Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0134-4.9.35-all-fixes.patch

    Contents of /trunk/kernel-alx-legacy/patches-4.9/0134-4.9.35-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3608 - (show annotations) (download)
    Fri Aug 14 07:34:29 2020 UTC (3 years, 8 months ago) by niro
    File size: 63041 byte(s) 
    -added kerenl-alx-legacy pkg
    1 diff --git a/Makefile b/Makefile
    2 index a40b373eba3a..0a8d47465f97 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 34
    9 +SUBLEVEL = 35
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 @@ -651,6 +651,12 @@ KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
    14 # Tell gcc to never replace conditional load with a non-conditional one
    15 KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
    16
    17 +# check for 'asm goto'
    18 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
    19 + KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
    20 + KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
    21 +endif
    22 +
    23 include scripts/Makefile.gcc-plugins
    24
    25 ifdef CONFIG_READABLE_ASM
    26 @@ -796,12 +802,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types)
    27 # use the deterministic mode of AR if available
    28 KBUILD_ARFLAGS := $(call ar-option,D)
    29
    30 -# check for 'asm goto'
    31 -ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
    32 - KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
    33 - KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
    34 -endif
    35 -
    36 include scripts/Makefile.kasan
    37 include scripts/Makefile.extrawarn
    38 include scripts/Makefile.ubsan
    39 diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
    40 index a2c2478e7d78..4bcfe01b5aad 100644
    41 --- a/arch/arm64/kernel/vdso.c
    42 +++ b/arch/arm64/kernel/vdso.c
    43 @@ -217,10 +217,11 @@ void update_vsyscall(struct timekeeper *tk)
    44 /* tkr_mono.cycle_last == tkr_raw.cycle_last */
    45 vdso_data->cs_cycle_last = tk->tkr_mono.cycle_last;
    46 vdso_data->raw_time_sec = tk->raw_time.tv_sec;
    47 - vdso_data->raw_time_nsec = tk->raw_time.tv_nsec;
    48 + vdso_data->raw_time_nsec = (tk->raw_time.tv_nsec <<
    49 + tk->tkr_raw.shift) +
    50 + tk->tkr_raw.xtime_nsec;
    51 vdso_data->xtime_clock_sec = tk->xtime_sec;
    52 vdso_data->xtime_clock_nsec = tk->tkr_mono.xtime_nsec;
    53 - /* tkr_raw.xtime_nsec == 0 */
    54 vdso_data->cs_mono_mult = tk->tkr_mono.mult;
    55 vdso_data->cs_raw_mult = tk->tkr_raw.mult;
    56 /* tkr_mono.shift == tkr_raw.shift */
    57 diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
    58 index e00b4671bd7c..76320e920965 100644
    59 --- a/arch/arm64/kernel/vdso/gettimeofday.S
    60 +++ b/arch/arm64/kernel/vdso/gettimeofday.S
    61 @@ -256,7 +256,6 @@ monotonic_raw:
    62 seqcnt_check fail=monotonic_raw
    63
    64 /* All computations are done with left-shifted nsecs. */
    65 - lsl x14, x14, x12
    66 get_nsec_per_sec res=x9
    67 lsl x9, x9, x12
    68
    69 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
    70 index 1ba82ea90230..2e2fc1e37715 100644
    71 --- a/arch/powerpc/kernel/exceptions-64s.S
    72 +++ b/arch/powerpc/kernel/exceptions-64s.S
    73 @@ -1411,10 +1411,8 @@ USE_TEXT_SECTION()
    74 .align 7
    75 do_hash_page:
    76 #ifdef CONFIG_PPC_STD_MMU_64
    77 - andis. r0,r4,0xa410 /* weird error? */
    78 + andis. r0,r4,0xa450 /* weird error? */
    79 bne- handle_page_fault /* if not, try to insert a HPTE */
    80 - andis. r0,r4,DSISR_DABRMATCH@h
    81 - bne- handle_dabr_fault
    82 CURRENT_THREAD_INFO(r11, r1)
    83 lwz r0,TI_PREEMPT(r11) /* If we're in an "NMI" */
    84 andis. r0,r0,NMI_MASK@h /* (i.e. an irq when soft-disabled) */
    85 @@ -1438,11 +1436,16 @@ do_hash_page:
    86
    87 /* Error */
    88 blt- 13f
    89 +
    90 + /* Reload DSISR into r4 for the DABR check below */
    91 + ld r4,_DSISR(r1)
    92 #endif /* CONFIG_PPC_STD_MMU_64 */
    93
    94 /* Here we have a page fault that hash_page can't handle. */
    95 handle_page_fault:
    96 -11: ld r4,_DAR(r1)
    97 +11: andis. r0,r4,DSISR_DABRMATCH@h
    98 + bne- handle_dabr_fault
    99 + ld r4,_DAR(r1)
    100 ld r5,_DSISR(r1)
    101 addi r3,r1,STACK_FRAME_OVERHEAD
    102 bl do_page_fault
    103 diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
    104 index e785cc9e1ecd..fe97cbe04576 100644
    105 --- a/arch/powerpc/kernel/kprobes.c
    106 +++ b/arch/powerpc/kernel/kprobes.c
    107 @@ -511,6 +511,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
    108 regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
    109 #endif
    110
    111 + /*
    112 + * jprobes use jprobe_return() which skips the normal return
    113 + * path of the function, and this messes up the accounting of the
    114 + * function graph tracer.
    115 + *
    116 + * Pause function graph tracing while performing the jprobe function.
    117 + */
    118 + pause_graph_tracing();
    119 +
    120 return 1;
    121 }
    122
    123 @@ -533,6 +542,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
    124 * saved regs...
    125 */
    126 memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
    127 + /* It's OK to start function graph tracing again */
    128 + unpause_graph_tracing();
    129 preempt_enable_no_resched();
    130 return 1;
    131 }
    132 diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
    133 index 094deb60c6fe..5c0298422300 100644
    134 --- a/arch/powerpc/kvm/book3s_hv.c
    135 +++ b/arch/powerpc/kvm/book3s_hv.c
    136 @@ -2807,12 +2807,34 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
    137 {
    138 int r;
    139 int srcu_idx;
    140 + unsigned long ebb_regs[3] = {}; /* shut up GCC */
    141
    142 if (!vcpu->arch.sane) {
    143 run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
    144 return -EINVAL;
    145 }
    146
    147 + /*
    148 + * Don't allow entry with a suspended transaction, because
    149 + * the guest entry/exit code will lose it.
    150 + * If the guest has TM enabled, save away their TM-related SPRs
    151 + * (they will get restored by the TM unavailable interrupt).
    152 + */
    153 +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
    154 + if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
    155 + (current->thread.regs->msr & MSR_TM)) {
    156 + if (MSR_TM_ACTIVE(current->thread.regs->msr)) {
    157 + run->exit_reason = KVM_EXIT_FAIL_ENTRY;
    158 + run->fail_entry.hardware_entry_failure_reason = 0;
    159 + return -EINVAL;
    160 + }
    161 + current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
    162 + current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
    163 + current->thread.tm_texasr = mfspr(SPRN_TEXASR);
    164 + current->thread.regs->msr &= ~MSR_TM;
    165 + }
    166 +#endif
    167 +
    168 kvmppc_core_prepare_to_enter(vcpu);
    169
    170 /* No need to go into the guest when all we'll do is come back out */
    171 @@ -2834,6 +2856,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
    172
    173 flush_all_to_thread(current);
    174
    175 + /* Save userspace EBB register values */
    176 + if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
    177 + ebb_regs[0] = mfspr(SPRN_EBBHR);
    178 + ebb_regs[1] = mfspr(SPRN_EBBRR);
    179 + ebb_regs[2] = mfspr(SPRN_BESCR);
    180 + }
    181 +
    182 vcpu->arch.wqp = &vcpu->arch.vcore->wq;
    183 vcpu->arch.pgdir = current->mm->pgd;
    184 vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
    185 @@ -2856,6 +2885,13 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
    186 r = kvmppc_xics_rm_complete(vcpu, 0);
    187 } while (is_kvmppc_resume_guest(r));
    188
    189 + /* Restore userspace EBB register values */
    190 + if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
    191 + mtspr(SPRN_EBBHR, ebb_regs[0]);
    192 + mtspr(SPRN_EBBRR, ebb_regs[1]);
    193 + mtspr(SPRN_BESCR, ebb_regs[2]);
    194 + }
    195 +
    196 out:
    197 vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
    198 atomic_dec(&vcpu->kvm->arch.vcpus_running);
    199 diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c
    200 index d24a8a3668fa..28ae8bd6228e 100644
    201 --- a/arch/powerpc/perf/perf_regs.c
    202 +++ b/arch/powerpc/perf/perf_regs.c
    203 @@ -100,5 +100,6 @@ void perf_get_regs_user(struct perf_regs *regs_user,
    204 struct pt_regs *regs_user_copy)
    205 {
    206 regs_user->regs = task_pt_regs(current);
    207 - regs_user->abi = perf_reg_abi(current);
    208 + regs_user->abi = (regs_user->regs) ? perf_reg_abi(current) :
    209 + PERF_SAMPLE_REGS_ABI_NONE;
    210 }
    211 diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
    212 index 4aa8a7e2a1da..f5d79840f4e0 100644
    213 --- a/arch/s390/kvm/gaccess.c
    214 +++ b/arch/s390/kvm/gaccess.c
    215 @@ -972,11 +972,12 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
    216 ptr = asce.origin * 4096;
    217 if (asce.r) {
    218 *fake = 1;
    219 + ptr = 0;
    220 asce.dt = ASCE_TYPE_REGION1;
    221 }
    222 switch (asce.dt) {
    223 case ASCE_TYPE_REGION1:
    224 - if (vaddr.rfx01 > asce.tl && !asce.r)
    225 + if (vaddr.rfx01 > asce.tl && !*fake)
    226 return PGM_REGION_FIRST_TRANS;
    227 break;
    228 case ASCE_TYPE_REGION2:
    229 @@ -1004,8 +1005,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
    230 union region1_table_entry rfte;
    231
    232 if (*fake) {
    233 - /* offset in 16EB guest memory block */
    234 - ptr = ptr + ((unsigned long) vaddr.rsx << 53UL);
    235 + ptr += (unsigned long) vaddr.rfx << 53;
    236 rfte.val = ptr;
    237 goto shadow_r2t;
    238 }
    239 @@ -1031,8 +1031,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
    240 union region2_table_entry rste;
    241
    242 if (*fake) {
    243 - /* offset in 8PB guest memory block */
    244 - ptr = ptr + ((unsigned long) vaddr.rtx << 42UL);
    245 + ptr += (unsigned long) vaddr.rsx << 42;
    246 rste.val = ptr;
    247 goto shadow_r3t;
    248 }
    249 @@ -1059,8 +1058,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
    250 union region3_table_entry rtte;
    251
    252 if (*fake) {
    253 - /* offset in 4TB guest memory block */
    254 - ptr = ptr + ((unsigned long) vaddr.sx << 31UL);
    255 + ptr += (unsigned long) vaddr.rtx << 31;
