Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0404-4.9.305-all-fixes.patch

    Contents of /trunk/kernel-alx-legacy/patches-4.9/0404-4.9.305-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3706 - (show annotations) (download)
    Mon Oct 24 14:08:19 2022 UTC (18 months, 3 weeks ago) by niro
    File size: 27097 byte(s) 
    -linux-4.9.305
    1 diff --git a/Makefile b/Makefile
    2 index bd2f7d437b439..308c848b01dc2 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 304
    9 +SUBLEVEL = 305
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
    14 index 7edc6c3f4bd91..a99e7ebcd004d 100644
    15 --- a/arch/arm/mm/mmu.c
    16 +++ b/arch/arm/mm/mmu.c
    17 @@ -228,12 +228,14 @@ early_param("ecc", early_ecc);
    18 static int __init early_cachepolicy(char *p)
    19 {
    20 pr_warn("cachepolicy kernel parameter not supported without cp15\n");
    21 + return 0;
    22 }
    23 early_param("cachepolicy", early_cachepolicy);
    24
    25 static int __init noalign_setup(char *__unused)
    26 {
    27 pr_warn("noalign kernel parameter not supported without cp15\n");
    28 + return 1;
    29 }
    30 __setup("noalign", noalign_setup);
    31
    32 diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
    33 index 821fc1f2324c8..44cc02afaa8bd 100644
    34 --- a/drivers/ata/pata_hpt37x.c
    35 +++ b/drivers/ata/pata_hpt37x.c
    36 @@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
    37
    38 if ((freq >> 12) != 0xABCDE) {
    39 int i;
    40 - u8 sr;
    41 + u16 sr;
    42 u32 total = 0;
    43
    44 pr_warn("BIOS has not set timing clocks\n");
    45
    46 /* This is the process the HPT371 BIOS is reported to use */
    47 for (i = 0; i < 128; i++) {
    48 - pci_read_config_byte(dev, 0x78, &sr);
    49 + pci_read_config_word(dev, 0x78, &sr);
    50 total += sr & 0x1FF;
    51 udelay(15);
    52 }
    53 diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
    54 index 12fa48e380cf5..4f8dfe77da3c5 100644
    55 --- a/drivers/dma/sh/shdma-base.c
    56 +++ b/drivers/dma/sh/shdma-base.c
    57 @@ -118,8 +118,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
    58 ret = pm_runtime_get(schan->dev);
    59
    60 spin_unlock_irq(&schan->chan_lock);
    61 - if (ret < 0)
    62 + if (ret < 0) {
    63 dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret);
    64 + pm_runtime_put(schan->dev);
    65 + }
    66
    67 pm_runtime_barrier(schan->dev);
    68
    69 diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
    70 index fceaafd67ec61..e619ced030d52 100644
    71 --- a/drivers/firmware/efi/vars.c
    72 +++ b/drivers/firmware/efi/vars.c
    73 @@ -763,6 +763,7 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
    74 {
    75 const struct efivar_operations *ops;
    76 efi_status_t status;
    77 + unsigned long varsize;
    78
    79 if (!__efivars)
    80 return -EINVAL;
    81 @@ -785,15 +786,17 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
    82 return efivar_entry_set_nonblocking(name, vendor, attributes,
    83 size, data);
    84
    85 + varsize = size + ucs2_strsize(name, 1024);
    86 if (!block) {
    87 if (down_trylock(&efivars_lock))
    88 return -EBUSY;
    89 + status = check_var_size_nonblocking(attributes, varsize);
    90 } else {
    91 if (down_interruptible(&efivars_lock))
    92 return -EINTR;
    93 + status = check_var_size(attributes, varsize);
    94 }
    95
    96 - status = check_var_size(attributes, size + ucs2_strsize(name, 1024));
    97 if (status != EFI_SUCCESS) {
    98 up(&efivars_lock);
    99 return -ENOSPC;
    100 diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
    101 index 595bf12e76538..062d0eb50799b 100644
    102 --- a/drivers/firmware/qemu_fw_cfg.c
    103 +++ b/drivers/firmware/qemu_fw_cfg.c
    104 @@ -462,12 +462,12 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
