commit: ddda38709021959ebe1733998b1ff36392865290 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Aug 12 11:52:22 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Aug 12 11:52:22 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ddda3870
Linux patch 5.4.140 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1139_linux-5.4.140.patch | 2756 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2760 insertions(+) diff --git a/0000_README b/0000_README index 153ac0e..b565a28 100644 --- a/0000_README +++ b/0000_README @@ -599,6 +599,10 @@ Patch: 1138_linux-5.4.139.patch From: http://www.kernel.org Desc: Linux 5.4.139 +Patch: 1139_linux-5.4.140.patch +From: http://www.kernel.org +Desc: Linux 5.4.140 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1139_linux-5.4.140.patch b/1139_linux-5.4.140.patch new file mode 100644 index 0000000..3560381 --- /dev/null +++ b/1139_linux-5.4.140.patch @@ -0,0 +1,2756 @@ +diff --git a/Makefile b/Makefile +index 1174536034b38..1cb8f72d4dcea 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 139 ++SUBLEVEL = 140 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c +index 5f90df30be20a..06fd42417aa96 100644 +--- a/arch/alpha/kernel/smp.c ++++ b/arch/alpha/kernel/smp.c +@@ -585,7 +585,7 @@ void + smp_send_stop(void) + { + cpumask_t to_whom; +- cpumask_copy(&to_whom, cpu_possible_mask); ++ cpumask_copy(&to_whom, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &to_whom); + #ifdef DEBUG_IPI_MSG + if (hard_smp_processor_id() != boot_cpu_id) +diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi +index 6c2949991e297..64fdd5079d49b 100644 +--- a/arch/arm/boot/dts/am437x-l4.dtsi ++++ b/arch/arm/boot/dts/am437x-l4.dtsi +@@ -1611,7 +1611,7 @@ + compatible = "ti,am4372-d_can", "ti,am3352-d_can"; + reg = <0x0 0x2000>; + clocks = <&dcan1_fck>; +- clock-name = "fck"; ++ clock-names = "fck"; + syscon-raminit = <&scm_conf 0x644 1>; + interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>; + status = "disabled"; +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 719ed5ca454af..64faf5b46d92f 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -388,13 +388,13 @@ + + pinctrl_power_button: powerbutgrp { + fsl,pins = < +- MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 ++ MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 + >; + }; + + pinctrl_power_out: poweroutgrp { + fsl,pins = < +- MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 ++ MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 + >; + }; + +diff --git a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi +index 6d7f6b9035bc1..f2649241167ec 100644 +--- a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi +@@ -54,7 +54,13 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_microsom_enet_ar8035>; + phy-mode = "rgmii-id"; +- phy-reset-duration = <2>; ++ ++ /* ++ * The PHY seems to require a long-enough reset duration to avoid ++ * some rare issues where the PHY gets stuck in an inconsistent and ++ * non-functional state at boot-up. 10ms proved to be fine . ++ */ ++ phy-reset-duration = <10>; + phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi +index 038d8c90f6dfe..621396884c318 100644 +--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi ++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi +@@ -43,6 +43,7 @@ + assigned-clock-rates = <0>, <198000000>; + cap-power-off-card; + keep-power-in-suspend; ++ max-frequency = <25000000>; + mmc-pwrseq = <&wifi_pwrseq>; + no-1-8-v; + non-removable; +diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi +index 68ac04641bdb1..c7bf68c90ea8f 100644 +--- a/arch/arm/boot/dts/omap5-board-common.dtsi ++++ b/arch/arm/boot/dts/omap5-board-common.dtsi +@@ -30,14 +30,6 @@ + regulator-max-microvolt = <5000000>; + }; + +- vdds_1v8_main: fixedregulator-vdds_1v8_main { +- compatible = "regulator-fixed"; +- regulator-name = "vdds_1v8_main"; +- vin-supply = <&smps7_reg>; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- + vmmcsd_fixed: fixedregulator-mmcsd { + compatible = "regulator-fixed"; + regulator-name = "vmmcsd_fixed"; +@@ -487,6 +479,7 @@ + regulator-boot-on; + }; + ++ vdds_1v8_main: + smps7_reg: smps7 { + /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */ + regulator-name = "smps7"; +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index 0dfd0ae7a63dd..af12668d0bf51 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -103,6 +103,7 @@ struct mmdc_pmu { + struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; + struct hlist_node node; + struct fsl_mmdc_devtype_data *devtype_data; ++ struct clk *mmdc_ipg_clk; + }; + + /* +@@ -462,11 +463,14 @@ static int imx_mmdc_remove(struct platform_device *pdev) + + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); ++ iounmap(pmu_mmdc->mmdc_base); ++ clk_disable_unprepare(pmu_mmdc->mmdc_ipg_clk); + kfree(pmu_mmdc); + return 0; + } + +-static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base) ++static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base, ++ struct clk *mmdc_ipg_clk) + { + struct mmdc_pmu *pmu_mmdc; + char *name; +@@ -494,6 +498,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + } + + mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); ++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + if (mmdc_num == 0) + name = "mmdc"; + else +@@ -529,7 +534,7 @@ pmu_free: + + #else + #define imx_mmdc_remove NULL +-#define imx_mmdc_perf_init(pdev, mmdc_base) 0 ++#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0 + #endif + + static int imx_mmdc_probe(struct platform_device *pdev) +@@ -567,7 +572,13 @@ static int imx_mmdc_probe(struct platform_device *pdev) + val &= ~(1 << BP_MMDC_MAPSR_PSD); + writel_relaxed(val, reg); + +- return imx_mmdc_perf_init(pdev, mmdc_base); ++ err = imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk); ++ if (err) { ++ iounmap(mmdc_base); ++ clk_disable_unprepare(mmdc_ipg_clk); ++ } ++ ++ return err; + } + + int imx_mmdc_get_ddr_type(void) +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 5a2a188debd1d..5716ac20bddd1 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -65,7 +65,7 @@ + }; + }; + +- sysclk: clock-sysclk { ++ sysclk: sysclk { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <100000000>; +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index 874bc3954c8e6..025e02d23da9b 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -118,6 +118,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&i2c1_pins>; + clock-frequency = <100000>; ++ /delete-property/ mrvl,i2c-fast-mode; + status = "okay"; + + rtc@6f { +diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h +index 9f0ec21d6327f..88d20f04c64a5 100644 +--- a/arch/arm64/include/asm/arch_timer.h ++++ b/arch/arm64/include/asm/arch_timer.h +@@ -165,25 +165,6 @@ static inline void arch_timer_set_cntkctl(u32 cntkctl) + isb(); + } + +-/* +- * Ensure that reads of the counter are treated the same as memory reads +- * for the purposes of ordering by subsequent memory barriers. +- * +- * This insanity brought to you by speculative system register reads, +- * out-of-order memory accesses, sequence locks and Thomas Gleixner. +- * +- * http://lists.infradead.org/pipermail/linux-arm-kernel/2019-February/631195.html +- */ +-#define arch_counter_enforce_ordering(val) do { \ +- u64 tmp, _val = (val); \ +- \ +- asm volatile( \ +- " eor %0, %1, %1\n" \ +- " add %0, sp, %0\n" \ +- " ldr xzr, [%0]" \ +- : "=r" (tmp) : "r" (_val)); \ +-} while (0) +- + static __always_inline u64 __arch_counter_get_cntpct_stable(void) + { + u64 cnt; +@@ -224,8 +205,6 @@ static __always_inline u64 __arch_counter_get_cntvct(void) + return cnt; + } + +-#undef arch_counter_enforce_ordering +- + static inline int arch_timer_arch_init(void) + { + return 0; +diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h +index e0e2b1946f42b..0fcd854fc95f3 100644 +--- a/arch/arm64/include/asm/barrier.h ++++ b/arch/arm64/include/asm/barrier.h +@@ -57,6 +57,25 @@ static inline unsigned long array_index_mask_nospec(unsigned long idx, + return mask; + } + ++/* ++ * Ensure that reads of the counter are treated the same as memory reads ++ * for the purposes of ordering by subsequent memory barriers. ++ * ++ * This insanity brought to you by speculative system register reads, ++ * out-of-order memory accesses, sequence locks and Thomas Gleixner. ++ * ++ * http://lists.infradead.org/pipermail/linux-arm-kernel/2019-February/631195.html ++ */ ++#define arch_counter_enforce_ordering(val) do { \ ++ u64 tmp, _val = (val); \ ++ \ ++ asm volatile( \ ++ " eor %0, %1, %1\n" \ ++ " add %0, sp, %0\n" \ ++ " ldr xzr, [%0]" \ ++ : "=r" (tmp) : "r" (_val)); \ ++} while (0) ++ + #define __smp_mb() dmb(ish) + #define __smp_rmb() dmb(ishld) + #define __smp_wmb() dmb(ishst) +diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h +index bf57308fcd635..92b2575b01918 100644 +--- a/arch/arm64/include/asm/ptrace.h ++++ b/arch/arm64/include/asm/ptrace.h +@@ -299,7 +299,17 @@ static inline unsigned long kernel_stack_pointer(struct pt_regs *regs) + + static inline unsigned long regs_return_value(struct pt_regs *regs) + { +- return regs->regs[0]; ++ unsigned long val = regs->regs[0]; ++ ++ /* ++ * Audit currently uses regs_return_value() instead of ++ * syscall_get_return_value(). Apply the same sign-extension here until ++ * audit is updated to use syscall_get_return_value(). ++ */ ++ if (compat_user_mode(regs)) ++ val = sign_extend64(val, 31); ++ ++ return val; + } + + static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) +diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h +index cfc0672013f67..03e20895453a7 100644 +--- a/arch/arm64/include/asm/syscall.h ++++ b/arch/arm64/include/asm/syscall.h +@@ -29,22 +29,23 @@ static inline void syscall_rollback(struct task_struct *task, + regs->regs[0] = regs->orig_x0; + } + +- +-static inline long syscall_get_error(struct task_struct *task, +- struct pt_regs *regs) ++static inline long syscall_get_return_value(struct task_struct *task, ++ struct pt_regs *regs) + { +- unsigned long error = regs->regs[0]; ++ unsigned long val = regs->regs[0]; + + if (is_compat_thread(task_thread_info(task))) +- error = sign_extend64(error, 31); ++ val = sign_extend64(val, 31); + +- return IS_ERR_VALUE(error) ? error : 0; ++ return val; + } + +-static inline long syscall_get_return_value(struct task_struct *task, +- struct pt_regs *regs) ++static inline long syscall_get_error(struct task_struct *task, ++ struct pt_regs *regs) + { +- return regs->regs[0]; ++ unsigned long error = syscall_get_return_value(task, regs); ++ ++ return IS_ERR_VALUE(error) ? error : 0; + } + + static inline void syscall_set_return_value(struct task_struct *task, +diff --git a/arch/arm64/include/asm/vdso/gettimeofday.h b/arch/arm64/include/asm/vdso/gettimeofday.h +index ff83b8b574fc7..d7361faa42dea 100644 +--- a/arch/arm64/include/asm/vdso/gettimeofday.h ++++ b/arch/arm64/include/asm/vdso/gettimeofday.h +@@ -85,11 +85,7 @@ static __always_inline u64 __arch_get_hw_counter(s32 clock_mode) + */ + isb(); + asm volatile("mrs %0, cntvct_el0" : "=r" (res) :: "memory"); +- /* +- * This isb() is required to prevent that the seq lock is +- * speculated.