    256 rtte.val = ptr;
    257 goto shadow_sgt;
    258 }
    259 @@ -1096,8 +1094,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
    260 union segment_table_entry ste;
    261
    262 if (*fake) {
    263 - /* offset in 2G guest memory block */
    264 - ptr = ptr + ((unsigned long) vaddr.sx << 20UL);
    265 + ptr += (unsigned long) vaddr.sx << 20;
    266 ste.val = ptr;
    267 goto shadow_pgt;
    268 }
    269 diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
    270 index cb8522290e6a..3bdb917716b1 100644
    271 --- a/arch/x86/events/intel/core.c
    272 +++ b/arch/x86/events/intel/core.c
    273 @@ -431,11 +431,11 @@ static __initconst const u64 skl_hw_cache_event_ids
    274 [ C(DTLB) ] = {
    275 [ C(OP_READ) ] = {
    276 [ C(RESULT_ACCESS) ] = 0x81d0, /* MEM_INST_RETIRED.ALL_LOADS */
    277 - [ C(RESULT_MISS) ] = 0x608, /* DTLB_LOAD_MISSES.WALK_COMPLETED */
    278 + [ C(RESULT_MISS) ] = 0xe08, /* DTLB_LOAD_MISSES.WALK_COMPLETED */
    279 },
    280 [ C(OP_WRITE) ] = {
    281 [ C(RESULT_ACCESS) ] = 0x82d0, /* MEM_INST_RETIRED.ALL_STORES */
    282 - [ C(RESULT_MISS) ] = 0x649, /* DTLB_STORE_MISSES.WALK_COMPLETED */
    283 + [ C(RESULT_MISS) ] = 0xe49, /* DTLB_STORE_MISSES.WALK_COMPLETED */
    284 },
    285 [ C(OP_PREFETCH) ] = {
    286 [ C(RESULT_ACCESS) ] = 0x0,
    287 diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
    288 index 4a80ee752597..c42202d63567 100644
    289 --- a/drivers/block/xen-blkback/blkback.c
    290 +++ b/drivers/block/xen-blkback/blkback.c
    291 @@ -1436,34 +1436,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring,
    292 static void make_response(struct xen_blkif_ring *ring, u64 id,
    293 unsigned short op, int st)
    294 {
    295 - struct blkif_response resp;
    296 + struct blkif_response *resp;
    297 unsigned long flags;
    298 union blkif_back_rings *blk_rings;
    299 int notify;
    300
    301 - resp.id = id;
    302 - resp.operation = op;
    303 - resp.status = st;
    304 -
    305 spin_lock_irqsave(&ring->blk_ring_lock, flags);
    306 blk_rings = &ring->blk_rings;
    307 /* Place on the response ring for the relevant domain. */
    308 switch (ring->blkif->blk_protocol) {
    309 case BLKIF_PROTOCOL_NATIVE:
    310 - memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt),
    311 - &resp, sizeof(resp));
    312 + resp = RING_GET_RESPONSE(&blk_rings->native,
    313 + blk_rings->native.rsp_prod_pvt);
    314 break;
    315 case BLKIF_PROTOCOL_X86_32:
    316 - memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt),
    317 - &resp, sizeof(resp));
    318 + resp = RING_GET_RESPONSE(&blk_rings->x86_32,
    319 + blk_rings->x86_32.rsp_prod_pvt);
    320 break;
    321 case BLKIF_PROTOCOL_X86_64:
    322 - memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt),
    323 - &resp, sizeof(resp));
    324 + resp = RING_GET_RESPONSE(&blk_rings->x86_64,
    325 + blk_rings->x86_64.rsp_prod_pvt);
    326 break;
    327 default:
    328 BUG();
    329 }
    330 +
    331 + resp->id = id;
    332 + resp->operation = op;
    333 + resp->status = st;
    334 +
    335 blk_rings->common.rsp_prod_pvt++;
    336 RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify);
    337 spin_unlock_irqrestore(&ring->blk_ring_lock, flags);
    338 diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
    339 index dea61f6ab8cb..ecb35fe8ca8d 100644
    340 --- a/drivers/block/xen-blkback/common.h
    341 +++ b/drivers/block/xen-blkback/common.h
    342 @@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues;
    343 struct blkif_common_request {
    344 char dummy;
    345 };
    346 -struct blkif_common_response {
    347 - char dummy;
    348 -};
    349 +
    350 +/* i386 protocol version */
    351
    352 struct blkif_x86_32_request_rw {
    353 uint8_t nr_segments; /* number of segments */
    354 @@ -129,14 +128,6 @@ struct blkif_x86_32_request {
    355 } u;
    356 } __attribute__((__packed__));
    357
    358 -/* i386 protocol version */
    359 -#pragma pack(push, 4)
    360 -struct blkif_x86_32_response {
    361 - uint64_t id; /* copied from request */
    362 - uint8_t operation; /* copied from request */
    363 - int16_t status; /* BLKIF_RSP_??? */
    364 -};
    365 -#pragma pack(pop)
    366 /* x86_64 protocol version */
    367
    368 struct blkif_x86_64_request_rw {
    369 @@ -193,18 +184,12 @@ struct blkif_x86_64_request {
    370 } u;
    371 } __attribute__((__packed__));
    372
    373 -struct blkif_x86_64_response {
    374 - uint64_t __attribute__((__aligned__(8))) id;
    375 - uint8_t operation; /* copied from request */
    376 - int16_t status; /* BLKIF_RSP_??? */
    377 -};
    378 -
    379 DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
    380 - struct blkif_common_response);
    381 + struct blkif_response);
    382 DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
    383 - struct blkif_x86_32_response);
    384 + struct blkif_response __packed);
    385 DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
    386 - struct blkif_x86_64_response);
    387 + struct blkif_response);
    388
    389 union blkif_back_rings {
    390 struct blkif_back_ring native;
    391 @@ -281,6 +266,7 @@ struct xen_blkif_ring {
    392
    393 wait_queue_head_t wq;
    394 atomic_t inflight;
    395 + bool active;
    396 /* One thread per blkif ring. */
    397 struct task_struct *xenblkd;
    398 unsigned int waiting_reqs;
    399 diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
    400 index 3cc6d1d86f1e..9b69fe410c08 100644
    401 --- a/drivers/block/xen-blkback/xenbus.c
    402 +++ b/drivers/block/xen-blkback/xenbus.c
    403 @@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
    404 init_waitqueue_head(&ring->shutdown_wq);
    405 ring->blkif = blkif;
    406 ring->st_print = jiffies;
    407 - xen_blkif_get(blkif);
    408 + ring->active = true;
    409 }
    410
    411 return 0;
    412 @@ -249,6 +249,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
    413 struct xen_blkif_ring *ring = &blkif->rings[r];
    414 unsigned int i = 0;
    415
    416 + if (!ring->active)
    417 + continue;
    418 +
    419 if (ring->xenblkd) {
    420 kthread_stop(ring->xenblkd);
    421 wake_up(&ring->shutdown_wq);
    422 @@ -296,7 +299,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
    423 BUG_ON(ring->free_pages_num != 0);
    424 BUG_ON(ring->persistent_gnt_c != 0);
    425 WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
    426 - xen_blkif_put(blkif);
    427 + ring->active = false;
    428 }
    429 blkif->nr_ring_pages = 0;
    430 /*
    431 diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
    432 index 8ca07fe8d3f3..0cca3601d99e 100644
    433 --- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
    434 +++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
    435 @@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents,
    436 0x12c, 0, 4, 24, 3, BIT(31),
    437 CLK_SET_RATE_PARENT);
    438 static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents,
    439 - 0x12c, 0, 4, 24, 3, BIT(31),
    440 + 0x130, 0, 4, 24, 3, BIT(31),
    441 CLK_SET_RATE_PARENT);
    442
    443 static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1",
    444 diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
    445 index e18dc596cf24..6204cc32d09c 100644
    446 --- a/drivers/dma/bcm2835-dma.c
    447 +++ b/drivers/dma/bcm2835-dma.c
    448 @@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length(
    449 */
    450
    451 /* have we filled in period_length yet? */
    452 - if (*total_len + control_block->length < period_len)
    453 + if (*total_len + control_block->length < period_len) {
    454 + /* update number of bytes in this period so far */
    455 + *total_len += control_block->length;
    456 return;
    457 + }
    458
    459 /* calculate the length that remains to reach period_length */
    460 control_block->length = period_len - *total_len;
    461 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
    462 index 8e6bf548d689..f8fdbd1378a7 100644
    463 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
    464 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
    465 @@ -693,6 +693,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev)
    466 DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
    467 adev->clock.default_dispclk / 100);
    468 adev->clock.default_dispclk = 60000;
    469 + } else if (adev->clock.default_dispclk <= 60000) {
    470 + DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n",
    471 + adev->clock.default_dispclk / 100);
    472 + adev->clock.default_dispclk = 62500;
    473 }
    474 adev->clock.dp_extclk =
    475 le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
    476 diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
    477 index f7d236f95e74..57fbde14e978 100644
    478 --- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
    479 +++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
    480 @@ -164,7 +164,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
    481 struct drm_device *dev = crtc->dev;
    482 struct amdgpu_device *adev = dev->dev_private;
    483 int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
    484 - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
    485 + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
    486
    487 memset(&args, 0, sizeof(args));
    488
    489 @@ -177,7 +177,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
    490 void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev)
    491 {
    492 int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
    493 - ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
    494 + ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
    495
    496 memset(&args, 0, sizeof(args));
    497
    498 diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
    499 index 432480ff9d22..3178ba0c537c 100644
    500 --- a/drivers/gpu/drm/radeon/radeon_combios.c
    501 +++ b/drivers/gpu/drm/radeon/radeon_combios.c
    502 @@ -3393,6 +3393,13 @@ void radeon_combios_asic_init(struct drm_device *dev)
    503 rdev->pdev->subsystem_vendor == 0x103c &&
    504 rdev->pdev->subsystem_device == 0x280a)
    505 return;
    506 + /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume
    507 + * - it hangs on resume inside the dynclk 1 table.
