Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0247-4.9.148-all-fixes.patch

    Annotation of /trunk/kernel-alx-legacy/patches-4.9/0247-4.9.148-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3608 - (hide annotations) (download)
    Fri Aug 14 07:34:29 2020 UTC (3 years, 9 months ago) by niro
    File size: 21178 byte(s) 
    -added kerenl-alx-legacy pkg
    1 niro 3608 diff --git a/Makefile b/Makefile
    2     index 3cccc51a57ce..1b71b11ea63e 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 147
    9     +SUBLEVEL = 148
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
    14     index 6d9b45549109..d5b2a08e2b66 100644
    15     --- a/arch/x86/kernel/cpu/mtrr/if.c
    16     +++ b/arch/x86/kernel/cpu/mtrr/if.c
    17     @@ -172,6 +172,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)
    18     struct mtrr_gentry gentry;
    19     void __user *arg = (void __user *) __arg;
    20    
    21     + memset(&gentry, 0, sizeof(gentry));
    22     +
    23     switch (cmd) {
    24     case MTRRIOC_ADD_ENTRY:
    25     case MTRRIOC_SET_ENTRY:
    26     diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
    27     index ae52ef05d098..769831d9fd11 100644
    28     --- a/arch/x86/kernel/fpu/signal.c
    29     +++ b/arch/x86/kernel/fpu/signal.c
    30     @@ -342,10 +342,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
    31     sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
    32     }
    33    
    34     + local_bh_disable();
    35     fpu->fpstate_active = 1;
    36     - preempt_disable();
    37     fpu__restore(fpu);
    38     - preempt_enable();
    39     + local_bh_enable();
    40    
    41     return err;
    42     } else {
    43     diff --git a/block/blk-lib.c b/block/blk-lib.c
    44     index 46fe9248410d..af1d26f79878 100644
    45     --- a/block/blk-lib.c
    46     +++ b/block/blk-lib.c
    47     @@ -63,10 +63,18 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
    48     unsigned int req_sects;
    49     sector_t end_sect, tmp;
    50    
    51     - /* Make sure bi_size doesn't overflow */
    52     - req_sects = min_t(sector_t, nr_sects, UINT_MAX >> 9);
    53     + /*
    54     + * Issue in chunks of the user defined max discard setting,
    55     + * ensuring that bi_size doesn't overflow
    56     + */
    57     + req_sects = min_t(sector_t, nr_sects,
    58     + q->limits.max_discard_sectors);
    59     + if (!req_sects)
    60     + goto fail;
    61     + if (req_sects > UINT_MAX >> 9)
    62     + req_sects = UINT_MAX >> 9;
    63    
    64     - /**
    65     + /*
    66     * If splitting a request, and the next starting sector would be
    67     * misaligned, stop the discard at the previous aligned sector.
    68     */
    69     @@ -100,6 +108,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
    70    
    71     *biop = bio;
    72     return 0;
    73     +
    74     +fail:
    75     + if (bio) {
    76     + submit_bio_wait(bio);
    77     + bio_put(bio);
    78     + }
    79     + *biop = NULL;
    80     + return -EOPNOTSUPP;
    81     }
    82     EXPORT_SYMBOL(__blkdev_issue_discard);
    83    
    84     diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c
    85     index 05813fbf3daf..647dfbbc4e1c 100644
    86     --- a/drivers/gpio/gpio-max7301.c
    87     +++ b/drivers/gpio/gpio-max7301.c
    88     @@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg,
    89     struct spi_device *spi = to_spi_device(dev);
    90     u16 word = ((reg & 0x7F) << 8) | (val & 0xFF);
    91    
    92     - return spi_write(spi, (const u8 *)&word, sizeof(word));
    93     + return spi_write_then_read(spi, &word, sizeof(word), NULL, 0);
    94     }
    95    
    96     /* A read from the MAX7301 means two transfers; here, one message each */
    97     @@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg)
    98     struct spi_device *spi = to_spi_device(dev);
    99    
    100     word = 0x8000 | (reg << 8);
    101     - ret = spi_write(spi, (const u8 *)&word, sizeof(word));
    102     - if (ret)
    103     - return ret;
    104     - /*
    105     - * This relies on the fact, that a transfer with NULL tx_buf shifts out
    106     - * zero bytes (=NOOP for MAX7301)
    107     - */
    108     - ret = spi_read(spi, (u8 *)&word, sizeof(word));
    109     + ret = spi_write_then_read(spi, &word, sizeof(word), &word,
    110     + sizeof(word));
    111     if (ret)
    112     return ret;
    113     return word & 0xff;
    114     diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
    115     index 71c3473476c7..04b26ca06180 100644
    116     --- a/drivers/gpu/drm/drm_ioctl.c
    117     +++ b/drivers/gpu/drm/drm_ioctl.c
    118     @@ -36,6 +36,7 @@
    119    
    120     #include <linux/pci.h>
    121     #include <linux/export.h>
    122     +#include <linux/nospec.h>
    123    
    124     /**
    125     * DOC: getunique and setversion story
