Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0401-4.9.302-all-fixes.patch

    Annotation of /trunk/kernel-alx-legacy/patches-4.9/0401-4.9.302-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3703 - (hide annotations) (download)
    Mon Oct 24 14:08:16 2022 UTC (19 months, 1 week ago) by niro
    File size: 28739 byte(s) 
    -linux-4.9.302
    1 niro 3703 diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
    2     index ffab8b5caa603..30ba179392d81 100644
    3     --- a/Documentation/sysctl/kernel.txt
    4     +++ b/Documentation/sysctl/kernel.txt
    5     @@ -90,6 +90,7 @@ show up in /proc/sys/kernel:
    6     - sysctl_writes_strict
    7     - tainted
    8     - threads-max
    9     +- unprivileged_bpf_disabled
    10     - unknown_nmi_panic
    11     - watchdog
    12     - watchdog_thresh
    13     @@ -995,6 +996,26 @@ available RAM pages threads-max is reduced accordingly.
    14    
    15     ==============================================================
    16    
    17     +unprivileged_bpf_disabled:
    18     +
    19     +Writing 1 to this entry will disable unprivileged calls to bpf();
    20     +once disabled, calling bpf() without CAP_SYS_ADMIN will return
    21     +-EPERM. Once set to 1, this can't be cleared from the running kernel
    22     +anymore.
    23     +
    24     +Writing 2 to this entry will also disable unprivileged calls to bpf(),
    25     +however, an admin can still change this setting later on, if needed, by
    26     +writing 0 or 1 to this entry.
    27     +
    28     +If BPF_UNPRIV_DEFAULT_OFF is enabled in the kernel config, then this
    29     +entry will default to 2 instead of 0.
    30     +
    31     + 0 - Unprivileged calls to bpf() are enabled
    32     + 1 - Unprivileged calls to bpf() are disabled without recovery
    33     + 2 - Unprivileged calls to bpf() are disabled
    34     +
    35     +==============================================================
    36     +
    37     unknown_nmi_panic:
    38    
    39     The value in this file affects behavior of handling NMI. When the
    40     diff --git a/Makefile b/Makefile
    41     index 776408b6c56e7..d2a09d4a37082 100644
    42     --- a/Makefile
    43     +++ b/Makefile
    44     @@ -1,6 +1,6 @@
    45     VERSION = 4
    46     PATCHLEVEL = 9
    47     -SUBLEVEL = 301
    48     +SUBLEVEL = 302
    49     EXTRAVERSION =
    50     NAME = Roaring Lionus
    51    
    52     diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
    53     index 57e29977ba06c..acaa3a7c2fc65 100644
    54     --- a/arch/arm/boot/dts/imx23-evk.dts
    55     +++ b/arch/arm/boot/dts/imx23-evk.dts
    56     @@ -48,7 +48,6 @@
    57     MX23_PAD_LCD_RESET__GPIO_1_18
    58     MX23_PAD_PWM3__GPIO_1_29
    59     MX23_PAD_PWM4__GPIO_1_30
    60     - MX23_PAD_SSP1_DETECT__SSP1_DETECT
    61     >;
    62     fsl,drive-strength = <MXS_DRIVE_4mA>;
    63     fsl,voltage = <MXS_VOLTAGE_HIGH>;
    64     diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    65     index fc4ae2e423bd7..b0fdcae66ead3 100644
    66     --- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    67     +++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    68     @@ -9,6 +9,8 @@
    69     *
    70     */
    71    
    72     +#include <dt-bindings/gpio/gpio.h>
    73     +
    74     / {
    75     aliases {
    76     backlight = &backlight;
    77     @@ -201,6 +203,7 @@
    78     MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
    79     MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
    80     MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
    81     + MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0
    82     >;
    83     };
    84    
    85     @@ -267,7 +270,7 @@
    86     &usdhc3 {
    87     pinctrl-names = "default";
    88     pinctrl-0 = <&pinctrl_usdhc3>;
    89     - non-removable;
    90     + cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
    91     status = "okay";
    92     };
    93    
    94     diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
    95     index da9813f09d7d7..2b5ae00f8df25 100644
    96     --- a/drivers/hid/Kconfig
    97     +++ b/drivers/hid/Kconfig
    98     @@ -865,7 +865,7 @@ config THRUSTMASTER_FF
    99    
    100     config HID_WACOM
    101     tristate "Wacom Intuos/Graphire tablet support (USB)"
    102     - depends on HID
    103     + depends on USB_HID
    104     select POWER_SUPPLY
    105     select NEW_LEDS
    106     select LEDS_CLASS
    107     diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
    108     index d19ad92eede95..b7d7f40885689 100644
    109     --- a/drivers/hwmon/dell-smm-hwmon.c
    110     +++ b/drivers/hwmon/dell-smm-hwmon.c
    111     @@ -294,7 +294,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed)
    112     }
    113    
    114     /*
    115     - * Set the fan speed (off, low, high). Returns the new fan status.