# +- */ +- isb(); ++ arch_counter_enforce_ordering(res); + + return res; + } +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 0cfd685774891..8a95a013dfd3c 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1868,7 +1868,7 @@ void syscall_trace_exit(struct pt_regs *regs) + audit_syscall_exit(regs); + + if (flags & _TIF_SYSCALL_TRACEPOINT) +- trace_sys_exit(regs, regs_return_value(regs)); ++ trace_sys_exit(regs, syscall_get_return_value(current, regs)); + + if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP)) + tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT); +diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c +index ddb757b2c3e5b..f6d3278c1a4e0 100644 +--- a/arch/arm64/kernel/signal.c ++++ b/arch/arm64/kernel/signal.c +@@ -29,6 +29,7 @@ + #include <asm/unistd.h> + #include <asm/fpsimd.h> + #include <asm/ptrace.h> ++#include <asm/syscall.h> + #include <asm/signal32.h> + #include <asm/traps.h> + #include <asm/vdso.h> +@@ -868,7 +869,7 @@ static void do_signal(struct pt_regs *regs) + retval == -ERESTART_RESTARTBLOCK || + (retval == -ERESTARTSYS && + !(ksig.ka.sa.sa_flags & SA_RESTART)))) { +- regs->regs[0] = -EINTR; ++ syscall_set_return_value(current, regs, -EINTR, 0); + regs->pc = continue_addr; + } + +diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c +index f2d2dbbbfca20..091c11521108a 100644 +--- a/arch/arm64/kernel/syscall.c ++++ b/arch/arm64/kernel/syscall.c +@@ -50,10 +50,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, + ret = do_ni_syscall(regs, scno); + } + +- if (is_compat_task()) +- ret = lower_32_bits(ret); +- +- regs->regs[0] = ret; ++ syscall_set_return_value(current, regs, 0, ret); + } + + static inline bool has_syscall_work(unsigned long flags) +@@ -108,7 +105,7 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr, + if (has_syscall_work(flags)) { + /* set default errno for user-issued syscall(-1) */ + if (scno == NO_SYSCALL) +- regs->regs[0] = -ENOSYS; ++ syscall_set_return_value(current, regs, -ENOSYS, 0); + scno = syscall_trace_enter(regs); + if (scno == NO_SYSCALL) + goto trace_exit; +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 5403a91ce098d..9ff2c70763a0c 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -320,7 +320,7 @@ KBUILD_LDFLAGS += -m $(ld-emul) + + ifdef CONFIG_MIPS + CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ +- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \ ++ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ + sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') + endif + +diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c +index 11e9527c6e441..62ffac500eb52 100644 +--- a/arch/mips/mti-malta/malta-platform.c ++++ b/arch/mips/mti-malta/malta-platform.c +@@ -47,7 +47,8 @@ static struct plat_serial8250_port uart8250_data[] = { + .mapbase = 0x1f000900, /* The CBUS UART */ + .irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2, + .uartclk = 3686400, /* Twice the usual clk! */ +- .iotype = UPIO_MEM32, ++ .iotype = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ? ++ UPIO_MEM32BE : UPIO_MEM32, + .flags = CBUS_UART_FLAGS, + .regshift = 3, + }, +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 0ed910237c4d8..834e53e538d44 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -852,9 +852,10 @@ void x86_pmu_stop(struct perf_event *event, int flags); + + static inline void x86_pmu_disable_event(struct perf_event *event) + { ++ u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask); + struct hw_perf_event *hwc = &event->hw; + +- wrmsrl(hwc->config_base, hwc->config); ++ wrmsrl(hwc->config_base, hwc->config & ~disable_mask); + } + + void x86_pmu_enable_event(struct perf_event *event); +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index b9400087141df..260c64c205b8c 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2143,7 +2143,7 @@ static int is_empty_shadow_page(u64 *spt) + * aggregate version in order to make the slab shrinker + * faster + */ +-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr) ++static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, long nr) + { + kvm->arch.n_used_mmu_pages += nr; + percpu_counter_add(&kvm_total_used_mmu_pages, nr); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 5d35b9656b67d..364e96e508d90 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3638,8 +3638,17 @@ static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu) + + static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu) + { +- return kvm_arch_interrupt_allowed(vcpu) && +- kvm_cpu_accept_dm_intr(vcpu); ++ /* ++ * Do not cause an interrupt window exit if an exception ++ * is pending or an event needs reinjection; userspace ++ * might want to inject the interrupt manually using KVM_SET_REGS ++ * or KVM_SET_SREGS. For that to work, we must be at an ++ * instruction boundary and with no events half-injected. ++ */ ++ return (kvm_arch_interrupt_allowed(vcpu) && ++ kvm_cpu_accept_dm_intr(vcpu) && ++ !kvm_event_needs_reinjection(vcpu) && ++ !vcpu->arch.exception.pending); + } + + static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index c128d50cb4107..71a82528d4bfe 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -832,7 +832,11 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, + + enable = iolatency_set_min_lat_nsec(blkg, lat_val); + if (enable) { +- WARN_ON_ONCE(!blk_get_queue(blkg->q)); ++ if (!blk_get_queue(blkg->q)) { ++ ret = -ENODEV; ++ goto out; ++ } ++ + blkg_get(blkg); + } + +diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c +index b7c408ce340c9..663d85e0adba9 100644 +--- a/drivers/acpi/acpica/nsrepair2.c ++++ b/drivers/acpi/acpica/nsrepair2.c +@@ -375,13 +375,6 @@ acpi_ns_repair_CID(struct acpi_evaluate_info *info, + + (*element_ptr)->common.reference_count = + original_ref_count; +- +- /* +- * The original_element holds a reference from the package object +- * that represents _HID. Since a new element was created by _HID, +- * remove the reference from the _CID package. +- */ +- acpi_ut_remove_reference(original_element); + } + + element_ptr++; +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 038db94216a91..454f9d7d42fe1 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -641,6 +641,20 @@ unsigned int ata_sff_data_xfer32(struct ata_queued_cmd *qc, unsigned char *buf, + } + EXPORT_SYMBOL_GPL(ata_sff_data_xfer32); + ++static void ata_pio_xfer(struct ata_queued_cmd *qc, struct page *page, ++ unsigned int offset, size_t xfer_size) ++{ ++ bool do_write = (qc->tf.flags & ATA_TFLAG_WRITE); ++ unsigned char *buf; ++ ++ buf = kmap_atomic(page); ++ qc->ap->ops->sff_data_xfer(qc, buf + offset, xfer_size, do_write); ++ kunmap_atomic(buf); ++ ++ if (!do_write && !PageSlab(page)) ++ flush_dcache_page(page); ++} ++ + /** + * ata_pio_sector - Transfer a sector of data. + * @qc: Command on going +@@ -652,11 +666,9 @@ EXPORT_SYMBOL_GPL(ata_sff_data_xfer32); + */ + static void ata_pio_sector(struct ata_queued_cmd *qc) + { +- int do_write = (qc->tf.flags & ATA_TFLAG_WRITE); + struct ata_port *ap = qc->ap; + struct page *page; + unsigned int offset; +- unsigned char *buf; + + if (!qc->cursg) { + qc->curbytes = qc->nbytes; +@@ -674,13 +686,20 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) + + DPRINTK("data %s\n", qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read"); + +- /* do the actual data transfer */ +- buf = kmap_atomic(page); +- ap->ops->sff_data_xfer(qc, buf + offset, qc->sect_size, do_write); +- kunmap_atomic(buf); ++ /* ++ * Split the transfer when it splits a page boundary. Note that the ++ * split still has to be dword aligned like all ATA data transfers. ++ */ ++ WARN_ON_ONCE(offset % 4); ++ if (offset + qc->sect_size > PAGE_SIZE) { ++ unsigned int split_len = PAGE_SIZE - offset; + +- if (!do_write && !PageSlab(page)) +- flush_dcache_page(page); ++ ata_pio_xfer(qc, page, offset, split_len); ++ ata_pio_xfer(qc, nth_page(page, 1), 0, ++ qc->sect_size - split_len); ++ } else { ++ ata_pio_xfer(qc, page, offset, qc->sect_size); ++ } + + qc->curbytes += qc->sect_size; + qc->cursg_ofs += qc->sect_size; +diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c +index 70efbb22dfc30..5f3e5d8372590 100644 +--- a/drivers/base/firmware_loader/fallback.c ++++ b/drivers/base/firmware_loader/fallback.c +@@ -86,12 +86,11 @@ static void __fw_load_abort(struct fw_priv *fw_priv) + { + /* + * There is a small window in which user can write to 'loading' +- * between loading done and disappearance of 'loading' ++ * between loading done/aborted and disappearance of 'loading' + */ +- if (fw_sysfs_done(fw_priv)) ++ if (fw_state_is_aborted(fw_priv) || fw_sysfs_done(fw_priv)) + return; + +- list_del_init(&fw_priv->pending_list); + fw_state_aborted(fw_priv); + } + +@@ -277,7 +276,6 @@ static ssize_t firmware_loading_store(struct device *dev, + * Same logic as fw_load_abort, only the DONE bit + * is ignored and we set ABORT only on failure. + */ +- list_del_init(&fw_priv->pending_list); + if (rc) { + fw_state_aborted(fw_priv); + written = rc; +@@ -512,6 +510,11 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, + } + + mutex_lock(&fw_lock); ++ if (fw_state_is_aborted(fw_priv)) { ++ mutex_unlock(&fw_lock); ++ retval = -EINTR; ++ goto out; ++ } + list_add(&fw_priv->pending_list, &pending_fw_head); + mutex_unlock(&fw_lock); + +@@ -534,11 +537,10 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, + if (fw_state_is_aborted(fw_priv)) { + if (retval == -ERESTARTSYS) + retval = -EINTR; +- else +- retval = -EAGAIN; + } else if (fw_priv->is_paged_buf && !fw_priv->data) + retval = -ENOMEM; + ++out: + device_del(f_dev); + err_put_dev: + put_device(f_dev); +diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h +index 9bef6c35f344a..ffb2a2724cc5a 100644 +--- a/drivers/base/firmware_loader/firmware.h ++++ b/drivers/base/firmware_loader/firmware.h +@@ -108,8 +108,16 @@ static inline void __fw_state_set(struct fw_priv *fw_priv, + + WRITE_ONCE(fw_st->status, status); + +- if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) ++ if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) { ++#ifdef CONFIG_FW_LOADER_USER_HELPER ++ /* ++ * Doing this here ensures that the fw_priv is deleted from ++ * the pending list in all abort/done paths. ++ */ ++ list_del_init(&fw_priv->pending_list); ++#endif + complete_all(&fw_st->completion); ++ } + } + + static inline void fw_state_aborted(struct fw_priv *fw_priv) +diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c +index 95d21b4af9045..249349f64bfe9 100644 +--- a/drivers/base/firmware_loader/main.c ++++ b/drivers/base/firmware_loader/main.c +@@ -747,8 +747,10 @@ static void fw_abort_batch_reqs(struct firmware *fw) + return; + + fw_priv = fw->priv; ++ mutex_lock(&fw_lock); + if (!fw_state_is_aborted(fw_priv)) + fw_state_aborted(fw_priv); ++ mutex_unlock(&fw_lock); + } + + /* called from request_firmware() and request_firmware_work_func() */ +diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c +index 22bf553ccf9df..69937be2032b1 100644 +--- a/drivers/char/tpm/tpm_ftpm_tee.c ++++ b/drivers/char/tpm/tpm_ftpm_tee.c +@@ -255,11 +255,11 @@ static int ftpm_tee_probe(struct platform_device *pdev) + pvt_data->session = sess_arg.session; + + /* Allocate dynamic shared memory with fTPM TA */ +- pvt_data->shm = tee_shm_alloc(pvt_data->ctx, +- MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE, +- TEE_SHM_MAPPED | TEE_SHM_DMA_BUF); ++ pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx, ++ MAX_COMMAND_SIZE + ++ MAX_RESPONSE_SIZE); + if (IS_ERR(pvt_data->shm)) { +- dev_err(dev, "%s: tee_shm_alloc failed\n", __func__); ++ dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__); + rc = -ENOMEM; + goto out_shm_alloc; + } +diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c +index be160764911bf..f9d5b73343417 100644 +--- a/drivers/clk/clk-devres.c ++++ b/drivers/clk/clk-devres.c +@@ -92,13 +92,20 @@ int __must_check devm_clk_bulk_get_optional(struct device *dev, int num_clks, + } + EXPORT_SYMBOL_GPL(devm_clk_bulk_get_optional); + ++static void devm_clk_bulk_release_all(struct device *dev, void *res) ++{ ++ struct clk_bulk_devres *devres = res; ++ ++ clk_bulk_put_all(devres->num_clks, devres->clks); ++} ++ + int __must_check devm_clk_bulk_get_all(struct device *dev, + struct clk_bulk_data **clks) + { + struct clk_bulk_devres *devres; + int ret; + +- devres = devres_alloc(devm_clk_bulk_release, ++ devres = devres_alloc(devm_clk_bulk_release_all, + sizeof(*devres), GFP_KERNEL); + if (!devres) + return -ENOMEM; +diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c +index 18117ce5ff85f..5c75e3d906c20 100644 +--- a/drivers/clk/clk-stm32f4.c ++++ b/drivers/clk/clk-stm32f4.c +@@ -526,7 +526,7 @@ struct stm32f4_pll { + + struct stm32f4_pll_post_div_data { + int idx; +- u8 pll_num; ++ int pll_idx; + const char *name; + const char *parent; + u8 flag; +@@ -557,13 +557,13 @@ static const struct clk_div_table post_divr_table[] = { + + #define MAX_POST_DIV 3 + static const struct stm32f4_pll_post_div_data post_div_data[MAX_POST_DIV] = { +- { CLK_I2SQ_PDIV, PLL_I2S, "plli2s-q-div", "plli2s-q", ++ { CLK_I2SQ_PDIV, PLL_VCO_I2S, "plli2s-q-div", "plli2s-q", + CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 0, 5, 0, NULL}, + +- { CLK_SAIQ_PDIV, PLL_SAI, "pllsai-q-div", "pllsai-q", ++ { CLK_SAIQ_PDIV, PLL_VCO_SAI, "pllsai-q-div", "pllsai-q", + CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 8, 5, 0, NULL }, + +- { NO_IDX, PLL_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT, ++ { NO_IDX, PLL_VCO_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT, + STM32F4_RCC_DCKCFGR, 16, 2, 0, post_divr_table }, + }; + +@@ -1774,7 +1774,7 @@ static void __init stm32f4_rcc_init(struct device_node *np) + post_div->width, + post_div->flag_div, + post_div->div_table, +- clks[post_div->pll_num], ++ clks[post_div->pll_idx], + &stm32f4_clk_lock); + + if (post_div->idx != NO_IDX) +diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c +index 5c0fb3134825f..5265182674eb7 100644 +--- a/drivers/dma/imx-dma.c ++++ b/drivers/dma/imx-dma.c +@@ -832,6 +832,8 @@ static struct dma_async_tx_descriptor *imxdma_prep_slave_sg( + dma_length += sg_dma_len(sg); + } + ++ imxdma_config_write(chan, &imxdmac->config, direction); ++ + switch (imxdmac->word_size) { + case DMA_SLAVE_BUSWIDTH_4_BYTES: + if (sg_dma_len(sgl) & 3 || sgl->dma_address & 3) +diff --git a/drivers/gpio/gpio-tqmx86.c b/drivers/gpio/gpio-tqmx86.c +index a3109bcaa0ac2..09ca493b36176 100644 +--- a/drivers/gpio/gpio-tqmx86.c ++++ b/drivers/gpio/gpio-tqmx86.c +@@ -235,8 +235,8 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + struct resource *res; + int ret, irq; + +- irq = platform_get_irq(pdev, 0); +- if (irq < 0) ++ irq = platform_get_irq_optional(pdev, 0); ++ if (irq < 0 && irq != -ENXIO) + return irq; + + res = platform_get_resource(pdev, IORESOURCE_IO, 0); +@@ -275,7 +275,7 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + + pm_runtime_enable(&pdev->dev); + +- if (irq) { ++ if (irq > 0) { + struct irq_chip *irq_chip = &gpio->irq_chip; + u8 irq_status; + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index a715cb88052c2..e87184645c540 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -452,8 +452,6 @@ static void raid1_end_write_request(struct bio *bio) + /* + * When the device is faulty, it is not necessary to + * handle write error. +- * For failfast, this is the only remaining device, +- * We need to retry the write without FailFast. + */ + if (!test_bit(Faulty, &rdev->flags)) + set_bit(R1BIO_WriteError, &r1_bio->state); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index a195a85cc366a..deddabfb07d79 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -470,12 +470,12 @@ static void raid10_end_write_request(struct bio *bio) + /* + * When the device is faulty, it is not necessary to + * handle write error. +- * For failfast, this is the only remaining device, +- * We need to retry the write without FailFast. + */ + if (!test_bit(Faulty, &rdev->flags)) + set_bit(R10BIO_WriteError, &r10_bio->state); + else { ++ /* Fail the request */ ++ set_bit(R10BIO_Degraded, &r10_bio->state); + r10_bio->devs[slot].bio = NULL; + to_put = bio; + dec_rdev = 1; +diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c +index 4489744fbbd95..13602939906fc 100644 +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -1512,6 +1512,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + struct media_request *req) + { + struct vb2_buffer *vb; ++ enum vb2_buffer_state orig_state; + int ret; + + if (q->error) { +@@ -1611,6 +1612,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + * Add to the queued buffers list, a buffer will stay on it until + * dequeued in dqbuf. + */ ++ orig_state = vb->state; + list_add_tail(&vb->queued_entry, &q->queued_list); + q->queued_count++; + q->waiting_for_buffers = false; +@@ -1641,8 +1643,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + if (q->streaming && !q->start_streaming_called && + q->queued_count >= q->min_buffers_needed) { + ret = vb2_start_streaming(q); +- if (ret) ++ if (ret) { ++ /* ++ * Since vb2_core_qbuf will return with an error, ++ * we should return it to state DEQUEUED since ++ * the error indicates that the buffer wasn't queued. ++ */ ++ list_del(&vb->queued_entry); ++ q->queued_count--; ++ vb->state = orig_state; + return ret; ++ } + } + + dprintk(2, "qbuf of buffer %d succeeded\n", vb->index); +diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +index 1a36bda285421..0fe71437601e7 100644 +--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c ++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +@@ -37,7 +37,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req) + } else { + /* read */ + requesttype = (USB_TYPE_VENDOR | USB_DIR_IN); +- pipe = usb_rcvctrlpipe(d->udev, 0); ++ ++ /* ++ * Zero-length transfers must use usb_sndctrlpipe() and ++ * rtl28xxu_identify_state() uses a zero-length i2c read ++ * command to determine the chip type. ++ */ ++ if (req->size) ++ pipe = usb_rcvctrlpipe(d->udev, 0); ++ else ++ pipe = usb_sndctrlpipe(d->udev, 0); + } + + ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value, +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 034f1b50ab287..a07d8051ec3e8 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -992,10 +992,11 @@ static int sja1105et_is_fdb_entry_in_bin(struct sja1105_private *priv, int bin, + int sja1105et_fdb_add(struct dsa_switch *ds, int port, + const unsigned char *addr, u16 vid) + { +- struct sja1105_l2_lookup_entry l2_lookup = {0}; ++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp; + struct sja1105_private *priv = ds->priv; + struct device *dev = ds->dev; + int last_unused = -1; ++ int start, end, i; + int bin, way, rc; + + bin = sja1105et_fdb_hash(priv, addr, vid); +@@ -1007,7 +1008,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + * mask? If yes, we need to do nothing. If not, we need + * to rewrite the entry by adding this port to it. + */ +- if (l2_lookup.destports & BIT(port)) ++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds) + return 0; + l2_lookup.destports |= BIT(port); + } else { +@@ -1038,6 +1039,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + index, NULL, false); + } + } ++ l2_lookup.lockeds = true; + l2_lookup.index = sja1105et_fdb_index(bin, way); + + rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, +@@ -1046,6 +1048,29 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + if (rc < 0) + return rc; + ++ /* Invalidate a dynamically learned entry if that exists */ ++ start = sja1105et_fdb_index(bin, 0); ++ end = sja1105et_fdb_index(bin, way); ++ ++ for (i = start; i < end; i++) { ++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, ++ i, &tmp); ++ if (rc == -ENOENT) ++ continue; ++ if (rc) ++ return rc; ++ ++ if (tmp.macaddr != ether_addr_to_u64(addr) || tmp.vlanid != vid) ++ continue; ++ ++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, ++ i, NULL, false); ++ if (rc) ++ return rc; ++ ++ break; ++ } ++ + return sja1105_static_fdb_change(priv, port, &l2_lookup, true); + } + +@@ -1087,7 +1112,7 @@ int sja1105et_fdb_del(struct dsa_switch *ds, int port, + int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + const unsigned char *addr, u16 vid) + { +- struct sja1105_l2_lookup_entry l2_lookup = {0}; ++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp; + struct sja1105_private *priv = ds->priv; + int rc, i; + +@@ -1108,10 +1133,10 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, + SJA1105_SEARCH, &l2_lookup); + if (rc == 0) { +- /* Found and this port is already in the entry's ++ /* Found a static entry and this port is already in the entry's + * port mask => job done + */ +- if (l2_lookup.destports & BIT(port)) ++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds) + return 0; + /* l2_lookup.index is populated by the switch in case it + * found something. +@@ -1134,16 +1159,46 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + dev_err(ds->dev, "FDB is full, cannot add entry.