Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0401-4.9.302-all-fixes.patch

    Contents of /trunk/kernel-alx-legacy/patches-4.9/0401-4.9.302-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3703 - (show annotations) (download)
    Mon Oct 24 14:08:16 2022 UTC (19 months ago) by niro
    File size: 28739 byte(s) 
    -linux-4.9.302
    1 diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
    2 index ffab8b5caa603..30ba179392d81 100644
    3 --- a/Documentation/sysctl/kernel.txt
    4 +++ b/Documentation/sysctl/kernel.txt
    5 @@ -90,6 +90,7 @@ show up in /proc/sys/kernel:
    6 - sysctl_writes_strict
    7 - tainted
    8 - threads-max
    9 +- unprivileged_bpf_disabled
    10 - unknown_nmi_panic
    11 - watchdog
    12 - watchdog_thresh
    13 @@ -995,6 +996,26 @@ available RAM pages threads-max is reduced accordingly.
    14
    15 ==============================================================
    16
    17 +unprivileged_bpf_disabled:
    18 +
    19 +Writing 1 to this entry will disable unprivileged calls to bpf();
    20 +once disabled, calling bpf() without CAP_SYS_ADMIN will return
    21 +-EPERM. Once set to 1, this can't be cleared from the running kernel
    22 +anymore.
    23 +
    24 +Writing 2 to this entry will also disable unprivileged calls to bpf(),
    25 +however, an admin can still change this setting later on, if needed, by
    26 +writing 0 or 1 to this entry.
    27 +
    28 +If BPF_UNPRIV_DEFAULT_OFF is enabled in the kernel config, then this
    29 +entry will default to 2 instead of 0.
    30 +
    31 + 0 - Unprivileged calls to bpf() are enabled
    32 + 1 - Unprivileged calls to bpf() are disabled without recovery
    33 + 2 - Unprivileged calls to bpf() are disabled
    34 +
    35 +==============================================================
    36 +
    37 unknown_nmi_panic:
    38
    39 The value in this file affects behavior of handling NMI. When the
    40 diff --git a/Makefile b/Makefile
    41 index 776408b6c56e7..d2a09d4a37082 100644
    42 --- a/Makefile
    43 +++ b/Makefile
    44 @@ -1,6 +1,6 @@
    45 VERSION = 4
    46 PATCHLEVEL = 9
    47 -SUBLEVEL = 301
    48 +SUBLEVEL = 302
    49 EXTRAVERSION =
    50 NAME = Roaring Lionus
    51
    52 diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
    53 index 57e29977ba06c..acaa3a7c2fc65 100644
    54 --- a/arch/arm/boot/dts/imx23-evk.dts
    55 +++ b/arch/arm/boot/dts/imx23-evk.dts
    56 @@ -48,7 +48,6 @@
    57 MX23_PAD_LCD_RESET__GPIO_1_18
    58 MX23_PAD_PWM3__GPIO_1_29
    59 MX23_PAD_PWM4__GPIO_1_30
    60 - MX23_PAD_SSP1_DETECT__SSP1_DETECT
    61 >;
    62 fsl,drive-strength = <MXS_DRIVE_4mA>;
    63 fsl,voltage = <MXS_VOLTAGE_HIGH>;
    64 diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    65 index fc4ae2e423bd7..b0fdcae66ead3 100644
    66 --- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    67 +++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
    68 @@ -9,6 +9,8 @@
    69 *
    70 */
    71
    72 +#include <dt-bindings/gpio/gpio.h>
    73 +
    74 / {
    75 aliases {
    76 backlight = &backlight;
    77 @@ -201,6 +203,7 @@
    78 MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
    79 MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
    80 MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
    81 + MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0
    82 >;
    83 };
    84
    85 @@ -267,7 +270,7 @@
    86 &usdhc3 {
    87 pinctrl-names = "default";
    88 pinctrl-0 = <&pinctrl_usdhc3>;
    89 - non-removable;
    90 + cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
    91 status = "okay";
    92 };
    93
    94 diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
    95 index da9813f09d7d7..2b5ae00f8df25 100644
    96 --- a/drivers/hid/Kconfig
    97 +++ b/drivers/hid/Kconfig
    98 @@ -865,7 +865,7 @@ config THRUSTMASTER_FF
    99
    100 config HID_WACOM
    101 tristate "Wacom Intuos/Graphire tablet support (USB)"
    102 - depends on HID
    103 + depends on USB_HID
    104 select POWER_SUPPLY
    105 select NEW_LEDS
    106 select LEDS_CLASS
    107 diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
    108 index d19ad92eede95..b7d7f40885689 100644
    109 --- a/drivers/hwmon/dell-smm-hwmon.c
    110 +++ b/drivers/hwmon/dell-smm-hwmon.c
    111 @@ -294,7 +294,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed)
    112 }
    113
    114 /*
    115 - * Set the fan speed (off, low, high). Returns the new fan status.