    508 + */
    509 + if (rdev->family == CHIP_RS400 &&
    510 + rdev->pdev->subsystem_vendor == 0x1179 &&
    511 + rdev->pdev->subsystem_device == 0xff31)
    512 + return;
    513
    514 /* DYN CLK 1 */
    515 table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
    516 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
    517 index 621af069a3d2..3b21ca5a6c81 100644
    518 --- a/drivers/gpu/drm/radeon/radeon_device.c
    519 +++ b/drivers/gpu/drm/radeon/radeon_device.c
    520 @@ -136,6 +136,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = {
    521 * https://bugzilla.kernel.org/show_bug.cgi?id=51381
    522 */
    523 { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
    524 + /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
    525 + * https://bugs.freedesktop.org/show_bug.cgi?id=101491
    526 + */
    527 + { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
    528 /* macbook pro 8.2 */
    529 { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP },
    530 { 0, 0, 0, 0, 0 },
    531 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    532 index da9307701abe..cfca43f635a6 100644
    533 --- a/drivers/hid/hid-ids.h
    534 +++ b/drivers/hid/hid-ids.h
    535 @@ -311,6 +311,9 @@
    536 #define USB_VENDOR_ID_DELCOM 0x0fc5
    537 #define USB_DEVICE_ID_DELCOM_VISUAL_IND 0xb080
    538
    539 +#define USB_VENDOR_ID_DELL 0x413c
    540 +#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a
    541 +
    542 #define USB_VENDOR_ID_DELORME 0x1163
    543 #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100
    544 #define USB_DEVICE_ID_DELORME_EM_LT20 0x0200
    545 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
    546 index 97dbb2562ace..2b1620797959 100644
    547 --- a/drivers/hid/usbhid/hid-quirks.c
    548 +++ b/drivers/hid/usbhid/hid-quirks.c
    549 @@ -81,6 +81,7 @@ static const struct hid_blacklist {
    550 { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
    551 { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
    552 { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
    553 + { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
    554 { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
    555 { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
    556 { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
    557 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    558 index e7b96f1ac2c5..5be14ad29d46 100644
    559 --- a/drivers/input/serio/i8042-x86ia64io.h
    560 +++ b/drivers/input/serio/i8042-x86ia64io.h
    561 @@ -788,6 +788,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
    562 DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
    563 },
    564 },
    565 + {
    566 + /* Fujitsu UH554 laptop */
    567 + .matches = {
    568 + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
    569 + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"),
    570 + },
    571 + },
    572 { }
    573 };
    574
    575 diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
    576 index d0fc165d7d66..21dde5249085 100644
    577 --- a/drivers/mtd/spi-nor/spi-nor.c
    578 +++ b/drivers/mtd/spi-nor/spi-nor.c
    579 @@ -1255,6 +1255,13 @@ static int spansion_quad_enable(struct spi_nor *nor)
    580 return -EINVAL;
    581 }
    582
    583 + ret = spi_nor_wait_till_ready(nor);
    584 + if (ret) {
    585 + dev_err(nor->dev,
    586 + "timeout while writing configuration register\n");
    587 + return ret;
    588 + }
    589 +
    590 /* read back and check it */
    591 ret = read_cr(nor);
    592 if (!(ret > 0 && (ret & CR_QUAD_EN_SPAN))) {
    593 diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
    594 index f9c2feb4a4e7..0c2a32a305bc 100644
    595 --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
    596 +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
    597 @@ -2201,9 +2201,10 @@ static int cxgb_up(struct adapter *adap)
    598 {
    599 int err;
    600
    601 + mutex_lock(&uld_mutex);
    602 err = setup_sge_queues(adap);
    603 if (err)
    604 - goto out;
    605 + goto rel_lock;
    606 err = setup_rss(adap);
    607 if (err)
    608 goto freeq;
    609 @@ -2227,7 +2228,6 @@ static int cxgb_up(struct adapter *adap)
    610 goto irq_err;
    611 }
    612
    613 - mutex_lock(&uld_mutex);
    614 enable_rx(adap);
    615 t4_sge_start(adap);
    616 t4_intr_enable(adap);
    617 @@ -2240,13 +2240,15 @@ static int cxgb_up(struct adapter *adap)
    618 #endif
    619 /* Initialize hash mac addr list*/
    620 INIT_LIST_HEAD(&adap->mac_hlist);
    621 - out:
    622 return err;
    623 +
    624 irq_err:
    625 dev_err(adap->pdev_dev, "request_irq failed, err %d\n", err);
    626 freeq:
    627 t4_free_sge_resources(adap);
    628 - goto out;
    629 + rel_lock:
    630 + mutex_unlock(&uld_mutex);
    631 + return err;
    632 }
    633
    634 static void cxgb_down(struct adapter *adapter)
    635 diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
    636 index d6a541bde331..2f70f80de27f 100644
    637 --- a/drivers/net/phy/marvell.c
    638 +++ b/drivers/net/phy/marvell.c
    639 @@ -1114,8 +1114,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
    640 if (adv < 0)
    641 return adv;
    642
    643 - lpa &= adv;
    644 -
    645 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
    646 phydev->duplex = DUPLEX_FULL;
    647 else
    648 diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c
    649 index c0b4e65267af..46fe1ae919a3 100644
    650 --- a/drivers/net/phy/mdio-bcm-iproc.c
    651 +++ b/drivers/net/phy/mdio-bcm-iproc.c
    652 @@ -81,8 +81,6 @@ static int iproc_mdio_read(struct mii_bus *bus, int phy_id, int reg)
    653 if (rc)
    654 return rc;
    655
    656 - iproc_mdio_config_clk(priv->base);
    657 -
    658 /* Prepare the read operation */
    659 cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) |
    660 (reg << MII_DATA_RA_SHIFT) |
    661 @@ -112,8 +110,6 @@ static int iproc_mdio_write(struct mii_bus *bus, int phy_id,
    662 if (rc)
    663 return rc;
    664
    665 - iproc_mdio_config_clk(priv->base);
    666 -
    667 /* Prepare the write operation */
    668 cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) |
    669 (reg << MII_DATA_RA_SHIFT) |
    670 @@ -163,6 +159,8 @@ static int iproc_mdio_probe(struct platform_device *pdev)
    671 bus->read = iproc_mdio_read;
    672 bus->write = iproc_mdio_write;
    673
    674 + iproc_mdio_config_clk(priv->base);
    675 +
    676 rc = of_mdiobus_register(bus, pdev->dev.of_node);
    677 if (rc) {
    678 dev_err(&pdev->dev, "MDIO bus registration failed\n");
    679 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
    680 index c7c1e9906500..d231042f19d6 100644
    681 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
    682 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
    683 @@ -442,7 +442,7 @@ struct brcmf_fw {
    684 const char *nvram_name;
    685 u16 domain_nr;
    686 u16 bus_nr;
    687 - void (*done)(struct device *dev, const struct firmware *fw,
    688 + void (*done)(struct device *dev, int err, const struct firmware *fw,
    689 void *nvram_image, u32 nvram_len);
    690 };
    691
    692 @@ -477,52 +477,51 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
    693 if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
    694 goto fail;
    695
    696 - fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
    697 + fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
    698 kfree(fwctx);
    699 return;
    700
    701 fail:
    702 brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
    703 release_firmware(fwctx->code);
    704 - device_release_driver(fwctx->dev);
    705 + fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
    706 kfree(fwctx);
    707 }
    708
    709 static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
    710 {
    711 struct brcmf_fw *fwctx = ctx;
    712 - int ret;
    713 + int ret = 0;
    714
    715 brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
    716 - if (!fw)
    717 + if (!fw) {
    718 + ret = -ENOENT;
    719 goto fail;
    720 -
    721 - /* only requested code so done here */