    126     @@ -668,13 +669,17 @@ long drm_ioctl(struct file *filp,
    127    
    128     if (is_driver_ioctl) {
    129     /* driver ioctl */
    130     - if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
    131     + unsigned int index = nr - DRM_COMMAND_BASE;
    132     +
    133     + if (index >= dev->driver->num_ioctls)
    134     goto err_i1;
    135     - ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
    136     + index = array_index_nospec(index, dev->driver->num_ioctls);
    137     + ioctl = &dev->driver->ioctls[index];
    138     } else {
    139     /* core ioctl */
    140     if (nr >= DRM_CORE_IOCTL_COUNT)
    141     goto err_i1;
    142     + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
    143     ioctl = &drm_ioctls[nr];
    144     }
    145    
    146     @@ -770,6 +775,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
    147    
    148     if (nr >= DRM_CORE_IOCTL_COUNT)
    149     return false;
    150     + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
    151    
    152     *flags = drm_ioctls[nr].flags;
    153     return true;
    154     diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
    155     index 0276d2ef06ee..9a0d0d0ad6d0 100644
    156     --- a/drivers/hv/vmbus_drv.c
    157     +++ b/drivers/hv/vmbus_drv.c
    158     @@ -317,6 +317,8 @@ static ssize_t out_intr_mask_show(struct device *dev,
    159    
    160     if (!hv_dev->channel)
    161     return -ENODEV;
    162     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    163     + return -EINVAL;
    164     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    165     return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
    166     }
    167     @@ -330,6 +332,8 @@ static ssize_t out_read_index_show(struct device *dev,
    168    
    169     if (!hv_dev->channel)
    170     return -ENODEV;
    171     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    172     + return -EINVAL;
    173     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    174     return sprintf(buf, "%d\n", outbound.current_read_index);
    175     }
    176     @@ -344,6 +348,8 @@ static ssize_t out_write_index_show(struct device *dev,
    177    
    178     if (!hv_dev->channel)
    179     return -ENODEV;
    180     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    181     + return -EINVAL;
    182     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    183     return sprintf(buf, "%d\n", outbound.current_write_index);
    184     }
    185     @@ -358,6 +364,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
    186    
    187     if (!hv_dev->channel)
    188     return -ENODEV;
    189     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    190     + return -EINVAL;
    191     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    192     return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
    193     }
    194     @@ -372,6 +380,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
    195    
    196     if (!hv_dev->channel)
    197     return -ENODEV;
    198     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    199     + return -EINVAL;
    200     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    201     return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
    202     }
    203     @@ -385,6 +395,8 @@ static ssize_t in_intr_mask_show(struct device *dev,
    204    
    205     if (!hv_dev->channel)
    206     return -ENODEV;
    207     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    208     + return -EINVAL;
    209     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    210     return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
    211     }
    212     @@ -398,6 +410,8 @@ static ssize_t in_read_index_show(struct device *dev,
    213    
    214     if (!hv_dev->channel)
    215     return -ENODEV;
    216     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    217     + return -EINVAL;
    218     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    219     return sprintf(buf, "%d\n", inbound.current_read_index);
    220     }
    221     @@ -411,6 +425,8 @@ static ssize_t in_write_index_show(struct device *dev,
    222    
    223     if (!hv_dev->channel)
    224     return -ENODEV;
    225     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    226     + return -EINVAL;
    227     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    228     return sprintf(buf, "%d\n", inbound.current_write_index);
    229     }
    230     @@ -425,6 +441,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
    231    
    232     if (!hv_dev->channel)
    233     return -ENODEV;
    234     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    235     + return -EINVAL;
    236     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    237     return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
    238     }