    116 + * Set the fan speed (off, low, high, ...).
    117 */
    118 static int i8k_set_fan(int fan, int speed)
    119 {
    120 @@ -303,7 +303,7 @@ static int i8k_set_fan(int fan, int speed)
    121 speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed);
    122 regs.ebx = (fan & 0xff) | (speed << 8);
    123
    124 - return i8k_smm(&regs) ? : i8k_get_fan_status(fan);
    125 + return i8k_smm(&regs);
    126 }
    127
    128 static int i8k_get_temp_type(int sensor)
    129 @@ -417,7 +417,7 @@ static int
    130 i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
    131 {
    132 int val = 0;
    133 - int speed;
    134 + int speed, err;
    135 unsigned char buff[16];
    136 int __user *argp = (int __user *)arg;
    137
    138 @@ -478,7 +478,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
    139 if (copy_from_user(&speed, argp + 1, sizeof(int)))
    140 return -EFAULT;
    141
    142 - val = i8k_set_fan(val, speed);
    143 + err = i8k_set_fan(val, speed);
    144 + if (err < 0)
    145 + return err;
    146 +
    147 + val = i8k_get_fan_status(val);
    148 break;
    149
    150 default:
    151 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    152 index 323b86b38b3a3..6cd2ae95e21ed 100644
    153 --- a/drivers/input/serio/i8042-x86ia64io.h
    154 +++ b/drivers/input/serio/i8042-x86ia64io.h
    155 @@ -586,11 +586,6 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
    156 DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
    157 DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
    158 },
    159 - }, {
    160 - .matches = {
    161 - DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    162 - DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
    163 - },
    164 },
    165 { }
    166 };
    167 @@ -677,6 +672,12 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
    168 DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"),
    169 },
    170 },
    171 + {
    172 + .matches = {
    173 + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    174 + DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
    175 + },
    176 + },
    177 { }
    178 };
    179 static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
    180 diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
    181 index 1e2ee97b92406..578d8e12e2d21 100644
    182 --- a/drivers/net/bonding/bond_3ad.c
    183 +++ b/drivers/net/bonding/bond_3ad.c
    184 @@ -971,8 +971,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
    185 if (port->aggregator &&
    186 port->aggregator->is_active &&
    187 !__port_is_enabled(port)) {
    188 -
    189 __enable_port(port);
    190 + *update_slave_arr = true;
    191 }
    192 }
    193 break;
    194 @@ -1724,6 +1724,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
    195 port = port->next_port_in_aggregator) {
    196 __enable_port(port);
    197 }
    198 + *update_slave_arr = true;
    199 }
    200 }
    201
    202 diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    203 index 46998a58e3d96..467dc0c60759f 100644
    204 --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    205 +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
    206 @@ -278,16 +278,6 @@ static int axienet_dma_bd_init(struct net_device *ndev)
    207 axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET,
    208 cr | XAXIDMA_CR_RUNSTOP_MASK);
    209
    210 - /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finished */
    211 - ret = read_poll_timeout(axienet_ior, value,
    212 - value & XAE_INT_PHYRSTCMPLT_MASK,
    213 - DELAY_OF_ONE_MILLISEC, 50000, false, lp,
    214 - XAE_IS_OFFSET);
    215 - if (ret) {
    216 - dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__);
    217 - return ret;
    218 - }
    219 -
    220 return 0;
    221 out:
    222 axienet_dma_bd_release(ndev);
    223 diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h
    224 index 0275319906748..a76723a4219a6 100644
    225 --- a/drivers/staging/fbtft/fbtft.h
