commit: 47780bbcdd892f11e96acabcdc9dcac20fc9c99e Author: Arisu Tachibana <alicef <AT> gentoo <DOT> org> AuthorDate: Thu Feb 12 11:12:00 2026 +0000 Commit: Arisu Tachibana <alicef <AT> gentoo <DOT> org> CommitDate: Thu Feb 12 11:12:00 2026 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=47780bbc
Linux patch 5.10.250 Signed-off-by: Arisu Tachibana <alicef <AT> gentoo.org> 0000_README | 4 + 1249_linux-5.10.250.patch | 1212 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1216 insertions(+) diff --git a/0000_README b/0000_README index 4d63e7b8..512e0127 100644 --- a/0000_README +++ b/0000_README @@ -1039,6 +1039,10 @@ Patch: 1248_linux-5.10.249.patch From: https://www.kernel.org Desc: Linux 5.10.249 +Patch: 1249_linux-5.10.250.patch +From: https://www.kernel.org +Desc: Linux 5.10.250 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1249_linux-5.10.250.patch b/1249_linux-5.10.250.patch new file mode 100644 index 00000000..97a6281e --- /dev/null +++ b/1249_linux-5.10.250.patch @@ -0,0 +1,1212 @@ +diff --git a/Makefile b/Makefile +index 7ce2aac53688a8..f2b49458203586 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 249 ++SUBLEVEL = 250 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h +index 111a1d8a41ddfa..b5ad23acb303ac 100644 +--- a/arch/arm/include/asm/string.h ++++ b/arch/arm/include/asm/string.h +@@ -36,7 +36,10 @@ static inline void *memset32(uint32_t *p, uint32_t v, __kernel_size_t n) + extern void *__memset64(uint64_t *, uint32_t low, __kernel_size_t, uint32_t hi); + static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n) + { +- return __memset64(p, v, n * 8, v >> 32); ++ if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN)) ++ return __memset64(p, v, n * 8, v >> 32); ++ else ++ return __memset64(p, v >> 32, n * 8, v); + } + + #endif +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 1f9ccc661d574c..14341376702e66 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -387,7 +387,7 @@ static void bfqg_stats_add_aux(struct bfqg_stats *to, struct bfqg_stats *from) + blkg_rwstat_add_aux(&to->merged, &from->merged); + blkg_rwstat_add_aux(&to->service_time, &from->service_time); + blkg_rwstat_add_aux(&to->wait_time, &from->wait_time); +- bfq_stat_add_aux(&from->time, &from->time); ++ bfq_stat_add_aux(&to->time, &from->time); + bfq_stat_add_aux(&to->avg_queue_size_sum, &from->avg_queue_size_sum); + bfq_stat_add_aux(&to->avg_queue_size_samples, + &from->avg_queue_size_samples); +diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c +index 7b4f154f07e6c9..2a0fb9afcc05e6 100644 +--- a/drivers/android/binderfs.c ++++ b/drivers/android/binderfs.c +@@ -122,8 +122,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode, + mutex_lock(&binderfs_minors_mutex); + if (++info->device_count <= info->mount_opts.max) + minor = ida_alloc_max(&binderfs_minors, +- use_reserve ? BINDERFS_MAX_MINOR : +- BINDERFS_MAX_MINOR_CAPPED, ++ use_reserve ? BINDERFS_MAX_MINOR - 1 : ++ BINDERFS_MAX_MINOR_CAPPED - 1, + GFP_KERNEL); + else + minor = -ENOSPC; +@@ -423,8 +423,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb) + /* Reserve a new minor number for the new device. */ + mutex_lock(&binderfs_minors_mutex); + minor = ida_alloc_max(&binderfs_minors, +- use_reserve ? BINDERFS_MAX_MINOR : +- BINDERFS_MAX_MINOR_CAPPED, ++ use_reserve ? BINDERFS_MAX_MINOR - 1 : ++ BINDERFS_MAX_MINOR_CAPPED - 1, + GFP_KERNEL); + mutex_unlock(&binderfs_minors_mutex); + if (minor < 0) { +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 0ceef7bcfe8ee9..70b4f01ce4b904 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -3560,11 +3560,29 @@ static void rbd_img_object_requests(struct rbd_img_request *img_req) + rbd_assert(!need_exclusive_lock(img_req) || + __rbd_is_lock_owner(rbd_dev)); + +- if (rbd_img_is_write(img_req)) { +- rbd_assert(!img_req->snapc); ++ if (test_bit(IMG_REQ_CHILD, &img_req->flags)) { ++ rbd_assert(!rbd_img_is_write(img_req)); ++ } else { ++ struct request *rq = blk_mq_rq_from_pdu(img_req); ++ u64 off = (u64)blk_rq_pos(rq) << SECTOR_SHIFT; ++ u64 len = blk_rq_bytes(rq); ++ u64 mapping_size; ++ + down_read(&rbd_dev->header_rwsem); +- img_req->snapc = ceph_get_snap_context(rbd_dev->header.snapc); ++ mapping_size = rbd_dev->mapping.size; ++ if (rbd_img_is_write(img_req)) { ++ rbd_assert(!img_req->snapc); ++ img_req->snapc = ++ ceph_get_snap_context(rbd_dev->header.snapc); ++ } + up_read(&rbd_dev->header_rwsem); ++ ++ if (unlikely(off + len > mapping_size)) { ++ rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", ++ off, len, mapping_size); ++ img_req->pending.result = -EIO; ++ return; ++ } + } + + for_each_obj_request(img_req, obj_req) { +@@ -4781,7 +4799,6 @@ static void rbd_queue_workfn(struct work_struct *work) + struct request *rq = blk_mq_rq_from_pdu(img_request); + u64 offset = (u64)blk_rq_pos(rq) << SECTOR_SHIFT; + u64 length = blk_rq_bytes(rq); +- u64 mapping_size; + int result; + + /* Ignore/skip any zero-length requests */ +@@ -4794,17 +4811,9 @@ static void rbd_queue_workfn(struct work_struct *work) + blk_mq_start_request(rq); + + down_read(&rbd_dev->header_rwsem); +- mapping_size = rbd_dev->mapping.size; + rbd_img_capture_header(img_request); + up_read(&rbd_dev->header_rwsem); + +- if (offset + length > mapping_size) { +- rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", offset, +- length, mapping_size); +- result = -EIO; +- goto err_img_request; +- } +- + dout("%s rbd_dev %p img_req %p %s %llu~%llu\n", __func__, rbd_dev, + img_request, obj_op_name(op_type), offset, length); + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8850a5e5ae0e9a..174090489072db 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -280,6 +280,7 @@ + #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 + #define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824 + #define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c ++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA3 0xb882 + + #define USB_VENDOR_ID_CHUNGHWAT 0x2247 + #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001 +@@ -396,6 +397,9 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + ++#define USB_VENDOR_ID_EDIFIER 0x2d99 ++#define USB_DEVICE_ID_EDIFIER_QR30 0xa101 /* EDIFIER Hal0 2.0 SE */ ++ + #define USB_VENDOR_ID_ELAN 0x04f3 + #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401 + #define USB_DEVICE_ID_HP_X2 0x074d +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 5d966acbb0fd4f..1f1e4a383a85ab 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -349,6 +349,7 @@ static const struct mt_class mt_classes[] = { + { .name = MT_CLS_VTL, + .quirks = MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_CONTACT_CNT_ACCURATE | ++ MT_QUIRK_STICKY_FINGERS | + MT_QUIRK_FORCE_GET_FEATURE, + }, + { .name = MT_CLS_GOOGLE, +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 0d15148d52533a..85d81b07b6d47c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -81,6 +81,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER), HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_EDIFIER, USB_DEVICE_ID_EDIFIER_QR30), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II), HID_QUIRK_MULTI_INPUT }, +@@ -738,6 +739,7 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA3) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) }, +diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c +index 6ba944b40fdb48..751eec63cea42b 100644 +--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c ++++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c +@@ -488,6 +488,7 @@ static int ishtp_enum_enum_devices(struct ishtp_cl *hid_ishtp_cl) + int rv; + + /* Send HOSTIF_DM_ENUM_DEVICES */ ++ client_data->enum_devices_done = false; + memset(&msg, 0, sizeof(struct hostif_msg)); + msg.hdr.command = HOSTIF_DM_ENUM_DEVICES; + rv = ishtp_cl_send(hid_ishtp_cl, (unsigned char *)&msg, +diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c +index 479ea4ce451a57..1a6c8ebc32e16c 100644 +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -755,6 +755,7 @@ static ssize_t occ_show_extended(struct device *dev, + * are dynamically allocated, we cannot use the existing kernel macros which + * stringify the name argument. + */ ++__printf(7, 8) + static void occ_init_attribute(struct occ_attribute *attr, int mode, + ssize_t (*show)(struct device *dev, struct device_attribute *attr, char *buf), + ssize_t (*store)(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index eefb25bcf57ff2..c72dbc7252f967 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -3531,6 +3531,23 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + */ + netdev->netdev_ops = &lionetdevops; + ++ lio = GET_LIO(netdev); ++ ++ memset(lio, 0, sizeof(struct lio)); ++ ++ lio->ifidx = ifidx_or_pfnum; ++ ++ props = &octeon_dev->props[i]; ++ props->gmxport = resp->cfg_info.linfo.gmxport; ++ props->netdev = netdev; ++ ++ /* Point to the properties for octeon device to which this ++ * interface belongs. ++ */ ++ lio->oct_dev = octeon_dev; ++ lio->octprops = props; ++ lio->netdev = netdev; ++ + retval = netif_set_real_num_rx_queues(netdev, num_oqueues); + if (retval) { + dev_err(&octeon_dev->pci_dev->dev, +@@ -3547,16 +3564,6 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + goto setup_nic_dev_free; + } + +- lio = GET_LIO(netdev); +- +- memset(lio, 0, sizeof(struct lio)); +- +- lio->ifidx = ifidx_or_pfnum; +- +- props = &octeon_dev->props[i]; +- props->gmxport = resp->cfg_info.linfo.gmxport; +- props->netdev = netdev; +- + lio->linfo.num_rxpciq = num_oqueues; + lio->linfo.num_txpciq = num_iqueues; + for (j = 0; j < num_oqueues; j++) { +@@ -3622,13 +3629,6 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + netdev->min_mtu = LIO_MIN_MTU_SIZE; + netdev->max_mtu = LIO_MAX_MTU_SIZE; + +- /* Point to the properties for octeon device to which this +- * interface belongs. +- */ +- lio->oct_dev = octeon_dev; +- lio->octprops = props; +- lio->netdev = netdev; +- + dev_dbg(&octeon_dev->pci_dev->dev, + "if%d gmx: %d hw_addr: 0x%llx\n", i, + lio->linfo.gmxport, CVM_CAST64(lio->linfo.hw_addr)); +@@ -3773,6 +3773,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + sizeof(struct lio_devlink_priv)); + if (!devlink) { + dev_err(&octeon_dev->pci_dev->dev, "devlink alloc failed\n"); ++ i--; + goto setup_nic_dev_free; + } + +@@ -3793,11 +3794,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + + setup_nic_dev_free: + +- while (i--) { ++ do { + dev_err(&octeon_dev->pci_dev->dev, + "NIC ifidx:%d Setup failed\n", i); + liquidio_destroy_nic_device(octeon_dev, i); +- } ++ } while (i--); + + setup_nic_dev_done: + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +index 226a7842d2fdbb..ff4346652e0f3c 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +@@ -2232,11 +2232,11 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + + setup_nic_dev_free: + +- while (i--) { ++ do { + dev_err(&octeon_dev->pci_dev->dev, + "NIC ifidx:%d Setup failed\n", i); + liquidio_destroy_nic_device(octeon_dev, i); +- } ++ } while (i--); + + setup_nic_dev_done: + +diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c +index cbfd0074493510..af30bf148bc2bf 100644 +--- a/drivers/net/ethernet/google/gve/gve_ethtool.c ++++ b/drivers/net/ethernet/google/gve/gve_ethtool.c +@@ -140,7 +140,8 @@ gve_get_ethtool_stats(struct net_device *netdev, + tmp_rx_desc_err_dropped_pkt, tmp_tx_pkts, tmp_tx_bytes; + u64 rx_buf_alloc_fail, rx_desc_err_dropped_pkt, rx_pkts, + rx_skb_alloc_fail, rx_bytes, tx_pkts, tx_bytes; +- int stats_idx, base_stats_idx, max_stats_idx; ++ int rx_base_stats_idx, max_rx_stats_idx, max_tx_stats_idx; ++ int stats_idx, stats_region_len, nic_stats_len; + struct stats *report_stats; + int *rx_qid_to_stats_idx; + int *tx_qid_to_stats_idx; +@@ -209,8 +210,7 @@ gve_get_ethtool_stats(struct net_device *netdev, + data[i++] = rx_bytes; + data[i++] = tx_bytes; + /* total rx dropped packets */ +- data[i++] = rx_skb_alloc_fail + rx_buf_alloc_fail + +- rx_desc_err_dropped_pkt; ++ data[i++] = rx_skb_alloc_fail + rx_desc_err_dropped_pkt; + /* Skip tx_dropped */ + i++; + +@@ -226,14 +226,33 @@ gve_get_ethtool_stats(struct net_device *netdev, + data[i++] = priv->stats_report_trigger_cnt; + i = GVE_MAIN_STATS_LEN; + +- /* For rx cross-reporting stats, start from nic rx stats in report */ +- base_stats_idx = GVE_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + +- GVE_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues; +- max_stats_idx = NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + +- base_stats_idx; ++ rx_base_stats_idx = 0; ++ max_rx_stats_idx = 0; ++ max_tx_stats_idx = 0; ++ stats_region_len = priv->stats_report_len - ++ sizeof(struct gve_stats_report); ++ nic_stats_len = (NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + ++ NIC_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues) * ++ sizeof(struct stats); ++ if (unlikely((stats_region_len - ++ nic_stats_len) % sizeof(struct stats))) { ++ net_err_ratelimited("Starting index of NIC stats should be multiple of stats size"); ++ } else { ++ /* For rx cross-reporting stats, ++ * start from nic rx stats in report ++ */ ++ rx_base_stats_idx = (stats_region_len - nic_stats_len) / ++ sizeof(struct stats); ++ max_rx_stats_idx = NIC_RX_STATS_REPORT_NUM * ++ priv->rx_cfg.num_queues + ++ rx_base_stats_idx; ++ max_tx_stats_idx = NIC_TX_STATS_REPORT_NUM * ++ priv->tx_cfg.num_queues + ++ max_rx_stats_idx; ++ } + /* Preprocess the stats report for rx, map queue id to start index */ + skip_nic_stats = false; +- for (stats_idx = base_stats_idx; stats_idx < max_stats_idx; ++ for (stats_idx = rx_base_stats_idx; stats_idx < max_rx_stats_idx; + stats_idx += NIC_RX_STATS_REPORT_NUM) { + u32 stat_name = be32_to_cpu(report_stats[stats_idx].stat_name); + u32 queue_id = be32_to_cpu(report_stats[stats_idx].queue_id); +@@ -265,7 +284,6 @@ gve_get_ethtool_stats(struct net_device *netdev, + data[i++] = tmp_rx_bytes; + /* rx dropped packets */ + data[i++] = tmp_rx_skb_alloc_fail + +- tmp_rx_buf_alloc_fail + + tmp_rx_desc_err_dropped_pkt; + data[i++] = rx->rx_copybreak_pkt; + data[i++] = rx->rx_copied_pkt; +@@ -286,13 +304,9 @@ gve_get_ethtool_stats(struct net_device *netdev, + i += priv->rx_cfg.num_queues * NUM_GVE_RX_CNTS; + } + +- /* For tx cross-reporting stats, start from nic tx stats in report */ +- base_stats_idx = max_stats_idx; +- max_stats_idx = NIC_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + +- max_stats_idx; +- /* Preprocess the stats report for tx, map queue id to start index */ + skip_nic_stats = false; +- for (stats_idx = base_stats_idx; stats_idx < max_stats_idx; ++ /* NIC TX stats start right after NIC RX stats */ ++ for (stats_idx = max_rx_stats_idx; stats_idx < max_tx_stats_idx; + stats_idx += NIC_TX_STATS_REPORT_NUM) { + u32 stat_name = be32_to_cpu(report_stats[stats_idx].stat_name); + u32 queue_id = be32_to_cpu(report_stats[stats_idx].queue_id); +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index c409e46e3cfd8d..c22605e6977199 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -124,9 +124,9 @@ static int gve_alloc_stats_report(struct gve_priv *priv) + int tx_stats_num, rx_stats_num; + + tx_stats_num = (GVE_TX_STATS_REPORT_NUM + NIC_TX_STATS_REPORT_NUM) * +- priv->tx_cfg.num_queues; ++ priv->tx_cfg.max_queues; + rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) * +- priv->rx_cfg.num_queues; ++ priv->rx_cfg.max_queues; + priv->stats_report_len = struct_size(priv->stats_report, stats, + size_add(tx_stats_num, rx_stats_num)); + priv->stats_report = +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 49f9f75f5c121b..cae48b1b7020f4 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1519,9 +1519,10 @@ destroy_macvlan_port: + /* the macvlan port may be freed by macvlan_uninit when fail to register. + * so we destroy the macvlan port only when it's valid. + */ +- if (create && macvlan_port_get_rtnl(lowerdev)) { ++ if (macvlan_port_get_rtnl(lowerdev)) { + macvlan_flush_sources(port, vlan); +- macvlan_port_destroy(port->dev); ++ if (create) ++ macvlan_port_destroy(port->dev); + } + return err; + } +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index d4f0dfe1175ab1..4d860d5bbcd73e 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -538,6 +538,11 @@ static const struct usb_device_id products[] = { + USB_DEVICE(0x0fe6, 0x9700), /* SR9700 device */ + .driver_info = (unsigned long)&sr9700_driver_info, + }, ++ { ++ /* SR9700 with virtual driver CD-ROM - interface 0 is the CD-ROM device */ ++ USB_DEVICE_INTERFACE_NUMBER(0x0fe6, 0x9702, 1), ++ .driver_info = (unsigned long)&sr9700_driver_info, ++ }, + {}, /* END */ + }; + +diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c +index e20e18cd04aeda..e86cc3425e9975 100644 +--- a/drivers/net/wireless/ti/wlcore/tx.c ++++ b/drivers/net/wireless/ti/wlcore/tx.c +@@ -210,6 +210,11 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif, + total_blocks = wlcore_hw_calc_tx_blocks(wl, total_len, spare_blocks); + + if (total_blocks <= wl->tx_blocks_available) { ++ if (skb_headroom(skb) < (total_len - skb->len) && ++ pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) { ++ wl1271_free_tx_id(wl, id); ++ return -EAGAIN; ++ } + desc = skb_push(skb, total_len - skb->len); + + wlcore_hw_set_tx_desc_blocks(wl, desc, total_blocks, +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 94ed4b5b725c7f..5d8e57e5fdb187 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -68,9 +68,8 @@ struct nvmet_tcp_cmd { + u32 pdu_len; + u32 pdu_recv; + int sg_idx; +- int nr_mapped; + struct msghdr recv_msg; +- struct kvec *iov; ++ struct bio_vec *iov; + u32 flags; + + struct list_head entry; +@@ -155,6 +154,7 @@ static struct workqueue_struct *nvmet_tcp_wq; + static const struct nvmet_fabrics_ops nvmet_tcp_ops; + static void nvmet_tcp_free_cmd(struct nvmet_tcp_cmd *c); + static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd); ++static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd); + + static inline u16 nvmet_tcp_cmd_tag(struct nvmet_tcp_queue *queue, + struct nvmet_tcp_cmd *cmd) +@@ -286,44 +286,61 @@ static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu) + return 0; + } + +-static void nvmet_tcp_unmap_pdu_iovec(struct nvmet_tcp_cmd *cmd) ++static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) + { +- struct scatterlist *sg; +- int i; +- +- sg = &cmd->req.sg[cmd->sg_idx]; +- +- for (i = 0; i < cmd->nr_mapped; i++) +- kunmap(sg_page(&sg[i])); ++ kfree(cmd->iov); ++ sgl_free(cmd->req.sg); ++ cmd->iov = NULL; ++ cmd->req.sg = NULL; + } + +-static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd) ++static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue); ++ ++static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) + { +- struct kvec *iov = cmd->iov; ++ struct bio_vec *iov = cmd->iov; + struct scatterlist *sg; + u32 length, offset, sg_offset; ++ unsigned int sg_remaining; ++ int nr_pages; + + length = cmd->pdu_len; +- cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE); ++ nr_pages = DIV_ROUND_UP(length, PAGE_SIZE); + offset = cmd->rbytes_done; + cmd->sg_idx = offset / PAGE_SIZE; + sg_offset = offset % PAGE_SIZE; ++ if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { ++ nvmet_tcp_fatal_error(cmd->queue); ++ return; ++ } + sg = &cmd->req.sg[cmd->sg_idx]; ++ sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; + + while (length) { + u32 iov_len = min_t(u32, length, sg->length - sg_offset); + +- iov->iov_base = kmap(sg_page(sg)) + sg->offset + sg_offset; +- iov->iov_len = iov_len; ++ if (!sg_remaining) { ++ nvmet_tcp_fatal_error(cmd->queue); ++ return; ++ } ++ if (!sg->length || sg->length <= sg_offset) { ++ nvmet_tcp_fatal_error(cmd->queue); ++ return; ++ } ++ ++ iov->bv_page = sg_page(sg); ++ iov->bv_len = iov_len; ++ iov->bv_offset = sg->offset + sg_offset; + + length -= iov_len; + sg = sg_next(sg); ++ sg_remaining--; + iov++; + sg_offset = 0; + } + +- iov_iter_kvec(&cmd->recv_msg.msg_iter, READ, cmd->iov, +- cmd->nr_mapped, cmd->pdu_len); ++ iov_iter_bvec(&cmd->recv_msg.msg_iter, READ, cmd->iov, ++ nr_pages, cmd->pdu_len); + } + + static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) +@@ -377,11 +394,11 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) + + return 0; + err: +- sgl_free(cmd->req.sg); ++ nvmet_tcp_free_cmd_buffers(cmd); + return NVME_SC_INTERNAL; + } + +-static void nvmet_tcp_send_ddgst(struct ahash_request *hash, ++static void nvmet_tcp_calc_ddgst(struct ahash_request *hash, + struct nvmet_tcp_cmd *cmd) + { + ahash_request_set_crypt(hash, cmd->req.sg, +@@ -389,23 +406,6 @@ static void nvmet_tcp_send_ddgst(struct ahash_request *hash, + crypto_ahash_digest(hash); + } + +-static