commit: 89df9075a31ed1e517572dd7d700527b79252803 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed May 27 15:24:58 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed May 27 15:24:58 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=89df9075
Linux patch 4.14.182 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1181_linux-4.14.182.patch | 2340 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2344 insertions(+) diff --git a/0000_README b/0000_README index 0e85d1b..b13e85f 100644 --- a/0000_README +++ b/0000_README @@ -767,6 +767,10 @@ Patch: 1180_linux-4.14.181.patch From: https://www.kernel.org Desc: Linux 4.14.181 +Patch: 1181_linux-4.14.182.patch +From: https://www.kernel.org +Desc: Linux 4.14.182 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1181_linux-4.14.182.patch b/1181_linux-4.14.182.patch new file mode 100644 index 0000000..6544cc8 --- /dev/null +++ b/1181_linux-4.14.182.patch @@ -0,0 +1,2340 @@ +diff --git a/Makefile b/Makefile +index 12bf05880d2d..591582e26a57 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 181 ++SUBLEVEL = 182 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h +index ffebe7b7a5b7..91ca80035fc4 100644 +--- a/arch/arm/include/asm/futex.h ++++ b/arch/arm/include/asm/futex.h +@@ -163,8 +163,13 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) + preempt_enable(); + #endif + +- if (!ret) +- *oval = oldval; ++ /* ++ * Store unconditionally. If ret != 0 the extra store is the least ++ * of the worries but GCC cannot figure out that __futex_atomic_op() ++ * is either setting ret to -EFAULT or storing the old value in ++ * oldval which results in a uninitialized warning at the call site. ++ */ ++ *oval = oldval; + + return ret; + } +diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c +index 11121f608eb5..f7e593965c1d 100644 +--- a/arch/arm64/kernel/machine_kexec.c ++++ b/arch/arm64/kernel/machine_kexec.c +@@ -184,7 +184,8 @@ void machine_kexec(struct kimage *kimage) + /* Flush the reboot_code_buffer in preparation for its execution. */ + __flush_dcache_area(reboot_code_buffer, arm64_relocate_new_kernel_size); + flush_icache_range((uintptr_t)reboot_code_buffer, +- arm64_relocate_new_kernel_size); ++ (uintptr_t)reboot_code_buffer + ++ arm64_relocate_new_kernel_size); + + /* Flush the kimage list and its buffers. */ + kexec_list_flush(kimage); +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 277e4ffb928b..679e1e3c1695 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -141,12 +141,14 @@ config PPC + select ARCH_HAS_GCOV_PROFILE_ALL + select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE + select ARCH_HAS_SG_CHAIN ++ select ARCH_HAS_STRICT_KERNEL_RWX if (PPC32 && !HIBERNATION) + select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST + select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_ZONE_DEVICE if PPC_BOOK3S_64 + select ARCH_HAVE_NMI_SAFE_CMPXCHG + select ARCH_MIGHT_HAVE_PC_PARPORT + select ARCH_MIGHT_HAVE_PC_SERIO ++ select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX + select ARCH_SUPPORTS_ATOMIC_RMW + select ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT + select ARCH_USE_BUILTIN_BSWAP +@@ -178,8 +180,6 @@ config PPC + select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT + select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_TRACEHOOK +- select ARCH_HAS_STRICT_KERNEL_RWX if ((PPC_BOOK3S_64 || PPC32) && !RELOCATABLE && !HIBERNATION) +- select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX + select HAVE_CBPF_JIT if !PPC64 + select HAVE_CONTEXT_TRACKING if PPC64 + select HAVE_DEBUG_KMEMLEAK +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 6415b4aead54..48ab5fdd1044 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -353,8 +353,6 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen) + * According to Intel, MFENCE can do the serialization here. + */ + asm volatile("mfence" : : : "memory"); +- +- printk_once(KERN_DEBUG "TSC deadline timer enabled\n"); + return; + } + +@@ -553,7 +551,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events); + #define DEADLINE_MODEL_MATCH_REV(model, rev) \ + { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)rev } + +-static u32 hsx_deadline_rev(void) ++static __init u32 hsx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x02: return 0x3a; /* EP */ +@@ -563,7 +561,7 @@ static u32 hsx_deadline_rev(void) + return ~0U; + } + +-static u32 bdx_deadline_rev(void) ++static __init u32 bdx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x02: return 0x00000011; +@@ -575,7 +573,7 @@ static u32 bdx_deadline_rev(void) + return ~0U; + } + +-static u32 skx_deadline_rev(void) ++static __init u32 skx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x03: return 0x01000136; +@@ -588,7 +586,7 @@ static u32 skx_deadline_rev(void) + return ~0U; + } + +-static const struct x86_cpu_id deadline_match[] = { ++static const struct x86_cpu_id deadline_match[] __initconst = { + DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_HASWELL_X, hsx_deadline_rev), + DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_BROADWELL_X, 0x0b000020), + DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_BROADWELL_XEON_D, bdx_deadline_rev), +@@ -610,18 +608,19 @@ static const struct x86_cpu_id deadline_match[] = { + {}, + }; + +-static void apic_check_deadline_errata(void) ++static __init bool apic_validate_deadline_timer(void) + { + const struct x86_cpu_id *m; + u32 rev; + +- if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER) || +- boot_cpu_has(X86_FEATURE_HYPERVISOR)) +- return; ++ if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER)) ++ return false; ++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) ++ return true; + + m = x86_match_cpu(deadline_match); + if (!m) +- return; ++ return true; + + /* + * Function pointers will have the MSB set due to address layout, +@@ -633,11 +632,12 @@ static void apic_check_deadline_errata(void) + rev = (u32)m->driver_data; + + if (boot_cpu_data.microcode >= rev) +- return; ++ return true; + + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); + pr_err(FW_BUG "TSC_DEADLINE disabled due to Errata; " + "please update microcode to version: 0x%x (or later)\n", rev); ++ return false; + } + + /* +@@ -1914,7 +1914,8 @@ void __init init_apic_mappings(void) + { + unsigned int new_apicid; + +- apic_check_deadline_errata(); ++ if (apic_validate_deadline_timer()) ++ pr_debug("TSC deadline timer available\n"); + + if (x2apic_mode) { + boot_cpu_physical_apicid = read_apic_id(); +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index b698468f726b..a9a55e76a43f 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -255,12 +255,19 @@ EXPORT_SYMBOL_GPL(unwind_get_return_address); + + unsigned long *unwind_get_return_address_ptr(struct unwind_state *state) + { ++ struct task_struct *task = state->task; ++ + if (unwind_done(state)) + return NULL; + + if (state->regs) + return &state->regs->ip; + ++ if (task != current && state->sp == task->thread.sp) { ++ struct inactive_task_frame *frame = (void *)task->thread.sp; ++ return &frame->ret_addr; ++ } ++ + if (state->sp) + return (unsigned long *)state->sp - 1; + +diff --git a/drivers/base/component.c b/drivers/base/component.c +index 08da6160e94d..55f0856bd9b5 100644 +--- a/drivers/base/component.c ++++ b/drivers/base/component.c +@@ -162,7 +162,8 @@ static int try_to_bring_up_master(struct master *master, + ret = master->ops->bind(master->dev); + if (ret < 0) { + devres_release_group(master->dev, NULL); +- dev_info(master->dev, "master bind failed: %d\n", ret); ++ if (ret != -EPROBE_DEFER) ++ dev_info(master->dev, "master bind failed: %d\n", ret); + return ret; + } + +@@ -431,8 +432,9 @@ static int component_bind(struct component *component, struct master *master, + devres_release_group(component->dev, NULL); + devres_release_group(master->dev, NULL); + +- dev_err(master->dev, "failed to bind %s (ops %ps): %d\n", +- dev_name(component->dev), component->ops, ret); ++ if (ret != -EPROBE_DEFER) ++ dev_err(master->dev, "failed to bind %s (ops %ps): %d\n", ++ dev_name(component->dev), component->ops, ret); + } + + return ret; +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index 4f4733d831a1..045351f3549c 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -793,7 +793,7 @@ static int tegra_adma_probe(struct platform_device *pdev) + ret = dma_async_device_register(&tdma->dma_dev); + if (ret < 0) { + dev_err(&pdev->dev, "ADMA registration failed: %d\n", ret); +- goto irq_dispose; ++ goto rpm_put; + } + + ret = of_dma_controller_register(pdev->dev.of_node, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9d372fa7c298..a1e5e0529545 