    226 +++ b/drivers/staging/fbtft/fbtft.h
    227 @@ -343,7 +343,10 @@ static int __init fbtft_driver_module_init(void) \
    228 ret = spi_register_driver(&fbtft_driver_spi_driver); \
    229 if (ret < 0) \
    230 return ret; \
    231 - return platform_driver_register(&fbtft_driver_platform_driver); \
    232 + ret = platform_driver_register(&fbtft_driver_platform_driver); \
    233 + if (ret < 0) \
    234 + spi_unregister_driver(&fbtft_driver_spi_driver); \
    235 + return ret; \
    236 } \
    237 \
    238 static void __exit fbtft_driver_module_exit(void) \
    239 diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
    240 index 761b065a40bb3..b2a76ecb5789c 100644
    241 --- a/drivers/target/iscsi/iscsi_target_tpg.c
    242 +++ b/drivers/target/iscsi/iscsi_target_tpg.c
    243 @@ -452,6 +452,9 @@ static bool iscsit_tpg_check_network_portal(
    244 break;
    245 }
    246 spin_unlock(&tpg->tpg_np_lock);
    247 +
    248 + if (match)
    249 + break;
    250 }
    251 spin_unlock(&tiqn->tiqn_tpg_lock);
    252
    253 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    254 index 8214b0326b3a1..690cb5a63f9a0 100644
    255 --- a/drivers/tty/n_tty.c
    256 +++ b/drivers/tty/n_tty.c
    257 @@ -1377,7 +1377,7 @@ handle_newline:
    258 put_tty_queue(c, ldata);
    259 smp_store_release(&ldata->canon_head, ldata->read_head);
    260 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
    261 - wake_up_interruptible_poll(&tty->read_wait, POLLIN);
    262 + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
    263 return 0;
    264 }
    265 }
    266 @@ -1658,7 +1658,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
    267
    268 if (read_cnt(ldata)) {
    269 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
    270 - wake_up_interruptible_poll(&tty->read_wait, POLLIN);
    271 + wake_up_interruptible_poll(&tty->read_wait, POLLIN | POLLRDNORM);
    272 }
    273 }
    274
    275 diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
    276 index b4f528d26bf1a..5c6243a31166a 100644
    277 --- a/drivers/tty/serial/sh-sci.c
    278 +++ b/drivers/tty/serial/sh-sci.c
    279 @@ -2377,6 +2377,10 @@ done:
    280
    281 serial_port_out(port, SCFCR, ctrl);
    282 }
    283 + if (port->flags & UPF_HARD_FLOW) {
    284 + /* Refresh (Auto) RTS */
    285 + sci_set_mctrl(port, port->mctrl);
    286 + }
    287
    288 scr_val |= s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0);
    289 dev_dbg(port->dev, "SCSCR 0x%x\n", scr_val);
    290 @@ -2391,10 +2395,6 @@ done:
    291 */
    292 udelay(DIV_ROUND_UP(10 * 1000000, baud));
    293 }
    294 - if (port->flags & UPF_HARD_FLOW) {
    295 - /* Refresh (Auto) RTS */
    296 - sci_set_mctrl(port, port->mctrl);
    297 - }
    298
    299 #ifdef CONFIG_SERIAL_SH_SCI_DMA
    300 /*
    301 diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
    302 index e1c1627a3356b..e785a8a7f1c22 100644
    303 --- a/drivers/tty/vt/vt_ioctl.c
    304 +++ b/drivers/tty/vt/vt_ioctl.c
    305 @@ -694,6 +694,7 @@ int vt_ioctl(struct tty_struct *tty,
    306 ret = -ENXIO;
    307 else {
    308 arg--;
    309 + arg = array_index_nospec(arg, MAX_NR_CONSOLES);
    310 console_lock();
    311 ret = vc_allocate(arg);
    312 console_unlock();
    313 @@ -718,9 +719,9 @@ int vt_ioctl(struct tty_struct *tty,
    314 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
    315 ret = -ENXIO;
    316 else {
    317 - vsa.console = array_index_nospec(vsa.console,
    318 - MAX_NR_CONSOLES + 1);
    319 vsa.console--;
    320 + vsa.console = array_index_nospec(vsa.console,
    321 + MAX_NR_CONSOLES);
    322 console_lock();
    323 ret = vc_allocate(vsa.console);
    324 if (ret == 0) {
    325 diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
    326 index e7ad3ae4ea6bd..65bcbbad6d545 100644
    327 --- a/drivers/usb/dwc2/gadget.c
    328 +++ b/drivers/usb/dwc2/gadget.c
    329 @@ -3979,7 +3979,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
    330 hsotg->gadget.speed = USB_SPEED_UNKNOWN;