    116     + * Set the fan speed (off, low, high, ...).
    117     */
    118     static int i8k_set_fan(int fan, int speed)
    119     {
    120     @@ -303,7 +303,7 @@ static int i8k_set_fan(int fan, int speed)
    121     speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed);
    122     regs.ebx = (fan & 0xff) | (speed << 8);
    123    
    124     - return i8k_smm(&regs) ? : i8k_get_fan_status(fan);
    125     + return i8k_smm(&regs);
    126     }
    127    
    128     static int i8k_get_temp_type(int sensor)
    129     @@ -417,7 +417,7 @@ static int
    130     i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
    131     {
    132     int val = 0;
    133     - int speed;
    134     + int speed, err;
    135     unsigned char buff[16];
    136     int __user *argp = (int __user *)arg;
    137    
    138     @@ -478,7 +478,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
    139     if (copy_from_user(&speed, argp + 1, sizeof(int)))
    140     return -EFAULT;
    141    
    142     - val = i8k_set_fan(val, speed);
    143     + err = i8k_set_fan(val, speed);
    144     + if (err < 0)
    145     + return err;
    146     +
    147     + val = i8k_get_fan_status(val);
    148     break;
    149    
    150     default:
    151     diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    152     index 323b86b38b3a3..6cd2ae95e21ed 100644
    153     --- a/drivers/input/serio/i8042-x86ia64io.h
    154     +++ b/drivers/input/serio/i8042-x86ia64io.h
    155     @@ -586,11 +586,6 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
    156     DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
    157     DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
    158     },
    159     - }, {
    160     - .matches = {
    161     - DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    162     - DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
    163     - },
    164     },
    165     { }
    166     };
    167     @@ -677,6 +672,12 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
    168     DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"),
    169     },
    170     },
    171     + {
    172     + .matches = {
    173     + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    174     + DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
    175     + },
    176     + },
    177     { }
    178     };
    179     static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
    180     diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
    181     index 1e2ee97b92406..578d8e12e2d21 100644
    182     --- a/drivers/net/bonding/bond_3ad.c
    183     +++ b/drivers/net/bonding/bond_3ad.c
    184     @@ -971,8 +971,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
    185     if (port->aggregator &&
    186     port->aggregator->is_active &&
    187     !__port_is_enabled(port)) {
    188     -
    189     __enable_port(port);
    190     + *update_slave_arr = true;
    191     }
    192     }
    193     break;
    194     @@ -1724,6 +1724,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
    195     port = port->next_port_in_aggregator) {
    196     __enable_port(port);
    197     }
    198     + *update_slave_arr = true;
    199     }
    200     }
    201    
    202     diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    203     index 46998a58e3d96..467dc0c60759f 100644
    204     --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    205     +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    206     @@ -278,16 +278,6 @@ static int axienet_dma_bd_init(struct net_device *ndev)
    207     axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET,
    208     cr | XAXIDMA_CR_RUNSTOP_MASK);
    209    
    210     - /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finished */
    211     - ret = read_poll_timeout(axienet_ior, value,
    212     - value & XAE_INT_PHYRSTCMPLT_MASK,
    213     - DELAY_OF_ONE_MILLISEC, 50000, false, lp,
    214     - XAE_IS_OFFSET);
    215     - if (ret) {
    216     - dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__);
    217     - return ret;
    218     - }
    219     -
    220     return 0;
    221     out:
    222     axienet_dma_bd_release(ndev);
    223     diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h
    224     index 0275319906748..a76723a4219a6 100644
