diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch new file mode 100644 index 000000000..4d1e82964 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch @@ -0,0 +1,1471 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index b11e1fd95ee5f..e7f71df9daf1c 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -2112,8 +2112,12 @@ + Default is 1 (enabled) + + kvm-intel.emulate_invalid_guest_state= +- [KVM,Intel] Enable emulation of invalid guest states +- Default is 0 (disabled) ++ [KVM,Intel] Disable emulation of invalid guest state. ++ Ignored if kvm-intel.enable_unrestricted_guest=1, as ++ guest state is never invalid for unrestricted guests. ++ This param doesn't apply to nested guests (L2), as KVM ++ never emulates invalid L2 guest state. ++ Default is 1 (enabled) + + kvm-intel.flexpriority= + [KVM,Intel] Disable FlexPriority feature (TPR shadow). +diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst +index 953315987c06e..03851cbe637ce 100644 +--- a/Documentation/hwmon/lm90.rst ++++ b/Documentation/hwmon/lm90.rst +@@ -123,6 +123,18 @@ Supported chips: + + http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497 + ++ * Maxim MAX6654 ++ ++ Prefix: 'max6654' ++ ++ Addresses scanned: I2C 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, ++ ++ 0x4c, 0x4d and 0x4e ++ ++ Datasheet: Publicly available at the Maxim website ++ ++ https://www.maximintegrated.com/en/products/sensors/MAX6654.html ++ + * Maxim MAX6657 + + Prefix: 'max6657' +@@ -253,6 +265,16 @@ Supported chips: + + http://www.ti.com/litv/pdf/sbos686 + ++ * Texas Instruments TMP461 ++ ++ Prefix: 'tmp461' ++ ++ Addresses scanned: I2C 0x48 through 0x4F ++ ++ Datasheet: Publicly available at TI website ++ ++ https://www.ti.com/lit/gpn/tmp461 ++ + Author: Jean Delvare + + +@@ -301,6 +323,13 @@ ADT7461, ADT7461A, NCT1008: + * Extended temperature range (breaks compatibility) + * Lower resolution for remote temperature + ++MAX6654: ++ * Better local resolution ++ * Selectable address ++ * Remote sensor type selection ++ * Extended temperature range ++ * Extended resolution only available when conversion rate <= 1 Hz ++ + MAX6657 and MAX6658: + * Better local resolution + * Remote sensor type selection +@@ -336,8 +365,8 @@ SA56004X: + + All temperature values are given in degrees Celsius. Resolution + is 1.0 degree for the local temperature, 0.125 degree for the remote +-temperature, except for the MAX6657, MAX6658 and MAX6659 which have a +-resolution of 0.125 degree for both temperatures. ++temperature, except for the MAX6654, MAX6657, MAX6658 and MAX6659 which have ++a resolution of 0.125 degree for both temperatures. + + Each sensor has its own high and low limits, plus a critical limit. + Additionally, there is a relative hysteresis value common to both critical +diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt +index e3abfbd32f71e..b020e6ce6dd49 100644 +--- a/Documentation/networking/bonding.txt ++++ b/Documentation/networking/bonding.txt +@@ -191,11 +191,12 @@ ad_actor_sys_prio + ad_actor_system + + In an AD system, this specifies the mac-address for the actor in +- protocol packet exchanges (LACPDUs). The value cannot be NULL or +- multicast. It is preferred to have the local-admin bit set for this +- mac but driver does not enforce it. If the value is not given then +- system defaults to using the masters' mac address as actors' system +- address. ++ protocol packet exchanges (LACPDUs). The value cannot be a multicast ++ address. If the all-zeroes MAC is specified, bonding will internally ++ use the MAC of the bond itself. It is preferred to have the ++ local-admin bit set for this mac but driver does not enforce it. If ++ the value is not given then system defaults to using the masters' ++ mac address as actors' system address. + + This parameter has effect only in 802.3ad mode and is available through + SysFs interface. +diff --git a/Makefile b/Makefile +index c23f5b17d239f..151fd24540125 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 168 ++SUBLEVEL = 169 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S +index b62d74a2c73a5..4937d514318ec 100644 +--- a/arch/arm/kernel/entry-armv.S ++++ b/arch/arm/kernel/entry-armv.S +@@ -596,11 +596,9 @@ call_fpe: + tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2 + reteq lr + and r8, r0, #0x00000f00 @ mask out CP number +- THUMB( lsr r8, r8, #8 ) + mov r7, #1 +- add r6, r10, #TI_USED_CP +- ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[] +- THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[] ++ add r6, r10, r8, lsr #8 @ add used_cp[] array offset first ++ strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[] + #ifdef CONFIG_IWMMXT + @ Test if we need to give access to iWMMXt coprocessors + ldr r5, [r10, #TI_FLAGS] +@@ -609,7 +607,7 @@ call_fpe: + bcs iwmmxt_task_enable + #endif + ARM( add pc, pc, r8, lsr #6 ) +- THUMB( lsl r8, r8, #2 ) ++ THUMB( lsr r8, r8, #6 ) + THUMB( add pc, r8 ) + nop + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts +index db6ea7b58999b..19f930f43936e 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts +@@ -72,7 +72,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index a37814cb66c76..8b616aada6492 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -478,7 +478,7 @@ lws_start: + extrd,u %r1,PSW_W_BIT,1,%r1 + /* sp must be aligned on 4, so deposit the W bit setting into + * the bottom of sp temporarily */ +- or,ev %r1,%r30,%r30 ++ or,od %r1,%r30,%r30 + + /* Clip LWS number to a 32-bit value for 32-bit processes */ + depdi 0, 31, 32, %r20 +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index ea85f23d9e227..1ae7c20f54691 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -1375,8 +1375,8 @@ static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd) + #endif + #endif + +-#define PKRU_AD_BIT 0x1 +-#define PKRU_WD_BIT 0x2 ++#define PKRU_AD_BIT 0x1u ++#define PKRU_WD_BIT 0x2u + #define PKRU_BITS_PER_PKEY 2 + + #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 8a93d5a494fff..ad2e6d55d4a59 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -2938,7 +2938,7 @@ cleanup_bmc_device(struct kref *ref) + * with removing the device attributes while reading a device + * attribute. + */ +- schedule_work(&bmc->remove_work); ++ queue_work(remove_work_wq, &bmc->remove_work); + } + + /* +@@ -5156,22 +5156,27 @@ static int ipmi_init_msghandler(void) + if (initialized) + goto out; + +- init_srcu_struct(&ipmi_interfaces_srcu); +- +- timer_setup(&ipmi_timer, ipmi_timeout, 0); +- mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); +- +- atomic_notifier_chain_register(&panic_notifier_list, &panic_block); ++ rv = init_srcu_struct(&ipmi_interfaces_srcu); ++ if (rv) ++ goto out; + + remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq"); + if (!remove_work_wq) { + pr_err("unable to create ipmi-msghandler-remove-wq workqueue"); + rv = -ENOMEM; +- goto out; ++ goto out_wq; + } + ++ timer_setup(&ipmi_timer, ipmi_timeout, 0); ++ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); ++ ++ atomic_notifier_chain_register(&panic_notifier_list, &panic_block); ++ + initialized = true; + ++out_wq: ++ if (rv) ++ cleanup_srcu_struct(&ipmi_interfaces_srcu); + out: + mutex_unlock(&ipmi_interfaces_mutex); + return rv; +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 8ac390c2b5147..bb42a1c92cae5 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1704,6 +1704,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) + } + } + ++ ssif_info->client = client; ++ i2c_set_clientdata(client, ssif_info); ++ + rv = ssif_check_and_remove(client, ssif_info); + /* If rv is 0 and addr source is not SI_ACPI, continue probing */ + if (!rv && ssif_info->addr_source == SI_ACPI) { +@@ -1724,9 +1727,6 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) + ipmi_addr_src_to_str(ssif_info->addr_source), + client->addr, client->adapter->name, slave_addr); + +- ssif_info->client = client; +- i2c_set_clientdata(client, ssif_info); +- + /* Now check for system interface capabilities */ + msg[0] = IPMI_NETFN_APP_REQUEST << 2; + msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD; +@@ -1926,6 +1926,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) + + dev_err(&ssif_info->client->dev, + "Unable to start IPMI SSIF: %d\n", rv); ++ i2c_set_clientdata(client, NULL); + kfree(ssif_info); + } + kfree(resp); +diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c +index b7172c48ef9f0..7c907939bfae1 100644 +--- a/drivers/hid/hid-holtek-mouse.c ++++ b/drivers/hid/hid-holtek-mouse.c +@@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, + static int holtek_mouse_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { ++ int ret; ++ + if (!hid_is_usb(hdev)) + return -EINVAL; ++ ++ ret = hid_parse(hdev); ++ if (ret) { ++ hid_err(hdev, "hid parse failed: %d\n", ret); ++ return ret; ++ } ++ ++ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); ++ if (ret) { ++ hid_err(hdev, "hw start failed: %d\n", ret); ++ return ret; ++ } ++ + return 0; + } + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 13a6b4afb4b36..049563d503b68 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1132,10 +1132,11 @@ config SENSORS_LM90 + help + If you say yes here you get support for National Semiconductor LM90, + LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A, +- Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659, +- MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008, +- Winbond/Nuvoton W83L771W/G/AWG/ASG, Philips SA56004, GMT G781, and +- Texas Instruments TMP451 sensor chips. ++ Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, ++ MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ++ ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, ++ Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461 ++ sensor chips. + + This driver can also be built as a module. If so, the module + will be called lm90. +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 9b3c9f390ef81..9abb4507f572b 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -35,6 +35,15 @@ + * explicitly as max6659, or if its address is not 0x4c. + * These chips lack the remote temperature offset feature. + * ++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be ++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar ++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature ++ * limits. Extended range is available by setting the configuration register ++ * accordingly, and is done during initialization. Extended precision is only ++ * available at conversion rates of 1 Hz and slower. Note that extended ++ * precision is not enabled by default, as this driver initializes all chips ++ * to 2 Hz by design. ++ * + * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and + * MAX6692 chips made by Maxim. These are again similar to the LM86, + * but they use unsigned temperature values and can report temperatures +@@ -61,10 +70,10 @@ + * This driver also supports the G781 