commit: bbda7f22f22fe20352673151651159111604d20a Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Apr 27 17:28:53 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Apr 27 17:28:53 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bbda7f22
Linux patch 4.9.171 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1170_linux-4.9.171.patch | 1955 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1959 insertions(+) diff --git a/0000_README b/0000_README index ea31894..5425b73 100644 --- a/0000_README +++ b/0000_README @@ -723,6 +723,10 @@ Patch: 1169_linux-4.9.170.patch From: http://www.kernel.org Desc: Linux 4.9.170 +Patch: 1170_linux-4.9.171.patch +From: http://www.kernel.org +Desc: Linux 4.9.171 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1170_linux-4.9.171.patch b/1170_linux-4.9.171.patch new file mode 100644 index 0000000..e7cd389 --- /dev/null +++ b/1170_linux-4.9.171.patch @@ -0,0 +1,1955 @@ +diff --git a/Makefile b/Makefile +index 966069dab768..dbdef749e1c8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 170 ++SUBLEVEL = 171 + EXTRAVERSION = + NAME = Roaring Lionus + +@@ -655,8 +655,7 @@ KBUILD_CFLAGS += $(call cc-option,-fdata-sections,) + endif + + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE +-KBUILD_CFLAGS += $(call cc-option,-Oz,-Os) +-KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) ++KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) + else + ifdef CONFIG_PROFILE_ALL_BRANCHES + KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,) +diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h +index d7116f5935fb..86a43450f014 100644 +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -53,7 +53,7 @@ + static inline int + arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) + { +- int oldval, ret, tmp; ++ int oldval = 0, ret, tmp; + + pagefault_disable(); + +diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S +index eff2f414e22b..ec234c43b3f4 100644 +--- a/arch/x86/crypto/poly1305-avx2-x86_64.S ++++ b/arch/x86/crypto/poly1305-avx2-x86_64.S +@@ -321,6 +321,12 @@ ENTRY(poly1305_4block_avx2) + vpaddq t2,t1,t1 + vmovq t1x,d4 + ++ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> ++ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small ++ # amount. Careful: we must not assume the carry bits 'd0 >> 26', ++ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit ++ # integers. It's true in a single-block implementation, but not here. ++ + # d1 += d0 >> 26 + mov d0,%rax + shr $26,%rax +@@ -359,16 +365,16 @@ ENTRY(poly1305_4block_avx2) + # h0 += (d4 >> 26) * 5 + mov d4,%rax + shr $26,%rax +- lea (%eax,%eax,4),%eax +- add %eax,%ebx ++ lea (%rax,%rax,4),%rax ++ add %rax,%rbx + # h4 = d4 & 0x3ffffff + mov d4,%rax + and $0x3ffffff,%eax + mov %eax,h4 + + # h1 += h0 >> 26 +- mov %ebx,%eax +- shr $26,%eax ++ mov %rbx,%rax ++ shr $26,%rax + add %eax,h1 + # h0 = h0 & 0x3ffffff + andl $0x3ffffff,%ebx +diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S +index 338c748054ed..639d9760b089 100644 +--- a/arch/x86/crypto/poly1305-sse2-x86_64.S ++++ b/arch/x86/crypto/poly1305-sse2-x86_64.S +@@ -251,16 +251,16 @@ ENTRY(poly1305_block_sse2) + # h0 += (d4 >> 26) * 5 + mov d4,%rax + shr $26,%rax +- lea (%eax,%eax,4),%eax +- add %eax,%ebx ++ lea (%rax,%rax,4),%rax ++ add %rax,%rbx + # h4 = d4 & 0x3ffffff + mov d4,%rax + and $0x3ffffff,%eax + mov %eax,h4 + + # h1 += h0 >> 26 +- mov %ebx,%eax +- shr $26,%eax ++ mov %rbx,%rax ++ shr $26,%rax + add %eax,h1 + # h0 = h0 & 0x3ffffff + andl $0x3ffffff,%ebx +@@ -518,6 +518,12 @@ ENTRY(poly1305_2block_sse2) + paddq t2,t1 + movq t1,d4 + ++ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> ++ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small ++ # amount. Careful: we must not assume the carry bits 'd0 >> 26', ++ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit ++ # integers. It's true in a single-block implementation, but not here. ++ + # d1 += d0 >> 26 + mov d0,%rax + shr $26,%rax +@@ -556,16 +562,16 @@ ENTRY(poly1305_2block_sse2) + # h0 += (d4 >> 26) * 5 + mov d4,%rax + shr $26,%rax +- lea (%eax,%eax,4),%eax +- add %eax,%ebx ++ lea (%rax,%rax,4),%rax ++ add %rax,%rbx + # h4 = d4 & 0x3ffffff + mov d4,%rax + and $0x3ffffff,%eax + mov %eax,h4 + + # h1 += h0 >> 26 +- mov %ebx,%eax +- shr $26,%eax ++ mov %rbx,%rax ++ shr $26,%rax + add %eax,h1 + # h0 = h0 & 0x3ffffff + andl $0x3ffffff,%ebx +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index afb222b63cae..de050d5a4506 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -113,22 +113,39 @@ static __initconst const u64 amd_hw_cache_event_ids + }; + + /* +- * AMD Performance Monitor K7 and later. ++ * AMD Performance Monitor K7 and later, up to and including Family 16h: + */ + static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] = + { +- [PERF_COUNT_HW_CPU_CYCLES] = 0x0076, +- [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0, +- [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d, +- [PERF_COUNT_HW_CACHE_MISSES] = 0x077e, +- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2, +- [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3, +- [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */ +- [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */ ++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076, ++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0, ++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d, ++ [PERF_COUNT_HW_CACHE_MISSES] = 0x077e, ++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2, ++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3, ++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */ ++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */ ++}; ++ ++/* ++ * AMD Performance Monitor Family 17h and later: ++ */ ++static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] = ++{ ++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076, ++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0, ++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0xff60, ++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2, ++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3, ++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x0287, ++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x0187, + }; + + static u64 amd_pmu_event_map(int hw_event) + { ++ if (boot_cpu_data.x86 >= 0x17) ++ return amd_f17h_perfmon_event_map[hw_event]; ++ + return amd_perfmon_event_map[hw_event]; + } + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 64a70b2e2285..3f3cfeca1083 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -545,6 +545,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs) + unsigned long *sara = stack_addr(regs); + + ri->ret_addr = (kprobe_opcode_t *) *sara; ++ ri->fp = sara; + + /* Replace the return addr with trampoline addr */ + *sara = (unsigned long) &kretprobe_trampoline; +@@ -746,15 +747,21 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + unsigned long flags, orig_ret_address = 0; + unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline; + kprobe_opcode_t *correct_ret_addr = NULL; ++ void *frame_pointer; ++ bool skipped = false; + + INIT_HLIST_HEAD(&empty_rp); + kretprobe_hash_lock(current, &head, &flags); + /* fixup registers */ + #ifdef CONFIG_X86_64 + regs->cs = __KERNEL_CS; ++ /* On x86-64, we use pt_regs->sp for return address holder. */ ++ frame_pointer = ®s->sp; + #else + regs->cs = __KERNEL_CS | get_kernel_rpl(); + regs->gs = 0; ++ /* On x86-32, we use pt_regs->flags for return address holder. */ ++ frame_pointer = ®s->flags; + #endif + regs->ip = trampoline_address; + regs->orig_ax = ~0UL; +@@ -776,8 +783,25 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + if (ri->task != current) + /* another task is sharing our hash bucket */ + continue; ++ /* ++ * Return probes must be pushed on this hash list correct ++ * order (same as return order) so that it can be poped ++ * correctly. However, if we find it is pushed it incorrect ++ * order, this means we find a function which should not be ++ * probed, because the wrong order entry is pushed on the ++ * path of processing other kretprobe itself. ++ */ ++ if (ri->fp != frame_pointer) { ++ if (!skipped) ++ pr_warn("kretprobe is stacked incorrectly. Trying to fixup.