void nvmet_tcp_recv_ddgst(struct ahash_request *hash, +- struct nvmet_tcp_cmd *cmd) +-{ +- struct scatterlist sg; +- struct kvec *iov; +- int i; +- +- crypto_ahash_init(hash); +- for (i = 0, iov = cmd->iov; i < cmd->nr_mapped; i++, iov++) { +- sg_init_one(&sg, iov->iov_base, iov->iov_len); +- ahash_request_set_crypt(hash, &sg, NULL, iov->iov_len); +- crypto_ahash_update(hash); +- } +- ahash_request_set_crypt(hash, NULL, (void *)&cmd->exp_ddgst, 0); +- crypto_ahash_final(hash); +-} +- + static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd) + { + struct nvme_tcp_data_pdu *pdu = cmd->data_pdu; +@@ -430,7 +430,7 @@ static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd) + + if (queue->data_digest) { + pdu->hdr.flags |= NVME_TCP_F_DDGST; +- nvmet_tcp_send_ddgst(queue->snd_hash, cmd); ++ nvmet_tcp_calc_ddgst(queue->snd_hash, cmd); + } + + if (cmd->queue->hdr_digest) { +@@ -628,10 +628,8 @@ static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd, bool last_in_batch) + } + } + +- if (queue->nvme_sq.sqhd_disabled) { +- kfree(cmd->iov); +- sgl_free(cmd->req.sg); +- } ++ if (queue->nvme_sq.sqhd_disabled) ++ nvmet_tcp_free_cmd_buffers(cmd); + + return 1; + +@@ -660,8 +658,7 @@ static int nvmet_try_send_response(struct nvmet_tcp_cmd *cmd, + if (left) + return -EAGAIN; + +- kfree(cmd->iov); +- sgl_free(cmd->req.sg); ++ nvmet_tcp_free_cmd_buffers(cmd); + cmd->queue->snd_cmd = NULL; + nvmet_tcp_put_cmd(cmd); + return 1; +@@ -919,7 +916,7 @@ static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue, + } + + queue->rcv_state = NVMET_TCP_RECV_DATA; +- nvmet_tcp_map_pdu_iovec(cmd); ++ nvmet_tcp_build_pdu_iovec(cmd); + cmd->flags |= NVMET_TCP_F_INIT_FAILED; + } + +@@ -972,7 +969,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) + goto err_proto; + } + cmd->pdu_recv = 0; +- nvmet_tcp_map_pdu_iovec(cmd); ++ nvmet_tcp_build_pdu_iovec(cmd); + queue->cmd = cmd; + queue->rcv_state = NVMET_TCP_RECV_DATA; + +@@ -1046,7 +1043,7 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) + if (nvmet_tcp_need_data_in(queue->cmd)) { + if (nvmet_tcp_has_inline_data(queue->cmd)) { + queue->rcv_state = NVMET_TCP_RECV_DATA; +- nvmet_tcp_map_pdu_iovec(queue->cmd); ++ nvmet_tcp_build_pdu_iovec(queue->cmd); + return 0; + } + /* send back R2T */ +@@ -1145,7 +1142,7 @@ static void nvmet_tcp_prep_recv_ddgst(struct nvmet_tcp_cmd *cmd) + { + struct nvmet_tcp_queue *queue = cmd->queue; + +- nvmet_tcp_recv_ddgst(queue->rcv_hash, cmd); ++ nvmet_tcp_calc_ddgst(queue->rcv_hash, cmd); + queue->offset = 0; + queue->left = NVME_TCP_DIGEST_LENGTH; + queue->rcv_state = NVMET_TCP_RECV_DDGST; +@@ -1166,7 +1163,6 @@ static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue) + cmd->rbytes_done += ret; + } + +- nvmet_tcp_unmap_pdu_iovec(cmd); + if (queue->data_digest) { + nvmet_tcp_prep_recv_ddgst(cmd); + return 0; +@@ -1421,9 +1417,7 @@ static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue) + static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd) + { + nvmet_req_uninit(&cmd->req); +- nvmet_tcp_unmap_pdu_iovec(cmd); +- kfree(cmd->iov); +- sgl_free(cmd->req.sg); ++ nvmet_tcp_free_cmd_buffers(cmd); + } + + static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue) +@@ -1433,7 +1427,9 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue) + + for (i = 0; i < queue->nr_cmds; i++, cmd++) { + if (nvmet_tcp_need_data_in(cmd)) +- nvmet_tcp_finish_cmd(cmd); ++ nvmet_req_uninit(&cmd->req); ++ ++ nvmet_tcp_free_cmd_buffers(cmd); + } + + if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) { +diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c +index 1d4d0fbfd63cc6..e533de621ac4b7 100644 +--- a/drivers/platform/x86/intel_telemetry_debugfs.c ++++ b/drivers/platform/x86/intel_telemetry_debugfs.c +@@ -449,7 +449,7 @@ static int telem_pss_states_show(struct seq_file *s, void *unused) + for (index = 0; index < debugfs_conf->pss_ltr_evts; index++) { + seq_printf(s, "%-32s\t%u\n", + debugfs_conf->pss_ltr_data[index].name, +- pss_s0ix_wakeup[index]); ++ pss_ltr_blkd[index]); + } + + seq_puts(s, "\n--------------------------------------\n"); +@@ -459,7 +459,7 @@ static int telem_pss_states_show(struct seq_file *s, void *unused) + for (index = 0; index < debugfs_conf->pss_wakeup_evts; index++) { + seq_printf(s, "%-32s\t%u\n", + debugfs_conf->pss_wakeup[index].name, +- pss_ltr_blkd[index]); ++ pss_s0ix_wakeup[index]); + } + + return 0; +diff --git a/drivers/platform/x86/intel_telemetry_pltdrv.c b/drivers/platform/x86/intel_telemetry_pltdrv.c +index 405dea87de6bf8..dd1ee2730b6a60 100644 +--- a/drivers/platform/x86/intel_telemetry_pltdrv.c ++++ b/drivers/platform/x86/intel_telemetry_pltdrv.c +@@ -610,7 +610,7 @@ static int telemetry_setup(struct platform_device *pdev) + /* Get telemetry Info */ + events = (read_buf & TELEM_INFO_SRAMEVTS_MASK) >> + TELEM_INFO_SRAMEVTS_SHIFT; +- event_regs = read_buf & TELEM_INFO_SRAMEVTS_MASK; ++ event_regs = read_buf & TELEM_INFO_NENABLES_MASK; + if ((events < TELEM_MAX_EVENTS_SRAM) || + (event_regs < TELEM_MAX_EVENTS_SRAM)) { + dev_err(&pdev->dev, "PSS:Insufficient Space for SRAM Trace\n"); +diff --git