Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0404-4.9.305-all-fixes.patch

    Annotation of /trunk/kernel-alx-legacy/patches-4.9/0404-4.9.305-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3706 - (hide annotations) (download)
    Mon Oct 24 14:08:19 2022 UTC (19 months, 4 weeks ago) by niro
    File size: 27097 byte(s) 
    -linux-4.9.305
    1 niro 3706 diff --git a/Makefile b/Makefile
    2     index bd2f7d437b439..308c848b01dc2 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 304
    9     +SUBLEVEL = 305
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
    14     index 7edc6c3f4bd91..a99e7ebcd004d 100644
    15     --- a/arch/arm/mm/mmu.c
    16     +++ b/arch/arm/mm/mmu.c
    17     @@ -228,12 +228,14 @@ early_param("ecc", early_ecc);
    18     static int __init early_cachepolicy(char *p)
    19     {
    20     pr_warn("cachepolicy kernel parameter not supported without cp15\n");
    21     + return 0;
    22     }
    23     early_param("cachepolicy", early_cachepolicy);
    24    
    25     static int __init noalign_setup(char *__unused)
    26     {
    27     pr_warn("noalign kernel parameter not supported without cp15\n");
    28     + return 1;
    29     }
    30     __setup("noalign", noalign_setup);
    31    
    32     diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
    33     index 821fc1f2324c8..44cc02afaa8bd 100644
    34     --- a/drivers/ata/pata_hpt37x.c
    35     +++ b/drivers/ata/pata_hpt37x.c
    36     @@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
    37    
    38     if ((freq >> 12) != 0xABCDE) {
    39     int i;
    40     - u8 sr;
    41     + u16 sr;
    42     u32 total = 0;
    43    
    44     pr_warn("BIOS has not set timing clocks\n");
    45    
    46     /* This is the process the HPT371 BIOS is reported to use */
    47     for (i = 0; i < 128; i++) {
    48     - pci_read_config_byte(dev, 0x78, &sr);
    49     + pci_read_config_word(dev, 0x78, &sr);
    50     total += sr & 0x1FF;
    51     udelay(15);
    52     }
    53     diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
    54     index 12fa48e380cf5..4f8dfe77da3c5 100644
    55     --- a/drivers/dma/sh/shdma-base.c
    56     +++ b/drivers/dma/sh/shdma-base.c
    57     @@ -118,8 +118,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
    58     ret = pm_runtime_get(schan->dev);
    59    
    60     spin_unlock_irq(&schan->chan_lock);
    61     - if (ret < 0)
    62     + if (ret < 0) {
    63     dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret);
    64     + pm_runtime_put(schan->dev);
    65     + }
    66    
    67     pm_runtime_barrier(schan->dev);
    68    
    69     diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
    70     index fceaafd67ec61..e619ced030d52 100644
    71     --- a/drivers/firmware/efi/vars.c
    72     +++ b/drivers/firmware/efi/vars.c
    73     @@ -763,6 +763,7 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
    74     {
    75     const struct efivar_operations *ops;
    76     efi_status_t status;
    77     + unsigned long varsize;
    78    
    79     if (!__efivars)
    80     return -EINVAL;
    81     @@ -785,15 +786,17 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
    82     return efivar_entry_set_nonblocking(name, vendor, attributes,
    83     size, data);
    84    
    85     + varsize = size + ucs2_strsize(name, 1024);
    86     if (!block) {
    87     if (down_trylock(&efivars_lock))
    88     return -EBUSY;
    89     + status = check_var_size_nonblocking(attributes, varsize);
    90     } else {
    91     if (down_interruptible(&efivars_lock))
    92     return -EINTR;
    93     + status = check_var_size(attributes, varsize);
    94     }
    95    
    96     - status = check_var_size(attributes, size + ucs2_strsize(name, 1024));
    97     if (status != EFI_SUCCESS) {
    98     up(&efivars_lock);
    99     return -ENOSPC;
    100     diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
    101     index 595bf12e76538..062d0eb50799b 100644
    102     --- a/drivers/firmware/qemu_fw_cfg.c
    103     +++ b/drivers/firmware/qemu_fw_cfg.c
    104     @@ -462,12 +462,12 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