from GMT. This device is compatible + * with the ADM1032. + * +- * This driver also supports TMP451 from Texas Instruments. This device is +- * supported in both compatibility and extended mode. It's mostly compatible +- * with ADT7461 except for local temperature low byte register and max +- * conversion rate. ++ * This driver also supports TMP451 and TMP461 from Texas Instruments. ++ * Those devices are supported in both compatibility and extended mode. ++ * They are mostly compatible with ADT7461 except for local temperature ++ * low byte register and max conversion rate. + * + * Since the LM90 was the first chipset supported by this driver, most + * comments will refer to this chipset, but are actually general and +@@ -94,8 +103,8 @@ + * have address 0x4d. + * MAX6647 has address 0x4e. + * MAX6659 can have address 0x4c, 0x4d or 0x4e. +- * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, +- * 0x4c, 0x4d or 0x4e. ++ * MAX6654, MAX6680, and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, ++ * 0x2a, 0x2b, 0x4c, 0x4d or 0x4e. + * SA56004 can have address 0x48 through 0x4F. + */ + +@@ -104,7 +113,7 @@ static const unsigned short normal_i2c[] = { + 0x4d, 0x4e, 0x4f, I2C_CLIENT_END }; + + enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, +- max6646, w83l771, max6696, sa56004, g781, tmp451 }; ++ max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 }; + + /* + * The LM90 registers +@@ -145,7 +154,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_REG_R_TCRIT_HYST 0x21 + #define LM90_REG_W_TCRIT_HYST 0x21 + +-/* MAX6646/6647/6649/6657/6658/6659/6695/6696 registers */ ++/* MAX6646/6647/6649/6654/6657/6658/6659/6695/6696 registers */ + + #define MAX6657_REG_R_LOCAL_TEMPL 0x11 + #define MAX6696_REG_R_STATUS2 0x12 +@@ -160,8 +169,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + + #define LM90_MAX_CONVRATE_MS 16000 /* Maximum conversion rate in ms */ + +-/* TMP451 registers */ ++/* TMP451/TMP461 registers */ + #define TMP451_REG_R_LOCAL_TEMPL 0x15 ++#define TMP451_REG_CONALERT 0x22 ++ ++#define TMP461_REG_CHEN 0x16 ++#define TMP461_REG_DFC 0x24 + + /* + * Device flags +@@ -174,7 +187,10 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */ + #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */ + #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ +-#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */ ++#define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ ++#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ ++#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ ++#define LM90_HAVE_CRIT_ALRM_SWP (1 << 11)/* critical alarm bits swapped */ + + /* LM90 status */ + #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ +@@ -184,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_STATUS_RHIGH (1 << 4) /* remote high temp limit tripped */ + #define LM90_STATUS_LLOW (1 << 5) /* local low temp limit tripped */ + #define LM90_STATUS_LHIGH (1 << 6) /* local high temp limit tripped */ ++#define LM90_STATUS_BUSY (1 << 7) /* conversion is ongoing */ + + #define MAX6696_STATUS2_R2THRM (1 << 1) /* remote2 THERM limit tripped */ + #define MAX6696_STATUS2_R2OPEN (1 << 2) /* remote2 is an open circuit */ +@@ -209,6 +226,7 @@ static const struct i2c_device_id lm90_id[] = { + { "max6646", max6646 }, + { "max6647", max6646 }, + { "max6649", max6646 }, ++ { "max6654", max6654 }, + { "max6657", max6657 }, + { "max6658", max6657 }, + { "max6659", max6659 }, +@@ -220,6 +238,7 @@ static const struct i2c_device_id lm90_id[] = { + { "w83l771", w83l771 }, + { "sa56004", sa56004 }, + { "tmp451", tmp451 }, ++ { "tmp461", tmp461 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, lm90_id); +@@ -269,6 +288,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { + .compatible = "dallas,max6649", + .data = (void *)max6646 + }, ++ { ++ .compatible = "dallas,max6654", ++ .data = (void *)max6654 ++ }, + { + .compatible = "dallas,max6657", + .data = (void *)max6657 +@@ -313,6 +336,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { + .compatible = "ti,tmp451", + .data = (void *)tmp451 + }, ++ { ++ .compatible = "ti,tmp461", ++ .data = (void *)tmp461 ++ }, + { }, + }; + MODULE_DEVICE_TABLE(of, lm90_of_match); +@@ -331,80 +358,98 @@ struct lm90_params { + static const struct lm90_params lm90_params[] = { + [adm1032] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [adt7461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [g781] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [lm86] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm90] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm99] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [max6646] = { ++ .flags = LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, ++ [max6654] = { ++ .alert_alarms = 0x7c, ++ .max_convrate = 7, ++ .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, ++ }, + [max6657] = { +- .flags = LM90_PAUSE_FOR_CONFIG, ++ .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6659] = { +- .flags = LM90_HAVE_EMERGENCY, ++ .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6680] = { +- .flags = LM90_HAVE_OFFSET, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT ++ | LM90_HAVE_CRIT_ALRM_SWP, + .alert_alarms = 0x7c, + .max_convrate = 7, + }, + [max6696] = { + .flags = LM90_HAVE_EMERGENCY +- | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3, ++ | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT, + .alert_alarms = 0x1c7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [w83l771] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [sa56004] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL, + }, + [tmp451] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, ++ .alert_alarms = 0x7c, ++ .max_convrate = 9, ++ .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, ++ }, ++ [tmp461] = { ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, +@@ -632,20 +677,22 @@ static int lm90_update_limits(struct device *dev) + struct i2c_client *client = data->client; + int val; + +- val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); +- if (val < 0) +- return val; +- data->temp8[LOCAL_CRIT] = val; ++ if (data->flags & LM90_HAVE_CRIT) { ++ val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[LOCAL_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); +- if (val < 0) +- return val; +- data->temp8[REMOTE_CRIT] = val; ++ val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[REMOTE_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); +- if (val < 0) +- return val; +- data->temp_hyst = val; ++ val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); ++ if (val < 0) ++ return val; ++ data->temp_hyst = val; ++ } + + val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH); + if (val < 0) +@@ -773,7 +820,7 @@ static int lm90_update_device(struct device *dev) + val = lm90_read_reg(client, LM90_REG_R_STATUS); + if (val < 0) + return val; +- data->alarms = val; /* lower 8 bit of alarms */ ++ data->alarms = val & ~LM90_STATUS_BUSY; + + if (data->kind == max6696) { + val = lm90_select_remote_channel(data, 1); +@@ -979,7 +1026,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index) + s16 temp11 = data->temp11[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u16_adt7461(data, temp11); + else if (data->kind == max6646) + temp = temp_from_u16(temp11); +@@ -1013,7 +1060,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index <= 2) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp11[index] = temp_to_u16_adt7461(data, val); + else if (data->kind == max6646) + data->temp11[index] = temp_to_u8(val) << 8; +@@ -1040,7 +1087,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index) + s8 temp8 = data->temp8[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, temp8); + else if (data->kind == max6646) + temp = temp_from_u8(temp8); +@@ -1073,7 +1120,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index == 3) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp8[index] = temp_to_u8_adt7461(data, val); + else if (data->kind == max6646) + data->temp8[index] = temp_to_u8(val); +@@ -1091,7 +1138,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index) + { + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[index]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[index]); +@@ -1111,7 +1158,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val) + int temp; + int err; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[LOCAL_CRIT]); +@@ -1147,6 +1194,7 @@ static const u8 lm90_temp_emerg_index[3] = { + static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 }; + static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 }; + static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 }; ++static const u8 lm90_crit_alarm_bits_swapped[3] = { 1, 0, 9 }; + static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 }; + static const u8 lm90_fault_bits[3] = { 0, 2, 10 }; + +@@ -1172,7 +1220,10 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val) + *val = (data->alarms >> lm90_max_alarm_bits[channel]) & 1; + break; + case hwmon_temp_crit_alarm: +- *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1; ++ if (data->flags & LM90_HAVE_CRIT_ALRM_SWP) ++ *val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) & 1; ++ else ++ *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1; + break; + case hwmon_temp_emergency_alarm: + *val = (data->alarms >> lm90_emergency_alarm_bits[channel]) & 1; +@@ -1420,12 +1471,11 @@ static int lm90_detect(struct i2c_client *client, + if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) + return -ENODEV; + +- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) { ++ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) { + config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); + if (config2 < 0) + return -ENODEV; +- } else +- config2 = 0; /* Make compiler happy */ ++ } + + if ((address == 0x4C || address == 0x4D) + && man_id == 0x01) { /* National Semiconductor */ +@@ -1557,6 +1607,16 @@ static int lm90_detect(struct i2c_client *client, + && (config1 & 0x3f) == 0x00 + && convrate <= 0x07) { + name = "max6646"; ++ } else ++ /* ++ * The chip_id of the MAX6654 holds the revision of the chip. ++ * The lowest 3 bits of the config1 register are unused and ++ * should return zero when read. ++ */ ++ if (chip_id == 0x08 ++ && (config1 & 0x07) == 0x00 ++ && convrate <= 0x07) { ++ name = "max6654"; + } + } else + if (address == 0x4C +@@ -1589,18 +1649,26 @@ static int lm90_detect(struct i2c_client *client, + && convrate <= 0x08) + name = "g781"; + } else +- if (address == 0x4C +- && man_id == 0x55) { /* Texas Instruments */ +- int local_ext; ++ if (man_id == 0x55 && chip_id == 0x00 && ++ (config1 & 0x1B) == 0x00 && convrate <= 0x09) { ++ int local_ext, conalert, chen, dfc; + + local_ext = i2c_smbus_read_byte_data(client, + TMP451_REG_R_LOCAL_TEMPL); +- +- if (chip_id == 0x00 /* TMP451 */ +- && (config1 & 0x1B) == 0x00 +- && convrate <= 0x09 +- && (local_ext & 0x0F) == 0x00) +- name = "tmp451"; ++ conalert = i2c_smbus_read_byte_data(client, ++ TMP451_REG_CONALERT); ++ chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN); ++ dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC); ++ ++ if ((local_ext & 0x0F) == 0x00 && ++ (conalert & 0xf1) == 0x01 && ++ (chen & 0xfc) == 0x00 && ++ (dfc & 0xfc) == 0x00) { ++ if (address == 0x4c && !