    105 err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
    106 fw_cfg_sel_ko, "%d", entry->f.select);
    107 if (err)
    108 - goto err_register;
    109 + goto err_put_entry;
    110
    111 /* add raw binary content access */
    112 err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
    113 if (err)
    114 - goto err_add_raw;
    115 + goto err_del_entry;
    116
    117 /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */
    118 fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->f.name);
    119 @@ -476,10 +476,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
    120 fw_cfg_sysfs_cache_enlist(entry);
    121 return 0;
    122
    123 -err_add_raw:
    124 +err_del_entry:
    125 kobject_del(&entry->kobj);
    126 -err_register:
    127 - kfree(entry);
    128 +err_put_entry:
    129 + kobject_put(&entry->kobj);
    130 return err;
    131 }
    132
    133 diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
    134 index 3cafa1d28fedd..07dea71d41fc5 100644
    135 --- a/drivers/hid/hid-debug.c
    136 +++ b/drivers/hid/hid-debug.c
    137 @@ -833,7 +833,9 @@ static const char *keys[KEY_MAX + 1] = {
    138 [KEY_F22] = "F22", [KEY_F23] = "F23",
    139 [KEY_F24] = "F24", [KEY_PLAYCD] = "PlayCD",
    140 [KEY_PAUSECD] = "PauseCD", [KEY_PROG3] = "Prog3",
    141 - [KEY_PROG4] = "Prog4", [KEY_SUSPEND] = "Suspend",
    142 + [KEY_PROG4] = "Prog4",
    143 + [KEY_ALL_APPLICATIONS] = "AllApplications",
    144 + [KEY_SUSPEND] = "Suspend",
    145 [KEY_CLOSE] = "Close", [KEY_PLAY] = "Play",
    146 [KEY_FASTFORWARD] = "FastForward", [KEY_BASSBOOST] = "BassBoost",
    147 [KEY_PRINT] = "Print", [KEY_HP] = "HP",
    148 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
    149 index 5e1a51ba6500f..1dccc072da4af 100644
    150 --- a/drivers/hid/hid-input.c
    151 +++ b/drivers/hid/hid-input.c
    152 @@ -937,6 +937,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
    153 case 0x28b: map_key_clear(KEY_FORWARDMAIL); break;
    154 case 0x28c: map_key_clear(KEY_SEND); break;
    155
    156 + case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break;
    157 +
    158 case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break;
    159 case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break;
    160 case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break;
    161 diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
    162 index 759c621a860a9..be4b7b1ad39b6 100644
    163 --- a/drivers/i2c/busses/Kconfig
    164 +++ b/drivers/i2c/busses/Kconfig
    165 @@ -783,7 +783,7 @@ config I2C_PXA_SLAVE
    166
    167 config I2C_QUP
    168 tristate "Qualcomm QUP based I2C controller"
    169 - depends on ARCH_QCOM
    170 + depends on ARCH_QCOM || COMPILE_TEST
    171 help
    172 If you say yes to this option, support will be included for the
    173 built-in I2C interface on the Qualcomm SoCs.
    174 diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
    175 index 7ed09865cb4b9..4729c14b75017 100644
    176 --- a/drivers/i2c/busses/i2c-bcm2835.c
    177 +++ b/drivers/i2c/busses/i2c-bcm2835.c
    178 @@ -28,6 +28,11 @@
    179 #define BCM2835_I2C_FIFO 0x10
    180 #define BCM2835_I2C_DIV 0x14
    181 #define BCM2835_I2C_DEL 0x18
    182 +/*
    183 + * 16-bit field for the number of SCL cycles to wait after rising SCL
    184 + * before deciding the slave is not responding. 0 disables the
    185 + * timeout detection.
    186 + */
    187 #define BCM2835_I2C_CLKT 0x1c
    188
    189 #define BCM2835_I2C_C_READ BIT(0)
    190 @@ -313,6 +318,12 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
    191 adap->dev.of_node = pdev->dev.of_node;
    192 adap->quirks = &bcm2835_i2c_quirks;
    193
    194 + /*
    195 + * Disable the hardware clock stretching timeout. SMBUS
    196 + * specifies a limit for how long the device can stretch the
    197 + * clock, but core I2C doesn't.
