commit: a76fe1a6fbe7be381d6b7e8fb767177f76eadf1d Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Jan 23 17:05:30 2025 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Jan 23 17:05:30 2025 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a76fe1a6
Linux patch 5.15.177 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1176_linux-5.15.177.patch | 3424 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3428 insertions(+) diff --git a/0000_README b/0000_README index 9e8cc91d..9ba28d33 100644 --- a/0000_README +++ b/0000_README @@ -747,6 +747,10 @@ Patch: 1175_linux-5.15.176.patch From: https://www.kernel.org Desc: Linux 5.15.176 +Patch: 1176_linux-5.15.177.patch +From: https://www.kernel.org +Desc: Linux 5.15.177 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1176_linux-5.15.177.patch b/1176_linux-5.15.177.patch new file mode 100644 index 00000000..1e9a5250 --- /dev/null +++ b/1176_linux-5.15.177.patch @@ -0,0 +1,3424 @@ +diff --git a/Makefile b/Makefile +index 8813faaa9bda53..85ce552fefcaa8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 15 +-SUBLEVEL = 176 ++SUBLEVEL = 177 + EXTRAVERSION = + NAME = Trick or Treat + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index f73cb7667babac..93ef90315cda6c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -302,6 +302,7 @@ power: power-controller { + + power-domain@RK3328_PD_HEVC { + reg = <RK3328_PD_HEVC>; ++ clocks = <&cru SCLK_VENC_CORE>; + #power-domain-cells = <0>; + }; + power-domain@RK3328_PD_VIDEO { +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 4f38b3c47e6d53..8b234a14d17f94 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -27,7 +27,7 @@ + + int show_unhandled_signals = 1; + +-static DEFINE_SPINLOCK(die_lock); ++static DEFINE_RAW_SPINLOCK(die_lock); + + void die(struct pt_regs *regs, const char *str) + { +@@ -38,7 +38,7 @@ void die(struct pt_regs *regs, const char *str) + + oops_enter(); + +- spin_lock_irqsave(&die_lock, flags); ++ raw_spin_lock_irqsave(&die_lock, flags); + console_verbose(); + bust_spinlocks(1); + +@@ -55,7 +55,7 @@ void die(struct pt_regs *regs, const char *str) + + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +- spin_unlock_irqrestore(&die_lock, flags); ++ raw_spin_unlock_irqrestore(&die_lock, flags); + oops_exit(); + + if (in_interrupt()) +diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h +index 68c257a3de0d39..147e83fa86e254 100644 +--- a/arch/x86/include/asm/special_insns.h ++++ b/arch/x86/include/asm/special_insns.h +@@ -224,7 +224,7 @@ static inline void clwb(volatile void *__p) + + #define nop() asm volatile ("nop") + +-static inline void serialize(void) ++static __always_inline void serialize(void) + { + /* Instruction opcode for SERIALIZE; supported in binutils >= 2.35. */ + asm volatile(".byte 0xf, 0x1, 0xe8" ::: "memory"); +diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S +index 045760ddac6abe..81012ee191f8e6 100644 +--- a/arch/x86/xen/xen-asm.S ++++ b/arch/x86/xen/xen-asm.S +@@ -214,7 +214,7 @@ SYM_CODE_END(xen_early_idt_handler_array) + push %rax + mov $__HYPERVISOR_iret, %eax + syscall /* Do the IRET. */ +-#ifdef CONFIG_MITIGATION_SLS ++#ifdef CONFIG_SLS + int3 + #endif + .endm +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index c985c944fa6546..d830ed169e65ca 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -6577,16 +6577,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq) + if (new_bfqq == waker_bfqq) { + /* + * If waker_bfqq is in the merge chain, and current +- * is the only procress. ++ * is the only process, waker_bfqq can be freed. + */ + if (bfqq_process_refs(waker_bfqq) == 1) + return NULL; +- break; ++ ++ return waker_bfqq; + } + + new_bfqq = new_bfqq->new_bfqq; + } + ++ /* ++ * If waker_bfqq is not in the merge chain, and it's procress reference ++ * is 0, waker_bfqq can be freed. ++ */ ++ if (bfqq_process_refs(waker_bfqq) == 0) ++ return NULL; ++ + return waker_bfqq; + } + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 0433ab8ced0dfd..56bbdd2f9a40db 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -442,6 +442,13 @@ static const struct dmi_system_id asus_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"), + }, + }, ++ { ++ /* Asus Vivobook X1504VAP */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"), ++ }, ++ }, + { + /* Asus Vivobook X1704VAP */ + .matches = { +@@ -618,6 +625,17 @@ static const struct dmi_system_id lg_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), + }, + }, ++ { ++ /* ++ * TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the ++ * board-name is changed, so check OEM strings instead. Note ++ * OEM string matches are always exact matches. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=219614 ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"), ++ }, ++ }, + { } + }; + +@@ -648,11 +666,11 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity, + for (i = 0; i < ARRAY_SIZE(override_table); i++) { + const struct irq_override_cmp *entry = &override_table[i]; + +- if (dmi_check_system(entry->system) && +- entry->irq == gsi && ++ if (entry->irq == gsi && + entry->triggering == triggering && + entry->polarity == polarity && +- entry->shareable == shareable) ++ entry->shareable == shareable && ++ dmi_check_system(entry->system)) + return entry->override; + } + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 00437ed9d5e02c..85d324fd6a8728 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -663,17 +663,6 @@ int regmap_attach_dev(struct device *dev, struct regmap *map, + } + EXPORT_SYMBOL_GPL(regmap_attach_dev); + +-static int dev_get_regmap_match(struct device *dev, void *res, void *data); +- +-static int regmap_detach_dev(struct device *dev, struct regmap *map) +-{ +- if (!dev) +- return 0; +- +- return devres_release(dev, dev_get_regmap_release, +- dev_get_regmap_match, (void *)map->name); +-} +- + static enum regmap_endian regmap_get_reg_endian(const struct regmap_bus *bus, + const struct regmap_config *config) + { +@@ -1508,7 +1497,6 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config) + { + int ret; + +- regmap_detach_dev(map->dev, map); + regcache_exit(map); + regmap_debugfs_exit(map); + +diff --git a/drivers/base/topology.c b/drivers/base/topology.c +index 5df6d861bc21b6..bdb41e26c46471 100644 +--- a/drivers/base/topology.c ++++ b/drivers/base/topology.c +@@ -27,9 +27,17 @@ static ssize_t name##_read(struct file *file, struct kobject *kobj, \ + loff_t off, size_t count) \ + { \ + struct device *dev = kobj_to_dev(kobj); \ ++ cpumask_var_t mask; \ ++ ssize_t n; \ + \ +- return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id), \ +- off, count); \ ++ if (!alloc_cpumask_var(&mask, GFP_KERNEL)) \ ++ return -ENOMEM; \ ++ \ ++ cpumask_copy(mask, topology_##mask(dev->id)); \ ++ n = cpumap_print_bitmask_to_buf(buf, mask, off, count); \ ++ free_cpumask_var(mask); \ ++ \ ++ return n; \ + } \ + \ + static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \ +@@ -37,9 +45,17 @@ static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \ + loff_t off, size_t count) \ + { \ + struct device *dev = kobj_to_dev(kobj); \ ++ cpumask_var_t mask; \ ++ ssize_t n; \ ++ \ ++ if (!alloc_cpumask_var(&mask, GFP_KERNEL)) \ ++ return -ENOMEM; \ ++ \ ++ cpumask_copy(mask, topology_##mask(dev->id)); \ ++ n = cpumap_print_list_to_buf(buf, mask, off, count); \ ++ free_cpumask_var(mask); \ + \ +- return cpumap_print_list_to_buf(buf, topology_##mask(dev->id), \ +- off, count); \ ++ return n; \ + } + + define_id_show_func(physical_package_id); +diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c +index fe0926ce0068b8..3cd19ab1fc2a08 100644 +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -2506,9 +2506,9 @@ static int gpio_chrdev_release(struct inode *inode, struct file *file) + struct gpio_chardev_data *cdev = file->private_data; + struct gpio_device *gdev = cdev->gdev; + +- bitmap_free(cdev->watched_lines); + blocking_notifier_chain_unregister(&gdev->notifier, + &cdev->lineinfo_changed_nb); ++ bitmap_free(cdev->watched_lines); + put_device(&gdev->dev); + kfree(cdev); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index e8dc38496f42f0..4be8d2ca50f3a7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3197,7 +3197,7 @@ static int amdgpu_device_ip_resume_phase1(struct amdgpu_device *adev) + * + * @adev: amdgpu_device pointer + * +- * Second resume function for hardware IPs. The list of all the hardware ++ * First resume function for hardware IPs. The list of all the hardware + * IPs that make up the asic is walked and the resume callbacks are run for + * all blocks except COMMON, GMC, and IH. resume puts the hardware into a + * functional state after a suspend and updates the software state as +@@ -3215,7 +3215,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) + if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON || + adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC || + adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_IH || +- adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE || + adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP) + continue; + r = adev->ip_blocks[i].version->funcs->resume(adev); +@@ -3239,36 +3238,6 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) + return 0; + } + +-/** +- * amdgpu_device_ip_resume_phase3 - run resume for hardware IPs +- * +- * @adev: amdgpu_device pointer +- * +- * Third resume function for hardware IPs. The list of all the hardware +- * IPs that make up the asic is walked and the resume callbacks are run for +- * all DCE. resume puts the hardware into a functional state after a suspend +- * and updates the software state as necessary. This function is also used +- * for restoring the GPU after a GPU reset. +- * +- * Returns 0 on success, negative error code on failure. +- */ +-static int amdgpu_device_ip_resume_phase3(struct amdgpu_device *adev) +-{ +- int i, r; +- +- for (i = 0; i < adev->num_ip_blocks; i++) { +- if (!adev->ip_blocks[i].status.valid || adev->ip_blocks[i].status.hw) +- continue; +- if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) { +- r = adev->ip_blocks[i].version->funcs->resume(adev); +- if (r) +- return r; +- } +- } +- +- return 0; +-} +- + /** + * amdgpu_device_ip_resume - run resume for hardware IPs + * +@@ -3299,13 +3268,6 @@ static int amdgpu_device_ip_resume(struct amdgpu_device *adev) + + r = amdgpu_device_ip_resume_phase2(adev); + +- if (r) +- return r; +- +- amdgpu_fence_driver_hw_init(adev); +- +- r = amdgpu_device_ip_resume_phase3(adev); +- + return r; + } + +@@ -4198,6 +4160,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon) + dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r); + return r; + } ++ amdgpu_fence_driver_hw_init(adev); + + r = amdgpu_device_ip_late_init(adev); + if (r) +@@ -4843,10 +4806,6 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, + if (r) + goto out; + +- r = amdgpu_device_ip_resume_phase3(tmp_adev); +- if (r) +- goto out; +- + if (vram_lost) + amdgpu_device_fill_reset_magic(tmp_adev); + +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index 09a8726c263997..d3d6924c994453 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -47,7 +47,7 @@ struct aux_payload; + + #define DC_VER "3.2.149" + +-#define MAX_SURFACES 3 ++#define MAX_SURFACES 4 + #define MAX_PLANES 6 + #define MAX_STREAMS 6 + #define MAX_SINKS_PER_LINK 4 +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h +index 479d7d83220c2b..1163b6fbc74ca1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h ++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h +@@ -66,11 +66,15 @@ static inline double dml_max5(double a, double b, double c, double d, double e) + + static inline double dml_ceil(double a, double granularity) + { ++ if (granularity == 0) ++ return 0; + return (double) dcn_bw_ceil2(a, granularity); + } + + static inline double dml_floor(double a, double granularity) + { ++ if (granularity == 0) ++ return 0; + return (double) dcn_bw_floor2(a, granularity); + } + +@@ -119,11 +123,15 @@ static inline double dml_ceil_2(double f) + + static inline double dml_ceil_ex(double x, double granularity) + { ++ if (granularity == 0) ++ return 0; + return (double) dcn_bw_ceil2(x, granularity); + } + + static inline double dml_floor_ex(double x, double granularity) + { ++ if (granularity == 0) ++ return 0; + return (double) dcn_bw_floor2(x, granularity); + } + +diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c +index c6413c54094207..ec2005e5b4f35b 100644 +--- a/drivers/gpu/drm/i915/display/intel_fb.c ++++ b/drivers/gpu/drm/i915/display/intel_fb.c +@@ -795,7 +795,7 @@ int intel_fill_fb_info(struct drm_i915_private *i915, struct intel_framebuffer * + * arithmetic related to alignment and offset calculation. + */ + if (is_gen12_ccs_cc_plane(&fb->base, i)) { +- if (IS_ALIGNED(fb->base.offsets[i], PAGE_SIZE)) ++ if (IS_ALIGNED(fb->base.offsets[i], 64)) + continue; + else + return -EINVAL; +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index c54d56fb7b4c57..77397bf0b5b457 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -302,6 +302,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + unsigned int addr = pending->addr; + unsigned int pitch = pending->pitch & 0xffff; + unsigned int fmt = pending->format; ++ unsigned int rotation = pending->rotation; + unsigned int offset = (pending->y << 16) | pending->x; + unsigned int src_size = (pending->height << 16) | pending->width; + unsigned int con; +@@ -315,12 +316,19 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + if (state->base.fb && state->base.fb->format->has_alpha) + con |= OVL_CON_AEN | OVL_CON_ALPHA; + +- if (pending->rotation & DRM_MODE_REFLECT_Y) { ++ /* ++ * Treat rotate 180 as flip x + flip y, and XOR the original