    722 - if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
    723 - fwctx->done(fwctx->dev, fw, NULL, 0);
    724 - kfree(fwctx);
    725 - return;
    726 }
    727 + /* only requested code so done here */
    728 + if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
    729 + goto done;
    730 +
    731 fwctx->code = fw;
    732 ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
    733 fwctx->dev, GFP_KERNEL, fwctx,
    734 brcmf_fw_request_nvram_done);
    735
    736 - if (!ret)
    737 - return;
    738 -
    739 - brcmf_fw_request_nvram_done(NULL, fwctx);
    740 + /* pass NULL to nvram callback for bcm47xx fallback */
    741 + if (ret)
    742 + brcmf_fw_request_nvram_done(NULL, fwctx);
    743 return;
    744
    745 fail:
    746 brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
    747 - device_release_driver(fwctx->dev);
    748 +done:
    749 + fwctx->done(fwctx->dev, ret, fw, NULL, 0);
    750 kfree(fwctx);
    751 }
    752
    753 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
    754 const char *code, const char *nvram,
    755 - void (*fw_cb)(struct device *dev,
    756 + void (*fw_cb)(struct device *dev, int err,
    757 const struct firmware *fw,
    758 void *nvram_image, u32 nvram_len),
    759 u16 domain_nr, u16 bus_nr)
    760 @@ -555,7 +554,7 @@ int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
    761
    762 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
    763 const char *code, const char *nvram,
    764 - void (*fw_cb)(struct device *dev,
    765 + void (*fw_cb)(struct device *dev, int err,
    766 const struct firmware *fw,
    767 void *nvram_image, u32 nvram_len))
    768 {
    769 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
    770 index d3c9f0d52ae3..8fa4b7e1ab3d 100644
    771 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
    772 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
    773 @@ -73,13 +73,13 @@ void brcmf_fw_nvram_free(void *nvram);
    774 */
    775 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
    776 const char *code, const char *nvram,
    777 - void (*fw_cb)(struct device *dev,
    778 + void (*fw_cb)(struct device *dev, int err,
    779 const struct firmware *fw,
    780 void *nvram_image, u32 nvram_len),
    781 u16 domain_nr, u16 bus_nr);
    782 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
    783 const char *code, const char *nvram,
    784 - void (*fw_cb)(struct device *dev,
    785 + void (*fw_cb)(struct device *dev, int err,
    786 const struct firmware *fw,
    787 void *nvram_image, u32 nvram_len));
    788
    789 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
    790 index 3deba90c7eb5..d3d79219fbb0 100644
    791 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
    792 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
    793 @@ -1618,16 +1618,23 @@ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
    794 .write32 = brcmf_pcie_buscore_write32,
    795 };
    796
    797 -static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
    798 +static void brcmf_pcie_setup(struct device *dev, int ret,
    799 + const struct firmware *fw,
    800 void *nvram, u32 nvram_len)
    801 {
    802 - struct brcmf_bus *bus = dev_get_drvdata(dev);
    803 - struct brcmf_pciedev *pcie_bus_dev = bus->bus_priv.pcie;
    804 - struct brcmf_pciedev_info *devinfo = pcie_bus_dev->devinfo;
    805 + struct brcmf_bus *bus;
    806 + struct brcmf_pciedev *pcie_bus_dev;
    807 + struct brcmf_pciedev_info *devinfo;
    808 struct brcmf_commonring **flowrings;
    809 - int ret;
    810 u32 i;
    811
    812 + /* check firmware loading result */
    813 + if (ret)
    814 + goto fail;
    815 +
    816 + bus = dev_get_drvdata(dev);
    817 + pcie_bus_dev = bus->bus_priv.pcie;
    818 + devinfo = pcie_bus_dev->devinfo;
    819 brcmf_pcie_attach(devinfo);
    820
    821 /* Some of the firmwares have the size of the memory of the device
    822 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    823 index 2458e6e05276..8744b9beda33 100644
    824 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    825 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    826 @@ -3975,21 +3975,26 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
    827 .get_memdump = brcmf_sdio_bus_get_memdump,
    828 };
    829
    830 -static void brcmf_sdio_firmware_callback(struct device *dev,
    831 +static void brcmf_sdio_firmware_callback(struct device *dev, int err,
    832 const struct firmware *code,
    833 void *nvram, u32 nvram_len)
    834 {
    835 - struct brcmf_bus *bus_if = dev_get_drvdata(dev);
    836 - struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
    837 - struct brcmf_sdio *bus = sdiodev->bus;
    838 - int err = 0;
    839 + struct brcmf_bus *bus_if;
    840 + struct brcmf_sdio_dev *sdiodev;
    841 + struct brcmf_sdio *bus;
    842 u8 saveclk;
    843
    844 - brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
    845 + brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
    846 + bus_if = dev_get_drvdata(dev);
    847 + sdiodev = bus_if->bus_priv.sdio;
    848 + if (err)
    849 + goto fail;
    850
    851 if (!bus_if->drvr)
    852 return;
    853
    854 + bus = sdiodev->bus;
    855 +
    856 /* try to download image and nvram to the dongle */
    857 bus->alp_only = true;
    858 err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
    859 @@ -4076,6 +4081,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev,
    860 fail:
    861 brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
    862 device_release_driver(dev);
    863 + device_release_driver(&sdiodev->func[2]->dev);
    864 }
    865
    866 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
    867 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
    868 index 2f978a39b58a..053f3b59f21e 100644
    869 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
    870 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
    871 @@ -1158,17 +1158,18 @@ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
    872 return ret;
    873 }
    874
    875 -static void brcmf_usb_probe_phase2(struct device *dev,
    876 +static void brcmf_usb_probe_phase2(struct device *dev, int ret,
    877 const struct firmware *fw,
    878 void *nvram, u32 nvlen)
    879 {
    880 struct brcmf_bus *bus = dev_get_drvdata(dev);
    881 - struct brcmf_usbdev_info *devinfo;
    882 - int ret;
    883 + struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
    884 +
    885 + if (ret)
    886 + goto error;
    887
    888 brcmf_dbg(USB, "Start fw downloading\n");
    889
    890 - devinfo = bus->bus_priv.usb->devinfo;
    891 ret = check_file(fw->data);
    892 if (ret < 0) {
    893 brcmf_err("invalid firmware\n");
    894 diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
    895 index b7273be9303d..c8d9075339cf 100644
    896 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
    897 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
    898 @@ -1422,21 +1422,6 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
    899 cancel_work_sync(&rt2x00dev->intf_work);
    900 cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
    901 cancel_work_sync(&rt2x00dev->sleep_work);
    902 -#if IS_ENABLED(CONFIG_RT2X00_LIB_USB)
    903 - if (rt2x00_is_usb(rt2x00dev)) {
    904 - usb_kill_anchored_urbs(rt2x00dev->anchor);
    905 - hrtimer_cancel(&rt2x00dev->txstatus_timer);
    906 - cancel_work_sync(&rt2x00dev->rxdone_work);
    907 - cancel_work_sync(&rt2x00dev->txdone_work);
    908 - }
    909 -#endif
    910 - if (rt2x00dev->workqueue)
    911 - destroy_workqueue(rt2x00dev->workqueue);
    912 -
    913 - /*
    914 - * Free the tx status fifo.
    915 - */
    916 - kfifo_free(&rt2x00dev->txstatus_fifo);
    917
    918 /*
    919 * Kill the tx status tasklet.
    920 @@ -1452,6 +1437,14 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
    921 */
    922 rt2x00lib_uninitialize(rt2x00dev);
    923
    924 + if (rt2x00dev->workqueue)
    925 + destroy_workqueue(rt2x00dev->workqueue);
    926 +
    927 + /*
    928 + * Free the tx status fifo.