    198 + */
    199 + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0);
    200 bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
    201
    202 ret = i2c_add_adapter(adap);
    203 diff --git a/drivers/input/input.c b/drivers/input/input.c
    204 index 5d94fc3fce0bb..cb31236425a11 100644
    205 --- a/drivers/input/input.c
    206 +++ b/drivers/input/input.c
    207 @@ -2112,6 +2112,12 @@ int input_register_device(struct input_dev *dev)
    208 /* KEY_RESERVED is not supposed to be transmitted to userspace. */
    209 __clear_bit(KEY_RESERVED, dev->keybit);
    210
    211 + /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */
    212 + if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) {
    213 + __clear_bit(BTN_RIGHT, dev->keybit);
    214 + __clear_bit(BTN_MIDDLE, dev->keybit);
    215 + }
    216 +
    217 /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
    218 input_cleanse_bitmasks(dev);
    219
    220 diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
    221 index 16f5d56600530..44015e6bd6a05 100644
    222 --- a/drivers/input/mouse/elan_i2c_core.c
    223 +++ b/drivers/input/mouse/elan_i2c_core.c
    224 @@ -132,55 +132,21 @@ static int elan_get_fwinfo(u8 iap_version, u16 *validpage_count,
    225 return 0;
    226 }
    227
    228 -static int elan_enable_power(struct elan_tp_data *data)
    229 +static int elan_set_power(struct elan_tp_data *data, bool on)
    230 {
    231 int repeat = ETP_RETRY_COUNT;
    232 int error;
    233
    234 - error = regulator_enable(data->vcc);
    235 - if (error) {
    236 - dev_err(&data->client->dev,
    237 - "failed to enable regulator: %d\n", error);
    238 - return error;
    239 - }
    240 -
    241 do {
    242 - error = data->ops->power_control(data->client, true);
    243 + error = data->ops->power_control(data->client, on);
    244 if (error >= 0)
    245 return 0;
    246
    247 msleep(30);
    248 } while (--repeat > 0);
    249
    250 - dev_err(&data->client->dev, "failed to enable power: %d\n", error);
    251 - return error;
    252 -}
    253 -
    254 -static int elan_disable_power(struct elan_tp_data *data)
    255 -{
    256 - int repeat = ETP_RETRY_COUNT;
    257 - int error;
    258 -
    259 - do {
    260 - error = data->ops->power_control(data->client, false);
    261 - if (!error) {
    262 - error = regulator_disable(data->vcc);
    263 - if (error) {
    264 - dev_err(&data->client->dev,
    265 - "failed to disable regulator: %d\n",
    266 - error);
    267 - /* Attempt to power the chip back up */
    268 - data->ops->power_control(data->client, true);
    269 - break;
    270 - }
    271 -
    272 - return 0;
    273 - }
    274 -
    275 - msleep(30);
    276 - } while (--repeat > 0);
    277 -
    278 - dev_err(&data->client->dev, "failed to disable power: %d\n", error);
    279 + dev_err(&data->client->dev, "failed to set power %s: %d\n",
    280 + on ? "on" : "off", error);
    281 return error;
    282 }
    283
    284 @@ -1195,9 +1161,19 @@ static int __maybe_unused elan_suspend(struct device *dev)
    285 /* Enable wake from IRQ */
    286 data->irq_wake = (enable_irq_wake(client->irq) == 0);
    287 } else {
    288 - ret = elan_disable_power(data);
    289 + ret = elan_set_power(data, false);
    290 + if (ret)
    291 + goto err;
    292 +
    293 + ret = regulator_disable(data->vcc);
    294 + if (ret) {
    295 + dev_err(dev, "error %d disabling regulator\n", ret);
    296 + /* Attempt to power the chip back up */
    297 + elan_set_power(data, true);
    298 + }
    299 }
    300
    301 +err:
    302 mutex_unlock(&data->sysfs_mutex);
    303 return ret;
    304 }
    305 @@ -1208,12 +1184,18 @@ static int __maybe_unused elan_resume(struct device *dev)
    306 struct elan_tp_data *data = i2c_get_clientdata(client);
    307 int error;
    308
    309 - if (device_may_wakeup(dev) && data->irq_wake) {
    310 + if (!device_may_wakeup(dev)) {
    311 + error = regulator_enable(data->vcc);