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -369,6 +369,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_ELAN 0x04f3 + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 07d92d4a9f7c..db29bf539a4b 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1550,6 +1550,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, + + /* Elitegroup panel */ + { .driver_data = MT_CLS_SERIAL, +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index eaa312bc3a3c..c4066276eb7b 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -47,7 +47,7 @@ + struct i2c_dev { + struct list_head list; + struct i2c_adapter *adap; +- struct device *dev; ++ struct device dev; + struct cdev cdev; + }; + +@@ -91,12 +91,14 @@ static struct i2c_dev *get_free_i2c_dev(struct i2c_adapter *adap) + return i2c_dev; + } + +-static void put_i2c_dev(struct i2c_dev *i2c_dev) ++static void put_i2c_dev(struct i2c_dev *i2c_dev, bool del_cdev) + { + spin_lock(&i2c_dev_list_lock); + list_del(&i2c_dev->list); + spin_unlock(&i2c_dev_list_lock); +- kfree(i2c_dev); ++ if (del_cdev) ++ cdev_device_del(&i2c_dev->cdev, &i2c_dev->dev); ++ put_device(&i2c_dev->dev); + } + + static ssize_t name_show(struct device *dev, +@@ -542,6 +544,14 @@ static const struct file_operations i2cdev_fops = { + + static struct class *i2c_dev_class; + ++static void i2cdev_dev_release(struct device *dev) ++{ ++ struct i2c_dev *i2c_dev; ++ ++ i2c_dev = container_of(dev, struct i2c_dev, dev); ++ kfree(i2c_dev); ++} ++ + static int i2cdev_attach_adapter(struct device *dev, void *dummy) + { + struct i2c_adapter *adap; +@@ -558,27 +568,23 @@ static int i2cdev_attach_adapter(struct device *dev, void *dummy) + + cdev_init(&i2c_dev->cdev, &i2cdev_fops); + i2c_dev->cdev.owner = THIS_MODULE; +- res = cdev_add(&i2c_dev->cdev, MKDEV(I2C_MAJOR, adap->nr), 1); +- if (res) +- goto error_cdev; +- +- /* register this i2c device with the driver core */ +- i2c_dev->dev = device_create(i2c_dev_class, &adap->dev, +- MKDEV(I2C_MAJOR, adap->nr), NULL, +- "i2c-%d", adap->nr); +- if (IS_ERR(i2c_dev->dev)) { +- res = PTR_ERR(i2c_dev->dev); +- goto error; ++ ++ device_initialize(&i2c_dev->dev); ++ i2c_dev->dev.devt = MKDEV(I2C_MAJOR, adap->nr); ++ i2c_dev->dev.class = i2c_dev_class; ++ i2c_dev->dev.parent = &adap->dev; ++ i2c_dev->dev.release = i2cdev_dev_release; ++ dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr); ++ ++ res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev); ++ if (res) { ++ put_i2c_dev(i2c_dev, false); ++ return res; + } + + pr_debug("i2c-dev: adapter [%s] registered as minor %d\n", + adap->name, adap->nr); + return 0; +-error: +- cdev_del(&i2c_dev->cdev); +-error_cdev: +- put_i2c_dev(i2c_dev); +- return res; + } + + static int i2cdev_detach_adapter(struct device *dev, void *dummy) +@@ -594,9 +600,7 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy) + if (!i2c_dev) /* attach_adapter must have failed */ + return 0; + +- cdev_del(&i2c_dev->cdev); +- put_i2c_dev(i2c_dev); +- device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr)); ++ put_i2c_dev(i2c_dev, true); + + pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name); + return 0; +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 33ce032cb701..0c637ae81404 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -270,6 +270,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); + err_rollback: ++ i2c_demux_deactivate_master(priv); + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c +index f2761b385541..edceda640fa2 100644 +--- a/drivers/iio/accel/sca3000.c ++++ b/drivers/iio/accel/sca3000.c +@@ -982,7 +982,7 @@ static int sca3000_read_data(struct sca3000_state *st, + st->tx[0] = SCA3000_READ_REG(reg_address_high); + ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer)); + if (ret) { +- dev_err(get_device(&st->us->dev), "problem reading register"); ++ dev_err(&st->us->dev, "problem reading register\n"); + return ret; + } + +diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c +index 3cfb2d4b2441..206feefbc456 100644 +--- a/drivers/iio/adc/stm32-adc.c ++++ b/drivers/iio/adc/stm32-adc.c +@@ -1627,15 +1627,27 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev) + return 0; + } + +-static int stm32_adc_dma_request(struct iio_dev *indio_dev) ++static int stm32_adc_dma_request(struct device *dev, struct iio_dev *indio_dev) + { + struct stm32_adc *adc = iio_priv(indio_dev); + struct dma_slave_config config; + int ret; + +- adc->dma_chan = dma_request_slave_channel(&indio_dev->dev, "rx"); +- if (!adc->dma_chan) ++ adc->dma_chan = dma_request_chan(dev, "rx"); ++ if (IS_ERR(adc->dma_chan)) { ++ ret = PTR_ERR(adc->dma_chan); ++ if (ret != -ENODEV) { ++ if (ret != -EPROBE_DEFER) ++ dev_err(dev, ++ "DMA channel request failed with %d\n", ++ ret); ++ return ret; ++ } ++ ++ /* DMA is optional: fall back to IRQ mode */ ++ adc->dma_chan = NULL; + return 0; ++ } + + adc->rx_buf = dma_alloc_coherent(adc->dma_chan->device->dev, + STM32_DMA_BUFFER_SIZE, +@@ -1749,7 +1761,7 @@ static int stm32_adc_probe(struct platform_device *pdev) + if (ret < 0) + goto err_clk_disable; + +- ret = stm32_adc_dma_request(indio_dev); ++ ret = stm32_adc_dma_request(dev, indio_dev); + if (ret < 0) + goto err_clk_disable; + +diff --git a/drivers/iio/dac/vf610_dac.c b/drivers/iio/dac/vf610_dac.c +index c4ec7779b394..190a7c1c5604 100644 +--- a/drivers/iio/dac/vf610_dac.c ++++ b/drivers/iio/dac/vf610_dac.c +@@ -235,6 +235,7 @@ static int vf610_dac_probe(struct platform_device *pdev) + return 0; + + error_iio_device_register: ++ vf610_dac_exit(info); + clk_disable_unprepare(info->clk); + + return ret; +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 6c228144b3da..ec9a20e06941 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -1317,8 +1317,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + } + case IVHD_DEV_ACPI_HID: { + u16 devid; +- u8 hid[ACPIHID_HID_LEN] = {0}; +- u8 uid[ACPIHID_UID_LEN] = {0}; ++ u8 hid[ACPIHID_HID_LEN]; ++ u8 uid[ACPIHID_UID_LEN]; + int ret; + + if (h->type != 0x40) { +@@ -1335,6 +1335,7 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + break; + } + ++ uid[0] = '\0'; + switch (e->uidf) { + case UID_NOT_PRESENT: + +@@ -1349,8 +1350,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + break; + case UID_IS_CHARACTER: + +- memcpy(uid, (u8 *)(&e->uid), ACPIHID_UID_LEN - 1); +- uid[ACPIHID_UID_LEN - 1] = '\0'; ++ memcpy(uid, &e->uid, e->uidl); ++ uid[e->uidl] = '\0'; + + break; + default: +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index d8d406c79cfa..5965e34e36cc 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2372,7 +2372,7 @@ static int fdp1_probe(struct platform_device *pdev) + dprintk(fdp1, "FDP1 Version R-Car H3\n"); + break; + case FD1_IP_M3N: +- dprintk(fdp1, "FDP1 Version R-Car M3N\n"); ++ dprintk(fdp1, "FDP1 Version R-Car M3-N\n"); + break; + case FD1_IP_E3: + dprintk(fdp1, "FDP1 Version R-Car E3\n"); +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index be64969d986a..391c6d4855ff 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -276,6 +276,7 @@ void mei_me_cl_rm_by_uuid(struct mei_device *dev, const uuid_le *uuid) + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid(dev, uuid); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + +@@ -297,6 +298,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_device *dev, const uuid_le *uuid, u8 id) + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + +diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c +index 7bc96294ae4d..b108e1f04bf6 100644 +--- a/drivers/mtd/ubi/debug.c ++++ b/drivers/mtd/ubi/debug.c +@@ -405,9 +405,6 @@ static void *eraseblk_count_seq_start(struct seq_file *s, loff_t *pos) + { + struct ubi_device *ubi = s->private; + +- if (*pos == 0) +- return SEQ_START_TOKEN; +- + if (*pos < ubi->peb_count) + return pos; + +@@ -421,8 +418,6 @@ static void *eraseblk_count_seq_next(struct seq_file *s, void *v, loff_t *pos) + { + struct ubi_device *ubi = s->private; + +- if (v == SEQ_START_TOKEN) +- return pos; + (*pos)++; + + if (*pos < ubi->peb_count) +@@ -444,11 +439,8 @@ static int eraseblk_count_seq_show(struct seq_file *s, void *iter) + int err; + + /* If this is the start, print a header */ +- if (iter == SEQ_START_TOKEN) { +- seq_puts(s, +- "physical_block_number\terase_count\tblock_status\tread_status\n"); +- return 0; +- } ++ if (*block_number == 0) ++ seq_puts(s, "physical_block_number\terase_count\n"); + + err = ubi_io_is_bad(ubi, *block_number); + if (err) +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 0e13989608f1..6eb65b870da7 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -2241,8 +2241,6 @@ static