(chen & 0x03)) ++ name = "tmp451"; ++ else if (address >= 0x48 && address <= 0x4f) ++ name = "tmp461"; ++ } + } + + if (!name) { /* identification failed */ +@@ -1647,7 +1715,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) + lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */ + + /* Check Temperature Range Select */ +- if (data->kind == adt7461 || data->kind == tmp451) { ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) { + if (config & 0x04) + data->flags |= LM90_FLAG_ADT7461_EXT; + } +@@ -1660,6 +1728,15 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) + if (data->kind == max6680) + config |= 0x18; + ++ /* ++ * Put MAX6654 into extended range (0x20, extend minimum range from ++ * 0 degrees to -64 degrees). Note that extended resolution is not ++ * possible on the MAX6654 unless conversion rate is set to 1 Hz or ++ * slower, which is intentionally not done by default. ++ */ ++ if (data->kind == max6654) ++ config |= 0x20; ++ + /* + * Select external channel 0 for max6695/96 + */ +@@ -1806,11 +1883,14 @@ static int lm90_probe(struct i2c_client *client, + info->config = data->channel_config; + + data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM; + data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT; ++ ++ if (data->flags & LM90_HAVE_CRIT) { ++ data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ } + + if (data->flags & LM90_HAVE_OFFSET) + data->channel_config[1] |= HWMON_T_OFFSET; +diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c +index 5fd28574124fb..fde848b00202b 100644 +--- a/drivers/infiniband/hw/qib/qib_user_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c +@@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + &addrlimit) || + addrlimit > type_max(typeof(pkt->addrlimit))) { + ret = -EINVAL; +- goto free_pbc; ++ goto free_pkt; + } + pkt->addrlimit = addrlimit; + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 0b5ed963cb0e1..3e78c26025815 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { + */ + static int elantech_change_report_id(struct psmouse *psmouse) + { +- unsigned char param[2] = { 0x10, 0x03 }; ++ /* ++ * NOTE: the code is expecting to receive param[] as an array of 3 ++ * items (see __ps2_command()), even if in this case only 2 are ++ * actually needed. Make sure the array size is 3 to avoid potential ++ * stack out-of-bound accesses. ++ */ ++ unsigned char param[3] = { 0x10, 0x03 }; + + if (elantech_write_reg_params(psmouse, 0x7, param) || + elantech_read_reg_params(psmouse, 0x7, param) || +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index ae60442efda0d..fb31a9d43162b 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1794,7 +1794,7 @@ static int mxt_read_info_block(struct mxt_data *data) + if (error) { + dev_err(&client->dev, "Error %d parsing object table\n", error); + mxt_free_object_table(data); +- goto err_free_mem; ++ return error; + } + + data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START); +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 8f94c25395080..d7bda1fa0a6e2 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2364,7 +2364,7 @@ void mmc_start_host(struct mmc_host *host) + _mmc_detect_change(host, 0, false); + } + +-void mmc_stop_host(struct mmc_host *host) ++void __mmc_stop_host(struct mmc_host *host) + { + if (host->slot.cd_irq >= 0) { + mmc_gpio_set_cd_wake(host, false); +@@ -2373,6 +2373,11 @@ void mmc_stop_host(struct mmc_host *host) + + host->rescan_disable = 1; + cancel_delayed_work_sync(&host->detect); ++} ++ ++void mmc_stop_host(struct mmc_host *host) ++{ ++ __mmc_stop_host(host); + + /* clear pm flags now and let card drivers set them as needed */ + host->pm_flags = 0; +diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h +index db3c9c68875d8..a6c814fdbf0a9 100644 +--- a/drivers/mmc/core/core.h ++++ b/drivers/mmc/core/core.h +@@ -69,6 +69,7 @@ static inline void mmc_delay(unsigned int ms) + + void mmc_rescan(struct work_struct *work); + void mmc_start_host(struct mmc_host *host); ++void __mmc_stop_host(struct mmc_host *host); + void mmc_stop_host(struct mmc_host *host); + + void _mmc_detect_change(struct mmc_host *host, unsigned long delay, +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index f7339590a84c8..e955f1ef25643 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -76,9 +76,18 @@ static void mmc_host_classdev_release(struct device *dev) + kfree(host); + } + ++static int mmc_host_classdev_shutdown(struct device *dev) ++{ ++ struct mmc_host *host = cls_dev_to_mmc_host(dev); ++ ++ __mmc_stop_host(host); ++ return 0; ++} ++ + static struct class mmc_host_class = { + .name = "mmc_host", + .dev_release = mmc_host_classdev_release, ++ .shutdown_pre = mmc_host_classdev_shutdown, + .pm = MMC_HOST_CLASS_DEV_PM_OPS, + }; + +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index c105356ad4cb7..65dfe75120ed6 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -340,23 +340,6 @@ static void tegra_sdhci_set_tap(struct sdhci_host *host, unsigned int tap) + } + } + +-static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc, +- struct mmc_ios *ios) +-{ +- struct sdhci_host *host = mmc_priv(mmc); +- u32 val; +- +- val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); +- +- if (ios->enhanced_strobe) +- val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; +- else +- val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; +- +- sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); +- +-} +- + static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); +@@ -768,6 +751,32 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock) + } + } + ++static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc, ++ struct mmc_ios *ios) ++{ ++ struct sdhci_host *host = mmc_priv(mmc); ++ u32 val; ++ ++ val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); ++ ++ if (ios->enhanced_strobe) { ++ val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; ++ /* ++ * When CMD13 is sent from mmc_select_hs400es() after ++ * switching to HS400ES mode, the bus is operating at ++ * either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR. ++ * To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI ++ * interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host ++ * controller CAR clock and the interface clock are rate matched. ++ */ ++ tegra_sdhci_set_clock(host, MMC_HS200_MAX_DTR); ++ } else { ++ val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; ++ } ++ ++ sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); ++} ++ + static unsigned int tegra_sdhci_get_max_clock(struct sdhci_host *host) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 215c109232893..933087d85549a 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -1452,7 +1452,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, + mac = (u8 *)&newval->value; + } + +- if (!is_valid_ether_addr(mac)) ++ if (is_multicast_ether_addr(mac)) + goto err; + + netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +index 5f327659efa7a..85b688f60b876 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, + struct qlcnic_info *, u16); + int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8); + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *); +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); + bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *); + void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *, + struct qlcnic_vf_info *, u16); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index f7c2f32237cb0..400bc2c3f222e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + struct qlcnic_cmd_args *cmd) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; +- int i, num_vlans; ++ int i, num_vlans, ret; + u16 *vlans; + + if (sriov->allowed_vlans) +@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n", + sriov->num_allowed_vlans); + +- qlcnic_sriov_alloc_vlans(adapter); ++ ret = qlcnic_sriov_alloc_vlans(adapter); ++ if (ret) ++ return ret; + + if (!sriov->any_vlan) + return 0; +@@ -2160,7 +2162,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter) + return err; + } + +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; + struct qlcnic_vf_info *vf; +@@ -2170,7 +2172,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + vf = &sriov->vf_info[i]; + vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, + sizeof(*vf->sriov_vlans), GFP_KERNEL); ++ if (!vf->sriov_vlans) ++ return -ENOMEM; + } ++ ++ return 0; + } + + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +index 5632da05145a5..ed218ed2f466d 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, + if (err) + goto del_flr_queue; + +- qlcnic_sriov_alloc_vlans(adapter); ++ err = qlcnic_sriov_alloc_vlans(adapter); ++ if (err) ++ goto del_flr_queue; + + return err; + +diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c +index 05ea3523890a9..d516f81ab37a7 100644 +--- a/drivers/net/ethernet/sfc/falcon/rx.c ++++ b/drivers/net/ethernet/sfc/falcon/rx.c +@@ -726,7 +726,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx, + efx->rx_bufs_per_page); + rx_queue->page_ring = kcalloc(page_ring_size, + sizeof(*rx_queue->page_ring), GFP_KERNEL); +- rx_queue->page_ptr_mask = page_ring_size - 1; ++ if (!rx_queue->page_ring) ++ rx_queue->page_ptr_mask = 0; ++ else ++ rx_queue->page_ptr_mask = page_ring_size - 1; + } + + void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue) +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index 7b65e79d6ae91..82ca29b6781b2 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -2069,6 +2069,11 @@ static int smc911x_drv_probe(struct platform_device *pdev) + + ndev->dma = (unsigned char)-1; + ndev->irq = platform_get_irq(pdev, 0); ++ if (ndev->irq < 0) { ++ ret = ndev->irq; ++ goto release_both; ++ } ++ + lp = netdev_priv(ndev); + lp->netdev = ndev; + #ifdef SMC_DYNAMIC_BUS_CONFIG +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index b89b4a3800a4d..bef0133696c31 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -1269,6 +1269,11 @@ static int fjes_probe(struct platform_device *plat_dev) + hw->hw_res.start = res->start; + hw->hw_res.size = resource_size(res); + hw->hw_res.irq = platform_get_irq(plat_dev, 0); ++ if (hw->hw_res.irq < 0) { ++ err = hw->hw_res.irq; ++ goto err_free_control_wq; ++ } ++ + err = fjes_hw_init(&adapter->hw); + if (err) + goto err_free_control_wq; +diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c +index 352f9e75954ce..d2eb33f53993b 100644 +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -793,13 +793,14 @@ static void mkiss_close(struct tty_struct *tty) + */ + netif_stop_queue(ax->dev); + +- /* Free all AX25 frame buffers. */ ++ unregister_netdev(ax->dev); ++ ++ /* Free all AX25 frame buffers after unreg. */ + kfree(ax->rbuff); + kfree(ax->xbuff); + + ax->tty = NULL; + +- unregister_netdev(ax->dev); + free_netdev(ax->dev); + } + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 2d98373f7a71d..ce3c8f476d75c 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -64,6 +64,8 @@ + #define LAN7801_USB_PRODUCT_ID (0x7801) + #define LAN78XX_EEPROM_MAGIC (0x78A5) + #define LAN78XX_OTP_MAGIC (0x78F3) ++#define AT29M2AF_USB_VENDOR_ID (0x07C9) ++#define AT29M2AF_USB_PRODUCT_ID (0x0012) + + #define MII_READ 1 + #define MII_WRITE 0 +@@ -4153,6 +4155,10 @@ static const struct usb_device_id products[] = { + /* LAN7801 USB Gigabit Ethernet Device */ + USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID), + }, ++ { ++ /* ATM2-AF USB Gigabit Ethernet Device */ ++ USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID), ++ }, + {}, + }; + MODULE_DEVICE_TABLE(usb, products); +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +index 20e1c890e73b3..c3e6f3c1b4743 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +@@ -236,8 +236,12 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n, + desc = (const struct mtk_pin_desc *)hw->soc->pins; + *gpio_chip = &hw->chip; + +- /* Be greedy to guess first gpio_n is equal to eint_n */ +- if (desc[eint_n].eint.eint_n == eint_n) ++ /* ++ * Be greedy to guess first gpio_n is equal to eint_n. ++ * Only eint virtual eint number is greater than gpio number. ++ */ ++ if (hw->soc->npins > eint_n && ++ desc[eint_n].eint.eint_n == eint_n) + *gpio_n = eint_n; + else + *gpio_n = mtk_xt_find_eint_num(hw, eint_n); +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 138cbc012cd89..f9abd4364fbaa 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1186,10 +1186,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, + bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK; + bank->gpio_chip.base = args.args[1]; + +- npins = args.args[2]; +- while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, +- ++i, &args)) +- npins += args.args[2]; ++ /* get the last defined gpio line (offset + nb of pins) */ ++ npins = args.args[0] + args.args[2]; ++ while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args)) ++ npins = max(npins, (int)(args.args[0] + args.args[2])); + } else { + bank_nr = pctl->nbanks; + bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK; +diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c +index e450ee17787f0..4a4e2877414a1 100644 +--- a/drivers/spi/spi-armada-3700.c ++++ b/drivers/spi/spi-armada-3700.c +@@ -906,7 +906,7 @@ static int a3700_spi_probe(struct platform_device *pdev) + return 0; + + error_clk: +- clk_disable_unprepare(spi->clk); ++ clk_unprepare(spi->clk); + error: + spi_master_put(master); + out: +diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c +index c41a9a501a6e9..fa75024f16f7f 100644 +--- a/drivers/tee/optee/shm_pool.c ++++ b/drivers/tee/optee/shm_pool.c +@@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, + goto err; + } + +- for (i = 0; i < nr_pages; i++) { +- pages[i] = page; +- page++; +- } ++ for (i = 0; i < nr_pages; i++) ++ pages[i] = page + i; + + shm->flags |= TEE_SHM_REGISTER; + rc = optee_shm_register(shm->ctx, shm, pages, nr_pages, +diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c +index 31c91c2f8c6e7..e24161004ddc1 100644 +--- a/drivers/tty/serial/8250/8250_fintek.c ++++ b/drivers/tty/serial/8250/8250_fintek.c +@@ -285,24 +285,6 @@ static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata) + } + } + +-static void fintek_8250_goto_highspeed(struct uart_8250_port *uart, +- struct fintek_8250 *pdata) +-{ +- sio_write_reg(pdata, LDN, pdata->index); +- +- switch (pdata->pid) { +- case CHIP_ID_F81866: /* set uart clock for high speed serial mode */ +- sio_write_mask_reg(pdata, F81866_UART_CLK, +- F81866_UART_CLK_MASK, +- F81866_UART_CLK_14_769MHZ); +- +- uart->port.uartclk = 921600 * 16; +- break; +- default: /* leave clock speed untouched */ +- break; +- } +-} +- + static void fintek_8250_set_termios(struct uart_port *port, + struct ktermios *termios, + struct ktermios *old) +@@ -422,7 +404,6 @@ static int probe_setup_port(struct fintek_8250 *pdata, + + fintek_8250_set_irq_mode(pdata, level_mode); + fintek_8250_set_max_fifo(pdata); +- fintek_8250_goto_highspeed(uart, pdata); + + fintek_8250_exit_key(addr[i]); + +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index 57da62e331848..271bd08f4a255 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -860,19 +860,23 @@ int gether_register_netdev(struct net_device *net) + { + struct eth_dev *dev; + struct usb_gadget *g; +- struct sockaddr sa; + int status; + + if (!net->dev.parent) + return -EINVAL; + dev = netdev_priv(net); + g = dev->gadget; ++ ++ memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN); ++ net->addr_assign_type = NET_ADDR_RANDOM; ++ + status = register_netdev(net); + if (status < 0) { + dev_dbg(&g->dev, "register_netdev failed, %d\n", status); + return status; + } else { + INFO(dev, "HOST MAC %pM\n", dev->host_mac); ++ INFO(dev, "MAC %pM\n", dev->dev_mac); + + /* two kinds of host-initiated state changes: + * - iff DATA transfer is active, carrier is "on" +@@ -880,15 +884,6 @@ int gether_register_netdev(struct net_device *net) + */ + netif_carrier_off(net); + } +- sa.sa_family = net->type; +- memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN); +- rtnl_lock(); +- status = dev_set_mac_address(net, &sa, NULL); +- rtnl_unlock(); +- if (status) +- pr_warn("cannot set self ethernet address: %d\n", status); +- else +- INFO(dev, "MAC %pM\n", dev->dev_mac); + + return status; + } +diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c +index 296b3189448a4..cf1bfed1e6621 100644 +--- a/fs/f2fs/xattr.c ++++ b/fs/f2fs/xattr.c +@@ -661,8 +661,17 @@ static int __f2fs_setxattr(struct inode *inode, int index, + } + + last = here; +- while (!IS_XATTR_LAST_ENTRY(last)) ++ while (!IS_XATTR_LAST_ENTRY(last)) { ++ if ((void *)(last) + sizeof(__u32) > last_base_addr || ++ (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) { ++ f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu", ++ inode->i_ino, ENTRY_SIZE(last)); ++ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK); ++ error = -EFSCORRUPTED; ++ goto exit; ++ } + last = XATTR_NEXT_ENTRY(last); ++ } + + newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size); + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index 04e87f4b9417c..a960de68ac69e 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -7,9 +7,27 @@ + #include + #include + ++static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type) ++{ ++ switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { ++ case VIRTIO_NET_HDR_GSO_TCPV4: ++ return protocol == cpu_to_be16(ETH_P_IP); ++ case VIRTIO_NET_HDR_GSO_TCPV6: ++ return protocol == cpu_to_be16(ETH_P_IPV6); ++ case VIRTIO_NET_HDR_GSO_UDP: ++ return protocol == cpu_to_be16(ETH_P_IP) || ++ protocol == cpu_to_be16(ETH_P_IPV6); ++ default: ++ return false; ++ } ++} ++ + static inline int virtio_net_hdr_set_proto(struct sk_buff *skb, + const struct virtio_net_hdr *hdr) + { ++ if (skb->protocol) ++ return 0; ++ + switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { + case VIRTIO_NET_HDR_GSO_TCPV4: + case VIRTIO_NET_HDR_GSO_UDP: +@@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + if (!skb->protocol) { + __be16 protocol = dev_parse_header_protocol(skb); + +- virtio_net_hdr_set_proto(skb, hdr); +- if (protocol && protocol != skb->protocol) ++ if (!protocol) ++ virtio_net_hdr_set_proto(skb, hdr); ++ else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type)) + return -EINVAL; ++ else ++ skb->protocol = protocol; + } + retry: + if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys, +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 87d165923fee2..2c4082f71d258 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2143,8 +2143,9 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + * memory as well. + */ + if (!page && (gfp & __GFP_DIRECT_RECLAIM)) +- page = __alloc_pages_node(hpage_node, +- gfp | __GFP_NORETRY, order); ++ page = __alloc_pages_nodemask(gfp | __GFP_NORETRY, ++ order, hpage_node, ++ nmask); + + goto out; + } +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 2fdb1b573e8c8..1f84d41e22c36 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct net_device *dev) + again: + ax25_for_each(s, &ax25_list) { + if (s->ax25_dev == ax25_dev) { +- s->ax25_dev = NULL; + spin_unlock_bh(&ax25_list_lock); ++ lock_sock(s->sk); ++ s->ax25_dev = NULL; ++ release_sock(s->sk); + ax25_disconnect(s, ENETUNREACH); + spin_lock_bh(&ax25_list_lock); + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index 7ca2ca4bba055..b36af4741ad3c 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -557,7 +557,8 @@ __build_packet_message(struct nfnl_log_net *log, + goto nla_put_failure; + + if (indev && skb->dev && +- skb->mac_header != skb->network_header) { ++ skb_mac_header_was_set(skb) && ++ skb_mac_header_len(skb) != 0) { + struct nfulnl_msg_packet_hw phw; + int len; + +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index a8cb562da3fea..ca21f8f4a47c1 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -562,7 +562,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + goto nla_put_failure; + + if (indev && entskb->dev && +- skb_mac_header_was_set(entskb)) { ++ skb_mac_header_was_set(entskb) && ++ skb_mac_header_len(entskb) != 0) { + struct nfqnl_msg_packet_hw phw; + int len; + +diff --git a/net/phonet/pep.c b/net/phonet/pep.c +index 4577e43cb7778..a07e13f63332c 100644 +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) + ret = -EBUSY; + else if (sk->sk_state == TCP_ESTABLISHED) + ret = -EISCONN; ++ else if (!pn->pn_sk.sobject) ++ ret = -EADDRNOTAVAIL; + else + ret = pep_sock_enable(sk, NULL, 0); + release_sock(sk); +diff --git a/sound/core/jack.c b/sound/core/jack.c +index fb26196571a7c..8b209750c7a9c 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -220,6 +220,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + return -ENOMEM; + + jack->id = kstrdup(id, GFP_KERNEL); ++ if (jack->id == NULL) { ++ kfree(jack); ++ return -ENOMEM; ++ } + + /* don't creat input device for phantom jack */ + if (!phantom_jack) { +diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c +index 280cc79870cf8..ce38ec09d4087 100644 +--- a/sound/drivers/opl3/opl3_midi.c ++++ b/sound/drivers/opl3/opl3_midi.c +@@ -398,7 +398,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan) + } + if (instr_4op) { + vp2 = &opl3->voices[voice + 3]; +- if (vp->state > 0) { ++ if (vp2->state > 0) { + opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK + + voice_offset + 3); + reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 9514db7c2a86d..022799479a722 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8101,6 +8101,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), ++ SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch new file mode 100644 index 000000000..e78f6fa05 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch @@ -0,0 +1,1469 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index e7f71df9daf1c..165abcb656c5b 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1487,6 +1487,8 @@ + architectures force reset to be always executed + i8042.unlock [HW] Unlock (ignore) the keylock + i8042.kbdreset [HW] Reset device connected to KBD port ++ i8042.probe_defer ++ [HW] Allow deferred probing upon i8042 probe errors + + i810= [HW,DRM] + +diff --git a/Makefile b/Makefile +index 151fd24540125..7380354e49513 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 169 ++SUBLEVEL = 170 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 3526bb1488e5e..b5022a7f6bae1 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -613,7 +613,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, + BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); + + if (buffer->async_transaction) { +- alloc->free_async_space += size + sizeof(struct binder_buffer); ++ alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); + + binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, + "%d: binder_free_buf size %zd async free %zd\n", +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 0cfcfb116a03d..5169a38ee47a9 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -149,6 +149,7 @@ config HID_APPLEIR + + config HID_ASUS + tristate "Asus" ++ depends on USB_HID + depends on LEDS_CLASS + depends on ASUS_WMI || ASUS_WMI=n + select POWER_SUPPLY +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index c9ae1895cd48a..7da6ca26a5f56 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -536,6 +536,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo + sizeof(rdwr_arg))) + return -EFAULT; + ++ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0) ++ return -EINVAL; ++ + if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS) + return -EINVAL; + +diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c +index cf7cbcd0c29df..6971412990695 100644 +--- a/drivers/input/joystick/spaceball.c ++++ b/drivers/input/joystick/spaceball.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #define DRIVER_DESC "SpaceTec SpaceBall 2003/3003/4000 FLX driver" + +@@ -75,9 +76,15 @@ static void spaceball_process_packet(struct spaceball* spaceball) + + case 'D': /* Ball data */ + if (spaceball->idx != 15) return; +- for (i = 0; i < 6; i++) ++ /* ++ * Skip first three bytes; read six axes worth of data. ++ * Axis values are signed 16-bit big-endian. ++ */ ++ data += 3; ++ for (i = 0; i < ARRAY_SIZE(spaceball_axes); i++) { + input_report_abs(dev, spaceball_axes[i], +- (__s16)((data[2 * i + 3] << 8) | data[2 * i + 2])); ++ (__s16)get_unaligned_be16(&data[i * 2])); ++ } + break; + + case 'K': /* Button data */ +diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c +index 3f06e8a495d80..ff94388416645 100644 +--- a/drivers/input/mouse/appletouch.c ++++ b/drivers/input/mouse/appletouch.c +@@ -916,6 +916,8 @@ static int atp_probe(struct usb_interface *iface, + set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); + set_bit(BTN_LEFT, input_dev->keybit); + ++ INIT_WORK(&dev->work, atp_reinit); ++ + error = input_register_device(dev->input); + if (error) + goto err_free_buffer; +@@ -923,8 +925,6 @@ static int atp_probe(struct usb_interface *iface, + /* save our data pointer in this interface device */ + usb_set_intfdata(iface, dev); + +- INIT_WORK(&dev->work, atp_reinit); +- + return 0; + + err_free_buffer: +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 202e43a6ffae2..0282c4c55e9da 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -995,6 +995,24 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { + { } + }; + ++static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = { ++ { ++ /* ASUS ZenBook UX425UA */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"), ++ }, ++ }, ++ { ++ /* ASUS ZenBook UM325UA */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), ++ }, ++ }, ++ { } ++}; ++ + #endif /* CONFIG_X86 */ + + #ifdef CONFIG_PNP +@@ -1314,6 +1332,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_kbdreset_table)) + i8042_kbdreset = true; + ++ if (dmi_check_system(i8042_dmi_probe_defer_table)) ++ i8042_probe_defer = true; ++ + /* + * A20 was already enabled during early kernel init. But some buggy + * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 6ff6b5710dd4e..bb76ff2f6b1d8 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -44,6 +44,10 @@ static bool i8042_unlock; + module_param_named(unlock, i8042_unlock, bool, 0); + MODULE_PARM_DESC(unlock, "Ignore keyboard lock."); + ++static bool i8042_probe_defer; ++module_param_named(probe_defer, i8042_probe_defer, bool, 0); ++MODULE_PARM_DESC(probe_defer, "Allow deferred probing."); ++ + enum i8042_controller_reset_mode { + I8042_RESET_NEVER, + I8042_RESET_ALWAYS, +@@ -709,7 +713,7 @@ static int i8042_set_mux_mode(bool multiplex, unsigned char *mux_version) + * LCS/Telegraphics. + */ + +-static int __init i8042_check_mux(void) ++static int i8042_check_mux(void) + { + unsigned char mux_version; + +@@ -738,10 +742,10 @@ static int __init i8042_check_mux(void) + /* + * The following is used to test AUX IRQ delivery. + */ +-static struct completion i8042_aux_irq_delivered __initdata; +-static bool i8042_irq_being_tested __initdata; ++static struct completion i8042_aux_irq_delivered; ++static bool i8042_irq_being_tested; + +-static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) ++static irqreturn_t i8042_aux_test_irq(int irq, void *dev_id) + { + unsigned long flags; + unsigned char str, data; +@@ -768,7 +772,7 @@ static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) + * verifies success by readinng CTR. Used when testing for presence of AUX + * port. + */ +-static int __init i8042_toggle_aux(bool on) ++static int i8042_toggle_aux(bool on) + { + unsigned char param; + int i; +@@ -796,7 +800,7 @@ static int __init i8042_toggle_aux(bool on) + * the presence of an AUX interface. + */ + +-static int __init i8042_check_aux(void) ++static int i8042_check_aux(void) + { + int retval = -1; + bool irq_registered = false; +@@ -1003,7 +1007,7 @@ static int i8042_controller_init(void) + + if (i8042_command(&ctr[n++ % 2], I8042_CMD_CTL_RCTR)) { + pr_err("Can't read CTR while initializing i8042\n"); +- return -EIO; ++ return i8042_probe_defer ? -EPROBE_DEFER : -EIO; + } + + } while (n < 2 || ctr[0] != ctr[1]); +@@ -1318,7 +1322,7 @@ static void i8042_shutdown(struct platform_device *dev) + i8042_controller_reset(false); + } + +-static int __init i8042_create_kbd_port(void) ++static int i8042_create_kbd_port(void) + { + struct serio *serio; + struct i8042_port *port = &i8042_ports[I8042_KBD_PORT_NO]; +@@ -1346,7 +1350,7 @@ static int __init i8042_create_kbd_port(void) + return 0; + } + +-static int __init i8042_create_aux_port(int idx) ++static int i8042_create_aux_port(int idx) + { + struct serio *serio; + int port_no = idx < 0 ? I8042_AUX_PORT_NO : I8042_MUX_PORT_NO + idx; +@@ -1383,13 +1387,13 @@ static int __init i8042_create_aux_port(int idx) + return 0; + } + +-static void __init i8042_free_kbd_port(void) ++static void i8042_free_kbd_port(void) + { + kfree(i8042_ports[I8042_KBD_PORT_NO].serio); + i8042_ports[I8042_KBD_PORT_NO].serio = NULL; + } + +-static void __init i8042_free_aux_ports(void) ++static void i8042_free_aux_ports(void) + { + int i; + +@@ -1399,7 +1403,7 @@ static void __init i8042_free_aux_ports(void) + } + } + +-static void __init i8042_register_ports(void) ++static void i8042_register_ports(void) + { + int i; + +@@ -1440,7 +1444,7 @@ static void i8042_free_irqs(void) + i8042_aux_irq_registered = i8042_kbd_irq_registered = false; + } + +-static int __init i8042_setup_aux(void) ++static int i8042_setup_aux(void) + { + int (*aux_enable)(void); + int error; +@@ -1482,7 +1486,7 @@ static int __init i8042_setup_aux(void) + return error; + } + +-static int __init i8042_setup_kbd(void) ++static int i8042_setup_kbd(void) + { + int error; + +@@ -1532,7 +1536,7 @@ static int i8042_kbd_bind_notifier(struct notifier_block *nb, + return 0; + } + +-static int __init i8042_probe(struct platform_device *dev) ++static int i8042_probe(struct platform_device *dev) + { + int error; + +@@ -1597,6 +1601,7 @@ static struct platform_driver i8042_driver = { + .pm = &i8042_pm_ops, + #endif + }, ++ .probe = i8042_probe, + .remove = i8042_remove, + .shutdown = i8042_shutdown, + }; +@@ -1607,7 +1612,6 @@ static struct notifier_block i8042_kbd_bind_notifier_block = { + + static int __init i8042_init(void) + { +- struct platform_device *pdev; + int err; + + dbg_init(); +@@ -1623,17 +1627,29 @@ static int __init i8042_init(void) + /* Set this before creating the dev to allow i8042_command to work right away */ + i8042_present = true; + +- pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); +- if (IS_ERR(pdev)) { +- err = PTR_ERR(pdev); ++ err = platform_driver_register(&i8042_driver); ++ if (err) + goto err_platform_exit; ++ ++ i8042_platform_device = platform_device_alloc("i8042", -1); ++ if (!i8042_platform_device) { ++ err = -ENOMEM; ++ goto err_unregister_driver; + } + ++ err = platform_device_add(i8042_platform_device); ++ if (err) ++ goto err_free_device; ++ + bus_register_notifier(&serio_bus, &i8042_kbd_bind_notifier_block); + panic_blink = i8042_panic_blink; + + return 0; + ++err_free_device: ++ platform_device_put(i8042_platform_device); ++err_unregister_driver: ++ platform_driver_unregister(&i8042_driver); + err_platform_exit: + i8042_platform_exit(); + return err; +diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c +index 47f6fee1f3964..1812434cda847 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -1791,7 +1791,7 @@ static int fman_port_probe(struct platform_device *of_dev) + fman = dev_get_drvdata(&fm_pdev->dev); + if (!fman) { + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + + err = of_property_read_u32(port_node, "cell-index", &val); +@@ -1799,7 +1799,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: reading cell-index for %pOF failed\n", + __func__, port_node); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + port_id = (u8)val; + port->dts_params.id = port_id; +@@ -1833,7 +1833,7 @@ static int fman_port_probe(struct platform_device *of_dev) + } else { + dev_err(port->dev, "%s: Illegal port type\n", __func__); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + + port->dts_params.type = port_type; +@@ -1847,7 +1847,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: incorrect qman-channel-id\n", + __func__); + err = -EINVAL; +- goto return_err; ++ goto put_device; + } + port->dts_params.qman_channel_id = qman_channel_id; + } +@@ -1857,7 +1857,7 @@ static int fman_port_probe(struct platform_device *of_dev) + dev_err(port->dev, "%s: of_address_to_resource() failed\n", + __func__); + err = -ENOMEM; +- goto return_err; ++ goto put_device; + } + + port->dts_params.fman = fman; +@@ -1882,6 +1882,8 @@ static int fman_port_probe(struct platform_device *of_dev) + + return 0; + ++put_device: ++ put_device(&fm_pdev->dev); + return_err: + of_node_put(port_node); + free_port: +diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c +index 6e504854571cf..94541bf889a23 100644 +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -209,7 +209,7 @@ static int xrx200_hw_receive(struct xrx200_chan *ch) + skb->protocol = eth_type_trans(skb, net_dev); + netif_receive_skb(skb); + net_dev->stats.rx_packets++; +- net_dev->stats.rx_bytes += len - ETH_FCS_LEN; ++ net_dev->stats.rx_bytes += len; + + return 0; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 5f4f0f61c83c8..dea884c94568c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3907,12 +3907,11 @@ static int set_feature_arfs(struct net_device *netdev, bool enable) + + static int mlx5e_handle_feature(struct net_device *netdev, + netdev_features_t *features, +- netdev_features_t wanted_features, + netdev_features_t feature, + mlx5e_feature_handler feature_handler) + { +- netdev_features_t changes = wanted_features ^ netdev->features; +- bool enable = !!