    225     --- a/drivers/staging/fbtft/fbtft.h
    226     +++ b/drivers/staging/fbtft/fbtft.h
    227     @@ -343,7 +343,10 @@ static int __init fbtft_driver_module_init(void) \
    228     ret = spi_register_driver(&fbtft_driver_spi_driver); \
    229     if (ret < 0) \
    230     return ret; \
    231     - return platform_driver_register(&fbtft_driver_platform_driver); \
    232     + ret = platform_driver_register(&fbtft_driver_platform_driver); \
    233     + if (ret < 0) \
    234     + spi_unregister_driver(&fbtft_driver_spi_driver); \
    235     + return ret; \
    236     } \
    237     \
    238     static void __exit fbtft_driver_module_exit(void) \
    239     diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
    240     index 761b065a40bb3..b2a76ecb5789c 100644
    241     --- a/drivers/target/iscsi/iscsi_target_tpg.c
    242     +++ b/drivers/target/iscsi/iscsi_target_tpg.c
    243     @@ -452,6 +452,9 @@ static bool iscsit_tpg_check_network_portal(
    244     break;
    245     }
    246     spin_unlock(&tpg->tpg_np_lock);
    247     +
    248     + if (match)
    249     + break;
    250     }
    251     spin_unlock(&tiqn->tiqn_tpg_lock);
    252    
    253     diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    254     index 8214b0326b3a1..690cb5a63f9a0 100644
    255     --- a/drivers/tty/n_tty.c
    256     +++ b/drivers/tty/n_tty.c
    257     @@ -1377,7 +1377,7 @@ handle_newline:
    258     put_tty_queue(c, ldata);
    259     smp_store_release(&ldata->canon_head, ldata->read_head);
    260     kill_fasync(&tty->fasync, SIGIO, POLL_IN);
    261     - wake_up_interruptible_poll(&tty->read_wait, POLLIN);
    262     + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
    263     return 0;
    264     }
    265     }
    266     @@ -1658,7 +1658,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
    267    
    268     if (read_cnt(ldata)) {
    269     kill_fasync(&tty->fasync, SIGIO, POLL_IN);
    270     - wake_up_interruptible_poll(&tty->read_wait, POLLIN);
    271     + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
    272     }
    273     }
    274    
    275     diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
    276     index b4f528d26bf1a..5c6243a31166a 100644
    277     --- a/drivers/tty/serial/sh-sci.c
    278     +++ b/drivers/tty/serial/sh-sci.c
    279     @@ -2377,6 +2377,10 @@ done:
    280    
    281     serial_port_out(port, SCFCR, ctrl);
    282     }
    283     + if (port->flags & UPF_HARD_FLOW) {
    284     + /* Refresh (Auto) RTS */
    285     + sci_set_mctrl(port, port->mctrl);
    286     + }
    287    
    288     scr_val |= s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0);
    289     dev_dbg(port->dev, "SCSCR 0x%x\n", scr_val);
    290     @@ -2391,10 +2395,6 @@ done:
    291     */
    292     udelay(DIV_ROUND_UP(10 * 1000000, baud));
    293     }
    294     - if (port->flags & UPF_HARD_FLOW) {
    295     - /* Refresh (Auto) RTS */
    296     - sci_set_mctrl(port, port->mctrl);
    297     - }
    298    
    299     #ifdef CONFIG_SERIAL_SH_SCI_DMA
    300     /*
    301     diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
    302     index e1c1627a3356b..e785a8a7f1c22 100644
    303     --- a/drivers/tty/vt/vt_ioctl.c
    304     +++ b/drivers/tty/vt/vt_ioctl.c
    305     @@ -694,6 +694,7 @@ int vt_ioctl(struct tty_struct *tty,
    306     ret = -ENXIO;
    307     else {
    308     arg--;
    309     + arg = array_index_nospec(arg, MAX_NR_CONSOLES);
    310     console_lock();
    311     ret = vc_allocate(arg);
    312     console_unlock();
    313     @@ -718,9 +719,9 @@ int vt_ioctl(struct tty_struct *tty,
    314     if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
    315     ret = -ENXIO;
    316     else {
    317     - vsa.console = array_index_nospec(vsa.console,
    318     - MAX_NR_CONSOLES + 1);
    319     vsa.console--;
    320     + vsa.console = array_index_nospec(vsa.console,
    321     + MAX_NR_CONSOLES);
    322     console_lock();
    323     ret = vc_allocate(vsa.console);
    324     if (ret == 0) {
    325     diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
    326     index e7ad3ae4ea6bd..65bcbbad6d545 100644
    327     --- a/drivers/usb/dwc2/gadget.c
    328     +++ b/drivers/usb/dwc2/gadget.c
    329     @@ -3979,7 +3979,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