    331 spin_unlock_irqrestore(&hsotg->lock, flags);
    332
    333 - for (ep = 0; ep < hsotg->num_of_eps; ep++) {
    334 + for (ep = 1; ep < hsotg->num_of_eps; ep++) {
    335 if (hsotg->eps_in[ep])
    336 dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
    337 if (hsotg->eps_out[ep])
    338 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    339 index e340ef67321e5..58c4b745eae13 100644
    340 --- a/drivers/usb/dwc3/gadget.c
    341 +++ b/drivers/usb/dwc3/gadget.c
    342 @@ -902,6 +902,19 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
    343 if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
    344 trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(req->request.stream_id);
    345
    346 + /*
    347 + * As per data book 4.2.3.2TRB Control Bit Rules section
    348 + *
    349 + * The controller autonomously checks the HWO field of a TRB to determine if the
    350 + * entire TRB is valid. Therefore, software must ensure that the rest of the TRB
    351 + * is valid before setting the HWO field to '1'. In most systems, this means that
    352 + * software must update the fourth DWORD of a TRB last.
    353 + *
    354 + * However there is a possibility of CPU re-ordering here which can cause
    355 + * controller to observe the HWO bit set prematurely.
    356 + * Add a write memory barrier to prevent CPU re-ordering.
    357 + */
    358 + wmb();
    359 trb->ctrl |= DWC3_TRB_CTRL_HWO;
    360
    361 trace_dwc3_prepare_trb(dep, trb);
    362 diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    363 index a7c44a3cb2d25..3b8a8e2d34848 100644
    364 --- a/drivers/usb/gadget/composite.c
    365 +++ b/drivers/usb/gadget/composite.c
    366 @@ -1932,6 +1932,9 @@ unknown:
    367 if (w_index != 0x5 || (w_value >> 8))
    368 break;
    369 interface = w_value & 0xFF;
    370 + if (interface >= MAX_CONFIG_INTERFACES ||
    371 + !os_desc_cfg->interface[interface])
    372 + break;
    373 buf[6] = w_index;
    374 if (w_length == 0x0A) {
    375 count = count_ext_prop(os_desc_cfg,
    376 diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
    377 index ab6ac1b74ac0f..a912b6b9153fd 100644
    378 --- a/drivers/usb/gadget/function/rndis.c
    379 +++ b/drivers/usb/gadget/function/rndis.c
    380 @@ -642,14 +642,17 @@ static int rndis_set_response(struct rndis_params *params,
    381 rndis_set_cmplt_type *resp;
    382 rndis_resp_t *r;
    383
    384 + BufLength = le32_to_cpu(buf->InformationBufferLength);
    385 + BufOffset = le32_to_cpu(buf->InformationBufferOffset);
    386 + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
    387 + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
    388 + return -EINVAL;
    389 +
    390 r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
    391 if (!r)
    392 return -ENOMEM;
    393 resp = (rndis_set_cmplt_type *)r->buf;
    394
    395 - BufLength = le32_to_cpu(buf->InformationBufferLength);
    396 - BufOffset = le32_to_cpu(buf->InformationBufferOffset);
    397 -
    398 #ifdef VERBOSE_DEBUG
    399 pr_debug("%s: Length: %d\n", __func__, BufLength);
    400 pr_debug("%s: Offset: %d\n", __func__, BufOffset);
    401 diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
    402 index c6ff79360302f..a8573da2717a1 100644
    403 --- a/drivers/usb/serial/ch341.c
    404 +++ b/drivers/usb/serial/ch341.c
    405 @@ -74,6 +74,7 @@ static const struct usb_device_id id_table[] = {
    406 { USB_DEVICE(0x1a86, 0x5523) },
    407 { USB_DEVICE(0x1a86, 0x7522) },
    408 { USB_DEVICE(0x1a86, 0x7523) },
    409 + { USB_DEVICE(0x2184, 0x0057) },
    410 { USB_DEVICE(0x4348, 0x5523) },
    411 { USB_DEVICE(0x9986, 0x7523) },
    412 { },
    413 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    414 index dde28ede396bf..ddee42e44a33b 100644
    415 --- a/drivers/usb/serial/cp210x.c
    416 +++ b/drivers/usb/serial/cp210x.c
    417 @@ -49,6 +49,7 @@ static int cp210x_port_remove(struct usb_serial_port *);
    418 static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
