commit: 58ef0246d074788e6c2b9d26d62d0ebd03bc6174 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Jan 12 20:06:09 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Jan 12 20:06:09 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=58ef0246
Linux patch 4.19.167 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1166_linux-4.19.167.patch | 2625 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2629 insertions(+) diff --git a/0000_README b/0000_README index 551b30e..5064804 100644 --- a/0000_README +++ b/0000_README @@ -703,6 +703,10 @@ Patch: 1165_linux-4.19.166.patch From: https://www.kernel.org Desc: Linux 4.19.166 +Patch: 1166_linux-4.19.167.patch +From: https://www.kernel.org +Desc: Linux 4.19.167 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1166_linux-4.19.167.patch b/1166_linux-4.19.167.patch new file mode 100644 index 0000000..ab5b3ed --- /dev/null +++ b/1166_linux-4.19.167.patch @@ -0,0 +1,2625 @@ +diff --git a/Makefile b/Makefile +index b2c939f289c25..91a82c22a4749 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 166 ++SUBLEVEL = 167 + EXTRAVERSION = + NAME = "People's Front" + +@@ -400,7 +400,7 @@ YACC = bison + AWK = awk + GENKSYMS = scripts/genksyms/genksyms + INSTALLKERNEL := installkernel +-DEPMOD = /sbin/depmod ++DEPMOD = depmod + PERL = perl + PYTHON = python + PYTHON2 = python2 +diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c +index e12ee86906c62..9436f34520491 100644 +--- a/arch/x86/kernel/cpu/mtrr/generic.c ++++ b/arch/x86/kernel/cpu/mtrr/generic.c +@@ -166,9 +166,6 @@ static u8 mtrr_type_lookup_variable(u64 start, u64 end, u64 *partial_end, + *repeat = 0; + *uniform = 1; + +- /* Make end inclusive instead of exclusive */ +- end--; +- + prev_match = MTRR_TYPE_INVALID; + for (i = 0; i < num_var_ranges; ++i) { + unsigned short start_state, end_state, inclusive; +@@ -260,6 +257,9 @@ u8 mtrr_type_lookup(u64 start, u64 end, u8 *uniform) + int repeat; + u64 partial_end; + ++ /* Make end inclusive instead of exclusive */ ++ end--; ++ + if (!mtrr_state_set) + return MTRR_TYPE_INVALID; + +diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h +index 0b62c817f63f5..05a02b8ace6ba 100644 +--- a/arch/x86/kvm/mmu.h ++++ b/arch/x86/kvm/mmu.h +@@ -53,7 +53,7 @@ static inline u64 rsvd_bits(int s, int e) + if (e < s) + return 0; + +- return ((1ULL << (e - s + 1)) - 1) << s; ++ return ((2ULL << (e - s)) - 1) << s; + } + + void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value); +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index bf52106ab9c49..c0e9c00402ac8 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -838,6 +838,8 @@ int pud_free_pmd_page(pud_t *pud, unsigned long addr) + } + + free_page((unsigned long)pmd_sv); ++ ++ pgtable_pmd_page_dtor(virt_to_page(pmd)); + free_page((unsigned long)pmd); + + return 1; +diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c +index 66bcdeeee639a..90d2e4ce70644 100644 +--- a/arch/x86/xen/efi.c ++++ b/arch/x86/xen/efi.c +@@ -172,7 +172,7 @@ static enum efi_secureboot_mode xen_efi_get_secureboot(void) + return efi_secureboot_mode_unknown; + } + +-void __init xen_efi_init(void) ++void __init xen_efi_init(struct boot_params *boot_params) + { + efi_system_table_t *efi_systab_xen; + +@@ -181,12 +181,12 @@ void __init xen_efi_init(void) + if (efi_systab_xen == NULL) + return; + +- strncpy((char *)&boot_params.efi_info.efi_loader_signature, "Xen", +- sizeof(boot_params.efi_info.efi_loader_signature)); +- boot_params.efi_info.efi_systab = (__u32)__pa(efi_systab_xen); +- boot_params.efi_info.efi_systab_hi = (__u32)(__pa(efi_systab_xen) >> 32); ++ strncpy((char *)&boot_params->efi_info.efi_loader_signature, "Xen", ++ sizeof(boot_params->efi_info.efi_loader_signature)); ++ boot_params->efi_info.efi_systab = (__u32)__pa(efi_systab_xen); ++ boot_params->efi_info.efi_systab_hi = (__u32)(__pa(efi_systab_xen) >> 32); + +- boot_params.secure_boot = xen_efi_get_secureboot(); ++ boot_params->secure_boot = xen_efi_get_secureboot(); + + set_bit(EFI_BOOT, &efi.flags); + set_bit(EFI_PARAVIRT, &efi.flags); +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 9f8995cd28f65..1c3e9185934c4 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1409,7 +1409,7 @@ asmlinkage __visible void __init xen_start_kernel(void) + /* We need this for printk timestamps */ + xen_setup_runstate_info(0); + +- xen_efi_init(); ++ xen_efi_init(&boot_params); + + /* Start the world */ + #ifdef CONFIG_X86_32 +diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c +index dab07827d25e8..f04d22bcf08de 100644 +--- a/arch/x86/xen/enlighten_pvh.c ++++ b/arch/x86/xen/enlighten_pvh.c +@@ -14,6 +14,8 @@ + #include <xen/interface/memory.h> + #include <xen/interface/hvm/start_info.h> + ++#include "xen-ops.h" ++ + /* + * PVH variables. + * +@@ -79,6 +81,8 @@ static void __init init_pvh_bootparams(void) + pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */ + + x86_init.acpi.get_root_pointer = pvh_get_root_pointer; ++ ++ xen_efi_init(&pvh_bootparams); + } + + /* +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 0e60bd9186954..2f111f47ba98c 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -122,9 +122,9 @@ static inline void __init xen_init_vga(const struct dom0_vga_console_info *info, + void __init xen_init_apic(void); + + #ifdef CONFIG_XEN_EFI +-extern void xen_efi_init(void); ++extern void xen_efi_init(struct boot_params *boot_params); + #else +-static inline void __init xen_efi_init(void) ++static inline void __init xen_efi_init(struct boot_params *boot_params) + { + } + #endif +diff --git a/crypto/ecdh.c b/crypto/ecdh.c +index a6e1a5d43fa7a..34605509b41a6 100644 +--- a/crypto/ecdh.c ++++ b/crypto/ecdh.c +@@ -43,7 +43,8 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, + struct ecdh params; + unsigned int ndigits; + +- if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0) ++ if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0 || ++ params.key_size > sizeof(ctx->private_key)) + return -EINVAL; + + ndigits = ecdh_supported_curve(params.curve_id); +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 6e737142ceaab..3e00ab8a8890c 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -3607,7 +3607,7 @@ static int idt77252_init_one(struct pci_dev *pcidev, + + if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) { + printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev)); +- return err; ++ goto err_out_disable_pdev; + } + + card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL); +diff --git a/drivers/base/core.c b/drivers/base/core.c +index f0cdf38ed31c9..4818aaddd712e 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3349,7 +3349,7 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + if (fwnode_is_primary(fn)) { + dev->fwnode = fn->secondary; + if (!(parent && fn == parent->fwnode)) +- fn->secondary = ERR_PTR(-ENODEV); ++ fn->secondary = NULL; + } else { + dev->fwnode = NULL; + } +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index a017322dba82b..7ffeb37e8f202 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -263,12 +263,8 @@ static int h5_close(struct hci_uart *hu) + if (h5->vnd && h5->vnd->close) + h5->vnd->close(h5); + +- if (hu->serdev) +- serdev_device_close(hu->serdev); +- +- kfree_skb(h5->rx_skb); +- kfree(h5); +- h5 = NULL; ++ if (!hu->serdev) ++ kfree(h5); + + return 0; + } +diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c +index 8b2b72b938857..4224c4dd89635 100644 +--- a/drivers/ide/ide-atapi.c ++++ b/drivers/ide/ide-atapi.c +@@ -213,7 +213,6 @@ void ide_prep_sense(ide_drive_t *drive, struct request *rq) + sense_rq->rq_disk = rq->rq_disk; + sense_rq->cmd_flags = REQ_OP_DRV_IN; + ide_req(sense_rq)->type = ATA_PRIV_SENSE; +- sense_rq->rq_flags |= RQF_PREEMPT; + + req->cmd[0] = GPCMD_REQUEST_SENSE; + req->cmd[4] = cmd_len; +diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c +index 0d93e0cfbeaf9..4381760846109 100644 +--- a/drivers/ide/ide-io.c ++++ b/drivers/ide/ide-io.c +@@ -527,11 +527,6 @@ repeat: + * above to return us whatever is in the queue. Since we call + * ide_do_request() ourselves, we end up taking requests while + * the queue is blocked... +- * +- * We let requests forced at head of queue with ide-preempt +- * though. I hope that doesn't happen too much, hopefully not +- * unless the subdriver triggers such a thing in its own PM +- * state machine. + */ + if ((drive->dev_flags & IDE_DFLAG_BLOCKED) && + ata_pm_request(rq) == 0 && +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 9a614c5cdfa22..0c69becc3c177 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2507,6 +2507,7 @@ static int bcm_sysport_probe(struct platform_device *pdev) + /* HW supported features, none enabled by default */ + dev->hw_features |= NETIF_F_RXCSUM | NETIF_F_HIGHDMA | + NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; ++ dev->max_mtu = UMAC_MAX_MTU_SIZE; + + /* Request the WOL interrupt and advertise suspend if available */ + priv->wol_irq_disabled = 1; +diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c +index 60da0499ad66c..a2280c4be0f51 100644 +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1213,7 +1213,7 @@ static int ethoc_probe(struct platform_device *pdev) + ret = mdiobus_register(priv->mdio); + if (ret) { + dev_err(&netdev->dev, "failed to register MDIO bus\n"); +- goto free2; ++ goto free3; + } + + ret = ethoc_mdio_probe(netdev); +@@ -1245,6 +1245,7 @@ error2: + netif_napi_del(&priv->napi); + error: + mdiobus_unregister(priv->mdio); ++free3: + mdiobus_free(priv->mdio); + free2: + clk_disable_unprepare(priv->clk); +diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c +index 5de6f7c73c1fa..d43173917ce47 100644 +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3902,6 +3902,7 @@ static int ucc_geth_probe(struct platform_device* ofdev) + INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work); + netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64); + dev->mtu = 1500; ++ dev->max_mtu = 1518; + + ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT); + ugeth->phy_interface = phy_interface; +@@ -3947,12 +3948,12 @@ static int ucc_geth_remove(struct platform_device* ofdev) + struct device_node *np = ofdev->dev.of_node; + + unregister_netdev(dev); +- free_netdev(dev); + ucc_geth_memclean(ugeth); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(ugeth->ug_info->tbi_node); + of_node_put(ugeth->ug_info->phy_node); ++ free_netdev(dev); + + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 1fa0cd527ead3..f453cebf758c6 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -419,6 +419,10 @@ static void __lb_other_process(struct hns_nic_ring_data *ring_data, + /* for mutl buffer*/ + new_skb = skb_copy(skb, GFP_ATOMIC); + dev_kfree_skb_any(skb); ++ if (!new_skb) { ++ netdev_err(ndev, "skb alloc failed\n"); ++ return; ++ } + skb = new_skb; + + check_ok = 0; +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 3ad46d1f58f6e..738acba7a9a3c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -127,6 +127,7 @@ enum i40e_state_t { + __I40E_RESET_INTR_RECEIVED, + __I40E_REINIT_REQUESTED, + __I40E_PF_RESET_REQUESTED, ++ __I40E_PF_RESET_AND_REBUILD_REQUESTED, + __I40E_CORE_RESET_REQUESTED, + __I40E_GLOBAL_RESET_REQUESTED, + __I40E_EMP_RESET_REQUESTED, +@@ -153,6 +154,8 @@ enum i40e_state_t { + }; + + #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED) ++#define I40E_PF_RESET_AND_REBUILD_FLAG \ ++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED) + + /* VSI state flags */ + enum i40e_vsi_state_t { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 985601a65defd..a728b6a7872cb 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -42,6 +42,8 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf); + static void i40e_determine_queue_usage(struct i40e_pf *pf); + static int i40e_setup_pf_filter_control(struct i40e_pf *pf); + static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired); ++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit, ++ bool lock_acquired); + static int i40e_reset(struct i40e_pf *pf); + static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired); + static void i40e_fdir_sb_setup(struct i40e_pf *pf); +@@ -7929,6 +7931,14 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired) + dev_dbg(&pf->pdev->dev, "PFR requested\n"); + i40e_handle_reset_warning(pf, lock_acquired); + ++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) { ++ /* Request a PF Reset ++ * ++ * Resets PF and reinitializes PFs VSI. ++ */ ++ i40e_prep_for_reset(pf, lock_acquired); ++ i40e_reset_and_rebuild(pf, true, lock_acquired); ++ + } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) { + int v; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index dd0c9604d3c92..5d782148d35f8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1567,7 +1567,7 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs) + if (num_vfs) { + if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { + pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } + return i40e_pci_sriov_enable(pdev, num_vfs); + } +@@ -1575,7 +1575,7 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs) + if (!pci_vfs_assigned(pf->pdev)) { + i40e_free_vfs(pf); + pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } else { + dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n"); + return -EINVAL; +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index e4e43519710d4..986292a34f4f6 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -954,7 +954,7 @@ static void mvpp22_gop_init_rgmii(struct mvpp2_port *port) + + regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val); + if (port->gop_id == 2) +- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII; ++ val |= GENCONF_CTRL0_PORT0_RGMII; + else if (port->gop_id == 3) + val |= GENCONF_CTRL0_PORT1_RGMII_MII; + regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val); +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index 5692c6087bbb0..a30eb90ba3d28 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(struct mvpp2 *priv, unsigned char start, + return -EINVAL; + } + ++/* Drop flow control pause frames */ ++static void mvpp2_prs_drop_fc(struct mvpp2 *priv) ++{ ++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 }; ++ struct mvpp2_prs_entry pe; ++ unsigned int len; ++ ++ memset(&pe, 0, sizeof(pe)); ++ ++ /* For all ports - drop flow control frames */ ++ pe.index = MVPP2_PE_FC_DROP; ++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC); ++ ++ /* Set match on DA */ ++ len = ETH_ALEN; ++ while (len--) ++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff); ++ ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK, ++ MVPP2_PRS_RI_DROP_MASK); ++ ++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1); ++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS); ++ ++ /* Mask all ports */ ++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK); ++ ++ /* Update shadow table and hw entry */ ++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC); ++ mvpp2_prs_hw_write(priv, &pe); ++} ++ + /* Enable/disable dropping all mac da's */ + static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add) + { +@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv) + mvpp2_prs_hw_write(priv, &pe); + + /* Create dummy entries for drop all and promiscuous modes */ ++ mvpp2_prs_drop_fc(priv); + mvpp2_prs_mac_drop_all_set(priv, 0, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false); +@@ -1647,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct mvpp2 *priv) + mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6); + mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6, + MVPP2_PRS_RI_L3_PROTO_MASK); +- /* Skip eth_type + 4 bytes of IPv6 header */ +- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4, ++ /* Jump to DIP of IPV6 header */ ++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 + ++ MVPP2_MAX_L3_ADDR_SIZE, + MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); + /* Set L3 offset */ + mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h +index e22f6c85d3803..4b68dd3747338 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h +@@ -129,7 +129,7 @@ + #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7) + #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6) + #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5) +-/* reserved */ ++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4) + #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3) + #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2) + #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1) +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index a96da16f34049..1976279800cd8 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1747,6 +1747,11 @@ netdev_features_t qede_features_check(struct sk_buff *skb, + ntohs(udp_hdr(skb)->dest) != gnv_port)) + return features & ~(NETIF_F_CSUM_MASK | + NETIF_F_GSO_MASK); ++ } else if (l4_proto == IPPROTO_IPIP) { ++ /* IPIP tunnels are unknown to the device or at least unsupported natively, ++ * offloads for them can't be done trivially, so disable them for such skb. ++ */ ++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); + } + } + +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index c7ce167c67a08..6b901bf1cd54d 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -4237,7 +4237,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp) + return; + + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: +@@ -4263,7 +4264,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp) + static void r8168_pll_power_up(struct rtl8169_private *tp) + { + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index d7543811dfae2..10b301e790864 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -476,6 +476,7 @@ void cpts_unregister(struct cpts *cpts) + + ptp_clock_unregister(cpts->clock); + cpts->clock = NULL; ++ cpts->phc_index = -1; + + cpts_write32(cpts, 0, int_enable); + cpts_write32(cpts, 0, control); +@@ -577,6 +578,7 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs, + cpts->cc.read = cpts_systim_read; + cpts->cc.mask = CLOCKSOURCE_MASK(32); + cpts->info = cpts_info; ++ cpts->phc_index = -1; + + cpts_calc_mult_shift(cpts); + /* save cc.mult original value as it can be modified +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index fe0e02e11f294..1a86b016b8420 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1450,7 +1450,7 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile, + int i; + + if (it->nr_segs > MAX_SKB_FRAGS + 1) +- return ERR_PTR(-ENOMEM); ++ return ERR_PTR(-EMSGSIZE); + + local_bh_disable(); + skb = napi_get_frags(&tfile->napi); +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 1f57a6a2b8a25..e0bbefcbefa17 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1629,9 +1629,6 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) + * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be + * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE. + */ +- netif_info(dev, link, dev->net, +- "network connection: %sconnected\n", +- !!event->wValue ? "" : "dis"); + usbnet_link_change(dev, !!event->wValue, 0); + break; + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index ebd630a94571f..1b48d71dbc284 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -995,6 +995,7 @@ static const struct usb_device_id products[] = { + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ ++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */ + + /* 3. Combined interface devices matching on interface number */ +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index b21223be93c8e..d41d5f63f211f 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2077,14 +2077,16 @@ static int virtnet_set_channels(struct net_device *dev, + + get_online_cpus(); + err = _virtnet_set_queues(vi, queue_pairs); +- if (!err) { +- netif_set_real_num_tx_queues(dev, queue_pairs); +- netif_set_real_num_rx_queues(dev, queue_pairs); +- +- virtnet_set_affinity(vi); ++ if (err) { ++ put_online_cpus(); ++ goto err; + } ++ virtnet_set_affinity(vi); + put_online_cpus(); + ++ netif_set_real_num_tx_queues(dev, queue_pairs); ++ netif_set_real_num_rx_queues(dev, queue_pairs); ++ err: + return err; + } + +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index 20d9b6585fba3..d67623d61dc42 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -572,6 +572,13 @@ static void ppp_timer(struct timer_list *t) + unsigned long flags; + + spin_lock_irqsave(&ppp->lock, flags); ++ /* mod_timer could be called after we entered this function but ++ * before we got the lock. ++ */ ++ if (timer_pending(&proto->timer)) { ++ spin_unlock_irqrestore(&ppp->lock, flags); ++ return; ++ } + switch (proto->state) { + case STOPPING: + case REQ_SENT: +diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c +index 69213842e63e0..efb9c3d902133 100644 +--- a/drivers/scsi/scsi_transport_spi.c ++++ b/drivers/scsi/scsi_transport_spi.c +@@ -130,12 +130,16 @@ static int spi_execute(struct scsi_device *sdev, const void *cmd, + sshdr = &sshdr_tmp; + + for(i = 0; i < DV_RETRIES; i++) { ++ /* ++ * The purpose of the RQF_PM flag below is to bypass the ++ * SDEV_QUIESCE state. ++ */ + result = scsi_execute(sdev, cmd, dir, buffer, bufflen, sense, + sshdr, DV_TIMEOUT, /* retries */ 1, + REQ_FAILFAST_DEV | + REQ_FAILFAST_TRANSPORT | + REQ_FAILFAST_DRIVER, +- 0, NULL); ++ RQF_PM, NULL); + if (driver_byte(result) != DRIVER_SENSE || + sshdr->sense_key != UNIT_ATTENTION) + break; +@@ -1018,23 +1022,26 @@ spi_dv_device(struct scsi_device *sdev) + */ + lock_system_sleep(); + ++ if (scsi_autopm_get_device(sdev)) ++ goto unlock_system_sleep; ++ + if (unlikely(spi_dv_in_progress(starget))) +- goto unlock; ++ goto put_autopm; + + if (unlikely(scsi_device_get(sdev))) +- goto unlock; ++ goto put_autopm; + + spi_dv_in_progress(starget) = 1; + + buffer = kzalloc(len, GFP_KERNEL); + + if (unlikely(!buffer)) +- goto out_put; ++ goto put_sdev; + + /* We need to verify that the actual device will quiesce; the + * later target quiesce is just a nice to have */ + if (unlikely(scsi_device_quiesce(sdev))) +- goto out_free; ++ goto free_buffer; + + scsi_target_quiesce(starget); + +@@ -1054,12 +1061,16 @@ spi_dv_device(struct scsi_device *sdev) + + spi_initial_dv(starget) = 1; + +- out_free: ++free_buffer: + kfree(buffer); +- out_put: ++ ++put_sdev: + spi_dv_in_progress(starget) = 0; + scsi_device_put(sdev); +-unlock: ++put_autopm: ++ scsi_autopm_put_device(sdev); ++ ++unlock_system_sleep: + unlock_system_sleep(); + } + EXPORT_SYMBOL(spi_dv_device); +diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c +index ffe6f82182ba8..68f4f67c5ff88 100644 +--- a/drivers/scsi/ufs/ufshcd-pci.c ++++ b/drivers/scsi/ufs/ufshcd-pci.c +@@ -96,6 +96,30 @@ static int ufshcd_pci_resume(struct device *dev) + { + return ufshcd_system_resume(dev_get_drvdata(dev)); + } ++ ++/** ++ * ufshcd_pci_poweroff - suspend-to-disk poweroff function ++ * @dev: pointer to PCI device handle ++ * ++ * Returns 0 if successful ++ * Returns non-zero otherwise ++ */ ++static int ufshcd_pci_poweroff(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ int spm_lvl = hba->spm_lvl; ++ int ret; ++ ++ /* ++ * For poweroff we need to set the UFS device to PowerDown mode. ++ * Force spm_lvl to ensure that. ++ */ ++ hba->spm_lvl = 5; ++ ret = ufshcd_system_suspend(hba); ++ hba->spm_lvl = spm_lvl; ++ return ret; ++} ++ + #endif /* !CONFIG_PM_SLEEP */ + + #ifdef CONFIG_PM +@@ -190,8 +214,14 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + } + + static const struct dev_pm_ops ufshcd_pci_pm_ops = { +- SET_SYSTEM_SLEEP_PM_OPS(ufshcd_pci_suspend, +- ufshcd_pci_resume) ++#ifdef CONFIG_PM_SLEEP ++ .suspend = ufshcd_pci_suspend, ++ .resume = ufshcd_pci_resume, ++ .freeze = ufshcd_pci_suspend, ++ .thaw = ufshcd_pci_resume, ++ .poweroff = ufshcd_pci_poweroff, ++ .restore = ufshcd_pci_resume, ++#endif + SET_RUNTIME_PM_OPS(ufshcd_pci_runtime_suspend, + ufshcd_pci_runtime_resume, + ufshcd_pci_runtime_idle) +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 61b1eae42ea85..40f478c4d118f 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -3583,7 +3583,7 @@ static int ufshcd_dme_enable(struct ufs_hba *hba) + ret = ufshcd_send_uic_cmd(hba, &uic_cmd); + if (ret) + dev_err(hba->dev, +- "dme-reset: error code %d\n", ret); ++ "dme-enable: error code %d\n", ret); + + return ret; + } +diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c +index 5831f816c17b1..f60302b711813 100644 +--- a/drivers/staging/mt7621-dma/mtk-hsdma.c ++++ b/drivers/staging/mt7621-dma/mtk-hsdma.c +@@ -723,7 +723,7 @@ static int mtk_hsdma_probe(struct platform_device *pdev) + ret = dma_async_device_register(dd); + if (ret) { + dev_err(&pdev->dev, "failed to register dma device\n"); +- return ret; ++ goto err_uninit_hsdma; + } + + ret = of_dma_controller_register(pdev->dev.of_node, +@@ -739,6 +739,8 @@ static int mtk_hsdma_probe(struct platform_device *pdev) + + err_unregister: + dma_async_device_unregister(dd); ++err_uninit_hsdma: ++ mtk_hsdma_uninit(hsdma); + return ret; + } + +diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c +index 7cdb5d7f65382..1709b8a99bd79 100644 +--- a/drivers/target/target_core_xcopy.c ++++ b/drivers/target/target_core_xcopy.c +@@ -55,60 +55,83 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf) + return 0; + } + +-struct xcopy_dev_search_info { +- const unsigned char *dev_wwn; +- struct se_device *found_dev; +-}; +- ++/** ++ * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers ++ * ++ * @se_dev: device being considered for match ++ * @dev_wwn: XCOPY requested NAA dev_wwn ++ * @return: 1 on match, 0 on no-match ++ */ + static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev, +- void *data) ++ const unsigned char *dev_wwn) + { +- struct xcopy_dev_search_info *info = data; + unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; + int rc; + +- if (!se_dev->dev_attrib.emulate_3pc) ++ if (!se_dev->dev_attrib.emulate_3pc) { ++ pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev); + return 0; ++ } + + memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN); + target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]); + +- rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); +- if (rc != 0) +- return 0; +- +- info->found_dev = se_dev; +- pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); +- +- rc = target_depend_item(&se_dev->dev_group.cg_item); ++ rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); + if (rc != 0) { +- pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n", +- rc, se_dev); +- return rc; ++ pr_debug("XCOPY: skip non-matching: %*ph\n", ++ XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn); ++ return 0; + } ++ pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); + +- pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n", +- se_dev, &se_dev->dev_group); + return 1; + } + +-static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn, +- struct se_device **found_dev) ++static int target_xcopy_locate_se_dev_e4(struct se_session *sess, ++ const unsigned char *dev_wwn, ++ struct se_device **_found_dev, ++ struct percpu_ref **_found_lun_ref) + { +- struct xcopy_dev_search_info info; +- int ret; +- +- memset(&info, 0, sizeof(info)); +- info.dev_wwn = dev_wwn; +- +- ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info); +- if (ret == 1) { +- *found_dev = info.found_dev; +- return 0; +- } else { +- pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); +- return -EINVAL; ++ struct se_dev_entry *deve; ++ struct se_node_acl *nacl; ++ struct se_lun *this_lun = NULL; ++ struct se_device *found_dev = NULL; ++ ++ /* cmd with NULL sess indicates no associated $FABRIC_MOD */ ++ if (!sess) ++ goto err_out; ++ ++ pr_debug("XCOPY 0xe4: searching for: %*ph\n", ++ XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn); ++ ++ nacl = sess->se_node_acl; ++ rcu_read_lock(); ++ hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) { ++ struct se_device *this_dev; ++ int rc; ++ ++ this_lun = rcu_dereference(deve->se_lun); ++ this_dev = rcu_dereference_raw(this_lun->lun_se_dev); ++ ++ rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn); ++ if (rc) { ++ if (percpu_ref_tryget_live(&this_lun->lun_ref)) ++ found_dev = this_dev; ++ break; ++ } + } ++ rcu_read_unlock(); ++ if (found_dev == NULL) ++ goto err_out; ++ ++ pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n", ++ found_dev, &found_dev->dev_group); ++ *_found_dev = found_dev; ++ *_found_lun_ref = &this_lun->lun_ref; ++ return 0; ++err_out: ++ pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); ++ return -EINVAL; + } + + static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop, +@@ -255,12 +278,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd, + + switch (xop->op_origin) { + case XCOL_SOURCE_RECV_OP: +- rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn, +- &xop->dst_dev); ++ rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, ++ xop->dst_tid_wwn, ++ &xop->dst_dev, ++ &xop->remote_lun_ref); + break; + case XCOL_DEST_RECV_OP: +- rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn, +- &xop->src_dev); ++ rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, ++ xop->src_tid_wwn, ++ &xop->src_dev, ++ &xop->remote_lun_ref); + break; + default: + pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - " +@@ -412,18 +439,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd) + + static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop) + { +- struct se_device *remote_dev; +- + if (xop->op_origin == XCOL_SOURCE_RECV_OP) +- remote_dev = xop->dst_dev; ++ pr_debug("putting dst lun_ref for %p\n", xop->dst_dev); + else +- remote_dev = xop->src_dev; +- +- pr_debug("Calling configfs_undepend_item