    312 + if (error) {
    313 + dev_err(dev, "error %d enabling regulator\n", error);
    314 + goto err;
    315 + }
    316 + } else if (data->irq_wake) {
    317 disable_irq_wake(client->irq);
    318 data->irq_wake = false;
    319 }
    320
    321 - error = elan_enable_power(data);
    322 + error = elan_set_power(data, true);
    323 if (error) {
    324 dev_err(dev, "power up when resuming failed: %d\n", error);
    325 goto err;
    326 diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
    327 index 239de38fbd6a5..1c9fff038569d 100644
    328 --- a/drivers/net/arcnet/com20020-pci.c
    329 +++ b/drivers/net/arcnet/com20020-pci.c
    330 @@ -115,6 +115,9 @@ static int com20020pci_probe(struct pci_dev *pdev,
    331 return -ENOMEM;
    332
    333 ci = (struct com20020_pci_card_info *)id->driver_data;
    334 + if (!ci)
    335 + return -EINVAL;
    336 +
    337 priv->ci = ci;
    338 mm = &ci->misc_map;
    339
    340 diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
    341 index 75399aa1ba951..6771c51f72c37 100644
    342 --- a/drivers/net/can/usb/gs_usb.c
    343 +++ b/drivers/net/can/usb/gs_usb.c
    344 @@ -198,8 +198,8 @@ struct gs_can {
    345 struct gs_usb {
    346 struct gs_can *canch[GS_MAX_INTF];
    347 struct usb_anchor rx_submitted;
    348 - atomic_t active_channels;
    349 struct usb_device *udev;
    350 + u8 active_channels;
    351 };
    352
    353 /* 'allocate' a tx context.
    354 @@ -597,7 +597,7 @@ static int gs_can_open(struct net_device *netdev)
    355 if (rc)
    356 return rc;
    357
    358 - if (atomic_add_return(1, &parent->active_channels) == 1) {
    359 + if (!parent->active_channels) {
    360 for (i = 0; i < GS_MAX_RX_URBS; i++) {
    361 struct urb *urb;
    362 u8 *buf;
    363 @@ -698,6 +698,7 @@ static int gs_can_open(struct net_device *netdev)
    364
    365 dev->can.state = CAN_STATE_ERROR_ACTIVE;
    366
    367 + parent->active_channels++;
    368 if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
    369 netif_start_queue(netdev);
    370
    371 @@ -713,7 +714,8 @@ static int gs_can_close(struct net_device *netdev)
    372 netif_stop_queue(netdev);
    373
    374 /* Stop polling */
    375 - if (atomic_dec_and_test(&parent->active_channels))
    376 + parent->active_channels--;
    377 + if (!parent->active_channels)
    378 usb_kill_anchored_urbs(&parent->rx_submitted);
    379
    380 /* Stop sending URBs */
    381 @@ -992,8 +994,6 @@ static int gs_usb_probe(struct usb_interface *intf,
    382
    383 init_usb_anchor(&dev->rx_submitted);
    384
    385 - atomic_set(&dev->active_channels, 0);
    386 -
    387 usb_set_intfdata(intf, dev);
    388 dev->udev = interface_to_usbdev(intf);
    389
    390 diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    391 index a89721fad633e..29220141e4e46 100644
    392 --- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    393 +++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
    394 @@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
    395 MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10);
    396 adapter->params.pci.vpd_cap_addr =
    397 pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD);
    398 + if (!adapter->params.pci.vpd_cap_addr)
    399 + return -ENODEV;
    400 ret = get_vpd_params(adapter, &adapter->params.vpd);
    401 if (ret < 0)
    402 return ret;
    403 diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    404 index 11dd7c8d576d6..ab1d01dd2eb3a 100644
    405 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    406 +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
    407 @@ -2311,18 +2311,18 @@ static int __init sxgbe_cmdline_opt(char *str)
    408 char *opt;
    409
    410 if (!str || !*str)
    411 - return -EINVAL;
    412 + return 1;
    413 while ((opt = strsep(&str, ",")) != NULL) {
    414 if (!strncmp(opt, "eee_timer:", 10)) {
    415 if (kstrtoint(opt + 10, 0, &eee_timer))
    416 goto err;