    419
    420 static const struct usb_device_id id_table[] = {
    421 + { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */
    422 { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
    423 { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
    424 { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    425 @@ -66,6 +67,7 @@ static const struct usb_device_id id_table[] = {
    426 { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
    427 { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
    428 { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
    429 + { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */
    430 { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
    431 { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
    432 { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
    433 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    434 index fe6b32c2ff1cb..5c4fa4fcb1e88 100644
    435 --- a/drivers/usb/serial/ftdi_sio.c
    436 +++ b/drivers/usb/serial/ftdi_sio.c
    437 @@ -964,6 +964,7 @@ static const struct usb_device_id id_table_combined[] = {
    438 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
    439 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
    440 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
    441 + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) },
    442 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
    443 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
    444 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
    445 @@ -972,12 +973,14 @@ static const struct usb_device_id id_table_combined[] = {
    446 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
    447 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
    448 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
    449 + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) },
    450 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
    451 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
    452 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
    453 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
    454 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
    455 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
    456 + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) },
    457 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
    458 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
    459 { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
    460 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    461 index 3b7cea8df446c..006e92d26baba 100644
    462 --- a/drivers/usb/serial/ftdi_sio_ids.h
    463 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    464 @@ -1505,6 +1505,9 @@
    465 #define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
    466 #define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
    467 #define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
    468 +#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */
    469 +#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */
    470 +#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */
    471 #define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
    472 #define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
    473 #define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
    474 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    475 index 9479abb9eaaaf..4c3ff0706554f 100644
    476 --- a/drivers/usb/serial/option.c
    477 +++ b/drivers/usb/serial/option.c
    478 @@ -1625,6 +1625,8 @@ static const struct usb_device_id option_ids[] = {
    479 .driver_info = RSVD(2) },
    480 { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
    481 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
    482 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */
    483 + .driver_info = RSVD(5) },
    484 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