for" +- " remote_dev: %p remote_dev->dev_group: %p\n", +- remote_dev, &remote_dev->dev_group.cg_item); ++ pr_debug("putting src lun_ref for %p\n", xop->src_dev); + +- target_undepend_item(&remote_dev->dev_group.cg_item); ++ percpu_ref_put(xop->remote_lun_ref); + } + + static void xcopy_pt_release_cmd(struct se_cmd *se_cmd) +diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h +index 26ba4c3c9cffd..974bc1e19ff2b 100644 +--- a/drivers/target/target_core_xcopy.h ++++ b/drivers/target/target_core_xcopy.h +@@ -29,6 +29,7 @@ struct xcopy_op { + struct se_device *dst_dev; + unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; + unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; ++ struct percpu_ref *remote_lun_ref; + + sector_t src_lba; + sector_t dst_lba; +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 7335dc8552180..af420ec2a9f41 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -128,9 +128,13 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev) + misc_pdev = of_find_device_by_node(args.np); + of_node_put(args.np); + +- if (!misc_pdev || !platform_get_drvdata(misc_pdev)) ++ if (!misc_pdev) + return ERR_PTR(-EPROBE_DEFER); + ++ if (!platform_get_drvdata(misc_pdev)) { ++ put_device(&misc_pdev->dev); ++ return ERR_PTR(-EPROBE_DEFER); ++ } + data->dev = &misc_pdev->dev; + + if (of_find_property(np, "disable-over-current", NULL)) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index e0d8da4e3967b..e847d0de67607 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1939,6 +1939,10 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x04d8, 0x0083), /* Bootloader mode */ + .driver_info = IGNORE_DEVICE, + }, ++ ++ { USB_DEVICE(0x04d8, 0xf58b), ++ .driver_info = IGNORE_DEVICE, ++ }, + #endif + + /*Samsung phone in firmware update mode */ +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 55ad4c43b3804..ae69635bb1fb5 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -465,13 +465,23 @@ static int service_outstanding_interrupt(struct wdm_device *desc) + if (!desc->resp_count || !--desc->resp_count) + goto out; + ++ if (test_bit(WDM_DISCONNECTING, &desc->flags)) { ++ rv = -ENODEV; ++ goto out; ++ } ++ if (test_bit(WDM_RESETTING, &desc->flags)) { ++ rv = -EIO; ++ goto out; ++ } ++ + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); + rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); + if (rv) { +- dev_err(&desc->intf->dev, +- "usb_submit_urb failed with result %d\n", rv); ++ if (!test_bit(WDM_DISCONNECTING, &desc->flags)) ++ dev_err(&desc->intf->dev, ++ "usb_submit_urb failed with result %d\n", rv); + + /* make sure the next notification trigger a submit */ + clear_bit(WDM_RESPONDING, &desc->flags); +@@ -1026,9 +1036,9 @@ static void wdm_disconnect(struct usb_interface *intf) + wake_up_all(&desc->wait); + mutex_lock(&desc->rlock); + mutex_lock(&desc->wlock); +- kill_urbs(desc); + cancel_work_sync(&desc->rxwork); + cancel_work_sync(&desc->service_outs_intr); ++ kill_urbs(desc); + mutex_unlock(&desc->wlock); + mutex_unlock(&desc->rlock); + +diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c +index db36a796af8c3..5c00d79ac7a10 100644 +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -274,8 +274,25 @@ static int usblp_ctrl_msg(struct usblp *usblp, int request, int type, int dir, i + #define usblp_reset(usblp)\ + usblp_ctrl_msg(usblp, USBLP_REQ_RESET, USB_TYPE_CLASS, USB_DIR_OUT, USB_RECIP_OTHER, 0, NULL, 0) + +-#define usblp_hp_channel_change_request(usblp, channel, buffer) \ +- usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST, USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE, channel, buffer, 1) ++static int usblp_hp_channel_change_request(struct usblp *usblp, int channel, u8 *new_channel) ++{ ++ u8 *buf; ++ int ret; ++ ++ buf = kzalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ ret = usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST, ++ USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE, ++ channel, buf, 1); ++ if (ret == 0) ++ *new_channel = buf[0]; ++ ++ kfree(buf); ++ ++ return ret; ++} + + /* + * See the description for usblp_select_alts() below for the usage +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index d6968b90ee6bb..55ee41283f395 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -272,6 +272,7 @@ + + /* Global USB2 PHY Vendor Control Register */ + #define DWC3_GUSB2PHYACC_NEWREGREQ BIT(25) ++#define DWC3_GUSB2PHYACC_DONE BIT(24) + #define DWC3_GUSB2PHYACC_BUSY BIT(23) + #define DWC3_GUSB2PHYACC_WRITE BIT(22) + #define DWC3_GUSB2PHYACC_ADDR(n) (n << 16) +diff --git a/drivers/usb/dwc3/ulpi.c b/drivers/usb/dwc3/ulpi.c +index f62b5f3c2d67d..bb8271531da70 100644 +--- a/drivers/usb/dwc3/ulpi.c ++++ b/drivers/usb/dwc3/ulpi.c +@@ -24,7 +24,7 @@ static int dwc3_ulpi_busyloop(struct dwc3 *dwc) + + while (count--) { + reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0)); +- if (!(reg & DWC3_GUSB2PHYACC_BUSY)) ++ if (reg & DWC3_GUSB2PHYACC_DONE) + return 0; + cpu_relax(); + } +diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig +index 31cce7805eb2e..c6afc42429628 100644 +--- a/drivers/usb/gadget/Kconfig ++++ b/drivers/usb/gadget/Kconfig +@@ -264,6 +264,7 @@ config USB_CONFIGFS_NCM + depends on NET + select USB_U_ETHER + select USB_F_NCM ++ select CRC32 + help + NCM is an advanced protocol for Ethernet encapsulation, allows + grouping of several ethernet frames into one USB transfer and +@@ -313,6 +314,7 @@ config USB_CONFIGFS_EEM + depends on NET + select USB_U_ETHER + select USB_F_EEM ++ select CRC32 + help + CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM + and therefore can be supported by more hardware. Technically ECM and +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 40b3ed93596ad..4cfcc73f39790 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -392,8 +392,11 @@ int usb_function_deactivate(struct usb_function *function) + + spin_lock_irqsave(&cdev->lock, flags); + +- if (cdev->deactivations == 0) ++ if (cdev->deactivations == 0) { ++ spin_unlock_irqrestore(&cdev->lock, flags); + status = usb_gadget_deactivate(cdev->gadget); ++ spin_lock_irqsave(&cdev->lock, flags); ++ } + if (status == 0) + cdev->deactivations++; + +@@ -424,8 +427,11 @@ int usb_function_activate(struct usb_function *function) + status = -EINVAL; + else { + cdev->deactivations--; +- if (cdev->deactivations == 0) ++ if (cdev->deactivations == 0) { ++ spin_unlock_irqrestore(&cdev->lock, flags); + status = usb_gadget_activate(cdev->gadget); ++ spin_lock_irqsave(&cdev->lock, flags); ++ } + } + + spin_unlock_irqrestore(&cdev->lock, flags); +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index a7709d126b29b..5b8b2ca4376cb 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -233,9 +233,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item, + + static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page) + { +- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name; ++ struct gadget_info *gi = to_gadget_info(item); ++ char *udc_name; ++ int ret; ++ ++ mutex_lock(&gi->lock); ++ udc_name = gi->composite.gadget_driver.udc_name; ++ ret = sprintf(page, "%s\n", udc_name ?: ""); ++ mutex_unlock(&gi->lock); + +- return sprintf(page, "%s\n", udc_name ?: ""); ++ return ret; + } + + static int unregister_gadget(struct gadget_info *gi) +@@ -1217,9 +1224,9 @@ static void purge_configs_funcs(struct gadget_info *gi) + + cfg = container_of(c, struct config_usb_cfg, c); + +- list_for_each_entry_safe(f, tmp, &c->functions, list) { ++ list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) { + +- list_move_tail(&f->list, &cfg->func_list); ++ list_move(&f->list, &cfg->func_list); + if (f->unbind) { + dev_dbg(&gi->cdev.gadget->dev, + "unbind function '%s'/%p\n", +@@ -1505,7 +1512,7 @@ static const struct usb_gadget_driver configfs_driver_template = { + .suspend = configfs_composite_suspend, + .resume = configfs_composite_resume, + +- .max_speed = USB_SPEED_SUPER, ++ .max_speed = USB_SPEED_SUPER_PLUS, + .driver = { + .owner = THIS_MODULE, + .name = "configfs-gadget", +@@ -1545,7 +1552,7 @@ static struct config_group *gadgets_make( + gi->composite.unbind = configfs_do_nothing; + gi->composite.suspend = NULL; + gi->composite.resume = NULL; +- gi->composite.max_speed = USB_SPEED_SUPER; ++ gi->composite.max_speed = USB_SPEED_SUPER_PLUS; + + spin_lock_init(&gi->spinlock); + mutex_init(&gi->lock); +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index 8ed1295d7e350..0f47cd398d60a 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -1126,6 +1126,7 @@ fail_tx_reqs: + printer_req_free(dev->in_ep, req); + } + ++ usb_free_all_descriptors(f); + return ret; + + } +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index d582921f7257d..425981ab7a4dc 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -275,7 +275,7 @@ static struct usb_endpoint_descriptor fs_epout_desc = { + + .bEndpointAddress = USB_DIR_OUT, + .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC, +- .wMaxPacketSize = cpu_to_le16(1023), ++ /* .wMaxPacketSize = DYNAMIC */ + .bInterval = 1, + }; + +@@ -284,7 +284,7 @@ static struct usb_endpoint_descriptor hs_epout_desc = { + .bDescriptorType = USB_DT_ENDPOINT, + + .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC, +- .wMaxPacketSize = cpu_to_le16(1024), ++ /* .wMaxPacketSize = DYNAMIC */ + .bInterval = 4, + }; + +@@ -352,7 +352,7 @@ static struct usb_endpoint_descriptor fs_epin_desc = { + + .bEndpointAddress = USB_DIR_IN, + .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC, +- .wMaxPacketSize = cpu_to_le16(1023), ++ /* .wMaxPacketSize = DYNAMIC */ + .bInterval = 1, + }; + +@@ -361,7 +361,7 @@ static struct usb_endpoint_descriptor hs_epin_desc = { + .bDescriptorType = USB_DT_ENDPOINT, + + .