    417 }
    418 }
    419 - return 0;
    420 + return 1;
    421
    422 err:
    423 pr_err("%s: ERROR broken module parameter conversion\n", __func__);
    424 - return -EINVAL;
    425 + return 1;
    426 }
    427
    428 __setup("sxgbeeth=", sxgbe_cmdline_opt);
    429 diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    430 index 0a7ff854d1c34..bb44f8161ea94 100644
    431 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    432 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    433 @@ -3608,7 +3608,7 @@ static int __init stmmac_cmdline_opt(char *str)
    434 char *opt;
    435
    436 if (!str || !*str)
    437 - return -EINVAL;
    438 + return 1;
    439 while ((opt = strsep(&str, ",")) != NULL) {
    440 if (!strncmp(opt, "debug:", 6)) {
    441 if (kstrtoint(opt + 6, 0, &debug))
    442 @@ -3639,11 +3639,11 @@ static int __init stmmac_cmdline_opt(char *str)
    443 goto err;
    444 }
    445 }
    446 - return 0;
    447 + return 1;
    448
    449 err:
    450 pr_err("%s: ERROR broken module parameter conversion", __func__);
    451 - return -EINVAL;
    452 + return 1;
    453 }
    454
    455 __setup("stmmaceth=", stmmac_cmdline_opt);
    456 diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    457 index 8d85cedb4bf5b..cbf959e7bbff7 100644
    458 --- a/drivers/net/hamradio/mkiss.c
    459 +++ b/drivers/net/hamradio/mkiss.c
    460 @@ -41,6 +41,8 @@
    461
    462 #define AX_MTU 236
    463
    464 +/* some arch define END as assembly function ending, just undef it */
    465 +#undef END
    466 /* SLIP/KISS protocol characters. */
    467 #define END 0300 /* indicates end of frame */
    468 #define ESC 0333 /* indicates byte stuffing */
    469 diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
    470 index d86132d41416d..95256765b3887 100644
    471 --- a/drivers/net/usb/cdc_mbim.c
    472 +++ b/drivers/net/usb/cdc_mbim.c
    473 @@ -652,6 +652,11 @@ static const struct usb_device_id mbim_devs[] = {
    474 .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
    475 },
    476
    477 + /* Telit FN990 */
    478 + { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
    479 + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
    480 + },
    481 +
    482 /* default entry */
    483 { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
    484 .driver_info = (unsigned long)&cdc_mbim_info_zlp,
    485 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    486 index dd6924d21b8a1..a34647efb5ea5 100644
    487 --- a/drivers/net/wireless/mac80211_hwsim.c
    488 +++ b/drivers/net/wireless/mac80211_hwsim.c
    489 @@ -1987,6 +1987,15 @@ static void hw_scan_work(struct work_struct *work)
    490 memcpy(skb_put(probe, req->ie_len), req->ie,
    491 req->ie_len);
    492
    493 + if (!ieee80211_tx_prepare_skb(hwsim->hw,
    494 + hwsim->hw_scan_vif,
    495 + probe,
    496 + hwsim->tmp_chan->band,
    497 + NULL)) {
    498 + kfree_skb(probe);
    499 + continue;
    500 + }
    501 +
    502 local_bh_disable();
    503 mac80211_hwsim_tx_frame(hwsim->hw, probe,
    504 hwsim->tmp_chan);
    505 @@ -2919,6 +2928,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
    506 }
    507 txi->flags |= IEEE80211_TX_STAT_ACK;
    508 }
    509 +
    510 + if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
    511 + txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
    512 +
    513 ieee80211_tx_status_irqsafe(data2->hw, skb);
    514 return 0;
    515 out:
    516 diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c
    517 index 7ae59abc78637..127a4a836e675 100644
    518 --- a/drivers/soc/fsl/qe/qe_io.c
    519 +++ b/drivers/soc/fsl/qe/qe_io.c
    520 @@ -41,6 +41,8 @@ int par_io_init(struct device_node *np)
    521 if (ret)
    522 return ret;
    523 par_io = ioremap(res.start, resource_size(&res));
    524 + if (!par_io)
    525 + return -ENOMEM;
    526
    527 num_ports = of_get_property(np, "num-ports", NULL);
    528 if (num_ports)
