) + return err; + +- alt_ifname = nla_strdup(attr, GFP_KERNEL); ++ if (cmd == RTM_NEWLINKPROP) { ++ size = rtnl_prop_list_size(dev); ++ size += nla_total_size(ALTIFNAMSIZ); ++ if (size >= U16_MAX) { ++ NL_SET_ERR_MSG(extack, ++ "effective property list too long"); ++ return -EINVAL; ++ } ++ } ++ ++ alt_ifname = nla_strdup(attr, GFP_KERNEL_ACCOUNT); + if (!alt_ifname) + return -ENOMEM; + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index 922dd73e57406..83a47998c4b18 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1116,13 +1116,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) + return err; + } + +-static int arp_invalidate(struct net_device *dev, __be32 ip) ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force) + { + struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); + int err = -ENXIO; + struct neigh_table *tbl = &arp_tbl; + + if (neigh) { ++ if ((neigh->nud_state & NUD_VALID) && !force) { ++ neigh_release(neigh); ++ return 0; ++ } ++ + if (neigh->nud_state & ~NUD_NOARP) + err = neigh_update(neigh, NULL, NUD_FAILED, + NEIGH_UPDATE_F_OVERRIDE| +@@ -1169,7 +1174,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, + if (!dev) + return -EINVAL; + } +- return arp_invalidate(dev, ip); ++ return arp_invalidate(dev, ip, true); + } + + /* +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 917ea953dfad8..0df4594b49c78 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1112,9 +1112,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + return; + + /* Add broadcast address, if it is explicitly assigned. */ +- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) ++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, + prim, 0); ++ arp_invalidate(dev, ifa->ifa_broadcast, false); ++ } + + if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && + (prefix != addr || ifa->ifa_prefixlen < 32)) { +@@ -1130,6 +1132,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + prim, 0); + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, + 32, prim, 0); ++ arp_invalidate(dev, prefix | ~mask, false); + } + } + } +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 838a876c168ca..c8c7b76c3b2e2 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -888,8 +888,13 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, + } + + if (cfg->fc_oif || cfg->fc_gw_family) { +- struct fib_nh *nh = fib_info_nh(fi, 0); ++ struct fib_nh *nh; ++ ++ /* cannot match on nexthop object attributes */ ++ if (fi->nh) ++ return 1; + ++ nh = fib_info_nh(fi, 0); + if (cfg->fc_encap) { + if (fib_encap_match(net, cfg->fc_encap_type, + cfg->fc_encap, nh, cfg, extack)) +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index e093847c334da..915b8e1bd9efb 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -637,7 +637,9 @@ int __inet_hash(struct sock *sk, struct sock *osk) + int err = 0; + + if (sk->sk_state != TCP_LISTEN) { ++ local_bh_disable(); + inet_ehash_nolisten(sk, osk, NULL); ++ local_bh_enable(); + return 0; + } + WARN_ON(!sk_unhashed(sk)); +@@ -669,45 +671,54 @@ int inet_hash(struct sock *sk) + { + int err = 0; + +- if (sk->sk_state != TCP_CLOSE) { +- local_bh_disable(); ++ if (sk->sk_state != TCP_CLOSE) + err = __inet_hash(sk, NULL); +- local_bh_enable(); +- } + + return err; + } + EXPORT_SYMBOL_GPL(inet_hash); + +-void inet_unhash(struct sock *sk) ++static void __inet_unhash(struct sock *sk, struct inet_listen_hashbucket *ilb) + { +- struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; +- struct inet_listen_hashbucket *ilb = NULL; +- spinlock_t *lock; +- + if (sk_unhashed(sk)) + return; + +- if (sk->sk_state == TCP_LISTEN) { +- ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)]; +- lock = &ilb->lock; +- } else { +- lock = inet_ehash_lockp(hashinfo, sk->sk_hash); +- } +- spin_lock_bh(lock); +- if (sk_unhashed(sk)) +- goto unlock; +- + if (rcu_access_pointer(sk->sk_reuseport_cb)) + reuseport_detach_sock(sk); + if (ilb) { ++ struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; ++ + inet_unhash2(hashinfo, sk); + ilb->count--; + } + __sk_nulls_del_node_init_rcu(sk); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); +-unlock: +- spin_unlock_bh(lock); ++} ++ ++void inet_unhash(struct sock *sk) ++{ ++ struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; ++ ++ if (sk_unhashed(sk)) ++ return; ++ ++ if (sk->sk_state == TCP_LISTEN) { ++ struct inet_listen_hashbucket *ilb; ++ ++ ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)]; ++ /* Don't disable bottom halves while acquiring the lock to ++ * avoid