    330     hsotg->gadget.speed = USB_SPEED_UNKNOWN;
    331     spin_unlock_irqrestore(&hsotg->lock, flags);
    332    
    333     - for (ep = 0; ep < hsotg->num_of_eps; ep++) {
    334     + for (ep = 1; ep < hsotg->num_of_eps; ep++) {
    335     if (hsotg->eps_in[ep])
    336     dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
    337     if (hsotg->eps_out[ep])
    338     diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    339     index e340ef67321e5..58c4b745eae13 100644
    340     --- a/drivers/usb/dwc3/gadget.c
    341     +++ b/drivers/usb/dwc3/gadget.c
    342     @@ -902,6 +902,19 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
    343     if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
    344     trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(req->request.stream_id);
    345    
    346     + /*
    347     + * As per data book 4.2.3.2TRB Control Bit Rules section
    348     + *
    349     + * The controller autonomously checks the HWO field of a TRB to determine if the
    350     + * entire TRB is valid. Therefore, software must ensure that the rest of the TRB
    351     + * is valid before setting the HWO field to '1'. In most systems, this means that
    352     + * software must update the fourth DWORD of a TRB last.
    353     + *
    354     + * However there is a possibility of CPU re-ordering here which can cause
    355     + * controller to observe the HWO bit set prematurely.
    356     + * Add a write memory barrier to prevent CPU re-ordering.
    357     + */
    358     + wmb();
    359     trb->ctrl |= DWC3_TRB_CTRL_HWO;
    360    
    361     trace_dwc3_prepare_trb(dep, trb);
    362     diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    363     index a7c44a3cb2d25..3b8a8e2d34848 100644
    364     --- a/drivers/usb/gadget/composite.c
    365     +++ b/drivers/usb/gadget/composite.c
    366     @@ -1932,6 +1932,9 @@ unknown:
    367     if (w_index != 0x5 || (w_value >> 8))
    368     break;
    369     interface = w_value & 0xFF;
    370     + if (interface >= MAX_CONFIG_INTERFACES ||
    371     + !os_desc_cfg->interface[interface])
    372     + break;
    373     buf[6] = w_index;
    374     if (w_length == 0x0A) {
    375     count = count_ext_prop(os_desc_cfg,
    376     diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
    377     index ab6ac1b74ac0f..a912b6b9153fd 100644
    378     --- a/drivers/usb/gadget/function/rndis.c
    379     +++ b/drivers/usb/gadget/function/rndis.c
    380     @@ -642,14 +642,17 @@ static int rndis_set_response(struct rndis_params *params,
    381     rndis_set_cmplt_type *resp;
    382     rndis_resp_t *r;
    383    
    384     + BufLength = le32_to_cpu(buf->InformationBufferLength);
    385     + BufOffset = le32_to_cpu(buf->InformationBufferOffset);
    386     + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
    387     + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
    388     + return -EINVAL;
    389     +
    390     r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
    391     if (!r)
    392     return -ENOMEM;
    393     resp = (rndis_set_cmplt_type *)r->buf;
    394    
    395     - BufLength = le32_to_cpu(buf->InformationBufferLength);
    396     - BufOffset = le32_to_cpu(buf->InformationBufferOffset);
    397     -
    398     #ifdef VERBOSE_DEBUG
    399     pr_debug("%s: Length: %d\n", __func__, BufLength);
    400     pr_debug("%s: Offset: %d\n", __func__, BufOffset);
    401     diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
    402     index c6ff79360302f..a8573da2717a1 100644
    403     --- a/drivers/usb/serial/ch341.c
    404     +++ b/drivers/usb/serial/ch341.c
    405     @@ -74,6 +74,7 @@ static const struct usb_device_id id_table[] = {
    406     { USB_DEVICE(0x1a86, 0x5523) },
    407     { USB_DEVICE(0x1a86, 0x7522) },
    408     { USB_DEVICE(0x1a86, 0x7523) },
    409     + { USB_DEVICE(0x2184, 0x0057) },
    410     { USB_DEVICE(0x4348, 0x5523) },
    411     { USB_DEVICE(0x9986, 0x7523) },
    412     { },
    413     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    414     index dde28ede396bf..ddee42e44a33b 100644
    415     --- a/drivers/usb/serial/cp210x.c
    416     +++ b/drivers/usb/serial/cp210x.c
    417     @@ -49,6 +49,7 @@ static int cp210x_port_remove(struct usb_serial_port *);