    239     @@ -439,6 +457,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
    240    
    241     if (!hv_dev->channel)
    242     return -ENODEV;
    243     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    244     + return -EINVAL;
    245     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    246     return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
    247     }
    248     diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
    249     index fe7c6ec67d98..2a44a2c3e859 100644
    250     --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
    251     +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
    252     @@ -1763,8 +1763,8 @@ static void __srpt_close_all_ch(struct srpt_device *sdev)
    253    
    254     list_for_each_entry(ch, &sdev->rch_list, list) {
    255     if (srpt_disconnect_ch(ch) >= 0)
    256     - pr_info("Closing channel %s-%d because target %s has been disabled\n",
    257     - ch->sess_name, ch->qp->qp_num,
    258     + pr_info("Closing channel %s because target %s has been disabled\n",
    259     + ch->sess_name,
    260     sdev->device->name);
    261     srpt_close_ch(ch);
    262     }
    263     diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
    264     index 0c6de9f12ee8..97e51309d7af 100644
    265     --- a/drivers/mmc/core/mmc.c
    266     +++ b/drivers/mmc/core/mmc.c
    267     @@ -27,6 +27,7 @@
    268     #include "sd_ops.h"
    269    
    270     #define DEFAULT_CMD6_TIMEOUT_MS 500
    271     +#define MIN_CACHE_EN_TIMEOUT_MS 1600
    272    
    273     static const unsigned int tran_exp[] = {
    274     10000, 100000, 1000000, 10000000,
    275     @@ -522,8 +523,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
    276     card->cid.year += 16;
    277    
    278     /* check whether the eMMC card supports BKOPS */
    279     - if (!mmc_card_broken_hpi(card) &&
    280     - ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
    281     + if (ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
    282     card->ext_csd.bkops = 1;
    283     card->ext_csd.man_bkops_en =
    284     (ext_csd[EXT_CSD_BKOPS_EN] &
    285     @@ -1719,20 +1719,26 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
    286     if (err) {
    287     pr_warn("%s: Enabling HPI failed\n",
    288     mmc_hostname(card->host));
    289     + card->ext_csd.hpi_en = 0;
    290     err = 0;
    291     - } else
    292     + } else {
    293     card->ext_csd.hpi_en = 1;
    294     + }
    295     }
    296    
    297     /*
    298     - * If cache size is higher than 0, this indicates
    299     - * the existence of cache and it can be turned on.
    300     + * If cache size is higher than 0, this indicates the existence of cache
    301     + * and it can be turned on. Note that some eMMCs from Micron has been
    302     + * reported to need ~800 ms timeout, while enabling the cache after
    303     + * sudden power failure tests. Let's extend the timeout to a minimum of
    304     + * DEFAULT_CACHE_EN_TIMEOUT_MS and do it for all cards.
    305     */
    306     - if (!mmc_card_broken_hpi(card) &&
    307     - card->ext_csd.cache_size > 0) {
    308     + if (card->ext_csd.cache_size > 0) {
    309     + unsigned int timeout_ms = MIN_CACHE_EN_TIMEOUT_MS;
    310     +
    311     + timeout_ms = max(card->ext_csd.generic_cmd6_time, timeout_ms);
    312     err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
    313     - EXT_CSD_CACHE_CTRL, 1,
    314     - card->ext_csd.generic_cmd6_time);
    315     + EXT_CSD_CACHE_CTRL, 1, timeout_ms);
    316     if (err && err != -EBADMSG)
    317     goto free_card;
    318    
    319     diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
    320     index f7d1c8c4e5ad..009242bcc7be 100644
    321     --- a/drivers/mmc/host/omap_hsmmc.c
    322     +++ b/drivers/mmc/host/omap_hsmmc.c
    323     @@ -2105,7 +2105,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
    324     mmc->max_blk_size = 512; /* Block Length at max can be 1024 */
    325     mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */
    326     mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
    327     - mmc->max_seg_size = mmc->max_req_size;
    328    
    329     mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
    330     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
    331     @@ -2135,6 +2134,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
    332     goto err_irq;
    333     }
    334    
    335     + /*
    336     + * Limit the maximum segment size to the lower of the request size
    337     + * and the DMA engine device segment size limits. In reality, with
    338     + * 32-bit transfers, the DMA engine can do longer segments than this
    339     + * but there is no way to represent that in the DMA model - if we
    340     + * increase this figure here, we get warnings from the DMA API debug.