a/drivers/platform/x86/toshiba_haps.c b/drivers/platform/x86/toshiba_haps.c +index b237bd6b1ee54f..e9ae102c0bfd76 100644 +--- a/drivers/platform/x86/toshiba_haps.c ++++ b/drivers/platform/x86/toshiba_haps.c +@@ -185,7 +185,7 @@ static int toshiba_haps_add(struct acpi_device *acpi_dev) + + pr_info("Toshiba HDD Active Protection Sensor device\n"); + +- haps = kzalloc(sizeof(struct toshiba_haps_dev), GFP_KERNEL); ++ haps = devm_kzalloc(&acpi_dev->dev, sizeof(*haps), GFP_KERNEL); + if (!haps) + return -ENOMEM; + +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 45ba07c6ec2709..29ad78fcdd5f8e 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -801,8 +801,11 @@ void iscsit_dec_session_usage_count(struct iscsi_session *sess) + spin_lock_bh(&sess->session_usage_lock); + sess->session_usage_count--; + +- if (!sess->session_usage_count && sess->session_waiting_on_uc) ++ if (!sess->session_usage_count && sess->session_waiting_on_uc) { ++ spin_unlock_bh(&sess->session_usage_lock); + complete(&sess->session_waiting_on_uc_comp); ++ return; ++ } + + spin_unlock_bh(&sess->session_usage_lock); + } +@@ -870,8 +873,11 @@ void iscsit_dec_conn_usage_count(struct iscsi_conn *conn) + spin_lock_bh(&conn->conn_usage_lock); + conn->conn_usage_count--; + +- if (!conn->conn_usage_count && conn->conn_waiting_on_uc) ++ if (!conn->conn_usage_count && conn->conn_waiting_on_uc) { ++ spin_unlock_bh(&conn->conn_usage_lock); + complete(&conn->conn_waiting_on_uc_comp); ++ return; ++ } + + spin_unlock_bh(&conn->conn_usage_lock); + } +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 225dbe4a564132..221895e0363561 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2255,6 +2255,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, + list) { + list_del_init(&bpage->list); + free_buffer_page(bpage); ++ ++ cond_resched(); + } + } + out_err_unlock: +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 2f5558a097e9bb..8dce0e205c8ed6 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -56,14 +56,17 @@ enum trace_type { + #undef __field_fn + #define __field_fn(type, item) type item; + ++#undef __field_packed ++#define __field_packed(type, item) type item; ++ + #undef __field_struct + #define __field_struct(type, item) __field(type, item) + + #undef __field_desc + #define __field_desc(type, container, item) + +-#undef __field_packed +-#define __field_packed(type, container, item) ++#undef __field_desc_packed ++#define __field_desc_packed(type, container, item) + + #undef __array + #define __array(type, item, size) type item[size]; +diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h +index 18c4a58aff7977..6ea285cc3c21ee 100644 +--- a/kernel/trace/trace_entries.h ++++ b/kernel/trace/trace_entries.h +@@ -78,8 +78,8 @@ FTRACE_ENTRY_PACKED(funcgraph_entry, ftrace_graph_ent_entry, + + F_STRUCT( + __field_struct( struct ftrace_graph_ent, graph_ent ) +- __field_packed( unsigned long, graph_ent, func ) +- __field_packed( int, graph_ent, depth ) ++ __field_desc_packed( unsigned long, graph_ent, func ) ++ __field_desc_packed( int, graph_ent, depth ) + ), + + F_printk("--> %ps (%d)", (void *)__entry->func, __entry->depth) +@@ -92,11 +92,11 @@ FTRACE_ENTRY_PACKED(funcgraph_exit, ftrace_graph_ret_entry, + + F_STRUCT( + __field_struct( struct ftrace_graph_ret, ret ) +- __field_packed( unsigned long, ret, func ) +- __field_packed( unsigned long, ret, overrun ) +- __field_packed( unsigned long long, ret, calltime) +- __field_packed( unsigned long long, ret, rettime ) +- __field_packed( int, ret, depth ) ++ __field_desc_packed( unsigned long, ret, func ) ++ __field_desc_packed( unsigned long, ret, overrun ) ++ __field_desc_packed( unsigned long long, ret, calltime) ++ __field_desc_packed( unsigned long long, ret, rettime ) ++ __field_desc_packed( int, ret, depth ) + ), + + F_printk("<-- %ps (%d) (start: %llx end: %llx) over: %d", +diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c +index 90f81d33fa3f58..78e2bb03b24a24 100644 +--- a/kernel/trace/trace_export.c ++++ b/kernel/trace/trace_export.c +@@ -42,11 +42,14 @@ static int ftrace_event_register(struct trace_event_call *call, + #undef __field_fn + #define __field_fn(type, item) type item; + ++#undef __field_packed ++#define __field_packed(type, item) type item; ++ + #undef __field_desc + #define __field_desc(type, container, item) type item; + +-#undef __field_packed +-#define __field_packed(type, container, item) type item; ++#undef __field_desc_packed ++#define __field_desc_packed(type, container, item) type item; + + #undef __array + #define __array(type, item, size) type item[size]; +@@ -101,11 +104,14 @@ static void __always_unused ____ftrace_check_##name(void) \ + #undef __field_fn + #define __field_fn(_type, _item) __field_ext(_type, _item, FILTER_TRACE_FN) + ++#undef __field_packed ++#define __field_packed(_type, _item) __field_ext_packed(_type, _item, FILTER_OTHER) ++ + #undef __field_desc + #define __field_desc(_type, _container, _item) __field_ext(_type, _item, FILTER_OTHER) + +-#undef __field_packed +-#define __field_packed(_type, _container, _item) __field_ext_packed(_type, _item, FILTER_OTHER) ++#undef __field_desc_packed ++#define __field_desc_packed(_type, _container, _item) __field_ext_packed(_type, _item, FILTER_OTHER) + + #undef __array + #define __array(_type, _item, _len) { \ +@@ -139,11 +145,14 @@ static struct trace_event_fields ftrace_event_fields_##name[] = { \ + #undef __field_fn + #define __field_fn(type, item) + ++#undef __field_packed ++#define __field_packed(type, item) ++ + #undef __field_desc + #define __field_desc(type, container, item) + +-#undef __field_packed +-#define __field_packed(type, container, item) ++#undef __field_desc_packed ++#define __field_desc_packed(type, container, item) + + #undef __array + #define __array(type, item, len) +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 3df4695caef6ce..d5b697701cff69 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -910,7 +910,8 @@ void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata) + + if (ieee80211_sdata_running(sdata)) { + list_for_each_entry(key, &sdata->key_list, list) { +- increment_tailroom_need_count(sdata); ++ if (!(key->flags & KEY_FLAG_TAINTED)) ++ increment_tailroom_need_count(sdata); + ieee80211_key_enable_hw_accel(key); + } + } +diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c +index 7c1a735b9eee38..736e5c08bfd7b4 100644 +--- a/net/mac80211/ocb.c ++++ b/net/mac80211/ocb.c +@@ -47,6 +47,9 @@ void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata, + struct sta_info *sta; + int band; + ++ if (!ifocb->joined) ++ return; ++ + /* XXX: Consider removing the least recently used entry and + * allow new one to be added. + */ +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 3bb7a3314788eb..529f8701a54f78 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -1105,6 +1105,10 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + } + } + ++ sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL); ++ if (sinfo) ++ sta_set_sinfo(sta, sinfo, true); ++ + if (sta->uploaded) { + ret = drv_sta_state(local, sdata, sta, IEEE80211_STA_NONE, + IEEE80211_STA_NOTEXIST); +@@ -1113,9 +1117,6 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + + sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr); + +- sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL); +- if (sinfo) +- sta_set_sinfo(sta, sinfo, true); + cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); + kfree(sinfo); + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 6813ff660b722d..a4fdd1587bb3b7 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -665,6 +665,11 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules) + } + + mt: ++ if (rules > (INT_MAX / sizeof(*new_mt))) { ++ kvfree(new_lt); ++ return -ENOMEM; ++ } ++ + new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL); + if (!new_mt) { + kvfree(new_lt); +@@ -1358,6 +1363,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) + src->bsize * sizeof(*dst->lt) * + src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + ++ if (src->rules > (INT_MAX / sizeof(*src->mt))) ++ goto out_mt; ++ + dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); + if (!dst->mt) + goto out_mt; +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index cc409d55e15764..42e7d2bc783028 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -1223,7 +1223,7 @@ void tipc_crypto_key_flush(struct tipc_crypto *c) + rx = c; + tx = tipc_net(rx->net)->crypto_tx; + if (cancel_delayed_work(&rx->work)) { +- kfree(rx->skey); ++ kfree_sensitive(rx->skey); + rx->skey = NULL; + atomic_xchg(&rx->key_distr, 0); + tipc_node_put(rx->node); +@@ -2398,7 +2398,7 @@ static void tipc_crypto_work_rx(struct work_struct *work) + break; + default: + synchronize_rcu(); +- kfree(rx->skey); ++ kfree_sensitive(rx->skey); + rx->skey = NULL; + break; + } +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 37719fc39f64d3..29b8233d4a9c27 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1389,12 +1389,14 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + tmp = result; + tmp *= SCALE; + do_div(tmp, mcs_divisors[rate->mcs]); +- result = tmp; + + /* and take NSS, DCM into account */ +- result = (result * rate->nss) / 8; ++ tmp *= rate->nss; ++ do_div(tmp, 8); + if (rate->he_dcm) +- result /= 2; ++ do_div(tmp, 2); ++ ++ result = tmp; + + return result / 10000; + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index a9c71f38710ed6..a8f530037033e8 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9270,6 +9270,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x863e, "HP Spectre x360 15-df1xxx", ALC285_FIXUP_HP_SPECTRE_X360_DF1), + SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), + SND_PCI_QUIRK(0x103c, 0x86f9, "HP Spectre x360 13-aw0xxx", ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x8706, "HP Laptop 15s-eq1xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x8720, "HP EliteBook x360 1040 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), +diff --git a/sound/soc/amd/renoir/acp3x-pdm-dma.c b/sound/soc/amd/renoir/acp3x-pdm-dma.c +index 7dcca3674295e3..ca794c2b272d6e 100644 +--- a/sound/soc/amd/renoir/acp3x-pdm-dma.c ++++ b/sound/soc/amd/renoir/acp3x-pdm-dma.c +@@ -308,9 +308,11 @@ static int acp_pdm_dma_close(struct snd_soc_component *component, + struct