    418     static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
    419    
    420     static const struct usb_device_id id_table[] = {
    421     + { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */
    422     { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
    423     { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
    424     { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    425     @@ -66,6 +67,7 @@ static const struct usb_device_id id_table[] = {
    426     { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
    427     { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
    428     { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
    429     + { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */
    430     { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
    431     { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
    432     { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
    433     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    434     index fe6b32c2ff1cb..5c4fa4fcb1e88 100644
    435     --- a/drivers/usb/serial/ftdi_sio.c
    436     +++ b/drivers/usb/serial/ftdi_sio.c
    437     @@ -964,6 +964,7 @@ static const struct usb_device_id id_table_combined[] = {
    438     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
    439     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
    440     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
    441     + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) },
    442     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
    443     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
    444     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
    445     @@ -972,12 +973,14 @@ static const struct usb_device_id id_table_combined[] = {
    446     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
    447     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
    448     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
    449     + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) },
    450     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
    451     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
    452     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
    453     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
    454     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
    455     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
    456     + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) },
    457     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
    458     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
    459     { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
    460     diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    461     index 3b7cea8df446c..006e92d26baba 100644
    462     --- a/drivers/usb/serial/ftdi_sio_ids.h
    463     +++ b/drivers/usb/serial/ftdi_sio_ids.h
    464     @@ -1505,6 +1505,9 @@
    465     #define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
    466     #define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
    467     #define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
    468     +#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */
    469     +#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */
    470     +#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */
    471     #define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
    472     #define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
    473     #define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
    474     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    475     index 9479abb9eaaaf..4c3ff0706554f 100644
    476     --- a/drivers/usb/serial/option.c
    477     +++ b/drivers/usb/serial/option.c
    478     @@ -1625,6 +1625,8 @@ static const struct usb_device_id option_ids[] = {
    479     .driver_info = RSVD(2) },
    480     { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
    481     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
    482     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */
    483     + .driver_info = RSVD(5) },
    484     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
    485     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
    486     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