    341     + */
    342     + mmc->max_seg_size = min3(mmc->max_req_size,
    343     + dma_get_max_seg_size(host->rx_chan->device->dev),
    344     + dma_get_max_seg_size(host->tx_chan->device->dev));
    345     +
    346     /* Request IRQ for MMC operations */
    347     ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0,
    348     mmc_hostname(mmc), host);
    349     diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
    350     index e7b516342678..66ae647b712e 100644
    351     --- a/drivers/net/usb/hso.c
    352     +++ b/drivers/net/usb/hso.c
    353     @@ -2808,6 +2808,12 @@ static int hso_get_config_data(struct usb_interface *interface)
    354     return -EIO;
    355     }
    356    
    357     + /* check if we have a valid interface */
    358     + if (if_num > 16) {
    359     + kfree(config_data);
    360     + return -EINVAL;
    361     + }
    362     +
    363     switch (config_data[if_num]) {
    364     case 0x0:
    365     result = 0;
    366     @@ -2878,10 +2884,18 @@ static int hso_probe(struct usb_interface *interface,
    367    
    368     /* Get the interface/port specification from either driver_info or from
    369     * the device itself */
    370     - if (id->driver_info)
    371     + if (id->driver_info) {
    372     + /* if_num is controlled by the device, driver_info is a 0 terminated
    373     + * array. Make sure, the access is in bounds! */
    374     + for (i = 0; i <= if_num; ++i)
    375     + if (((u32 *)(id->driver_info))[i] == 0)
    376     + goto exit;
    377     port_spec = ((u32 *)(id->driver_info))[if_num];
    378     - else
    379     + } else {
    380     port_spec = hso_get_config_data(interface);
    381     + if (port_spec < 0)
    382     + goto exit;
    383     + }
    384    
    385     /* Check if we need to switch to alt interfaces prior to port
    386     * configuration */
    387     diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    388     index 00d10660ff14..39e2d3271035 100644
    389     --- a/drivers/usb/host/xhci-hub.c
    390     +++ b/drivers/usb/host/xhci-hub.c
    391     @@ -1353,7 +1353,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
    392     portsc_buf[port_index] = 0;
    393    
    394     /* Bail out if a USB3 port has a new device in link training */
    395     - if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
    396     + if ((hcd->speed >= HCD_USB3) &&
    397     + (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
    398     bus_state->bus_suspended = 0;
    399     spin_unlock_irqrestore(&xhci->lock, flags);
    400     xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
    401     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    402     index 2b81939fecd7..1e3445dd84b2 100644
    403     --- a/drivers/usb/serial/option.c
    404     +++ b/drivers/usb/serial/option.c
    405     @@ -1163,6 +1163,10 @@ static const struct usb_device_id option_ids[] = {
    406     { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
    407     { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
    408     .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
    409     + { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
    410     + .driver_info = NCTRL(0) | RSVD(1) },
    411     + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
    412     + .driver_info = NCTRL(0) },
    413     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
    414     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
    415     .driver_info = RSVD(1) },
    416     @@ -1327,6 +1331,7 @@ static const struct usb_device_id option_ids[] = {
    417     .driver_info = RSVD(4) },
    418     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
    419     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
    420     + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
    421     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
    422     .driver_info = RSVD(4) },
    423     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
    424     @@ -1530,6 +1535,7 @@ static const struct usb_device_id option_ids[] = {
    425     .driver_info = RSVD(2) },
    426     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
    427     .driver_info = RSVD(2) },
    428     + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
    429     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
    430     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
    431     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
    432     @@ -1757,6 +1763,7 @@ static const struct usb_device_id option_ids[] = {
    433     { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
    434     { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
    435     .driver_info = RSVD(5) | RSVD(6) },
    436     + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
    437     { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
    438     .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
    439     { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
    440     @@ -1941,7 +1948,14 @@ static const struct usb_device_id option_ids[] = {
    441     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
    442     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
    443     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
    444     - { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
    445     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