    105     err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
    106     fw_cfg_sel_ko, "%d", entry->f.select);
    107     if (err)
    108     - goto err_register;
    109     + goto err_put_entry;
    110    
    111     /* add raw binary content access */
    112     err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
    113     if (err)
    114     - goto err_add_raw;
    115     + goto err_del_entry;
    116    
    117     /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */
    118     fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->f.name);
    119     @@ -476,10 +476,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
    120     fw_cfg_sysfs_cache_enlist(entry);
    121     return 0;
    122    
    123     -err_add_raw:
    124     +err_del_entry:
    125     kobject_del(&entry->kobj);
    126     -err_register:
    127     - kfree(entry);
    128     +err_put_entry:
    129     + kobject_put(&entry->kobj);
    130     return err;
    131     }
    132    
    133     diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
    134     index 3cafa1d28fedd..07dea71d41fc5 100644
    135     --- a/drivers/hid/hid-debug.c
    136     +++ b/drivers/hid/hid-debug.c
    137     @@ -833,7 +833,9 @@ static const char *keys[KEY_MAX + 1] = {
    138     [KEY_F22] = "F22", [KEY_F23] = "F23",
    139     [KEY_F24] = "F24", [KEY_PLAYCD] = "PlayCD",
    140     [KEY_PAUSECD] = "PauseCD", [KEY_PROG3] = "Prog3",
    141     - [KEY_PROG4] = "Prog4", [KEY_SUSPEND] = "Suspend",
    142     + [KEY_PROG4] = "Prog4",
    143     + [KEY_ALL_APPLICATIONS] = "AllApplications",
    144     + [KEY_SUSPEND] = "Suspend",
    145     [KEY_CLOSE] = "Close", [KEY_PLAY] = "Play",
    146     [KEY_FASTFORWARD] = "FastForward", [KEY_BASSBOOST] = "BassBoost",
    147     [KEY_PRINT] = "Print", [KEY_HP] = "HP",
    148     diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
    149     index 5e1a51ba6500f..1dccc072da4af 100644
    150     --- a/drivers/hid/hid-input.c
    151     +++ b/drivers/hid/hid-input.c
    152     @@ -937,6 +937,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
    153     case 0x28b: map_key_clear(KEY_FORWARDMAIL); break;
    154     case 0x28c: map_key_clear(KEY_SEND); break;
    155    
    156     + case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break;
    157     +
    158     case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break;
    159     case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break;
    160     case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break;
    161     diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
    162     index 759c621a860a9..be4b7b1ad39b6 100644
    163     --- a/drivers/i2c/busses/Kconfig
    164     +++ b/drivers/i2c/busses/Kconfig
    165     @@ -783,7 +783,7 @@ config I2C_PXA_SLAVE
    166    
    167     config I2C_QUP
    168     tristate "Qualcomm QUP based I2C controller"
    169     - depends on ARCH_QCOM
    170     + depends on ARCH_QCOM || COMPILE_TEST
    171     help
    172     If you say yes to this option, support will be included for the
    173     built-in I2C interface on the Qualcomm SoCs.
    174     diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
    175     index 7ed09865cb4b9..4729c14b75017 100644
    176     --- a/drivers/i2c/busses/i2c-bcm2835.c
    177     +++ b/drivers/i2c/busses/i2c-bcm2835.c
    178     @@ -28,6 +28,11 @@
    179     #define BCM2835_I2C_FIFO 0x10
    180     #define BCM2835_I2C_DIV 0x14
    181     #define BCM2835_I2C_DEL 0x18
    182     +/*
    183     + * 16-bit field for the number of SCL cycles to wait after rising SCL
    184     + * before deciding the slave is not responding. 0 disables the
    185     + * timeout detection.
    186     + */
    187     #define BCM2835_I2C_CLKT 0x1c
    188    
    189     #define BCM2835_I2C_C_READ BIT(0)
    190     @@ -313,6 +318,12 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
    191     adap->dev.of_node = pdev->dev.of_node;
    192     adap->quirks = &bcm2835_i2c_quirks;
    193    
    194     + /*
    195     + * Disable the hardware clock stretching timeout. SMBUS
    196     + * specifies a limit for how long the device can stretch the
    197     + * clock, but core I2C doesn't.