int cxgb_up(struct adapter *adap) + #if IS_ENABLED(CONFIG_IPV6) + update_clip(adap); + #endif +- /* Initialize hash mac addr list*/ +- INIT_LIST_HEAD(&adap->mac_hlist); + return err; + + irq_err: +@@ -2264,6 +2262,7 @@ static void cxgb_down(struct adapter *adapter) + + t4_sge_stop(adapter); + t4_free_sge_resources(adapter); ++ + adapter->flags &= ~FULL_INIT_DONE; + } + +@@ -4962,6 +4961,9 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + (is_t5(adapter->params.chip) ? STATMODE_V(0) : + T6_STATMODE_V(0))); + ++ /* Initialize hash mac addr list */ ++ INIT_LIST_HEAD(&adapter->mac_hlist); ++ + for_each_port(adapter, i) { + netdev = alloc_etherdev_mq(sizeof(struct port_info), + MAX_ETH_QSETS); +@@ -5252,6 +5254,7 @@ free_mbox_log: + static void remove_one(struct pci_dev *pdev) + { + struct adapter *adapter = pci_get_drvdata(pdev); ++ struct hash_mac_addr *entry, *tmp; + + if (!adapter) { + pci_release_regions(pdev); +@@ -5295,6 +5298,12 @@ static void remove_one(struct pci_dev *pdev) + if (adapter->num_uld || adapter->num_ofld_uld) + t4_uld_mem_free(adapter); + free_some_resources(adapter); ++ list_for_each_entry_safe(entry, tmp, &adapter->mac_hlist, ++ list) { ++ list_del(&entry->list); ++ kfree(entry); ++ } ++ + #if IS_ENABLED(CONFIG_IPV6) + t4_cleanup_clip_tbl(adapter); + #endif +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index 26ba18ea08c6..fa116f0a107d 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -715,9 +715,6 @@ static int adapter_up(struct adapter *adapter) + if (adapter->flags & USING_MSIX) + name_msix_vecs(adapter); + +- /* Initialize hash mac addr list*/ +- INIT_LIST_HEAD(&adapter->mac_hlist); +- + adapter->flags |= FULL_INIT_DONE; + } + +@@ -2936,6 +2933,9 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev, + if (err) + goto err_unmap_bar; + ++ /* Initialize hash mac addr list */ ++ INIT_LIST_HEAD(&adapter->mac_hlist); ++ + /* + * Allocate our "adapter ports" and stitch everything together. + */ +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 92e4e5d53053..090607e725a2 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1177,11 +1177,11 @@ out_unlock: + static struct genl_family gtp_genl_family; + + static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, +- u32 type, struct pdp_ctx *pctx) ++ int flags, u32 type, struct pdp_ctx *pctx) + { + void *genlh; + +- genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, 0, ++ genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, + type); + if (genlh == NULL) + goto nlmsg_failure; +@@ -1235,8 +1235,8 @@ static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info) + goto err_unlock; + } + +- err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, +- info->snd_seq, info->nlhdr->nlmsg_type, pctx); ++ err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq, ++ 0, info->nlhdr->nlmsg_type, pctx); + if (err < 0) + goto err_unlock_free; + +@@ -1279,6 +1279,7 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, + gtp_genl_fill_info(skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, ++ NLM_F_MULTI, + cb->nlh->nlmsg_type, pctx)) { + cb->args[0] = i; + cb->args[1] = j; +diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c +index 471498469d0a..c46b7e1b0132 100644 +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -540,9 +540,9 @@ static int arena_clear_freelist_error(struct arena_info *arena, u32 lane) + + static int btt_freelist_init(struct arena_info *arena) + { +- int old, new, ret; +- u32 i, map_entry; +- struct log_entry log_new, log_old; ++ int new, ret; ++ struct log_entry log_new; ++ u32 i, map_entry, log_oldmap, log_newmap; + + arena->freelist = kcalloc(arena->nfree, sizeof(struct free_entry), + GFP_KERNEL); +@@ -550,24 +550,26 @@ static int btt_freelist_init(struct arena_info *arena) + return -ENOMEM; + + for (i = 0; i < arena->nfree; i++) { +- old = btt_log_read(arena, i, &log_old, LOG_OLD_ENT); +- if (old < 0) +- return old; +- + new = btt_log_read(arena, i, &log_new, LOG_NEW_ENT); + if (new < 0) + return new; + ++ /* old and new map entries with any flags stripped out */ ++ log_oldmap = ent_lba(le32_to_cpu(log_new.old_map)); ++ log_newmap = ent_lba(le32_to_cpu(log_new.new_map)); ++ + /* sub points to the next one to be overwritten */ + arena->freelist[i].sub = 1 - new; + arena->freelist[i].seq = nd_inc_seq(le32_to_cpu(log_new.seq)); +- arena->freelist[i].block = le32_to_cpu(log_new.old_map); ++ arena->freelist[i].block = log_oldmap; + + /* + * FIXME: if error clearing fails during init, we want to make + * the BTT read-only + */ +- if (ent_e_flag(log_new.old_map)) { ++ if (ent_e_flag(log_new.old_map) && ++ !ent_normal(log_new.old_map)) { ++ arena->freelist[i].has_err = 1; + ret = arena_clear_freelist_error(arena, i); + if (ret) + dev_err_ratelimited(to_dev(arena), +@@ -575,7 +577,7 @@ static int btt_freelist_init(struct arena_info *arena) + } + + /* This implies a newly created or untouched flog entry */ +- if (log_new.old_map == log_new.new_map) ++ if (log_oldmap == log_newmap) + continue; + + /* Check if map recovery is needed */ +@@ -583,8 +585,15 @@ static int btt_freelist_init(struct arena_info *arena) + NULL, NULL, 0); + if (ret) + return ret; +- if ((le32_to_cpu(log_new.new_map) != map_entry) && +- (le32_to_cpu(log_new.old_map) == map_entry)) { ++ ++ /* ++ * The map_entry from btt_read_map is stripped of any flag bits, ++ * so use the stripped out versions from the log as well for ++ * testing whether recovery is needed. For restoration, use the ++ * 'raw' version of the log entries as that captured what we ++ * were going to write originally. ++ */ ++ if ((log_newmap != map_entry) && (log_oldmap == map_entry)) { + /* + * Last transaction wrote the flog, but wasn't able + * to complete the map write. So fix up the map. +diff --git a/drivers/nvdimm/btt.h b/drivers/nvdimm/btt.h +index 2609683c4167..c3e6a5da2ec7 100644 +--- a/drivers/nvdimm/btt.h ++++ b/drivers/nvdimm/btt.h +@@ -44,6 +44,8 @@ + #define ent_e_flag(ent) (!!(ent & MAP_ERR_MASK)) + #define ent_z_flag(ent) (!!(ent & MAP_TRIM_MASK)) + #define set_e_flag(ent) (ent |= MAP_ERR_MASK) ++/* 'normal' is both e and z flags set */ ++#define ent_normal(ent) (ent_e_flag(ent) && ent_z_flag(ent)) + + enum btt_init_state { + INIT_UNCHECKED = 0, +diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c +index e610dd890263..76a74e292fd7 100644 +--- a/drivers/nvdimm/btt_devs.c ++++ b/drivers/nvdimm/btt_devs.c +@@ -159,11 +159,19 @@ static ssize_t size_show(struct device *dev, + } + static DEVICE_ATTR_RO(size); + ++static ssize_t log_zero_flags_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sprintf(buf, "Y\n"); ++} ++static DEVICE_ATTR_RO(log_zero_flags); ++ + static struct attribute *nd_btt_attributes[] = { + &dev_attr_sector_size.attr, + &dev_attr_namespace.attr, + &dev_attr_uuid.attr, + &dev_attr_size.attr, ++ &dev_attr_log_zero_flags.attr, + NULL, + }; + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 59f3a37a44d7..8db2dc05b8cf 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -517,9 +517,33 @@ static struct asus_wmi_driver asus_nb_wmi_driver = { + .detect_quirks = asus_nb_wmi_quirks, + }; + ++static const struct dmi_system_id asus_nb_wmi_blacklist[] __initconst = { ++ { ++ /* ++ * asus-nb-wm adds no functionality. The T100TA has a detachable ++ * USB kbd, so no hotkeys and it has no WMI rfkill; and loading ++ * asus-nb-wm causes the camera LED to turn and _stay_ on. ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"), ++ }, ++ }, ++ { ++ /* The Asus T200TA has the same issue as the T100TA */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T200TA"), ++ }, ++ }, ++ {} /* Terminating entry */ ++}; + + static int __init asus_nb_wmi_init(void) + { ++ if (dmi_check_system(asus_nb_wmi_blacklist)) ++ return -ENODEV; ++ + return asus_wmi_register_driver(&asus_nb_wmi_driver); + } + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index ecd71efe8ea0..f15f6d1e1070 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -904,6 +904,11 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, + rmcd_error("pinned %ld out of %ld pages", + pinned, nr_pages); + ret = -EFAULT; ++ /* ++ * Set nr_pages up to mean "how many pages to unpin, in ++ * the error handler: ++ */ ++ nr_pages = pinned; + goto err_pg; + } + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index 07c23bbd968c..83645a1c6f82 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -2299,16 +2299,12 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + static int ibmvscsi_remove(struct vio_dev *vdev) + { + struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev); +- unsigned long flags; + + srp_remove_host(hostdata->host); + scsi_remove_host(hostdata->host); + + purge_requests(hostdata, DID_ERROR); +- +- spin_lock_irqsave(hostdata->host->host_lock, flags); + release_event_pool(&hostdata->pool, hostdata); +- spin_unlock_irqrestore(hostdata->host->host_lock, flags); + + ibmvscsi_release_crq_queue(&hostdata->queue, hostdata, + max_events); +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 5e8ae510aef8..9d9737114dcf 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -2998,7 +2998,7 @@ qla24xx_abort_command(srb_t *sp) + ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x108c, + "Entered %s.