snd_pcm_substream *substream) + { + struct pdm_dev_data *adata = dev_get_drvdata(component->dev); ++ struct pdm_stream_instance *rtd = substream->runtime->private_data; + + disable_pdm_interrupts(adata->acp_base); + adata->capture_stream = NULL; ++ kfree(rtd); + return 0; + } + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index c7a591ee259002..6e4dbf93c69961 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -1096,6 +1096,9 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, + "reset", GPIOD_OUT_LOW); + if (IS_ERR(adcx140->gpio_reset)) ++ return dev_err_probe(&i2c->dev, PTR_ERR(adcx140->gpio_reset), ++ "Failed to get Reset GPIO\n"); ++ if (!adcx140->gpio_reset) + dev_info(&i2c->dev, "Reset GPIO not defined\n"); + + adcx140->supply_areg = devm_regulator_get_optional(adcx140->dev, +diff --git a/sound/soc/ti/davinci-evm.c b/sound/soc/ti/davinci-evm.c +index 105e56ab9cdc25..745c79cf739df8 100644 +--- a/sound/soc/ti/davinci-evm.c ++++ b/sound/soc/ti/davinci-evm.c +@@ -405,27 +405,32 @@ static int davinci_evm_probe(struct platform_device *pdev) + return -EINVAL; + + dai->cpus->of_node = of_parse_phandle(np, "ti,mcasp-controller", 0); +- if (!dai->cpus->of_node) +- return -EINVAL; ++ if (!dai->cpus->of_node) { ++ ret = -EINVAL; ++ goto err_put; ++ } + + dai->platforms->of_node = dai->cpus->of_node; + + evm_soc_card.dev = &pdev->dev; + ret = snd_soc_of_parse_card_name(&evm_soc_card, "ti,model"); + if (ret) +- return ret; ++ goto err_put; + + mclk = devm_clk_get(&pdev->dev, "mclk"); + if (PTR_ERR(mclk) == -EPROBE_DEFER) { +- return -EPROBE_DEFER; ++ ret = -EPROBE_DEFER; ++ goto err_put; + } else if (IS_ERR(mclk)) { + dev_dbg(&pdev->dev, "mclk not found.\n"); + mclk = NULL; + } + + drvdata = devm_kzalloc(&pdev->dev, sizeof(*drvdata), GFP_KERNEL); +- if (!drvdata) +- return -ENOMEM; ++ if (!drvdata) { ++ ret = -ENOMEM; ++ goto err_put; ++ } + + drvdata->mclk = mclk; + +@@ -435,7 +440,8 @@ static int davinci_evm_probe(struct platform_device *pdev) + if (!drvdata->mclk) { + dev_err(&pdev->dev, + "No clock or clock rate defined.\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_put; + } + drvdata->sysclk = clk_get_rate(drvdata->mclk); + } else if (drvdata->mclk) { +@@ -451,8 +457,25 @@ static int davinci_evm_probe(struct platform_device *pdev) + snd_soc_card_set_drvdata(&evm_soc_card, drvdata); + ret = devm_snd_soc_register_card(&pdev->dev, &evm_soc_card); + +- if (ret) ++ if (ret) { + dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret); ++ goto err_put; ++ } ++ ++ return ret; ++ ++err_put: ++ dai->platforms->of_node = NULL; ++ ++ if (dai->cpus->of_node) { ++ of_node_put(dai->cpus->of_node); ++ dai->cpus->of_node = NULL; ++ } ++ ++ if (dai->codecs->of_node) { ++ of_node_put(dai->codecs->of_node); ++ dai->codecs->of_node = NULL; ++ } + + return ret; + } +diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c +index 518cd8dc390e2d..4702b71aad0831 100644 +--- a/virt/kvm/eventfd.c ++++ b/virt/kvm/eventfd.c +@@ -147,21 +147,18 @@ irqfd_shutdown(struct work_struct *work) + } + + +-/* assumes kvm->irqfds.lock is held */ +-static bool +-irqfd_is_active(struct kvm_kernel_irqfd *irqfd) ++static bool irqfd_is_active(struct kvm_kernel_irqfd *irqfd) + { + return list_empty(&irqfd->list) ? false : true; + } + + /* + * Mark the irqfd as inactive and schedule it for removal +- * +- * assumes kvm->irqfds.lock is held + */ +-static void +-irqfd_deactivate(struct kvm_kernel_irqfd *irqfd) ++static void irqfd_deactivate(struct kvm_kernel_irqfd *irqfd) + { ++ lockdep_assert_held(&irqfd->kvm->irqfds.lock); ++ + BUG_ON(!irqfd_is_active(irqfd)); + + list_del_init(&irqfd->list); +@@ -198,8 +195,15 @@ irqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key) + seq = read_seqcount_begin(&irqfd->irq_entry_sc); + irq = irqfd->irq_entry; + } while (read_seqcount_retry(&irqfd->irq_entry_sc, seq)); +- /* An event has been signaled, inject an interrupt */ +- if (kvm_arch_set_irq_inatomic(&irq, kvm, ++ ++ /* ++ * An event has been signaled, inject an interrupt unless the ++ * irqfd is being deassigned (isn't active), in which case the ++ * routing information may be stale (once the irqfd is removed ++ * from the list, it will stop receiving routing updates). ++ */ ++ if (unlikely(!irqfd_is_active(irqfd)) || ++ kvm_arch_set_irq_inatomic(&irq, kvm, + KVM_USERSPACE_IRQ_SOURCE_ID, 1, + false) == -EWOULDBLOCK) + schedule_work(&irqfd->inject); +@@ -536,18 +540,8 @@ kvm_irqfd_deassign(struct kvm *kvm, struct kvm_irqfd *args) + spin_lock_irq(&kvm->irqfds.lock); + + list_for_each_entry_safe(irqfd, tmp, &kvm->irqfds.items, list) { +- if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi) { +- /* +- * This clearing of irq_entry.type is needed for when +- * another thread calls kvm_irq_routing_update before +- * we flush workqueue below (we synchronize with +- * kvm_irq_routing_update using irqfds.lock). +- */ +- write_seqcount_begin(&irqfd->irq_entry_sc); +- irqfd->irq_entry.type = 0; +- write_seqcount_end(&irqfd->irq_entry_sc); ++ if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi) + irqfd_deactivate(irqfd); +- } + } + + spin_unlock_irq(&kvm->irqfds.lock);