    198     + */
    199     + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0);
    200     bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
    201    
    202     ret = i2c_add_adapter(adap);
    203     diff --git a/drivers/input/input.c b/drivers/input/input.c
    204     index 5d94fc3fce0bb..cb31236425a11 100644
    205     --- a/drivers/input/input.c
    206     +++ b/drivers/input/input.c
    207     @@ -2112,6 +2112,12 @@ int input_register_device(struct input_dev *dev)
    208     /* KEY_RESERVED is not supposed to be transmitted to userspace. */
    209     __clear_bit(KEY_RESERVED, dev->keybit);
    210    
    211     + /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */
    212     + if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) {
    213     + __clear_bit(BTN_RIGHT, dev->keybit);
    214     + __clear_bit(BTN_MIDDLE, dev->keybit);
    215     + }
    216     +
    217     /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
    218     input_cleanse_bitmasks(dev);
    219    
    220     diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
    221     index 16f5d56600530..44015e6bd6a05 100644
    222     --- a/drivers/input/mouse/elan_i2c_core.c
    223     +++ b/drivers/input/mouse/elan_i2c_core.c
    224     @@ -132,55 +132,21 @@ static int elan_get_fwinfo(u8 iap_version, u16 *validpage_count,
    225     return 0;
    226     }
    227    
    228     -static int elan_enable_power(struct elan_tp_data *data)
    229     +static int elan_set_power(struct elan_tp_data *data, bool on)
    230     {
    231     int repeat = ETP_RETRY_COUNT;
    232     int error;
    233    
    234     - error = regulator_enable(data->vcc);
    235     - if (error) {
    236     - dev_err(&data->client->dev,
    237     - "failed to enable regulator: %d\n", error);
    238     - return error;
    239     - }
    240     -
    241     do {
    242     - error = data->ops->power_control(data->client, true);
    243     + error = data->ops->power_control(data->client, on);
    244     if (error >= 0)
    245     return 0;
    246    
    247     msleep(30);
    248     } while (--repeat > 0);
    249    
    250     - dev_err(&data->client->dev, "failed to enable power: %d\n", error);
    251     - return error;
    252     -}
    253     -
    254     -static int elan_disable_power(struct elan_tp_data *data)
    255     -{
    256     - int repeat = ETP_RETRY_COUNT;
    257     - int error;
    258     -
    259     - do {
    260     - error = data->ops->power_control(data->client, false);
    261     - if (!error) {
    262     - error = regulator_disable(data->vcc);
    263     - if (error) {
    264     - dev_err(&data->client->dev,
    265     - "failed to disable regulator: %d\n",
    266     - error);
    267     - /* Attempt to power the chip back up */
    268     - data->ops->power_control(data->client, true);
    269     - break;
    270     - }
    271     -
    272     - return 0;
    273     - }
    274     -
    275     - msleep(30);
    276     - } while (--repeat > 0);
    277     -
    278     - dev_err(&data->client->dev, "failed to disable power: %d\n", error);
    279     + dev_err(&data->client->dev, "failed to set power %s: %d\n",
    280     + on ? "on" : "off", error);
    281     return error;
    282     }
    283    
    284     @@ -1195,9 +1161,19 @@ static int __maybe_unused elan_suspend(struct device *dev)
    285     /* Enable wake from IRQ */
    286     data->irq_wake = (enable_irq_wake(client->irq) == 0);
    287     } else {
    288     - ret = elan_disable_power(data);
    289     + ret = elan_set_power(data, false);
    290     + if (ret)
    291     + goto err;
    292     +
    293     + ret = regulator_disable(data->vcc);
    294     + if (ret) {
    295     + dev_err(dev, "error %d disabling regulator\n", ret);
    296     + /* Attempt to power the chip back up */
    297     + elan_set_power(data, true);
    298     + }
    299     }
    300    
    301     +err:
    302     mutex_unlock(&data->sysfs_mutex);
    303     return ret;
    304     }
    305     @@ -1208,12 +1184,18 @@ static int __maybe_unused elan_resume(struct device *dev)
    306     struct elan_tp_data *data = i2c_get_clientdata(client);
    307     int error;
    308    
    309     - if (device_may_wakeup(dev) && data->irq_wake) {
    310     + if (!device_may_wakeup(dev)) {
    311     + error = regulator_enable(data->vcc);