circular locking dependency on PREEMPT_RT. ++ */ ++ spin_lock(&ilb->lock); ++ __inet_unhash(sk, ilb); ++ spin_unlock(&ilb->lock); ++ } else { ++ spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash); ++ ++ spin_lock_bh(lock); ++ __inet_unhash(sk, NULL); ++ spin_unlock_bh(lock); ++ } + } + EXPORT_SYMBOL_GPL(inet_unhash); + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 7c5bf39dca5d1..86bcb18256982 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -542,7 +542,7 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex, + #ifdef CONFIG_IPV6_MROUTE + if ((all || type == NETCONFA_MC_FORWARDING) && + nla_put_s32(skb, NETCONFA_MC_FORWARDING, +- devconf->mc_forwarding) < 0) ++ atomic_read(&devconf->mc_forwarding)) < 0) + goto nla_put_failure; + #endif + if ((all || type == NETCONFA_PROXY_NEIGH) && +@@ -5515,7 +5515,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, + array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding; ++ array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding); + #endif + array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6; + array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index 67c9114835c84..0a2e7f2283911 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -333,11 +333,8 @@ int inet6_hash(struct sock *sk) + { + int err = 0; + +- if (sk->sk_state != TCP_CLOSE) { +- local_bh_disable(); ++ if (sk->sk_state != TCP_CLOSE) + err = __inet_hash(sk, NULL); +- local_bh_enable(); +- } + + return err; + } +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index 06d60662717d1..15ea3d082534d 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -509,7 +509,7 @@ int ip6_mc_input(struct sk_buff *skb) + /* + * IPv6 multicast router mode is now supported ;) + */ +- if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && ++ if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) && + !(ipv6_addr_type(&hdr->daddr) & + (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && + likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 41cb348a7c3c4..5f0ac47acc74b 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -740,7 +740,7 @@ static int mif6_delete(struct mr_table *mrt, int vifi, int notify, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding--; ++ atomic_dec(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -908,7 +908,7 @@ static int mif6_add(struct net *net, struct mr_table *mrt, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding++; ++ atomic_inc(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -1558,7 +1558,7 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) + } else { + rcu_assign_pointer(mrt->mroute_sk, sk); + sock_set_flag(sk, SOCK_RCU_FREE); +- net->ipv6.devconf_all->mc_forwarding++; ++ atomic_inc(&net->ipv6.devconf_all->mc_forwarding); + } + write_unlock_bh(&mrt_lock); + +@@ -1591,7 +1591,7 @@ int ip6mr_sk_done(struct sock *sk) + * so the RCU grace period before sk freeing + * is guaranteed by sk_destruct() + */ +- net->ipv6.devconf_all->mc_forwarding--; ++ atomic_dec(&net->ipv6.devconf_all->mc_forwarding); + write_unlock_bh(&mrt_lock); + inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 352e645c546eb..776b1b58c5dc6 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -4398,7 +4398,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes) + struct inet6_dev *idev; + int type; + +- if (netif_is_l3_master(skb->dev) && ++ if (netif_is_l3_master(skb->dev) || + dst->dev == net->loopback_dev) + idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif)); + else +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 5e1239cef0005..91b35b7c80d82 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -885,6 +885,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, + unsigned char bitmask; + unsigned char byte; + ++ if (offset >= bitmap_len) ++ return -1; + byte_offset = offset / 8; + byte = bitmap[byte_offset]; + bit_spot = offset; +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 525c1540f10e6..6d8d700216662 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1044,7 +1044,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, + int rem = nla_len(attr); + bool dont_clone_flow_key; + +- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ ++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ + clone_arg = nla_data(attr); + dont_clone_flow_key = nla_get_u32(clone_arg); + actions = nla_next(clone_arg, &rem); +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 8c4bdfa627ca9..98a7e6f64ab0b 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2288,6 +2288,62 @@ static struct sw_flow_actions *nla_alloc_flow_actions(int size) + return sfa; + } + ++static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len); ++ ++static void ovs_nla_free_check_pkt_len_action(const struct nlattr *action) ++{ ++ const struct nlattr *a; ++ int rem; ++ ++ nla_for_each_nested(a, action, rem) { ++ switch (nla_type(a)) { ++ case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL: ++ case OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER: ++ ovs_nla_free_nested_actions(nla_data(a), nla_len(a)); ++ break; ++ } ++ } ++} ++ ++static void ovs_nla_free_clone_action(const struct nlattr *action) ++{ ++ const struct nlattr *a = nla_data(action); ++ int rem = nla_len(action); ++ ++ switch (nla_type(a)) { ++ case OVS_CLONE_ATTR_EXEC: ++ /* The real list of actions follows this attribute. */ ++ a = nla_next(a, &rem); ++ ovs_nla_free_nested_actions(a, rem); ++ break; ++ } ++} ++ ++static void ovs_nla_free_dec_ttl_action(const struct nlattr *action) ++{ ++ const struct nlattr *a = nla_data(action); ++ ++ switch (nla_type(a)) { ++ case OVS_DEC_TTL_ATTR_ACTION: ++ ovs_nla_free_nested_actions(nla_data(a), nla_len(a)); ++ break; ++ } ++} ++ ++static void ovs_nla_free_sample_action(const struct nlattr *action) ++{ ++ const struct nlattr *a = nla_data(action); ++ int rem = nla_len(action); ++ ++ switch (nla_type(a)) { ++ case OVS_SAMPLE_ATTR_ARG: ++ /* The real list of actions follows this attribute. */ ++ a = nla_next(a, &rem); ++ ovs_nla_free_nested_actions(a, rem); ++ break; ++ } ++} ++ + static void ovs_nla_free_set_action(const struct nlattr *a) + { + const struct nlattr *ovs_key = nla_data(a); +@@ -2301,25 +2357,54 @@ static void ovs_nla_free_set_action(const struct nlattr *a) + } + } + +-void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) ++static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len) + { + const struct nlattr *a; + int rem; + +- if (!sf_acts) ++ /* Whenever new actions are added, the need to update this ++ * function should be considered. ++ */ ++ BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 23); ++ ++ if (!actions) + return; + +- nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) { ++ nla_for_each_attr(a, actions, len, rem) { + switch (nla_type(a)) { +- case OVS_ACTION_ATTR_SET: +- ovs_nla_free_set_action(a); ++ case OVS_ACTION_ATTR_CHECK_PKT_LEN: ++ ovs_nla_free_check_pkt_len_action(a); ++ break; ++ ++ case OVS_ACTION_ATTR_CLONE: ++ ovs_nla_free_clone_action(a); + break; ++ + case OVS_ACTION_ATTR_CT: + ovs_ct_free_action(a); + break; ++ ++ case OVS_ACTION_ATTR_DEC_TTL: ++ ovs_nla_free_dec_ttl_action(a); ++ break; ++ ++ case OVS_ACTION_ATTR_SAMPLE: ++ ovs_nla_free_sample_action(a); ++ break; ++ ++ case OVS_ACTION_ATTR_SET: ++ ovs_nla_free_set_action(a); ++ break; + } + } ++} ++ ++void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) ++{ ++ if (!sf_acts) ++ return; + ++ ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len); + kfree(sf_acts); + } + +@@ -3419,7 +3504,9 @@ static int clone_action_to_attr(const struct nlattr *attr, + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); ++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ ++ attr = nla_next(nla_data(attr), &rem); ++ err = ovs_nla_put_actions(attr, rem, skb); + + if (err) + nla_nest_cancel(skb, start); +diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c +index 25bbc4cc8b135..f15d6942da453 100644 +--- a/net/rxrpc/net_ns.c ++++ b/net/rxrpc/net_ns.c +@@ -113,8 +113,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) + struct rxrpc_net *rxnet = rxrpc_net(net); + + rxnet->live = false; +- del_timer_sync(&rxnet->peer_keepalive_timer); + cancel_work_sync(&rxnet->peer_keepalive_work); ++ del_timer_sync(&rxnet->peer_keepalive_timer); + rxrpc_destroy_all_calls(rxnet); + rxrpc_destroy_all_connections(rxnet); + rxrpc_destroy_all_peers(rxnet); +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index d69aac6c1fcea..ef2fd28999baf 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1426,7 +1426,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, + */ + static inline int smc_rmb_wnd_update_limit(int rmbe_size) + { +- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); ++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); + } + + /* map an rmb buf to a link */ +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 84c8a534029c9..c5af31312e0cf 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2175,6 +2175,7 @@ call_transmit_status(struct rpc_task *task) + * socket just