    485 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
    486 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
    487 diff --git a/fs/nfs/client.c b/fs/nfs/client.c
    488 index d322ed5cbc1ca..6386875d0a33a 100644
    489 --- a/fs/nfs/client.c
    490 +++ b/fs/nfs/client.c
    491 @@ -179,6 +179,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
    492 INIT_LIST_HEAD(&clp->cl_superblocks);
    493 clp->cl_rpcclient = ERR_PTR(-EINVAL);
    494
    495 + clp->cl_flags = cl_init->init_flags;
    496 clp->cl_proto = cl_init->proto;
    497 clp->cl_net = get_net(cl_init->net);
    498
    499 @@ -400,7 +401,6 @@ nfs_get_client(const struct nfs_client_initdata *cl_init,
    500 list_add_tail(&new->cl_share_link,
    501 &nn->nfs_client_list);
    502 spin_unlock(&nn->nfs_client_lock);
    503 - new->cl_flags = cl_init->init_flags;
    504 return rpc_ops->init_client(new, cl_init);
    505 }
    506
    507 diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
    508 index 2fb4633897084..48baa92846e5f 100644
    509 --- a/fs/nfs/nfs4client.c
    510 +++ b/fs/nfs/nfs4client.c
    511 @@ -1329,8 +1329,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
    512 goto out;
    513 }
    514
    515 - if (server->nfs_client->cl_hostname == NULL)
    516 + if (server->nfs_client->cl_hostname == NULL) {
    517 server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);
    518 + if (server->nfs_client->cl_hostname == NULL)
    519 + return -ENOMEM;
    520 + }
    521 nfs_server_insert_lists(server);
    522
    523 error = nfs_probe_destination(server);
    524 diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
    525 index 4e63daeef6339..466c07bd06295 100644
    526 --- a/fs/nfs/nfs4state.c
    527 +++ b/fs/nfs/nfs4state.c
    528 @@ -1985,6 +1985,9 @@ static int nfs4_try_migration(struct nfs_server *server, struct rpc_cred *cred)
    529 }
    530
    531 result = -NFS4ERR_NXIO;
    532 + if (!locations->nlocations)
    533 + goto out;
    534 +
    535 if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
    536 dprintk("<-- %s: No fs_locations data, migration skipped\n",
    537 __func__);
    538 diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
    539 index 0a7c4e30a385e..b50c97c6aecb3 100644
    540 --- a/fs/nfs/nfs4xdr.c
    541 +++ b/fs/nfs/nfs4xdr.c
    542 @@ -3633,8 +3633,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
    543 if (unlikely(!p))
    544 goto out_overflow;
    545 n = be32_to_cpup(p);
    546 - if (n <= 0)
    547 - goto out_eio;
    548 for (res->nlocations = 0; res->nlocations < n; res->nlocations++) {
    549 u32 m;
    550 struct nfs4_fs_location *loc;
    551 @@ -4177,10 +4175,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
    552 } else
    553 printk(KERN_WARNING "%s: label too long (%u)!\n",
    554 __func__, len);
    555 + if (label && label->label)
    556 + dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n",
    557 + __func__, label->len, (char *)label->label,
    558 + label->len, label->pi, label->lfs);
    559 }
    560 - if (label && label->label)
    561 - dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
    562 - (char *)label->label, label->len, label->pi, label->lfs);
    563 return status;
    564
    565 out_overflow:
    566 diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
    567 index 00b472fe77c19..1bf2e1c47cbfd 100644
    568 --- a/fs/nfsd/nfs3proc.c
    569 +++ b/fs/nfsd/nfs3proc.c
    570 @@ -191,6 +191,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp,
    571 (unsigned long long) argp->offset,
    572 argp->stable? " stable" : "");
    573
    574 + resp->status = nfserr_fbig;
    575 + if (argp->offset > (u64)OFFSET_MAX ||
    576 + argp->offset + argp->len > (u64)OFFSET_MAX)
    577 + return rpc_success;
    578 +
    579 fh_copy(&resp->fh, &argp->fh);
    580 resp->committed = argp->stable;
    581 nfserr = nfsd_write(rqstp, &resp->fh, NULL,
    582 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    583 index 66985a6a7047b..d029decd87e3d 100644