\n", __func__); + +- if (vha->flags.qpairs_available && sp->qpair) ++ if (sp->qpair) + req = sp->qpair->req; + + if (ql2xasynctmfenable) +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index c6d01b800d3c..2b297df88bdd 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -538,9 +538,9 @@ static void gb_tty_set_termios(struct tty_struct *tty, + } + + if (C_CRTSCTS(tty) && C_BAUD(tty) != B0) +- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN; + else +- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = 0; + + if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) { + memcpy(&gb_tty->line_coding, &newline, sizeof(newline)); +diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c +index 3e00df74b18c..989d5eca8861 100644 +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -126,17 +126,24 @@ static int ad2s1210_config_write(struct ad2s1210_state *st, u8 data) + static int ad2s1210_config_read(struct ad2s1210_state *st, + unsigned char address) + { +- struct spi_transfer xfer = { +- .len = 2, +- .rx_buf = st->rx, +- .tx_buf = st->tx, ++ struct spi_transfer xfers[] = { ++ { ++ .len = 1, ++ .rx_buf = &st->rx[0], ++ .tx_buf = &st->tx[0], ++ .cs_change = 1, ++ }, { ++ .len = 1, ++ .rx_buf = &st->rx[1], ++ .tx_buf = &st->tx[1], ++ }, + }; + int ret = 0; + + ad2s1210_set_mode(MOD_CONFIG, st); + st->tx[0] = address | AD2S1210_MSB_IS_HIGH; + st->tx[1] = AD2S1210_REG_FAULT; +- ret = spi_sync_transfer(st->sdev, &xfer, 1); ++ ret = spi_sync_transfer(st->sdev, xfers, 2); + if (ret < 0) + return ret; + st->old_data = true; +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 00e80cfe614c..298c91f83aee 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1082,11 +1082,11 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr, + + if (usb_endpoint_out(epaddr)) { + ep = dev->ep_out[epnum]; +- if (reset_hardware) ++ if (reset_hardware && epnum != 0) + dev->ep_out[epnum] = NULL; + } else { + ep = dev->ep_in[epnum]; +- if (reset_hardware) ++ if (reset_hardware && epnum != 0) + dev->ep_in[epnum] = NULL; + } + if (ep) { +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 834e88e20550..3f2f34ebf51f 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -182,14 +182,14 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, + break; + } + +- vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len); +- added = true; +- +- /* Deliver to monitoring devices all correctly transmitted +- * packets. ++ /* Deliver to monitoring devices all packets that we ++ * will transmit. + */ + virtio_transport_deliver_tap_pkt(pkt); + ++ vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len); ++ added = true; ++ + pkt->off += payload_len; + total_len += payload_len; + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index 52e03f1c76e3..21c3ffdc8a09 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -38,7 +38,6 @@ + #include <linux/init.h> /* For __init/__exit/... */ + #include <linux/jiffies.h> /* For timeout functions */ + #include <linux/kernel.h> /* For printk/panic/... */ +-#include <linux/kref.h> /* For data references */ + #include <linux/miscdevice.h> /* For handling misc devices */ + #include <linux/module.h> /* For module stuff/... */ + #include <linux/mutex.h> /* For mutexes */ +@@ -53,14 +52,14 @@ + + /* + * struct watchdog_core_data - watchdog core internal data +- * @kref: Reference count. ++ * @dev: The watchdog's internal device + * @cdev: The watchdog's Character device. + * @wdd: Pointer to watchdog device. + * @lock: Lock for watchdog core. + * @status: Watchdog core internal status bits. + */ + struct watchdog_core_data { +- struct kref kref; ++ struct device dev; + struct cdev cdev; + struct watchdog_device *wdd; + struct mutex lock; +@@ -802,7 +801,7 @@ static int watchdog_open(struct inode *inode, struct file *file) + file->private_data = wd_data; + + if (!hw_running) +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + + /* dev/watchdog is a virtual (and thus non-seekable) filesystem */ + return nonseekable_open(inode, file); +@@ -814,11 +813,11 @@ out_clear: + return err; + } + +-static void watchdog_core_data_release(struct kref *kref) ++static void watchdog_core_data_release(struct device *dev) + { + struct watchdog_core_data *wd_data; + +- wd_data = container_of(kref, struct watchdog_core_data, kref); ++ wd_data = container_of(dev, struct watchdog_core_data, dev); + + kfree(wd_data); + } +@@ -878,7 +877,7 @@ done: + */ + if (!running) { + module_put(wd_data->cdev.owner); +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return 0; + } +@@ -897,17 +896,22 @@ static struct miscdevice watchdog_miscdev = { + .fops = &watchdog_fops, + }; + ++static struct class watchdog_class = { ++ .name = "watchdog", ++ .owner = THIS_MODULE, ++ .dev_groups = wdt_groups, ++}; ++ + /* + * watchdog_cdev_register: register watchdog character device + * @wdd: watchdog device +- * @devno: character device number + * + * Register a watchdog character device including handling the legacy + * /dev/watchdog node. /dev/watchdog is actually a miscdevice and + * thus we set it up like that. + */ + +-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) ++static int watchdog_cdev_register(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data; + int err; +@@ -915,7 +919,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL); + if (!wd_data) + return -ENOMEM; +- kref_init(&wd_data->kref); + mutex_init(&wd_data->lock); + + wd_data->wdd = wdd; +@@ -942,23 +945,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + } + } + ++ device_initialize(&wd_data->dev); ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); ++ wd_data->dev.class = &watchdog_class; ++ wd_data->dev.parent = wdd->parent; ++ wd_data->dev.groups = wdd->groups; ++ wd_data->dev.release = watchdog_core_data_release; ++ dev_set_drvdata(&wd_data->dev, wdd); ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); ++ + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); +- wd_data->cdev.owner = wdd->ops->owner; + + /* Add the device */ +- err = cdev_add(&wd_data->cdev, devno, 1); ++ err = cdev_device_add(&wd_data->cdev, &wd_data->dev); + if (err) { + pr_err("watchdog%d unable to add device %d:%d\n", + wdd->id, MAJOR(watchdog_devt), wdd->id); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + return err; + } + ++ wd_data->cdev.owner = wdd->ops->owner; ++ + /* Record time of most recent heartbeat as 'just before now'. */ + wd_data->last_hw_keepalive = jiffies - 1; + +@@ -968,7 +981,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + */ + if (watchdog_hw_running(wdd)) { + __module_get(wdd->ops->owner); +- kref_get(&wd_data->kref); ++ get_device(&wd_data->dev); + if (handle_boot_enabled) + queue_delayed_work(watchdog_wq, &wd_data->work, 0); + else +@@ -991,7 +1004,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + { + struct watchdog_core_data *wd_data = wdd->wd_data; + +- cdev_del(&wd_data->cdev); ++ cdev_device_del(&wd_data->cdev, &wd_data->dev); + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +@@ -1009,15 +1022,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + + cancel_delayed_work_sync(&wd_data->work); + +- kref_put(&wd_data->kref, watchdog_core_data_release); ++ put_device(&wd_data->dev); + } + +-static struct class watchdog_class = { +- .name = "watchdog", +- .owner = THIS_MODULE, +- .dev_groups = wdt_groups, +-}; +- + /* + * watchdog_dev_register: register a watchdog device + * @wdd: watchdog device +@@ -1029,27 +1036,14 @@ static struct class watchdog_class = { + + int watchdog_dev_register(struct watchdog_device *wdd) + { +- struct device *dev; +- dev_t devno; + int ret; + +- devno = MKDEV(MAJOR(watchdog_devt), wdd->id); +- +- ret = watchdog_cdev_register(wdd, devno); ++ ret = watchdog_cdev_register(wdd); + if (ret) + return ret; + +- dev = device_create_with_groups(&watchdog_class, wdd->parent, +- devno, wdd, wdd->groups, +- "watchdog%d", wdd->id); +- if (IS_ERR(dev)) { +- watchdog_cdev_unregister(wdd); +- return PTR_ERR(dev); +- } +- + ret = watchdog_register_pretimeout(wdd); + if (ret) { +- device_destroy(&watchdog_class, devno); + watchdog_cdev_unregister(wdd); + } + +@@ -1067,7 +1061,6 @@ int watchdog_dev_register(struct watchdog_device *wdd) + void watchdog_dev_unregister(struct watchdog_device *wdd) + { + watchdog_unregister_pretimeout(wdd); +- device_destroy(&watchdog_class, wdd->wd_data->cdev.dev); + watchdog_cdev_unregister(wdd); + } + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index 1b5a50848b5b..589cfe3ed873 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -3502,6 +3502,7 @@ retry: + WARN_ON(1); + tsession = NULL; + target = -1; ++ mutex_lock(&session->s_mutex); + } + goto retry; + +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index c2ef617d2f97..c875f246cb0e 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -1537,6 +1537,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry) + spin_lock(&configfs_dirent_lock); + configfs_detach_rollback(dentry); + spin_unlock(&configfs_dirent_lock); ++ config_item_put(parent_item); + return -EINTR; + } + frag->frag_dead = true; +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c +index 13eb028607ca..3cbee832e796 100644 +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -153,6 +153,7 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino) + return PTR_ERR(inode); + num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits; + while (i < num) { ++ cond_resched(); + map.m_lblk = i; + map.m_len = num - i; + n = ext4_map_blocks(NULL, inode, &map, 0); +diff --git a/fs/file.c b/fs/file.c +index 0c25b980affe..97c6f0df39da 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -75,7 +75,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt, + */ + static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) + { +- unsigned int cpy, set; ++ size_t cpy, set; + + BUG_ON(nfdt->max_fds < ofdt->max_fds); + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 1e2ff4b32c79..aea1ed0aebd0 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -636,9 +636,6 @@ __acquires(&gl->gl_lockref.lock) + goto out_unlock; + if (nonblock) + goto out_sched; +- smp_mb(); +- if (atomic_read(&gl->gl_revokes) != 0) +- goto out_sched; + set_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + GLOCK_BUG_ON(gl, gl->gl_demote_state == LM_ST_EXCLUSIVE); + gl->gl_target = gl->gl_demote_state; +diff --git a/include/linux/padata.h b/include/linux/padata.h +index 2f9c1f93b1ce..d803397a28f7 100644 +--- a/include/linux/padata.h ++++ b/include/linux/padata.h +@@ -24,7 +24,6 @@ + #include <linux/workqueue.h> + #include <linux/spinlock.h> + #include <linux/list.h> +-#include <linux/timer.h> + #include <linux/notifier.h> + #include <linux/kobject.h> + +@@ -37,6 +36,7 @@ + * @list: List entry, to attach to the padata lists. + * @pd: Pointer to the internal control structure. + * @cb_cpu: Callback cpu for serializatioon. ++ * @cpu: Cpu for parallelization. + * @seq_nr: Sequence number of the parallelized data object. + * @info: Used to pass information from the parallel to the serial function. + * @parallel: Parallel execution function. +@@ -46,6 +46,7 @@ struct padata_priv { + struct list_head list; + struct parallel_data *pd; + int cb_cpu; ++ int cpu; + int info; + void (*parallel)(struct padata_priv *padata); + void (*serial)(struct padata_priv *padata); +@@ -83,7 +84,6 @@ struct padata_serial_queue { + * @serial: List to wait for serialization after reordering. + * @pwork: work struct for parallelization. + * @swork: work struct for serialization. +- * @pd: Backpointer to the internal control structure. + * @work: work struct for parallelization. + * @num_obj: Number of objects that are processed by this cpu. + * @cpu_index: Index of the cpu. +@@ -91,7 +91,6 @@ struct padata_serial_queue { + struct padata_parallel_queue { + struct padata_list parallel; + struct padata_list reorder; +- struct parallel_data *pd; + struct work_struct work; + atomic_t num_obj; + int cpu_index; +@@ -118,10 +117,10 @@ struct padata_cpumask { + * @reorder_objects: Number of objects waiting in the reorder queues. + * @refcnt: Number of objects holding a reference on this parallel_data. + * @max_seq_nr: Maximal used sequence number. ++ * @cpu: Next CPU to be processed. + * @cpumask: The cpumasks in use for parallel and serial workers. ++ * @reorder_work: work struct for reordering. + * @lock: Reorder lock. +- * @processed: Number of already processed objects. +- * @timer: Reorder timer. + */ + struct parallel_data { + struct padata_instance *pinst; +@@ -130,10 +129,10 @@ struct parallel_data { + atomic_t reorder_objects; + atomic_t refcnt; + atomic_t seq_nr; ++ int cpu; + struct padata_cpumask cpumask; ++ struct work_struct reorder_work; + spinlock_t lock ____cacheline_aligned; +- unsigned int processed; +- struct timer_list timer; + }; + + /** +diff --git a/kernel/padata.c b/kernel/padata.c +index a71620d2b8ba..f56ec63f60ba 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -133,6 +133,7 @@ int padata_do_parallel(struct padata_instance *pinst, + padata->cb_cpu = cb_cpu; + + target_cpu = padata_cpu_hash(pd); ++ padata->cpu = target_cpu; + queue = per_cpu_ptr(pd->pqueue, target_cpu); + + spin_lock(&queue->parallel.lock); +@@ -165,23 +166,12 @@ EXPORT_SYMBOL(padata_do_parallel); + */ + static struct padata_priv *padata_get_next(struct parallel_data *pd) + { +- int cpu, num_cpus; +- unsigned int next_nr, next_index; + struct padata_parallel_queue *next_queue; + struct padata_priv *padata; + struct padata_list *reorder; ++ int cpu = pd->cpu; + +- num_cpus = cpumask_weight(pd->cpumask.pcpu); +- +- /* +- * Calculate the percpu reorder queue and the sequence +- * number of the next object. +- */ +- next_nr = pd->processed; +- next_index = next_nr % num_cpus; +- cpu = padata_index_to_cpu(pd, next_index); + next_queue = per_cpu_ptr(pd->pqueue, cpu); +- + reorder = &next_queue->reorder; + + spin_lock(&reorder->lock); +@@ -192,7 +182,8 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd) + list_del_init(&padata->list); + atomic_dec(&pd->reorder_objects); + +- pd->processed++; ++ pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, ++ false); + + spin_unlock(&reorder->lock); + goto out; +@@ -215,6 +206,7 @@ static void padata_reorder(struct parallel_data *pd) + struct padata_priv *padata; + struct padata_serial_queue *squeue; + struct padata_instance *pinst = pd->pinst; ++ struct padata_parallel_queue *next_queue; + + /* + * We need to ensure that only one cpu can work on dequeueing of +@@ -246,7 +238,6 @@ static void padata_reorder(struct parallel_data *pd) + * so exit immediately. + */ + if (PTR_ERR(padata) == -ENODATA) { +- del_timer(&pd->timer); + spin_unlock_bh(&pd->lock); + return; + } +@@ -265,28 +256,27 @@ static void padata_reorder(struct parallel_data *pd) + + /* + * The next object that needs serialization might have arrived to +- * the reorder queues in the meantime, we will be called again +- * from the timer function if no one else cares for it. ++ * the reorder queues in the meantime. + * +- * Ensure reorder_objects is read after pd->lock is dropped so we see +- * an increment from another task in padata_do_serial. Pairs with ++ * Ensure reorder queue is read after pd->lock is dropped so we see ++ * new objects from another task in padata_do_serial. Pairs with + * smp_mb__after_atomic in padata_do_serial. + */ + smp_mb(); +- if (atomic_read(&pd->reorder_objects) +- && !