    929 + */
    930 + kfifo_free(&rt2x00dev->txstatus_fifo);
    931 +
    932 /*
    933 * Free extra components
    934 */
    935 diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
    936 index 662705e31136..631df690adbe 100644
    937 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
    938 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
    939 @@ -740,6 +740,11 @@ void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev)
    940 {
    941 struct data_queue *queue;
    942
    943 + usb_kill_anchored_urbs(rt2x00dev->anchor);
    944 + hrtimer_cancel(&rt2x00dev->txstatus_timer);
    945 + cancel_work_sync(&rt2x00dev->rxdone_work);
    946 + cancel_work_sync(&rt2x00dev->txdone_work);
    947 +
    948 queue_for_each(rt2x00dev, queue)
    949 rt2x00usb_free_entries(queue);
    950 }
    951 diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
    952 index 6a43fd3d0576..502f5547a1f2 100644
    953 --- a/drivers/of/fdt.c
    954 +++ b/drivers/of/fdt.c
    955 @@ -741,9 +741,12 @@ int __init of_scan_flat_dt(int (*it)(unsigned long node,
    956 const char *pathp;
    957 int offset, rc = 0, depth = -1;
    958
    959 - for (offset = fdt_next_node(blob, -1, &depth);
    960 - offset >= 0 && depth >= 0 && !rc;
    961 - offset = fdt_next_node(blob, offset, &depth)) {
    962 + if (!blob)
    963 + return 0;
    964 +
    965 + for (offset = fdt_next_node(blob, -1, &depth);
    966 + offset >= 0 && depth >= 0 && !rc;
    967 + offset = fdt_next_node(blob, offset, &depth)) {
    968
    969 pathp = fdt_get_name(blob, offset, NULL);
    970 if (*pathp == '/')
    971 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
    972 index 838783c3fed0..24d4492d0168 100644
    973 --- a/drivers/spi/spi.c
    974 +++ b/drivers/spi/spi.c
    975 @@ -1004,7 +1004,7 @@ static int spi_transfer_one_message(struct spi_master *master,
    976 ret = 0;
    977 ms = 8LL * 1000LL * xfer->len;
    978 do_div(ms, xfer->speed_hz);
    979 - ms += ms + 100; /* some tolerance */
    980 + ms += ms + 200; /* some tolerance */
    981
    982 if (ms > UINT_MAX)
    983 ms = UINT_MAX;
    984 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    985 index 01ea228358ea..155fe0e0623f 100644
    986 --- a/drivers/target/iscsi/iscsi_target.c
    987 +++ b/drivers/target/iscsi/iscsi_target.c
    988 @@ -1287,6 +1287,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
    989 */
    990 if (dump_payload)
    991 goto after_immediate_data;
    992 + /*
    993 + * Check for underflow case where both EDTL and immediate data payload
    994 + * exceeds what is presented by CDB's TRANSFER LENGTH, and what has
    995 + * already been set in target_cmd_size_check() as se_cmd->data_length.
    996 + *
    997 + * For this special case, fail the command and dump the immediate data
    998 + * payload.
    999 + */
    1000 + if (cmd->first_burst_len > cmd->se_cmd.data_length) {
    1001 + cmd->sense_reason = TCM_INVALID_CDB_FIELD;
    1002 + goto after_immediate_data;
    1003 + }
    1004
    1005 immed_ret = iscsit_handle_immediate_data(cmd, hdr,
    1006 cmd->first_burst_len);
    1007 @@ -4431,8 +4443,11 @@ static void iscsit_logout_post_handler_closesession(
    1008 * always sleep waiting for RX/TX thread shutdown to complete
    1009 * within iscsit_close_connection().
    1010 */
    1011 - if (!conn->conn_transport->rdma_shutdown)
    1012 + if (!conn->conn_transport->rdma_shutdown) {
    1013 sleep = cmpxchg(&conn->tx_thread_active, true, false);
    1014 + if (!sleep)
    1015 + return;
    1016 + }
    1017
    1018 atomic_set(&conn->conn_logout_remove, 0);
    1019 complete(&conn->conn_logout_comp);
    1020 @@ -4448,8 +4463,11 @@ static void iscsit_logout_post_handler_samecid(
    1021 {
    1022 int sleep = 1;
    1023
    1024 - if (!conn->conn_transport->rdma_shutdown)
    1025 + if (!conn->conn_transport->rdma_shutdown) {
    1026 sleep = cmpxchg(&conn->tx_thread_active, true, false);
    1027 + if (!sleep)
    1028 + return;
    1029 + }
    1030
    1031 atomic_set(&conn->conn_logout_remove, 0);
    1032 complete(&conn->conn_logout_comp);
    1033 diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
    1034 index e2c970a9d61c..be52838cc1a8 100644
    1035 --- a/drivers/target/target_core_internal.h
    1036 +++ b/drivers/target/target_core_internal.h
    1037 @@ -131,7 +131,7 @@ int init_se_kmem_caches(void);
    1038 void release_se_kmem_caches(void);
    1039 u32 scsi_get_new_index(scsi_index_t);
    1040 void transport_subsystem_check_init(void);
    1041 -void transport_cmd_finish_abort(struct se_cmd *, int);
    1042 +int transport_cmd_finish_abort(struct se_cmd *, int);
    1043 unsigned char *transport_dump_cmd_direction(struct se_cmd *);
    1044 void transport_dump_dev_state(struct se_device *, char *, int *);
    1045 void transport_dump_dev_info(struct se_device *, struct se_lun *,
    1046 diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
    1047 index 4f229e711e1c..27dd1e12f246 100644
    1048 --- a/drivers/target/target_core_tmr.c
    1049 +++ b/drivers/target/target_core_tmr.c
    1050 @@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
    1051 kfree(tmr);
    1052 }
    1053
    1054 -static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
    1055 +static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
    1056 {
    1057 unsigned long flags;
    1058 bool remove = true, send_tas;
    1059 @@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
    1060 transport_send_task_abort(cmd);
    1061 }
    1062
    1063 - transport_cmd_finish_abort(cmd, remove);
    1064 + return transport_cmd_finish_abort(cmd, remove);
    1065 }
    1066
    1067 static int target_check_cdb_and_preempt(struct list_head *list,
    1068 @@ -185,8 +185,8 @@ void core_tmr_abort_task(
    1069 cancel_work_sync(&se_cmd->work);
    1070 transport_wait_for_tasks(se_cmd);
    1071
    1072 - transport_cmd_finish_abort(se_cmd, true);
    1073 - target_put_sess_cmd(se_cmd);
    1074 + if (!transport_cmd_finish_abort(se_cmd, true))
    1075 + target_put_sess_cmd(se_cmd);
    1076
    1077 printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
    1078 " ref_tag: %llu\n", ref_tag);
    1079 @@ -286,8 +286,8 @@ static void core_tmr_drain_tmr_list(
    1080 cancel_work_sync(&cmd->work);
    1081 transport_wait_for_tasks(cmd);
    1082
    1083 - transport_cmd_finish_abort(cmd, 1);
    1084 - target_put_sess_cmd(cmd);
    1085 + if (!transport_cmd_finish_abort(cmd, 1))
    1086 + target_put_sess_cmd(cmd);
    1087 }
    1088 }
    1089
    1090 @@ -385,8 +385,8 @@ static void core_tmr_drain_state_list(
    1091 cancel_work_sync(&cmd->work);
    1092 transport_wait_for_tasks(cmd);
    1093
    1094 - core_tmr_handle_tas_abort(cmd, tas);
    1095 - target_put_sess_cmd(cmd);
    1096 + if (!core_tmr_handle_tas_abort(cmd, tas))
    1097 + target_put_sess_cmd(cmd);
    1098 }
    1099 }
    1100
    1101 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    1102 index 077344cc819f..1f9bfa4195ea 100644
    1103 --- a/drivers/target/target_core_transport.c
    1104 +++ b/drivers/target/target_core_transport.c
    1105 @@ -673,9 +673,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
    1106 percpu_ref_put(&lun->lun_ref);
    1107 }
    1108
    1109 -void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
    1110 +int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
    1111 {
    1112 bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
    1113 + int ret = 0;
    1114
    1115 if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
    1116 transport_lun_remove_cmd(cmd);
    1117 @@ -687,9 +688,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
    1118 cmd->se_tfo->aborted_task(cmd);
    1119
    1120 if (transport_cmd_check_stop_to_fabric(cmd))
    1121 - return;
    1122 + return 1;
    1123 if (remove && ack_kref)
    1124 - transport_put_cmd(cmd);
    1125 + ret = transport_put_cmd(cmd);
    1126 +
    1127 + return ret;
    1128 }
    1129
    1130 static void target_complete_failure_work(struct work_struct *work)
    1131 diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
    1132 index 89081b834615..04ffd7640c33 100644
    1133 --- a/drivers/usb/gadget/function/f_fs.c
    1134 +++ b/drivers/usb/gadget/function/f_fs.c
    1135 @@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
    1136 ep->ep->driver_data = ep;
    1137 ep->ep->desc = ds;
    1138
    1139 - comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
    1140 - USB_DT_ENDPOINT_SIZE);
    1141 - ep->ep->maxburst = comp_desc->bMaxBurst + 1;
    1142 -
    1143 - if (needs_comp_desc)
    1144 + if (needs_comp_desc) {
    1145 + comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
    1146 + USB_DT_ENDPOINT_SIZE);
    1147 + ep->ep->maxburst = comp_desc->bMaxBurst + 1;
    1148 ep->ep->comp_desc = comp_desc;
    1149 + }
    1150
    1151 ret = usb_ep_enable(ep->ep);
    1152 if (likely(!ret)) {
    1153 diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
    1154 index fc09eb77ddf3..ffc69dd28928 100644
    1155 --- a/fs/autofs4/dev-ioctl.c
    1156 +++ b/fs/autofs4/dev-ioctl.c
    1157 @@ -345,7 +345,7 @@ static int autofs_dev_ioctl_fail(struct file *fp,
    1158 int status;
    1159
    1160 token = (autofs_wqt_t) param->fail.token;
    1161 - status = param->fail.status ? param->fail.status : -ENOENT;
    1162 + status = param->fail.status < 0 ? param->fail.status : -ENOENT;
    1163 return autofs4_wait_release(sbi, token, status);
    1164 }
    1165
    1166 diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
    1167 index 87b87e091e8e..efd72e1fae74 100644
    1168 --- a/fs/cifs/smb1ops.c
    1169 +++ b/fs/cifs/smb1ops.c
    1170 @@ -849,8 +849,13 @@ cifs_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
    1171 struct cifs_fid *fid, __u16 search_flags,
    1172 struct cifs_search_info *srch_inf)
    1173 {
    1174 - return CIFSFindFirst(xid, tcon, path, cifs_sb,
    1175 - &fid->netfid, search_flags, srch_inf, true);
    1176 + int rc;
    1177 +
    1178 + rc = CIFSFindFirst(xid, tcon, path, cifs_sb,
    1179 + &fid->netfid, search_flags, srch_inf, true);
    1180 + if (rc)
    1181 + cifs_dbg(FYI, "find first failed=%d\n", rc);
    1182 + return rc;
    1183 }
    1184
    1185 static int
    1186 diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
    1187 index 36334fe3266c..b6968241c26f 100644
    1188 --- a/fs/cifs/smb2ops.c
    1189 +++ b/fs/cifs/smb2ops.c
    1190 @@ -964,7 +964,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
    1191 rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL);
    1192 kfree(utf16_path);
    1193 if (rc) {
    1194 - cifs_dbg(VFS, "open dir failed\n");
    1195 + cifs_dbg(FYI, "open dir failed rc=%d\n", rc);
    1196 return rc;
    1197 }
    1198
    1199 @@ -974,7 +974,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
    1200 rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
    1201 fid->volatile_fid, 0, srch_inf);
    1202 if (rc) {
    1203 - cifs_dbg(VFS, "query directory failed\n");
    1204 + cifs_dbg(FYI, "query directory failed rc=%d\n", rc);
    1205 SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid);
    1206 }
    1207 return rc;
    1208 diff --git a/fs/exec.c b/fs/exec.c
    1209 index 67e86571685a..91441402d706 100644
    1210 --- a/fs/exec.c
    1211 +++ b/fs/exec.c
    1212 @@ -215,8 +215,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
    1213
    1214 if (write) {
    1215 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
    1216 + unsigned long ptr_size;
    1217 struct rlimit *rlim;
    1218
    1219 + /*
    1220 + * Since the stack will hold pointers to the strings, we
    1221 + * must account for them as well.