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC, +- .wMaxPacketSize = cpu_to_le16(1024), ++ /* .wMaxPacketSize = DYNAMIC */ + .bInterval = 4, + }; + +@@ -448,12 +448,28 @@ struct cntrl_range_lay3 { + __le32 dRES; + } __packed; + +-static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, ++static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, + struct usb_endpoint_descriptor *ep_desc, +- unsigned int factor, bool is_playback) ++ enum usb_device_speed speed, bool is_playback) + { + int chmask, srate, ssize; +- u16 max_packet_size; ++ u16 max_size_bw, max_size_ep; ++ unsigned int factor; ++ ++ switch (speed) { ++ case USB_SPEED_FULL: ++ max_size_ep = 1023; ++ factor = 1000; ++ break; ++ ++ case USB_SPEED_HIGH: ++ max_size_ep = 1024; ++ factor = 8000; ++ break; ++ ++ default: ++ return -EINVAL; ++ } + + if (is_playback) { + chmask = uac2_opts->p_chmask; +@@ -465,10 +481,12 @@ static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, + ssize = uac2_opts->c_ssize; + } + +- max_packet_size = num_channels(chmask) * ssize * ++ max_size_bw = num_channels(chmask) * ssize * + DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1))); +- ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_packet_size, +- le16_to_cpu(ep_desc->wMaxPacketSize))); ++ ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw, ++ max_size_ep)); ++ ++ return 0; + } + + static int +@@ -551,10 +569,33 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + uac2->as_in_alt = 0; + + /* Calculate wMaxPacketSize according to audio bandwidth */ +- set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true); +- set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false); +- set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true); +- set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false); ++ ret = set_ep_max_packet_size(uac2_opts, &fs_epin_desc, USB_SPEED_FULL, ++ true); ++ if (ret < 0) { ++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); ++ return ret; ++ } ++ ++ ret = set_ep_max_packet_size(uac2_opts, &fs_epout_desc, USB_SPEED_FULL, ++ false); ++ if (ret < 0) { ++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); ++ return ret; ++ } ++ ++ ret = set_ep_max_packet_size(uac2_opts, &hs_epin_desc, USB_SPEED_HIGH, ++ true); ++ if (ret < 0) { ++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); ++ return ret; ++ } ++ ++ ret = set_ep_max_packet_size(uac2_opts, &hs_epout_desc, USB_SPEED_HIGH, ++ false); ++ if (ret < 0) { ++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); ++ return ret; ++ } + + agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc); + if (!agdev->out_ep) { +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index 39ebc1b03698b..156651df6b4da 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -45,9 +45,10 @@ + #define UETH__VERSION "29-May-2008" + + /* Experiments show that both Linux and Windows hosts allow up to 16k +- * frame sizes. Set the max size to 15k+52 to prevent allocating 32k ++ * frame sizes. Set the max MTU size to 15k+52 to prevent allocating 32k + * blocks and still have efficient handling. */ +-#define GETHER_MAX_ETH_FRAME_LEN 15412 ++#define GETHER_MAX_MTU_SIZE 15412 ++#define GETHER_MAX_ETH_FRAME_LEN (GETHER_MAX_MTU_SIZE + ETH_HLEN) + + struct eth_dev { + /* lock is held while accessing port_usb +@@ -786,7 +787,7 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, + + /* MTU range: 14 - 15412 */ + net->min_mtu = ETH_HLEN; +- net->max_mtu = GETHER_MAX_ETH_FRAME_LEN; ++ net->max_mtu = GETHER_MAX_MTU_SIZE; + + dev->gadget = g; + SET_NETDEV_DEV(net, &g->dev); +@@ -848,7 +849,7 @@ struct net_device *gether_setup_name_default(const char *netname) + + /* MTU range: 14 - 15412 */ + net->min_mtu = ETH_HLEN; +- net->max_mtu = GETHER_MAX_ETH_FRAME_LEN; ++ net->max_mtu = GETHER_MAX_MTU_SIZE; + + return net; + } +diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c +index af16672d51187..6680dcfe660ea 100644 +--- a/drivers/usb/gadget/legacy/acm_ms.c ++++ b/drivers/usb/gadget/legacy/acm_ms.c +@@ -203,8 +203,10 @@ static int acm_ms_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail_string_ids; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 0348ea899d062..a753221c2268e 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4558,19 +4558,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, + { + unsigned long long timeout_ns; + ++ if (xhci->quirks & XHCI_INTEL_HOST) ++ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); ++ else ++ timeout_ns = udev->u1_params.sel; ++ + /* Prevent U1 if service interval is shorter than U1 exit latency */ + if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { +- if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) { ++ if (xhci_service_interval_to_ns(desc) <= timeout_ns) { + dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n"); + return USB3_LPM_DISABLED; + } + } + +- if (xhci->quirks & XHCI_INTEL_HOST) +- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); +- else +- timeout_ns = udev->u1_params.sel; +- + /* The U1 timeout is encoded in 1us intervals. + * Don't return a timeout of zero, because that's USB3_LPM_DISABLED. + */ +@@ -4622,19 +4622,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, + { + unsigned long long timeout_ns; + ++ if (xhci->quirks & XHCI_INTEL_HOST) ++ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); ++ else ++ timeout_ns = udev->u2_params.sel; ++ + /* Prevent U2 if service interval is shorter than U2 exit latency */ + if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { +- if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) { ++ if (xhci_service_interval_to_ns(desc) <= timeout_ns) { + dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n"); + return USB3_LPM_DISABLED; + } + } + +- if (xhci->quirks & XHCI_INTEL_HOST) +- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); +- else +- timeout_ns = udev->u2_params.sel; +- + /* The U2 timeout is encoded in 256us intervals */ + timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000); + /* If the necessary timeout value is bigger than what we can set in the +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 785080f790738..08b72bb22b7ef 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -497,6 +497,9 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); + finish_wait(&dev->waitq, &wait); + ++ /* make sure URB is idle after timeout or (spurious) CMD_ACK */ ++ usb_kill_urb(dev->cntl_urb); ++ + mutex_unlock(&dev->io_mutex); + + if (retval < 0) { +diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c +index 734f18d0a7f73..6dc93652afc18 100644 +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -536,23 +536,29 @@ static int iuu_uart_flush(struct usb_serial_port *port) + struct device *dev = &port->dev; + int i; + int status; +- u8 rxcmd = IUU_UART_RX; ++ u8 *rxcmd; + struct iuu_private *priv = usb_get_serial_port_data(port); + + if (iuu_led(port, 0xF000, 0, 0, 0xFF) < 0) + return -EIO; + ++ rxcmd = kmalloc(1, GFP_KERNEL); ++ if (!rxcmd) ++ return -ENOMEM; ++ ++ rxcmd[0] = IUU_UART_RX; ++ + for (i = 0; i < 2; i++) { +- status = bulk_immediate(port, &rxcmd, 1); ++ status = bulk_immediate(port, rxcmd, 1); + if (status != IUU_OPERATION_OK) { + dev_dbg(dev, "%s - uart_flush_write error\n", __func__); +- return status; ++ goto out_free; + } + + status = read_immediate(port, &priv->len, 1); + if (status != IUU_OPERATION_OK) { + dev_dbg(dev, "%s - uart_flush_read error\n", __func__); +- return status; ++ goto out_free; + } + + if (priv->len > 0) { +@@ -560,12 +566,16 @@ static int iuu_uart_flush(struct usb_serial_port *port) + status = read_immediate(port, priv->buf, priv->len); + if (status != IUU_OPERATION_OK) { + dev_dbg(dev, "%s - uart_flush_read error\n", __func__); +- return status; ++ goto out_free; + } + } + } + dev_dbg(dev, "%s - uart_flush_read OK!\n", __func__); + iuu_led(port, 0, 0xF000, 0, 0xFF); ++ ++out_free: ++ kfree(rxcmd); ++ + return status; + } + +diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c +index e7a2aa1747db1..766969cf72b2d 100644 +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -555,10 +555,8 @@ exit: + static void keyspan_pda_write_bulk_callback(struct urb *urb) + { + struct usb_serial_port *port = urb->context; +- struct keyspan_pda_private *priv; + + set_bit(0, &port->write_urbs_free); +- priv = usb_get_serial_port_data(port); + + /* queue up a wakeup at scheduler time */ + usb_serial_port_softint(port); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 6fd6012ad7b3a..1024aca252210 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1117,6 +1117,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) }, /* EM160R-GL */ ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), +@@ -2057,6 +2059,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 749c69be091cc..cb7b15ecb7aba 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -90,6 +90,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA), + ++/* Reported-by: Thinh Nguyen <[email protected]> */ ++UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999, ++ "PNY", ++ "Pro Elite SSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* Reported-by: Thinh Nguyen <[email protected]> */ + UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, + "PNY", +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index d5a036bf904bc..0909cfcbf7205 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -396,6 +396,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + default: + usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n", + wValue); ++ if (wValue >= 32) ++ goto error; + vhci_hcd->port_status[rhport] &= ~(1 << wValue); + break; + } +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 88c8c158ec25c..0c7bbc92b22a9 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -613,6 +613,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) + size_t len, total_len = 0; + int err; + struct vhost_net_ubuf_ref *uninitialized_var(ubufs); ++ struct ubuf_info *ubuf; + bool zcopy_used; + int sent_pkts = 0; + +@@ -645,9 +646,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) + + /* use