    312     + if (error) {
    313     + dev_err(dev, "error %d enabling regulator\n", error);
    314     + goto err;
    315     + }
    316     + } else if (data->irq_wake) {
    317     disable_irq_wake(client->irq);
    318     data->irq_wake = false;
    319     }
    320    
    321     - error = elan_enable_power(data);
    322     + error = elan_set_power(data, true);
    323     if (error) {
    324     dev_err(dev, "power up when resuming failed: %d\n", error);
    325     goto err;
    326     diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
    327     index 239de38fbd6a5..1c9fff038569d 100644
    328     --- a/drivers/net/arcnet/com20020-pci.c
    329     +++ b/drivers/net/arcnet/com20020-pci.c
    330     @@ -115,6 +115,9 @@ static int com20020pci_probe(struct pci_dev *pdev,
    331     return -ENOMEM;
    332    
    333     ci = (struct com20020_pci_card_info *)id->driver_data;
    334     + if (!ci)
    335     + return -EINVAL;
    336     +
    337     priv->ci = ci;
    338     mm = &ci->misc_map;
    339    
    340     diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
    341     index 75399aa1ba951..6771c51f72c37 100644
    342     --- a/drivers/net/can/usb/gs_usb.c
    343     +++ b/drivers/net/can/usb/gs_usb.c
    344     @@ -198,8 +198,8 @@ struct gs_can {
    345     struct gs_usb {
    346     struct gs_can *canch[GS_MAX_INTF];
    347     struct usb_anchor rx_submitted;
    348     - atomic_t active_channels;
    349     struct usb_device *udev;
    350     + u8 active_channels;
    351     };
    352    
    353     /* 'allocate' a tx context.
    354     @@ -597,7 +597,7 @@ static int gs_can_open(struct net_device *netdev)
    355     if (rc)
    356     return rc;
    357    
    358     - if (atomic_add_return(1, &parent->active_channels) == 1) {
    359     + if (!parent->active_channels) {
    360     for (i = 0; i < GS_MAX_RX_URBS; i++) {
    361     struct urb *urb;
    362     u8 *buf;
    363     @@ -698,6 +698,7 @@ static int gs_can_open(struct net_device *netdev)
    364    
    365     dev->can.state = CAN_STATE_ERROR_ACTIVE;
    366    
    367     + parent->active_channels++;
    368     if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
    369     netif_start_queue(netdev);
    370    
    371     @@ -713,7 +714,8 @@ static int gs_can_close(struct net_device *netdev)
    372     netif_stop_queue(netdev);
    373    
    374     /* Stop polling */
    375     - if (atomic_dec_and_test(&parent->active_channels))
    376     + parent->active_channels--;
    377     + if (!parent->active_channels)
    378     usb_kill_anchored_urbs(&parent->rx_submitted);
    379    
    380     /* Stop sending URBs */
    381     @@ -992,8 +994,6 @@ static int gs_usb_probe(struct usb_interface *intf,
    382    
    383     init_usb_anchor(&dev->rx_submitted);
    384    
    385     - atomic_set(&dev->active_channels, 0);
    386     -
    387     usb_set_intfdata(intf, dev);
    388     dev->udev = interface_to_usbdev(intf);
    389    
    390     diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    391     index a89721fad633e..29220141e4e46 100644
    392     --- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    393     +++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    394     @@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
    395     MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10);
    396     adapter->params.pci.vpd_cap_addr =
    397     pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD);
    398     + if (!adapter->params.pci.vpd_cap_addr)
    399     + return -ENODEV;
    400     ret = get_vpd_params(adapter, &adapter->params.vpd);
    401     if (ret < 0)
    402     return ret;
    403     diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    404     index 11dd7c8d576d6..ab1d01dd2eb3a 100644
    405     --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    406     +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    407     @@ -2311,18 +2311,18 @@ static int __init sxgbe_cmdline_opt(char *str)
    408     char *opt;
    409    
    410     if (!str || !*str)
    411     - return -EINVAL;
    412     + return 1;
    413     while ((opt = strsep(&str, ",")) != NULL) {
    414     if (!strncmp(opt, "eee_timer:", 10)) {
    415     if (kstrtoint(opt + 10, 0, &eee_timer))
    416     goto err;
    417     }