returned a connection error, + * then hold onto the transport lock. + */ ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + fallthrough; +@@ -2258,6 +2259,7 @@ call_bc_transmit_status(struct rpc_task *task) + case -ENOTCONN: + case -EPIPE: + break; ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + fallthrough; +@@ -2340,6 +2342,11 @@ call_status(struct rpc_task *task) + case -EPIPE: + case -EAGAIN: + break; ++ case -ENFILE: ++ case -ENOBUFS: ++ case -ENOMEM: ++ rpc_delay(task, HZ>>2); ++ break; + case -EIO: + /* shutdown or soft timeout */ + goto out_exit; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index c045f63d11fa6..f0f55fbd13752 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -186,11 +186,6 @@ static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue, + + /* + * Add new request to wait queue. +- * +- * Swapper tasks always get inserted at the head of the queue. +- * This should avoid many nasty memory deadlocks and hopefully +- * improve overall performance. +- * Everyone else gets appended to the queue to ensure proper FIFO behavior. + */ + static void __rpc_add_wait_queue(struct rpc_wait_queue *queue, + struct rpc_task *task, +@@ -199,8 +194,6 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue, + INIT_LIST_HEAD(&task->u.tk_wait.timer_list); + if (RPC_IS_PRIORITY(queue)) + __rpc_add_wait_queue_priority(queue, task, queue_priority); +- else if (RPC_IS_SWAPPER(task)) +- list_add(&task->u.tk_wait.list, &queue->tasks[0]); + else + list_add_tail(&task->u.tk_wait.list, &queue->tasks[0]); + task->tk_waitqueue = queue; +@@ -1012,8 +1005,10 @@ int rpc_malloc(struct rpc_task *task) + struct rpc_buffer *buf; + gfp_t gfp = GFP_NOFS; + ++ if (RPC_IS_ASYNC(task)) ++ gfp = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ gfp |= __GFP_MEMALLOC; + + size += sizeof(struct rpc_buffer); + if (size <= RPC_BUFFER_MAXSIZE) +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index eba1714bf09ab..6d5bb8bfed38b 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1091,7 +1091,9 @@ static int svc_tcp_sendmsg(struct socket *sock, struct msghdr *msg, + int flags, ret; + + *sentp = 0; +- xdr_alloc_bvec(xdr, GFP_KERNEL); ++ ret = xdr_alloc_bvec(xdr, GFP_KERNEL); ++ if (ret < 0) ++ return ret; + + msg->msg_flags = MSG_MORE; + ret = kernel_sendmsg(sock, msg, &rm, 1, rm.iov_len); +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 46304e647c492..6bc225d64d23f 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1306,17 +1306,6 @@ xprt_request_enqueue_transmit(struct rpc_task *task) + INIT_LIST_HEAD(&req->rq_xmit2); + goto out; + } +- } else if (RPC_IS_SWAPPER(task)) { +- list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) { +- if (pos->rq_cong || pos->rq_bytes_sent) +- continue; +- if (RPC_IS_SWAPPER(pos->rq_task)) +- continue; +- /* Note: req is added _before_ pos */ +- list_add_tail(&req->rq_xmit, &pos->rq_xmit); +- INIT_LIST_HEAD(&req->rq_xmit2); +- goto out; +- } + } else if (!req->rq_seqno) { + list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) { + if (pos->rq_task->tk_owner != task->tk_owner) +@@ -1635,12 +1624,15 @@ out: + static struct rpc_rqst *xprt_dynamic_alloc_slot(struct rpc_xprt *xprt) + { + struct rpc_rqst *req = ERR_PTR(-EAGAIN); ++ gfp_t gfp_mask = GFP_KERNEL; + + if (xprt->num_reqs >= xprt->max_reqs) + goto out; + ++xprt->num_reqs; + spin_unlock(&xprt->reserve_lock); +- req = kzalloc(sizeof(struct rpc_rqst), GFP_NOFS); ++ if (current->flags & PF_WQ_WORKER) ++ gfp_mask |= __GFP_NORETRY | __GFP_NOWARN; ++ req = kzalloc(sizeof(*req), gfp_mask); + spin_lock(&xprt->reserve_lock); + if (req != NULL) + goto out; +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index 8e2368a0c2a29..9cf10cfb85c65 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -519,7 +519,7 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task) + return; + + out_sleep: +- task->tk_status = -EAGAIN; ++ task->tk_status = -ENOMEM; + xprt_add_backlog(xprt, task); + } + +@@ -572,8 +572,10 @@ xprt_rdma_allocate(struct rpc_task *task) + gfp_t flags; + + flags = RPCRDMA_DEF_GFP; ++ if (RPC_IS_ASYNC(task)) ++ flags = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ flags |= __GFP_MEMALLOC; + + if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize, + flags)) +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 16c7758e7bf30..bd123f1d09230 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -754,12 +754,12 @@ xs_stream_start_connect(struct sock_xprt *transport) + /** + * xs_nospace - handle transmit was incomplete + * @req: pointer to RPC request ++ * @transport: pointer to struct sock_xprt + * + */ +-static int xs_nospace(struct rpc_rqst *req) ++static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) + { +- struct rpc_xprt *xprt = req->rq_xprt; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct rpc_xprt *xprt = &transport->xprt; + struct sock *sk = transport->inet; + int ret = -EAGAIN; + +@@ -770,25 +770,49 @@ static int xs_nospace(struct rpc_rqst *req) + + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { ++ struct socket_wq *wq; ++ ++ rcu_read_lock(); ++ wq = rcu_dereference(sk->sk_wq); ++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); ++ rcu_read_unlock(); ++ + /* wait for more buffer space */ ++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_pending++; + xprt_wait_for_buffer_space(xprt); + } else + ret = -ENOTCONN; + + spin_unlock(&xprt->transport_lock); ++ return ret; ++} + +- /* Race breaker in case memory is freed before above code is called */ +- if (ret == -EAGAIN) { +- struct socket_wq *wq; ++static int xs_sock_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; + +- rcu_read_lock(); +- wq = rcu_dereference(sk->sk_wq); +- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); +- rcu_read_unlock(); ++ lock_sock(sk); ++ if (!sock_writeable(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); ++ return ret; ++} + +- sk->sk_write_space(sk); +- } ++static int xs_stream_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; ++ ++ lock_sock(sk); ++ if (!sk_stream_memory_free(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); + return ret; + } + +@@ -878,7 +902,7 @@ static int xs_local_send_request(struct rpc_rqst *req) + case -ENOBUFS: + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + default: + dprintk("RPC: sendmsg returned unrecognized error %d\n", +@@ -954,7 +978,7 @@ process_status: + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_sock_nospace(req); + break; + case -ENETUNREACH: + case -ENOBUFS: +@@ -1069,7 +1093,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req) + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + case -ECONNRESET: + case -ECONNREFUSED: +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 8cd011ea9fbb8..21f20c3cda971 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1483,7 +1483,7 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, + } + if (prot->version == TLS_1_3_VERSION) + memcpy(iv + iv_offset, tls_ctx->rx.iv, +- crypto_aead_ivsize(ctx->aead_recv)); ++ prot->iv_size + prot->salt_size); + else + memcpy(iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index fd614a5a00b42..c1b2655682a8a 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -702,8 +702,12 @@ static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, + + for (i = 0; i < request->n_ssids; i++) { + /* wildcard ssid in the scan request */ +- if (!request->ssids[i].ssid_len) ++ if (!request->ssids[i].ssid_len) { ++ if (ap->multi_bss && !ap->transmitted_bssid) ++ continue; ++ + return true; ++ } + + if (ap->ssid_len && + ap->ssid_len == request->ssids[i].ssid_len) { +@@ -830,6 +834,9 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + !cfg80211_find_ssid_match(ap, request)) + continue; + ++ if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid) ++ continue; ++ + cfg80211_scan_req_add_chan(request, chan, true); + memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN); + scan_6ghz_params->short_ssid = ap->short_ssid; +diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan +index 9716dab06bc7a..2156e18391a3f 100644 +--- a/scripts/Makefile.ubsan ++++ b/scripts/Makefile.ubsan +@@ -23,7 +23,6 @@ ifdef CONFIG_UBSAN_MISC + CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) + CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) + CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow) +- CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size) + CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) + CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) + endif +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 22ea350dab588..221250973d078 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -210,9 +210,16 @@ strip-libs = $(filter-out -l%,$(1)) + PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null) + PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS)) + PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS)) +-PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null` ++PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null) + FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS) + ++ifeq ($(CC_NO_CLANG), 0) ++ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS)) ++ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro ++endif ++ + $(OUTPUT)test-libperl.bin: + $(BUILD) $(FLAGS_PERL_EMBED) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 154b75fc1373e..f2a353bba25f4 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -147,7 +147,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \ + sort -u | wc -l) + VERSIONED_SYM_COUNT = $(shell readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ + sed 's/\[.