    487     diff --git a/fs/nfs/client.c b/fs/nfs/client.c
    488     index d322ed5cbc1ca..6386875d0a33a 100644
    489     --- a/fs/nfs/client.c
    490     +++ b/fs/nfs/client.c
    491     @@ -179,6 +179,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
    492     INIT_LIST_HEAD(&clp->cl_superblocks);
    493     clp->cl_rpcclient = ERR_PTR(-EINVAL);
    494    
    495     + clp->cl_flags = cl_init->init_flags;
    496     clp->cl_proto = cl_init->proto;
    497     clp->cl_net = get_net(cl_init->net);
    498    
    499     @@ -400,7 +401,6 @@ nfs_get_client(const struct nfs_client_initdata *cl_init,
    500     list_add_tail(&new->cl_share_link,
    501     &nn->nfs_client_list);
    502     spin_unlock(&nn->nfs_client_lock);
    503     - new->cl_flags = cl_init->init_flags;
    504     return rpc_ops->init_client(new, cl_init);
    505     }
    506    
    507     diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
    508     index 2fb4633897084..48baa92846e5f 100644
    509     --- a/fs/nfs/nfs4client.c
    510     +++ b/fs/nfs/nfs4client.c
    511     @@ -1329,8 +1329,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
    512     goto out;
    513     }
    514    
    515     - if (server->nfs_client->cl_hostname == NULL)
    516     + if (server->nfs_client->cl_hostname == NULL) {
    517     server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);
    518     + if (server->nfs_client->cl_hostname == NULL)
    519     + return -ENOMEM;
    520     + }
    521     nfs_server_insert_lists(server);
    522    
    523     error = nfs_probe_destination(server);
    524     diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
    525     index 4e63daeef6339..466c07bd06295 100644
    526     --- a/fs/nfs/nfs4state.c
    527     +++ b/fs/nfs/nfs4state.c
    528     @@ -1985,6 +1985,9 @@ static int nfs4_try_migration(struct nfs_server *server, struct rpc_cred *cred)
    529     }
    530    
    531     result = -NFS4ERR_NXIO;
    532     + if (!locations->nlocations)
    533     + goto out;
    534     +
    535     if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
    536     dprintk("<-- %s: No fs_locations data, migration skipped\n",
    537     __func__);
    538     diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
    539     index 0a7c4e30a385e..b50c97c6aecb3 100644
    540     --- a/fs/nfs/nfs4xdr.c
    541     +++ b/fs/nfs/nfs4xdr.c
    542     @@ -3633,8 +3633,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
    543     if (unlikely(!p))
    544     goto out_overflow;
    545     n = be32_to_cpup(p);
    546     - if (n <= 0)
    547     - goto out_eio;
    548     for (res->nlocations = 0; res->nlocations < n; res->nlocations++) {
    549     u32 m;
    550     struct nfs4_fs_location *loc;
    551     @@ -4177,10 +4175,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
    552     } else
    553     printk(KERN_WARNING "%s: label too long (%u)!\n",
    554     __func__, len);
    555     + if (label && label->label)
    556     + dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n",
    557     + __func__, label->len, (char *)label->label,
    558     + label->len, label->pi, label->lfs);
    559     }
    560     - if (label && label->label)
    561     - dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
    562     - (char *)label->label, label->len, label->pi, label->lfs);
    563     return status;
    564    
    565     out_overflow:
    566     diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
    567     index 00b472fe77c19..1bf2e1c47cbfd 100644
    568     --- a/fs/nfsd/nfs3proc.c
    569     +++ b/fs/nfsd/nfs3proc.c
    570     @@ -191,6 +191,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp,
    571     (unsigned long long) argp->offset,
    572     argp->stable? " stable" : "");
    573    
    574     + resp->status = nfserr_fbig;
    575     + if (argp->offset > (u64)OFFSET_MAX ||
    576     + argp->offset + argp->len > (u64)OFFSET_MAX)
    577     + return rpc_success;
    578     +
    579     fh_copy(&resp->fh, &argp->fh);
    580     resp->committed = argp->stable;
    581     nfserr = nfsd_write(rqstp, &resp->fh, NULL,
    582     diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    583     index 66985a6a7047b..d029decd87e3d 100644
    584     --- a/fs/nfsd/nfs4proc.c