    529 diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    530 index 19eb954a7afa3..2b30b5a1b577e 100644
    531 --- a/drivers/usb/gadget/legacy/inode.c
    532 +++ b/drivers/usb/gadget/legacy/inode.c
    533 @@ -1833,8 +1833,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    534 spin_lock_irq (&dev->lock);
    535 value = -EINVAL;
    536 if (dev->buf) {
    537 + spin_unlock_irq(&dev->lock);
    538 kfree(kbuf);
    539 - goto fail;
    540 + return value;
    541 }
    542 dev->buf = kbuf;
    543
    544 @@ -1882,8 +1883,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    545
    546 value = usb_gadget_probe_driver(&gadgetfs_driver);
    547 if (value != 0) {
    548 - kfree (dev->buf);
    549 - dev->buf = NULL;
    550 + spin_lock_irq(&dev->lock);
    551 + goto fail;
    552 } else {
    553 /* at this point "good" hardware has for the first time
    554 * let the USB the host see us. alternatively, if users
    555 @@ -1900,6 +1901,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    556 return value;
    557
    558 fail:
    559 + dev->config = NULL;
    560 + dev->hs_config = NULL;
    561 + dev->dev = NULL;
    562 spin_unlock_irq (&dev->lock);
    563 pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev);
    564 kfree (dev->buf);
    565 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
    566 index 375ccd209206a..95e4f074b7665 100644
    567 --- a/fs/cifs/cifsfs.c
    568 +++ b/fs/cifs/cifsfs.c
    569 @@ -746,6 +746,7 @@ cifs_do_mount(struct file_system_type *fs_type,
    570
    571 out_super:
    572 deactivate_locked_super(sb);
    573 + return root;
    574 out:
    575 cifs_cleanup_volume_info(volume_info);
    576 return root;
    577 diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
    578 index 2280cfe86c561..faa535defddd0 100644
    579 --- a/include/net/netfilter/nf_queue.h
    580 +++ b/include/net/netfilter/nf_queue.h
    581 @@ -31,7 +31,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q
    582 void nf_unregister_queue_handler(struct net *net);
    583 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
    584
    585 -void nf_queue_entry_get_refs(struct nf_queue_entry *entry);
    586 +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);
    587 void nf_queue_entry_release_refs(struct nf_queue_entry *entry);
    588
    589 static inline void init_hashrandom(u32 *jhash_initval)
    590 diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
    591 index b584868e1b26b..fd7cacbfc8c2c 100644
    592 --- a/include/uapi/linux/input-event-codes.h
    593 +++ b/include/uapi/linux/input-event-codes.h
    594 @@ -277,7 +277,8 @@
    595 #define KEY_PAUSECD 201
    596 #define KEY_PROG3 202
    597 #define KEY_PROG4 203
    598 -#define KEY_DASHBOARD 204 /* AL Dashboard */
    599 +#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */
    600 +#define KEY_DASHBOARD KEY_ALL_APPLICATIONS
    601 #define KEY_SUSPEND 205
    602 #define KEY_CLOSE 206 /* AC Close */
    603 #define KEY_PLAY 207
    604 diff --git a/mm/shmem.c b/mm/shmem.c
    605 index 51aa13f596220..dffa36e6d1c45 100644
    606 --- a/mm/shmem.c
    607 +++ b/mm/shmem.c
    608 @@ -2478,7 +2478,8 @@ static void shmem_tag_pins(struct address_space *mapping)
    609 slot = radix_tree_iter_retry(&iter);
    610 continue;
    611 }
    612 - } else if (page_count(page) - page_mapcount(page) > 1) {
    613 + } else if (!PageTail(page) && page_count(page) !=
    614 + hpage_nr_pages(page) + total_mapcount(page)) {
    615 radix_tree_tag_set(&mapping->page_tree, iter.index,
    616 SHMEM_TAG_PINNED);
    617 }
    618 @@ -2538,8 +2539,8 @@ static int shmem_wait_for_pins(struct address_space *mapping)
    619 page = NULL;
    620 }
    621
    622 - if (page &&
    623 - page_count(page) - page_mapcount(page) != 1) {
    624 + if (page && page_count(page) !=
    625 + hpage_nr_pages(page) + total_mapcount(page)) {
    626 if (scan < LAST_SCAN)
    627 goto continue_resched;
    628