\n"); ++ skipped = true; ++ continue; ++ } + + orig_ret_address = (unsigned long)ri->ret_addr; ++ if (skipped) ++ pr_warn("%ps must be blacklisted because of incorrect kretprobe order\n", ++ ri->rp->kp.addr); + + if (orig_ret_address != trampoline_address) + /* +@@ -795,6 +819,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + if (ri->task != current) + /* another task is sharing our hash bucket */ + continue; ++ if (ri->fp != frame_pointer) ++ continue; + + orig_ret_address = (unsigned long)ri->ret_addr; + if (ri->rp && ri->rp->handler) { +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 510cfc06701a..b636a1e849fd 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2579,15 +2579,13 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) + * CR0/CR3/CR4/EFER. It's all a bit more complicated if the vCPU + * supports long mode. + */ +- cr4 = ctxt->ops->get_cr(ctxt, 4); + if (emulator_has_longmode(ctxt)) { + struct desc_struct cs_desc; + + /* Zero CR4.PCIDE before CR0.PG. */ +- if (cr4 & X86_CR4_PCIDE) { ++ cr4 = ctxt->ops->get_cr(ctxt, 4); ++ if (cr4 & X86_CR4_PCIDE) + ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE); +- cr4 &= ~X86_CR4_PCIDE; +- } + + /* A 32-bit code segment is required to clear EFER.LMA. */ + memset(&cs_desc, 0, sizeof(cs_desc)); +@@ -2601,13 +2599,16 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) + if (cr0 & X86_CR0_PE) + ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE)); + +- /* Now clear CR4.PAE (which must be done before clearing EFER.LME). */ +- if (cr4 & X86_CR4_PAE) +- ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE); ++ if (emulator_has_longmode(ctxt)) { ++ /* Clear CR4.PAE before clearing EFER.LME. */ ++ cr4 = ctxt->ops->get_cr(ctxt, 4); ++ if (cr4 & X86_CR4_PAE) ++ ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE); + +- /* And finally go back to 32-bit mode. */ +- efer = 0; +- ctxt->ops->set_msr(ctxt, MSR_EFER, efer); ++ /* And finally go back to 32-bit mode. */ ++ efer = 0; ++ ctxt->ops->set_msr(ctxt, MSR_EFER, efer); ++ } + + smbase = ctxt->ops->get_smbase(ctxt); + if (emulator_has_longmode(ctxt)) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 01eb0451b96d..9a6d258c3c16 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3940,14 +3940,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) + kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: { ++ int i; ++ struct kvm_vcpu *vcpu; ++ struct kvm *kvm = svm->vcpu.kvm; + struct kvm_lapic *apic = svm->vcpu.arch.apic; + + /* +- * Update ICR high and low, then emulate sending IPI, +- * which is handled when writing APIC_ICR. ++ * At this point, we expect that the AVIC HW has already ++ * set the appropriate IRR bits on the valid target ++ * vcpus. So, we just need to kick the appropriate vcpu. + */ +- kvm_lapic_reg_write(apic, APIC_ICR2, icrh); +- kvm_lapic_reg_write(apic, APIC_ICR, icrl); ++ kvm_for_each_vcpu(i, vcpu, kvm) { ++ bool m = kvm_apic_match_dest(vcpu, apic, ++ icrl & KVM_APIC_SHORT_MASK, ++ GET_APIC_DEST_FIELD(icrh), ++ icrl & KVM_APIC_DEST_MASK); ++ ++ if (m && !avic_vcpu_is_running(vcpu)) ++ kvm_vcpu_wake_up(vcpu); ++ } + break; + } + case AVIC_IPI_FAILURE_INVALID_TARGET: +diff --git a/crypto/testmgr.h b/crypto/testmgr.h +index 9033088ca231..ebff33765ac3 100644 +--- a/crypto/testmgr.h ++++ b/crypto/testmgr.h +@@ -4527,7 +4527,49 @@ static struct hash_testvec poly1305_tv_template[] = { + .psize = 80, + .digest = "\x13\x00\x00\x00\x00\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00", +- }, ++ }, { /* Regression test for overflow in AVX2 implementation */ ++ .plaintext = "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff\xff\xff\xff\xff" ++ "\xff\xff\xff\xff", ++ .psize = 300, ++ .digest = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8" ++ "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1", ++ } + }; + + /* +diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c +index 95ce2e9ccdc6..cc4e642d3180 100644 +--- a/drivers/char/tpm/tpm_i2c_atmel.c ++++ b/drivers/char/tpm/tpm_i2c_atmel.c +@@ -65,7 +65,15 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) + dev_dbg(&chip->dev, + "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__, + (int)min_t(size_t, 64, len), buf, len, status); +- return status; ++ ++ if (status < 0) ++ return status; ++ ++ /* The upper layer does not support incomplete sends. */ ++ if (status != len) ++ return -E2BIG; ++ ++ return 0; + } + + static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) +diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c +index 4afca3968773..e3b8bebfdd30 100644 +--- a/drivers/crypto/amcc/crypto4xx_alg.c ++++ b/drivers/crypto/amcc/crypto4xx_alg.c +@@ -138,7 +138,8 @@ static int crypto4xx_setkey_aes(struct crypto_ablkcipher *cipher, + sa = (struct dynamic_sa_ctl *) ctx->sa_in; + ctx->hash_final = 0; + +- set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV, ++ set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ? ++ SA_SAVE_IV : SA_NOT_SAVE_IV), + SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE, + SA_NO_HEADER_PROC, SA_HASH_ALG_NULL, + SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO, +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index c7524bbbaf98..7d066fa9f2ad 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -646,6 +646,15 @@ static u32 crypto4xx_ablkcipher_done(struct crypto4xx_device *dev, + addr = dma_map_page(dev->core_dev->device, sg_page(dst), + dst->offset, dst->length, DMA_FROM_DEVICE); + } ++ ++ if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { ++ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); ++ ++ crypto4xx_memcpy_from_le32((u32 *)req->iv, ++ pd_uinfo->sr_va->save_iv, ++ crypto_skcipher_ivsize(skcipher)); ++ } ++ + crypto4xx_ret_sg_desc(dev, pd_uinfo); + if (ablk_req->base.complete != NULL) + ablk_req->base.complete(&ablk_req->base, 0); +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 1d645c9ab417..cac262a912c1 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -337,7 +337,8 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook edge11 - M-FBE11"), + }, + .driver_data = (void *)&sipodev_desc +- } ++ }, ++ { } /* Terminate list */ + }; + + +diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c +index 784636800361..780f886ccbfe 100644 +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -1340,6 +1340,8 @@ static int kxcjk1013_resume(struct device *dev) + + mutex_lock(&data->mutex); + ret = kxcjk1013_set_mode(data, OPERATION); ++ if (ret == 0) ++ ret = kxcjk1013_set_range(data, data->range); + mutex_unlock(&data->mutex); + + return ret; +diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c +index 22c4c17cd996..a1d072ecb717 100644 +--- a/drivers/iio/adc/ad_sigma_delta.c ++++ b/drivers/iio/adc/ad_sigma_delta.c +@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta, + if (sigma_delta->info->has_registers) { + data[0] = reg << sigma_delta->info->addr_shift; + data[0] |= sigma_delta->info->read_mask; ++ data[0] |= sigma_delta->comm; + spi_message_add_tail(&t[0], &m); + } + spi_message_add_tail(&t[1], &m); +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index e3e2155b0386..dd9f2280927b 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -704,23 +704,29 @@ static int at91_adc_read_raw(struct iio_dev *idev, + ret = wait_event_interruptible_timeout(st->wq_data_avail, + st->done, + msecs_to_jiffies(1000)); +- if (ret == 0) +- ret = -ETIMEDOUT; +- if (ret < 0) { +- mutex_unlock(&st->lock); +- return ret; +- } +- +- *val = st->last_value; + ++ /* Disable interrupts, regardless if adc conversion was ++ * successful or not ++ */ + at91_adc_writel(st, AT91_ADC_CHDR, + AT91_ADC_CH(chan->channel)); + at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel)); + +- st->last_value = 0; +- st->done = false; ++ if (ret > 0) { ++ /* a valid conversion took place */ ++ *val = st->last_value; ++ st->last_value = 0; ++ st->done = false; ++ ret = IIO_VAL_INT; ++ } else if (ret == 0) { ++ /* conversion timeout */ ++ dev_err(&idev->dev, "ADC Channel %d timeout.