rotation value ++ * to flip x + flip y to support both in the same time. ++ */ ++ if (rotation & DRM_MODE_ROTATE_180) ++ rotation ^= DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; ++ ++ if (rotation & DRM_MODE_REFLECT_Y) { + con |= OVL_CON_VIRT_FLIP; + addr += (pending->height - 1) * pending->pitch; + } + +- if (pending->rotation & DRM_MODE_REFLECT_X) { ++ if (rotation & DRM_MODE_REFLECT_X) { + con |= OVL_CON_HORZ_FLIP; + addr += pending->pitch - 1; + } +diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c +index e714d5318f3095..76806039691a2c 100644 +--- a/drivers/gpu/drm/v3d/v3d_irq.c ++++ b/drivers/gpu/drm/v3d/v3d_irq.c +@@ -103,6 +103,7 @@ v3d_irq(int irq, void *arg) + + trace_v3d_bcl_irq(&v3d->drm, fence->seqno); + dma_fence_signal(&fence->base); ++ v3d->bin_job = NULL; + status = IRQ_HANDLED; + } + +@@ -112,6 +113,7 @@ v3d_irq(int irq, void *arg) + + trace_v3d_rcl_irq(&v3d->drm, fence->seqno); + dma_fence_signal(&fence->base); ++ v3d->render_job = NULL; + status = IRQ_HANDLED; + } + +@@ -121,6 +123,7 @@ v3d_irq(int irq, void *arg) + + trace_v3d_csd_irq(&v3d->drm, fence->seqno); + dma_fence_signal(&fence->base); ++ v3d->csd_job = NULL; + status = IRQ_HANDLED; + } + +@@ -157,6 +160,7 @@ v3d_hub_irq(int irq, void *arg) + + trace_v3d_tfu_irq(&v3d->drm, fence->seqno); + dma_fence_signal(&fence->base); ++ v3d->tfu_job = NULL; + status = IRQ_HANDLED; + } + +diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c +index aaba9521ebefea..cbe29c8a9b18db 100644 +--- a/drivers/hwmon/tmp513.c ++++ b/drivers/hwmon/tmp513.c +@@ -203,7 +203,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + *val = sign_extend32(regval, + reg == TMP51X_SHUNT_CURRENT_RESULT ? + 16 - tmp51x_get_pga_shift(data) : 15); +- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms); ++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms); ++ + break; + case TMP51X_BUS_VOLTAGE_RESULT: + case TMP51X_BUS_VOLTAGE_H_LIMIT: +@@ -219,7 +220,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + case TMP51X_BUS_CURRENT_RESULT: + // Current = (ShuntVoltage * CalibrationRegister) / 4096 + *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua; +- *val = DIV_ROUND_CLOSEST(*val, MILLI); ++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI); + break; + case TMP51X_LOCAL_TEMP_RESULT: + case TMP51X_REMOTE_TEMP_RESULT_1: +@@ -259,7 +260,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val) + * The user enter current value and we convert it to + * voltage. 1lsb = 10uV + */ +- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI); ++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI); + max_val = U16_MAX >> tmp51x_get_pga_shift(data); + regval = clamp_val(val, -max_val, max_val); + break; +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 316dd378fb8c41..afefe991290018 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -112,6 +112,8 @@ + #define ID_P_PM_BLOCKED BIT(31) + #define ID_P_MASK GENMASK(31, 28) + ++#define ID_SLAVE_NACK BIT(0) ++ + enum rcar_i2c_type { + I2C_RCAR_GEN1, + I2C_RCAR_GEN2, +@@ -146,6 +148,7 @@ struct rcar_i2c_priv { + int irq; + + struct i2c_client *host_notify_client; ++ u8 slave_flags; + }; + + #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) +@@ -576,6 +579,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + { + u32 ssr_raw, ssr_filtered; + u8 value; ++ int ret; + + ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff; + ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER); +@@ -591,7 +595,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICRXTX, value); + rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR); + } else { +- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ + rcar_i2c_read(priv, ICRXTX); /* dummy read */ + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } +@@ -604,18 +611,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ ++ priv->slave_flags &= ~ID_SLAVE_NACK; + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + + /* master wants to write to us */ + if (ssr_filtered & SDR) { +- int ret; +- + value = rcar_i2c_read(priv, ICRXTX); + ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value); +- /* Send NACK in case of error */ +- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0)); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ ++ /* Send NACK in case of error, but it will come 1 byte late :( */ ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS | ++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0)); + rcar_i2c_write(priv, ICSSR, ~SDR & 0xff); + } + +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 45a3f7e7b3f68e..cea057704c00c6 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + pm_runtime_no_callbacks(&pdev->dev); + + /* switch to first parent as active master */ +- i2c_demux_activate_master(priv, 0); ++ err = i2c_demux_activate_master(priv, 0); ++ if (err) ++ goto err_rollback; + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c +index 06a541fa3cfea3..93f32bba73f62e 100644 +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -856,6 +856,9 @@ static int ad7124_setup(struct ad7124_state *st) + * set all channels to this default value. + */ + ad7124_set_channel_odr(st, i, 10); ++ ++ /* Disable all channels to prevent unintended conversions. */ ++ ad_sd_write_reg(&st->sd, AD7124_CHANNEL(i), 2, 0); + } + + return ret; +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index d61b8ce643a805..b8db5bcc5502fc 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -985,7 +985,7 @@ static int at91_ts_register(struct iio_dev *idev, + return ret; + + err: +- input_free_device(st->ts_input); ++ input_free_device(input); + return ret; + } + +diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c +index a237fe469a30cf..3197fd2b3aada2 100644 +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -270,6 +270,8 @@ static irqreturn_t rockchip_saradc_trigger_handler(int irq, void *p) + int ret; + int i, j = 0; + ++ memset(&data, 0, sizeof(data)); ++ + mutex_lock(&i_dev->mlock); + + for_each_set_bit(i, i_dev->active_scan_mask, i_dev->masklength) { +diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c +index 17d0da5877a9a6..232e8063eb1989 100644 +--- a/drivers/iio/adc/ti-ads124s08.c ++++ b/drivers/iio/adc/ti-ads124s08.c +@@ -184,9 +184,9 @@ static int ads124s_reset(struct iio_dev *indio_dev) + struct ads124s_private *priv = iio_priv(indio_dev); + + if (priv->reset_gpio) { +- gpiod_set_value(priv->reset_gpio, 0); ++ gpiod_set_value_cansleep(priv->reset_gpio, 0); + udelay(200); +- gpiod_set_value(priv->reset_gpio, 1); ++ gpiod_set_value_cansleep(priv->reset_gpio, 1); + } else { + return ads124s_write_cmd(indio_dev, ADS124S08_CMD_RESET); + } +diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c +index 79c803537dc423..9055889a5e9149 100644 +--- a/drivers/iio/adc/ti-ads8688.c ++++ b/drivers/iio/adc/ti-ads8688.c +@@ -384,7 +384,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p) + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; + /* Ensure naturally aligned timestamp */ +- u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8); ++ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8) = { }; + int i, j = 0; + + for (i = 0; i < indio_dev->masklength; i++) { +diff --git a/drivers/iio/dummy/iio_simple_dummy_buffer.c b/drivers/iio/dummy/iio_simple_dummy_buffer.c +index 59aa60d4ca370b..a8fd50cdffbed4 100644 +--- a/drivers/iio/dummy/iio_simple_dummy_buffer.c ++++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c +@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p) + int len = 0; + u16 *data; + +- data = kmalloc(indio_dev->scan_bytes, GFP_KERNEL); ++ data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL); + if (!data) + goto done; + +diff --git a/drivers/iio/gyro/fxas21002c_core.c b/drivers/iio/gyro/fxas21002c_core.c +index 410e5e9f2672e1..f331f7480805b2 100644 +--- a/drivers/iio/gyro/fxas21002c_core.c ++++ b/drivers/iio/gyro/fxas21002c_core.c +@@ -730,14 +730,21 @@ static irqreturn_t fxas21002c_trigger_handler(int irq, void *p) + int ret; + + mutex_lock(&data->lock); ++ ret = fxas21002c_pm_get(data); ++ if (ret < 0) ++ goto out_unlock; ++ + ret = regmap_bulk_read(data->regmap, FXAS21002C_REG_OUT_X_MSB, + data->buffer, CHANNEL_SCAN_MAX * sizeof(s16)); + if (ret < 0) +- goto out_unlock; ++ goto out_pm_put; + + iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, + data->timestamp); + ++out_pm_put: ++ fxas21002c_pm_put(data); ++ + out_unlock: + mutex_unlock(&data->lock); + +diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h +index 995a9dc06521de..f5df2e13b063d3 100644 +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h +@@ -360,6 +360,7 @@ struct inv_icm42600_state { + typedef int (*inv_icm42600_bus_setup)(struct inv_icm42600_state *); + + extern const struct regmap_config inv_icm42600_regmap_config; ++extern const struct regmap_config inv_icm42600_spi_regmap_config; + extern const struct dev_pm_ops inv_icm42600_pm_ops; + + const struct iio_mount_matrix * +diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +index ca85fccc98393a..9dec4ad38c0dc2 100644 +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -43,6 +43,17 @@ const struct regmap_config inv_icm42600_regmap_config = { + }; + EXPORT_SYMBOL_GPL(inv_icm42600_regmap_config); + ++/* define specific regmap for SPI not supporting burst write */ ++const struct regmap_config inv_icm42600_spi_regmap_config = { ++ .reg_bits = 8, ++ .val_bits = 8, ++ .max_register = 0x4FFF, ++ .ranges = inv_icm42600_regmap_ranges, ++ .num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges), ++ .use_single_write = true, ++}; ++EXPORT_SYMBOL_GPL(inv_icm42600_spi_regmap_config); ++ + struct inv_icm42600_hw { + uint8_t whoami; + const char *name; +@@ -709,6 +720,8 @@ static int __maybe_unused inv_icm42600_suspend(struct device *dev) + static int __maybe_unused inv_icm42600_resume(struct device *dev) + { + struct inv_icm42600_state *st = dev_get_drvdata(dev); ++ struct inv_icm42600_timestamp *gyro_ts = iio_priv(st->indio_gyro); ++ struct inv_icm42600_timestamp *accel_ts = iio_priv(st->indio_accel); + int ret; + + mutex_lock(&st->lock); +@@ -729,9 +742,12 @@ static int __maybe_unused inv_icm42600_resume(struct device *dev) + goto out_unlock; + + /* restore FIFO data streaming */ +- if (st->fifo.on) ++ if (st->fifo.on) { ++ inv_icm42600_timestamp_reset(gyro_ts); ++ inv_icm42600_timestamp_reset(accel_ts); + ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG, + INV_ICM42600_FIFO_CONFIG_STREAM); ++ } + + out_unlock: + mutex_unlock(&st->lock); +diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c +index 323789697a084c..193afb46725dc4 100644 +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c +@@ -59,7 +59,8 @@ static int inv_icm42600_probe(struct spi_device *spi) + return -EINVAL; + chip = (enum inv_icm42600_chip)match; + +- regmap = devm_regmap_init_spi(spi, &inv_icm42600_regmap_config); ++ /* use SPI specific regmap */ ++ regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config); + if (IS_ERR(regmap)) + return PTR_ERR(regmap); + +diff --git a/drivers/iio/imu/kmx61.c b/drivers/iio/imu/kmx61.c +index f89724481df932..950570ae2980fd 100644 +--- a/drivers/iio/imu/kmx61.c ++++ b/drivers/iio/imu/kmx61.c +@@ -1192,7 +1192,7 @@ static irqreturn_t kmx61_trigger_handler(int irq, void *p) + struct kmx61_data *data = kmx61_get_data(indio_dev); + int bit, ret, i = 0; + u8 base; +- s16 buffer[8]; ++ s16 buffer[8] = { }; + + if (indio_dev == data->acc_indio_dev) + base = KMX61_ACC_XOUT_L; +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 16f25a2bede79c..5eabb54c1fc725 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -469,7 +469,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev) + return chans; + + error_free_chans: +- for (i = 0; i < nummaps; i++) ++ for (i = 0; i < mapind; i++) + iio_device_put(chans[i].indio_dev); + kfree(chans); + error_ret: +diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c +index 2c439610ddb918..41ce0af26dd538 100644 +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p) + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4035_data *data = iio_priv(indio_dev); + /* Ensure naturally aligned timestamp */ +- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8); ++ u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; + int ret; + + ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); +diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c +index 89295c90f8018e..50f3338778daf6 100644 +--- a/drivers/iio/pressure/zpa2326.c ++++ b/drivers/iio/pressure/zpa2326.c +@@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(struct iio_dev *indio_dev, + } sample; + int err; + ++ memset(&sample, 0, sizeof(sample)); ++ + if (test_bit(0, indio_dev->active_scan_mask)) { + /* Get current pressure from hardware FIFO. */ + err = zpa2326_dequeue_pressure(indio_dev, &sample.pressure); +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 69126d8034f54c..42389b4b5dbc2d 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -1340,7 +1340,7 @@ static int gic_retrigger(struct irq_data *data) + static int gic_cpu_pm_notifier(struct notifier_block *self, + unsigned long cmd, void *v) + { +- if (cmd == CPU_PM_EXIT) { ++ if (cmd == CPU_PM_EXIT || cmd == CPU_PM_ENTER_FAILED) { + if (gic_dist_security_disabled()) + gic_enable_redist(true); + gic_cpu_sys_reg_init(); +diff --git a/drivers/md/dm-ebs-target.c b/drivers/md/dm-ebs-target.c +index d25989660a7682..418fdc75749752 100644 +--- a/drivers/md/dm-ebs-target.c ++++ b/drivers/md/dm-ebs-target.c +@@ -440,7 +440,7 @@ static int ebs_iterate_devices(struct dm_target *ti, + static struct target_type ebs_target = { + .name = "ebs", + .version = {1, 0, 1}, +- .features = DM_TARGET_PASSES_INTEGRITY, ++ .features = 0, + .module = THIS_MODULE, + .ctr = ebs_ctr, + .dtr = ebs_dtr, +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index e6027c24d147e7..afdd1efed614cc 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2317,10 +2317,9 @@ static struct thin_c *get_first_thin(struct pool *pool) + struct thin_c *tc = NULL; + + rcu_read_lock(); +- if (!list_empty(&pool->active_thins)) { +- tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list); ++ tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list); ++ if (tc) + thin_get(tc); +- } + rcu_read_unlock(); + + return tc; +diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c +index 3a963d783a8655..1f1dd077d3f849 100644 +--- a/drivers/md/persistent-data/dm-array.c ++++ b/drivers/md/persistent-data/dm-array.c +@@ -911,23 +911,27 @@ static int load_ablock(struct dm_array_cursor *c) + if (c->block) + unlock_ablock(c->info, c->block); + +- c->block = NULL; +- c->ab = NULL; + c->index = 0; + + r = dm_btree_cursor_get_value(&c->cursor, &key, &value_le); + if (r) { + DMERR("dm_btree_cursor_get_value failed"); +- dm_btree_cursor_end(&c->cursor); ++ goto out; + + } else { + r = get_ablock(c->info, le64_to_cpu(value_le), &c->block, &c->ab); + if (r) { + DMERR("get_ablock failed"); +- dm_btree_cursor_end(&c->cursor); ++ goto out; + } + } + ++ return 0; ++ ++out: ++ dm_btree_cursor_end(&c->cursor); ++ c->block = NULL; ++ c->ab = NULL; + return r; + } + +@@ -950,10 +954,10 @@ EXPORT_SYMBOL_GPL(dm_array_cursor_begin); + + void dm_array_cursor_end(struct dm_array_cursor *c) + { +- if (c->block) { ++ if (c->block) + unlock_ablock(c->info, c->block); +- dm_btree_cursor_end(&c->cursor); +- } ++ ++ dm_btree_cursor_end(&c->cursor); + } + EXPORT_SYMBOL_GPL(dm_array_cursor_end); + +@@ -993,6 +997,7 @@ int dm_array_cursor_skip(struct dm_array_cursor *c, uint32_t count) + } + + count -= remaining; ++ c->index += (remaining - 1); + r = dm_array_cursor_next(c); + + } while (!r); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 87b713142e15de..6ec9bd733922c8 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2349,7 +2349,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp) + atomic_inc(&conf->active_stripes); + + raid5_release_stripe(sh); +- conf->max_nr_stripes++; ++ WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes + 1); + return 1; + } + +@@ -2646,7 +2646,7 @@ static int drop_one_stripe(struct r5conf *conf) + shrink_buffers(sh); + free_stripe(conf->slab_cache, sh); + atomic_dec(&conf->active_stripes); +- conf->max_nr_stripes--; ++ WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes - 1); + return 1; + } + +@@ -6577,7 +6577,7 @@ raid5_set_cache_size(struct mddev *mddev, int size) + if (size <= 16 || size > 32768) + return -EINVAL; + +- conf->min_nr_stripes = size; ++ WRITE_ONCE(conf->min_nr_stripes, size); + mutex_lock(&conf->cache_size_mutex); + while (size < conf->max_nr_stripes && + drop_one_stripe(conf)) +@@ -6589,7 +6589,7 @@ raid5_set_cache_size(struct mddev *mddev, int size) + mutex_lock(&conf->cache_size_mutex); + while (size > conf->max_nr_stripes) + if (!grow_one_stripe(conf, GFP_KERNEL)) { +- conf->min_nr_stripes = conf->max_nr_stripes; ++ WRITE_ONCE(conf->min_nr_stripes, conf->max_nr_stripes); + result = -ENOMEM; + break; + } +@@ -7153,11 +7153,13 @@ static unsigned long raid5_cache_count(struct shrinker *shrink, + struct shrink_control *sc) + { + struct r5conf *conf = container_of(shrink, struct r5conf, shrinker); ++ int max_stripes = READ_ONCE(conf->max_nr_stripes); ++ int min_stripes = READ_ONCE(conf->min_nr_stripes); + +- if (conf->max_nr_stripes < conf->min_nr_stripes) ++ if (max_stripes < min_stripes) + /* unlikely, but not impossible */ + return 0; +- return conf->max_nr_stripes - conf->min_nr_stripes; ++ return max_stripes - min_stripes; + } + + static struct r5conf *setup_conf(struct mddev *mddev) +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index 4e66354b87f378..e115aab7243e11 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor, + op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->dummy.nbytes) +- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto); ++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->data.nbytes) + op->data.buswidth = spi_nor_get_protocol_data_nbits(proto); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 97e32c0490f8a7..8bfac9f2fea93d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -856,7 +856,6 @@ static void xgbe_phy_free_phy_device(struct xgbe_prv_data *pdata) + + static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) + { +- __ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, }; + struct xgbe_phy_data *phy_data = pdata->phy_data; + unsigned int phy_id = phy_data->phydev->phy_id; + +@@ -878,14 +877,7 @@ static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) + phy_write(phy_data->phydev, 0x04, 0x0d01); + phy_write(phy_data->phydev, 0x00, 0x9140); + +- linkmode_set_bit_array(phy_10_100_features_array, +- ARRAY_SIZE(phy_10_100_features_array), +- supported); +- linkmode_set_bit_array(phy_gbit_features_array, +- ARRAY_SIZE(phy_gbit_features_array), +- supported); +- +- linkmode_copy(phy_data->phydev->supported, supported); ++ linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES); + + phy_support_asym_pause(phy_data->phydev); + +@@ -897,7 +889,6 @@ static bool xgbe_phy_finisar_phy_quirks(struct xgbe_prv_data *pdata) + + static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata) + { +- __ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, }; + struct xgbe_phy_data *phy_data = pdata->phy_data; + struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom; + unsigned int phy_id = phy_data->phydev->phy_id; +@@ -961,13 +952,7 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata) + reg = phy_read(phy_data->phydev, 0x00); + phy_write(phy_data->phydev, 0x00, reg & ~0x00800); + +- linkmode_set_bit_array(phy_10_100_features_array, +- ARRAY_SIZE(phy_10_100_features_array), +- supported); +- linkmode_set_bit_array(phy_gbit_features_array, +- ARRAY_SIZE(phy_gbit_features_array), +- supported); +- linkmode_copy(phy_data->phydev->supported, supported); ++ linkmode_copy(phy_data->phydev->supported, PHY_GBIT_FEATURES); + phy_support_asym_pause(phy_data->phydev); + + netif_dbg(pdata, drv, pdata->netdev, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index fde0c3e8ac57ca..871f695e707604 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -252,7 +252,7 @@ static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id, + + rc = hwrm_req_replace(bp, req, fw_msg->msg, fw_msg->msg_len); + if (rc) +- return rc; ++ goto drop_req; + + hwrm_req_timeout(bp, req, fw_msg->timeout); + resp = hwrm_req_hold(bp, req); +@@ -264,6 +264,7 @@ static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id, + + memcpy(fw_msg->resp, resp, resp_len); + } ++drop_req: + hwrm_req_drop(bp, req); + return rc; + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 21afaa81697e69..47529c77654c8b 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -1800,7 +1800,10 @@ void cxgb4_remove_tid(struct tid_info *t, unsigned int chan, unsigned int tid, + struct adapter *adap = container_of(t, struct adapter, tids); + struct sk_buff *skb; + +- WARN_ON(tid_out_of_range(&adap->tids, tid)); ++ if (tid_out_of_range(&adap->tids, tid)) { ++ dev_err(adap->pdev_dev, "tid %d out of range\n", tid); ++ return; ++ } + + if (t->tid_tab[tid - adap->tids.tid_base]) { + t->tid_tab[tid - adap->tids.tid_base] = NULL; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 665619ce467468..8ff2b81960de70 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -99,6 +99,9 @@ + #define LEFTOVERS_NUM_LEVELS 1 + #define LEFTOVERS_NUM_PRIOS 1 + ++#define RDMA_RX_COUNTERS_PRIO_NUM_LEVELS 1 ++#define RDMA_TX_COUNTERS_PRIO_NUM_LEVELS 1 ++ + #define BY_PASS_PRIO_NUM_LEVELS 1 + #define BY_PASS_MIN_LEVEL (ETHTOOL_MIN_LEVEL + MLX5_BY_PASS_NUM_PRIOS +\ + LEFTOVERS_NUM_PRIOS) +@@ -206,34 +209,63 @@ static struct init_tree_node egress_root_fs = { + } + }; + +-#define RDMA_RX_BYPASS_PRIO 0 +-#define RDMA_RX_KERNEL_PRIO 1 ++enum { ++ RDMA_RX_COUNTERS_PRIO, ++ RDMA_RX_BYPASS_PRIO, ++ RDMA_RX_KERNEL_PRIO, ++}; ++ ++#define RDMA_RX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_REGULAR_PRIOS ++#define RDMA_RX_KERNEL_MIN_LEVEL (RDMA_RX_BYPASS_MIN_LEVEL + 1) ++#define RDMA_RX_COUNTERS_MIN_LEVEL (RDMA_RX_KERNEL_MIN_LEVEL + 2) ++ + static struct init_tree_node rdma_rx_root_fs = { + .type = FS_TYPE_NAMESPACE, +- .ar_size = 2, ++ .ar_size = 3, + .children = (struct init_tree_node[]) { ++ [RDMA_RX_COUNTERS_PRIO] = ++ ADD_PRIO(0, RDMA_RX_COUNTERS_MIN_LEVEL, 0, ++ FS_CHAINING_CAPS, ++ ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF, ++ ADD_MULTIPLE_PRIO(MLX5_RDMA_RX_NUM_COUNTERS_PRIOS, ++ RDMA_RX_COUNTERS_PRIO_NUM_LEVELS))), + [RDMA_RX_BYPASS_PRIO] = +- ADD_PRIO(0, MLX5_BY_PASS_NUM_REGULAR_PRIOS, 0, ++ ADD_PRIO(0, RDMA_RX_BYPASS_MIN_LEVEL, 0, + FS_CHAINING_CAPS, + ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF, + ADD_MULTIPLE_PRIO(MLX5_BY_PASS_NUM_REGULAR_PRIOS, + BY_PASS_PRIO_NUM_LEVELS))), + [RDMA_RX_KERNEL_PRIO] = +- ADD_PRIO(0, MLX5_BY_PASS_NUM_REGULAR_PRIOS + 1, 0, ++ ADD_PRIO(0, RDMA_RX_KERNEL_MIN_LEVEL, 0, + FS_CHAINING_CAPS, + ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_SWITCH_DOMAIN, + ADD_MULTIPLE_PRIO(1, 1))), + } + }; + ++enum { ++ RDMA_TX_COUNTERS_PRIO, ++ RDMA_TX_BYPASS_PRIO, ++}; ++ ++#define RDMA_TX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_PRIOS ++#define RDMA_TX_COUNTERS_MIN_LEVEL (RDMA_TX_BYPASS_MIN_LEVEL + 1) ++ + static struct init_tree_node rdma_tx_root_fs = { + .type = FS_TYPE_NAMESPACE, +- .ar_size = 1, ++ .ar_size = 2, + .children = (struct init_tree_node[]) { +- ADD_PRIO(0, MLX5_BY_PASS_NUM_PRIOS, 0, ++ [RDMA_TX_COUNTERS_PRIO] = ++ ADD_PRIO(0, RDMA_TX_COUNTERS_MIN_LEVEL, 0, ++ FS_CHAINING_CAPS, ++ ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF, ++ ADD_MULTIPLE_PRIO(MLX5_RDMA_TX_NUM_COUNTERS_PRIOS, ++ RDMA_TX_COUNTERS_PRIO_NUM_LEVELS))), ++ [RDMA_TX_BYPASS_PRIO] = ++ ADD_PRIO(0, RDMA_TX_BYPASS_MIN_LEVEL, 0, + FS_CHAINING_CAPS_RDMA_TX, + ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF, +- ADD_MULTIPLE_PRIO(MLX5_BY_PASS_NUM_PRIOS, ++ ADD_MULTIPLE_PRIO(RDMA_TX_BYPASS_MIN_LEVEL, + BY_PASS_PRIO_NUM_LEVELS))), + } + }; +@@ -2278,6 +2310,22 @@ struct mlx5_flow_namespace *mlx5_get_fdb_sub_ns(struct mlx5_core_dev *dev, + } + EXPORT_SYMBOL(mlx5_get_fdb_sub_ns); + ++static bool is_nic_rx_ns(enum mlx5_flow_namespace_type type) ++{ ++ switch (type) { ++ case MLX5_FLOW_NAMESPACE_BYPASS: ++ case MLX5_FLOW_NAMESPACE_LAG: ++ case MLX5_FLOW_NAMESPACE_OFFLOADS: ++ case MLX5_FLOW_NAMESPACE_ETHTOOL: ++ case MLX5_FLOW_NAMESPACE_KERNEL: ++ case MLX5_FLOW_NAMESPACE_LEFTOVERS: ++ case MLX5_FLOW_NAMESPACE_ANCHOR: ++ return true; ++ default: ++ return false; ++ } ++} ++ + struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev, + enum mlx5_flow_namespace_type type) + { +@@ -2303,25 +2351,36 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev, + if (steering->sniffer_tx_root_ns) + return &steering->sniffer_tx_root_ns->ns; + return NULL; +- default: +- break; +- } +- +- if (type == MLX5_FLOW_NAMESPACE_EGRESS || +- type == MLX5_FLOW_NAMESPACE_EGRESS_KERNEL) { ++ case MLX5_FLOW_NAMESPACE_EGRESS: ++ case MLX5_FLOW_NAMESPACE_EGRESS_KERNEL: + root_ns = steering->egress_root_ns; + prio = type - MLX5_FLOW_NAMESPACE_EGRESS; +- } else if (type == MLX5_FLOW_NAMESPACE_RDMA_RX) { ++ break; ++ case MLX5_FLOW_NAMESPACE_RDMA_RX: + root_ns = steering->rdma_rx_root_ns; + prio = RDMA_RX_BYPASS_PRIO; +- } else if (type == MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL) { ++ break; ++ case MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL: + root_ns = steering->rdma_rx_root_ns; + prio = RDMA_RX_KERNEL_PRIO; +- } else if (type == MLX5_FLOW_NAMESPACE_RDMA_TX) { ++ break; ++ case MLX5_FLOW_NAMESPACE_RDMA_TX: + root_ns = steering->rdma_tx_root_ns; +- } else { /* Must be NIC RX */ ++ prio = RDMA_TX_BYPASS_PRIO; ++ break; ++ case MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS: ++ root_ns = steering->rdma_rx_root_ns; ++ prio = RDMA_RX_COUNTERS_PRIO; ++ break; ++ case MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS: ++ root_ns = steering->rdma_tx_root_ns; ++ prio = RDMA_TX_COUNTERS_PRIO; ++ break; ++ default: /* Must be NIC RX */ ++ WARN_ON(!is_nic_rx_ns(type)); + root_ns = steering->root_ns; + prio = type; ++ break; + } + + if (!root_ns) +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +index 9d97cd281f18e4..c03558adda91eb 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +@@ -458,7 +458,8 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, + map_id_full = be64_to_cpu(cbe->map_ptr); + map_id = map_id_full; + +- if (len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size) ++ if (size_add(pkt_size, data_size) > INT_MAX || ++ len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size) + return -EINVAL; + if (cbe->hdr.ver != NFP_CCM_ABI_VERSION) + return -EINVAL; +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 8c59e34d8bcaf2..348a05454fcaa2 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -104,15 +104,15 @@ struct cpsw_ale_dev_id { + + static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) + { +- int idx, idx2; ++ int idx, idx2, index; + u32 hi_val = 0; + + idx = start / 32; + idx2 = (start + bits - 1) / 32; + /* Check if bits to be fetched exceed a word */ + if (idx != idx2) { +- idx2 = 2 - idx2; /* flip */ +- hi_val = ale_entry[idx2] << ((idx2 * 32) - start); ++ index = 2 - idx2; /* flip */ ++ hi_val = ale_entry[index] << ((idx2 * 32) - start); + } + start -= idx * 32; + idx = 2 - idx; /* flip */ +@@ -122,16 +122,16 @@ static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) + static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits, + u32 