(pinst->flags & PADATA_RESET)) +- mod_timer(&pd->timer, jiffies + HZ); +- else +- del_timer(&pd->timer); + +- return; ++ next_queue = per_cpu_ptr(pd->pqueue, pd->cpu); ++ if (!list_empty(&next_queue->reorder.list)) ++ queue_work(pinst->wq, &pd->reorder_work); + } + +-static void padata_reorder_timer(unsigned long arg) ++static void invoke_padata_reorder(struct work_struct *work) + { +- struct parallel_data *pd = (struct parallel_data *)arg; ++ struct parallel_data *pd; + ++ local_bh_disable(); ++ pd = container_of(work, struct parallel_data, reorder_work); + padata_reorder(pd); ++ local_bh_enable(); + } + + static void padata_serial_worker(struct work_struct *serial_work) +@@ -333,29 +323,22 @@ static void padata_serial_worker(struct work_struct *serial_work) + */ + void padata_do_serial(struct padata_priv *padata) + { +- int cpu; +- struct padata_parallel_queue *pqueue; +- struct parallel_data *pd; +- +- pd = padata->pd; +- +- cpu = get_cpu(); +- pqueue = per_cpu_ptr(pd->pqueue, cpu); ++ struct parallel_data *pd = padata->pd; ++ struct padata_parallel_queue *pqueue = per_cpu_ptr(pd->pqueue, ++ padata->cpu); + + spin_lock(&pqueue->reorder.lock); +- atomic_inc(&pd->reorder_objects); + list_add_tail(&padata->list, &pqueue->reorder.list); ++ atomic_inc(&pd->reorder_objects); + spin_unlock(&pqueue->reorder.lock); + + /* +- * Ensure the atomic_inc of reorder_objects above is ordered correctly ++ * Ensure the addition to the reorder list is ordered correctly + * with the trylock of pd->lock in padata_reorder. Pairs with smp_mb + * in padata_reorder. + */ + smp_mb__after_atomic(); + +- put_cpu(); +- + padata_reorder(pd); + } + EXPORT_SYMBOL(padata_do_serial); +@@ -404,9 +387,14 @@ static void padata_init_pqueues(struct parallel_data *pd) + struct padata_parallel_queue *pqueue; + + cpu_index = 0; +- for_each_cpu(cpu, pd->cpumask.pcpu) { ++ for_each_possible_cpu(cpu) { + pqueue = per_cpu_ptr(pd->pqueue, cpu); +- pqueue->pd = pd; ++ ++ if (!cpumask_test_cpu(cpu, pd->cpumask.pcpu)) { ++ pqueue->cpu_index = -1; ++ continue; ++ } ++ + pqueue->cpu_index = cpu_index; + cpu_index++; + +@@ -440,12 +428,13 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst, + + padata_init_pqueues(pd); + padata_init_squeues(pd); +- setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd); + atomic_set(&pd->seq_nr, -1); + atomic_set(&pd->reorder_objects, 0); + atomic_set(&pd->refcnt, 1); + pd->pinst = pinst; + spin_lock_init(&pd->lock); ++ pd->cpu = cpumask_first(pd->cpumask.pcpu); ++ INIT_WORK(&pd->reorder_work, invoke_padata_reorder); + + return pd; + +diff --git a/lib/Makefile b/lib/Makefile +index 4ea31c2d982d..ae2d261daec9 100644 +--- a/lib/Makefile ++++ b/lib/Makefile +@@ -256,6 +256,8 @@ obj-$(CONFIG_UCS2_STRING) += ucs2_string.o + obj-$(CONFIG_UBSAN) += ubsan.o + + UBSAN_SANITIZE_ubsan.o := n ++KASAN_SANITIZE_ubsan.o := n ++CFLAGS_ubsan.o := $(call cc-option, -fno-stack-protector) $(DISABLE_STACKLEAK_PLUGIN) + + obj-$(CONFIG_SBITMAP) += sbitmap.o + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index b8c90f8d1a57..c3f8bac32584 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -328,8 +328,8 @@ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net, + } + EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname); + +-static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel, +- struct l2tp_session *session) ++int l2tp_session_register(struct l2tp_session *session, ++ struct l2tp_tunnel *tunnel) + { + struct l2tp_session *session_walk; + struct hlist_head *g_head; +@@ -382,6 +382,10 @@ static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel, + hlist_add_head(&session->hlist, head); + write_unlock_bh(&tunnel->hlist_lock); + ++ /* Ignore management session in session count value */ ++ if (session->session_id != 0) ++ atomic_inc(&l2tp_session_count); ++ + return 0; + + err_tlock_pnlock: +@@ -391,6 +395,7 @@ err_tlock: + + return err; + } ++EXPORT_SYMBOL_GPL(l2tp_session_register); + + /* Lookup a tunnel by id + */ +@@ -1791,7 +1796,6 @@ EXPORT_SYMBOL_GPL(l2tp_session_set_header_len); + struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg) + { + struct l2tp_session *session; +- int err; + + session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL); + if (session != NULL) { +@@ -1848,17 +1852,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn + + refcount_set(&session->ref_count, 1); + +- err = l2tp_session_add_to_tunnel(tunnel, session); +- if (err) { +- kfree(session); +- +- return ERR_PTR(err); +- } +- +- /* Ignore management session in session count value */ +- if (session->session_id != 0) +- atomic_inc(&l2tp_session_count); +- + return session; + } + +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 62598ee7b2e7..e75748cdedb9 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -257,6 +257,9 @@ struct l2tp_session *l2tp_session_create(int priv_size, + struct l2tp_tunnel *tunnel, + u32 session_id, u32 peer_session_id, + struct l2tp_session_cfg *cfg); ++int l2tp_session_register(struct l2tp_session *session, ++ struct l2tp_tunnel *tunnel); ++ + void __l2tp_session_unhash(struct l2tp_session *session); + int l2tp_session_delete(struct l2tp_session *session); + void l2tp_session_free(struct l2tp_session *session); +diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c +index 014a7bc2a872..d29bfee291cb 100644 +--- a/net/l2tp/l2tp_eth.c ++++ b/net/l2tp/l2tp_eth.c +@@ -54,7 +54,7 @@ struct l2tp_eth { + + /* via l2tp_session_priv() */ + struct l2tp_eth_sess { +- struct net_device *dev; ++ struct net_device __rcu *dev; + }; + + +@@ -72,7 +72,14 @@ static int l2tp_eth_dev_init(struct net_device *dev) + + static void l2tp_eth_dev_uninit(struct net_device *dev) + { +- dev_put(dev); ++ struct l2tp_eth *priv = netdev_priv(dev); ++ struct l2tp_eth_sess *spriv; ++ ++ spriv = l2tp_session_priv(priv->session); ++ RCU_INIT_POINTER(spriv->dev, NULL); ++ /* No need for synchronize_net() here. We're called by ++ * unregister_netdev*(), which does the synchronisation for us. ++ */ + } + + static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev) +@@ -130,8 +137,8 @@ static void l2tp_eth_dev_setup(struct net_device *dev) + static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) + { + struct l2tp_eth_sess *spriv = l2tp_session_priv(session); +- struct net_device *dev = spriv->dev; +- struct l2tp_eth *priv = netdev_priv(dev); ++ struct net_device *dev; ++ struct l2tp_eth *priv; + + if (session->debug & L2TP_MSG_DATA) { + unsigned int length; +@@ -155,16 +162,25 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, + skb_dst_drop(skb); + nf_reset(skb); + ++ rcu_read_lock(); ++ dev = rcu_dereference(spriv->dev); ++ if (!dev) ++ goto error_rcu; ++ ++ priv = netdev_priv(dev); + if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) { + atomic_long_inc(&priv->rx_packets); + atomic_long_add(data_len, &priv->rx_bytes); + } else { + atomic_long_inc(&priv->rx_errors); + } ++ rcu_read_unlock(); ++ + return; + ++error_rcu: ++ rcu_read_unlock(); + error: +- atomic_long_inc(&priv->rx_errors); + kfree_skb(skb); + } + +@@ -175,11 +191,15 @@ static void l2tp_eth_delete(struct l2tp_session *session) + + if (session) { + spriv = l2tp_session_priv(session); +- dev = spriv->dev; ++ ++ rtnl_lock(); ++ dev = rtnl_dereference(spriv->dev); + if (dev) { +- unregister_netdev(dev); +- spriv->dev = NULL; ++ unregister_netdevice(dev); ++ rtnl_unlock(); + module_put(THIS_MODULE); ++ } else { ++ rtnl_unlock(); + } + } + } +@@ -189,9 +209,20 @@ static void l2tp_eth_show(struct seq_file *m, void *arg) + { + struct l2tp_session *session = arg; + struct l2tp_eth_sess *spriv = l2tp_session_priv(session); +- struct net_device *dev = spriv->dev; ++ struct net_device *dev; ++ ++ rcu_read_lock(); ++ dev = rcu_dereference(spriv->dev); ++ if (!dev) { ++ rcu_read_unlock(); ++ return; ++ } ++ dev_hold(dev); ++ rcu_read_unlock(); + + seq_printf(m, " interface %s\n", dev->name); ++ ++ dev_put(dev); + } + #endif + +@@ -268,14 +299,14 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel, + peer_session_id, cfg); + if (IS_ERR(session)) { + rc = PTR_ERR(session); +- goto out; ++ goto err; + } + + dev = alloc_netdev(sizeof(*priv), name, name_assign_type, + l2tp_eth_dev_setup); + if (!dev) { + rc = -ENOMEM; +- goto out_del_session; ++ goto err_sess; + } + + dev_net_set(dev, net); +@@ -295,26 +326,48 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel, + #endif + + spriv = l2tp_session_priv(session); +- spriv->dev = dev; + +- rc = register_netdev(dev); +- if (rc < 0) +- goto out_del_dev; ++ l2tp_session_inc_refcount(session); ++ ++ rtnl_lock(); ++ ++ /* Register both device and session while holding the rtnl lock. This ++ * ensures that l2tp_eth_delete() will see that there's a device to ++ * unregister, even if it happened to run before we assign spriv->dev. ++ */ ++ rc = l2tp_session_register(session, tunnel); ++ if (rc < 0) { ++ rtnl_unlock(); ++ goto err_sess_dev; ++ } ++ ++ rc = register_netdevice(dev); ++ if (rc < 0) { ++ rtnl_unlock(); ++ l2tp_session_delete(session); ++ l2tp_session_dec_refcount(session); ++ free_netdev(dev); ++ ++ return rc; ++ } + +- __module_get(THIS_MODULE); +- /* Must be done after register_netdev() */ + strlcpy(session->ifname, dev->name, IFNAMSIZ); ++ rcu_assign_pointer(spriv->dev, dev); + +- dev_hold(dev); ++ rtnl_unlock(); ++ ++ l2tp_session_dec_refcount(session); ++ ++ __module_get(THIS_MODULE); + + return 0; + +-out_del_dev: ++err_sess_dev: ++ l2tp_session_dec_refcount(session); + free_netdev(dev); +- spriv->dev = NULL; +-out_del_session: +- l2tp_session_delete(session); +-out: ++err_sess: ++ kfree(session); ++err: + return rc; + } + +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index a7fcf48e9087..ad07b7cb6558 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -122,8 +122,11 @@ + struct pppol2tp_session { + int owner; /* pid that opened the socket */ + +- struct sock *sock; /* Pointer to the session ++ struct mutex sk_lock; /* Protects .sk */ ++ struct sock __rcu *sk; /* Pointer to the session + * PPPoX socket */ ++ struct sock *__sk; /* Copy of .sk, for cleanup */ ++ struct rcu_head rcu; /* For asynchronous release */ + struct sock *tunnel_sock; /* Pointer to the tunnel UDP + * socket */ + int flags; /* accessed by PPPIOCGFLAGS. +@@ -138,6 +141,24 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = { + + static const struct proto_ops pppol2tp_ops; + ++/* Retrieves the pppol2tp socket associated to a session. ++ * A reference is held on the returned socket, so this function must be paired ++ * with sock_put(). ++ */ ++static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) ++{ ++ struct pppol2tp_session *ps = l2tp_session_priv(session); ++ struct sock *sk; ++ ++ rcu_read_lock(); ++ sk = rcu_dereference(ps->sk); ++ if (sk) ++ sock_hold(sk); ++ rcu_read_unlock(); ++ ++ return sk; ++} ++ + /* Helpers to obtain tunnel/session contexts from sockets. + */ + static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) +@@ -224,7 +245,8 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int + /* If the socket is bound, send it in to PPP's input queue. Otherwise + * queue it on the session socket. + */ +- sk = ps->sock; ++ rcu_read_lock(); ++ sk = rcu_dereference(ps->sk); + if (sk == NULL) + goto no_sock; + +@@ -247,30 +269,16 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int + kfree_skb(skb); + } + } ++ rcu_read_unlock(); + + return; + + no_sock: ++ rcu_read_unlock(); + l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); + kfree_skb(skb); + } + +-static void pppol2tp_session_sock_hold(struct l2tp_session *session) +-{ +- struct pppol2tp_session *ps = l2tp_session_priv(session); +- +- if (ps->sock) +- sock_hold(ps->sock); +-} +- +-static void pppol2tp_session_sock_put(struct l2tp_session *session) +-{ +- struct pppol2tp_session *ps = l2tp_session_priv(session); +- +- if (ps->sock) +- sock_put(ps->sock); +-} +- + /************************************************************************ + * Transmit handling + ***********************************************************************/ +@@ -431,17 +439,16 @@ abort: + */ + static void pppol2tp_session_close(struct l2tp_session *session) + { +- struct pppol2tp_session *ps = l2tp_session_priv(session); +- struct sock *sk = ps->sock; +- struct socket *sock = sk->sk_socket; ++ struct sock *sk; + + BUG_ON(session->magic != L2TP_SESSION_MAGIC); + +- if (sock) +- inet_shutdown(sock, SEND_SHUTDOWN); +- +- /* Don't let the session go away before our socket does */ +- l2tp_session_inc_refcount(session); ++ sk = pppol2tp_session_get_sock(session); ++ if (sk) { ++ if (sk->sk_socket) ++ inet_shutdown(sk->sk_socket, SEND_SHUTDOWN); ++ sock_put(sk); ++ } + } + + /* Really kill the session socket. (Called from sock_put() if +@@ -461,6 +468,14 @@ static void pppol2tp_session_destruct(struct sock *sk) + } + } + ++static void pppol2tp_put_sk(struct rcu_head *head) ++{ ++ struct pppol2tp_session *ps; ++ ++ ps = container_of(head, typeof(*ps), rcu); ++ sock_put(ps->__sk); ++} ++ + /* Called when the PPPoX socket (session) is closed. + */ + static int pppol2tp_release(struct socket *sock) +@@ -486,11 +501,23 @@ static int pppol2tp_release(struct socket *sock) + + session = pppol2tp_sock_to_session(sk); + +- /* Purge any queued data */ + if (session != NULL) { +- __l2tp_session_unhash(session); +- l2tp_session_queue_purge(session); +- sock_put(sk); ++ struct pppol2tp_session *ps; ++ ++ l2tp_session_delete(session); ++ ++ ps = l2tp_session_priv(session); ++ mutex_lock(&ps->sk_lock); ++ ps->__sk = rcu_dereference_protected(ps->sk, ++ lockdep_is_held(&ps->sk_lock)); ++ RCU_INIT_POINTER(ps->sk, NULL); ++ mutex_unlock(&ps->sk_lock); ++ call_rcu(&ps->rcu, pppol2tp_put_sk); ++ ++ /* Rely on the sock_put() call at the end of the function for ++ * dropping the reference held by pppol2tp_sock_to_session(). ++ * The last reference will be dropped by pppol2tp_put_sk(). ++ */ + } + release_sock(sk); + +@@ -557,16 +584,47 @@ out: + static void pppol2tp_show(struct seq_file *m, void *arg) + { + struct l2tp_session *session = arg; +- struct pppol2tp_session *ps = l2tp_session_priv(session); ++ struct sock *sk; ++ ++ sk = pppol2tp_session_get_sock(session); ++ if (sk) { ++ struct pppox_sock *po = pppox_sk(sk); + +- if (ps) { +- struct pppox_sock *po = pppox_sk(ps->sock); +- if (po) +- seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); ++ seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); ++ sock_put(sk); + } + } + #endif + ++static void pppol2tp_session_init(struct l2tp_session *session) ++{ ++ struct pppol2tp_session *ps; ++ struct dst_entry *dst; ++ ++ session->recv_skb = pppol2tp_recv; ++ session->session_close = pppol2tp_session_close; ++#if IS_ENABLED(CONFIG_L2TP_DEBUGFS) ++ session->show = pppol2tp_show; ++#endif ++ ++ ps = l2tp_session_priv(session); ++ mutex_init(&ps->sk_lock); ++ ps->tunnel_sock = session->tunnel->sock; ++ ps->owner = current->pid; ++ ++ /* If PMTU discovery was enabled, use the MTU that was discovered */ ++ dst = sk_dst_get(session->tunnel->sock); ++ if (dst) { ++ u32 pmtu = dst_mtu(dst); ++ ++ if (pmtu) { ++ session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; ++ session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; ++ } ++ dst_release(dst); ++ } ++} ++ + /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket + */ + static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, +@@ -578,7 +636,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + struct l2tp_session *session = NULL; + struct l2tp_tunnel *tunnel; + struct pppol2tp_session *ps; +- struct dst_entry *dst; + struct l2tp_session_cfg cfg = { 0, }; + int error = 0; + u32 tunnel_id, peer_tunnel_id; +@@ -703,13 +760,17 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + /* Using a pre-existing session is fine as long as it hasn't + * been connected yet. + */ +- if (ps->sock) { ++ mutex_lock(&ps->sk_lock); ++ if (rcu_dereference_protected(ps->sk, ++ lockdep_is_held(&ps->sk_lock))) { ++ mutex_unlock(&ps->sk_lock); + error = -EEXIST; + goto end; + } + + /* consistency checks */ + if (ps->tunnel_sock != tunnel->sock) { ++ mutex_unlock(&ps->sk_lock); + error = -EEXIST; + goto end; + } +@@ -725,35 +786,19 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + error = PTR_ERR(session); + goto end; + } +- } +- +- /* Associate session with its PPPoL2TP socket */ +- ps = l2tp_session_priv(session); +- ps->owner = current->pid; +- ps->sock = sk; +- ps->tunnel_sock = tunnel->sock; +- +- session->recv_skb = pppol2tp_recv; +- session->session_close = pppol2tp_session_close; +-#if IS_ENABLED(CONFIG_L2TP_DEBUGFS) +- session->show = pppol2tp_show; +-#endif +- +- /* We need to know each time a skb is dropped from the reorder +- * queue. +- */ +- session->ref = pppol2tp_session_sock_hold; +- session->deref = pppol2tp_session_sock_put; + +- /* If PMTU discovery was enabled, use the MTU that was discovered */ +- dst = sk_dst_get(tunnel->sock); +- if (dst != NULL) { +- u32 pmtu = dst_mtu(dst); ++ pppol2tp_session_init(session); ++ ps = l2tp_session_priv(session); ++ l2tp_session_inc_refcount(session); + +- if (pmtu != 0) +- session->mtu = session->mru = pmtu - +- PPPOL2TP_HEADER_OVERHEAD; +- dst_release(dst); ++ mutex_lock(&ps->sk_lock); ++ error = l2tp_session_register(session, tunnel); ++ if (error < 0) { ++ mutex_unlock(&ps->sk_lock); ++ kfree(session); ++ goto end; ++ } ++ drop_refcnt = true; + } + + /* Special case: if source & dest session_id == 0x0000, this +@@ -778,12 +823,23 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.mtu = session->mtu; + + error = ppp_register_net_channel(sock_net(sk), &po->chan); +- if (error) ++ if (error) { ++ mutex_unlock(&ps->sk_lock); + goto end; ++ } + + out_no_ppp: + /* This is how we get the session context from the socket. */ + sk->sk_user_data = session; ++ rcu_assign_pointer(ps->sk, sk); ++ mutex_unlock(&ps->sk_lock); ++ ++ /* Keep the reference we've grabbed on the session: sk doesn't expect ++ * the session to disappear. pppol2tp_session_destruct() is responsible ++ * for dropping it. ++ */ ++ drop_refcnt = false; ++ + sk->sk_state = PPPOX_CONNECTED; + l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", + session->name); +@@ -807,12 +863,11 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, + { + int error; + struct l2tp_session *session; +- struct pppol2tp_session *ps; + + /* Error if tunnel socket is not prepped */ + if (!tunnel->sock) { + error = -ENOENT; +- goto out; ++ goto err; + } + + /* Default MTU values. */ +@@ -827,18 +882,20 