\n"); + return -EINVAL; + } +- l2_lookup.lockeds = true; + l2_lookup.index = i; + + skip_finding_an_index: ++ l2_lookup.lockeds = true; ++ + rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, + l2_lookup.index, &l2_lookup, + true); + if (rc < 0) + return rc; + ++ /* The switch learns dynamic entries and looks up the FDB left to ++ * right. It is possible that our addition was concurrent with the ++ * dynamic learning of the same address, so now that the static entry ++ * has been installed, we are certain that address learning for this ++ * particular address has been turned off, so the dynamic entry either ++ * is in the FDB at an index smaller than the static one, or isn't (it ++ * can also be at a larger index, but in that case it is inactive ++ * because the static FDB entry will match first, and the dynamic one ++ * will eventually age out). Search for a dynamically learned address ++ * prior to our static one and invalidate it. ++ */ ++ tmp = l2_lookup; ++ ++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, ++ SJA1105_SEARCH, &tmp); ++ if (rc < 0) { ++ dev_err(ds->dev, ++ "port %d failed to read back entry for %pM vid %d: %pe\n", ++ port, addr, vid, ERR_PTR(rc)); ++ return rc; ++ } ++ ++ if (tmp.index < l2_lookup.index) { ++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, ++ tmp.index, NULL, false); ++ if (rc < 0) ++ return rc; ++ } ++ + return sja1105_static_fdb_change(priv, port, &l2_lookup, true); + } + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index d10b421ed1f19..9af8afd7ae89d 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2666,7 +2666,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) + } + + /* Allocated memory for FW statistics */ +- if (bnx2x_alloc_fw_stats_mem(bp)) ++ rc = bnx2x_alloc_fw_stats_mem(bp); ++ if (rc) + LOAD_ERROR_EXIT(bp, load_error0); + + /* request pf to initialize status blocks */ +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index b1856552ab813..a53c2d637a971 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3781,13 +3781,13 @@ fec_drv_remove(struct platform_device *pdev) + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +- free_netdev(ndev); + + clk_disable_unprepare(fep->clk_ahb); + clk_disable_unprepare(fep->clk_ipg); + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + ++ free_netdev(ndev); + return 0; + } + +diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c +index 1a2634cbbb691..a653502c5d6f9 100644 +--- a/drivers/net/ethernet/natsemi/natsemi.c ++++ b/drivers/net/ethernet/natsemi/natsemi.c +@@ -819,7 +819,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + printk(version); + #endif + +- i = pci_enable_device(pdev); ++ i = pcim_enable_device(pdev); + if (i) return i; + + /* natsemi has a non-standard PM control register +@@ -852,7 +852,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + ioaddr = ioremap(iostart, iosize); + if (!ioaddr) { + i = -ENOMEM; +- goto err_ioremap; ++ goto err_pci_request_regions; + } + + /* Work around the dropped serial bit. */ +@@ -974,9 +974,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + err_register_netdev: + iounmap(ioaddr); + +- err_ioremap: +- pci_release_regions(pdev); +- + err_pci_request_regions: + free_netdev(dev); + return i; +@@ -3242,7 +3239,6 @@ static void natsemi_remove1(struct pci_dev *pdev) + + NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround); + unregister_netdev (dev); +- pci_release_regions (pdev); + iounmap(ioaddr); + free_netdev (dev); + } +diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c +index 1d334f2e0a568..607e2ff272dc0 100644 +--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c ++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c +@@ -3524,13 +3524,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev) + + kfree(vdev->vpaths); + +- /* we are safe to free it now */ +- free_netdev(dev); +- + vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered", + buf); + vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf, + __func__, __LINE__); ++ ++ /* we are safe to free it now */ ++ free_netdev(dev); + } + + /* +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 17b91ed39369c..2354dec994184 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -266,6 +266,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev, + + /* Init to unknowns */ + ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE); ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + cmd->base.port = PORT_OTHER; + cmd->base.speed = SPEED_UNKNOWN; + cmd->base.duplex = DUPLEX_UNKNOWN; +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 5dc36c51636c4..6ca2216e40585 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -155,7 +155,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev) + "driver lock acquired\n"); + return 1; + } +- ssleep(1); ++ mdelay(1000); + } while (++i < 10); + + netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n"); +@@ -3291,7 +3291,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev) + if ((value & ISP_CONTROL_SR) == 0) + break; + +- ssleep(1); ++ mdelay(1000); + } while ((--max_wait_time)); + + /* +@@ -3327,7 +3327,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev) + ispControlStatus); + if ((value & ISP_CONTROL_FSR) == 0) + break; +- ssleep(1); ++ mdelay(1000); + } while ((--max_wait_time)); + } + if (max_wait_time == 0) +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 663c68ed6ef96..910ab2182158d 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -343,11 +343,11 @@ static int ksz8041_config_aneg(struct phy_device *phydev) + } + + static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, +- const u32 ksz_phy_id) ++ const bool ksz_8051) + { + int ret; + +- if ((phydev->phy_id & MICREL_PHY_ID_MASK) != ksz_phy_id) ++ if ((phydev->phy_id & MICREL_PHY_ID_MASK) != PHY_ID_KSZ8051) + return 0; + + ret = phy_read(phydev, MII_BMSR); +@@ -360,7 +360,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, + * the switch does not. + */ + ret &= BMSR_ERCAP; +- if (ksz_phy_id == PHY_ID_KSZ8051) ++ if (ksz_8051) + return ret; + else + return !ret; +@@ -368,7 +368,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, + + static int ksz8051_match_phy_device(struct phy_device *phydev) + { +- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ8051); ++ return ksz8051_ksz8795_match_phy_device(phydev, true); + } + + static int ksz8081_config_init(struct phy_device *phydev) +@@ -396,7 +396,7 @@ static int ksz8061_config_init(struct phy_device *phydev) + + static int ksz8795_match_phy_device(struct phy_device *phydev) + { +- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ87XX); ++ return ksz8051_ksz8795_match_phy_device(phydev, false); + } + + static int ksz9021_load_values_from_of(struct phy_device *phydev, +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index f7d117d80cfbb..b744c09346a7c 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -747,12 +747,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus) + set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp); + } + +-static inline void get_interrupt_interval(pegasus_t *pegasus) ++static inline int get_interrupt_interval(pegasus_t *pegasus) + { + u16 data; + u8 interval; ++ int ret; ++ ++ ret = read_eprom_word(pegasus, 4, &data); ++ if (ret < 0) ++ return ret; + +- read_eprom_word(pegasus, 4, &data); + interval = data >> 8; + if (pegasus->usb->speed != USB_SPEED_HIGH) { + if (interval < 0x80) { +@@ -767,6 +771,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus) + } + } + pegasus->intr_interval = interval; ++ ++ return 0; + } + + static void set_carrier(struct net_device *net) +@@ -1186,7 +1192,9 @@ static int pegasus_probe(struct usb_interface *intf, + | NETIF_MSG_PROBE | NETIF_MSG_LINK); + + pegasus->features = usb_dev_id[dev_index].private; +- get_interrupt_interval(pegasus); ++ res = get_interrupt_interval(pegasus); ++ if (res) ++ goto out2; + if (reset_mac(pegasus)) { + dev_err(&intf->dev, "can't reset MAC\n"); + res = -EIO; +diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c +index 9d04ca53229b5..4e906910f110b 100644 +--- a/drivers/net/wireless/virt_wifi.c ++++ b/drivers/net/wireless/virt_wifi.c +@@ -136,6 +136,29 @@ static struct ieee80211_supported_band band_5ghz = { + /* Assigned at module init. Guaranteed locally-administered and unicast. */ + static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; + ++static void virt_wifi_inform_bss(struct wiphy *wiphy) ++{ ++ u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); ++ struct cfg80211_bss *informed_bss; ++ static const struct { ++ u8 tag; ++ u8 len; ++ u8 ssid[8]; ++ } __packed ssid = { ++ .tag = WLAN_EID_SSID, ++ .len = 8, ++ .ssid = "VirtWifi", ++ }; ++ ++ informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, ++ CFG80211_BSS_FTYPE_PRESP, ++ fake_router_bssid, tsf, ++ WLAN_CAPABILITY_ESS, 0, ++ (void *)&ssid, sizeof(ssid), ++ DBM_TO_MBM(-50), GFP_KERNEL); ++ cfg80211_put_bss(wiphy, informed_bss); ++} ++ + /* Called with the rtnl lock held. */ + static int virt_wifi_scan(struct wiphy *wiphy, + struct cfg80211_scan_request *request) +@@ -156,28 +179,13 @@ static int virt_wifi_scan(struct wiphy *wiphy, + /* Acquires and releases the rdev BSS lock. */ + static void virt_wifi_scan_result(struct work_struct *work) + { +- struct { +- u8 tag; +- u8 len; +- u8 ssid[8]; +- } __packed ssid = { +- .tag = WLAN_EID_SSID, .len = 8, .ssid = "VirtWifi", +- }; +- struct cfg80211_bss *informed_bss; + struct virt_wifi_wiphy_priv *priv = + container_of(work, struct virt_wifi_wiphy_priv, + scan_result.work); + struct wiphy *wiphy = priv_to_wiphy(priv); + struct cfg80211_scan_info scan_info = { .aborted = false }; +- u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); + +- informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, +- CFG80211_BSS_FTYPE_PRESP, +- fake_router_bssid, tsf, +- WLAN_CAPABILITY_ESS, 0, +- (void *)&ssid, sizeof(ssid), +- DBM_TO_MBM(-50), GFP_KERNEL); +- cfg80211_put_bss(wiphy, informed_bss); ++ virt_wifi_inform_bss(wiphy); + + /* Schedules work which acquires and releases the rtnl lock. */ + cfg80211_scan_done(priv->scan_request, &scan_info); +@@ -225,10 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev, + if (!could_schedule) + return -EBUSY; + +- if (sme->bssid) ++ if (sme->bssid) { + ether_addr_copy(priv->connect_requested_bss, sme->bssid); +- else ++ } else { ++ virt_wifi_inform_bss(wiphy); + eth_zero_addr(priv->connect_requested_bss); ++ } + + wiphy_debug(wiphy, "connect\n"); + +@@ -241,11 +251,13 @@ static void virt_wifi_connect_complete(struct work_struct *work) + struct virt_wifi_netdev_priv *priv = + container_of(work, struct virt_wifi_netdev_priv, connect.work); + u8 *requested_bss = priv->connect_requested_bss; +- bool has_addr = !is_zero_ether_addr(requested_bss); + bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); + u16 status = WLAN_STATUS_SUCCESS; + +- if (!priv->is_up || (has_addr && !right_addr)) ++ if (is_zero_ether_addr(requested_bss)) ++ requested_bss = NULL; ++ ++ if (!priv->is_up || (requested_bss && !right_addr)) + status = WLAN_STATUS_UNSPECIFIED_FAILURE; + else + priv->is_connected = true; +diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c +index 245d60189375a..7a43d4ca79292 100644 +--- a/drivers/pcmcia/i82092.c ++++ b/drivers/pcmcia/i82092.c +@@ -106,6 +106,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i + for (i = 0;i<socket_count;i++) { + sockets[i].card_state = 1; /* 1 = present but empty */ + sockets[i].io_base = pci_resource_start(dev, 0); ++ sockets[i].dev = dev; + sockets[i].socket.features |= SS_CAP_PCCARD; + sockets[i].socket.map_size = 0x1000; + sockets[i].socket.irq_mask = 0; +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 2332b245b182d..279dea628620d 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -219,7 +219,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev) + else if (med->media_event_code == 2) + return DISK_EVENT_MEDIA_CHANGE; + else if (med->media_event_code == 3) +- return DISK_EVENT_EJECT_REQUEST; ++ return DISK_EVENT_MEDIA_CHANGE; + return 0; + } + +diff --git a/drivers/soc/ixp4xx/ixp4xx-npe.c b/drivers/soc/ixp4xx/ixp4xx-npe.c +index ec90b44fa0cd3..6065aaab67403 100644 +--- a/drivers/soc/ixp4xx/ixp4xx-npe.c ++++ b/drivers/soc/ixp4xx/ixp4xx-npe.c +@@ -690,8 +690,8 @@ static int ixp4xx_npe_probe(struct platform_device *pdev) + + if (!