value) + { +- int idx, idx2; ++ int idx, idx2, index; + + value &= BITMASK(bits); + idx = start / 32; + idx2 = (start + bits - 1) / 32; + /* Check if bits to be set exceed a word */ + if (idx != idx2) { +- idx2 = 2 - idx2; /* flip */ +- ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32))); +- ale_entry[idx2] |= (value >> ((idx2 * 32) - start)); ++ index = 2 - idx2; /* flip */ ++ ale_entry[index] &= ~(BITMASK(bits + start - (idx2 * 32))); ++ ale_entry[index] |= (value >> ((idx2 * 32) - start)); + } + start -= idx * 32; + idx = 2 - idx; /* flip */ +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 56a970357f450d..f63d2224ba91ac 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1584,6 +1584,12 @@ axienet_ethtools_set_coalesce(struct net_device *ndev, + return -EFAULT; + } + ++ if (ecoalesce->rx_max_coalesced_frames > 255 || ++ ecoalesce->tx_max_coalesced_frames > 255) { ++ NL_SET_ERR_MSG(extack, "frames must be less than 256"); ++ return -EINVAL; ++ } ++ + if (ecoalesce->rx_max_coalesced_frames) + lp->coalesce_count_rx = ecoalesce->rx_max_coalesced_frames; + if (ecoalesce->rx_coalesce_usecs) +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 2509d7bccb2b3c..2d306971d4fde6 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -697,8 +697,8 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + goto out_encap; + } + +- gn = net_generic(dev_net(dev), gtp_net_id); +- list_add_rcu(>p->list, &gn->gtp_dev_list); ++ gn = net_generic(src_net, gtp_net_id); ++ list_add(>p->list, &gn->gtp_dev_list); + dev->priv_destructor = gtp_destructor; + + netdev_dbg(dev, "registered new GTP interface\n"); +@@ -724,7 +724,7 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head) + hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) + pdp_context_delete(pctx); + +- list_del_rcu(>p->list); ++ list_del(>p->list); + unregister_netdevice_queue(dev, head); + } + +@@ -1305,16 +1305,19 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, + struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; + int i, j, bucket = cb->args[0], skip = cb->args[1]; + struct net *net = sock_net(skb->sk); ++ struct net_device *dev; + struct pdp_ctx *pctx; +- struct gtp_net *gn; +- +- gn = net_generic(net, gtp_net_id); + + if (cb->args[4]) + return 0; + + rcu_read_lock(); +- list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { ++ for_each_netdev_rcu(net, dev) { ++ if (dev->rtnl_link_ops != >p_link_ops) ++ continue; ++ ++ gtp = netdev_priv(dev); ++ + if (last_gtp && last_gtp != gtp) + continue; + else +@@ -1403,23 +1406,28 @@ static int __net_init gtp_net_init(struct net *net) + return 0; + } + +-static void __net_exit gtp_net_exit(struct net *net) ++static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, ++ struct list_head *dev_to_kill) + { +- struct gtp_net *gn = net_generic(net, gtp_net_id); +- struct gtp_dev *gtp; +- LIST_HEAD(list); ++ struct net *net; + +- rtnl_lock(); +- list_for_each_entry(gtp, &gn->gtp_dev_list, list) +- gtp_dellink(gtp->dev, &list); ++ list_for_each_entry(net, net_list, exit_list) { ++ struct gtp_net *gn = net_generic(net, gtp_net_id); ++ struct gtp_dev *gtp, *gtp_next; ++ struct net_device *dev; + +- unregister_netdevice_many(&list); +- rtnl_unlock(); ++ for_each_netdev(net, dev) ++ if (dev->rtnl_link_ops == >p_link_ops) ++ gtp_dellink(dev, dev_to_kill); ++ ++ list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list) ++ gtp_dellink(gtp->dev, dev_to_kill); ++ } + } + + static struct pernet_operations gtp_net_ops = { + .init = gtp_net_init, +- .exit = gtp_net_exit, ++ .exit_batch_rtnl = gtp_net_exit_batch_rtnl, + .id = >p_net_id, + .size = sizeof(struct gtp_net), + }; +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index dc786c3bbccf8b..d6dafd9876d246 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -3125,7 +3125,11 @@ static int ca8210_probe(struct spi_device *spi_device) + spi_set_drvdata(priv->spi, priv); + if (IS_ENABLED(CONFIG_IEEE802154_CA8210_DEBUGFS)) { + cascoda_api_upstream = ca8210_test_int_driver_write; +- ca8210_test_interface_init(priv); ++ ret = ca8210_test_interface_init(priv); ++ if (ret) { ++ dev_crit(&spi_device->dev, "ca8210_test_interface_init failed\n"); ++ goto error; ++ } + } else { + cascoda_api_upstream = NULL; + } +diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c +index 0fc2781ab97080..58da949696c211 100644 +--- a/drivers/nvme/target/io-cmd-bdev.c ++++ b/drivers/nvme/target/io-cmd-bdev.c +@@ -36,7 +36,7 @@ void nvmet_bdev_set_limits(struct block_device *bdev, struct nvme_id_ns *id) + */ + id->nsfeat |= 1 << 4; + /* NPWG = Namespace Preferred Write Granularity. 0's based */ +- id->npwg = lpp0b; ++ id->npwg = to0based(bdev_io_min(bdev) / bdev_logical_block_size(bdev)); + /* NPWA = Namespace Preferred Write Alignment. 0's based */ + id->npwa = id->npwg; + /* NPDG = Namespace Preferred Deallocate Granularity. 0's based */ +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 60ead610547142..9454725af850fe 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -50,7 +50,7 @@ struct of_bus { + u64 (*map)(__be32 *addr, const __be32 *range, + int na, int ns, int pna); + int (*translate)(__be32 *addr, u64 offset, int na); +- bool has_flags; ++ int flag_cells; + unsigned int (*get_flags)(const __be32 *addr); + }; + +@@ -95,11 +95,43 @@ static int of_bus_default_translate(__be32 *addr, u64 offset, int na) + return 0; + } + ++static unsigned int of_bus_default_flags_get_flags(const __be32 *addr) ++{ ++ return of_read_number(addr, 1); ++} ++ + static unsigned int of_bus_default_get_flags(const __be32 *addr) + { + return IORESOURCE_MEM; + } + ++static u64 of_bus_default_flags_map(__be32 *addr, const __be32 *range, int na, ++ int ns, int pna) ++{ ++ u64 cp, s, da; ++ ++ /* Check that flags match */ ++ if (*addr != *range) ++ return OF_BAD_ADDR; ++ ++ /* Read address values, skipping high cell */ ++ cp = of_read_number(range + 1, na - 1); ++ s = of_read_number(range + na + pna, ns); ++ da = of_read_number(addr + 1, na - 1); ++ ++ pr_debug("default flags map, cp=%llx, s=%llx, da=%llx\n", cp, s, da); ++ ++ if (da < cp || da >= (cp + s)) ++ return OF_BAD_ADDR; ++ return da - cp; ++} ++ ++static int of_bus_default_flags_translate(__be32 *addr, u64 offset, int na) ++{ ++ /* Keep "flags" part (high cell) in translated address */ ++ return of_bus_default_translate(addr + 1, offset, na - 1); ++} ++ + #ifdef CONFIG_PCI + static unsigned int of_bus_pci_get_flags(const __be32 *addr) + { +@@ -189,10 +221,6 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns, + return da - cp; + } + +-static int of_bus_pci_translate(__be32 *addr, u64 offset, int na) +-{ +- return of_bus_default_translate(addr + 1, offset, na - 1); +-} + #endif /* CONFIG_PCI */ + + int of_pci_address_to_resource(struct device_node *dev, int bar, +@@ -302,11 +330,6 @@ static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns, + return da - cp; + } + +-static int of_bus_isa_translate(__be32 *addr, u64 offset, int na) +-{ +- return of_bus_default_translate(addr + 1, offset, na - 1); +-} +- + static unsigned int of_bus_isa_get_flags(const __be32 *addr) + { + unsigned int flags = 0; +@@ -319,6 +342,11 @@ static unsigned int of_bus_isa_get_flags(const __be32 *addr) + return flags; + } + ++static int of_bus_default_flags_match(struct device_node *np) ++{ ++ return of_bus_n_addr_cells(np) == 3; ++} ++ + /* + * Array of bus specific translators + */ +@@ -332,8 +360,8 @@ static struct of_bus of_busses[] = { + .match = of_bus_pci_match, + .count_cells = of_bus_pci_count_cells, + .map = of_bus_pci_map, +- .translate = of_bus_pci_translate, +- .has_flags = true, ++ .translate = of_bus_default_flags_translate, ++ .flag_cells = 1, + .get_flags = of_bus_pci_get_flags, + }, + #endif /* CONFIG_PCI */ +@@ -344,10 +372,21 @@ static struct of_bus of_busses[] = { + .match = of_bus_isa_match, + .count_cells = of_bus_isa_count_cells, + .map = of_bus_isa_map, +- .translate = of_bus_isa_translate, +- .has_flags = true, ++ .translate = of_bus_default_flags_translate, ++ .flag_cells = 1, + .get_flags = of_bus_isa_get_flags, + }, ++ /* Default with flags cell */ ++ { ++ .name = "default-flags", ++ .addresses = "reg", ++ .match = of_bus_default_flags_match, ++ .count_cells = of_bus_default_count_cells, ++ .map = of_bus_default_flags_map, ++ .translate = of_bus_default_flags_translate, ++ .flag_cells = 1, ++ .get_flags = of_bus_default_flags_get_flags, ++ }, + /* Default */ + { + .name = "default", +@@ -427,7 +466,8 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus, + } + if (ranges == NULL || rlen == 0) { + offset = of_read_number(addr, na); +- memset(addr, 0, pna * 4); ++ /* set address to zero, pass flags through */ ++ memset(addr + pbus->flag_cells, 0, (pna - pbus->flag_cells) * 4); + pr_debug("empty ranges; 1:1 translation\n"); + goto finish; + } +@@ -712,7 +752,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, + int na = parser->na; + int ns = parser->ns; + int np = parser->pna + na + ns; +- int busflag_na = 0; ++ int busflag_na = parser->bus->flag_cells; + + if (!range) + return NULL; +@@ -722,10 +762,6 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, + + range->flags = parser->bus->get_flags(parser->range); + +- /* A extra cell for resource flags */ +- if (parser->bus->has_flags) +- busflag_na = 1; +- + range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na); + + if (parser->dma) +diff --git a/drivers/of/unittest-data/tests-address.dtsi b/drivers/of/unittest-data/tests-address.dtsi +index 6604a52bf6cb85..bc0029cbf8eafa 100644 +--- a/drivers/of/unittest-data/tests-address.dtsi ++++ b/drivers/of/unittest-data/tests-address.dtsi +@@ -14,7 +14,7 @@ address-tests { + #size-cells = <1>; + /* ranges here is to make sure we don't use it for + * dma-ranges translation */ +- ranges = <0x70000000 0x70000000 0x40000000>, ++ ranges = <0x70000000 0x70000000 0x50000000>, + <0x00000000 0xd0000000 0x20000000>; + dma-ranges = <0x0 0x20000000 0x40000000>; + +@@ -43,6 +43,13 @@ pci@90000000 { + <0x42000000 0x0 0xc0000000 0x20000000 0x0 0x10000000>; + }; + ++ bus@a0000000 { ++ #address-cells = <3>; ++ #size-cells = <2>; ++ ranges = <0xf00baa 0x0 0x0 0xa0000000 0x0 0x100000>, ++ <0xf00bee 0x1 0x0 0xb0000000 0x0 0x200000>; ++ }; ++ + }; + }; + }; +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 5a8d37cef0ba6d..d6a250cd7a4011 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1019,6 +1019,113 @@ static void __init of_unittest_pci_dma_ranges(void) + of_node_put(np); + } + ++static void __init of_unittest_bus_ranges(void) ++{ ++ struct device_node *np; ++ struct of_range range; ++ struct of_range_parser parser; ++ int i = 0; ++ ++ np = of_find_node_by_path("/testcase-data/address-tests"); ++ if (!np) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ ++ if (of_range_parser_init(&parser, np)) { ++ pr_err("missing ranges property\n"); ++ return; ++ } ++ ++ /* ++ * Get the "ranges" from the device tree ++ */ ++ for_each_of_range(&parser, &range) { ++ unittest(range.flags == IORESOURCE_MEM, ++ "for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n", ++ np, range.flags, IORESOURCE_MEM); ++ if (!i) { ++ unittest(range.size == 0x50000000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0x70000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x70000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } else { ++ unittest(range.size == 0x20000000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xd0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x00000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } ++ i++; ++ } ++ ++ of_node_put(np); ++} ++ ++static void __init of_unittest_bus_3cell_ranges(void) ++{ ++ struct device_node *np; ++ struct of_range range; ++ struct of_range_parser parser; ++ int i = 0; ++ ++ np = of_find_node_by_path("/testcase-data/address-tests/bus@a0000000"); ++ if (!np) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ ++ if (of_range_parser_init(&parser, np)) { ++ pr_err("missing ranges property\n"); ++ return; ++ } ++ ++ /* ++ * Get the "ranges" from the device tree ++ */ ++ for_each_of_range(&parser, &range) { ++ if (!i) { ++ unittest(range.flags == 0xf00baa, ++ "for_each_of_range wrong flags on node %pOF flags=%x\n", ++ np, range.flags); ++ unittest(range.size == 0x100000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xa0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x0, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } else { ++ unittest(range.flags == 0xf00bee, ++ "for_each_of_range wrong flags on node %pOF flags=%x\n", ++ np, range.flags); ++ unittest(range.size == 0x200000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xb0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x100000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } ++ i++; ++ } ++ ++ of_node_put(np); ++} ++ + static void __init of_unittest_parse_interrupts(void) + { + struct device_node *np; +@@ -3324,6 +3431,8 @@ static int __init of_unittest(void) + of_unittest_dma_get_max_cpu_address(); + of_unittest_parse_dma_ranges(); + of_unittest_pci_dma_ranges(); ++ of_unittest_bus_ranges(); ++ of_unittest_bus_3cell_ranges(); + of_unittest_match_node(); + of_unittest_platform_populate(); + of_unittest_overlay(); +diff --git a/drivers/pci/controller/pci-host-common.c b/drivers/pci/controller/pci-host-common.c +index fd3020a399cf93..d3924a44db02f8 100644 +--- a/drivers/pci/controller/pci-host-common.c ++++ b/drivers/pci/controller/pci-host-common.c +@@ -73,6 +73,10 @@ int pci_host_common_probe(struct platform_device *pdev) + if (IS_ERR(cfg)) + return PTR_ERR(cfg); + ++ /* Do not reassign resources if probe only */ ++ if (!pci_has_flag(PCI_PROBE_ONLY)) ++ pci_add_flags(PCI_REASSIGN_ALL_BUS); ++ + bridge->sysdata = cfg; + bridge->ops = (struct pci_ops *)&ops->pci_ops; + bridge->msi_domain = true; +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index cda6650aa3b113..dd2134c7c4192b 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -3048,18 +3048,20 @@ int pci_host_probe(struct pci_host_bridge *bridge) + + bus = bridge->bus; + +- /* If we must preserve the resource configuration, claim now */ +- if (bridge->preserve_config) +- pci_bus_claim_resources(bus); +- + /* +- * Assign whatever was left unassigned. If we didn't claim above, +- * this will reassign everything. ++ * We insert PCI resources into the iomem_resource and ++ * ioport_resource trees in either pci_bus_claim_resources() ++ * or pci_bus_assign_resources(). + */ +- pci_assign_unassigned_root_bus_resources(bus); ++ if (pci_has_flag(PCI_PROBE_ONLY)) { ++ pci_bus_claim_resources(bus); ++ } else { ++ pci_bus_size_bridges(bus); ++ pci_bus_assign_resources(bus); + +- list_for_each_entry(child, &bus->children, node) +- pcie_bus_configure_settings(child); ++ list_for_each_entry(child, &bus->children, node) ++ pcie_bus_configure_settings(child); ++ } + + pci_bus_add_devices(bus); + return 0; +diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +index e63457e145c719..1bc9557c580660 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +@@ -47,6 +47,8 @@ + #define USB_CTRL_USB_PM_SOFT_RESET_MASK 0x40000000 + #define USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK 0x00800000 + #define USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK 0x00400000 ++#define USB_CTRL_USB_PM_XHC_PME_EN_MASK 0x00000010 ++#define USB_CTRL_USB_PM_XHC_S2_CLK_SWITCH_EN_MASK 0x00000008 + #define USB_CTRL_USB_PM_STATUS 0x08 + #define USB_CTRL_USB_DEVICE_CTL1 0x10 + #define USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK 0x00000003 +@@ -190,10 +192,6 @@ static void usb_init_common(struct brcm_usb_init_params *params) + + pr_debug("%s\n", __func__); + +- USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); +- /* 1 millisecond - for USB clocks to settle down */ +- usleep_range(1000, 2000); +- + if (USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE)) { + reg = brcm_usb_readl(USB_CTRL_REG(ctrl, USB_DEVICE_CTL1)); + reg &= ~USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE); +@@ -222,6 +220,17 @@ static void usb_wake_enable_7211b0(struct brcm_usb_init_params *params, + USB_CTRL_UNSET(ctrl, CTLR_CSHCR, ctl_pme_en); + } + ++static void usb_wake_enable_7216(struct brcm_usb_init_params *params, ++ bool enable) ++{ ++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; ++ ++ if (enable) ++ USB_CTRL_SET(ctrl, USB_PM, XHC_PME_EN); ++ else ++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_PME_EN); ++} ++ + static void usb_init_common_7211b0(struct brcm_usb_init_params *params) + { + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; +@@ -295,6 +304,26 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params) + usb2_eye_fix_7211b0(params); + } + ++static void usb_init_common_7216(struct brcm_usb_init_params *params) ++{ ++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; ++ ++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ ++ /* ++ * The PHY might be in a bad state if it is already powered ++ * up. Toggle the power just in case. ++ */ ++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); ++ USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); ++ ++ /* 1 millisecond - for USB clocks to settle down */ ++ usleep_range(1000, 2000); ++ ++ usb_wake_enable_7216(params, false); ++ usb_init_common(params); ++} ++ + static void usb_init_xhci(struct brcm_usb_init_params *params) + { + pr_debug("%s\n", __func__); +@@ -302,14 +331,19 @@ static void usb_init_xhci(struct brcm_usb_init_params *params) + xhci_soft_reset(params, 0); + } + +-static void usb_uninit_common(struct brcm_usb_init_params *params) ++static void usb_uninit_common_7216(struct brcm_usb_init_params *params) + { + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; + + pr_debug("%s\n", __func__); + +- USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); +- ++ if (params->wake_enabled) { ++ /* Switch to using slower clock during suspend to save power */ ++ USB_CTRL_SET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ usb_wake_enable_7216(params, true); ++ } else { ++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); ++ } + } + + static void usb_uninit_common_7211b0(struct brcm_usb_init_params *params) +@@ -371,9 +405,9 @@ static void usb_set_dual_select(struct brcm_usb_init_params *params, int mode) + + static const struct brcm_usb_init_ops bcm7216_ops = { + .init_ipp = usb_init_ipp, +- .init_common = usb_init_common, ++ .init_common = usb_init_common_7216, + .init_xhci = usb_init_xhci, +- .uninit_common = usb_uninit_common, ++ .uninit_common = usb_uninit_common_7216, + .uninit_xhci = usb_uninit_xhci, + .get_dual_select = usb_get_dual_select, + .set_dual_select = usb_set_dual_select, +@@ -405,5 +439,4 @@ void brcm_usb_dvr_init_7211b0(struct brcm_usb_init_params *params) + + params->family_name = "7211"; + params->ops = &bcm7211b0_ops; +- params->suspend_with_clocks = true; + } +diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.h b/drivers/phy/broadcom/phy-brcm-usb-init.h +index 1ccb5ddab865c3..3236e949884288 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb-init.h ++++ b/drivers/phy/broadcom/phy-brcm-usb-init.h +@@ -61,7 +61,6 @@ struct brcm_usb_init_params { + const struct brcm_usb_init_ops *ops; + struct regmap *syscon_piarbctl; + bool wake_enabled; +- bool suspend_with_clocks; + }; + + void brcm_usb_dvr_init_4908(struct brcm_usb_init_params *params); +diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c +index c0c3ab9b2a153e..2bfd78e2d8fd61 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb.c ++++ b/drivers/phy/broadcom/phy-brcm-usb.c +@@ -598,7 +598,7 @@ static int brcm_usb_phy_suspend(struct device *dev) + * and newer XHCI->2.0-clks/3.0-clks. + */ + +- if (!priv->ini.suspend_with_clocks) { ++ if (!priv->ini.wake_enabled) { + if (priv->phys[BRCM_USB_PHY_3_0].inited) + clk_disable_unprepare(priv->usb_30_clk); + if (priv->phys[BRCM_USB_PHY_2_0].inited || +@@ -615,8 +615,10 @@ static int brcm_usb_phy_resume(struct device *dev) + { + struct brcm_usb_phy_data *priv = dev_get_drvdata(dev); + +- clk_prepare_enable(priv->usb_20_clk); +- clk_prepare_enable(priv->usb_30_clk); ++ if (!priv->ini.wake_enabled) { ++ clk_prepare_enable(priv->usb_20_clk); ++ clk_prepare_enable(priv->usb_30_clk); ++ } + brcm_usb_init_ipp(&priv->ini); + + /* +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index d771a1988f9423..f9b3668154eb0c 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -391,7 +391,6 @@ sg_release(struct inode *inode, struct file *filp) + + mutex_lock(&sdp->open_rel_lock); + scsi_autopm_put_device(sdp->device); +- kref_put(&sfp->f_ref, sg_remove_sfp); + sdp->open_cnt--; + + /* possibly many open()s waiting on exlude clearing, start many; +@@ -403,6 +402,7 @@ sg_release(struct inode *inode, struct file *filp) + wake_up_interruptible(&sdp->open_wait); + } + mutex_unlock(&sdp->open_rel_lock); ++ kref_put(&sfp->f_ref, sg_remove_sfp); + return 0; + } + +diff --git a/drivers/staging/iio/frequency/ad9832.c b/drivers/staging/iio/frequency/ad9832.c +index 60f4f57aab5749..087f9c08a3e98f 100644 +--- a/drivers/staging/iio/frequency/ad9832.c ++++ b/drivers/staging/iio/frequency/ad9832.c +@@ -158,7 +158,7 @@ static int ad9832_write_frequency(struct ad9832_state *st, + static int ad9832_write_phase(struct ad9832_state *st, + unsigned long addr, unsigned long phase) + { +- if (phase > BIT(AD9832_PHASE_BITS)) ++ if (phase >= BIT(AD9832_PHASE_BITS)) + return -EINVAL; + + st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) | +diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c +index d78454deedd97b..91801fccea868a 100644 +--- a/drivers/staging/iio/frequency/ad9834.c ++++ b/drivers/staging/iio/frequency/ad9834.c +@@ -131,7 +131,7 @@ static int ad9834_write_frequency(struct ad9834_state *st, + static int ad9834_write_phase(struct ad9834_state *st, + unsigned long addr, unsigned long phase) + { +- if (phase > BIT(AD9834_PHASE_BITS)) ++ if (phase >= BIT(AD9834_PHASE_BITS)) + return -EINVAL; + st->data = cpu_to_be16(addr | phase); + +diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c +index f27b4aecff3d49..759f567538e2a1 100644 +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -1337,11 +1337,12 @@ static int usblp_set_protocol(struct usblp *usblp, int protocol) + if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL) + return -EINVAL; + ++ alts = usblp->protocol[protocol].alt_setting; ++ if (alts < 0) ++ return -EINVAL; ++ + /* Don't unnecessarily set the interface if there's a single alt. */ + if (usblp->intf->num_altsetting > 1) { +- alts = usblp->protocol[protocol].alt_setting; +- if (alts < 0) +- return -EINVAL; + r = usb_set_interface(usblp->dev, usblp->ifnum, alts); + if (r < 0) { + printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n", +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 7bb3f81ac3b391..1a7a6161e68ff3 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2605,13 +2605,13 @@ int usb_new_device(struct usb_device *udev) + err = sysfs_create_link(&udev->dev.kobj, + &port_dev->dev.kobj, "port"); + if (err) +- goto fail; ++ goto out_del_dev; + + err = sysfs_create_link(&port_dev->dev.kobj, + &udev->dev.kobj, "device"); + if (err) { + sysfs_remove_link(&udev->dev.kobj, "port"); +- goto fail; ++ goto out_del_dev; + } + + if (!test_and_set_bit(port1, hub->child_usage_bits)) +@@ -2623,6 +2623,8 @@ int usb_new_device(struct usb_device *udev) + pm_runtime_put_sync_autosuspend(&udev->dev); + return err; + ++out_del_dev: ++ device_del(&udev->dev); + fail: + usb_set_device_state(udev, USB_STATE_NOTATTACHED); + pm_runtime_disable(&udev->dev); +diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c +index 2d87a4681e6741..e2fc8abdcdcfee 100644 +--- a/drivers/usb/core/port.c ++++ b/drivers/usb/core/port.c +@@ -294,10 +294,11 @@ static int usb_port_runtime_suspend(struct device *dev) + static void usb_port_shutdown(struct device *dev) + { + struct usb_port *port_dev = to_usb_port(dev); ++ struct usb_device *udev = port_dev->child; + +- if (port_dev->child) { +- usb_disable_usb2_hardware_lpm(port_dev->child); +- usb_unlocked_disable_lpm(port_dev->child); ++ if (udev && !udev->port_is_suspended) { ++ usb_disable_usb2_hardware_lpm(udev); ++ usb_unlocked_disable_lpm(udev); + } + } + +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 3d434c110bdb6e..d4a37a1539d2cf 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -430,6 +430,7 @@ + #define DWC3_DCTL_TRGTULST_SS_INACT (DWC3_DCTL_TRGTULST(6)) + + /* These apply for core versions 1.94a and later */ ++#define DWC3_DCTL_NYET_THRES_MASK (0xf << 20) + #define DWC3_DCTL_NYET_THRES(n) (((n) & 0xf) << 20) + + #define DWC3_DCTL_KEEP_CONNECT BIT(19) +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 7ab6307fba85f0..d39906248850a8 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4004,8 +4004,10 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc) + WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum, + "LPM Erratum not available on dwc3 revisions < 2.40a\n"); + +- if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) ++ if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) { ++ reg &= ~DWC3_DCTL_NYET_THRES_MASK; + reg |= DWC3_DCTL_NYET_THRES(dwc->lpm_nyet_threshold); ++ } + + dwc3_gadget_dctl_write_safe(dwc, reg); + } else { +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index ad858044e0bfd1..d6dc02ec5fc6e6 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1868,7 +1868,7 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) + + ENTER(); + +- if (WARN_ON(ffs->state != FFS_ACTIVE ++ if ((ffs->state != FFS_ACTIVE + || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) + return -EBADFD; + +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 850394ed8eb14f..6732583490ff65 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -1103,6 +1103,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + uac2->as_in_alt = 0; + } + ++ std_ac_if_desc.bNumEndpoints = 0; + if (FUOUT_EN(uac2_opts) || FUIN_EN(uac2_opts)) { + uac2->int_ep = usb_ep_autoconfig(gadget, &fs_ep_int_desc); + if (!uac2->int_ep) { +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 37ba396d5473fb..8481b8807494d3 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1393,6 +1393,10 @@ void gserial_disconnect(struct gserial *gser) + /* REVISIT as above: how best to track this? */ + port->port_line_coding = gser->port_line_coding; + ++ /* disable endpoints, aborting down any active I/O */ ++ usb_ep_disable(gser->out); ++ usb_ep_disable(gser->in); ++ + port->port_usb = NULL; + gser->ioport = NULL; + if (port->port.count > 0) { +@@ -1404,10 +1408,6 @@ void gserial_disconnect(struct gserial *gser) + spin_unlock(&port->port_lock); + spin_unlock_irqrestore(&serial_port_lock, flags); + +- /* disable endpoints, aborting down any active I/O */ +- usb_ep_disable(gser->out); +- usb_ep_disable(gser->in); +- + /* finally, free any unused/unusable I/O buffers */ + spin_lock_irqsave(&port->port_lock, flags); + if (port->port.count == 0) +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index d358d30569e579..48a1cf5d9a1f61 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -764,11 +764,9 @@ static struct pci_driver xhci_pci_driver = { + /* suspend and resume implemented later */ + + .shutdown = usb_hcd_pci_shutdown, +-#ifdef CONFIG_PM + .driver = { +- .pm = &usb_hcd_pci_pm_ops ++ .pm = pm_ptr(&usb_hcd_pci_pm_ops), + }, +-#endif + }; + + static int __init xhci_pci_init(void) +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 