(wanted_features & feature); ++ netdev_features_t changes = *features ^ netdev->features; ++ bool enable = !!(*features & feature); + int err; + + if (!(changes & feature)) +@@ -3920,22 +3919,22 @@ static int mlx5e_handle_feature(struct net_device *netdev, + + err = feature_handler(netdev, enable); + if (err) { ++ MLX5E_SET_FEATURE(features, feature, !enable); + netdev_err(netdev, "%s feature %pNF failed, err %d\n", + enable ? "Enable" : "Disable", &feature, err); + return err; + } + +- MLX5E_SET_FEATURE(features, feature, enable); + return 0; + } + + int mlx5e_set_features(struct net_device *netdev, netdev_features_t features) + { +- netdev_features_t oper_features = netdev->features; ++ netdev_features_t oper_features = features; + int err = 0; + + #define MLX5E_HANDLE_FEATURE(feature, handler) \ +- mlx5e_handle_feature(netdev, &oper_features, features, feature, handler) ++ mlx5e_handle_feature(netdev, &oper_features, feature, handler) + + err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro); + err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +index 56bf900eb753f..dbdb6a9592f09 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +@@ -2,6 +2,7 @@ + /* Copyright (c) 2019 Mellanox Technologies. */ + + #include ++#include + #include "dr_types.h" + + static int dr_domain_init_cache(struct mlx5dr_domain *dmn) +@@ -64,9 +65,9 @@ static int dr_domain_init_resources(struct mlx5dr_domain *dmn) + } + + dmn->uar = mlx5_get_uars_page(dmn->mdev); +- if (!dmn->uar) { ++ if (IS_ERR(dmn->uar)) { + mlx5dr_err(dmn, "Couldn't allocate UAR\n"); +- ret = -ENOMEM; ++ ret = PTR_ERR(dmn->uar); + goto clean_pd; + } + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 99ba3551458fc..f9c303d76658a 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -1995,7 +1995,7 @@ static int ionic_lif_init(struct ionic_lif *lif) + return -EINVAL; + } + +- lif->dbid_inuse = bitmap_alloc(lif->dbid_count, GFP_KERNEL); ++ lif->dbid_inuse = bitmap_zalloc(lif->dbid_count, GFP_KERNEL); + if (!lif->dbid_inuse) { + dev_err(dev, "Failed alloc doorbell id bitmap, aborting\n"); + return -ENOMEM; +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index b744c09346a7c..dda051c94fb4d 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -495,11 +495,11 @@ static void read_bulk_callback(struct urb *urb) + goto goon; + + rx_status = buf[count - 2]; +- if (rx_status & 0x1e) { ++ if (rx_status & 0x1c) { + netif_dbg(pegasus, rx_err, net, + "RX packet error %x\n", rx_status); + net->stats.rx_errors++; +- if (rx_status & 0x06) /* long or runt */ ++ if (rx_status & 0x04) /* runt */ + net->stats.rx_length_errors++; + if (rx_status & 0x08) + net->stats.rx_crc_errors++; +diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c +index 23ed11f91213d..6ea59426ab0bf 100644 +--- a/drivers/nfc/st21nfca/i2c.c ++++ b/drivers/nfc/st21nfca/i2c.c +@@ -533,7 +533,8 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); + if (IS_ERR(phy->gpiod_ena)) { + nfc_err(dev, "Unable to get ENABLE GPIO\n"); +- return PTR_ERR(phy->gpiod_ena); ++ r = PTR_ERR(phy->gpiod_ena); ++ goto out_free; + } + + phy->se_status.is_ese_present = +@@ -544,7 +545,7 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + r = st21nfca_hci_platform_init(phy); + if (r < 0) { + nfc_err(&client->dev, "Unable to reboot st21nfca\n"); +- return r; ++ goto out_free; + } + + r = devm_request_threaded_irq(&client->dev, client->irq, NULL, +@@ -553,15 +554,23 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, + ST21NFCA_HCI_DRIVER_NAME, phy); + if (r < 0) { + nfc_err(&client->dev, "Unable to register IRQ handler\n"); +- return r; ++ goto out_free; + } + +- return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, +- ST21NFCA_FRAME_HEADROOM, +- ST21NFCA_FRAME_TAILROOM, +- ST21NFCA_HCI_LLC_MAX_PAYLOAD, +- &phy->hdev, +- &phy->se_status); ++ r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, ++ ST21NFCA_FRAME_HEADROOM, ++ ST21NFCA_FRAME_TAILROOM, ++ ST21NFCA_HCI_LLC_MAX_PAYLOAD, ++ &phy->hdev, ++ &phy->se_status); ++ if (r) ++ goto out_free; ++ ++ return 0; ++ ++out_free: ++ kfree_skb(phy->pending_skb); ++ return r; + } + + static int st21nfca_hci_i2c_remove(struct i2c_client *client) +@@ -574,6 +583,8 @@ static int st21nfca_hci_i2c_remove(struct i2c_client *client) + + if (phy->powered) + st21nfca_hci_i2c_disable(phy); ++ if (phy->pending_skb) ++ kfree_skb(phy->pending_skb); + + return 0; + } +diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c +index 7e3083deb1c5d..1b86005c0f5f4 100644 +--- a/drivers/platform/x86/apple-gmux.c ++++ b/drivers/platform/x86/apple-gmux.c +@@ -625,7 +625,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + } + + gmux_data->iostart = res->start; +- gmux_data->iolen = res->end - res->start; ++ gmux_data->iolen = resource_size(res); + + if (gmux_data->iolen < GMUX_MIN_IO_LEN) { + pr_err("gmux I/O region too small (%lu < %u)\n", +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index 3c9248d2435e1..e15bb3dfe9956 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2757,8 +2757,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > 63) ++ nbytes = 63; + + memset(mybuf, 0, sizeof(mybuf)); + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 0ac342b1deb95..0370ff6dd2efd 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -578,9 +578,12 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + * Commands like INQUIRY may transfer less data than + * requested by the initiator via bufflen. Set residual + * count to make upper layer aware of the actual amount +- * of data returned. ++ * of data returned. There are cases when controller ++ * returns zero dataLen with non zero data - do not set ++ * residual count in that case. + */ +- scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); ++ if (e->dataLen && (e->dataLen < scsi_bufflen(cmd))) ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); + cmd->result = (DID_OK << 16); + break; + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index d6491e973fa4c..0d5ae80530498 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -1,26 +1,18 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2015-2016, Linaro Limited ++ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited + */ ++#include + #include +-#include +-#include + #include ++#include + #include + #include + #include + #include "tee_private.h" + +-static void tee_shm_release(struct tee_shm *shm) ++static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) + { +- struct tee_device *teedev = shm->teedev; +- +- mutex_lock(&teedev->mutex); +- idr_remove(&teedev->idr, shm->id); +- if (shm->ctx) +- list_del(&shm->link); +- mutex_unlock(&teedev->mutex); +- + if (shm->flags & TEE_SHM_POOL) { + struct tee_shm_pool_mgr *poolm; + +@@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm) + tee_device_put(teedev); + } + +-static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment +- *attach, enum dma_data_direction dir) +-{ +- return NULL; +-} +- +-static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach, +- struct sg_table *table, +- enum dma_data_direction dir) +-{ +-} +- +-static void tee_shm_op_release(struct dma_buf *dmabuf) +-{ +- struct tee_shm *shm = dmabuf->priv; +- +- tee_shm_release(shm); +-} +- +-static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) +-{ +- return NULL; +-} +- +-static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) +-{ +- struct tee_shm *shm = dmabuf->priv; +- size_t size = vma->vm_end - vma->vm_start; +- +- /* Refuse sharing shared memory provided by application */ +- if (shm->flags & TEE_SHM_REGISTER) +- return -EINVAL; +- +- return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, +- size, vma->vm_page_prot); +-} +- +-static const struct dma_buf_ops tee_shm_dma_buf_ops = { +- .map_dma_buf = tee_shm_op_map_dma_buf, +- .unmap_dma_buf = tee_shm_op_unmap_dma_buf, +- .release = tee_shm_op_release, +- .map = tee_shm_op_map, +- .mmap = tee_shm_op_mmap, +-}; +- + static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + struct tee_device *teedev, + size_t size, u32 flags) +@@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + goto err_dev_put; + } + ++ refcount_set(&shm->refcount, 1); + shm->flags = flags | TEE_SHM_POOL; + shm->teedev = teedev; + shm->ctx = ctx; +@@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + goto err_pool_free; + } + +- if (flags & TEE_SHM_DMA_BUF) { +- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); +- +- exp_info.ops = &tee_shm_dma_buf_ops; +- exp_info.size = shm->size; +- exp_info.flags = O_RDWR; +- exp_info.priv = shm; +- +- shm->dmabuf = dma_buf_export(&exp_info); +- if (IS_ERR(shm->dmabuf)) { +- ret = ERR_CAST(shm->dmabuf); +- goto err_rem; +- } +- } +- + if (ctx) { + teedev_ctx_get(ctx); + mutex_lock(&teedev->mutex); +@@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, + } + + return shm; +-err_rem: +- mutex_lock(&teedev->mutex); +- idr_remove(&teedev->idr, shm->id); +- mutex_unlock(&teedev->mutex); + err_pool_free: + poolm->ops->free(poolm, shm); + err_kfree: +@@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, + goto err; + } + ++ refcount_set(&shm->refcount, 1); + shm->flags = flags | TEE_SHM_REGISTER; + shm->teedev = teedev; + shm->ctx = ctx; +@@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, + goto err; + } + +- if (flags & TEE_SHM_DMA_BUF) { +- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); +- +- exp_info.ops = &tee_shm_dma_buf_ops; +- exp_info.size = shm->size; +- exp_info.flags = O_RDWR; +- exp_info.priv = shm; +- +- shm->dmabuf = dma_buf_export(&exp_info); +- if (IS_ERR(shm->dmabuf)) { +- ret = ERR_CAST(shm->dmabuf); +- teedev->desc->ops->shm_unregister(ctx, shm); +- goto err; +- } +- } +- + mutex_lock(&teedev->mutex); + list_add_tail(&shm->link, &ctx->list_shm); + mutex_unlock(&teedev->mutex); +@@ -352,6 +266,35 @@ err: + } + EXPORT_SYMBOL_GPL(tee_shm_register); + ++static int tee_shm_fop_release(struct inode *inode, struct file *filp) ++{ ++ tee_shm_put(filp->private_data); ++ return 0; ++} ++ ++static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma) ++{ ++ struct tee_shm *shm = filp->private_data; ++ size_t size = vma->vm_end - vma->vm_start; ++ ++ /* Refuse sharing shared memory provided by application */ ++ if (shm->flags & TEE_SHM_USER_MAPPED) ++ return -EINVAL; ++ ++ /* check for overflowing the buffer's size */ ++ if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT) ++ return -EINVAL; ++ ++ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, ++ size, vma->vm_page_prot); ++} ++ ++static const struct file_operations tee_shm_fops = { ++ .owner = THIS_MODULE, ++ .release = tee_shm_fop_release, ++ .mmap = tee_shm_fop_mmap, ++}; ++ + /** + * tee_shm_get_fd() - Increase reference count and return file descriptor + * @shm: Shared memory handle +@@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm) + if (!