    584 --- a/fs/nfsd/nfs4proc.c
    585 +++ b/fs/nfsd/nfs4proc.c
    586 @@ -982,8 +982,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
    587 unsigned long cnt;
    588 int nvecs;
    589
    590 - if (write->wr_offset >= OFFSET_MAX)
    591 - return nfserr_inval;
    592 + if (write->wr_offset > (u64)OFFSET_MAX ||
    593 + write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
    594 + return nfserr_fbig;
    595
    596 status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
    597 stateid, WR_STATE, &filp, NULL);
    598 diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
    599 index 5a23535a5018d..6a6f1d3bf8538 100644
    600 --- a/include/net/dst_metadata.h
    601 +++ b/include/net/dst_metadata.h
    602 @@ -97,8 +97,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
    603
    604 memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
    605 sizeof(struct ip_tunnel_info) + md_size);
    606 +#ifdef CONFIG_DST_CACHE
    607 + /* Unclone the dst cache if there is one */
    608 + if (new_md->u.tun_info.dst_cache.cache) {
    609 + int ret;
    610 +
    611 + ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC);
    612 + if (ret) {
    613 + metadata_dst_free(new_md);
    614 + return ERR_PTR(ret);
    615 + }
    616 + }
    617 +#endif
    618 +
    619 skb_dst_drop(skb);
    620 - dst_hold(&new_md->dst);
    621 skb_dst_set(skb, &new_md->dst);
    622 return new_md;
    623 }
    624 diff --git a/init/Kconfig b/init/Kconfig
    625 index 07570008e2fd9..7e09227b976fa 100644
    626 --- a/init/Kconfig
    627 +++ b/init/Kconfig
    628 @@ -1645,6 +1645,16 @@ config ADVISE_SYSCALLS
    629 applications use these syscalls, you can disable this option to save
    630 space.
    631
    632 +config BPF_UNPRIV_DEFAULT_OFF
    633 + bool "Disable unprivileged BPF by default"
    634 + depends on BPF_SYSCALL
    635 + help
    636 + Disables unprivileged BPF by default by setting the corresponding
    637 + /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
    638 + still reenable it by setting it to 0 later on, or permanently
    639 + disable it by setting it to 1 (from which no other transition to
    640 + 0 is possible anymore).
    641 +
    642 config USERFAULTFD
    643 bool "Enable userfaultfd() system call"
    644 select ANON_INODES
    645 diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
    646 index e10314223cbfe..e30ad1be68412 100644
    647 --- a/kernel/bpf/syscall.c
    648 +++ b/kernel/bpf/syscall.c
    649 @@ -22,7 +22,8 @@
    650
    651 DEFINE_PER_CPU(int, bpf_prog_active);
    652
    653 -int sysctl_unprivileged_bpf_disabled __read_mostly;
    654 +int sysctl_unprivileged_bpf_disabled __read_mostly =
    655 + IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
    656
    657 static LIST_HEAD(bpf_map_types);
    658
    659 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
    660 index 513e6da318c47..78b445562b81e 100644
    661 --- a/kernel/sysctl.c
    662 +++ b/kernel/sysctl.c
    663 @@ -221,6 +221,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write,
    664
    665 #endif
    666
    667 +#ifdef CONFIG_BPF_SYSCALL
    668 +static int bpf_unpriv_handler(struct ctl_table *table, int write,
    669 + void *buffer, size_t *lenp, loff_t *ppos)
    670 +{
    671 + int ret, unpriv_enable = *(int *)table->data;
    672 + bool locked_state = unpriv_enable == 1;
    673 + struct ctl_table tmp = *table;
    674 +
    675 + if (write && !capable(CAP_SYS_ADMIN))
    676 + return -EPERM;
    677 +
    678 + tmp.data = &unpriv_enable;
    679 + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
    680 + if (write && !ret) {
    681 + if (locked_state && unpriv_enable != 1)
    682 + return -EPERM;
    683 + *(int *)table->data = unpriv_enable;
    684 + }
    685 + return ret;
    686 +}
    687 +#endif
    688 +
    689 static struct ctl_table kern_table[];
    690 static struct ctl_table vm_table[];
    691 static struct ctl_table fs_table[];