    629 diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
    630 index 2dbf5a0faad32..e32a520c3702b 100644
    631 --- a/net/dcb/dcbnl.c
    632 +++ b/net/dcb/dcbnl.c
    633 @@ -1938,10 +1938,54 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
    634 }
    635 EXPORT_SYMBOL(dcb_ieee_delapp);
    636
    637 +static void dcbnl_flush_dev(struct net_device *dev)
    638 +{
    639 + struct dcb_app_type *itr, *tmp;
    640 +
    641 + spin_lock_bh(&dcb_lock);
    642 +
    643 + list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) {
    644 + if (itr->ifindex == dev->ifindex) {
    645 + list_del(&itr->list);
    646 + kfree(itr);
    647 + }
    648 + }
    649 +
    650 + spin_unlock_bh(&dcb_lock);
    651 +}
    652 +
    653 +static int dcbnl_netdevice_event(struct notifier_block *nb,
    654 + unsigned long event, void *ptr)
    655 +{
    656 + struct net_device *dev = netdev_notifier_info_to_dev(ptr);
    657 +
    658 + switch (event) {
    659 + case NETDEV_UNREGISTER:
    660 + if (!dev->dcbnl_ops)
    661 + return NOTIFY_DONE;
    662 +
    663 + dcbnl_flush_dev(dev);
    664 +
    665 + return NOTIFY_OK;
    666 + default:
    667 + return NOTIFY_DONE;
    668 + }
    669 +}
    670 +
    671 +static struct notifier_block dcbnl_nb __read_mostly = {
    672 + .notifier_call = dcbnl_netdevice_event,
    673 +};
    674 +
    675 static int __init dcbnl_init(void)
    676 {
    677 + int err;
    678 +
    679 INIT_LIST_HEAD(&dcb_app_list);
    680
    681 + err = register_netdevice_notifier(&dcbnl_nb);
    682 + if (err)
    683 + return err;
    684 +
    685 rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, NULL);
    686 rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, NULL);
    687
    688 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    689 index d93a98dfe52df..55be18cae35ba 100644
    690 --- a/net/ipv6/ip6_output.c
    691 +++ b/net/ipv6/ip6_output.c
    692 @@ -1274,8 +1274,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
    693 if (np->frag_size)
    694 mtu = np->frag_size;
    695 }
    696 - if (mtu < IPV6_MIN_MTU)
    697 - return -EINVAL;
    698 cork->base.fragsize = mtu;
    699 if (dst_allfrag(rt->dst.path))
    700 cork->base.flags |= IPCORK_ALLFRAG;
    701 @@ -1324,8 +1322,6 @@ static int __ip6_append_data(struct sock *sk,
    702
    703 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
    704 (opt ? opt->opt_nflen : 0);
    705 - maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
    706 - sizeof(struct frag_hdr);
    707
    708 headersize = sizeof(struct ipv6hdr) +
    709 (opt ? opt->opt_flen + opt->opt_nflen : 0) +
    710 @@ -1333,6 +1329,13 @@ static int __ip6_append_data(struct sock *sk,
    711 sizeof(struct frag_hdr) : 0) +
    712 rt->rt6i_nfheader_len;
    713
    714 + if (mtu < fragheaderlen ||
    715 + ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
    716 + goto emsgsize;
    717 +
    718 + maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
    719 + sizeof(struct frag_hdr);
    720 +
    721 /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
    722 * the first fragment
    723 */
    724 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    725 index 3dc370ad23bf6..41af02a70742e 100644
    726 --- a/net/mac80211/rx.c
    727 +++ b/net/mac80211/rx.c
    728 @@ -2607,13 +2607,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
    729 ether_addr_equal(sdata->vif.addr, hdr->addr3))
    730 return RX_CONTINUE;
    731
    732 - ac = ieee80211_select_queue_80211(sdata, skb, hdr);
    733 + ac = ieee802_1d_to_ac[skb->priority];
    734 q = sdata->vif.hw_queue[ac];
    735 if (ieee80211_queue_stopped(&local->hw, q)) {
    736 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
    737 return RX_DROP_MONITOR;
    738 }
    739 - skb_set_queue_mapping(skb, q);
    740 + skb_set_queue_mapping(skb, ac);
    741
    742 if (!--mesh_hdr->ttl) {
    743 if (!is_multicast_ether_addr(hdr->addr1))