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, + peer_session_id, cfg); + if (IS_ERR(session)) { + error = PTR_ERR(session); +- goto out; ++ goto err; + } + +- ps = l2tp_session_priv(session); +- ps->tunnel_sock = tunnel->sock; ++ pppol2tp_session_init(session); + +- l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", +- session->name); ++ error = l2tp_session_register(session, tunnel); ++ if (error < 0) ++ goto err_sess; + +- error = 0; ++ return 0; + +-out: ++err_sess: ++ kfree(session); ++err: + return error; + } + +@@ -999,12 +1056,10 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session, + "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", + session->name, cmd, arg); + +- sk = ps->sock; ++ sk = pppol2tp_session_get_sock(session); + if (!sk) + return -EBADR; + +- sock_hold(sk); +- + switch (cmd) { + case SIOCGIFMTU: + err = -ENXIO; +@@ -1280,7 +1335,6 @@ static int pppol2tp_session_setsockopt(struct sock *sk, + int optname, int val) + { + int err = 0; +- struct pppol2tp_session *ps = l2tp_session_priv(session); + + switch (optname) { + case PPPOL2TP_SO_RECVSEQ: +@@ -1301,8 +1355,8 @@ static int pppol2tp_session_setsockopt(struct sock *sk, + } + session->send_seq = !!val; + { +- struct sock *ssk = ps->sock; +- struct pppox_sock *po = pppox_sk(ssk); ++ struct pppox_sock *po = pppox_sk(sk); ++ + po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : + PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; + } +@@ -1641,8 +1695,9 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) + { + struct l2tp_session *session = v; + struct l2tp_tunnel *tunnel = session->tunnel; +- struct pppol2tp_session *ps = l2tp_session_priv(session); +- struct pppox_sock *po = pppox_sk(ps->sock); ++ unsigned char state; ++ char user_data_ok; ++ struct sock *sk; + u32 ip = 0; + u16 port = 0; + +@@ -1652,6 +1707,15 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) + port = ntohs(inet->inet_sport); + } + ++ sk = pppol2tp_session_get_sock(session); ++ if (sk) { ++ state = sk->sk_state; ++ user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; ++ } else { ++ state = 0; ++ user_data_ok = 'N'; ++ } ++ + seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " + "%04X/%04X %d %c\n", + session->name, ip, port, +@@ -1659,9 +1723,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) + session->session_id, + tunnel->peer_tunnel_id, + session->peer_session_id, +- ps->sock->sk_state, +- (session == ps->sock->sk_user_data) ? +- 'Y' : 'N'); ++ state, user_data_ok); + seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", + session->mtu, session->mru, + session->recv_seq ? 'R' : '-', +@@ -1678,8 +1740,12 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) + atomic_long_read(&session->stats.rx_bytes), + atomic_long_read(&session->stats.rx_errors)); + +- if (po) ++ if (sk) { ++ struct pppox_sock *po = pppox_sk(sk); ++ + seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); ++ sock_put(sk); ++ } + } + + static int pppol2tp_seq_show(struct seq_file *m, void *v) +diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c +index 77cb23c7bd0a..48fad9ba8601 100644 +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -1111,7 +1111,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key, + &expiry, _abort_code); + if (ret < 0) +- goto temporary_error_free_resp; ++ goto temporary_error_free_ticket; + + /* use the session key from inside the ticket to decrypt the + * response */ +@@ -1193,7 +1193,6 @@ protocol_error: + + temporary_error_free_ticket: + kfree(ticket); +-temporary_error_free_resp: + kfree(response); + temporary_error: + /* Ignore the response packet if we got a temporary error such as +diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile +index e2ff425f4c7e..c404d7628039 100644 +--- a/scripts/gcc-plugins/Makefile ++++ b/scripts/gcc-plugins/Makefile +@@ -10,6 +10,7 @@ else + HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti + HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb + HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable ++ HOST_EXTRACXXFLAGS += -Wno-format-diag + export HOST_EXTRACXXFLAGS + endif + +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 797e3786b415..01312b1d6294 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -35,7 +35,9 @@ + #include "ggc.h" + #include "timevar.h" + ++#if BUILDING_GCC_VERSION < 10000 + #include "params.h" ++#endif + + #if BUILDING_GCC_VERSION <= 4009 + #include "pointer-set.h" +@@ -841,6 +843,7 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l + return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT); + } + ++#if BUILDING_GCC_VERSION < 10000 + template <> + template <> + inline bool is_a_helper<const ggoto *>::test(const_gimple gs) +@@ -854,6 +857,7 @@ inline bool is_a_helper<const greturn *>::test(const_gimple gs) + { + return gs->code == GIMPLE_RETURN; + } ++#endif + + static inline gasm *as_a_gasm(gimple stmt) + { +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index c106988c1b25..5341d8e52a2b 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -426,7 +426,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, + */ + error = aa_may_manage_policy(label, ns, mask); + if (error) +- return error; ++ goto end_section; + + data = aa_simple_write_to_buffer(buf, size, size, pos); + error = PTR_ERR(data); +@@ -434,6 +434,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, + error = aa_replace_profiles(ns, label, mask, data); + aa_put_loaddata(data); + } ++end_section: + end_current_label_crit_section(label); + + return error; +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index f1f030ae363b..73791d22ae07 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -90,7 +90,7 @@ static struct shash_desc *init_desc(char type) + algo = evm_hash; + } + +- if (*tfm == NULL) { ++ if (IS_ERR_OR_NULL(*tfm)) { + mutex_lock(&mutex); + if (*tfm) + goto out; +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index 06b0ee75f34f..7b16e54f01c6 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -432,7 +432,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + loff_t i_size; + int rc; + struct file *f = file; +- bool new_file_instance = false, modified_flags = false; ++ bool new_file_instance = false, modified_mode = false; + + /* + * For consistency, fail file's opened with the O_DIRECT flag on +@@ -452,13 +452,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + f = dentry_open(&file->f_path, flags, file->f_cred); + if (IS_ERR(f)) { + /* +- * Cannot open the file again, lets modify f_flags ++ * Cannot open the file again, lets modify f_mode + * of original and continue + */ + pr_info_ratelimited("Unable to reopen file for reading.\n"); + f = file; +- f->f_flags |= FMODE_READ; +- modified_flags = true; ++ f->f_mode |= FMODE_READ; ++ modified_mode = true; + } else { + new_file_instance = true; + } +@@ -476,8 +476,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + out: + if (new_file_instance) + fput(f); +- else if (modified_flags) +- f->f_flags &= ~FMODE_READ; ++ else if (modified_mode) ++ f->f_mode &= ~FMODE_READ; + return rc; + } + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 2c4e83f6409e..d37f9ac46670 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -340,8 +340,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, + "policy_update", "signed policy required", + 1, 0); +- if (ima_appraise & IMA_APPRAISE_ENFORCE) +- result = -EACCES; ++ result = -EACCES; + } else { + result = ima_parse_add_rule(data); + } +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 80453266a2de..c412f2a909c9 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -440,6 +440,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream, + + no_delta_check: + if (runtime->status->hw_ptr == new_hw_ptr) { ++ runtime->hw_ptr_jiffies = curr_jiffies; + update_audio_tstamp(substream, &curr_tstamp, &audio_tstamp); + return 0; + } +diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c +index 0e66afa403a3..5a7928e1b29e 100644 +--- a/sound/pci/ice1712/ice1712.c ++++ b/sound/pci/ice1712/ice1712.c +@@ -2377,7 +2377,8 @@ static int snd_ice1712_chip_init(struct snd_ice1712 *ice) + pci_write_config_byte(ice->pci, 0x61, ice->eeprom.data[ICE_EEP1_ACLINK]); + pci_write_config_byte(ice->pci, 0x62, ice->eeprom.data[ICE_EEP1_I2SID]); + pci_write_config_byte(ice->pci, 0x63, ice->eeprom.data[ICE_EEP1_SPDIF]); +- if (ice->eeprom.subvendor != ICE1712_SUBDEVICE_STDSP24) { ++ if (ice->eeprom.subvendor != ICE1712_SUBDEVICE_STDSP24 && ++ ice->eeprom.subvendor != ICE1712_SUBDEVICE_STAUDIO_ADCIII) { + ice->gpio.write_mask = ice->eeprom.gpiomask; + ice->gpio.direction = ice->eeprom.gpiodir; + snd_ice1712_write(ice, ICE1712_IREG_GPIO_WRITE_MASK,