(ixp4xx_read_feature_bits() & + (IXP4XX_FEATURE_RESET_NPEA << i))) { +- dev_info(dev, "NPE%d at 0x%08x-0x%08x not available\n", +- i, res->start, res->end); ++ dev_info(dev, "NPE%d at %pR not available\n", ++ i, res); + continue; /* NPE already disabled or not present */ + } + npe->regs = devm_ioremap_resource(dev, res); +@@ -699,13 +699,12 @@ static int ixp4xx_npe_probe(struct platform_device *pdev) + return PTR_ERR(npe->regs); + + if (npe_reset(npe)) { +- dev_info(dev, "NPE%d at 0x%08x-0x%08x does not reset\n", +- i, res->start, res->end); ++ dev_info(dev, "NPE%d at %pR does not reset\n", ++ i, res); + continue; + } + npe->valid = 1; +- dev_info(dev, "NPE%d at 0x%08x-0x%08x registered\n", +- i, res->start, res->end); ++ dev_info(dev, "NPE%d at %pR registered\n", i, res); + found++; + } + +diff --git a/drivers/soc/ixp4xx/ixp4xx-qmgr.c b/drivers/soc/ixp4xx/ixp4xx-qmgr.c +index 8c968382cea76..065a800717bd5 100644 +--- a/drivers/soc/ixp4xx/ixp4xx-qmgr.c ++++ b/drivers/soc/ixp4xx/ixp4xx-qmgr.c +@@ -145,12 +145,12 @@ static irqreturn_t qmgr_irq1_a0(int irq, void *pdev) + /* ACK - it may clear any bits so don't rely on it */ + __raw_writel(0xFFFFFFFF, &qmgr_regs->irqstat[0]); + +- en_bitmap = qmgr_regs->irqen[0]; ++ en_bitmap = __raw_readl(&qmgr_regs->irqen[0]); + while (en_bitmap) { + i = __fls(en_bitmap); /* number of the last "low" queue */ + en_bitmap &= ~BIT(i); +- src = qmgr_regs->irqsrc[i >> 3]; +- stat = qmgr_regs->stat1[i >> 3]; ++ src = __raw_readl(&qmgr_regs->irqsrc[i >> 3]); ++ stat = __raw_readl(&qmgr_regs->stat1[i >> 3]); + if (src & 4) /* the IRQ condition is inverted */ + stat = ~stat; + if (stat & BIT(src & 3)) { +@@ -170,7 +170,8 @@ static irqreturn_t qmgr_irq2_a0(int irq, void *pdev) + /* ACK - it may clear any bits so don't rely on it */ + __raw_writel(0xFFFFFFFF, &qmgr_regs->irqstat[1]); + +- req_bitmap = qmgr_regs->irqen[1] & qmgr_regs->statne_h; ++ req_bitmap = __raw_readl(&qmgr_regs->irqen[1]) & ++ __raw_readl(&qmgr_regs->statne_h); + while (req_bitmap) { + i = __fls(req_bitmap); /* number of the last "high" queue */ + req_bitmap &= ~BIT(i); +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index e237481dbbbbf..474d5a7fa95e3 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -497,8 +497,10 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + struct spi_message *msg) + { + struct spi_device *spi = msg->spi; ++ struct spi_transfer *xfer; + u32 ctrl = MX51_ECSPI_CTRL_ENABLE; +- u32 testreg; ++ u32 min_speed_hz = ~0U; ++ u32 testreg, delay; + u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG); + + /* set Master or Slave mode */ +@@ -559,6 +561,35 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + + writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG); + ++ /* ++ * Wait until the changes in the configuration register CONFIGREG ++ * propagate into the hardware. It takes exactly one tick of the ++ * SCLK clock, but we will wait two SCLK clock just to be sure. The ++ * effect of the delay it takes for the hardware to apply changes ++ * is noticable if the SCLK clock run very slow. In such a case, if ++ * the polarity of SCLK should be inverted, the GPIO ChipSelect might ++ * be asserted before the SCLK polarity changes, which would disrupt ++ * the SPI communication as the device on the other end would consider ++ * the change of SCLK polarity as a clock tick already. ++ * ++ * Because spi_imx->spi_bus_clk is only set in bitbang prepare_message ++ * callback, iterate over all the transfers in spi_message, find the ++ * one with lowest bus frequency, and use that bus frequency for the ++ * delay calculation. In case all transfers have speed_hz == 0, then ++ * min_speed_hz is ~0 and the resulting delay is zero. ++ */ ++ list_for_each_entry(xfer, &msg->transfers, transfer_list) { ++ if (!xfer->speed_hz) ++ continue; ++ min_speed_hz = min(xfer->speed_hz, min_speed_hz); ++ } ++ ++ delay = (2 * 1000000) / min_speed_hz; ++ if (likely(delay < 10)) /* SCLK is faster than 100 kHz */ ++ udelay(delay); ++ else /* SCLK is _very_ slow */ ++ usleep_range(delay, delay + 10); ++ + return 0; + } + +@@ -566,7 +597,7 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + struct spi_device *spi) + { + u32 ctrl = readl(spi_imx->base + MX51_ECSPI_CTRL); +- u32 clk, delay; ++ u32 clk; + + /* Clear BL field and set the right value */ + ctrl &= ~MX51_ECSPI_CTRL_BL_MASK; +@@ -588,23 +619,6 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + + writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL); + +- /* +- * Wait until the changes in the configuration register CONFIGREG +- * propagate into the hardware. It takes exactly one tick of the +- * SCLK clock, but we will wait two SCLK clock just to be sure. The +- * effect of the delay it takes for the hardware to apply changes +- * is noticable if the SCLK clock run very slow. In such a case, if +- * the polarity of SCLK should be inverted, the GPIO ChipSelect might +- * be asserted before the SCLK polarity changes, which would disrupt +- * the SPI communication as the device on the other end would consider +- * the change of SCLK polarity as a clock tick already. +- */ +- delay = (2 * 1000000) / clk; +- if (likely(delay < 10)) /* SCLK is faster than 100 kHz */ +- udelay(delay); +- else /* SCLK is _very_ slow */ +- usleep_range(delay, delay + 10); +- + return 0; + } + +diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c +index f3f10443f9e26..3c841ae0a3e91 100644 +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -597,6 +597,8 @@ static int meson_spicc_remove(struct platform_device *pdev) + + clk_disable_unprepare(spicc->core); + ++ spi_master_put(spicc->master); ++ + return 0; + } + +diff --git a/drivers/staging/rtl8712/rtl8712_led.c b/drivers/staging/rtl8712/rtl8712_led.c +index db99129d31695..4305178243891 100644 +--- a/drivers/staging/rtl8712/rtl8712_led.c ++++ b/drivers/staging/rtl8712/rtl8712_led.c +@@ -1820,3 +1820,11 @@ void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction) + break; + } + } ++ ++void r8712_flush_led_works(struct _adapter *padapter) ++{ ++ struct led_priv *pledpriv = &padapter->ledpriv; ++ ++ flush_work(&pledpriv->SwLed0.BlinkWorkItem); ++ flush_work(&pledpriv->SwLed1.BlinkWorkItem); ++} +diff --git a/drivers/staging/rtl8712/rtl871x_led.h b/drivers/staging/rtl8712/rtl871x_led.h +index ee19c873cf010..2f0768132ad8f 100644 +--- a/drivers/staging/rtl8712/rtl871x_led.h ++++ b/drivers/staging/rtl8712/rtl871x_led.h +@@ -112,6 +112,7 @@ struct led_priv { + void r8712_InitSwLeds(struct _adapter *padapter); + void r8712_DeInitSwLeds(struct _adapter *padapter); + void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction); ++void r8712_flush_led_works(struct _adapter *padapter); + + #endif + +diff --git a/drivers/staging/rtl8712/rtl871x_pwrctrl.c b/drivers/staging/rtl8712/rtl871x_pwrctrl.c +index 23cff43437e21..cd6d9ff0bebca 100644 +--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.c ++++ b/drivers/staging/rtl8712/rtl871x_pwrctrl.c +@@ -224,3 +224,11 @@ void r8712_unregister_cmd_alive(struct _adapter *padapter) + } + mutex_unlock(&pwrctrl->mutex_lock); + } ++ ++void r8712_flush_rwctrl_works(struct _adapter *padapter) ++{ ++ struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv; ++ ++ flush_work(&pwrctrl->SetPSModeWorkItem); ++ flush_work(&pwrctrl->rpwm_workitem); ++} +diff --git a/drivers/staging/rtl8712/rtl871x_pwrctrl.h b/drivers/staging/rtl8712/rtl871x_pwrctrl.h +index dd5a79f90b1a6..6eee6f1bdba4d 100644 +--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.h ++++ b/drivers/staging/rtl8712/rtl871x_pwrctrl.h +@@ -111,5 +111,6 @@ void r8712_cpwm_int_hdl(struct _adapter *padapter, + void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode, + uint smart_ps); + void r8712_set_rpwm(struct _adapter *padapter, u8 val8); ++void r8712_flush_rwctrl_works(struct _adapter *padapter); + + #endif /* __RTL871X_PWRCTRL_H_ */ +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index bc421925e84c2..49188ab046123 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -604,7 +604,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf) + padapter->surprise_removed = true; + if (pnetdev->reg_state != NETREG_UNINITIALIZED) + unregister_netdev(pnetdev); /* will call netdev_close() */ +- flush_scheduled_work(); ++ r8712_flush_rwctrl_works(padapter); ++ r8712_flush_led_works(padapter); + udelay(1); + /* Stop driver mlme relation timer */ + r8712_stop_drv_timers(padapter); +diff --git a/drivers/staging/rtl8723bs/hal/sdio_ops.c b/drivers/staging/rtl8723bs/hal/sdio_ops.c +index 301d327d06244..e6ca03aa6830d 100644 +--- a/drivers/staging/rtl8723bs/hal/sdio_ops.c ++++ b/drivers/staging/rtl8723bs/hal/sdio_ops.c +@@ -1033,6 +1033,8 @@ void sd_int_dpc(struct adapter *adapter) + } else { + rtw_c2h_wk_cmd(adapter, (u8 *)c2h_evt); + } ++ } else { ++ kfree(c2h_evt); + } + } else { + /* Error handling for malloc fail */ +diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c +index ea79482ebda46..4b5069f88d786 100644 +--- a/drivers/tee/optee/call.c ++++ b/drivers/tee/optee/call.c +@@ -407,11 +407,13 @@ void optee_enable_shm_cache(struct optee *optee) + } + + /** +- * optee_disable_shm_cache() - Disables caching of some shared memory allocation +- * in OP-TEE ++ * __optee_disable_shm_cache() - Disables caching of some shared memory ++ * allocation in OP-TEE + * @optee: main service struct ++ * @is_mapped: true if the cached shared memory addresses were mapped by this ++ * kernel, are safe to dereference, and should be freed + */ +-void optee_disable_shm_cache(struct optee *optee) ++static void __optee_disable_shm_cache(struct optee *optee, bool is_mapped) + { + struct optee_call_waiter w; + +@@ -430,6 +432,13 @@ void optee_disable_shm_cache(struct optee *optee) + if (res.result.status == OPTEE_SMC_RETURN_OK) { + struct tee_shm *shm; + ++ /* ++ * Shared memory references that were not mapped by ++ * this kernel must be ignored to prevent a crash. ++ */ ++ if (!is_mapped) ++ continue; ++ + shm = reg_pair_to_ptr(res.result.shm_upper32, + res.result.shm_lower32); + tee_shm_free(shm); +@@ -440,6 +449,27 @@ void optee_disable_shm_cache(struct optee *optee) + optee_cq_wait_final(&optee->call_queue, &w); + } + ++/** ++ * optee_disable_shm_cache() - Disables caching of mapped shared memory ++ * allocations in OP-TEE ++ * @optee: main service struct ++ */ ++void optee_disable_shm_cache(struct optee *optee) ++{ ++ return __optee_disable_shm_cache(optee, true); ++} ++ ++/** ++ * optee_disable_unmapped_shm_cache() - Disables caching of shared memory ++ * allocations in OP-TEE which are not ++ * currently mapped ++ * @optee: main service struct ++ */ ++void optee_disable_unmapped_shm_cache(struct optee *optee) ++{ ++ return __optee_disable_shm_cache(optee, false); ++} ++ + #define PAGELIST_ENTRIES_PER_PAGE \ + ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1) + +diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c +index ba6cfba589a69..432dd38921dd9 100644 +--- a/drivers/tee/optee/core.c ++++ b/drivers/tee/optee/core.c +@@ -628,6 +628,15 @@ static struct optee *optee_probe(struct device_node *np) + optee->memremaped_shm = memremaped_shm; + optee->pool = pool; + ++ /* ++ * Ensure that there are no pre-existing shm objects before enabling ++ * the shm cache so that there's no chance of receiving an invalid ++ * address during shutdown. This could occur, for example, if we're ++ * kexec booting from an older kernel that did not properly cleanup the ++ * shm cache. ++ */ ++ optee_disable_unmapped_shm_cache(optee); ++ + optee_enable_shm_cache(optee); + + if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM) +diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h +index d9c5037b4e03e..3eeaad2a28686 100644 +--- a/drivers/tee/optee/optee_private.h ++++ b/drivers/tee/optee/optee_private.h +@@ -152,6 +152,7 @@ int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session); + + void optee_enable_shm_cache(struct optee *optee); + void optee_disable_shm_cache(struct optee *optee); ++void optee_disable_unmapped_shm_cache(struct optee *optee); + + int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm, + struct page **pages, size_t num_pages, +diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c +index d767eebf30bdd..da06ce9b9313e 100644 +--- a/drivers/tee/optee/shm_pool.c ++++ b/drivers/tee/optee/shm_pool.c +@@ -32,8 +32,10 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, + struct page **pages; + + pages = kcalloc(nr_pages, sizeof(pages), GFP_KERNEL); +- if (!pages) +- return -ENOMEM; ++ if (!pages) { ++ rc = -ENOMEM; ++ goto err; ++ } + + for (i = 0; i < nr_pages; i++) { + pages[i] = page; +@@ -44,8 +46,14 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, + rc = optee_shm_register(shm->ctx, shm, pages, nr_pages, + (unsigned long)shm->kaddr); + kfree(pages); ++ if (rc) ++ goto err; + } + ++ return 0; ++ ++err: ++ __free_pages(page, order); + return rc; + } + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 09ddcd06c7152..1b4b4a1ba91d9 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -219,6 +219,24 @@ struct tee_shm *tee_shm_priv_alloc(struct tee_device *teedev, size_t size) + } + EXPORT_SYMBOL_GPL(tee_shm_priv_alloc); + ++/** ++ * tee_shm_alloc_kernel_buf() - Allocate shared memory for kernel buffer ++ * @ctx: Context that allocates the shared memory ++ * @size: Requested size of shared memory ++ * ++ * The returned memory registered in secure world and is suitable to be ++ * passed as a memory buffer in parameter argument to ++ * tee_client_invoke_func(). The memory allocated is later freed with a ++ * call to tee_shm_free(). ++ * ++ * @returns a pointer to 'struct tee_shm' ++ */ ++struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size) ++{ ++ return tee_shm_alloc(ctx, size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF); ++} ++EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf); ++ + struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, + size_t length, u32 flags) + { +diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c +index e9eb454c24728..98e68f25a5f34 100644 +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -92,10 +92,13 @@ static void mtk8250_dma_rx_complete(void *param) + struct dma_tx_state state; + int copied, total, cnt; + unsigned char *ptr; ++ unsigned long flags; + + if (data->rx_status == DMA_RX_SHUTDOWN) + return; + ++ spin_lock_irqsave(&up->port.lock, flags); ++ + dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state); + total = dma->rx_size - state.residue; + cnt = total; +@@ -119,6 +122,8 @@ static void mtk8250_dma_rx_complete(void *param) + tty_flip_buffer_push(tty_port); + + mtk8250_rx_dma(up); ++ ++ spin_unlock_irqrestore(&up->port.lock, flags); + } + + static void mtk8250_rx_dma(struct uart_8250_port *up) +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 51346ca91c45c..43fc5b6a25d35 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -3763,6 +3763,12 @@ static const struct pci_device_id blacklist[] = { + { PCI_VDEVICE(INTEL, 0x0f0c), }, + { PCI_VDEVICE(INTEL, 0x228a), }, + { PCI_VDEVICE(INTEL, 0x228c), }, ++ { PCI_VDEVICE(INTEL, 0x4b96), }, ++ { PCI_VDEVICE(INTEL, 0x4b97), }, ++ { PCI_VDEVICE(INTEL, 0x4b98), }, ++ { PCI_VDEVICE(INTEL, 0x4b99), }, ++ { PCI_VDEVICE(INTEL, 0x4b9a), }, ++ { PCI_VDEVICE(INTEL, 0x4b9b), }, + { PCI_VDEVICE(INTEL, 0x9ce3), }, + { PCI_VDEVICE(INTEL, 0x9ce4), }, + +@@ -3923,6 +3929,7 @@ pciserial_init_ports(struct pci_dev *dev, const struct pciserial_board *board) + if (pci_match_id(pci_use_msi, dev)) { + dev_dbg(&dev->dev, "Using MSI(-X) interrupts\n"); + pci_set_master(dev); ++ uart.port.flags &= ~UPF_SHARE_IRQ; + rc = pci_alloc_irq_vectors(dev, 1, 1, PCI_IRQ_ALL_TYPES); + } else { + dev_dbg(&dev->dev, "Using legacy interrupts\n"); +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 6e93aa3623d9b..8a7c6d65f10ef 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -314,7 +314,11 @@ static const struct serial8250_config uart_config[] = { + /* Uart divisor latch read */ + static int default_serial_dl_read(struct uart_8250_port *up) + { +- return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8; ++ /* Assign these in pieces to truncate any bits above 7. */ ++ unsigned char dll = serial_in(up, UART_DLL); ++ unsigned char dlm = serial_in(up, UART_DLM); ++ ++ return dll | dlm << 8; + } + + /* Uart divisor latch write */ +@@ -1258,9 +1262,11 @@ static void autoconfig(struct uart_8250_port *up) + serial_out(up, UART_LCR, 0); + + serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO); +- scratch = serial_in(up, UART_IIR) >> 6; + +- switch (scratch) { ++ /* Assign this as it is to truncate any bits above 7. */ ++ scratch = serial_in(up, UART_IIR); ++ ++ switch (scratch >> 6) { + case 0: + autoconfig_8250(up); + break; +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 2007a40feef9d..64f18bf1e694a 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1028,9 +1028,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + + if (tup->cdata->fifo_mode_enable_status) { + ret = tegra_uart_wait_fifo_mode_enabled(tup); +- dev_err(tup->uport.dev, "FIFO mode not enabled\n"); +- if (ret < 0) ++ if (ret < 0) { ++ dev_err(tup->uport.dev, ++ "Failed to enable FIFO mode: %d\n", ret); + return ret; ++ } + } else { + /* + * For all tegra devices (up to t210), there is a hardware +diff --git a/drivers/usb/cdns3/ep0.c b/drivers/usb/cdns3/ep0.c +index 666cebd9c5f29..390779e2294d9 100644 +--- a/drivers/usb/cdns3/ep0.c ++++ b/drivers/usb/cdns3/ep0.c +@@ -736,6 +736,7 @@ static int cdns3_gadget_ep0_queue(struct usb_ep *ep, + request->actual = 0; + priv_dev->status_completion_no_call = true; + priv_dev->pending_status_request = request; ++ usb_gadget_set_state(&priv_dev->gadget, USB_STATE_CONFIGURED); + spin_unlock_irqrestore(&priv_dev->lock, flags); + + /* +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index dcd7066ffba22..3922a6f8c50a6 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -2285,17 +2285,10 @@ static void usbtmc_interrupt(struct urb *urb) + dev_err(dev, "overflow with length %d, actual length is %d\n", + data->iin_wMaxPacketSize, urb->actual_length); + /* fall through */ +- case -ECONNRESET: +- case -ENOENT: +- case -ESHUTDOWN: +- case -EILSEQ: +- case -ETIME: +- case -EPIPE: ++ default: + /* urb terminated, clean up */ + dev_dbg(dev, "urb terminated, status: %d\n", status); + return; +- default: +- dev_err(dev, "unknown status received: %d\n", status); + } + exit: + rv = usb_submit_urb(urb, GFP_ATOMIC); +diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c +index 3740cf95560e9..0697fde51d00f 100644 +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct otg_fsm *fsm) + if (!fsm->host_req_flag) + return; + +- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ if (!fsm->hnp_work_inited) { ++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ fsm->hnp_work_inited = true; ++ } ++ + schedule_delayed_work(&fsm->hnp_polling_work, + msecs_to_jiffies(T_HOST_REQ_POLL)); + } +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 3d540b0d93687..e4d71410a4b1c 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -41,6 +41,7 @@ struct f_hidg { + unsigned char bInterfaceSubClass; + unsigned char bInterfaceProtocol; + unsigned char protocol; ++ unsigned char idle; + unsigned short report_desc_length; + char *report_desc; + unsigned short report_length; +@@ -344,6 +345,11 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, + + spin_lock_irqsave(&hidg->write_spinlock, flags); + ++ if (!hidg->req) { ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ return -ESHUTDOWN; ++ } ++ + #define WRITE_COND (!hidg->write_pending) + try_again: + /* write queue */ +@@ -364,8 +370,14 @@ try_again: + count = min_t(unsigned, count, hidg->report_length); + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); +- status = copy_from_user(req->buf, buffer, count); + ++ if (!req) { ++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ ++ status = copy_from_user(req->buf, buffer, count); + if (status != 0) { + ERROR(hidg->func.config->cdev, + "copy_from_user error\n"); +@@ -393,14 +405,17 @@ try_again: + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + ++ if (!hidg->in_ep->enabled) { ++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ + status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); +- if (status < 0) { +- ERROR(hidg->func.config->cdev, +- "usb_ep_queue error on int endpoint %zd\n", status); ++ if (status < 0) + goto release_write_pending; +- } else { ++ else + status = count; +- } + + return status; + release_write_pending: +@@ -529,6 +544,14 @@ static int hidg_setup(struct usb_function *f, + goto respond; + break; + ++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_GET_IDLE): ++ VDBG(cdev, "get_idle\n"); ++ length = min_t(unsigned int, length, 1); ++ ((u8 *) req->buf)[0] = hidg->idle; ++ goto respond; ++ break; ++ + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 + | HID_REQ_SET_REPORT): + VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength); +@@ -552,6 +575,14 @@ static int hidg_setup(struct usb_function *f, + goto