*\]//' | \ +- awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \ ++ awk '/GLOBAL/ && /DEFAULT/ && !/UND|ABS/ {print $$NF}' | \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | sort -u | wc -l) + + CMD_TARGETS = $(LIB_TARGET) $(PC_FILE) +@@ -216,7 +216,7 @@ check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT) + sort -u > $(OUTPUT)libbpf_global_syms.tmp; \ + readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ + sed 's/\[.*\]//' | \ +- awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \ ++ awk '/GLOBAL/ && /DEFAULT/ && !/UND|ABS/ {print $$NF}'| \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | \ + sort -u > $(OUTPUT)libbpf_versioned_syms.tmp; \ + diff -u $(OUTPUT)libbpf_global_syms.tmp \ +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 68408a5ecfed2..41dff8d38448d 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -255,6 +255,9 @@ ifdef PYTHON_CONFIG + PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil + PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null) + FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS) ++ ifeq ($(CC_NO_CLANG), 0) ++ PYTHON_EMBED_CCOPTS := $(filter-out -ffat-lto-objects, $(PYTHON_EMBED_CCOPTS)) ++ endif + endif + + FEATURE_CHECK_CFLAGS-libpython := $(PYTHON_EMBED_CCOPTS) +@@ -760,6 +763,9 @@ else + LDFLAGS += $(PERL_EMBED_LDFLAGS) + EXTLIBS += $(PERL_EMBED_LIBADD) + CFLAGS += -DHAVE_LIBPERL_SUPPORT ++ ifeq ($(CC_NO_CLANG), 0) ++ CFLAGS += -Wno-compound-token-split-by-macro ++ endif + $(call detected,CONFIG_LIBPERL) + endif + endif +diff --git a/tools/perf/arch/arm64/util/arm-spe.c b/tools/perf/arch/arm64/util/arm-spe.c +index e3593063b3d17..37765e2bd9ddb 100644 +--- a/tools/perf/arch/arm64/util/arm-spe.c ++++ b/tools/perf/arch/arm64/util/arm-spe.c +@@ -124,6 +124,12 @@ static int arm_spe_recording_options(struct auxtrace_record *itr, + evsel__set_sample_bit(arm_spe_evsel, TIME); + evsel__set_sample_bit(arm_spe_evsel, TID); + ++ /* ++ * Set this only so that perf report knows that SPE generates memory info. It has no effect ++ * on the opening of the event or the SPE data produced. ++ */ ++ evsel__set_sample_bit(arm_spe_evsel, DATA_SRC); ++ + /* Add dummy event to keep tracking */ + err = parse_events(evlist, "dummy:u", NULL); + if (err) +diff --git a/tools/perf/perf.c b/tools/perf/perf.c +index 27f94b0bb8747..505e2a2f1872b 100644 +--- a/tools/perf/perf.c ++++ b/tools/perf/perf.c +@@ -433,7 +433,7 @@ void pthread__unblock_sigwinch(void) + static int libperf_print(enum libperf_print_level level, + const char *fmt, va_list ap) + { +- return eprintf(level, verbose, fmt, ap); ++ return veprintf(level, verbose, fmt, ap); + } + + int main(int argc, const char **argv) +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 9dddec19a494e..354e1e04a2662 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -2056,6 +2056,7 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + bool needs_swap, union perf_event *error) + { + union perf_event *event; ++ u16 event_size; + + /* + * Ensure we have enough space remaining to read +@@ -2068,15 +2069,23 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + if (needs_swap) + perf_event_header__bswap(&event->header); + +- if (head + event->header.size <= mmap_size) ++ event_size = event->header.size; ++ if (head + event_size <= mmap_size) + return event; + + /* We're not fetching the event so swap back again */ + if (needs_swap) + perf_event_header__bswap(&event->header); + +- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" +- " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); ++ /* Check if the event fits into the next mmapped buf. */ ++ if (event_size <= mmap_size - head % page_size) { ++ /* Remap buf and fetch again. */ ++ return NULL; ++ } ++ ++ /* Invalid input. Event size should never exceed mmap_size. */ ++ pr_debug("%s: head=%#" PRIx64 " event->header.size=%#x, mmap_size=%#zx:" ++ " fuzzed or compressed perf.data?