msg_control to pass vhost zerocopy ubuf info to skb */ + if (zcopy_used) { +- struct ubuf_info *ubuf; + ubuf = nvq->ubuf_info + nvq->upend_idx; +- + vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); + vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; + ubuf->callback = vhost_zerocopy_callback; +@@ -675,7 +674,8 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock) + err = sock->ops->sendmsg(sock, &msg, len); + if (unlikely(err < 0)) { + if (zcopy_used) { +- vhost_net_ubuf_put(ubufs); ++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS) ++ vhost_net_ubuf_put(ubufs); + nvq->upend_idx = ((unsigned)nvq->upend_idx - 1) + % UIO_MAXIOV; + } +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 56e70f12c9960..c907f96d6890c 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -713,11 +713,9 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + } + + /* +- * Map the VRAM cacheable for performance. This is also required for +- * VM Connect to display properly for ARM64 Linux VM, as the host also +- * maps the VRAM cacheable. ++ * Map the VRAM cacheable for performance. + */ +- fb_virt = ioremap_cache(par->mem->start, screen_fb_size); ++ fb_virt = ioremap_wc(par->mem->start, screen_fb_size); + if (!fb_virt) + goto err2; + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index ed61c0daef416..128398dde0816 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -238,6 +238,7 @@ struct waiting_dir_move { + * after this directory is moved, we can try to rmdir the ino rmdir_ino. + */ + u64 rmdir_ino; ++ u64 rmdir_gen; + bool orphanized; + }; + +@@ -308,7 +309,7 @@ static int is_waiting_for_move(struct send_ctx *sctx, u64 ino); + static struct waiting_dir_move * + get_waiting_dir_move(struct send_ctx *sctx, u64 ino); + +-static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino); ++static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino, u64 gen); + + static int need_send_hole(struct send_ctx *sctx) + { +@@ -2304,7 +2305,7 @@ static int get_cur_path(struct send_ctx *sctx, u64 ino, u64 gen, + + fs_path_reset(name); + +- if (is_waiting_for_rm(sctx, ino)) { ++ if (is_waiting_for_rm(sctx, ino, gen)) { + ret = gen_unique_name(sctx, ino, gen, name); + if (ret < 0) + goto out; +@@ -2863,8 +2864,8 @@ out: + return ret; + } + +-static struct orphan_dir_info * +-add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino) ++static struct orphan_dir_info *add_orphan_dir_info(struct send_ctx *sctx, ++ u64 dir_ino, u64 dir_gen) + { + struct rb_node **p = &sctx->orphan_dirs.rb_node; + struct rb_node *parent = NULL; +@@ -2873,20 +2874,23 @@ add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino) + while (*p) { + parent = *p; + entry = rb_entry(parent, struct orphan_dir_info, node); +- if (dir_ino < entry->ino) { ++ if (dir_ino < entry->ino) + p = &(*p)->rb_left; +- } else if (dir_ino > entry->ino) { ++ else if (dir_ino > entry->ino) + p = &(*p)->rb_right; +- } else { ++ else if (dir_gen < entry->gen) ++ p = &(*p)->rb_left; ++ else if (dir_gen > entry->gen) ++ p = &(*p)->rb_right; ++ else + return entry; +- } + } + + odi = kmalloc(sizeof(*odi), GFP_KERNEL); + if (!odi) + return ERR_PTR(-ENOMEM); + odi->ino = dir_ino; +- odi->gen = 0; ++ odi->gen = dir_gen; + odi->last_dir_index_offset = 0; + + rb_link_node(&odi->node, parent, p); +@@ -2894,8 +2898,8 @@ add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino) + return odi; + } + +-static struct orphan_dir_info * +-get_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino) ++static struct orphan_dir_info *get_orphan_dir_info(struct send_ctx *sctx, ++ u64 dir_ino, u64 gen) + { + struct rb_node *n = sctx->orphan_dirs.rb_node; + struct orphan_dir_info *entry; +@@ -2906,15 +2910,19 @@ get_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino) + n = n->rb_left; + else if (dir_ino > entry->ino) + n = n->rb_right; ++ else if (gen < entry->gen) ++ n = n->rb_left; ++ else if (gen > entry->gen) ++ n = n->rb_right; + else + return entry; + } + return NULL; + } + +-static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino) ++static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino, u64 gen) + { +- struct orphan_dir_info *odi = get_orphan_dir_info(sctx, dir_ino); ++ struct orphan_dir_info *odi = get_orphan_dir_info(sctx, dir_ino, gen); + + return odi != NULL; + } +@@ -2959,7 +2967,7 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen, + key.type = BTRFS_DIR_INDEX_KEY; + key.offset = 0; + +- odi = get_orphan_dir_info(sctx, dir); ++ odi = get_orphan_dir_info(sctx, dir, dir_gen); + if (odi) + key.offset = odi->last_dir_index_offset; + +@@ -2990,7 +2998,7 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen, + + dm = get_waiting_dir_move(sctx, loc.objectid); + if (dm) { +- odi = add_orphan_dir_info(sctx, dir); ++ odi = add_orphan_dir_info(sctx, dir, dir_gen); + if (IS_ERR(odi)) { + ret = PTR_ERR(odi); + goto out; +@@ -2998,12 +3006,13 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen, + odi->gen = dir_gen; + odi->last_dir_index_offset = found_key.offset; + dm->rmdir_ino = dir; ++ dm->rmdir_gen = dir_gen; + ret = 0; + goto out; + } + + if (loc.objectid > send_progress) { +- odi = add_orphan_dir_info(sctx, dir); ++ odi = add_orphan_dir_info(sctx, dir, dir_gen); + if (IS_ERR(odi)) { + ret = PTR_ERR(odi); + goto out; +@@ -3043,6 +3052,7 @@ static int add_waiting_dir_move(struct send_ctx *sctx, u64 ino, bool orphanized) + return -ENOMEM; + dm->ino = ino; + dm->rmdir_ino = 0; ++ dm->rmdir_gen = 0; + dm->orphanized = orphanized; + + while (*p) { +@@ -3188,7 +3198,7 @@ static int path_loop(struct send_ctx *sctx, struct fs_path *name, + while (ino != BTRFS_FIRST_FREE_OBJECTID) { + fs_path_reset(name); + +- if (is_waiting_for_rm(sctx, ino)) ++ if (is_waiting_for_rm(sctx, ino, gen)) + break; + if (is_waiting_for_move(sctx, ino)) { + if (*ancestor_ino == 0) +@@ -3228,6 +3238,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm) + u64 parent_ino, parent_gen; + struct waiting_dir_move *dm = NULL; + u64 rmdir_ino = 0; ++ u64 rmdir_gen; + u64 ancestor; + bool is_orphan; + int ret; +@@ -3242,6 +3253,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm) + dm = get_waiting_dir_move(sctx, pm->ino); + ASSERT(dm); + rmdir_ino = dm->rmdir_ino; ++ rmdir_gen = dm->rmdir_gen; + is_orphan = dm->orphanized; + free_waiting_dir_move(sctx, dm); + +@@ -3278,6 +3290,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm) + dm = get_waiting_dir_move(sctx, pm->ino); + ASSERT(dm); + dm->rmdir_ino = rmdir_ino; ++ dm->rmdir_gen = rmdir_gen; + } + goto out; + } +@@ -3296,7 +3309,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm) + struct orphan_dir_info *odi; + u64 gen; + +- odi = get_orphan_dir_info(sctx, rmdir_ino); ++ odi = get_orphan_dir_info(sctx, rmdir_ino, rmdir_gen); + if (!odi) { + /* already deleted */ + goto finish; +diff --git a/fs/proc/generic.c b/fs/proc/generic.c +index e39bac94dead0..bab10368a04d8 100644 +--- a/fs/proc/generic.c ++++ b/fs/proc/generic.c +@@ -137,8 +137,12 @@ static int proc_getattr(const struct path *path, struct kstat *stat, + { + struct inode *inode = d_inode(path->dentry); + struct proc_dir_entry *de = PDE(inode); +- if (de && de->nlink) +- set_nlink(inode, de->nlink); ++ if (de) { ++ nlink_t nlink = READ_ONCE(de->nlink); ++ if (nlink > 0) { ++ set_nlink(inode, nlink); ++ } ++ } + + generic_fillattr(inode, stat); + return 0; +@@ -337,6 +341,16 @@ static const struct file_operations proc_dir_operations = { + .iterate_shared = proc_readdir, + }; + ++static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags) ++{ ++ return 0; ++} ++ ++const struct dentry_operations proc_net_dentry_ops = { ++ .d_revalidate = proc_net_d_revalidate, ++ .d_delete = always_delete_dentry, ++}; ++ + /* + * proc directories can do almost nothing.. + */ +@@ -361,6 +375,7 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, + write_unlock(&proc_subdir_lock); + goto out_free_inum; + } ++ dir->nlink++; + write_unlock(&proc_subdir_lock); + + return dp; +@@ -458,8 +473,8 @@ struct proc_dir_entry *proc_symlink(const char *name, + } + EXPORT_SYMBOL(proc_symlink); + +-struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode, +- struct proc_dir_entry *parent, void *data) ++struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode, ++ struct proc_dir_entry *parent, void *data, bool force_lookup) + { + struct proc_dir_entry *ent; + +@@ -471,13 +486,20 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode, + ent->data = data; + ent->proc_fops = &proc_dir_operations; + ent->proc_iops = &proc_dir_inode_operations; +- parent->nlink++; ++ if (force_lookup) { ++ pde_force_lookup(ent); ++ } + ent = proc_register(parent, ent); +- if (!ent) +- parent->nlink--; + } + return ent; + } ++EXPORT_SYMBOL_GPL(_proc_mkdir); ++ ++struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode, ++ struct proc_dir_entry *parent, void *data) ++{ ++ return _proc_mkdir(name, mode, parent, data, false); ++} + EXPORT_SYMBOL_GPL(proc_mkdir_data); + + struct proc_dir_entry *proc_mkdir_mode(const char *name, umode_t mode, +@@ -504,10 +526,7 @@ struct proc_dir_entry *proc_create_mount_point(const char *name) + ent->data = NULL; + ent->proc_fops = NULL; + ent->proc_iops = NULL; +- parent->nlink++; + ent = proc_register(parent, ent); +- if (!ent) +- parent->nlink--; + } + return ent; + } +@@ -665,8 +684,12 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) + len = strlen(fn); + + de = pde_subdir_find(parent, fn, len); +- if (de) ++ if (de) { + rb_erase(&de->subdir_node, &parent->subdir); ++ if (S_ISDIR(de->mode)) { ++ parent->nlink--; ++ } ++ } + write_unlock(&proc_subdir_lock); + if (!de) { + WARN(1, "name '%s'\n", name); +@@ -675,9 +698,6 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) + + proc_entry_rundown(de); + +- if (S_ISDIR(de->mode)) +- parent->nlink--; +- de->nlink = 0; + WARN(pde_subdir_first(de), + "%s: removing