\n", ++ chan->channel); ++ ret = -ETIMEDOUT; ++ } ++ + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + + case IIO_CHAN_INFO_SCALE: + *val = st->vref_mv; +diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c +index 821919dd245b..b5a5517e3ce1 100644 +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -583,11 +583,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY: + return bmg160_get_filter(data, val); + case IIO_CHAN_INFO_SCALE: +- *val = 0; + switch (chan->type) { + case IIO_TEMP: +- *val2 = 500000; +- return IIO_VAL_INT_PLUS_MICRO; ++ *val = 500; ++ return IIO_VAL_INT; + case IIO_ANGL_VEL: + { + int i; +@@ -595,6 +594,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev, + for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) { + if (bmg160_scale_table[i].dps_range == + data->dps_range) { ++ *val = 0; + *val2 = bmg160_scale_table[i].scale; + return IIO_VAL_INT_PLUS_MICRO; + } +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 6bf58d27b6fc..df306caba296 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -944,8 +944,7 @@ static bool sdhci_needs_reset(struct sdhci_host *host, struct mmc_request *mrq) + return (!(host->flags & SDHCI_DEVICE_DEAD) && + ((mrq->cmd && mrq->cmd->error) || + (mrq->sbc && mrq->sbc->error) || +- (mrq->data && ((mrq->data->error && !mrq->data->stop) || +- (mrq->data->stop && mrq->data->stop->error))) || ++ (mrq->data && mrq->data->stop && mrq->data->stop->error) || + (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))); + } + +@@ -997,6 +996,16 @@ static void sdhci_finish_data(struct sdhci_host *host) + host->data = NULL; + host->data_cmd = NULL; + ++ /* ++ * The controller needs a reset of internal state machines upon error ++ * conditions. ++ */ ++ if (data->error) { ++ if (!host->cmd || host->cmd == data_cmd) ++ sdhci_do_reset(host, SDHCI_RESET_CMD); ++ sdhci_do_reset(host, SDHCI_RESET_DATA); ++ } ++ + if ((host->flags & (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA)) == + (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA)) + sdhci_adma_table_post(host, data); +@@ -1021,17 +1030,6 @@ static void sdhci_finish_data(struct sdhci_host *host) + if (data->stop && + (data->error || + !data->mrq->sbc)) { +- +- /* +- * The controller needs a reset of internal state machines +- * upon error conditions. +- */ +- if (data->error) { +- if (!host->cmd || host->cmd == data_cmd) +- sdhci_do_reset(host, SDHCI_RESET_CMD); +- sdhci_do_reset(host, SDHCI_RESET_DATA); +- } +- + /* + * 'cap_cmd_during_tfr' request must not use the command line + * after mmc_command_done() has been called. It is upper layer's +@@ -2457,7 +2455,7 @@ static void sdhci_timeout_data_timer(unsigned long data) + * * + \*****************************************************************************/ + +-static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask) ++static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p) + { + if (!host->cmd) { + /* +@@ -2480,20 +2478,12 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask) + else + host->cmd->error = -EILSEQ; + +- /* +- * If this command initiates a data phase and a response +- * CRC error is signalled, the card can start transferring +- * data - the card may have received the command without +- * error. We must not terminate the mmc_request early. +- * +- * If the card did not receive the command or returned an +- * error which prevented it sending data, the data phase +- * will time out. +- */ ++ /* Treat data command CRC error the same as data CRC error */ + if (host->cmd->data && + (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) == + SDHCI_INT_CRC) { + host->cmd = NULL; ++ *intmask_p |= SDHCI_INT_DATA_CRC; + return; + } + +@@ -2722,7 +2712,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id) + } + + if (intmask & SDHCI_INT_CMD_MASK) +- sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK); ++ sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK, &intmask); + + if (intmask & SDHCI_INT_DATA_MASK) + sdhci_data_irq(host, intmask & SDHCI_INT_DATA_MASK); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 24a3433f3944..93169729dfc9 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3134,8 +3134,12 @@ static int bond_netdev_event(struct notifier_block *this, + return NOTIFY_DONE; + + if (event_dev->flags & IFF_MASTER) { ++ int ret; ++ + netdev_dbg(event_dev, "IFF_MASTER\n"); +- return bond_master_netdev_event(event, event_dev); ++ ret = bond_master_netdev_event(event, event_dev); ++ if (ret != NOTIFY_DONE) ++ return ret; + } + + if (event_dev->flags & IFF_SLAVE) { +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 375b6810bf46..b8874faaa813 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1251,6 +1251,23 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_option_port_add; + } + ++ /* set promiscuity level to new slave */ ++ if (dev->flags & IFF_PROMISC) { ++ err = dev_set_promiscuity(port_dev, 1); ++ if (err) ++ goto err_set_slave_promisc; ++ } ++ ++ /* set allmulti level to new slave */ ++ if (dev->flags & IFF_ALLMULTI) { ++ err = dev_set_allmulti(port_dev, 1); ++ if (err) { ++ if (dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(port_dev, -1); ++ goto err_set_slave_promisc; ++ } ++ } ++ + netif_addr_lock_bh(dev); + dev_uc_sync_multiple(port_dev, dev); + dev_mc_sync_multiple(port_dev, dev); +@@ -1267,6 +1284,9 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + + return 0; + ++err_set_slave_promisc: ++ __team_option_inst_del_port(team, port); ++ + err_option_port_add: + team_upper_dev_unlink(team, port); + +@@ -1312,6 +1332,12 @@ static int team_port_del(struct team *team, struct net_device *port_dev) + + team_port_disable(team, port); + list_del_rcu(&port->list); ++ ++ if (dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(port_dev, -1); ++ if (dev->flags & IFF_ALLMULTI) ++ dev_set_allmulti(port_dev, -1); ++ + team_upper_dev_unlink(team, port); + netdev_rx_handler_unregister(port_dev); + team_port_disable_netpoll(port); +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h +index f68d492129c6..822833a52dd3 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h +@@ -669,7 +669,6 @@ enum rt2x00_state_flags { + CONFIG_CHANNEL_HT40, + CONFIG_POWERSAVING, + CONFIG_HT_DISABLED, +- CONFIG_QOS_DISABLED, + CONFIG_MONITORING, + + /* +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +index 987c7c4f43cd..55036ce5465c 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +@@ -666,18 +666,8 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw, + rt2x00dev->intf_associated--; + + rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated); +- +- clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags); + } + +- /* +- * Check for access point which do not support 802.11e . We have to +- * generate data frames sequence number in S/W for such AP, because +- * of H/W bug. +- */ +- if (changes & BSS_CHANGED_QOS && !bss_conf->qos) +- set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags); +- + /* + * When the erp information has changed, we should perform + * additional configuration steps. For all other changes we are done. +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +index 68b620b2462f..9a15a69b96a6 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +@@ -201,15 +201,18 