    446     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */
    447     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
    448     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
    449     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
    450     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
    451     + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
    452     + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
    453     { } /* Terminating entry */
    454     };
    455     MODULE_DEVICE_TABLE(usb, option_ids);
    456     diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
    457     index 46cd2e1b055b..1999e85840d5 100644
    458     --- a/fs/proc/proc_sysctl.c
    459     +++ b/fs/proc/proc_sysctl.c
    460     @@ -466,7 +466,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    461    
    462     inode = new_inode(sb);
    463     if (!inode)
    464     - goto out;
    465     + return ERR_PTR(-ENOMEM);
    466    
    467     inode->i_ino = get_next_ino();
    468    
    469     @@ -476,8 +476,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    470     if (unlikely(head->unregistering)) {
    471     spin_unlock(&sysctl_lock);
    472     iput(inode);
    473     - inode = NULL;
    474     - goto out;
    475     + return ERR_PTR(-ENOENT);
    476     }
    477     ei->sysctl = head;
    478     ei->sysctl_entry = table;
    479     @@ -502,7 +501,6 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    480     if (root->set_ownership)
    481     root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
    482    
    483     -out:
    484     return inode;
    485     }
    486    
    487     @@ -551,10 +549,11 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
    488     goto out;
    489     }
    490    
    491     - err = ERR_PTR(-ENOMEM);
    492     inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
    493     - if (!inode)
    494     + if (IS_ERR(inode)) {
    495     + err = ERR_CAST(inode);
    496     goto out;
    497     + }
    498    
    499     err = NULL;
    500     d_set_d_op(dentry, &proc_sys_dentry_operations);
    501     @@ -687,7 +686,7 @@ static bool proc_sys_fill_cache(struct file *file,
    502     return false;
    503     if (d_in_lookup(child)) {
    504     inode = proc_sys_make_inode(dir->d_sb, head, table);
    505     - if (!inode) {
    506     + if (IS_ERR(inode)) {
    507     d_lookup_done(child);
    508     dput(child);
    509     return false;
    510     diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
    511     index fb0f44cd1e28..de7799a0a9d1 100644
    512     --- a/fs/ubifs/replay.c
    513     +++ b/fs/ubifs/replay.c
    514     @@ -209,6 +209,38 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
    515     return ubifs_tnc_remove_range(c, &min_key, &max_key);
    516     }
    517    
    518     +/**
    519     + * inode_still_linked - check whether inode in question will be re-linked.
    520     + * @c: UBIFS file-system description object
    521     + * @rino: replay entry to test
    522     + *
    523     + * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1.
    524     + * This case needs special care, otherwise all references to the inode will
    525     + * be removed upon the first replay entry of an inode with link count 0
    526     + * is found.
    527     + */
    528     +static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino)
    529     +{
    530     + struct replay_entry *r;
    531     +
    532     + ubifs_assert(rino->deletion);
    533     + ubifs_assert(key_type(c, &rino->key) == UBIFS_INO_KEY);
    534     +
    535     + /*
    536     + * Find the most recent entry for the inode behind @rino and check
    537     + * whether it is a deletion.
    538     + */
    539     + list_for_each_entry_reverse(r, &c->replay_list, list) {
    540     + ubifs_assert(r->sqnum >= rino->sqnum);
    541     + if (key_inum(c, &r->key) == key_inum(c, &rino->key))
    542     + return r->deletion == 0;
    543     +
    544     + }
    545     +
    546     + ubifs_assert(0);
    547     + return false;
    548     +}
    549     +
    550     /**
    551     * apply_replay_entry - apply a replay entry to the TNC.
    552     * @c: UBIFS file-system description object
    553     @@ -239,6 +271,11 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
    554     {
    555     ino_t inum = key_inum(c, &r->key);
    556    
    557     + if (inode_still_linked(c, r)) {
    558     + err = 0;
    559     + break;
    560     + }
    561     +
    562     err = ubifs_tnc_remove_ino(c, inum);
    563     break;
    564     }
    565     diff --git a/kernel/panic.c b/kernel/panic.c
    566     index dbec387099b1..eb7bc6d60927 100644
    567     --- a/kernel/panic.c
    568     +++ b/kernel/panic.c
    569     @@ -13,6 +13,7 @@
    570     #include <linux/kmsg_dump.h>
    571     #include <linux/kallsyms.h>
    572     #include <linux/notifier.h>
    573     +#include <linux/vt_kern.h>
    574     #include <linux/module.h>
    575     #include <linux/random.h>
    576     #include <linux/ftrace.h>
    577     @@ -228,7 +229,10 @@ void panic(const char *fmt, ...)
    578     if (_crash_kexec_post_notifiers)
    579     __crash_kexec(NULL);
    580    
    581     - bust_spinlocks(0);
    582     +#ifdef CONFIG_VT
    583     + unblank_screen();
    584     +#endif
    585     + console_unblank();
    586    
    587     /*
    588     * We may have ended up stopping the CPU holding the lock (in