non-empty directory '%s/%s', leaking at least '%s'\n", + __func__, de->parent->name, de->name, pde_subdir_first(de)->name); +@@ -713,13 +733,12 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) + de = next; + continue; + } +- write_unlock(&proc_subdir_lock); +- +- proc_entry_rundown(de); + next = de->parent; + if (S_ISDIR(de->mode)) + next->nlink--; +- de->nlink = 0; ++ write_unlock(&proc_subdir_lock); ++ ++ proc_entry_rundown(de); + if (de == root) + break; + pde_put(de); +diff --git a/fs/proc/internal.h b/fs/proc/internal.h +index 95b14196f2842..4f14906ef16b5 100644 +--- a/fs/proc/internal.h ++++ b/fs/proc/internal.h +@@ -305,3 +305,10 @@ extern unsigned long task_statm(struct mm_struct *, + unsigned long *, unsigned long *, + unsigned long *, unsigned long *); + extern void task_mem(struct seq_file *, struct mm_struct *); ++ ++extern const struct dentry_operations proc_net_dentry_ops; ++static inline void pde_force_lookup(struct proc_dir_entry *pde) ++{ ++ /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */ ++ pde->proc_dops = &proc_net_dentry_ops; ++} +diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c +index a7b12435519e0..096bcc1e7a8a5 100644 +--- a/fs/proc/proc_net.c ++++ b/fs/proc/proc_net.c +@@ -38,22 +38,6 @@ static struct net *get_proc_net(const struct inode *inode) + return maybe_get_net(PDE_NET(PDE(inode))); + } + +-static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags) +-{ +- return 0; +-} +- +-static const struct dentry_operations proc_net_dentry_ops = { +- .d_revalidate = proc_net_d_revalidate, +- .d_delete = always_delete_dentry, +-}; +- +-static void pde_force_lookup(struct proc_dir_entry *pde) +-{ +- /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */ +- pde->proc_dops = &proc_net_dentry_ops; +-} +- + static int seq_open_net(struct inode *inode, struct file *file) + { + unsigned int state_size = PDE(inode)->state_size; +diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h +index d0e1f1522a78e..5141657a0f7f6 100644 +--- a/include/linux/proc_fs.h ++++ b/include/linux/proc_fs.h +@@ -21,6 +21,7 @@ extern void proc_flush_task(struct task_struct *); + + extern struct proc_dir_entry *proc_symlink(const char *, + struct proc_dir_entry *, const char *); ++struct proc_dir_entry *_proc_mkdir(const char *, umode_t, struct proc_dir_entry *, void *, bool); + extern struct proc_dir_entry *proc_mkdir(const char *, struct proc_dir_entry *); + extern struct proc_dir_entry *proc_mkdir_data(const char *, umode_t, + struct proc_dir_entry *, void *); +@@ -89,6 +90,11 @@ static inline struct proc_dir_entry *proc_symlink(const char *name, + static inline struct proc_dir_entry *proc_mkdir(const char *name, + struct proc_dir_entry *parent) {return NULL;} + static inline struct proc_dir_entry *proc_create_mount_point(const char *name) { return NULL; } ++static inline struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode, ++ struct proc_dir_entry *parent, void *data, bool force_lookup) ++{ ++ return NULL; ++} + static inline struct proc_dir_entry *proc_mkdir_data(const char *name, + umode_t mode, struct proc_dir_entry *parent, void *data) { return NULL; } + static inline struct proc_dir_entry *proc_mkdir_mode(const char *name, +@@ -121,7 +127,7 @@ struct net; + static inline struct proc_dir_entry *proc_net_mkdir( + struct net *net, const char *name, struct proc_dir_entry *parent) + { +- return proc_mkdir_data(name, 0, parent, net); ++ return _proc_mkdir(name, 0, parent, net, true); + } + + struct ns_common; +diff --git a/include/net/red.h b/include/net/red.h +index 9665582c4687e..e21e7fd4fe077 100644 +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,12 +168,14 @@ static inline void red_set_vars(struct red_vars *v) + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) + { + if (fls(qth_min) + Wlog > 32) + return false; + if (fls(qth_max) + Wlog > 32) + return false; ++ if (Scell_log >= 32) ++ return false; + if (qth_max < qth_min) + return false; + return true; +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index eef77c82d2e19..cd98ef48345e1 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3554,17 +3554,24 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) + * is updated and visible. + */ + if (!freezable || !workqueue_freezing) { ++ bool kick = false; ++ + pwq->max_active = wq->saved_max_active; + + while (!list_empty(&pwq->delayed_works) && +- pwq->nr_active < pwq->max_active) ++ pwq->nr_active < pwq->max_active) { + pwq_activate_first_delayed(pwq); ++ kick = true; ++ } + + /* + * Need to kick a worker after thawed or an unbound wq's +- * max_active is bumped. It's a slow path. Do it always. ++ * max_active is bumped. In realtime scenarios, always kicking a ++ * worker will cause interference on the isolated cpu cores, so ++ * let's kick iff work items were activated. + */ +- wake_up_worker(pwq->pool); ++ if (kick) ++ wake_up_worker(pwq->pool); + } else { + pwq->max_active = 0; + } +diff --git a/lib/genalloc.c b/lib/genalloc.c +index 7e85d1e37a6ea..0b8ee173cf3a6 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -83,14 +83,14 @@ static int clear_bits_ll(unsigned long *addr, unsigned long mask_to_clear) + * users set the same bit, one user will return remain bits, otherwise + * return 0. + */ +-static int bitmap_set_ll(unsigned long *map, int start, int nr) ++static int bitmap_set_ll(unsigned long *map, unsigned long start, unsigned long nr) + { + unsigned long *p = map + BIT_WORD(start); +- const int size = start + nr; ++ const unsigned long size = start + nr; + int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG); + unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start); + +- while (nr - bits_to_set >= 0) { ++ while (nr >= bits_to_set) { + if (set_bits_ll(p, mask_to_set)) + return nr; + nr -= bits_to_set; +@@ -118,14 +118,15 @@ static int bitmap_set_ll(unsigned long *map, int start, int nr) + * users clear the same bit, one user will return remain bits, + * otherwise return 0. + */ +-static int bitmap_clear_ll(unsigned long *map, int start, int nr) ++static unsigned long ++bitmap_clear_ll(unsigned long *map, unsigned long start, unsigned long nr) + { + unsigned long *p = map + BIT_WORD(start); +- const int size = start + nr; ++ const unsigned long size = start + nr; + int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG); + unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start); + +- while (nr - bits_to_clear >= 0) { ++ while (nr >= bits_to_clear) { + if (clear_bits_ll(p, mask_to_clear)) + return nr; + nr -= bits_to_clear; +@@ -184,8 +185,8 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + size_t size, int nid) + { + struct gen_pool_chunk *chunk; +- int nbits = size >> pool->min_alloc_order; +- int nbytes = sizeof(struct gen_pool_chunk) + ++ unsigned long nbits = size >> pool->min_alloc_order; ++ unsigned long nbytes = sizeof(struct gen_pool_chunk) + + BITS_TO_LONGS(nbits) * sizeof(long); + + chunk = vzalloc_node(nbytes, nid); +@@ -242,7 +243,7 @@ void gen_pool_destroy(struct gen_pool *pool) + struct list_head *_chunk, *_next_chunk; + struct gen_pool_chunk *chunk; + int order = pool->min_alloc_order; +- int bit, end_bit; ++ unsigned long bit, end_bit; + + list_for_each_safe(_chunk, _next_chunk, &pool->chunks) { + chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk); +@@ -293,7 +294,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, + struct gen_pool_chunk *chunk; + unsigned long addr = 0; + int order = pool->min_alloc_order; +- int nbits, start_bit, end_bit, remain; ++ unsigned long nbits, start_bit, end_bit, remain; + + #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG + BUG_ON(in_nmi()); +@@ -376,7 +377,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size) + { + struct gen_pool_chunk *chunk; + int order = pool->min_alloc_order; +- int start_bit, nbits, remain; ++ unsigned long start_bit, nbits, remain; + + #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG + BUG_ON(in_nmi()); +@@ -638,7 +639,7 @@ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, + index = bitmap_find_next_zero_area(map, size, start, nr, 0); + + while (index < size) { +- int next_bit = find_next_bit(map, size, index + nr); ++ unsigned long next_bit = find_next_bit(map, size, index + nr); + if ((next_bit - index) < len) { + len = next_bit - index; + start_bit = index; +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 001d7f07e7803..fe0d255d66c8b 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1244,8 +1244,8 @@ static const struct attribute_group dql_group = { + static ssize_t xps_cpus_show(struct netdev_queue *queue, + char *buf) + { ++ int cpu, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; +- int cpu, len, num_tc = 1, tc = 0; + struct xps_dev_maps *dev_maps; + cpumask_var_t mask; + unsigned long index; +@@ -1255,22 +1255,31 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + /* Do not allow XPS on subordinate device directly */ + num_tc = dev->num_tc; +- if (num_tc < 0) +- return -EINVAL; ++ if (num_tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + + /* If queue belongs to subordinate dev use its map */ + dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev; + + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + +- if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) +- return -ENOMEM; ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_cpus_map); +@@ -1293,9 +1302,15 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, + } + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask)); + free_cpumask_var(mask); + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_cpus_store(struct netdev_queue *queue, +@@ -1323,7 +1338,13 @@ static ssize_t xps_cpus_store(struct netdev_queue *queue, + return err; + } + ++ if (!rtnl_trylock()) { ++ free_cpumask_var(mask); ++ return restart_syscall(); ++ } ++ + err = netif_set_xps_queue(dev, mask, index); ++ rtnl_unlock(); + + free_cpumask_var(mask); + +@@ -1335,23 +1356,30 @@ static struct netdev_queue_attribute xps_cpus_attribute __ro_after_init + + static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) + { ++ int j, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; + struct xps_dev_maps *dev_maps; + unsigned long *mask, index; +- int j, len, num_tc = 1, tc = 0; + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + num_tc = dev->num_tc; + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + mask = kcalloc(BITS_TO_LONGS(dev->num_rx_queues), sizeof(long), + GFP_KERNEL); +- if (!mask) +- return -ENOMEM; ++ if (!mask) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_rxqs_map); +@@ -1377,10 +1405,16 @@ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) + out_no_maps: + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues); + kfree(mask); + + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf, +@@ -1407,10 +1441,17 @@ static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf, + return err; + } + ++ if (!rtnl_trylock()) { ++ bitmap_free(mask); ++ return restart_syscall(); ++ } ++ + cpus_read_lock(); + err = __netif_set_xps_queue(dev, mask, index, true); + cpus_read_unlock(); + ++ rtnl_unlock(); ++ + kfree(mask); + return err ? : len; + } +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 7f4ec36e5f705..b96aa88087be1 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -302,7 +302,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) + .flowi4_iif = LOOPBACK_IFINDEX, + .flowi4_oif = l3mdev_master_ifindex_rcu(dev), + .daddr = ip_hdr(skb)->saddr, +- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), ++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK, + .flowi4_scope = scope, + .flowi4_mark = vmark ? skb->mark : 0, + }; +diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c +index ad9ea82daeb3a..9376b30cf626e 100644 +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -133,7 +133,7 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + * to 0 and sets the configured key in the + * inner erspan header field + */ +- if (greh->protocol == htons(ETH_P_ERSPAN) || ++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) || + greh->protocol == htons(ETH_P_ERSPAN2)) { + struct erspan_base_hdr *ershdr; + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index ca20efe775ee4..a2cae543a285a 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1405,7 +1405,7 @@ static int compat_get_entries(struct net *net, + xt_compat_lock(NFPROTO_ARP); + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + struct xt_table_info info; + + ret = compat_table_info(private, &info); +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 115d48049686f..6672172a7512d 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1619,7 +1619,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, + xt_compat_lock(AF_INET); + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index b1441349e1517..3b067d5a62ee0 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1628,7 +1628,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, + xt_compat_lock(AF_INET6); + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c +index 930c1d3796f0f..a43c9a44f8701 100644 +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -949,7 +949,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_device *dev, + int payload, i, ret; + + /* Find the NCSI device */ +- nd = ncsi_find_dev(dev); ++ nd = ncsi_find_dev(orig_dev); + ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL; + if (!ndp) + return -ENODEV; +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index ddfe06d7530ba..154b40f2f2a8c 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -115,20 +115,6 @@ htable_size(u8 hbits) + return hsize * sizeof(struct hbucket *) + sizeof(struct htable); + } + +-/* Compute htable_bits from the user input parameter hashsize */ +-static u8 +-htable_bits(u32 hashsize) +-{ +- /* Assume that hashsize == 2^htable_bits */ +- u8 bits = fls(hashsize - 1); +- +- if (jhash_size(bits) != hashsize) +- /* Round up to the first 2^n value */ +- bits = fls(hashsize); +- +- return bits; +-} +- + #ifdef IP_SET_HASH_WITH_NETS + #if IPSET_NET_COUNT > 1 + #define __CIDR(cidr, i) (cidr[i]) +@@ -1287,7 +1273,11 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, + if (!h) + return -ENOMEM; + +- hbits = htable_bits(hashsize); ++ /* Compute htable_bits from the user input parameter hashsize. ++ * Assume that hashsize == 2^htable_bits, ++ * otherwise round up to the first 2^n value. ++ */ ++ hbits = fls(hashsize - 1); + hsize = htable_size(hbits); + if (hsize == 0) { + kfree(h); +diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c +index 9e05c86ba5c45..932c0ae99bdcf 100644 +--- a/net/netfilter/xt_RATEEST.c ++++ b/net/netfilter/xt_RATEEST.c +@@ -118,6 +118,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) + } cfg; + int ret; + ++ if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name)) ++ return -ENAMETOOLONG; ++ + net_get_random_once(&jhash_rnd, sizeof(jhash_rnd)); + + mutex_lock(&xn->hash_lock); +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index 63bfceeb8e3cd..d058397d284bf 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -371,7 +371,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index 4a042abf844c0..6f94bca75520b 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -357,7 +357,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (!q) { +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index 56c181c3feeb2..a3dc2118539b9 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -214,7 +214,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (ctl->limit > 0) { +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index b89cf0971d3dd..74f697c4a4d30 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -651,7 +651,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog)) ++ ctl_v1->Wlog, ctl_v1->Scell_log)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); +diff --git a/scripts/depmod.sh b/scripts/depmod.sh +index e083bcae343f3..3643b4f896ede 100755 +--- a/scripts/depmod.sh ++++ b/scripts/depmod.sh +@@ -15,6 +15,8 @@ if ! test -r System.map ; then + exit 0 + fi + ++# legacy behavior: "depmod" in /sbin, no /sbin in PATH ++PATH="$PATH:/sbin" + if [ -z $(command -v $DEPMOD) ]; then + echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2 + echo "This is probably in the kmod package." >&2 +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index d43245937db7e..2cd8bfd5293b9 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2328,8 +2328,6 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x1849, 0x7662, "Asrock H81M-HDS", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ + SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), +- /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */ +- SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ + SND_PCI_QUIRK(0x1558, 0x6504, "Clevo W65_67SB", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 78bb96263bc27..7d471ecc1ca03 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1088,6 +1088,7 @@ static int patch_conexant_auto(struct hda_codec *codec) + static const struct hda_device_id snd_hda_id_conexant[] = { + HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto), ++ HDA_CODEC_ENTRY(0x14f120d0, "CX11970", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 37b2bcdb3d65a..9f0b05bcbd867 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5774,6 +5774,7 @@ enum { + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, + ALC298_FIXUP_SPK_VOLUME, ++ ALC298_FIXUP_LENOVO_SPK_VOLUME, + ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER, + ALC269_FIXUP_ATIV_BOOK_8, + ALC221_FIXUP_HP_MIC_NO_PRESENCE, +@@ -6545,6 +6546,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + }, ++ [ALC298_FIXUP_LENOVO_SPK_VOLUME] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_speaker_volume, ++ }, + [ALC295_FIXUP_DISABLE_DAC3] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc295_fixup_disable_dac3, +@@ -7220,6 +7225,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c +index 6b9617aee0e69..11bf7ace5ab2d 100644 +--- a/sound/pci/hda/patch_via.c ++++ b/sound/pci/hda/patch_via.c +@@ -1015,6 +1015,7 @@ static const struct hda_verb vt1802_init_verbs[] = { + enum { + VIA_FIXUP_INTMIC_BOOST, + VIA_FIXUP_ASUS_G75, ++ VIA_FIXUP_POWER_SAVE, + }; + + static void via_fixup_intmic_boost(struct hda_codec *codec, +@@ -1024,6 +1025,13 @@ static void via_fixup_intmic_boost(struct hda_codec *codec, + override_mic_boost(codec, 0x30, 0, 2, 40); + } + ++static void via_fixup_power_save(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ codec->power_save_node = 0; ++} ++ + static const struct hda_fixup via_fixups[] = { + [VIA_FIXUP_INTMIC_BOOST] = { + .type = HDA_FIXUP_FUNC, +@@ -1038,11 +1046,16 @@ static const struct hda_fixup via_fixups[] = { + { } + } + }, ++ [VIA_FIXUP_POWER_SAVE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = via_fixup_power_save, ++ }, + }; + + static const struct snd_pci_quirk vt2002p_fixups[] = { + SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75), + SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST), ++ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE), + {} + }; + +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 137e1e8718d6f..26548f760bc1c 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1890,6 +1890,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bNumEmbMIDIJack > 0x10) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { +@@ -2142,6 +2144,8 @@ static int snd_usbmidi_detect_roland(struct snd_usb_midi *umidi, + cs_desc[1] == USB_DT_CS_INTERFACE && + cs_desc[2] == 0xf1 && + cs_desc[3] == 0x02) { ++ if (cs_desc[4] > 0x10 || cs_desc[5] > 0x10) ++ continue; + endpoint->in_cables = (1 << cs_desc[4]) - 1; + endpoint->out_cables = (1 << cs_desc[5]) - 1; + return snd_usbmidi_detect_endpoints(umidi, endpoint, 1);