    1222 + *
    1223 + * The size calculation is the entire vma while each arg page is
    1224 + * built, so each time we get here it's calculating how far it
    1225 + * is currently (rather than each call being just the newly
    1226 + * added size from the arg page). As a result, we need to
    1227 + * always add the entire size of the pointers, so that on the
    1228 + * last call to get_arg_page() we'll actually have the entire
    1229 + * correct size.
    1230 + */
    1231 + ptr_size = (bprm->argc + bprm->envc) * sizeof(void *);
    1232 + if (ptr_size > ULONG_MAX - size)
    1233 + goto fail;
    1234 + size += ptr_size;
    1235 +
    1236 acct_arg_size(bprm, size / PAGE_SIZE);
    1237
    1238 /*
    1239 @@ -234,13 +252,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
    1240 * to work from.
    1241 */
    1242 rlim = current->signal->rlim;
    1243 - if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
    1244 - put_page(page);
    1245 - return NULL;
    1246 - }
    1247 + if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)
    1248 + goto fail;
    1249 }
    1250
    1251 return page;
    1252 +
    1253 +fail:
    1254 + put_page(page);
    1255 + return NULL;
    1256 }
    1257
    1258 static void put_arg_page(struct page *page)
    1259 diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
    1260 index e88005459035..2c225d46a428 100644
    1261 --- a/include/linux/timekeeper_internal.h
    1262 +++ b/include/linux/timekeeper_internal.h
    1263 @@ -29,7 +29,6 @@
    1264 */
    1265 struct tk_read_base {
    1266 struct clocksource *clock;
    1267 - cycle_t (*read)(struct clocksource *cs);
    1268 cycle_t mask;
    1269 cycle_t cycle_last;
    1270 u32 mult;
    1271 @@ -58,7 +57,7 @@ struct tk_read_base {
    1272 * interval.
    1273 * @xtime_remainder: Shifted nano seconds left over when rounding
    1274 * @cycle_interval
    1275 - * @raw_interval: Raw nano seconds accumulated per NTP interval.
    1276 + * @raw_interval: Shifted raw nano seconds accumulated per NTP interval.
    1277 * @ntp_error: Difference between accumulated time and NTP time in ntp
    1278 * shifted nano seconds.
    1279 * @ntp_error_shift: Shift conversion between clock shifted nano seconds and
    1280 @@ -100,7 +99,7 @@ struct timekeeper {
    1281 cycle_t cycle_interval;
    1282 u64 xtime_interval;
    1283 s64 xtime_remainder;
    1284 - u32 raw_interval;
    1285 + u64 raw_interval;
    1286 /* The ntp_tick_length() value currently being used.
    1287 * This cached copy ensures we consistently apply the tick
    1288 * length for an entire tick, as ntp_tick_length may change
    1289 diff --git a/kernel/signal.c b/kernel/signal.c
    1290 index 0b1415720a15..deb04d5983ed 100644
    1291 --- a/kernel/signal.c
    1292 +++ b/kernel/signal.c
    1293 @@ -503,7 +503,8 @@ int unhandled_signal(struct task_struct *tsk, int sig)
    1294 return !tsk->ptrace;
    1295 }
    1296
    1297 -static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
    1298 +static void collect_signal(int sig, struct sigpending *list, siginfo_t *info,
    1299 + bool *resched_timer)
    1300 {
    1301 struct sigqueue *q, *first = NULL;
    1302
    1303 @@ -525,6 +526,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
    1304 still_pending:
    1305 list_del_init(&first->list);
    1306 copy_siginfo(info, &first->info);
    1307 +
    1308 + *resched_timer =
    1309 + (first->flags & SIGQUEUE_PREALLOC) &&
    1310 + (info->si_code == SI_TIMER) &&
    1311 + (info->si_sys_private);
    1312 +
    1313 __sigqueue_free(first);
    1314 } else {
    1315 /*
    1316 @@ -541,12 +548,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
    1317 }
    1318
    1319 static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
    1320 - siginfo_t *info)
    1321 + siginfo_t *info, bool *resched_timer)
    1322 {
    1323 int sig = next_signal(pending, mask);
    1324
    1325 if (sig)
    1326 - collect_signal(sig, pending, info);
    1327 + collect_signal(sig, pending, info, resched_timer);
    1328 return sig;
    1329 }
    1330
    1331 @@ -558,15 +565,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
    1332 */
    1333 int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
    1334 {
    1335 + bool resched_timer = false;
    1336 int signr;
    1337
    1338 /* We only dequeue private signals from ourselves, we don't let
    1339 * signalfd steal them
    1340 */
    1341 - signr = __dequeue_signal(&tsk->pending, mask, info);
    1342 + signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer);
    1343 if (!signr) {
    1344 signr = __dequeue_signal(&tsk->signal->shared_pending,
    1345 - mask, info);
    1346 + mask, info, &resched_timer);
    1347 /*
    1348 * itimer signal ?
    1349 *
    1350 @@ -611,7 +619,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
    1351 */
    1352 current->jobctl |= JOBCTL_STOP_DEQUEUED;
    1353 }
    1354 - if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) {
    1355 + if (resched_timer) {
    1356 /*
    1357 * Release the siglock to ensure proper locking order
    1358 * of timer locks outside of siglocks. Note, we leave
    1359 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
    1360 index 46e312e9be38..d831827d7ab0 100644
    1361 --- a/kernel/time/timekeeping.c
    1362 +++ b/kernel/time/timekeeping.c
    1363 @@ -116,6 +116,26 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
    1364 tk->offs_boot = ktime_add(tk->offs_boot, delta);
    1365 }
    1366
    1367 +/*
    1368 + * tk_clock_read - atomic clocksource read() helper
    1369 + *
    1370 + * This helper is necessary to use in the read paths because, while the
    1371 + * seqlock ensures we don't return a bad value while structures are updated,
    1372 + * it doesn't protect from potential crashes. There is the possibility that
    1373 + * the tkr's clocksource may change between the read reference, and the
    1374 + * clock reference passed to the read function. This can cause crashes if
    1375 + * the wrong clocksource is passed to the wrong read function.
    1376 + * This isn't necessary to use when holding the timekeeper_lock or doing
    1377 + * a read of the fast-timekeeper tkrs (which is protected by its own locking
    1378 + * and update logic).