    744 diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
    745 index 8f08d759844a9..333ea23681017 100644
    746 --- a/net/netfilter/nf_queue.c
    747 +++ b/net/netfilter/nf_queue.c
    748 @@ -44,6 +44,15 @@ void nf_unregister_queue_handler(struct net *net)
    749 }
    750 EXPORT_SYMBOL(nf_unregister_queue_handler);
    751
    752 +static void nf_queue_sock_put(struct sock *sk)
    753 +{
    754 +#ifdef CONFIG_INET
    755 + sock_gen_put(sk);
    756 +#else
    757 + sock_put(sk);
    758 +#endif
    759 +}
    760 +
    761 void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    762 {
    763 struct nf_hook_state *state = &entry->state;
    764 @@ -54,7 +63,7 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    765 if (state->out)
    766 dev_put(state->out);
    767 if (state->sk)
    768 - sock_put(state->sk);
    769 + nf_queue_sock_put(state->sk);
    770 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
    771 if (entry->skb->nf_bridge) {
    772 struct net_device *physdev;
    773 @@ -71,10 +80,13 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
    774 EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
    775
    776 /* Bump dev refs so they don't vanish while packet is out */
    777 -void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    778 +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    779 {
    780 struct nf_hook_state *state = &entry->state;
    781
    782 + if (state->sk && !atomic_inc_not_zero(&state->sk->sk_refcnt))
    783 + return false;
    784 +
    785 if (state->in)
    786 dev_hold(state->in);
    787 if (state->out)
    788 @@ -93,6 +105,7 @@ void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
    789 dev_hold(physdev);
    790 }
    791 #endif
    792 + return true;
    793 }
    794 EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
    795
    796 @@ -139,7 +152,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
    797 .size = sizeof(*entry) + afinfo->route_key_size,
    798 };
    799
    800 - nf_queue_entry_get_refs(entry);
    801 + if (!nf_queue_entry_get_refs(entry)) {
    802 + kfree(entry);
    803 + return -ENOTCONN;
    804 + }
    805 +
    806 skb_dst_force(skb);
    807 afinfo->saveroute(skb, entry);
    808 status = qh->outfn(entry, queuenum);
    809 diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    810 index a35510565d4d1..66814a9d030cc 100644
    811 --- a/net/netfilter/nfnetlink_queue.c
    812 +++ b/net/netfilter/nfnetlink_queue.c
    813 @@ -673,9 +673,15 @@ static struct nf_queue_entry *
    814 nf_queue_entry_dup(struct nf_queue_entry *e)
    815 {
    816 struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
    817 - if (entry)
    818 - nf_queue_entry_get_refs(entry);
    819 - return entry;
    820 +
    821 + if (!entry)
    822 + return NULL;
    823 +
    824 + if (nf_queue_entry_get_refs(entry))
    825 + return entry;
    826 +
    827 + kfree(entry);
    828 + return NULL;
    829 }
    830
    831 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
    832 diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
    833 index e2c200c3c1353..74968ddee49fa 100644
    834 --- a/sound/soc/soc-ops.c
    835 +++ b/sound/soc/soc-ops.c
    836 @@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
    837 mask = BIT(sign_bit + 1) - 1;
    838
    839 val = ucontrol->value.integer.value[0];
    840 - if (mc->platform_max && val > mc->platform_max)
    841 + if (mc->platform_max && ((int)val + min) > mc->platform_max)
    842 return -EINVAL;
    843 if (val > max - min)
    844 return -EINVAL;
    845 @@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
    846 val = val << shift;
    847 if (snd_soc_volsw_is_stereo(mc)) {
    848 val2 = ucontrol->value.integer.value[1];
    849 - if (mc->platform_max && val2 > mc->platform_max)
    850 + if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
    851 return -EINVAL;
    852 if (val2 > max - min)
    853 return -EINVAL;