    418     }
    419     - return 0;
    420     + return 1;
    421    
    422     err:
    423     pr_err("%s: ERROR broken module parameter conversion\n", __func__);
    424     - return -EINVAL;
    425     + return 1;
    426     }
    427    
    428     __setup("sxgbeeth=", sxgbe_cmdline_opt);
    429     diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    430     index 0a7ff854d1c34..bb44f8161ea94 100644
    431     --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    432     +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    433     @@ -3608,7 +3608,7 @@ static int __init stmmac_cmdline_opt(char *str)
    434     char *opt;
    435    
    436     if (!str || !*str)
    437     - return -EINVAL;
    438     + return 1;
    439     while ((opt = strsep(&str, ",")) != NULL) {
    440     if (!strncmp(opt, "debug:", 6)) {
    441     if (kstrtoint(opt + 6, 0, &debug))
    442     @@ -3639,11 +3639,11 @@ static int __init stmmac_cmdline_opt(char *str)
    443     goto err;
    444     }
    445     }
    446     - return 0;
    447     + return 1;
    448    
    449     err:
    450     pr_err("%s: ERROR broken module parameter conversion", __func__);
    451     - return -EINVAL;
    452     + return 1;
    453     }
    454    
    455     __setup("stmmaceth=", stmmac_cmdline_opt);
    456     diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    457     index 8d85cedb4bf5b..cbf959e7bbff7 100644
    458     --- a/drivers/net/hamradio/mkiss.c
    459     +++ b/drivers/net/hamradio/mkiss.c
    460     @@ -41,6 +41,8 @@
    461    
    462     #define AX_MTU 236
    463    
    464     +/* some arch define END as assembly function ending, just undef it */
    465     +#undef END
    466     /* SLIP/KISS protocol characters. */
    467     #define END 0300 /* indicates end of frame */
    468     #define ESC 0333 /* indicates byte stuffing */
    469     diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
    470     index d86132d41416d..95256765b3887 100644
    471     --- a/drivers/net/usb/cdc_mbim.c
    472     +++ b/drivers/net/usb/cdc_mbim.c
    473     @@ -652,6 +652,11 @@ static const struct usb_device_id mbim_devs[] = {
    474     .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
    475     },
    476    
    477     + /* Telit FN990 */
    478     + { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
    479     + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
    480     + },
    481     +
    482     /* default entry */
    483     { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
    484     .driver_info = (unsigned long)&cdc_mbim_info_zlp,
    485     diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    486     index dd6924d21b8a1..a34647efb5ea5 100644
    487     --- a/drivers/net/wireless/mac80211_hwsim.c
    488     +++ b/drivers/net/wireless/mac80211_hwsim.c
    489     @@ -1987,6 +1987,15 @@ static void hw_scan_work(struct work_struct *work)
    490     memcpy(skb_put(probe, req->ie_len), req->ie,
    491     req->ie_len);
    492    
    493     + if (!ieee80211_tx_prepare_skb(hwsim->hw,
    494     + hwsim->hw_scan_vif,
    495     + probe,
    496     + hwsim->tmp_chan->band,
    497     + NULL)) {
    498     + kfree_skb(probe);
    499     + continue;
    500     + }
    501     +
    502     local_bh_disable();
    503     mac80211_hwsim_tx_frame(hwsim->hw, probe,
    504     hwsim->tmp_chan);
    505     @@ -2919,6 +2928,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
    506     }
    507     txi->flags |= IEEE80211_TX_STAT_ACK;
    508     }
    509     +
    510     + if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
    511     + txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
    512     +
    513     ieee80211_tx_status_irqsafe(data2->hw, skb);
    514     return 0;
    515     out:
    516     diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c
    517     index 7ae59abc78637..127a4a836e675 100644
    518     --- a/drivers/soc/fsl/qe/qe_io.c
    519     +++ b/drivers/soc/fsl/qe/qe_io.c
    520     @@ -41,6 +41,8 @@ int par_io_init(struct device_node *np)
    521     if (ret)
    522     return ret;
    523     par_io = ioremap(res.start, resource_size(&res));
    524     + if (!par_io)
    525     + return -ENOMEM;
    526    
    527     num_ports = of_get_property(np, "num-ports", NULL);
    528     if (num_ports)