    1379 + */
    1380 +static inline u64 tk_clock_read(struct tk_read_base *tkr)
    1381 +{
    1382 + struct clocksource *clock = READ_ONCE(tkr->clock);
    1383 +
    1384 + return clock->read(clock);
    1385 +}
    1386 +
    1387 #ifdef CONFIG_DEBUG_TIMEKEEPING
    1388 #define WARNING_FREQ (HZ*300) /* 5 minute rate-limiting */
    1389
    1390 @@ -173,7 +193,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr)
    1391 */
    1392 do {
    1393 seq = read_seqcount_begin(&tk_core.seq);
    1394 - now = tkr->read(tkr->clock);
    1395 + now = tk_clock_read(tkr);
    1396 last = tkr->cycle_last;
    1397 mask = tkr->mask;
    1398 max = tkr->clock->max_cycles;
    1399 @@ -207,7 +227,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr)
    1400 cycle_t cycle_now, delta;
    1401
    1402 /* read clocksource */
    1403 - cycle_now = tkr->read(tkr->clock);
    1404 + cycle_now = tk_clock_read(tkr);
    1405
    1406 /* calculate the delta since the last update_wall_time */
    1407 delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask);
    1408 @@ -236,12 +256,10 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock)
    1409 ++tk->cs_was_changed_seq;
    1410 old_clock = tk->tkr_mono.clock;
    1411 tk->tkr_mono.clock = clock;
    1412 - tk->tkr_mono.read = clock->read;
    1413 tk->tkr_mono.mask = clock->mask;
    1414 - tk->tkr_mono.cycle_last = tk->tkr_mono.read(clock);
    1415 + tk->tkr_mono.cycle_last = tk_clock_read(&tk->tkr_mono);
    1416
    1417 tk->tkr_raw.clock = clock;
    1418 - tk->tkr_raw.read = clock->read;
    1419 tk->tkr_raw.mask = clock->mask;
    1420 tk->tkr_raw.cycle_last = tk->tkr_mono.cycle_last;
    1421
    1422 @@ -260,8 +278,7 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock)
    1423 /* Go back from cycles -> shifted ns */
    1424 tk->xtime_interval = (u64) interval * clock->mult;
    1425 tk->xtime_remainder = ntpinterval - tk->xtime_interval;
    1426 - tk->raw_interval =
    1427 - ((u64) interval * clock->mult) >> clock->shift;
    1428 + tk->raw_interval = interval * clock->mult;
    1429
    1430 /* if changing clocks, convert xtime_nsec shift units */
    1431 if (old_clock) {
    1432 @@ -405,7 +422,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
    1433
    1434 now += timekeeping_delta_to_ns(tkr,
    1435 clocksource_delta(
    1436 - tkr->read(tkr->clock),
    1437 + tk_clock_read(tkr),
    1438 tkr->cycle_last,
    1439 tkr->mask));
    1440 } while (read_seqcount_retry(&tkf->seq, seq));
    1441 @@ -433,6 +450,10 @@ static cycle_t dummy_clock_read(struct clocksource *cs)
    1442 return cycles_at_suspend;
    1443 }
    1444
    1445 +static struct clocksource dummy_clock = {
    1446 + .read = dummy_clock_read,
    1447 +};
    1448 +
    1449 /**
    1450 * halt_fast_timekeeper - Prevent fast timekeeper from accessing clocksource.
    1451 * @tk: Timekeeper to snapshot.
    1452 @@ -449,13 +470,13 @@ static void halt_fast_timekeeper(struct timekeeper *tk)
    1453 struct tk_read_base *tkr = &tk->tkr_mono;
    1454
    1455 memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy));
    1456 - cycles_at_suspend = tkr->read(tkr->clock);
    1457 - tkr_dummy.read = dummy_clock_read;
    1458 + cycles_at_suspend = tk_clock_read(tkr);
    1459 + tkr_dummy.clock = &dummy_clock;
    1460 update_fast_timekeeper(&tkr_dummy, &tk_fast_mono);
    1461
    1462 tkr = &tk->tkr_raw;
    1463 memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy));
    1464 - tkr_dummy.read = dummy_clock_read;
    1465 + tkr_dummy.clock = &dummy_clock;
    1466 update_fast_timekeeper(&tkr_dummy, &tk_fast_raw);
    1467 }
    1468
    1469 @@ -621,11 +642,10 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action)
    1470 */
    1471 static void timekeeping_forward_now(struct timekeeper *tk)
    1472 {
    1473 - struct clocksource *clock = tk->tkr_mono.clock;
    1474 cycle_t cycle_now, delta;
    1475 s64 nsec;
    1476
    1477 - cycle_now = tk->tkr_mono.read(clock);
    1478 + cycle_now = tk_clock_read(&tk->tkr_mono);
    1479 delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last, tk->tkr_mono.mask);
    1480 tk->tkr_mono.cycle_last = cycle_now;
    1481 tk->tkr_raw.cycle_last = cycle_now;
    1482 @@ -901,8 +921,7 @@ void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot)
    1483
    1484 do {
    1485 seq = read_seqcount_begin(&tk_core.seq);
    1486 -
    1487 - now = tk->tkr_mono.read(tk->tkr_mono.clock);
    1488 + now = tk_clock_read(&tk->tkr_mono);
    1489 systime_snapshot->cs_was_changed_seq = tk->cs_was_changed_seq;
    1490 systime_snapshot->clock_was_set_seq = tk->clock_was_set_seq;
    1491 base_real = ktime_add(tk->tkr_mono.base,
    1492 @@ -1081,7 +1100,7 @@ int get_device_system_crosststamp(int (*get_time_fn)
    1493 * Check whether the system counter value provided by the
    1494 * device driver is on the current timekeeping interval.
    1495 */
    1496 - now = tk->tkr_mono.read(tk->tkr_mono.clock);
    1497 + now = tk_clock_read(&tk->tkr_mono);
    1498 interval_start = tk->tkr_mono.cycle_last;
    1499 if (!cycle_between(interval_start, cycles, now)) {
    1500 clock_was_set_seq = tk->clock_was_set_seq;
    1501 @@ -1639,7 +1658,7 @@ void timekeeping_resume(void)
    1502 * The less preferred source will only be tried if there is no better
    1503 * usable source. The rtc part is handled separately in rtc core code.
    1504 */
    1505 - cycle_now = tk->tkr_mono.read(clock);
    1506 + cycle_now = tk_clock_read(&tk->tkr_mono);
    1507 if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) &&
    1508 cycle_now > tk->tkr_mono.cycle_last) {
    1509 u64 num, max = ULLONG_MAX;
    1510 @@ -2003,7 +2022,7 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset,
    1511 unsigned int *clock_set)
    1512 {
    1513 cycle_t interval = tk->cycle_interval << shift;
    1514 - u64 raw_nsecs;
    1515 + u64 snsec_per_sec;
    1516
    1517 /* If the offset is smaller than a shifted interval, do nothing */
    1518 if (offset < interval)
    1519 @@ -2018,14 +2037,15 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset,
    1520 *clock_set |= accumulate_nsecs_to_secs(tk);
    1521
    1522 /* Accumulate raw time */
    1523 - raw_nsecs = (u64)tk->raw_interval << shift;
    1524 - raw_nsecs += tk->raw_time.tv_nsec;
    1525 - if (raw_nsecs >= NSEC_PER_SEC) {
    1526 - u64 raw_secs = raw_nsecs;
    1527 - raw_nsecs = do_div(raw_secs, NSEC_PER_SEC);
    1528 - tk->raw_time.tv_sec += raw_secs;
    1529 + tk->tkr_raw.xtime_nsec += (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift;
    1530 + tk->tkr_raw.xtime_nsec += tk->raw_interval << shift;
    1531 + snsec_per_sec = (u64)NSEC_PER_SEC << tk->tkr_raw.shift;
    1532 + while (tk->tkr_raw.xtime_nsec >= snsec_per_sec) {
    1533 + tk->tkr_raw.xtime_nsec -= snsec_per_sec;
    1534 + tk->raw_time.tv_sec++;
    1535 }
    1536 - tk->raw_time.tv_nsec = raw_nsecs;
    1537 + tk->raw_time.tv_nsec = tk->tkr_raw.xtime_nsec >> tk->tkr_raw.shift;
    1538 + tk->tkr_raw.xtime_nsec -= (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift;
    1539
    1540 /* Accumulate error between NTP and clock interval */
    1541 tk->ntp_error += tk->ntp_tick << shift;
    1542 @@ -2057,7 +2077,7 @@ void update_wall_time(void)
    1543 #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
    1544 offset = real_tk->cycle_interval;
    1545 #else
    1546 - offset = clocksource_delta(tk->tkr_mono.read(tk->tkr_mono.clock),
    1547 + offset = clocksource_delta(tk_clock_read(&tk->tkr_mono),
    1548 tk->tkr_mono.cycle_last, tk->tkr_mono.mask);
    1549 #endif
    1550
    1551 diff --git a/lib/cmdline.c b/lib/cmdline.c
    1552 index 8f13cf73c2ec..79069d7938ea 100644
    1553 --- a/lib/cmdline.c
    1554 +++ b/lib/cmdline.c
    1555 @@ -22,14 +22,14 @@
    1556 * the values[M, M+1, ..., N] into the ints array in get_options.