    585     +++ b/fs/nfsd/nfs4proc.c
    586     @@ -982,8 +982,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
    587     unsigned long cnt;
    588     int nvecs;
    589    
    590     - if (write->wr_offset >= OFFSET_MAX)
    591     - return nfserr_inval;
    592     + if (write->wr_offset > (u64)OFFSET_MAX ||
    593     + write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
    594     + return nfserr_fbig;
    595    
    596     status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
    597     stateid, WR_STATE, &filp, NULL);
    598     diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
    599     index 5a23535a5018d..6a6f1d3bf8538 100644
    600     --- a/include/net/dst_metadata.h
    601     +++ b/include/net/dst_metadata.h
    602     @@ -97,8 +97,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
    603    
    604     memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
    605     sizeof(struct ip_tunnel_info) + md_size);
    606     +#ifdef CONFIG_DST_CACHE
    607     + /* Unclone the dst cache if there is one */
    608     + if (new_md->u.tun_info.dst_cache.cache) {
    609     + int ret;
    610     +
    611     + ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC);
    612     + if (ret) {
    613     + metadata_dst_free(new_md);
    614     + return ERR_PTR(ret);
    615     + }
    616     + }
    617     +#endif
    618     +
    619     skb_dst_drop(skb);
    620     - dst_hold(&new_md->dst);
    621     skb_dst_set(skb, &new_md->dst);
    622     return new_md;
    623     }
    624     diff --git a/init/Kconfig b/init/Kconfig
    625     index 07570008e2fd9..7e09227b976fa 100644
    626     --- a/init/Kconfig
    627     +++ b/init/Kconfig
    628     @@ -1645,6 +1645,16 @@ config ADVISE_SYSCALLS
    629     applications use these syscalls, you can disable this option to save
    630     space.
    631    
    632     +config BPF_UNPRIV_DEFAULT_OFF
    633     + bool "Disable unprivileged BPF by default"
    634     + depends on BPF_SYSCALL
    635     + help
    636     + Disables unprivileged BPF by default by setting the corresponding
    637     + /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
    638     + still reenable it by setting it to 0 later on, or permanently
    639     + disable it by setting it to 1 (from which no other transition to
    640     + 0 is possible anymore).
    641     +
    642     config USERFAULTFD
    643     bool "Enable userfaultfd() system call"
    644     select ANON_INODES
    645     diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
    646     index e10314223cbfe..e30ad1be68412 100644
    647     --- a/kernel/bpf/syscall.c
    648     +++ b/kernel/bpf/syscall.c
    649     @@ -22,7 +22,8 @@
    650    
    651     DEFINE_PER_CPU(int, bpf_prog_active);
    652    
    653     -int sysctl_unprivileged_bpf_disabled __read_mostly;
    654     +int sysctl_unprivileged_bpf_disabled __read_mostly =
    655     + IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
    656    
    657     static LIST_HEAD(bpf_map_types);
    658    
    659     diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    660     index 513e6da318c47..78b445562b81e 100644
    661     --- a/kernel/sysctl.c
    662     +++ b/kernel/sysctl.c
    663     @@ -221,6 +221,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write,
    664    
    665     #endif
    666    
    667     +#ifdef CONFIG_BPF_SYSCALL
    668     +static int bpf_unpriv_handler(struct ctl_table *table, int write,
    669     + void *buffer, size_t *lenp, loff_t *ppos)
    670     +{
    671     + int ret, unpriv_enable = *(int *)table->data;
    672     + bool locked_state = unpriv_enable == 1;
    673     + struct ctl_table tmp = *table;
    674     +
    675     + if (write && !capable(CAP_SYS_ADMIN))
    676     + return -EPERM;
    677     +
    678     + tmp.data = &unpriv_enable;
    679     + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
    680     + if (write && !ret) {
    681     + if (locked_state && unpriv_enable != 1)
    682     + return -EPERM;
    683     + *(int *)table->data = unpriv_enable;
    684     + }
    685     + return ret;
    686     +}
    687     +#endif
    688     +
    689     static struct ctl_table kern_table[];
    690     static struct ctl_table vm_table[];
    691     static struct ctl_table fs_table[];