    529     diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    530     index 19eb954a7afa3..2b30b5a1b577e 100644
    531     --- a/drivers/usb/gadget/legacy/inode.c
    532     +++ b/drivers/usb/gadget/legacy/inode.c
    533     @@ -1833,8 +1833,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    534     spin_lock_irq (&dev->lock);
    535     value = -EINVAL;
    536     if (dev->buf) {
    537     + spin_unlock_irq(&dev->lock);
    538     kfree(kbuf);
    539     - goto fail;
    540     + return value;
    541     }
    542     dev->buf = kbuf;
    543    
    544     @@ -1882,8 +1883,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    545    
    546     value = usb_gadget_probe_driver(&gadgetfs_driver);
    547     if (value != 0) {
    548     - kfree (dev->buf);
    549     - dev->buf = NULL;
    550     + spin_lock_irq(&dev->lock);
    551     + goto fail;
    552     } else {
    553     /* at this point "good" hardware has for the first time
    554     * let the USB the host see us. alternatively, if users
    555     @@ -1900,6 +1901,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    556     return value;
    557    
    558     fail:
    559     + dev->config = NULL;
    560     + dev->hs_config = NULL;
    561     + dev->dev = NULL;
    562     spin_unlock_irq (&dev->lock);
    563     pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev);
    564     kfree (dev->buf);
    565     diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
    566     index 375ccd209206a..95e4f074b7665 100644
    567     --- a/fs/cifs/cifsfs.c
    568     +++ b/fs/cifs/cifsfs.c
    569     @@ -746,6 +746,7 @@ cifs_do_mount(struct file_system_type *fs_type,
    570    
    571     out_super:
    572     deactivate_locked_super(sb);
    573     + return root;
    574     out:
    575     cifs_cleanup_volume_info(volume_info);
    576     return root;
    577     diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
    578     index 2280cfe86c561..faa535defddd0 100644
    579     --- a/include/net/netfilter/nf_queue.h
    580     +++ b/include/net/netfilter/nf_queue.h
    581     @@ -31,7 +31,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q
    582     void nf_unregister_queue_handler(struct net *net);
    583     void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
    584    
    585     -void nf_queue_entry_get_refs(struct nf_queue_entry *entry);
    586     +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);
    587     void nf_queue_entry_release_refs(struct nf_queue_entry *entry);
    588    
    589     static inline void init_hashrandom(u32 *jhash_initval)
    590     diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
    591     index b584868e1b26b..fd7cacbfc8c2c 100644
    592     --- a/include/uapi/linux/input-event-codes.h
    593     +++ b/include/uapi/linux/input-event-codes.h
    594     @@ -277,7 +277,8 @@
    595     #define KEY_PAUSECD 201
    596     #define KEY_PROG3 202
    597     #define KEY_PROG4 203
    598     -#define KEY_DASHBOARD 204 /* AL Dashboard */
    599     +#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */
    600     +#define KEY_DASHBOARD KEY_ALL_APPLICATIONS
    601     #define KEY_SUSPEND 205
    602     #define KEY_CLOSE 206 /* AC Close */
    603     #define KEY_PLAY 207
    604     diff --git a/mm/shmem.c b/mm/shmem.c
    605     index 51aa13f596220..dffa36e6d1c45 100644
    606     --- a/mm/shmem.c
    607     +++ b/mm/shmem.c
    608     @@ -2478,7 +2478,8 @@ static void shmem_tag_pins(struct address_space *mapping)
    609     slot = radix_tree_iter_retry(&iter);
    610     continue;
    611     }
    612     - } else if (page_count(page) - page_mapcount(page) > 1) {
    613     + } else if (!PageTail(page) && page_count(page) !=
    614     + hpage_nr_pages(page) + total_mapcount(page)) {
    615     radix_tree_tag_set(&mapping->page_tree, iter.index,
    616     SHMEM_TAG_PINNED);
    617     }
    618     @@ -2538,8 +2539,8 @@ static int shmem_wait_for_pins(struct address_space *mapping)
    619     page = NULL;
    620     }
    621    
    622     - if (page &&
    623     - page_count(page) - page_mapcount(page) != 1) {
    624     + if (page && page_count(page) !=
    625     + hpage_nr_pages(page) + total_mapcount(page)) {
    626     if (scan < LAST_SCAN)
    627     goto continue_resched;
    628    