\n", __func__, head, event_size, mmap_size); + + return error; + } +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index c5e3e9a68162d..b670469a8124f 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -1,12 +1,14 @@ +-from os import getenv ++from os import getenv, path + from subprocess import Popen, PIPE + from re import sub + + cc = getenv("CC") + cc_is_clang = b"clang version" in Popen([cc.split()[0], "-v"], stderr=PIPE).stderr.readline() ++src_feature_tests = getenv('srctree') + '/tools/build/feature' + + def clang_has_option(option): +- return [o for o in Popen([cc, option], stderr=PIPE).stderr.readlines() if b"unknown argument" in o] == [ ] ++ cc_output = Popen([cc, option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() ++ return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o))] == [ ] + + if cc_is_clang: + from distutils.sysconfig import get_config_vars +@@ -23,6 +25,8 @@ if cc_is_clang: + vars[var] = sub("-fstack-protector-strong", "", vars[var]) + if not clang_has_option("-fno-semantic-interposition"): + vars[var] = sub("-fno-semantic-interposition", "", vars[var]) ++ if not clang_has_option("-ffat-lto-objects"): ++ vars[var] = sub("-ffat-lto-objects", "", vars[var]) + + from distutils.core import setup, Extension + +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index 05853b0b88318..5b16c7b0ae4fa 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -219,7 +219,7 @@ int cg_find_unified_root(char *root, size_t len) + + int cg_create(const char *cgroup) + { +- return mkdir(cgroup, 0644); ++ return mkdir(cgroup, 0755); + } + + int cg_wait_for_proc_count(const char *cgroup, int count) +@@ -337,13 +337,13 @@ pid_t clone_into_cgroup(int cgroup_fd) + #ifdef CLONE_ARGS_SIZE_VER2 + pid_t pid; + +- struct clone_args args = { ++ struct __clone_args args = { + .flags = CLONE_INTO_CGROUP, + .exit_signal = SIGCHLD, + .cgroup = cgroup_fd, + }; + +- pid = sys_clone3(&args, sizeof(struct clone_args)); ++ pid = sys_clone3(&args, sizeof(struct __clone_args)); + /* + * Verify that this is a genuine test failure: + * ENOSYS -> clone3() not available +diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c +index 3df648c378765..6001235030631 100644 +--- a/tools/testing/selftests/cgroup/test_core.c ++++ b/tools/testing/selftests/cgroup/test_core.c +@@ -1,11 +1,14 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + ++#define _GNU_SOURCE + #include ++#include + #include + #include + #include + #include + #include ++#include + #include + #include + #include +@@ -674,6 +677,166 @@ cleanup: + return ret; + } + ++/* ++ * cgroup migration permission check should be performed based on the ++ * credentials at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_euid_open(const char *root) ++{ ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ uid_t saved_uid; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ saved_uid = geteuid(); ++ if (seteuid(test_euid)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR); ++ ++ if (seteuid(saved_uid)) ++ goto cleanup; ++ ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ ++struct lesser_ns_open_thread_arg { ++ const char *path; ++ int fd; ++ int err; ++}; ++ ++static int lesser_ns_open_thread_fn(void *arg) ++{ ++ struct lesser_ns_open_thread_arg *targ = arg; ++ ++ targ->fd = open(targ->path, O_RDWR); ++ targ->err = errno; ++ return 0; ++} ++ ++/* ++ * cgroup migration permission check should be performed based on the cgroup ++ * namespace at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_ns_open(const char *root) ++{ ++ static char stack[65536]; ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ struct lesser_ns_open_thread_arg targ = { .fd = -1 }; ++ pid_t pid; ++ int status; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_b)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ targ.path = cg_test_b_procs; ++ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack), ++ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, ++ &targ); ++ if (pid < 0) ++ goto cleanup; ++ ++ if (waitpid(pid, &status, 0) < 0) ++ goto cleanup; ++ ++ if (!WIFEXITED(status)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = targ.fd; ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ + #define T(x) { x, #x } + struct corecg_test { + int (*fn)(const char *root); +@@ -689,6 +852,8 @@ struct corecg_test { + T(test_cgcore_proc_migration), + T(test_cgcore_thread_migration), + T(test_cgcore_destroy), ++ T(test_cgcore_lesser_euid_open), ++ T(test_cgcore_lesser_ns_open), + }; + #undef T +