    1557 */
    1558
    1559 -static int get_range(char **str, int *pint)
    1560 +static int get_range(char **str, int *pint, int n)
    1561 {
    1562 int x, inc_counter, upper_range;
    1563
    1564 (*str)++;
    1565 upper_range = simple_strtol((*str), NULL, 0);
    1566 inc_counter = upper_range - *pint;
    1567 - for (x = *pint; x < upper_range; x++)
    1568 + for (x = *pint; n && x < upper_range; x++, n--)
    1569 *pint++ = x;
    1570 return inc_counter;
    1571 }
    1572 @@ -96,7 +96,7 @@ char *get_options(const char *str, int nints, int *ints)
    1573 break;
    1574 if (res == 3) {
    1575 int range_nums;
    1576 - range_nums = get_range((char **)&str, ints + i);
    1577 + range_nums = get_range((char **)&str, ints + i, nints - i);
    1578 if (range_nums < 0)
    1579 break;
    1580 /*
    1581 diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
    1582 index 18c737a61d80..7fc340726d03 100644
    1583 --- a/net/rxrpc/key.c
    1584 +++ b/net/rxrpc/key.c
    1585 @@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
    1586 unsigned int *_toklen)
    1587 {
    1588 const __be32 *xdr = *_xdr;
    1589 - unsigned int toklen = *_toklen, n_parts, loop, tmp;
    1590 + unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
    1591
    1592 /* there must be at least one name, and at least #names+1 length
    1593 * words */
    1594 @@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
    1595 toklen -= 4;
    1596 if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
    1597 return -EINVAL;
    1598 - if (tmp > toklen)
    1599 + paddedlen = (tmp + 3) & ~3;
    1600 + if (paddedlen > toklen)
    1601 return -EINVAL;
    1602 princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
    1603 if (!princ->name_parts[loop])
    1604 return -ENOMEM;
    1605 memcpy(princ->name_parts[loop], xdr, tmp);
    1606 princ->name_parts[loop][tmp] = 0;
    1607 - tmp = (tmp + 3) & ~3;
    1608 - toklen -= tmp;
    1609 - xdr += tmp >> 2;
    1610 + toklen -= paddedlen;
    1611 + xdr += paddedlen >> 2;
    1612 }
    1613
    1614 if (toklen < 4)
    1615 @@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
    1616 toklen -= 4;
    1617 if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
    1618 return -EINVAL;
    1619 - if (tmp > toklen)
    1620 + paddedlen = (tmp + 3) & ~3;
    1621 + if (paddedlen > toklen)
    1622 return -EINVAL;
    1623 princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
    1624 if (!princ->realm)
    1625 return -ENOMEM;
    1626 memcpy(princ->realm, xdr, tmp);
    1627 princ->realm[tmp] = 0;
    1628 - tmp = (tmp + 3) & ~3;
    1629 - toklen -= tmp;
    1630 - xdr += tmp >> 2;
    1631 + toklen -= paddedlen;
    1632 + xdr += paddedlen >> 2;
    1633
    1634 _debug("%s/...@%s", princ->name_parts[0], princ->realm);
    1635
    1636 @@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
    1637 unsigned int *_toklen)
    1638 {
    1639 const __be32 *xdr = *_xdr;
    1640 - unsigned int toklen = *_toklen, len;
    1641 + unsigned int toklen = *_toklen, len, paddedlen;
    1642
    1643 /* there must be at least one tag and one length word */
    1644 if (toklen <= 8)
    1645 @@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
    1646 toklen -= 8;
    1647 if (len > max_data_size)
    1648 return -EINVAL;
    1649 + paddedlen = (len + 3) & ~3;
    1650 + if (paddedlen > toklen)
    1651 + return -EINVAL;
    1652 td->data_len = len;
    1653
    1654 if (len > 0) {
    1655 td->data = kmemdup(xdr, len, GFP_KERNEL);
    1656 if (!td->data)
    1657 return -ENOMEM;
    1658 - len = (len + 3) & ~3;
    1659 - toklen -= len;
    1660 - xdr += len >> 2;
    1661 + toklen -= paddedlen;
    1662 + xdr += paddedlen >> 2;
    1663 }
    1664
    1665 _debug("tag %x len %x", td->tag, td->data_len);
    1666 @@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
    1667 const __be32 **_xdr, unsigned int *_toklen)
    1668 {
    1669 const __be32 *xdr = *_xdr;
    1670 - unsigned int toklen = *_toklen, len;
    1671 + unsigned int toklen = *_toklen, len, paddedlen;
    1672
    1673 /* there must be at least one length word */
    1674 if (toklen <= 4)
    1675 @@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
    1676 toklen -= 4;
    1677 if (len > AFSTOKEN_K5_TIX_MAX)
    1678 return -EINVAL;
    1679 + paddedlen = (len + 3) & ~3;
    1680 + if (paddedlen > toklen)
    1681 + return -EINVAL;
    1682 *_tktlen = len;
    1683
    1684 _debug("ticket len %u", len);
    1685 @@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
    1686 *_ticket = kmemdup(xdr, len, GFP_KERNEL);
    1687 if (!*_ticket)
    1688 return -ENOMEM;
    1689 - len = (len + 3) & ~3;
    1690 - toklen -= len;
    1691 - xdr += len >> 2;
    1692 + toklen -= paddedlen;
    1693 + xdr += paddedlen >> 2;
    1694 }
    1695
    1696 *_xdr = xdr;
    1697 @@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
    1698 {
    1699 const __be32 *xdr = prep->data, *token;
    1700 const char *cp;
    1701 - unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
    1702 + unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
    1703 size_t datalen = prep->datalen;
    1704 int ret;
    1705
    1706 @@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
    1707 if (len < 1 || len > AFSTOKEN_CELL_MAX)
    1708 goto not_xdr;
    1709 datalen -= 4;
    1710 - tmp = (len + 3) & ~3;
    1711 - if (tmp > datalen)
    1712 + paddedlen = (len + 3) & ~3;
    1713 + if (paddedlen > datalen)
    1714 goto not_xdr;
    1715
    1716 cp = (const char *) xdr;
    1717 for (loop = 0; loop < len; loop++)
    1718 if (!isprint(cp[loop]))
    1719 goto not_xdr;
    1720 - if (len < tmp)
    1721 - for (; loop < tmp; loop++)
    1722 - if (cp[loop])
    1723 - goto not_xdr;
    1724 + for (; loop < paddedlen; loop++)
    1725 + if (cp[loop])
    1726 + goto not_xdr;
    1727 _debug("cellname: [%u/%u] '%*.*s'",
    1728 - len, tmp, len, len, (const char *) xdr);
    1729 - datalen -= tmp;
    1730 - xdr += tmp >> 2;
    1731 + len, paddedlen, len, len, (const char *) xdr);
    1732 + datalen -= paddedlen;
    1733 + xdr += paddedlen >> 2;
    1734
    1735 /* get the token count */
    1736 if (datalen < 12)
    1737 @@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
    1738 sec_ix = ntohl(*xdr);
    1739 datalen -= 4;
    1740 _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
    1741 - if (toklen < 20 || toklen > datalen)
    1742 + paddedlen = (toklen + 3) & ~3;
    1743 + if (toklen < 20 || toklen > datalen || paddedlen > datalen)
    1744 goto not_xdr;
    1745 - datalen -= (toklen + 3) & ~3;
    1746 - xdr += (toklen + 3) >> 2;
    1747 + datalen -= paddedlen;
    1748 + xdr += paddedlen >> 2;
    1749
    1750 } while (--loop > 0);
    1751
    1752 diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
    1753 index bb1261591a1f..7f0598b32f13 100644
    1754 --- a/sound/core/pcm_lib.c
    1755 +++ b/sound/core/pcm_lib.c
    1756 @@ -2491,7 +2491,7 @@ static int pcm_chmap_ctl_get(struct snd_kcontrol *kcontrol,
    1757 struct snd_pcm_substream *substream;
    1758 const struct snd_pcm_chmap_elem *map;
    1759
    1760 - if (snd_BUG_ON(!info->chmap))
    1761 + if (!info->chmap)
    1762 return -EINVAL;
    1763 substream = snd_pcm_chmap_substream(info, idx);
    1764 if (!substream)
    1765 @@ -2523,7 +2523,7 @@ static int pcm_chmap_ctl_tlv(struct snd_kcontrol *kcontrol, int op_flag,
    1766 unsigned int __user *dst;
    1767 int c, count = 0;
    1768
    1769 - if (snd_BUG_ON(!info->chmap))
    1770 + if (!info->chmap)
    1771 return -EINVAL;
    1772 if (size < 8)
    1773 return -ENOMEM;
    1774 diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
    1775 index 00060c4a9deb..9741757436be 100644
    1776 --- a/sound/firewire/amdtp-stream.c
    1777 +++ b/sound/firewire/amdtp-stream.c
    1778 @@ -606,7 +606,9 @@ static void out_stream_callback(struct fw_iso_context *context, u32 tstamp,
    1779 cycle = increment_cycle_count(cycle, 1);
    1780 if (handle_out_packet(s, cycle, i) < 0) {
    1781 s->packet_index = -1;
    1782 - amdtp_stream_pcm_abort(s);
    1783 + if (in_interrupt())
    1784 + amdtp_stream_pcm_abort(s);
    1785 + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN);
    1786 return;
    1787 }
    1788 }
    1789 @@ -658,7 +660,9 @@ static void in_stream_callback(struct fw_iso_context *context, u32 tstamp,
    1790 /* Queueing error or detecting invalid payload. */
    1791 if (i < packets) {
    1792 s->packet_index = -1;
    1793 - amdtp_stream_pcm_abort(s);
    1794 + if (in_interrupt())
    1795 + amdtp_stream_pcm_abort(s);
    1796 + WRITE_ONCE(s->pcm_buffer_pointer, SNDRV_PCM_POS_XRUN);
    1797 return;
    1798 }
    1799
    1800 diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
    1801 index c1bc7fad056e..f7c054bc9d92 100644
    1802 --- a/sound/firewire/amdtp-stream.h
    1803 +++ b/sound/firewire/amdtp-stream.h
    1804 @@ -124,7 +124,7 @@ struct amdtp_stream {
    1805 /* For a PCM substream processing. */
    1806 struct snd_pcm_substream *pcm;
    1807 struct tasklet_struct period_tasklet;
    1808 - unsigned int pcm_buffer_pointer;
    1809 + snd_pcm_uframes_t pcm_buffer_pointer;
    1810 unsigned int pcm_period_pointer;
    1811
    1812 /* To wait for first packet. */