    629     diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
    630     index 2dbf5a0faad32..e32a520c3702b 100644
    631     --- a/net/dcb/dcbnl.c
    632     +++ b/net/dcb/dcbnl.c
    633     @@ -1938,10 +1938,54 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
    634     }
    635     EXPORT_SYMBOL(dcb_ieee_delapp);
    636    
    637     +static void dcbnl_flush_dev(struct net_device *dev)
    638     +{
    639     + struct dcb_app_type *itr, *tmp;
    640     +
    641     + spin_lock_bh(&dcb_lock);
    642     +
    643     + list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) {
    644     + if (itr->ifindex == dev->ifindex) {
    645     + list_del(&itr->list);
    646     + kfree(itr);
    647     + }
    648     + }
    649     +
    650     + spin_unlock_bh(&dcb_lock);
    651     +}
    652     +
    653     +static int dcbnl_netdevice_event(struct notifier_block *nb,
    654     + unsigned long event, void *ptr)
    655     +{
    656     + struct net_device *dev = netdev_notifier_info_to_dev(ptr);
    657     +
    658     + switch (event) {
    659     + case NETDEV_UNREGISTER:
    660     + if (!dev->dcbnl_ops)
    661     + return NOTIFY_DONE;
    662     +
    663     + dcbnl_flush_dev(dev);
    664     +
    665     + return NOTIFY_OK;
    666     + default:
    667     + return NOTIFY_DONE;
    668     + }
    669     +}
    670     +
    671     +static struct notifier_block dcbnl_nb __read_mostly = {
    672     + .notifier_call = dcbnl_netdevice_event,
    673     +};
    674     +
    675     static int __init dcbnl_init(void)
    676     {
    677     + int err;
    678     +
    679     INIT_LIST_HEAD(&dcb_app_list);
    680    
    681     + err = register_netdevice_notifier(&dcbnl_nb);
    682     + if (err)
    683     + return err;
    684     +
    685     rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, NULL);
    686     rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, NULL);
    687    
    688     diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    689     index d93a98dfe52df..55be18cae35ba 100644
    690     --- a/net/ipv6/ip6_output.c
    691     +++ b/net/ipv6/ip6_output.c
    692     @@ -1274,8 +1274,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
    693     if (np->frag_size)
    694     mtu = np->frag_size;
    695     }
    696     - if (mtu < IPV6_MIN_MTU)
    697     - return -EINVAL;
    698     cork->base.fragsize = mtu;
    699     if (dst_allfrag(rt->dst.path))
    700     cork->base.flags |= IPCORK_ALLFRAG;
    701     @@ -1324,8 +1322,6 @@ static int __ip6_append_data(struct sock *sk,
    702    
    703     fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
    704     (opt ? opt->opt_nflen : 0);
    705     - maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
    706     - sizeof(struct frag_hdr);
    707    
    708     headersize = sizeof(struct ipv6hdr) +
    709     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
    710     @@ -1333,6 +1329,13 @@ static int __ip6_append_data(struct sock *sk,
    711     sizeof(struct frag_hdr) : 0) +
    712     rt->rt6i_nfheader_len;
    713    
    714     + if (mtu < fragheaderlen ||
    715     + ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
    716     + goto emsgsize;
    717     +
    718     + maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
    719     + sizeof(struct frag_hdr);
    720     +
    721     /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
    722     * the first fragment
    723     */
    724     diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    725     index 3dc370ad23bf6..41af02a70742e 100644
    726     --- a/net/mac80211/rx.c
    727     +++ b/net/mac80211/rx.c
    728     @@ -2607,13 +2607,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
    729     ether_addr_equal(sdata->vif.addr, hdr->addr3))
    730     return RX_CONTINUE;
    731    
    732     - ac = ieee80211_select_queue_80211(sdata, skb, hdr);
    733     + ac = ieee802_1d_to_ac[skb->priority];
    734     q = sdata->vif.hw_queue[ac];
    735     if (ieee80211_queue_stopped(&local->hw, q)) {
    736     IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
    737     return RX_DROP_MONITOR;
    738     }
    739     - skb_set_queue_mapping(skb, q);
    740     + skb_set_queue_mapping(skb, ac);
    741    
    742     if (!--mesh_hdr->ttl) {
    743     if (!is_multicast_ether_addr(hdr->addr1))