    692     @@ -1202,10 +1224,9 @@ static struct ctl_table kern_table[] = {
    693     .data = &sysctl_unprivileged_bpf_disabled,
    694     .maxlen = sizeof(sysctl_unprivileged_bpf_disabled),
    695     .mode = 0644,
    696     - /* only handle a transition from default "0" to "1" */
    697     - .proc_handler = proc_dointvec_minmax,
    698     - .extra1 = &one,
    699     - .extra2 = &one,
    700     + .proc_handler = bpf_unpriv_handler,
    701     + .extra1 = &zero,
    702     + .extra2 = &two,
    703     },
    704     #endif
    705     #if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU)
    706     diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
    707     index 354926e61f067..58c0ab8894c70 100644
    708     --- a/net/ipv4/ipmr.c
    709     +++ b/net/ipv4/ipmr.c
    710     @@ -242,7 +242,9 @@ static int __net_init ipmr_rules_init(struct net *net)
    711     return 0;
    712    
    713     err2:
    714     + rtnl_lock();
    715     ipmr_free_table(mrt);
    716     + rtnl_unlock();
    717     err1:
    718     fib_rules_unregister(ops);
    719     return err;
    720     diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    721     index f38b22f54c093..3dce62ec37ed4 100644
    722     --- a/net/ipv6/ip6mr.c
    723     +++ b/net/ipv6/ip6mr.c
    724     @@ -251,7 +251,9 @@ static int __net_init ip6mr_rules_init(struct net *net)
    725     return 0;
    726    
    727     err2:
    728     + rtnl_lock();
    729     ip6mr_free_table(mrt);
    730     + rtnl_unlock();
    731     err1:
    732     fib_rules_unregister(ops);
    733     return err;
    734     diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
    735     index 7ebcaff8c1c4f..963f607b34999 100644
    736     --- a/net/tipc/name_distr.c
    737     +++ b/net/tipc/name_distr.c
    738     @@ -288,7 +288,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
    739     return true;
    740     }
    741     } else {
    742     - pr_warn("Unrecognized name table message received\n");
    743     + pr_warn_ratelimited("Unknown name table message received\n");
    744     }
    745     return false;
    746     }
    747     diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    748     index 853a7d2333b3e..51d2fef7cd677 100644
    749     --- a/security/integrity/ima/ima_fs.c
    750     +++ b/security/integrity/ima/ima_fs.c
    751     @@ -477,11 +477,11 @@ int __init ima_fs_init(void)
    752    
    753     return 0;
    754     out:
    755     + securityfs_remove(ima_policy);
    756     securityfs_remove(violations);
    757     securityfs_remove(runtime_measurements_count);
    758     securityfs_remove(ascii_runtime_measurements);
    759     securityfs_remove(binary_runtime_measurements);
    760     securityfs_remove(ima_dir);
    761     - securityfs_remove(ima_policy);
    762     return -1;
    763     }
    764     diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
    765     index 90987d15b6fe6..6c415667ba67f 100644
    766     --- a/security/integrity/integrity_audit.c
    767     +++ b/security/integrity/integrity_audit.c
    768     @@ -39,6 +39,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
    769     return;
    770    
    771     ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
    772     + if (!ab)
    773     + return;
    774     audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
    775     task_pid_nr(current),
    776     from_kuid(&init_user_ns, current_cred()->uid),
    777     diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
    778     index 7133c36f99b6c..b3abc4cf7eb0a 100644
    779     --- a/sound/usb/line6/podhd.c
    780     +++ b/sound/usb/line6/podhd.c
    781     @@ -385,7 +385,7 @@ static const struct line6_properties podhd_properties_table[] = {
    782     .name = "POD HD500",
    783     .capabilities = LINE6_CAP_PCM
    784     | LINE6_CAP_HWMON,
    785     - .altsetting = 0,
    786     + .altsetting = 1,
    787     .ep_ctrl_r = 0x81,
    788     .ep_ctrl_w = 0x01,
    789     .ep_audio_r = 0x86,
    790     @@ -396,7 +396,7 @@ static const struct line6_properties podhd_properties_table[] = {
    791     .name = "POD HD500",
    792     .capabilities = LINE6_CAP_PCM
    793     | LINE6_CAP_HWMON,
    794     - .altsetting = 1,
    795     + .altsetting = 0,
    796     .ep_ctrl_r = 0x81,
    797     .ep_ctrl_w = 0x01,
    798     .ep_audio_r = 0x86,