(shm->flags & TEE_SHM_DMA_BUF)) + return -EINVAL; + +- get_dma_buf(shm->dmabuf); +- fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); ++ /* matched by tee_shm_put() in tee_shm_op_release() */ ++ refcount_inc(&shm->refcount); ++ fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR); + if (fd < 0) +- dma_buf_put(shm->dmabuf); ++ tee_shm_put(shm); + return fd; + } + +@@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm) + */ + void tee_shm_free(struct tee_shm *shm) + { +- /* +- * dma_buf_put() decreases the dmabuf reference counter and will +- * call tee_shm_release() when the last reference is gone. +- * +- * In the case of driver private memory we call tee_shm_release +- * directly instead as it doesn't have a reference counter. +- */ +- if (shm->flags & TEE_SHM_DMA_BUF) +- dma_buf_put(shm->dmabuf); +- else +- tee_shm_release(shm); ++ tee_shm_put(shm); + } + EXPORT_SYMBOL_GPL(tee_shm_free); + +@@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id) + teedev = ctx->teedev; + mutex_lock(&teedev->mutex); + shm = idr_find(&teedev->idr, id); ++ /* ++ * If the tee_shm was found in the IDR it must have a refcount ++ * larger than 0 due to the guarantee in tee_shm_put() below. So ++ * it's safe to use refcount_inc(). ++ */ + if (!shm || shm->ctx != ctx) + shm = ERR_PTR(-EINVAL); +- else if (shm->flags & TEE_SHM_DMA_BUF) +- get_dma_buf(shm->dmabuf); ++ else ++ refcount_inc(&shm->refcount); + mutex_unlock(&teedev->mutex); + return shm; + } +@@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); + */ + void tee_shm_put(struct tee_shm *shm) + { +- if (shm->flags & TEE_SHM_DMA_BUF) +- dma_buf_put(shm->dmabuf); ++ struct tee_device *teedev = shm->teedev; ++ bool do_release = false; ++ ++ mutex_lock(&teedev->mutex); ++ if (refcount_dec_and_test(&shm->refcount)) { ++ /* ++ * refcount has reached 0, we must now remove it from the ++ * IDR before releasing the mutex. This will guarantee that ++ * the refcount_inc() in tee_shm_get_from_id() never starts ++ * from 0. ++ */ ++ idr_remove(&teedev->idr, shm->id); ++ if (shm->ctx) ++ list_del(&shm->link); ++ do_release = true; ++ } ++ mutex_unlock(&teedev->mutex); ++ ++ if (do_release) ++ tee_shm_release(teedev, shm); + } + EXPORT_SYMBOL_GPL(tee_shm_put); +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 94ccf43368dfc..3f5c21f7f9905 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1791,11 +1791,15 @@ static void ffs_data_clear(struct ffs_data *ffs) + + BUG_ON(ffs->gadget); + +- if (ffs->epfiles) ++ if (ffs->epfiles) { + ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); ++ ffs->epfiles = NULL; ++ } + +- if (ffs->ffs_eventfd) ++ if (ffs->ffs_eventfd) { + eventfd_ctx_put(ffs->ffs_eventfd); ++ ffs->ffs_eventfd = NULL; ++ } + + kfree(ffs->raw_descs_data); + kfree(ffs->raw_strings); +@@ -1808,7 +1812,6 @@ static void ffs_data_reset(struct ffs_data *ffs) + + ffs_data_clear(ffs); + +- ffs->epfiles = NULL; + ffs->raw_descs_data = NULL; + ffs->raw_descs = NULL; + ffs->raw_strings = NULL; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index ded05c39e4d1c..e7533787db411 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -108,7 +108,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + /* Look for vendor-specific quirks */ + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && + (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK || +- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 || + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) { + if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK && + pdev->revision == 0x0) { +@@ -143,6 +142,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) + xhci->quirks |= XHCI_BROKEN_STREAMS; + ++ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && ++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100) ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ + if (pdev->vendor == PCI_VENDOR_ID_NEC) + xhci->quirks |= XHCI_NEC_HOST; + +diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c +index 619c4598e64ea..253c8b71d3c49 100644 +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -100,6 +100,13 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) + interval = clamp_val(interval, 1, 16) - 1; + mult = usb_endpoint_maxp_mult(desc) - 1; + } ++ break; ++ case USB_SPEED_FULL: ++ if (usb_endpoint_xfer_isoc(desc)) ++ interval = clamp_val(desc->bInterval, 1, 16); ++ else if (usb_endpoint_xfer_int(desc)) ++ interval = clamp_val(desc->bInterval, 1, 255); ++ + break; + default: + break; /*others are ignored */ +@@ -245,6 +252,7 @@ struct usb_request *mtu3_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) + mreq->request.dma = DMA_ADDR_INVALID; + mreq->epnum = mep->epnum; + mreq->mep = mep; ++ INIT_LIST_HEAD(&mreq->list); + trace_mtu3_alloc_request(mreq); + + return &mreq->request; +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 3f414f91b5899..2ea3157ddb6e2 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -273,6 +273,8 @@ static int mtu3_prepare_tx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) + gpd->dw3_info |= cpu_to_le32(GPD_EXT_FLAG_ZLP); + } + ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); + + mreq->gpd = gpd; +@@ -306,6 +308,8 @@ static int mtu3_prepare_rx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) + gpd->next_gpd = cpu_to_le32(lower_32_bits(enq_dma)); + ext_addr |= GPD_EXT_NGP(mtu, upper_32_bits(enq_dma)); + gpd->dw3_info = cpu_to_le32(ext_addr); ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); + + mreq->gpd = gpd; +@@ -445,7 +449,8 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) + return; + } + mtu3_setbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_TXPKTRDY); +- ++ /* prevent reorder, make sure GPD's HWO is set last */ ++ mb(); + /* by pass the current GDP */ + gpd_current->dw0_info |= cpu_to_le32(GPD_FLAGS_BPS | GPD_FLAGS_HWO); + +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index f491690d54c6c..64b971b2542d6 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -351,8 +351,8 @@ phys_addr_t memblock_phys_alloc_range(phys_addr_t size, phys_addr_t align, + phys_addr_t start, phys_addr_t end); + phys_addr_t memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid); + +-static inline phys_addr_t memblock_phys_alloc(phys_addr_t size, +- phys_addr_t align) ++static __always_inline phys_addr_t memblock_phys_alloc(phys_addr_t size, ++ phys_addr_t align) + { + return memblock_phys_alloc_range(size, align, 0, + MEMBLOCK_ALLOC_ACCESSIBLE); +diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h +index cd15c1b7fae06..e08ace76eba6a 100644 +--- a/include/linux/tee_drv.h ++++ b/include/linux/tee_drv.h +@@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev); + * @offset: offset of buffer in user space + * @pages: locked pages from userspace + * @num_pages: number of locked pages +- * @dmabuf: dmabuf used to for exporting to user space ++ * @refcount: reference counter + * @flags: defined by TEE_SHM_* in tee_drv.h + * @id: unique id of a shared memory object on this device + * +@@ -195,7 +195,7 @@ struct tee_shm { + unsigned int offset; + struct page **pages; + size_t num_pages; +- struct dma_buf *dmabuf; ++ refcount_t refcount; + u32 flags; + int id; + }; +diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h +index 3ab5c6bbb90bd..35c108a6b8720 100644 +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -103,6 +103,7 @@ extern struct percpu_counter sctp_sockets_allocated; + int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *); + struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *); + ++typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *); + void sctp_transport_walk_start(struct rhashtable_iter *iter); + void sctp_transport_walk_stop(struct rhashtable_iter *iter); + struct sctp_transport *sctp_transport_get_next(struct net *net, +@@ -113,9 +114,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), + struct net *net, + const union sctp_addr *laddr, + const union sctp_addr *paddr, void *p); +-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), +- int (*cb_done)(struct sctp_transport *, void *), +- struct net *net, int *pos, void *p); ++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, ++ struct net *net, int *pos, void *p); + int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); + int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, + struct sctp_info *info); +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index fd7c3f76040c3..cb05e503c9cd1 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -1345,6 +1345,7 @@ struct sctp_endpoint { + + u32 secid; + u32 peer_secid; ++ struct rcu_head rcu; + }; + + /* Recover the outter endpoint structure. */ +@@ -1360,7 +1361,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base) + struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t); + void sctp_endpoint_free(struct sctp_endpoint *); + void sctp_endpoint_put(struct sctp_endpoint *); +-void sctp_endpoint_hold(struct sctp_endpoint *); ++int sctp_endpoint_hold(struct sctp_endpoint *ep); + void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *); + struct sctp_association *sctp_endpoint_lookup_assoc( + const struct sctp_endpoint *ep, +diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h +index f6e3c8c9c7449..4fa4e979e948a 100644 +--- a/include/uapi/linux/nfc.h ++++ b/include/uapi/linux/nfc.h +@@ -263,7 +263,7 @@ enum nfc_sdp_attr { + #define NFC_SE_ENABLED 0x1 + + struct sockaddr_nfc { +- sa_family_t sa_family; ++ __kernel_sa_family_t sa_family; + __u32 dev_idx; + __u32 target_idx; + __u32 nfc_protocol; +@@ -271,14 +271,14 @@ struct sockaddr_nfc { + + #define NFC_LLCP_MAX_SERVICE_NAME 63 + struct sockaddr_nfc_llcp { +- sa_family_t sa_family; ++ __kernel_sa_family_t sa_family; + __u32 dev_idx; + __u32 target_idx; + __u32 nfc_protocol; + __u8 dsap; /* Destination