    692 @@ -1202,10 +1224,9 @@ static struct ctl_table kern_table[] = {
    693 .data = &sysctl_unprivileged_bpf_disabled,
    694 .maxlen = sizeof(sysctl_unprivileged_bpf_disabled),
    695 .mode = 0644,
    696 - /* only handle a transition from default "0" to "1" */
    697 - .proc_handler = proc_dointvec_minmax,
    698 - .extra1 = &one,
    699 - .extra2 = &one,
    700 + .proc_handler = bpf_unpriv_handler,
    701 + .extra1 = &zero,
    702 + .extra2 = &two,
    703 },
    704 #endif
    705 #if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU)
    706 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
    707 index 354926e61f067..58c0ab8894c70 100644
    708 --- a/net/ipv4/ipmr.c
    709 +++ b/net/ipv4/ipmr.c
    710 @@ -242,7 +242,9 @@ static int __net_init ipmr_rules_init(struct net *net)
    711 return 0;
    712
    713 err2:
    714 + rtnl_lock();
    715 ipmr_free_table(mrt);
    716 + rtnl_unlock();
    717 err1:
    718 fib_rules_unregister(ops);
    719 return err;
    720 diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    721 index f38b22f54c093..3dce62ec37ed4 100644
    722 --- a/net/ipv6/ip6mr.c
    723 +++ b/net/ipv6/ip6mr.c
    724 @@ -251,7 +251,9 @@ static int __net_init ip6mr_rules_init(struct net *net)
    725 return 0;
    726
    727 err2:
    728 + rtnl_lock();
    729 ip6mr_free_table(mrt);
    730 + rtnl_unlock();
    731 err1:
    732 fib_rules_unregister(ops);
    733 return err;
    734 diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
    735 index 7ebcaff8c1c4f..963f607b34999 100644
    736 --- a/net/tipc/name_distr.c
    737 +++ b/net/tipc/name_distr.c
    738 @@ -288,7 +288,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
    739 return true;
    740 }
    741 } else {
    742 - pr_warn("Unrecognized name table message received\n");
    743 + pr_warn_ratelimited("Unknown name table message received\n");
    744 }
    745 return false;
    746 }
    747 diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    748 index 853a7d2333b3e..51d2fef7cd677 100644
    749 --- a/security/integrity/ima/ima_fs.c
    750 +++ b/security/integrity/ima/ima_fs.c
    751 @@ -477,11 +477,11 @@ int __init ima_fs_init(void)
    752
    753 return 0;
    754 out:
    755 + securityfs_remove(ima_policy);
    756 securityfs_remove(violations);
    757 securityfs_remove(runtime_measurements_count);
    758 securityfs_remove(ascii_runtime_measurements);
    759 securityfs_remove(binary_runtime_measurements);
    760 securityfs_remove(ima_dir);
    761 - securityfs_remove(ima_policy);
    762 return -1;
    763 }
    764 diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
    765 index 90987d15b6fe6..6c415667ba67f 100644
    766 --- a/security/integrity/integrity_audit.c
    767 +++ b/security/integrity/integrity_audit.c
    768 @@ -39,6 +39,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
    769 return;
    770
    771 ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
    772 + if (!ab)
    773 + return;
    774 audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
    775 task_pid_nr(current),
    776 from_kuid(&init_user_ns, current_cred()->uid),
    777 diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
    778 index 7133c36f99b6c..b3abc4cf7eb0a 100644
    779 --- a/sound/usb/line6/podhd.c
    780 +++ b/sound/usb/line6/podhd.c
    781 @@ -385,7 +385,7 @@ static const struct line6_properties podhd_properties_table[] = {
    782 .name = "POD HD500",
    783 .capabilities = LINE6_CAP_PCM
    784 | LINE6_CAP_HWMON,
    785 - .altsetting = 0,
    786 + .altsetting = 1,
    787 .ep_ctrl_r = 0x81,
    788 .ep_ctrl_w = 0x01,
    789 .ep_audio_r = 0x86,
    790 @@ -396,7 +396,7 @@ static const struct line6_properties podhd_properties_table[] = {
    791 .name = "POD HD500",
    792 .capabilities = LINE6_CAP_PCM
    793 | LINE6_CAP_HWMON,
    794 - .altsetting = 1,
    795 + .altsetting = 0,
    796 .ep_ctrl_r = 0x81,
    797 .ep_ctrl_w = 0x01,
    798 .ep_audio_r = 0x86,