4183942a1c1953..beae02e433f29b 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -223,6 +223,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ ++ { USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */ + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ + { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ + { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 6d80ed3cc540e0..89e6a9afb80823 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -621,7 +621,7 @@ static void option_instat_callback(struct urb *urb); + + /* MeiG Smart Technology products */ + #define MEIGSMART_VENDOR_ID 0x2dee +-/* MeiG Smart SRM825L based on Qualcomm 315 */ ++/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ + #define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 +@@ -2405,6 +2405,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, +@@ -2412,6 +2413,7 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(1) }, + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ + .driver_info = NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) }, /* Neoway N723-EA */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 41c76566d75113..e7f45e60812d1e 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -255,6 +255,13 @@ UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Added by Lubomir Rintel <[email protected]>, a very fine chap */ ++UNUSUAL_DEV( 0x0421, 0x06c2, 0x0000, 0x0406, ++ "Nokia", ++ "Nokia 208", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + #ifdef NO_SDDR09 + UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, + "Microtech", +diff --git a/fs/afs/afs.h b/fs/afs/afs.h +index 432cb4b2396142..3ea5f3e3c922a3 100644 +--- a/fs/afs/afs.h ++++ b/fs/afs/afs.h +@@ -10,7 +10,7 @@ + + #include <linux/in.h> + +-#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ ++#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ + #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ + #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ + #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ +diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h +index 9c65ffb8a523bd..8da0899fbc0835 100644 +--- a/fs/afs/afs_vl.h ++++ b/fs/afs/afs_vl.h +@@ -13,6 +13,7 @@ + #define AFS_VL_PORT 7003 /* volume location service port */ + #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ + #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ ++#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ + + enum AFSVL_Operations { + VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ +diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c +index f04a80e4f5c3fa..83cf1bfbe343ae 100644 +--- a/fs/afs/vl_alias.c ++++ b/fs/afs/vl_alias.c +@@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) + static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) + { + struct afs_cell *master; ++ size_t name_len; + char *cell_name; + + cell_name = afs_vl_get_cell_name(cell, key); +@@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) + return 0; + } + +- master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), +- NULL, false); ++ name_len = strlen(cell_name); ++ if (!name_len || name_len > AFS_MAXCELLNAME) ++ master = ERR_PTR(-EOPNOTSUPP); ++ else ++ master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); + kfree(cell_name); + if (IS_ERR(master)) + return PTR_ERR(master); +diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c +index 00fca3c66ba616..16653f2ffe4f54 100644 +--- a/fs/afs/vlclient.c ++++ b/fs/afs/vlclient.c +@@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) + return ret; + + namesz = ntohl(call->tmp); +- if (namesz > AFS_MAXCELLNAME) ++ if (namesz > YFS_VL_MAXCELLNAME) + return afs_protocol_error(call, afs_eproto_cellname_len); + paddedsz = (namesz + 3) & ~3; + call->count = namesz; +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index a0b6ae02a70b82..8236980957b6a2 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -2432,12 +2432,11 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *pbase, + + if (pos < 0) { + /* +- * A rename didn't occur, but somehow we didn't end up where +- * we thought we would. Throw a warning and try again. ++ * The path is longer than PATH_MAX and this function ++ * cannot ever succeed. Creating paths that long is ++ * possible with Ceph, but Linux cannot use them. + */ +- pr_warn("build_path did not end path lookup where " +- "expected, pos is %d\n", pos); +- goto retry; ++ return ERR_PTR(-ENAMETOOLONG); + } + + *pbase = base; +diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c +index 0a1b1de032efad..70d0849826f261 100644 +--- a/fs/exfat/dir.c ++++ b/fs/exfat/dir.c +@@ -126,7 +126,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent + type = exfat_get_entry_type(ep); + if (type == TYPE_UNUSED) { + brelse(bh); +- break; ++ goto out; + } + + if (type != TYPE_FILE && type != TYPE_DIR) { +@@ -186,6 +186,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent + } + } + ++out: + dir_entry->namebuf.lfn[0] = '\0'; + *cpos = EXFAT_DEN_TO_B(dentry); + return 0; +diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c +index 421c2735310498..8f07504e53458b 100644 +--- a/fs/exfat/fatent.c ++++ b/fs/exfat/fatent.c +@@ -215,6 +215,16 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain + + if (err) + goto dec_used_clus; ++ ++ if (num_clusters >= sbi->num_clusters - EXFAT_FIRST_CLUSTER) { ++ /* ++ * The cluster chain includes a loop, scan the ++ * bitmap to get the number of used clusters. ++ */ ++ exfat_count_used_clusters(sb, &sbi->used_clusters); ++ ++ return 0; ++ } + } while (clu != EXFAT_EOF_CLUSTER); + } + +diff --git a/fs/file.c b/fs/file.c +index b4194ee5c4d4f3..386968003030f2 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -21,6 +21,7 @@ + #include <linux/rcupdate.h> + #include <linux/close_range.h> + #include <net/sock.h> ++#include <linux/init_task.h> + + #include "internal.h" + +diff --git a/fs/hfs/super.c b/fs/hfs/super.c +index 12d9bae393631c..699dd94b1a8647 100644 +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -418,11 +418,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent) + goto bail_no_root; + res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd); + if (!res) { +- if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { ++ if (fd.entrylength != sizeof(rec.dir)) { + res = -EIO; + goto bail_hfs_find; + } + hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); ++ if (rec.type != HFS_CDR_DIR) ++ res = -EIO; + } + if (res) + goto bail_hfs_find; +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 540a3ccb32875b..9b2225ab5fe5ad 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -810,9 +810,9 @@ void jbd2_journal_commit_transaction(journal_t *journal) + /* + * If the journal is not located on the file system device, + * then we must flush the file system device before we issue +- * the commit record ++ * the commit record and update the journal tail sequence. + */ +- if (commit_transaction->t_need_data_flush && ++ if ((commit_transaction->t_need_data_flush || update_tail) && + (journal->j_fs_dev != journal->j_dev) && + (journal->j_flags & JBD2_BARRIER)) + blkdev_issue_flush(journal->j_fs_dev); +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 7f9297a5f3ef55..82b6be188ad4a6 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -714,6 +714,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) + struct smb2_hdr *rsp_hdr; + struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); + ++ if (!in_work) ++ return; ++ + if (allocate_interim_rsp_buf(in_work)) { + pr_err("smb_allocate_rsp_buf failed!\n"); + ksmbd_free_work_struct(in_work); +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index 585163b4e11cec..460df12aa85bb9 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -218,6 +218,7 @@ nfsd_file_alloc(struct net *net, struct inode *inode, unsigned char need, + return NULL; + + INIT_LIST_HEAD(&nf->nf_lru); ++ INIT_LIST_HEAD(&nf->nf_gc); + nf->nf_birthtime = ktime_get(); + nf->nf_file = NULL; + nf->nf_cred = get_current_cred(); +@@ -395,8 +396,8 @@ nfsd_file_dispose_list(struct list_head *dispose) + struct nfsd_file *nf; + + while (!list_empty(dispose)) { +- nf = list_first_entry(dispose, struct nfsd_file, nf_lru); +- list_del_init(&nf->nf_lru); ++ nf = list_first_entry(dispose, struct nfsd_file, nf_gc); ++ list_del_init(&nf->nf_gc); + nfsd_file_free(nf); + } + } +@@ -413,12 +414,12 @@ nfsd_file_dispose_list_delayed(struct list_head *dispose) + { + while(!list_empty(dispose)) { + struct nfsd_file *nf = list_first_entry(dispose, +- struct nfsd_file, nf_lru); ++ struct nfsd_file, nf_gc); + struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id); + struct nfsd_fcache_disposal *l = nn->fcache_disposal; + + spin_lock(&l->lock); +- list_move_tail(&nf->nf_lru, &l->freeme); ++ list_move_tail(&nf->nf_gc, &l->freeme); + spin_unlock(&l->lock); + queue_work(nfsd_filecache_wq, &l->work); + } +@@ -475,7 +476,8 @@ nfsd_file_lru_cb(struct list_head *item, struct list_lru_one *lru, + + /* Refcount went to zero. Unhash it and queue it to the dispose list */ + nfsd_file_unhash(nf); +- list_lru_isolate_move(lru, &nf->nf_lru, head); ++ list_lru_isolate(lru, &nf->nf_lru); ++ list_add(&nf->nf_gc, head); + this_cpu_inc(nfsd_file_evictions); + trace_nfsd_file_gc_disposed(nf); + return LRU_REMOVED; +@@ -554,7 +556,7 @@ nfsd_file_cond_queue(struct nfsd_file *nf, struct list_head *dispose) + + /* If refcount goes to 0, then put on the dispose list */ + if (refcount_sub_and_test(decrement, &nf->nf_ref)) { +- list_add(&nf->nf_lru, dispose); ++ list_add(&nf->nf_gc, dispose); + trace_nfsd_file_closing(nf); + } + } +@@ -630,8 +632,8 @@ nfsd_file_close_inode_sync(struct inode *inode) + + nfsd_file_queue_for_close(inode, &dispose); + while (!list_empty(&dispose)) { +- nf = list_first_entry(&dispose, struct nfsd_file, nf_lru); +- list_del_init(&nf->nf_lru); ++ nf = list_first_entry(&dispose, struct nfsd_file, nf_gc); ++ list_del_init(&nf->nf_gc); + nfsd_file_free(nf); + } + flush_delayed_fput(); +diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h +index e54165a3224f0b..bf7a630f1a4561 100644 +--- a/fs/nfsd/filecache.h ++++ b/fs/nfsd/filecache.h +@@ -44,6 +44,7 @@ struct nfsd_file { + + struct nfsd_file_mark *nf_mark; + struct list_head nf_lru; ++ struct list_head nf_gc; + struct rcu_head nf_rcu; + ktime_t nf_birthtime; + }; +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index effe92c7d6937c..cc464c9560e25a 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid) + int status = 0; + + trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type); +- if (!sb_has_quota_loaded(sb, type)) { ++ if (!sb_has_quota_active(sb, type)) { + status = -ESRCH; + goto out; + } +diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c +index 7a1c8da9e44b3b..77d5aa90338f1e 100644 +--- a/fs/ocfs2/quota_local.c ++++ b/fs/ocfs2/quota_local.c +@@ -815,7 +815,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) + struct ocfs2_quota_chunk *chunk; + struct ocfs2_local_disk_chunk *dchunk; + int mark_clean = 1, len; +- int status; ++ int status = 0; + + iput(oinfo->dqi_gqinode); + ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock); +@@ -857,17 +857,15 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) + oinfo->dqi_libh, + olq_update_info, + info); +- if (status < 0) { ++ if (status < 0) + mlog_errno(status); +- goto out; +- } +- + out: + ocfs2_inode_unlock(sb_dqopt(sb)->files[type], 1); + brelse(oinfo->dqi_libh); + brelse(oinfo->dqi_lqi_bh); + kfree(oinfo); +- return 0; ++ info->dqi_priv = NULL; ++ return status; + } + + static void olq_set_dquot(struct buffer_head *bh, void *private) +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index c6ee7d8439bcc6..fef8facc3c97e8 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -396,6 +396,8 @@ static ssize_t __read_vmcore(char *buffer, size_t buflen, loff_t *fpos, + if (buflen == 0) + return acc; + } ++ ++ cond_resched(); + } + + return acc; +diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h +index bc5c04d711bbc3..27c363f6b281b6 100644 +--- a/include/linux/blk-cgroup.h ++++ b/include/linux/blk-cgroup.h +@@ -433,10 +433,14 @@ static inline void blkcg_pin_online(struct blkcg *blkcg) + static inline void blkcg_unpin_online(struct blkcg *blkcg) + { + do { ++ struct blkcg *parent; ++ + if (!refcount_dec_and_test(&blkcg->online_pin)) + break; ++ ++ parent = blkcg_parent(blkcg); + blkcg_destroy_blkgs(blkcg); +- blkcg = blkcg_parent(blkcg); ++ blkcg = parent; + } while (blkcg); + } + +diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h +index 254d4a898179c0..8f77bb0f4ae0ca 100644 +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -532,6 +532,7 @@ extern void __init hrtimers_init(void); + extern void sysrq_timer_list_show(void); + + int hrtimers_prepare_cpu(unsigned int cpu); ++int hrtimers_cpu_starting(unsigned int cpu); + #ifdef CONFIG_HOTPLUG_CPU + int hrtimers_cpu_dying(unsigned int cpu); + #else +diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h +index 1bb4945885cec0..476d8fd5a7e5bd 100644 +--- a/include/linux/mlx5/device.h ++++ b/include/linux/mlx5/device.h +@@ -1462,6 +1462,8 @@ static inline u16 mlx5_to_sw_pkey_sz(int pkey_sz) + return MLX5_MIN_PKEY_TABLE_SIZE << pkey_sz; + } + ++#define MLX5_RDMA_RX_NUM_COUNTERS_PRIOS 2 ++#define MLX5_RDMA_TX_NUM_COUNTERS_PRIOS 1 + #define MLX5_BY_PASS_NUM_REGULAR_PRIOS 16 + #define MLX5_BY_PASS_NUM_DONT_TRAP_PRIOS 16 + #define MLX5_BY_PASS_NUM_MULTICAST_PRIOS 1 +diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h +index 0e43f0fb6d73a8..29db7677827d76 100644 +--- a/include/linux/mlx5/fs.h ++++ b/include/linux/mlx5/fs.h +@@ -83,6 +83,8 @@ enum mlx5_flow_namespace_type { + MLX5_FLOW_NAMESPACE_RDMA_RX, + MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL, + MLX5_FLOW_NAMESPACE_RDMA_TX, ++ MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS, ++ MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS, + }; + + enum { +diff --git a/include/linux/poll.h b/include/linux/poll.h +index 7e0fdcf905d2e7..a4af5e14dffed1 100644 +--- a/include/linux/poll.h ++++ b/include/linux/poll.h +@@ -43,8 +43,16 @@ typedef struct poll_table_struct { + + static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p) + { +- if (p && p->_qproc && wait_address) ++ if (p && p->_qproc && wait_address) { + p->_qproc(filp, wait_address, p); ++ /* ++ * This memory barrier is paired in the wq_has_sleeper(). ++ * See the comment above prepare_to_wait(), we need to ++ * ensure that subsequent tests in this thread can't be ++ * reordered with __add_wait_queue() in _qproc() paths. ++ */ ++ smp_mb(); ++ } + } + + /* +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 987550fd46fafe..15247a1cc65c61 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -695,13 +695,12 @@ struct usb_device { + + unsigned long active_duration; + +-#ifdef CONFIG_PM + unsigned long connect_time; + + unsigned do_remote_wakeup:1; + unsigned reset_resume:1; + unsigned port_is_suspended:1; +-#endif ++ + struct wusb_dev *wusb_dev; + int slot_id; + struct usb2_lpm_parameters l1_params; +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index e4e18a5faa9f58..aa43ef8a7aa34d 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -500,9 +500,7 @@ extern void usb_hcd_pci_shutdown(struct pci_dev *dev); + + extern int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *dev); + +-#ifdef CONFIG_PM + extern const struct dev_pm_ops usb_hcd_pci_pm_ops; +-#endif + #endif /* CONFIG_USB_PCI */ + + /* pci-ish (pdev null is ok) buffer alloc/mapping support */ +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 53ec06703fe4e4..7a015055fe6db0 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -278,7 +278,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk) + + static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) + { +- return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; ++ return inet_csk_reqsk_queue_len(sk) > READ_ONCE(sk->sk_max_ack_backlog); + } + + bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); +diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h +index c47baa623ba586..d184b832166b64 100644 +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -389,6 +389,9 @@ struct pernet_operations { + void (*pre_exit)(struct net *net); + void (*exit)(struct net *net); + void (*exit_batch)(struct list_head *net_exit_list); ++ /* Following method is called with RTNL held. */ ++ void (*exit_batch_rtnl)(struct list_head *net_exit_list, ++ struct list_head *dev_kill_list); + unsigned int *id; + size_t size; + }; +diff --git a/kernel/cpu.c b/kernel/cpu.c +index acf16e34265182..eac96f4424e34f 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -1766,7 +1766,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { + }, + [CPUHP_AP_HRTIMERS_DYING] = { + .name = "hrtimers:dying", +- .startup.single = NULL, ++ .startup.single = hrtimers_cpu_starting, + .teardown.single = hrtimers_cpu_dying, + }, + +diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh +index c618e37ccea98b..1b2b61ca80659b 100755 +--- a/kernel/gen_kheaders.sh ++++ b/kernel/gen_kheaders.sh +@@ -82,6 +82,7 @@ find $cpio_dir -type f -print0 | + + # Create archive and try to normalize metadata for reproducibility. + tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ ++ --exclude=".__afs*" --exclude=".nfs*" \ + --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \ + -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index bdd9041d595e97..9e91f69012a737 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -2176,6 +2176,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) + } + + cpu_base->cpu = cpu; ++ hrtimer_cpu_base_init_expiry_lock(cpu_base); ++ return 0; ++} ++ ++int hrtimers_cpu_starting(unsigned int cpu) ++{ ++ struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); ++ ++ /* Clear out any left over state from a CPU down operation */ + cpu_base->active_bases = 0; + cpu_base->hres_active = 0; + cpu_base->hang_detected = 0; +@@ -2184,7 +2193,6 @@ int hrtimers_prepare_cpu(unsigned int cpu) + cpu_base->expires_next = KTIME_MAX; + cpu_base->softirq_expires_next = KTIME_MAX; + cpu_base->online = 1; +- hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; + } + +@@ -2262,6 +2270,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) + void __init hrtimers_init(void) + { + hrtimers_prepare_cpu(smp_processor_id()); ++ hrtimers_cpu_starting(smp_processor_id()); + open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); + } + +diff --git a/mm/filemap.c b/mm/filemap.c +index b76deb24aeea0e..c71e86c12418ea 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2818,7 +2818,7 @@ static inline loff_t page_seek_hole_data(struct xa_state *xas, + do { + if (ops->is_partially_uptodate(page, offset, bsz) == seek_data) + break; +- start = (start + bsz) & ~(bsz - 1); ++ start = (start + bsz) & ~((u64)bsz - 1); + offset += bsz; + } while (offset < thp_size(page)); + unlock: +diff --git a/net/802/psnap.c b/net/802/psnap.c +index 4492e8d7ad2068..ed6e17c8cce938 100644 +--- a/net/802/psnap.c ++++ b/net/802/psnap.c +@@ -55,11 +55,11 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, + goto drop; + + rcu_read_lock(); +- proto = find_snap_client(skb_transport_header(skb)); ++ proto = find_snap_client(skb->data); + if (proto) { + /* Pass the frame on. */ +- skb->transport_header += 5; + skb_pull_rcsum(skb, 5); ++ skb_reset_transport_header(skb); + rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); + } + rcu_read_unlock(); +diff --git a/net/core/filter.c b/net/core/filter.c +index d6042d285aa212..84ec1b14b23f39 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -10509,6 +10509,7 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, + bool is_sockarray = map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY; + struct sock_reuseport *reuse; + struct sock *selected_sk; ++ int err; + + selected_sk = map->ops->map_lookup_elem(map, key); + if (!selected_sk) +@@ -10516,10 +10517,6 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, + + reuse = rcu_dereference(selected_sk->sk_reuseport_cb); + if (!reuse) { +- /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ +- if (sk_is_refcounted(selected_sk)) +- sock_put(selected_sk); +- + /* reuseport_array has only sk with non NULL sk_reuseport_cb. + * The only (!reuse) case here is - the sk has already been + * unhashed (e.g. by close()), so treat it as -ENOENT. +@@ -10527,24 +10524,33 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, + * Other maps (e.g. sock_map) do not provide this guarantee and + * the sk may never be in the reuseport group to begin with. + */ +- return is_sockarray ? -ENOENT : -EINVAL; ++ err = is_sockarray ? -ENOENT : -EINVAL; ++ goto error; + } + + if (unlikely(reuse->reuseport_id != reuse_kern->reuseport_id)) { + struct sock *sk = reuse_kern->sk; + +- if (sk->sk_protocol != selected_sk->sk_protocol) +- return -EPROTOTYPE; +- else if (sk->sk_family != selected_sk->sk_family) +- return -EAFNOSUPPORT; +- +- /* Catch all. Likely bound to a different sockaddr. */ +- return -EBADFD; ++ if (sk->sk_protocol != selected_sk->sk_protocol) { ++ err = -EPROTOTYPE; ++ } else if (sk->sk_family != selected_sk->sk_family) { ++ err = -EAFNOSUPPORT; ++ } else { ++ /* Catch all. Likely bound to a different sockaddr. */ ++ err = -EBADFD; ++ } ++ goto error; + } + + reuse_kern->selected_sk = selected_sk; + + return 0; ++error: ++ /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ ++ if (sk_is_refcounted(selected_sk)) ++ sock_put(selected_sk); ++ ++ return err; + } + + static const struct bpf_func_proto sk_select_reuseport_proto = { +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index 3addbce20f8ed0..1e9e76c4ff5be7 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -313,8 +313,9 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) + { + /* Must be called with pernet_ops_rwsem held */ + const struct pernet_operations *ops, *saved_ops; +- int error = 0; + LIST_HEAD(net_exit_list); ++ LIST_HEAD(dev_kill_list); ++ int error = 0; + + refcount_set(&net->ns.count, 1); + refcount_set(&net->passive, 1); +@@ -350,6 +351,15 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) + + synchronize_rcu(); + ++ ops = saved_ops; ++ rtnl_lock(); ++ list_for_each_entry_continue_reverse(ops, &pernet_list, list) { ++ if (ops->exit_batch_rtnl) ++ ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list); ++ } ++ unregister_netdevice_many(&dev_kill_list); ++ rtnl_unlock(); ++ + ops = saved_ops; + list_for_each_entry_continue_reverse(ops, &pernet_list, list) + ops_exit_list(ops, &net_exit_list); +@@ -554,6 +564,7 @@ static void cleanup_net(struct work_struct *work) + struct net *net, *tmp, *last; + struct llist_node *net_kill_list; + LIST_HEAD(net_exit_list); ++ LIST_HEAD(dev_kill_list); + + /* Atomically snapshot the list of namespaces to cleanup */ + net_kill_list = llist_del_all(&cleanup_list); +@@ -594,6 +605,14 @@ static void cleanup_net(struct work_struct *work) + */ + synchronize_rcu(); + ++ rtnl_lock(); ++ list_for_each_entry_reverse(ops, &pernet_list, list) { ++ if (ops->exit_batch_rtnl) ++ ops->exit_batch_rtnl(&net_exit_list, &dev_kill_list); ++ } ++ unregister_netdevice_many(&dev_kill_list); ++ rtnl_unlock(); ++ + /* Run all of the network namespace exit methods */ + list_for_each_entry_reverse(ops, &pernet_list, list) + ops_exit_list(ops, &net_exit_list); +@@ -1134,7 +1153,17 @@ static void free_exit_list(struct pernet_operations *ops, struct list_head *net_ + { + ops_pre_exit_list(ops, net_exit_list); + synchronize_rcu(); ++ ++ if (ops->exit_batch_rtnl) { ++ LIST_HEAD(dev_kill_list); ++ ++ rtnl_lock(); ++ ops->exit_batch_rtnl(net_exit_list, &dev_kill_list); ++ unregister_netdevice_many(&dev_kill_list); ++ rtnl_unlock(); ++ } + ops_exit_list(ops, net_exit_list); ++ + ops_free_list(ops, net_exit_list); + } + +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index a539f26fe4beaa..5d5f03471eb0c3 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -849,6 +849,9 @@ static ssize_t get_imix_entries(const char __user *buffer, + unsigned long weight; + unsigned long size; + ++ if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES) ++ return -E2BIG; ++ + len = num_arg(&buffer[i], max_digits, &size); + if (len < 0) + return len; +@@ -878,9 +881,6 @@ static ssize_t get_imix_entries(const char __user *buffer, + + i++; + pkt_dev->n_imix_entries++; +- +- if (pkt_dev->n_imix_entries > MAX_IMIX_ENTRIES) +- return -E2BIG; + } while (c == ' '); + + return i; +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index f7c88b860d5d5f..26d28e299f568b 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -615,7 +615,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) + by tcp. Feel free to propose better solution. + --ANK (980728) + */ +- if (np->rxopt.all) ++ if (np->rxopt.all && sk->sk_state != DCCP_LISTEN) + opt_skb = skb_clone_and_charge_r(skb, sk); + + if (sk->sk_state == DCCP_OPEN) { /* Fast path */ +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 407dba4327f534..b7f494cca3e5c0 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -176,7 +176,7 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev) + struct inet6_dev *rt_idev = rt->rt6i_idev; + struct net_device *rt_dev = rt->dst.dev; + +- if (rt_idev->dev == dev) { ++ if (rt_idev && rt_idev->dev == dev) { + rt->rt6i_idev = in6_dev_get(loopback_dev); + in6_dev_put(rt_idev); + } +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index fedbce7ed853e9..e1ca8b73ec08ce 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1503,7 +1503,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) + by tcp. Feel free to propose better solution. + --ANK (980728) + */ +- if (np->rxopt.all) ++ if (np->rxopt.all && sk->sk_state != TCP_LISTEN) + opt_skb = skb_clone_and_charge_r(skb, sk); + + if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */ +@@ -1541,8 +1541,6 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) + if (nsk != sk) { + if (tcp_child_process(sk, nsk, skb)) + goto reset; +- if (opt_skb) +- __kfree_skb(opt_skb); + return 0; + } + } else +diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c +index 3e510664fc8912..ecc084e2e5dd65 100644 +--- a/net/mac802154/iface.c ++++ b/net/mac802154/iface.c +@@ -688,6 +688,10 @@ void ieee802154_if_remove(struct ieee802154_sub_if_data *sdata) + ASSERT_RTNL(); + + mutex_lock(&sdata->local->iflist_mtx); ++ if (list_empty(&sdata->local->interfaces)) { ++ mutex_unlock(&sdata->local->iflist_mtx); ++ return; ++ } + list_del_rcu(&sdata->list); + mutex_unlock(&sdata->local->iflist_mtx); + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index e654701685a87f..bdabc5e889b7d8 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -651,7 +651,6 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * + bool drop_other_suboptions = false; + unsigned int opt_size = *size; + bool echo; +- bool port; + int len; + + /* add addr will strip the existing options, be sure to avoid breaking +@@ -660,12 +659,19 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * + if (!mptcp_pm_should_add_signal(msk) || + (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) || + !