SAP, if known */ + __u8 ssap; /* Source SAP to be bound to */ + char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */; +- size_t service_name_len; ++ __kernel_size_t service_name_len; + }; + + /* NFC socket protocols */ +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 70f92aaca4110..c800220c404d5 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1974,6 +1974,10 @@ static int __init inet_init(void) + + ip_init(); + ++ /* Initialise per-cpu ipv4 mibs */ ++ if (init_ipv4_mibs()) ++ panic("%s: Cannot init ipv4 mibs\n", __func__); ++ + /* Setup TCP slab cache for open requests. */ + tcp_init(); + +@@ -2004,12 +2008,6 @@ static int __init inet_init(void) + + if (init_inet_pernet_ops()) + pr_crit("%s: Cannot init ipv4 inet pernet ops\n", __func__); +- /* +- * Initialise per-cpu ipv4 mibs +- */ +- +- if (init_ipv4_mibs()) +- pr_crit("%s: Cannot init ipv4 mibs\n", __func__); + + ipv4_proc_init(); + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 818fc99756256..a71bfa5b02770 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1132,7 +1132,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, + kfree_skb(skb); + return -EINVAL; + } +- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) { ++ if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) { + kfree_skb(skb); + return -EINVAL; + } +diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c +index a33ea45dec054..27700887c3217 100644 +--- a/net/ncsi/ncsi-netlink.c ++++ b/net/ncsi/ncsi-netlink.c +@@ -112,7 +112,11 @@ static int ncsi_write_package_info(struct sk_buff *skb, + pnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR); + if (!pnest) + return -ENOMEM; +- nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); ++ rc = nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); ++ if (rc) { ++ nla_nest_cancel(skb, pnest); ++ return rc; ++ } + if ((0x1 << np->id) == ndp->package_whitelist) + nla_put_flag(skb, NCSI_PKG_ATTR_FORCED); + cnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR_CHANNEL_LIST); +diff --git a/net/sctp/diag.c b/net/sctp/diag.c +index ba9f64fdfd238..7921e77fa55a3 100644 +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -292,9 +292,8 @@ out: + return err; + } + +-static int sctp_sock_dump(struct sctp_transport *tsp, void *p) ++static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) + { +- struct sctp_endpoint *ep = tsp->asoc->ep; + struct sctp_comm_param *commp = p; + struct sock *sk = ep->base.sk; + struct sk_buff *skb = commp->skb; +@@ -304,6 +303,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) + int err = 0; + + lock_sock(sk); ++ if (ep != tsp->asoc->ep) ++ goto release; + list_for_each_entry(assoc, &ep->asocs, asocs) { + if (cb->args[4] < cb->args[1]) + goto next; +@@ -346,9 +347,8 @@ release: + return err; + } + +-static int sctp_sock_filter(struct sctp_transport *tsp, void *p) ++static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) + { +- struct sctp_endpoint *ep = tsp->asoc->ep; + struct sctp_comm_param *commp = p; + struct sock *sk = ep->base.sk; + const struct inet_diag_req_v2 *r = commp->r; +@@ -506,8 +506,8 @@ skip: + if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE))) + goto done; + +- sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump, +- net, &pos, &commp); ++ sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump, ++ net, &pos, &commp); + cb->args[2] = pos; + + done: +diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c +index 3067deb0fbec1..665a22d5c725b 100644 +--- a/net/sctp/endpointola.c ++++ b/net/sctp/endpointola.c +@@ -184,6 +184,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep) + } + + /* Final destructor for endpoint. */ ++static void sctp_endpoint_destroy_rcu(struct rcu_head *head) ++{ ++ struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu); ++ struct sock *sk = ep->base.sk; ++ ++ sctp_sk(sk)->ep = NULL; ++ sock_put(sk); ++ ++ kfree(ep); ++ SCTP_DBG_OBJCNT_DEC(ep); ++} ++ + static void sctp_endpoint_destroy(struct sctp_endpoint *ep) + { + struct sock *sk; +@@ -213,18 +225,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) + if (sctp_sk(sk)->bind_hash) + sctp_put_port(sk); + +- sctp_sk(sk)->ep = NULL; +- /* Give up our hold on the sock */ +- sock_put(sk); +- +- kfree(ep); +- SCTP_DBG_OBJCNT_DEC(ep); ++ call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu); + } + + /* Hold a reference to an endpoint. */ +-void sctp_endpoint_hold(struct sctp_endpoint *ep) ++int sctp_endpoint_hold(struct sctp_endpoint *ep) + { +- refcount_inc(&ep->base.refcnt); ++ return refcount_inc_not_zero(&ep->base.refcnt); + } + + /* Release a reference to an endpoint and clean up if there are +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 2146372adff43..565aa77fe5cbe 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5395,11 +5395,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), + } + EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); + +-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), +- int (*cb_done)(struct sctp_transport *, void *), +- struct net *net, int *pos, void *p) { ++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, ++ struct net *net, int *pos, void *p) ++{ + struct rhashtable_iter hti; + struct sctp_transport *tsp; ++ struct sctp_endpoint *ep; + int ret; + + again: +@@ -5408,26 +5409,32 @@ again: + + tsp = sctp_transport_get_idx(net, &hti, *pos + 1); + for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { +- ret = cb(tsp, p); +- if (ret) +- break; ++ ep = tsp->asoc->ep; ++ if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ ++ ret = cb(ep, tsp, p); ++ if (ret) ++ break; ++ sctp_endpoint_put(ep); ++ } + (*pos)++; + sctp_transport_put(tsp); + } + sctp_transport_walk_stop(&hti); + + if (ret) { +- if (cb_done && !cb_done(tsp, p)) { ++ if (cb_done && !cb_done(ep, tsp, p)) { + (*pos)++; ++ sctp_endpoint_put(ep); + sctp_transport_put(tsp); + goto again; + } ++ sctp_endpoint_put(ep); + sctp_transport_put(tsp); + } + + return ret; + } +-EXPORT_SYMBOL_GPL(sctp_for_each_transport); ++EXPORT_SYMBOL_GPL(sctp_transport_traverse_process); + + /* 7.2.1 Association Status (SCTP_STATUS) + +diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl +index a4ca050815aba..dc1d3696af6b8 100755 +--- a/scripts/recordmcount.pl ++++ b/scripts/recordmcount.pl +@@ -252,7 +252,7 @@ if ($arch eq "x86_64") { + + } elsif ($arch eq "s390" && $bits == 64) { + if ($cc =~ /-DCC_USING_HOTPATCH/) { +- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; ++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(brcl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; + $mcount_adjust = 0; + } else { + $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$"; +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 8b9cbe1e8ee22..91f2ba0b225b7 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5734,7 +5734,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, + struct common_audit_data ad; + struct lsm_network_audit net = {0,}; + char *addrp; +- u8 proto; ++ u8 proto = 0; + + if (sk == NULL) + return NF_ACCEPT; +diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c +index eba0b3395851e..861fc6f4ebfb7 100644 +--- a/security/tomoyo/util.c ++++ b/security/tomoyo/util.c +@@ -1029,6 +1029,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) + return false; + if (!domain) + return true; ++ if (READ_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED])) ++ return false; + list_for_each_entry_rcu(ptr, &domain->acl_info_list, list, + srcu_read_lock_held(&tomoyo_ss)) { + u16 perm; +@@ -1074,14 +1076,12 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) + if (count < tomoyo_profile(domain->ns, domain->profile)-> + pref[TOMOYO_PREF_MAX_LEARNING_ENTRY]) + return true; +- if (!domain->flags[TOMOYO_DIF_QUOTA_WARNED]) { +- domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true; +- /* r->granted = false; */ +- tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); ++ WRITE_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED], true); ++ /* r->granted = false; */ ++ tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); + #ifndef CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING +- pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", +- domain->domainname->name); ++ pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", ++ domain->domainname->name); + #endif +- } + return false; + } +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 3a169a026635d..bbf1f2d3387e3 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2308,7 +2308,7 @@ static int process_switch_event(struct perf_tool *tool, + if (perf_event__process_switch(tool, event, sample, machine) < 0) + return -1; + +- if (scripting_ops && scripting_ops->process_switch) ++ if (scripting_ops && scripting_ops->process_switch && !filter_cpu(sample)) + scripting_ops->process_switch(event, sample, machine); + + if (!script->show_switch_events) +diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c +index c66da6ffd6d8d..7badaf215de28 100644 +--- a/tools/testing/selftests/net/udpgso.c ++++ b/tools/testing/selftests/net/udpgso.c +@@ -156,13 +156,13 @@ struct testcase testcases_v4[] = { + }, + { + /* send max number of min sized segments */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, ++ .tlen = UDP_MAX_SEGMENTS, + .gso_len = 1, +- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, ++ .r_num_mss = UDP_MAX_SEGMENTS, + }, + { + /* send max number + 1 of min sized segments: fail */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4 + 1, ++ .tlen = UDP_MAX_SEGMENTS + 1, + .gso_len = 1, + .tfail = true, + }, +@@ -259,13 +259,13 @@ struct testcase testcases_v6[] = { + }, + { + /* send max number of min sized segments */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, ++ .tlen = UDP_MAX_SEGMENTS, + .gso_len = 1, +- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, ++ .r_num_mss = UDP_MAX_SEGMENTS, + }, + { + /* send max number + 1 of min sized segments: fail */ +- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6 + 1, ++ .tlen = UDP_MAX_SEGMENTS + 1, + .gso_len = 1, + .tfail = true, + }, +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index 17512a43885e7..f1fdaa2702913 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -419,6 +419,7 @@ static void usage(const char *filepath) + + static void parse_opts(int argc, char **argv) + { ++ const char *bind_addr = NULL; + int max_len, hdrlen; + int c; + +@@ -446,7 +447,7 @@ static void parse_opts(int argc, char **argv) + cfg_cpu = strtol(optarg, NULL, 0); + break; + case 'D': +- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr); ++ bind_addr = optarg; + break; + case 'l': + cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; +@@ -492,6 +493,11 @@ static void parse_opts(int argc, char **argv) + } + } + ++ if (!bind_addr) ++ bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0"; ++ ++ setup_sockaddr(cfg_family, bind_addr, &cfg_dst_addr); ++ + if (optind != argc) + usage(argv[0]); +