stall; + break; + ++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_SET_IDLE): ++ VDBG(cdev, "set_idle\n"); ++ length = 0; ++ hidg->idle = value >> 8; ++ goto respond; ++ break; ++ + case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8 + | USB_REQ_GET_DESCRIPTOR): + switch (value >> 8) { +@@ -779,6 +810,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; + hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; + hidg->protocol = HID_REPORT_PROTOCOL; ++ hidg->idle = 1; + hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); + hidg_ss_in_comp_desc.wBytesPerInterval = + cpu_to_le16(hidg->report_length); +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index a82ba9cc0c724..e9c39a41faae9 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -678,6 +678,7 @@ static struct usb_serial_driver ch341_device = { + .owner = THIS_MODULE, + .name = "ch341-uart", + }, ++ .bulk_in_size = 512, + .id_table = id_table, + .num_ports = 1, + .open = ch341_open, +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 6bd1a2f6cbd0a..1ec623e46214b 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -219,6 +219,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) }, + { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_AUTO_M3_OP_COM_V2_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index add602bebd820..755858ca20bac 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -159,6 +159,9 @@ + /* Vardaan Enterprises Serial Interface VEUSB422R3 */ + #define FTDI_VARDAAN_PID 0xF070 + ++/* Auto-M3 Ltd. - OP-COM USB V2 - OBD interface Adapter */ ++#define FTDI_AUTO_M3_OP_COM_V2_PID 0x4f50 ++ + /* + * Xsens Technologies BV products (http://www.xsens.com). + */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index d6d10ba1e1e80..793530f241ceb 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1203,6 +1203,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 4c37abe768512..9905720df9248 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2407,7 +2407,7 @@ again: + goto journal_error; + err = ext4_handle_dirty_dx_node(handle, dir, + frame->bh); +- if (err) ++ if (restart || err) + goto journal_error; + } else { + struct dx_root *dxroot; +diff --git a/fs/pipe.c b/fs/pipe.c +index 8a2ab2f974bd4..30a43b1956742 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -30,6 +30,21 @@ + + #include "internal.h" + ++/* ++ * New pipe buffers will be restricted to this size while the user is exceeding ++ * their pipe buffer quota. The general pipe use case needs at least two ++ * buffers: one for data yet to be read, and one for new data. If this is less ++ * than two, then a write to a non-empty pipe may block even if the pipe is not ++ * full. This can occur with GNU make jobserver or similar uses of pipes as ++ * semaphores: multiple processes may be waiting to write tokens back to the ++ * pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/. ++ * ++ * Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their ++ * own risk, namely: pipe writes to non-full pipes may block until the pipe is ++ * emptied. ++ */ ++#define PIPE_MIN_DEF_BUFFERS 2 ++ + /* + * The max size that a non-root user is allowed to grow the pipe. Can + * be set by root in /proc/sys/fs/pipe-max-size +@@ -666,8 +681,8 @@ struct pipe_inode_info *alloc_pipe_info(void) + user_bufs = account_pipe_buffers(user, 0, pipe_bufs); + + if (too_many_pipe_buffers_soft(user_bufs) && is_unprivileged_user()) { +- user_bufs = account_pipe_buffers(user, pipe_bufs, 1); +- pipe_bufs = 1; ++ user_bufs = account_pipe_buffers(user, pipe_bufs, PIPE_MIN_DEF_BUFFERS); ++ pipe_bufs = PIPE_MIN_DEF_BUFFERS; + } + + if (too_many_pipe_buffers_hard(user_bufs) && is_unprivileged_user()) +diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c +index 9e64e23014e8e..07d787145cc36 100644 +--- a/fs/reiserfs/stree.c ++++ b/fs/reiserfs/stree.c +@@ -387,6 +387,24 @@ void pathrelse(struct treepath *search_path) + search_path->path_length = ILLEGAL_PATH_ELEMENT_OFFSET; + } + ++static int has_valid_deh_location(struct buffer_head *bh, struct item_head *ih) ++{ ++ struct reiserfs_de_head *deh; ++ int i; ++ ++ deh = B_I_DEH(bh, ih); ++ for (i = 0; i < ih_entry_count(ih); i++) { ++ if (deh_location(&deh[i]) > ih_item_len(ih)) { ++ reiserfs_warning(NULL, "reiserfs-5094", ++ "directory entry location seems wrong %h", ++ &deh[i]); ++ return 0; ++ } ++ } ++ ++ return 1; ++} ++ + static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) + { + struct block_head *blkh; +@@ -454,11 +472,14 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) + "(second one): %h", ih); + return 0; + } +- if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) { +- reiserfs_warning(NULL, "reiserfs-5093", +- "item entry count seems wrong %h", +- ih); +- return 0; ++ if (is_direntry_le_ih(ih)) { ++ if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) { ++ reiserfs_warning(NULL, "reiserfs-5093", ++ "item entry count seems wrong %h", ++ ih); ++ return 0; ++ } ++ return has_valid_deh_location(bh, ih); + } + prev_location = ih_location(ih); + } +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index 1b9c7a387dc71..913f5af9bf248 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -2082,6 +2082,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent) + unlock_new_inode(root_inode); + } + ++ if (!S_ISDIR(root_inode->i_mode) || !inode_get_bytes(root_inode) || ++ !root_inode->i_size) { ++ SWARN(silent, s, "", "corrupt root inode, run fsck"); ++ iput(root_inode); ++ errval = -EUCLEAN; ++ goto error; ++ } ++ + s->s_root = d_make_root(root_inode); + if (!s->s_root) + goto error; +diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h +index 7a03f68fb982d..91677f2fa2e8b 100644 +--- a/include/linux/tee_drv.h ++++ b/include/linux/tee_drv.h +@@ -317,6 +317,7 @@ void *tee_get_drvdata(struct tee_device *teedev); + * @returns a pointer to 'struct tee_shm' + */ + struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags); ++struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size); + + /** + * tee_shm_priv_alloc() - Allocate shared memory privately +diff --git a/include/linux/usb/otg-fsm.h b/include/linux/usb/otg-fsm.h +index e78eb577d0fa1..8ef7d148c1493 100644 +--- a/include/linux/usb/otg-fsm.h ++++ b/include/linux/usb/otg-fsm.h +@@ -196,6 +196,7 @@ struct otg_fsm { + struct mutex lock; + u8 *host_req_flag; + struct delayed_work hnp_polling_work; ++ bool hnp_work_inited; + bool state_changed; + }; + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 325e8efb5b368..14d00cc10e22e 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1056,6 +1056,7 @@ struct hci_dev *hci_alloc_dev(void); + void hci_free_dev(struct hci_dev *hdev); + int hci_register_dev(struct hci_dev *hdev); + void hci_unregister_dev(struct hci_dev *hdev); ++void hci_cleanup_dev(struct hci_dev *hdev); + int hci_suspend_dev(struct hci_dev *hdev); + int hci_resume_dev(struct hci_dev *hdev); + int hci_reset_dev(struct hci_dev *hdev); +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index feeecbc80e727..2c739fc752e1a 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -263,7 +263,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + + static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb) + { +- int mtu; ++ unsigned int mtu; + + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? + inet6_sk(skb->sk) : NULL; +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 87fa73cdb90f6..16a2b62f5f74c 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1269,8 +1269,10 @@ static inline void timer_base_unlock_expiry(struct timer_base *base) + static void timer_sync_wait_running(struct timer_base *base) + { + if (atomic_read(&base->timer_waiters)) { ++ raw_spin_unlock_irq(&base->lock); + spin_unlock(&base->expiry_lock); + spin_lock(&base->expiry_lock); ++ raw_spin_lock_irq(&base->lock); + } + } + +@@ -1454,14 +1456,14 @@ static void expire_timers(struct timer_base *base, struct hlist_head *head) + if (timer->flags & TIMER_IRQSAFE) { + raw_spin_unlock(&base->lock); + call_timer_fn(timer, fn, baseclk); +- base->running_timer = NULL; + raw_spin_lock(&base->lock); ++ base->running_timer = NULL; + } else { + raw_spin_unlock_irq(&base->lock); + call_timer_fn(timer, fn, baseclk); ++ raw_spin_lock_irq(&base->lock); + base->running_timer = NULL; + timer_sync_wait_running(base); +- raw_spin_lock_irq(&base->lock); + } + } + } +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 553add1eb457f..db2b10c718ba2 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -3169,6 +3169,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data, + + expr->operands[0] = operand1; + expr->operands[1] = operand2; ++ ++ /* The operand sizes should be the same, so just pick one */ ++ expr->size = operand1->size; ++ + expr->operator = field_op; + expr->name = expr_str(expr, 0); + expr->type = kstrdup(operand1->type, GFP_KERNEL); +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 21a7ea9b70c8a..83a07fca9000f 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3393,14 +3393,10 @@ EXPORT_SYMBOL(hci_register_dev); + /* Unregister HCI device */ + void hci_unregister_dev(struct hci_dev *hdev) + { +- int id; +- + BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); + + hci_dev_set_flag(hdev, HCI_UNREGISTER); + +- id = hdev->id; +- + write_lock(&hci_dev_list_lock); + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); +@@ -3429,7 +3425,14 @@ void hci_unregister_dev(struct hci_dev *hdev) + } + + device_del(&hdev->dev); ++ /* Actual cleanup is deferred until hci_cleanup_dev(). */ ++ hci_dev_put(hdev); ++} ++EXPORT_SYMBOL(hci_unregister_dev); + ++/* Cleanup HCI device */ ++void hci_cleanup_dev(struct hci_dev *hdev) ++{ + debugfs_remove_recursive(hdev->debugfs); + kfree_const(hdev->hw_info); + kfree_const(hdev->fw_info); +@@ -3452,11 +3455,8 @@ void hci_unregister_dev(struct hci_dev *hdev) + hci_discovery_filter_clear(hdev); + hci_dev_unlock(hdev); + +- hci_dev_put(hdev); +- +- ida_simple_remove(&hci_index_ida, id); ++ ida_simple_remove(&hci_index_ida, hdev->id); + } +-EXPORT_SYMBOL(hci_unregister_dev); + + /* Suspend HCI device */ + int hci_suspend_dev(struct hci_dev *hdev) +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 8d2c26c4b6d3d..befab857a39be 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -59,6 +59,17 @@ struct hci_pinfo { + char comm[TASK_COMM_LEN]; + }; + ++static struct hci_dev *hci_hdev_from_sock(struct sock *sk) ++{ ++ struct hci_dev *hdev = hci_pi(sk)->hdev; ++ ++ if (!hdev) ++ return ERR_PTR(-EBADFD); ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ return ERR_PTR(-EPIPE); ++ return hdev; ++} ++ + void hci_sock_set_flag(struct sock *sk, int nr) + { + set_bit(nr, &hci_pi(sk)->flags); +@@ -752,19 +763,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) + if (event == HCI_DEV_UNREG) { + struct sock *sk; + +- /* Detach sockets from device */ ++ /* Wake up sockets using this dead device */ + read_lock(&hci_sk_list.lock); + sk_for_each(sk, &hci_sk_list.head) { +- lock_sock(sk); + if (hci_pi(sk)->hdev == hdev) { +- hci_pi(sk)->hdev = NULL; + sk->sk_err = EPIPE; +- sk->sk_state = BT_OPEN; + sk->sk_state_change(sk); +- +- hci_dev_put(hdev); + } +- release_sock(sk); + } + read_unlock(&hci_sk_list.lock); + } +@@ -923,10 +928,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg) + static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, + unsigned long arg) + { +- struct hci_dev *hdev = hci_pi(sk)->hdev; ++ struct hci_dev *hdev = hci_hdev_from_sock(sk); + +- if (!hdev) +- return -EBADFD; ++ if (IS_ERR(hdev)) ++ return PTR_ERR(hdev); + + if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) + return -EBUSY; +@@ -1080,6 +1085,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + ++ /* Allow detaching from dead device and attaching to alive device, if ++ * the caller wants to re-bind (instead of close) this socket in ++ * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. ++ */ ++ hdev = hci_pi(sk)->hdev; ++ if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { ++ hci_pi(sk)->hdev = NULL; ++ sk->sk_state = BT_OPEN; ++ hci_dev_put(hdev); ++ } ++ hdev = NULL; ++ + if (sk->sk_state == BT_BOUND) { + err = -EALREADY; + goto done; +@@ -1356,9 +1373,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +@@ -1718,9 +1735,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, + goto done; + } + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c +index 9874844a95a98..b69d88b88d2e4 100644 +--- a/net/bluetooth/hci_sysfs.c ++++ b/net/bluetooth/hci_sysfs.c +@@ -83,6 +83,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn) + static void bt_host_release(struct device *dev) + { + struct hci_dev *hdev = to_hci_dev(dev); ++ ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ hci_cleanup_dev(hdev); + kfree(hdev); + module_put(THIS_MODULE); + } +diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c +index e09147ac9a990..fc61cd3fea652 100644 +--- a/net/ipv4/tcp_offload.c ++++ b/net/ipv4/tcp_offload.c +@@ -298,6 +298,9 @@ int tcp_gro_complete(struct sk_buff *skb) + if (th->cwr) + skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN; + ++ if (skb->encapsulation) ++ skb->inner_transport_header = skb->transport_header; ++ + return 0; + } + EXPORT_SYMBOL(tcp_gro_complete); +diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c +index c463eebdc8fe2..487a92d75c703 100644 +--- a/net/ipv4/udp_offload.c ++++ b/net/ipv4/udp_offload.c +@@ -501,6 +501,10 @@ static int udp_gro_complete_segment(struct sk_buff *skb) + + skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count; + skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_L4; ++ ++ if (skb->encapsulation) ++ skb->inner_transport_header = skb->transport_header; ++ + return 0; + } + +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index 7eced1e523a5e..3b2d0bd616dd4 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -863,14 +863,18 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, + memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength); + cur_key->key = key; + +- if (replace) { +- list_del_init(&shkey->key_list); +- sctp_auth_shkey_release(shkey); +- if (asoc && asoc->active_key_id == auth_key->sca_keynumber) +- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ if (!replace) { ++ list_add(&cur_key->key_list, sh_keys); ++ return 0; + } ++ ++ list_del_init(&shkey->key_list); ++ sctp_auth_shkey_release(shkey); + list_add(&cur_key->key_list, sh_keys); + ++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber) ++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ + return 0; + } + +diff --git a/scripts/tracing/draw_functrace.py b/scripts/tracing/draw_functrace.py +index 74f8aadfd4cbc..7011fbe003ff2 100755 +--- a/scripts/tracing/draw_functrace.py ++++ b/scripts/tracing/draw_functrace.py +@@ -17,7 +17,7 @@ Usage: + $ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func + Wait some times but not too much, the script is a bit slow. + Break the pipe (Ctrl + Z) +- $ scripts/draw_functrace.py < raw_trace_func > draw_functrace ++ $ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace + Then you have your drawn trace in draw_functrace + """ + +@@ -103,10 +103,10 @@ def parseLine(line): + line = line.strip() + if line.startswith("#"): + raise CommentLineException +- m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line) ++ m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line) + if m is None: + raise BrokenLineException +- return (m.group(1), m.group(2), m.group(3)) ++ return (m.group(2), m.group(3), m.group(4)) + + + def main(): +diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c +index 83be6b982a87c..97e8eb38b0961 100644 +--- a/sound/core/seq/seq_ports.c ++++ b/sound/core/seq/seq_ports.c +@@ -514,10 +514,11 @@ static int check_and_subscribe_port(struct snd_seq_client *client, + return err; + } + +-static void delete_and_unsubscribe_port(struct snd_seq_client *client, +- struct snd_seq_client_port *port, +- struct snd_seq_subscribers *subs, +- bool is_src, bool ack) ++/* called with grp->list_mutex held */ ++static void __delete_and_unsubscribe_port(struct snd_seq_client *client, ++ struct snd_seq_client_port *port, ++ struct snd_seq_subscribers *subs, ++ bool is_src, bool ack) + { + struct snd_seq_port_subs_info *grp; + struct list_head *list; +@@ -525,7 +526,6 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, + + grp = is_src ? &port->c_src : &port->c_dest; + list = is_src ? &subs->src_list : &subs->dest_list; +- down_write(&grp->list_mutex); + write_lock_irq(&grp->list_lock); + empty = list_empty(list); + if (!empty) +@@ -535,6 +535,18 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, + + if (!empty) + unsubscribe_port(client, port, grp, &subs->info, ack); ++} ++ ++static void delete_and_unsubscribe_port(struct snd_seq_client *client, ++ struct snd_seq_client_port *port, ++ struct snd_seq_subscribers *subs, ++ bool is_src, bool ack) ++{ ++ struct snd_seq_port_subs_info *grp; ++ ++ grp = is_src ? &port->c_src : &port->c_dest; ++ down_write(&grp->list_mutex); ++ __delete_and_unsubscribe_port(client, port, subs, is_src, ack); + up_write(&grp->list_mutex); + } + +@@ -590,27 +602,30 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector, + struct snd_seq_client_port *dest_port, + struct snd_seq_port_subscribe *info) + { +- struct snd_seq_port_subs_info *src = &src_port->c_src; ++ struct snd_seq_port_subs_info *dest = &dest_port->c_dest; + struct snd_seq_subscribers *subs; + int err = -ENOENT; + +- down_write(&src->list_mutex); ++ /* always start from deleting the dest port for avoiding concurrent ++ * deletions ++ */ ++ down_write(&dest->list_mutex); + /* look for the connection */ +- list_for_each_entry(subs, &src->list_head, src_list) { ++ list_for_each_entry(subs, &dest->list_head, dest_list) { + if (match_subs_info(info, &subs->info)) { +- atomic_dec(&subs->ref_count); /* mark as not ready */ ++ __delete_and_unsubscribe_port(dest_client, dest_port, ++ subs, false, ++ connector->number != dest_client->number); + err = 0; + break; + } + } +- up_write(&src->list_mutex); ++ up_write(&dest->list_mutex); + if (err < 0) + return err; + + delete_and_unsubscribe_port(src_client, src_port, subs, true, + connector->number != src_client->number); +- delete_and_unsubscribe_port(dest_client, dest_port, subs, false, +- connector->number != dest_client->number); + kfree(subs); + return 0; + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f5606036b6a29..a0d1561eeb532 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7971,6 +7971,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index 6a51b9d20eebf..3d1c0ec117536 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -319,6 +319,12 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, + selector->baCSourceID[ret - 1], + visited, validate); + if (ret > 0) { ++ /* ++ * For Samsung USBC Headset (AKG), setting clock selector again ++ * will result in incorrect default clock setting problems ++ */ ++ if (chip->usb_id == USB_ID(0x04e8, 0xa051)) ++ return ret; + err = uac_clock_selector_set_val(chip, entity_id, cur); + if (err < 0) + return err; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 5b17a5c5785c0..4d20f3f45f7e2 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1842,6 +1842,7 @@ static const struct registration_quirk registration_quirks[] = { + REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ + REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ ++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ + { 0 } /* terminator */ + }; +diff --git a/tools/testing/selftests/bpf/verifier/stack_ptr.c b/tools/testing/selftests/bpf/verifier/stack_ptr.c +index 7276620ef242a..53d2a5a5ec582 100644 +--- a/tools/testing/selftests/bpf/verifier/stack_ptr.c ++++ b/tools/testing/selftests/bpf/verifier/stack_ptr.c +@@ -291,8 +291,6 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), + BPF_EXIT_INSN(), + }, +- .result_unpriv = REJECT, +- .errstr_unpriv = "invalid stack off=0 size=1", + .result = ACCEPT, + .retval = 42, + }, +diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +index a8dab0f58462e..188ac92c56d1b 100644 +--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c ++++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +@@ -301,8 +301,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -372,8 +370,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -473,8 +469,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -767,8 +761,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 862c0708f58df..fc48298649c6c 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -635,6 +635,8 @@ static void kvm_destroy_vm_debugfs(struct kvm *kvm) + + static int kvm_create_vm_debugfs(struct kvm *kvm, int fd) + { ++ static DEFINE_MUTEX(kvm_debugfs_lock); ++ struct dentry *dent; + char dir_name[ITOA_MAX_LEN * 2]; + struct kvm_stat_data *stat_data; + struct kvm_stats_debugfs_item *p; +@@ -643,8 +645,20 @@ static int kvm_create_vm_debugfs(struct kvm *kvm, int fd) + return 0; + + snprintf(dir_name, sizeof(dir_name), "%d-%d", task_pid_nr(current), fd); +- kvm->debugfs_dentry = debugfs_create_dir(dir_name, kvm_debugfs_dir); ++ mutex_lock(&kvm_debugfs_lock); ++ dent = debugfs_lookup(dir_name, kvm_debugfs_dir); ++ if (dent) { ++ pr_warn_ratelimited("KVM: debugfs: duplicate directory %s\n", dir_name); ++ dput(dent); ++ mutex_unlock(&kvm_debugfs_lock); ++ return 0; ++ } ++ dent = debugfs_create_dir(dir_name, kvm_debugfs_dir); ++ mutex_unlock(&kvm_debugfs_lock); ++ if (IS_ERR(dent)) ++ return 0; + ++ kvm->debugfs_dentry = dent; + kvm->debugfs_stat_data = kcalloc(kvm_debugfs_num_entries, + sizeof(*kvm->debugfs_stat_data), + GFP_KERNEL_ACCOUNT); +@@ -4367,7 +4381,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) + } + add_uevent_var(env, "PID=%d", kvm->userspace_pid); + +- if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) { ++ if (kvm->debugfs_dentry) { + char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT); + + if (p) {