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev, + if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) { + /* + * rt2800 has a H/W (or F/W) bug, device incorrectly increase +- * seqno on retransmited data (non-QOS) frames. To workaround +- * the problem let's generate seqno in software if QOS is +- * disabled. ++ * seqno on retransmitted data (non-QOS) and management frames. ++ * To workaround the problem let's generate seqno in software. ++ * Except for beacons which are transmitted periodically by H/W ++ * hence hardware has to assign seqno for them. + */ +- if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags)) +- __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags); +- else ++ if (ieee80211_is_beacon(hdr->frame_control)) { ++ __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags); + /* H/W will generate sequence number */ + return; ++ } ++ ++ __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags); + } + + /* +diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c +index e3ffd244603e..97aeaddd600d 100644 +--- a/drivers/scsi/libfc/fc_rport.c ++++ b/drivers/scsi/libfc/fc_rport.c +@@ -1935,7 +1935,6 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp) + FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n", + fc_rport_state(rdata)); + +- rdata->flags &= ~FC_RP_STARTED; + fc_rport_enter_delete(rdata, RPORT_EV_STOP); + mutex_unlock(&rdata->rp_mutex); + kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy); +diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c +index 5036eebb9162..2f174a34d9e9 100644 +--- a/drivers/staging/comedi/drivers/ni_usb6501.c ++++ b/drivers/staging/comedi/drivers/ni_usb6501.c +@@ -472,10 +472,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev) + + size = usb_endpoint_maxp(devpriv->ep_tx); + devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); +- if (!devpriv->usb_tx_buf) { +- kfree(devpriv->usb_rx_buf); ++ if (!devpriv->usb_tx_buf) + return -ENOMEM; +- } + + return 0; + } +@@ -527,6 +525,9 @@ static int ni6501_auto_attach(struct comedi_device *dev, + if (!devpriv) + return -ENOMEM; + ++ mutex_init(&devpriv->mut); ++ usb_set_intfdata(intf, devpriv); ++ + ret = ni6501_find_endpoints(dev); + if (ret) + return ret; +@@ -535,9 +536,6 @@ static int ni6501_auto_attach(struct comedi_device *dev, + if (ret) + return ret; + +- mutex_init(&devpriv->mut); +- usb_set_intfdata(intf, devpriv); +- + ret = comedi_alloc_subdevices(dev, 2); + if (ret) + return ret; +diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c +index a004aed0147a..1800eb3ae017 100644 +--- a/drivers/staging/comedi/drivers/vmk80xx.c ++++ b/drivers/staging/comedi/drivers/vmk80xx.c +@@ -691,10 +691,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) + + size = usb_endpoint_maxp(devpriv->ep_tx); + devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); +- if (!devpriv->usb_tx_buf) { +- kfree(devpriv->usb_rx_buf); ++ if (!devpriv->usb_tx_buf) + return -ENOMEM; +- } + + return 0; + } +@@ -809,6 +807,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev, + + devpriv->model = board->model; + ++ sema_init(&devpriv->limit_sem, 8); ++ + ret = vmk80xx_find_usb_endpoints(dev); + if (ret) + return ret; +@@ -817,8 +817,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev, + if (ret) + return ret; + +- sema_init(&devpriv->limit_sem, 8); +- + usb_set_intfdata(intf, devpriv); + + if (devpriv->model == VMK8055_MODEL) +diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c +index 4dc9ca3a11b4..b82a4ab77860 100644 +--- a/drivers/staging/iio/adc/ad7192.c ++++ b/drivers/staging/iio/adc/ad7192.c +@@ -109,10 +109,10 @@ + #define AD7192_CH_AIN3 BIT(6) /* AIN3 - AINCOM */ + #define AD7192_CH_AIN4 BIT(7) /* AIN4 - AINCOM */ + +-#define AD7193_CH_AIN1P_AIN2M 0x000 /* AIN1(+) - AIN2(-) */ +-#define AD7193_CH_AIN3P_AIN4M 0x001 /* AIN3(+) - AIN4(-) */ +-#define AD7193_CH_AIN5P_AIN6M 0x002 /* AIN5(+) - AIN6(-) */ +-#define AD7193_CH_AIN7P_AIN8M 0x004 /* AIN7(+) - AIN8(-) */ ++#define AD7193_CH_AIN1P_AIN2M 0x001 /* AIN1(+) - AIN2(-) */ ++#define AD7193_CH_AIN3P_AIN4M 0x002 /* AIN3(+) - AIN4(-) */ ++#define AD7193_CH_AIN5P_AIN6M 0x004 /* AIN5(+) - AIN6(-) */ ++#define AD7193_CH_AIN7P_AIN8M 0x008 /* AIN7(+) - AIN8(-) */ + #define AD7193_CH_TEMP 0x100 /* Temp senseor */ + #define AD7193_CH_AIN2P_AIN2M 0x200 /* AIN2(+) - AIN2(-) */ + #define AD7193_CH_AIN1 0x401 /* AIN1 - AINCOM */ +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 2383caf88b67..a54dbfe664cd 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -863,8 +863,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem, + u64 start, u64 size, u64 end, + u64 userspace_addr, int perm) + { +- struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC); ++ struct vhost_umem_node *tmp, *node; + ++ if (!size) ++ return -EFAULT; ++ ++ node = kmalloc(sizeof(*node), GFP_ATOMIC); + if (!node) + return -ENOMEM; + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 4ed4736b5bc6..5367b684c1f7 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1157,6 +1157,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file) + } + + struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file); ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr); + void cifsFileInfo_put(struct cifsFileInfo *cifs_file); + + #define CIFS_CACHE_READ_FLG 1 +@@ -1651,6 +1652,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock; + #endif /* CONFIG_CIFS_ACL */ + + void cifs_oplock_break(struct work_struct *work); ++void cifs_queue_oplock_break(struct cifsFileInfo *cfile); + + extern const struct slow_work_ops cifs_oplock_break_ops; + extern struct workqueue_struct *cifsiod_wq; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 7d295bf283ca..e7f1773b25d6 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -358,12 +358,30 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file) + return cifs_file; + } + +-/* +- * Release a reference on the file private data. This may involve closing +- * the filehandle out on the server. Must be called without holding +- * tcon->open_file_lock and cifs_file->file_info_lock. ++/** ++ * cifsFileInfo_put - release a reference of file priv data ++ * ++ * Always potentially wait for oplock handler. See _cifsFileInfo_put(). + */ + void cifsFileInfo_put(struct cifsFileInfo *cifs_file) ++{ ++ _cifsFileInfo_put(cifs_file, true); ++} ++ ++/** ++ * _cifsFileInfo_put - release a reference of file priv data ++ * ++ * This may involve closing the filehandle @cifs_file out on the ++ * server. Must be called without holding tcon->open_file_lock and ++ * cifs_file->file_info_lock. ++ * ++ * If @wait_for_oplock_handler is true and we are releasing the last ++ * reference, wait for any running oplock break handler of the file ++ * and cancel any pending one. If calling this function from the ++ * oplock break handler, you need to pass false. ++ * ++ */ ++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler) + { + struct inode *inode = d_inode(cifs_file->dentry); + struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink); +@@ -411,7 +429,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + + spin_unlock(&tcon->open_file_lock); + +- oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break); ++ oplock_break_cancelled = wait_oplock_handler ? ++ cancel_work_sync(&cifs_file->oplock_break) : false; + + if (!tcon->need_reconnect && !cifs_file->invalidHandle) { + struct TCP_Server_Info *server = tcon->ses->server; +@@ -3913,6 +3932,7 @@ void cifs_oplock_break(struct work_struct *work) + cinode); + cifs_dbg(FYI, "Oplock release rc = %d\n", rc); + } ++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */); + cifs_done_oplock_break(cinode); + } + +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 50559a80acf8..5e75df69062d 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -494,8 +494,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) + CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, + &pCifsInode->flags); + +- queue_work(cifsoplockd_wq, +- &netfile->oplock_break); ++ cifs_queue_oplock_break(netfile); + netfile->oplock_break_cancelled = false; + + spin_unlock(&tcon->open_file_lock); +@@ -592,6 +591,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode) + spin_unlock(&cinode->writers_lock); + } + ++/** ++ * cifs_queue_oplock_break - queue the oplock break handler for cfile ++ * ++ * This function is called from the demultiplex thread when it ++ * receives an oplock break for @cfile. ++ * ++ * Assumes the tcon->open_file_lock is held. ++ * Assumes cfile->file_info_lock is NOT held. ++ */ ++void cifs_queue_oplock_break(struct cifsFileInfo *cfile) ++{ ++ /* ++ * Bump the handle refcount now while we hold the ++ * open_file_lock to enforce the validity of it for the oplock ++ * break handler. The matching put is done at the end of the ++ * handler. ++ */ ++ cifsFileInfo_get(cfile); ++ ++ queue_work(cifsoplockd_wq, &cfile->oplock_break); ++} ++ + void cifs_done_oplock_break(struct cifsInodeInfo *cinode) + { + clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags); +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 244d27bb8fba..9994d15a32fc 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -512,7 +512,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, + clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, + &cinode->flags); + +- queue_work(cifsoplockd_wq, &cfile->oplock_break); ++ cifs_queue_oplock_break(cfile); + kfree(lw); + return true; + } +@@ -656,8 +656,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, + &cinode->flags); + spin_unlock(&cfile->file_info_lock); +- queue_work(cifsoplockd_wq, +- &cfile->oplock_break); ++ ++ cifs_queue_oplock_break(cfile); + + spin_unlock(&tcon->open_file_lock); + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h +index e23392517db9..cb527c78de9f 100644 +--- a/include/linux/kprobes.h ++++ b/include/linux/kprobes.h +@@ -197,6 +197,7 @@ struct kretprobe_instance { + struct kretprobe *rp; + kprobe_opcode_t *ret_addr; + struct task_struct *task; ++ void *fp; + char data[0]; + }; + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index f580352cc6e5..e2845dd53b30 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -668,7 +668,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force) + static int reuse_unused_kprobe(struct kprobe *ap) + { + struct optimized_kprobe *op; +- int ret; + + BUG_ON(!kprobe_unused(ap)); + /* +@@ -682,9 +681,8 @@ static int reuse_unused_kprobe(struct kprobe *ap) + /* Enable the probe again */ + ap->flags &= ~KPROBE_FLAG_DISABLED; + /* Optimize it again (remove from op->list) */ +- ret = kprobe_optready(ap); +- if (ret) +- return ret; ++ if (!kprobe_optready(ap)) ++ return -EINVAL; + + optimize_kprobe(ap); + return 0; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index d5b779d7e79f..26fc428476b9 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3446,9 +3446,6 @@ __lock_set_class(struct lockdep_map *lock, const char *name, + unsigned int depth; + int i; + +- if (unlikely(!debug_locks)) +- return 0; +- + depth = curr->lockdep_depth; + /* + * This function is about (re)setting the class of a held lock, +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 1c630d94f86b..4b1e0669740c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4347,12 +4347,15 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct hrtimer *timer) + return HRTIMER_NORESTART; + } + ++extern const u64 max_cfs_quota_period; ++ + static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) + { + struct cfs_bandwidth *cfs_b = + container_of(timer, struct cfs_bandwidth, period_timer); + int overrun; + int idle = 0; ++ int count = 0; + + raw_spin_lock(&cfs_b->lock); + for (;;) { +@@ -4360,6 +4363,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) + if (!overrun) + break; + ++ if (++count > 3) { ++ u64 new, old = ktime_to_ns(cfs_b->period); ++ ++ new = (old * 147) / 128; /* ~115% */ ++ new = min(new, max_cfs_quota_period); ++ ++ cfs_b->period = ns_to_ktime(new); ++ ++ /* since max is 1s, this is limited to 1e9^2, which fits in u64 */ ++ cfs_b->quota *= new; ++ cfs_b->quota = div64_u64(cfs_b->quota, old); ++ ++ pr_warn_ratelimited( ++ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n", ++ smp_processor_id(), ++ div_u64(new, NSEC_PER_USEC), ++ div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ ++ /* reset count so we don't come right back in here */ ++ count = 0; ++ } ++ + idle = do_sched_cfs_period_timer(cfs_b, overrun); + } + if (idle) +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 5515d578095b..cf0aeaae567e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -124,6 +124,7 @@ static int zero; + static int __maybe_unused one = 1; + static int __maybe_unused two = 2; + static int __maybe_unused four = 4; ++static unsigned long zero_ul; + static unsigned long one_ul = 1; + static unsigned long long_max = LONG_MAX; + static int one_hundred = 100; +@@ -1683,7 +1684,7 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(files_stat.max_files), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, +- .extra1 = &zero, ++ .extra1 = &zero_ul, + .extra2 = &long_max, + }, + { +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 8f4227d4cd39..0043aef0ed8d 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -32,6 +32,7 @@ + #include <linux/list.h> + #include <linux/hash.h> + #include <linux/rcupdate.h> ++#include <linux/kprobes.h> + + #include <trace/events/sched.h> + +@@ -5246,7 +5247,7 @@ void ftrace_reset_array_ops(struct trace_array *tr) + tr->ops->func = ftrace_stub; + } + +-static inline void ++static nokprobe_inline void + __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *ignored, struct pt_regs *regs) + { +@@ -5309,11 +5310,13 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip, + { + __ftrace_ops_list_func(ip, parent_ip, NULL, regs); + } ++NOKPROBE_SYMBOL(ftrace_ops_list_func); + #else + static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip) + { + __ftrace_ops_list_func(ip, parent_ip, NULL, NULL); + } ++NOKPROBE_SYMBOL(ftrace_ops_no_ops); + #endif + + /* +@@ -5343,6 +5346,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip, + preempt_enable_notrace(); + trace_clear_recursion(bit); + } ++NOKPROBE_SYMBOL(ftrace_ops_assist_func); + + /** + * ftrace_ops_get_func - get the function a trampoline should call +diff --git a/mm/percpu.c b/mm/percpu.c +index 3794cfc88689..0462a2a00f05 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -2048,8 +2048,8 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size, + ai->groups[group].base_offset = areas[group] - base; + } + +- pr_info("Embedded %zu pages/cpu @%p s%zu r%zu d%zu u%zu\n", +- PFN_DOWN(size_sum), base, ai->static_size, ai->reserved_size, ++ pr_info("Embedded %zu pages/cpu s%zu r%zu d%zu u%zu\n", ++ PFN_DOWN(size_sum), ai->static_size, ai->reserved_size, + ai->dyn_size, ai->unit_size); + + rc = pcpu_setup_first_chunk(ai, base); +@@ -2162,8 +2162,8 @@ int __init pcpu_page_first_chunk(size_t reserved_size, + } + + /* we're ready, commit */ +- pr_info("%d %s pages/cpu @%p s%zu r%zu d%zu\n", +- unit_pages, psize_str, vm.addr, ai->static_size, ++ pr_info("%d %s pages/cpu s%zu r%zu d%zu\n", ++ unit_pages, psize_str, ai->static_size, + ai->reserved_size, ai->dyn_size); + + rc = pcpu_setup_first_chunk(ai, vm.addr); +diff --git a/mm/vmstat.c b/mm/vmstat.c +index 5e6a4d76659d..9af8d369e112 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1075,13 +1075,8 @@ const char * const vmstat_text[] = { + #endif + #endif /* CONFIG_MEMORY_BALLOON */ + #ifdef CONFIG_DEBUG_TLBFLUSH +-#ifdef CONFIG_SMP + "nr_tlb_remote_flush", + "nr_tlb_remote_flush_received", +-#else +- "", /* nr_tlb_remote_flush */ +- "", /* nr_tlb_remote_flush_received */ +-#endif /* CONFIG_SMP */ + "nr_tlb_local_flush_all", + "nr_tlb_local_flush_one", + #endif /* CONFIG_DEBUG_TLBFLUSH */ +diff --git a/net/atm/lec.c b/net/atm/lec.c +index 1e84c5226c84..704892d79bf1 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -721,7 +721,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) + + static int lec_mcast_attach(struct atm_vcc *vcc, int arg) + { +- if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg]) ++ if (arg < 0 || arg >= MAX_LEC_ITF) ++ return -EINVAL; ++ arg = array_index_nospec(arg, MAX_LEC_ITF); ++ if (!dev_lec[arg]) + return -EINVAL; + vcc->proto_data = dev_lec[arg]; + return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc); +@@ -739,6 +742,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) + i = arg; + if (arg >= MAX_LEC_ITF) + return -EINVAL; ++ i = array_index_nospec(arg, MAX_LEC_ITF); + if (!dev_lec[i]) { + int size; + +diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c +index 267b46af407f..c615dff40ab4 100644 +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -231,13 +231,10 @@ static void __br_handle_local_finish(struct sk_buff *skb) + /* note: already called with rcu_read_lock */ + static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- struct net_bridge_port *p = br_port_get_rcu(skb->dev); +- + __br_handle_local_finish(skb); + +- BR_INPUT_SKB_CB(skb)->brdev = p->br->dev; +- br_pass_frame_up(skb); +- return 0; ++ /* return 1 to signal the okfn() was called so it's ok to use the skb */ ++ return 1; + } + + /* +@@ -308,10 +305,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) + goto forward; + } + +- /* Deliver packet to local host only */ +- NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev), +- NULL, skb, skb->dev, NULL, br_handle_local_finish); +- return RX_HANDLER_CONSUMED; ++ /* The else clause should be hit when nf_hook(): ++ * - returns < 0 (drop/error) ++ * - returns = 0 (stolen/nf_queue) ++ * Thus return 1 from the okfn() to signal the skb is ok to pass ++ */ ++ if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, ++ dev_net(skb->dev), NULL, skb, skb->dev, NULL, ++ br_handle_local_finish) == 1) { ++ return RX_HANDLER_PASS; ++ } else { ++ return RX_HANDLER_CONSUMED; ++ } + } + + forward: +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 2136e45f5277..964ffff90432 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1983,7 +1983,8 @@ static void br_multicast_start_querier(struct net_bridge *br, + + __br_multicast_open(br, query); + +- list_for_each_entry(port, &br->port_list, list) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(port, &br->port_list, list) { + if (port->state == BR_STATE_DISABLED || + port->state == BR_STATE_BLOCKING) + continue; +@@ -1995,6 +1996,7 @@ static void br_multicast_start_querier(struct net_bridge *br, + br_multicast_enable(&port->ip6_own_query); + #endif + } ++ rcu_read_unlock(); + } + + int br_multicast_toggle(struct net_bridge *br, unsigned long val) +diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c +index 030d1531e897..17acc89f9dec 100644 +--- a/net/ipv4/fou.c ++++ b/net/ipv4/fou.c +@@ -119,6 +119,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) + struct guehdr *guehdr; + void *data; + u16 doffset = 0; ++ u8 proto_ctype; + + if (!fou) + return 1; +@@ -210,13 +211,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) + if (unlikely(guehdr->control)) + return gue_control_message(skb, guehdr); + ++ proto_ctype = guehdr->proto_ctype; + __skb_pull(skb, sizeof(struct udphdr) + hdrlen); + skb_reset_transport_header(skb); + + if (iptunnel_pull_offloads(skb)) + goto drop; + +- return -guehdr->proto_ctype; ++ return -proto_ctype; + + drop: + kfree_skb(skb); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index c42fb2330b45..0e2cf9634541 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1170,9 +1170,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie) + + static void ipv4_link_failure(struct sk_buff *skb) + { ++ struct ip_options opt; + struct rtable *rt; ++ int res; ++ ++ /* Recompile ip options since IPCB may not be valid anymore. ++ */ ++ memset(&opt, 0, sizeof(opt)); ++ opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); ++ ++ rcu_read_lock(); ++ res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); ++ rcu_read_unlock(); ++ ++ if (res) ++ return; + +- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); ++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt); + + rt = skb_rtable(skb); + if (rt) +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index cd4f13dda49e..e238539c3497 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -389,11 +389,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb) + static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb) + { + struct tcp_sock *tp = tcp_sk(sk); ++ int room; ++ ++ room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh; + + /* Check #1 */ +- if (tp->rcv_ssthresh < tp->window_clamp && +- (int)tp->rcv_ssthresh < tcp_space(sk) && +- !tcp_under_memory_pressure(sk)) { ++ if (room > 0 && !tcp_under_memory_pressure(sk)) { + int incr; + + /* Check #2. Increase window, if skb with such overhead +@@ -406,8 +407,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb) + + if (incr) { + incr = max_t(int, incr, 2 * skb->len); +- tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr, +- tp->window_clamp); ++ tp->rcv_ssthresh += min(room, incr); + inet_csk(sk)->icsk_ack.quick |= 1; + } + } +diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h +index 49c8a9c9b91f..1a169de60192 100644 +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -1163,6 +1163,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local, + { + struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif); + ++ if (local->in_reconfig) ++ return; ++ + if (!check_sdata_in_driver(sdata)) + return; + +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index 29d6699d5a06..55b4c0dc2b93 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -47,49 +47,9 @@ typedef struct { + struct devtable { + const char *device_id; /* name of table, __mod_<name>__*_device_table. */ + unsigned long id_size; +- void *function; ++ int (*do_entry)(const char *filename, void *symval, char *alias); + }; + +-#define ___cat(a,b) a ## b +-#define __cat(a,b) ___cat(a,b) +- +-/* we need some special handling for this host tool running eventually on +- * Darwin. The Mach-O section handling is a bit different than ELF section +- * handling. The differnces in detail are: +- * a) we have segments which have sections +- * b) we need a API call to get the respective section symbols */ +-#if defined(__MACH__) +-#include <mach-o/getsect.h> +- +-#define INIT_SECTION(name) do { \ +- unsigned long name ## _len; \ +- char *__cat(pstart_,name) = getsectdata("__TEXT", \ +- #name, &__cat(name,_len)); \ +- char *__cat(pstop_,name) = __cat(pstart_,name) + \ +- __cat(name, _len); \ +- __cat(__start_,name) = (void *)__cat(pstart_,name); \ +- __cat(__stop_,name) = (void *)__cat(pstop_,name); \ +- } while (0) +-#define SECTION(name) __attribute__((section("__TEXT, " #name))) +- +-struct devtable **__start___devtable, **__stop___devtable; +-#else +-#define INIT_SECTION(name) /* no-op for ELF */ +-#define SECTION(name) __attribute__((section(#name))) +- +-/* We construct a table of pointers in an ELF section (pointers generally +- * go unpadded by gcc). ld creates boundary syms for us. */ +-extern struct devtable *__start___devtable[], *__stop___devtable[]; +-#endif /* __MACH__ */ +- +-#if !defined(__used) +-# if __GNUC__ == 3 && __GNUC_MINOR__ < 3 +-# define __used __attribute__((__unused__)) +-# else +-# define __used __attribute__((__used__)) +-# endif +-#endif +- + /* Define a variable f that holds the value of field f of struct devid + * based at address m. + */ +@@ -102,16 +62,6 @@ extern struct devtable *__start___devtable[], *__stop___devtable[]; + #define DEF_FIELD_ADDR(m, devid, f) \ + typeof(((struct devid *)0)->f) *f = ((m) + OFF_##devid##_##f) + +-/* Add a table entry. We test function type matches while we're here. */ +-#define ADD_TO_DEVTABLE(device_id, type, function) \ +- static struct devtable __cat(devtable,__LINE__) = { \ +- device_id + 0*sizeof((function)((const char *)NULL, \ +- (void *)NULL, \ +- (char *)NULL)), \ +- SIZE_##type, (function) }; \ +- static struct devtable *SECTION(__devtable) __used \ +- __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__) +- + #define ADD(str, sep, cond, field) \ + do { \ + strcat(str, sep); \ +@@ -431,7 +381,6 @@ static int do_hid_entry(const char *filename, + + return 1; + } +-ADD_TO_DEVTABLE("hid", hid_device_id, do_hid_entry); + + /* Looks like: ieee1394:venNmoNspNverN */ + static int do_ieee1394_entry(const char *filename, +@@ -456,7 +405,6 @@ static int do_ieee1394_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("ieee1394", ieee1394_device_id, do_ieee1394_entry); + + /* Looks like: pci:vNdNsvNsdNbcNscNiN. */ + static int do_pci_entry(const char *filename, +@@ -500,7 +448,6 @@ static int do_pci_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("pci", pci_device_id, do_pci_entry); + + /* looks like: "ccw:tNmNdtNdmN" */ + static int do_ccw_entry(const char *filename, +@@ -524,7 +471,6 @@ static int do_ccw_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("ccw", ccw_device_id, do_ccw_entry); + + /* looks like: "ap:tN" */ + static int do_ap_entry(const char *filename, +@@ -535,7 +481,6 @@ static int do_ap_entry(const char *filename, + sprintf(alias, "ap:t%02X*", dev_type); + return 1; + } +-ADD_TO_DEVTABLE("ap", ap_device_id, do_ap_entry); + + /* looks like: "css:tN" */ + static int do_css_entry(const char *filename, +@@ -546,7 +491,6 @@ static int do_css_entry(const char *filename, + sprintf(alias, "css:t%01X", type); + return 1; + } +-ADD_TO_DEVTABLE("css", css_device_id, do_css_entry); + + /* Looks like: "serio:tyNprNidNexN" */ + static int do_serio_entry(const char *filename, +@@ -566,7 +510,6 @@ static int do_serio_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("serio", serio_device_id, do_serio_entry); + + /* looks like: "acpi:ACPI0003" or "acpi:PNP0C0B" or "acpi:LNXVIDEO" or + * "acpi:bbsspp" (bb=base-class, ss=sub-class, pp=prog-if) +@@ -604,7 +547,6 @@ static int do_acpi_entry(const char *filename, + } + return 1; + } +-ADD_TO_DEVTABLE("acpi", acpi_device_id, do_acpi_entry); + + /* looks like: "pnp:dD" */ + static void do_pnp_device_entry(void *symval, unsigned long size, +@@ -725,7 +667,6 @@ static int do_pcmcia_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("pcmcia", pcmcia_device_id, do_pcmcia_entry); + + static int do_vio_entry(const char *filename, void *symval, + char *alias) +@@ -745,7 +686,6 @@ static int do_vio_entry(const char *filename, void *symval, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("vio", vio_device_id, do_vio_entry); + + #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) + +@@ -818,7 +758,6 @@ static int do_input_entry(const char *filename, void *symval, + do_input(alias, *swbit, 0, INPUT_DEVICE_ID_SW_MAX); + return 1; + } +-ADD_TO_DEVTABLE("input", input_device_id, do_input_entry); + + static int do_eisa_entry(const char *filename, void *symval, + char *alias) +@@ -830,7 +769,6 @@ static int do_eisa_entry(const char *filename, void *symval, + strcat(alias, "*"); + return 1; + } +-ADD_TO_DEVTABLE("eisa", eisa_device_id, do_eisa_entry); + + /* Looks like: parisc:tNhvNrevNsvN */ + static int do_parisc_entry(const char *filename, void *symval, +@@ -850,7 +788,6 @@ static int do_parisc_entry(const char *filename, void *symval, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("parisc", parisc_device_id, do_parisc_entry); + + /* Looks like: sdio:cNvNdN. */ + static int do_sdio_entry(const char *filename, +@@ -867,7 +804,6 @@ static int do_sdio_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("sdio", sdio_device_id, do_sdio_entry); + + /* Looks like: ssb:vNidNrevN. */ + static int do_ssb_entry(const char *filename, +@@ -884,7 +820,6 @@ static int do_ssb_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("ssb", ssb_device_id, do_ssb_entry); + + /* Looks like: bcma:mNidNrevNclN. */ + static int do_bcma_entry(const char *filename, +@@ -903,7 +838,6 @@ static int do_bcma_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("bcma", bcma_device_id, do_bcma_entry); + + /* Looks like: virtio:dNvN */ + static int do_virtio_entry(const char *filename, void *symval, +@@ -919,7 +853,6 @@ static int do_virtio_entry(const char *filename, void *symval, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("virtio", virtio_device_id, do_virtio_entry); + + /* + * Looks like: vmbus:guid +@@ -942,7 +875,6 @@ static int do_vmbus_entry(const char *filename, void *symval, + + return 1; + } +-ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry); + + /* Looks like: i2c:S */ + static int do_i2c_entry(const char *filename, void *symval, +@@ -953,7 +885,6 @@ static int do_i2c_entry(const char *filename, void *symval, + + return 1; + } +-ADD_TO_DEVTABLE("i2c", i2c_device_id, do_i2c_entry); + + /* Looks like: spi:S */ + static int do_spi_entry(const char *filename, void *symval, +@@ -964,7 +895,6 @@ static int do_spi_entry(const char *filename, void *symval, + + return 1; + } +-ADD_TO_DEVTABLE("spi", spi_device_id, do_spi_entry); + + static const struct dmifield { + const char *prefix; +@@ -1019,7 +949,6 @@ static int do_dmi_entry(const char *filename, void *symval, + strcat(alias, ":"); + return 1; + } +-ADD_TO_DEVTABLE("dmi", dmi_system_id, do_dmi_entry); + + static int do_platform_entry(const char *filename, + void *symval, char *alias) +@@ -1028,7 +957,6 @@ static int do_platform_entry(const char *filename, + sprintf(alias, PLATFORM_MODULE_PREFIX "%s", *name); + return 1; + } +-ADD_TO_DEVTABLE("platform", platform_device_id, do_platform_entry); + + static int do_mdio_entry(const char *filename, + void *symval, char *alias) +@@ -1053,7 +981,6 @@ static int do_mdio_entry(const char *filename, + + return 1; + } +-ADD_TO_DEVTABLE("mdio", mdio_device_id, do_mdio_entry); + + /* Looks like: zorro:iN. */ + static int do_zorro_entry(const char *filename, void *symval, +@@ -1064,7 +991,6 @@ static int do_zorro_entry(const char *filename, void *symval, + ADD(alias, "i", id != ZORRO_WILDCARD, id); + return 1; + } +-ADD_TO_DEVTABLE("zorro", zorro_device_id, do_zorro_entry); + + /* looks like: "pnp:dD" */ + static int do_isapnp_entry(const char *filename, +@@ -1080,7 +1006,6 @@ static int do_isapnp_entry(const char *filename, + (function >> 12) & 0x0f, (function >> 8) & 0x0f); + return 1; + } +-ADD_TO_DEVTABLE("isapnp", isapnp_device_id, do_isapnp_entry); + + /* Looks like: "ipack:fNvNdN". */ + static int do_ipack_entry(const char *filename, +@@ -1096,7 +1021,6 @@ static int do_ipack_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("ipack", ipack_device_id, do_ipack_entry); + + /* + * Append a match expression for a single masked hex digit. +@@ -1167,7 +1091,6 @@ static int do_amba_entry(const char *filename, + + return 1; + } +-ADD_TO_DEVTABLE("amba", amba_id, do_amba_entry); + + /* + * looks like: "mipscdmm:tN" +@@ -1183,7 +1106,6 @@ static int do_mips_cdmm_entry(const char *filename, + sprintf(alias, "mipscdmm:t%02X*", type); + return 1; + } +-ADD_TO_DEVTABLE("mipscdmm", mips_cdmm_device_id, do_mips_cdmm_entry); + + /* LOOKS like cpu:type:x86,venVVVVfamFFFFmodMMMM:feature:*,FEAT,* + * All fields are numbers. It would be nicer to use strings for vendor +@@ -1208,7 +1130,6 @@ static int do_x86cpu_entry(const char *filename, void *symval, + sprintf(alias + strlen(alias), "%04X*", feature); + return 1; + } +-ADD_TO_DEVTABLE("x86cpu", x86_cpu_id, do_x86cpu_entry); + + /* LOOKS like cpu:type:*:feature:*FEAT* */ + static int do_cpu_entry(const char *filename, void *symval, char *alias) +@@ -1218,7 +1139,6 @@ static int do_cpu_entry(const char *filename, void *symval, char *alias) + sprintf(alias, "cpu:type:*:feature:*%04X*", feature); + return 1; + } +-ADD_TO_DEVTABLE("cpu", cpu_feature, do_cpu_entry); + + /* Looks like: mei:S:uuid:N:* */ + static int do_mei_entry(const char *filename, void *symval, +@@ -1237,7 +1157,6 @@ static int do_mei_entry(const char *filename, void *symval, + + return 1; + } +-ADD_TO_DEVTABLE("mei", mei_cl_device_id, do_mei_entry); + + /* Looks like: rapidio:vNdNavNadN */ + static int do_rio_entry(const char *filename, +@@ -1257,7 +1176,6 @@ static int do_rio_entry(const char *filename, + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("rapidio", rio_device_id, do_rio_entry); + + /* Looks like: ulpi:vNpN */ + static int do_ulpi_entry(const char *filename, void *symval, +@@ -1270,7 +1188,6 @@ static int do_ulpi_entry(const char *filename, void *symval, + + return 1; + } +-ADD_TO_DEVTABLE("ulpi", ulpi_device_id, do_ulpi_entry); + + /* Looks like: hdaudio:vNrNaN */ + static int do_hda_entry(const char *filename, void *symval, char *alias) +@@ -1287,7 +1204,6 @@ static int do_hda_entry(const char *filename, void *symval, char *alias) + add_wildcard(alias); + return 1; + } +-ADD_TO_DEVTABLE("hdaudio", hda_device_id, do_hda_entry); + + /* Looks like: fsl-mc:vNdN */ + static int do_fsl_mc_entry(const char *filename, void *symval, +@@ -1299,7 +1215,6 @@ static int do_fsl_mc_entry(const char *filename, void *symval, + sprintf(alias, "fsl-mc:v%08Xd%s", vendor, *obj_type); + return 1; + } +-ADD_TO_DEVTABLE("fslmc", fsl_mc_device_id, do_fsl_mc_entry); + + /* Does namelen bytes of name exactly match the symbol? */ + static bool sym_is(const char *name, unsigned namelen, const char *symbol) +@@ -1313,12 +1228,11 @@ static bool sym_is(const char *name, unsigned namelen, const char *symbol) + static void do_table(void *symval, unsigned long size, + unsigned long id_size, + const char *device_id, +- void *function, ++ int (*do_entry)(const char *filename, void *symval, char *alias), + struct module *mod) + { + unsigned int i; + char alias[500]; +- int (*do_entry)(const char *, void *entry, char *alias) = function; + + device_id_check(mod->name, device_id, size, id_size, symval); + /* Leave last one: it's the terminator. */ +@@ -1332,6 +1246,44 @@ static void do_table(void *symval, unsigned long size, + } + } + ++static const struct devtable devtable[] = { ++ {"hid", SIZE_hid_device_id, do_hid_entry}, ++ {"ieee1394", SIZE_ieee1394_device_id, do_ieee1394_entry}, ++ {"pci", SIZE_pci_device_id, do_pci_entry}, ++ {"ccw", SIZE_ccw_device_id, do_ccw_entry}, ++ {"ap", SIZE_ap_device_id, do_ap_entry}, ++ {"css", SIZE_css_device_id, do_css_entry}, ++ {"serio", SIZE_serio_device_id, do_serio_entry}, ++ {"acpi", SIZE_acpi_device_id, do_acpi_entry}, ++ {"pcmcia", SIZE_pcmcia_device_id, do_pcmcia_entry}, ++ {"vio", SIZE_vio_device_id, do_vio_entry}, ++ {"input", SIZE_input_device_id, do_input_entry}, ++ {"eisa", SIZE_eisa_device_id, do_eisa_entry}, ++ {"parisc", SIZE_parisc_device_id, do_parisc_entry}, ++ {"sdio", SIZE_sdio_device_id, do_sdio_entry}, ++ {"ssb", SIZE_ssb_device_id, do_ssb_entry}, ++ {"bcma", SIZE_bcma_device_id, do_bcma_entry}, ++ {"virtio", SIZE_virtio_device_id, do_virtio_entry}, ++ {"vmbus", SIZE_hv_vmbus_device_id, do_vmbus_entry}, ++ {"i2c", SIZE_i2c_device_id, do_i2c_entry}, ++ {"spi", SIZE_spi_device_id, do_spi_entry}, ++ {"dmi", SIZE_dmi_system_id, do_dmi_entry}, ++ {"platform", SIZE_platform_device_id, do_platform_entry}, ++ {"mdio", SIZE_mdio_device_id, do_mdio_entry}, ++ {"zorro", SIZE_zorro_device_id, do_zorro_entry}, ++ {"isapnp", SIZE_isapnp_device_id, do_isapnp_entry}, ++ {"ipack", SIZE_ipack_device_id, do_ipack_entry}, ++ {"amba", SIZE_amba_id, do_amba_entry}, ++ {"mipscdmm", SIZE_mips_cdmm_device_id, do_mips_cdmm_entry}, ++ {"x86cpu", SIZE_x86_cpu_id, do_x86cpu_entry}, ++ {"cpu", SIZE_cpu_feature, do_cpu_entry}, ++ {"mei", SIZE_mei_cl_device_id, do_mei_entry}, ++ {"rapidio", SIZE_rio_device_id, do_rio_entry}, ++ {"ulpi", SIZE_ulpi_device_id, do_ulpi_entry}, ++ {"hdaudio", SIZE_hda_device_id, do_hda_entry}, ++ {"fslmc", SIZE_fsl_mc_device_id, do_fsl_mc_entry}, ++}; ++ + /* Create MODULE_ALIAS() statements. + * At this time, we cannot write the actual output C source yet, + * so we write into the mod->dev_table_buf buffer. */ +@@ -1386,13 +1338,14 @@ void handle_moddevtable(struct module *mod, struct elf_info *info, + else if (sym_is(name, namelen, "pnp_card")) + do_pnp_card_entries(symval, sym->st_size, mod); + else { +- struct devtable **p; +- INIT_SECTION(__devtable); ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(devtable); i++) { ++ const struct devtable *p = &devtable[i]; + +- for (p = __start___devtable; p < __stop___devtable; p++) { +- if (sym_is(name, namelen, (*p)->device_id)) { +- do_table(symval, sym->st_size, (*p)->id_size, +- (*p)->device_id, (*p)->function, mod); ++ if (sym_is(name, namelen, p->device_id)) { ++ do_table(symval, sym->st_size, p->id_size, ++ p->device_id, p->do_entry, mod); + break; + } + } +diff --git a/security/device_cgroup.c b/security/device_cgroup.c +index 03c1652c9a1f..db3bdc91c520 100644 +--- a/security/device_cgroup.c ++++ b/security/device_cgroup.c +@@ -568,7 +568,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root, + devcg->behavior == DEVCG_DEFAULT_ALLOW) { + rc = dev_exception_add(devcg, ex); + if (rc) +- break; ++ return rc; + } else { + /* + * in the other possible cases: +diff --git a/sound/core/info.c b/sound/core/info.c +index 8ab72e0f5932..358a6947342d 100644 +--- a/sound/core/info.c ++++ b/sound/core/info.c +@@ -724,8 +724,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent) + INIT_LIST_HEAD(&entry->children); + INIT_LIST_HEAD(&entry->list); + entry->parent = parent; +- if (parent) ++ if (parent) { ++ mutex_lock(&parent->access); + list_add_tail(&entry->list, &parent->children); ++ mutex_unlock(&parent->access); ++ } + return entry; + } + +@@ -809,7 +812,12 @@ void snd_info_free_entry(struct snd_info_entry * entry) + list_for_each_entry_safe(p, n, &entry->children, list) + snd_info_free_entry(p); + +- list_del(&entry->list); ++ p = entry->parent; ++ if (p) { ++ mutex_lock(&p->access); ++ list_del(&entry->list); ++ mutex_unlock(&p->access); ++ } + kfree(entry->name); + if (entry->private_free) + entry->private_free(entry); +diff --git a/sound/core/init.c b/sound/core/init.c +index 6bda8436d765..02e96c580cb7 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -408,14 +408,7 @@ int snd_card_disconnect(struct snd_card *card) + card->shutdown = 1; + spin_unlock(&card->files_lock); + +- /* phase 1: disable fops (user space) operations for ALSA API */ +- mutex_lock(&snd_card_mutex); +- snd_cards[card->number] = NULL; +- clear_bit(card->number, snd_cards_lock); +- mutex_unlock(&snd_card_mutex); +- +- /* phase 2: replace file->f_op with special dummy operations */ +- ++ /* replace file->f_op with special dummy operations */ + spin_lock(&card->files_lock); + list_for_each_entry(mfile, &card->files_list, list) { + /* it's critical part, use endless loop */ +@@ -431,7 +424,7 @@ int snd_card_disconnect(struct snd_card *card) + } + spin_unlock(&card->files_lock); + +- /* phase 3: notify all connected devices about disconnection */ ++ /* notify all connected devices about disconnection */ + /* at this point, they cannot respond to any calls except release() */ + + #if IS_ENABLED(CONFIG_SND_MIXER_OSS) +@@ -447,6 +440,13 @@ int snd_card_disconnect(struct snd_card *card) + device_del(&card->card_dev); + card->registered = false; + } ++ ++ /* disable fops (user space) operations for ALSA API */ ++ mutex_lock(&snd_card_mutex); ++ snd_cards[card->number] = NULL; ++ clear_bit(card->number, snd_cards_lock); ++ mutex_unlock(&snd_card_mutex); ++ + #ifdef CONFIG_PM + wake_up(&card->power_sleep); + #endif