    744     diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
    745     index 8f08d759844a9..333ea23681017 100644
    746     --- a/net/netfilter/nf_queue.c
    747     +++ b/net/netfilter/nf_queue.c
    748     @@ -44,6 +44,15 @@ void nf_unregister_queue_handler(struct net *net)
    749     }
    750     EXPORT_SYMBOL(nf_unregister_queue_handler);
    751    
    752     +static void nf_queue_sock_put(struct sock *sk)
    753     +{
    754     +#ifdef CONFIG_INET
    755     + sock_gen_put(sk);
    756     +#else
    757     + sock_put(sk);
    758     +#endif
    759     +}
    760     +
    761     void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    762     {
    763     struct nf_hook_state *state = &entry->state;
    764     @@ -54,7 +63,7 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    765     if (state->out)
    766     dev_put(state->out);
    767     if (state->sk)
    768     - sock_put(state->sk);
    769     + nf_queue_sock_put(state->sk);
    770     #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
    771     if (entry->skb->nf_bridge) {
    772     struct net_device *physdev;
    773     @@ -71,10 +80,13 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    774     EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
    775    
    776     /* Bump dev refs so they don't vanish while packet is out */
    777     -void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    778     +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    779     {
    780     struct nf_hook_state *state = &entry->state;
    781    
    782     + if (state->sk && !atomic_inc_not_zero(&state->sk->sk_refcnt))
    783     + return false;
    784     +
    785     if (state->in)
    786     dev_hold(state->in);
    787     if (state->out)
    788     @@ -93,6 +105,7 @@ void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    789     dev_hold(physdev);
    790     }
    791     #endif
    792     + return true;
    793     }
    794     EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
    795    
    796     @@ -139,7 +152,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
    797     .size = sizeof(*entry) + afinfo->route_key_size,
    798     };
    799    
    800     - nf_queue_entry_get_refs(entry);
    801     + if (!nf_queue_entry_get_refs(entry)) {
    802     + kfree(entry);
    803     + return -ENOTCONN;
    804     + }
    805     +
    806     skb_dst_force(skb);
    807     afinfo->saveroute(skb, entry);
    808     status = qh->outfn(entry, queuenum);
    809     diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    810     index a35510565d4d1..66814a9d030cc 100644
    811     --- a/net/netfilter/nfnetlink_queue.c
    812     +++ b/net/netfilter/nfnetlink_queue.c
    813     @@ -673,9 +673,15 @@ static struct nf_queue_entry *
    814     nf_queue_entry_dup(struct nf_queue_entry *e)
    815     {
    816     struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
    817     - if (entry)
    818     - nf_queue_entry_get_refs(entry);
    819     - return entry;
    820     +
    821     + if (!entry)
    822     + return NULL;
    823     +
    824     + if (nf_queue_entry_get_refs(entry))
    825     + return entry;
    826     +
    827     + kfree(entry);
    828     + return NULL;
    829     }
    830    
    831     #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
    832     diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
    833     index e2c200c3c1353..74968ddee49fa 100644
    834     --- a/sound/soc/soc-ops.c
    835     +++ b/sound/soc/soc-ops.c
    836     @@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
    837     mask = BIT(sign_bit + 1) - 1;
    838    
    839     val = ucontrol->value.integer.value[0];
    840     - if (mc->platform_max && val > mc->platform_max)
    841     + if (mc->platform_max && ((int)val + min) > mc->platform_max)
    842     return -EINVAL;
    843     if (val > max - min)
    844     return -EINVAL;
    845     @@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
    846     val = val << shift;
    847     if (snd_soc_volsw_is_stereo(mc)) {
    848     val2 = ucontrol->value.integer.value[1];
    849     - if (mc->platform_max && val2 > mc->platform_max)
    850     + if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
    851     return -EINVAL;
    852     if (val2 > max - min)
    853     return -EINVAL;