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &opts->addr, +- &echo, &port, &drop_other_suboptions)) ++ &echo, &drop_other_suboptions)) + return false; + ++ /* ++ * Later on, mptcp_write_options() will enforce mutually exclusion with ++ * DSS, bail out if such option is set and we can't drop it. ++ */ + if (drop_other_suboptions) + remaining += opt_size; +- len = mptcp_add_addr_len(opts->addr.family, echo, port); ++ else if (opts->suboptions & OPTION_MPTCP_DSS) ++ return false; ++ ++ len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port); + if (remaining < len) + return false; + +diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c +index b14eb6bccd3607..4fa31301fe849c 100644 +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -265,11 +265,12 @@ void mptcp_pm_mp_fail_received(struct sock *sk, u64 fail_seq) + bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb, + unsigned int opt_size, unsigned int remaining, + struct mptcp_addr_info *addr, bool *echo, +- bool *port, bool *drop_other_suboptions) ++ bool *drop_other_suboptions) + { + int ret = false; + u8 add_addr; + u8 family; ++ bool port; + + spin_lock_bh(&msk->pm.lock); + +@@ -287,10 +288,10 @@ bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb, + } + + *echo = mptcp_pm_should_add_signal_echo(msk); +- *port = !!(*echo ? msk->pm.remote.port : msk->pm.local.port); ++ port = !!(*echo ? msk->pm.remote.port : msk->pm.local.port); + + family = *echo ? msk->pm.remote.family : msk->pm.local.family; +- if (remaining < mptcp_add_addr_len(family, *echo, *port)) ++ if (remaining < mptcp_add_addr_len(family, *echo, port)) + goto out_unlock; + + if (*echo) { +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 8f5e5a66babf35..6026f0bcdea60f 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -823,7 +823,7 @@ static inline int mptcp_rm_addr_len(const struct mptcp_rm_list *rm_list) + bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb, + unsigned int opt_size, unsigned int remaining, + struct mptcp_addr_info *addr, bool *echo, +- bool *port, bool *drop_other_suboptions); ++ bool *drop_other_suboptions); + bool mptcp_pm_rm_addr_signal(struct mptcp_sock *msk, unsigned int remaining, + struct mptcp_rm_list *rm_list); + int mptcp_pm_get_local_id(struct mptcp_sock *msk, struct sock_common *skc); +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index be6031886f942a..00a97743507deb 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -2589,12 +2589,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) + struct hlist_nulls_head *hash; + unsigned int nr_slots, i; + +- if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) ++ if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + + BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); + nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + ++ if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) ++ return NULL; ++ + hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); + + if (hash && nulls) +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 7fdeed8a318663..e86cc6f4ce9db3 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -7794,6 +7794,7 @@ static void nft_unregister_flowtable_hook(struct net *net, + } + + static void __nft_unregister_flowtable_net_hooks(struct net *net, ++ struct nft_flowtable *flowtable, + struct list_head *hook_list, + bool release_netdev) + { +@@ -7801,6 +7802,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, + + list_for_each_entry_safe(hook, next, hook_list, list) { + nf_unregister_net_hook(net, &hook->ops); ++ flowtable->data.type->setup(&flowtable->data, hook->ops.dev, ++ FLOW_BLOCK_UNBIND); + if (release_netdev) { + list_del(&hook->list); + kfree_rcu(hook, rcu); +@@ -7809,9 +7812,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, + } + + static void nft_unregister_flowtable_net_hooks(struct net *net, ++ struct nft_flowtable *flowtable, + struct list_head *hook_list) + { +- __nft_unregister_flowtable_net_hooks(net, hook_list, false); ++ __nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false); + } + + static int nft_register_flowtable_net_hooks(struct net *net, +@@ -8433,8 +8437,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) + + flowtable->data.type->free(&flowtable->data); + list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { +- flowtable->data.type->setup(&flowtable->data, hook->ops.dev, +- FLOW_BLOCK_UNBIND); + list_del_rcu(&hook->list); + kfree_rcu(hook, rcu); + } +@@ -9668,6 +9670,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + &nft_trans_flowtable_hooks(trans), + NFT_MSG_DELFLOWTABLE); + nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans), + &nft_trans_flowtable_hooks(trans)); + } else { + list_del_rcu(&nft_trans_flowtable(trans)->list); +@@ -9676,6 +9679,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + &nft_trans_flowtable(trans)->hook_list, + NFT_MSG_DELFLOWTABLE); + nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans), + &nft_trans_flowtable(trans)->hook_list); + } + break; +@@ -9906,11 +9910,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + case NFT_MSG_NEWFLOWTABLE: + if (nft_trans_flowtable_update(trans)) { + nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans), + &nft_trans_flowtable_hooks(trans)); + } else { + nft_use_dec_restore(&trans->ctx.table->use); + list_del_rcu(&nft_trans_flowtable(trans)->list); + nft_unregister_flowtable_net_hooks(net, ++ nft_trans_flowtable(trans), + &nft_trans_flowtable(trans)->hook_list); + } + break; +@@ -10451,7 +10457,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table) + list_for_each_entry(chain, &table->chains, list) + __nf_tables_unregister_hook(net, table, chain, true); + list_for_each_entry(flowtable, &table->flowtables, list) +- __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, ++ __nft_unregister_flowtable_net_hooks(net, flowtable, ++ &flowtable->hook_list, + true); + } + +diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c +index 972303aa8edd6a..22ed49748302f1 100644 +--- a/net/sched/cls_flow.c ++++ b/net/sched/cls_flow.c +@@ -354,7 +354,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { + [TCA_FLOW_KEYS] = { .type = NLA_U32 }, + [TCA_FLOW_MODE] = { .type = NLA_U32 }, + [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, +- [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, ++ [TCA_FLOW_RSHIFT] = NLA_POLICY_MAX(NLA_U32, ++ 31 /* BITS_PER_U32 - 1 */), + [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, + [TCA_FLOW_MASK] = { .type = NLA_U32 }, + [TCA_FLOW_XOR] = { .type = NLA_U32 }, +diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c +index 43ebf090029d72..916dc2e81e428f 100644 +--- a/net/sctp/sysctl.c ++++ b/net/sctp/sysctl.c +@@ -380,7 +380,8 @@ static struct ctl_table sctp_net_table[] = { + static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, ++ sctp.sctp_hmac_alg); + struct ctl_table tbl; + bool changed = false; + char *none = "none"; +@@ -425,7 +426,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, + static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.rto_min); + unsigned int min = *(unsigned int *) ctl->extra1; + unsigned int max = *(unsigned int *) ctl->extra2; + struct ctl_table tbl; +@@ -453,7 +454,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, + static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.rto_max); + unsigned int min = *(unsigned int *) ctl->extra1; + unsigned int max = *(unsigned int *) ctl->extra2; + struct ctl_table tbl; +@@ -491,7 +492,7 @@ static int proc_sctp_do_alpha_beta(struct ctl_table *ctl, int write, + static int proc_sctp_do_auth(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.auth_enable); + struct ctl_table tbl; + int new_value, ret; + +@@ -520,7 +521,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write, + static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.udp_port); + unsigned int min = *(unsigned int *)ctl->extra1; + unsigned int max = *(unsigned int *)ctl->extra2; + struct ctl_table tbl; +@@ -561,7 +562,8 @@ static int proc_sctp_do_udp_port(struct ctl_table *ctl, int write, + static int proc_sctp_do_probe_interval(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, ++ sctp.probe_interval); + struct ctl_table tbl; + int ret, new_value; + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index c17c3a14b9c19f..0f93b0ba72df1f 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -453,7 +453,7 @@ int tls_tx_records(struct sock *sk, int flags) + + tx_err: + if (rc < 0 && rc != -EAGAIN) +- tls_err_abort(sk, -EBADMSG); ++ tls_err_abort(sk, rc); + + return rc; + } +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 9a65a2f195853e..943d58b07a559d 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -482,6 +482,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) + */ + vsk->transport->release(vsk); + vsock_deassign_transport(vsk); ++ ++ /* transport's release() and destruct() can touch some socket ++ * state, since we are reassigning the socket to a new transport ++ * during vsock_connect(), let's reset these fields to have a ++ * clean state. ++ */ ++ sock_reset_flag(sk, SOCK_DONE); ++ sk->sk_state = TCP_CLOSE; ++ vsk->peer_shutdown = 0; + } + + /* We increase the module refcnt to prevent the transport unloading +@@ -861,6 +870,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected); + + s64 vsock_stream_has_data(struct vsock_sock *vsk) + { ++ if (WARN_ON(!vsk->transport)) ++ return 0; ++ + return vsk->transport->stream_has_data(vsk); + } + EXPORT_SYMBOL_GPL(vsock_stream_has_data); +@@ -869,6 +881,9 @@ static s64 vsock_connectible_has_data(struct vsock_sock *vsk) + { + struct sock *sk = sk_vsock(vsk); + ++ if (WARN_ON(!vsk->transport)) ++ return 0; ++ + if (sk->sk_type == SOCK_SEQPACKET) + return vsk->transport->seqpacket_has_data(vsk); + else +@@ -877,6 +892,9 @@ static s64 vsock_connectible_has_data(struct vsock_sock *vsk) + + s64 vsock_stream_has_space(struct vsock_sock *vsk) + { ++ if (WARN_ON(!vsk->transport)) ++ return 0; ++ + return vsk->transport->stream_has_space(vsk); + } + EXPORT_SYMBOL_GPL(vsock_stream_has_space); +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 276993dd6416f8..ffd4db198bdf57 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -26,6 +26,9 @@ + /* Threshold for detecting small packets to copy */ + #define GOOD_COPY_LEN 128 + ++static void virtio_transport_cancel_close_work(struct vsock_sock *vsk, ++ bool cancel_timeout); ++ + static const struct virtio_transport * + virtio_transport_get_ops(struct vsock_sock *vsk) + { +@@ -811,6 +814,8 @@ void virtio_transport_destruct(struct vsock_sock *vsk) + { + struct virtio_vsock_sock *vvs = vsk->trans; + ++ virtio_transport_cancel_close_work(vsk, true); ++ + kfree(vvs); + vsk->trans = NULL; + } +@@ -899,17 +904,11 @@ static void virtio_transport_wait_close(struct sock *sk, long timeout) + } + } + +-static void virtio_transport_do_close(struct vsock_sock *vsk, +- bool cancel_timeout) ++static void virtio_transport_cancel_close_work(struct vsock_sock *vsk, ++ bool cancel_timeout) + { + struct sock *sk = sk_vsock(vsk); + +- sock_set_flag(sk, SOCK_DONE); +- vsk->peer_shutdown = SHUTDOWN_MASK; +- if (vsock_stream_has_data(vsk) <= 0) +- sk->sk_state = TCP_CLOSING; +- sk->sk_state_change(sk); +- + if (vsk->close_work_scheduled && + (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { + vsk->close_work_scheduled = false; +@@ -921,6 +920,20 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, + } + } + ++static void virtio_transport_do_close(struct vsock_sock *vsk, ++ bool cancel_timeout) ++{ ++ struct sock *sk = sk_vsock(vsk); ++ ++ sock_set_flag(sk, SOCK_DONE); ++ vsk->peer_shutdown = SHUTDOWN_MASK; ++ if (vsock_stream_has_data(vsk) <= 0) ++ sk->sk_state = TCP_CLOSING; ++ sk->sk_state_change(sk); ++ ++ virtio_transport_cancel_close_work(vsk, cancel_timeout); ++} ++ + static void virtio_transport_close_timeout(struct work_struct *work) + { + struct vsock_sock *vsk = +@@ -1304,8 +1317,11 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, + + lock_sock(sk); + +- /* Check if sk has been closed before lock_sock */ +- if (sock_flag(sk, SOCK_DONE)) { ++ /* Check if sk has been closed or assigned to another transport before ++ * lock_sock (note: listener sockets are not assigned to any transport) ++ */ ++ if (sock_flag(sk, SOCK_DONE) || ++ (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) { + (void)virtio_transport_reset_no_sock(t, pkt); + release_sock(sk); + sock_put(sk); +diff --git a/scripts/sorttable.h b/scripts/sorttable.h +index a2baa2fefb1379..9013b6984d68b4 100644 +--- a/scripts/sorttable.h ++++ b/scripts/sorttable.h +@@ -103,7 +103,7 @@ static inline unsigned long orc_ip(const int *ip) + + static int orc_sort_cmp(const void *_a, const void *_b) + { +- struct orc_entry *orc_a; ++ struct orc_entry *orc_a, *orc_b; + const int *a = g_orc_ip_table + *(int *)_a; + const int *b = g_orc_ip_table + *(int *)_b; + unsigned long a_val = orc_ip(a); +@@ -121,6 +121,10 @@ static int orc_sort_cmp(const void *_a, const void *_b) + * whitelisted .o files which didn't get objtool generation. + */ + orc_a = g_orc_table + (a - g_orc_ip_table); ++ orc_b = g_orc_table + (b - g_orc_ip_table); ++ if (orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end && ++ orc_b->sp_reg == ORC_REG_UNDEFINED && !orc_b->end) ++ return 0; + return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1; + } + +diff --git a/sound/soc/mediatek/common/mtk-afe-platform-driver.c b/sound/soc/mediatek/common/mtk-afe-platform-driver.c +index 01501d5747a7c0..52495c930ca3bf 100644 +--- a/sound/soc/mediatek/common/mtk-afe-platform-driver.c ++++ b/sound/soc/mediatek/common/mtk-afe-platform-driver.c +@@ -120,8 +120,8 @@ int mtk_afe_pcm_new(struct snd_soc_component *component, + struct mtk_base_afe *afe = snd_soc_component_get_drvdata(component); + + size = afe->mtk_afe_hardware->buffer_bytes_max; +- snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, +- afe->dev, size, size); ++ snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_DEV, afe->dev, 0, size); ++ + return 0; + } + EXPORT_SYMBOL_GPL(mtk_afe_pcm_new);
