Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0427-4.9.328-all-fixes.patch

    Contents of /trunk/kernel-alx-legacy/patches-4.9/0427-4.9.328-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3729 - (show annotations) (download)
    Mon Oct 24 14:08:39 2022 UTC (18 months ago) by niro
    File size: 37328 byte(s) 
    -linux-4.9.328
    1 diff --git a/Makefile b/Makefile
    2 index df5f7e0d30393..c4a9f44d5de67 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 327
    9 +SUBLEVEL = 328
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/board.c
    14 index a96bed5e3ea60..ac1c5e6572d5f 100644
    15 --- a/arch/mips/loongson32/ls1c/board.c
    16 +++ b/arch/mips/loongson32/ls1c/board.c
    17 @@ -18,7 +18,6 @@ static struct platform_device *ls1c_platform_devices[] __initdata = {
    18 static int __init ls1c_platform_init(void)
    19 {
    20 ls1x_serial_set_uartclk(&ls1x_uart_pdev);
    21 - ls1x_rtc_set_extclk(&ls1x_rtc_pdev);
    22
    23 return platform_add_devices(ls1c_platform_devices,
    24 ARRAY_SIZE(ls1c_platform_devices));
    25 diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
    26 index 9b99eb0712ad1..2f570a5205866 100644
    27 --- a/arch/parisc/kernel/head.S
    28 +++ b/arch/parisc/kernel/head.S
    29 @@ -22,7 +22,7 @@
    30 #include <linux/linkage.h>
    31 #include <linux/init.h>
    32
    33 - .level PA_ASM_LEVEL
    34 + .level 1.1
    35
    36 __INITDATA
    37 ENTRY(boot_args)
    38 @@ -69,6 +69,47 @@ $bss_loop:
    39 stw,ma %arg2,4(%r1)
    40 stw,ma %arg3,4(%r1)
    41
    42 +#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20)
    43 + /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU
    44 + * and halt kernel if we detect a PA1.x CPU. */
    45 + ldi 32,%r10
    46 + mtctl %r10,%cr11
    47 + .level 2.0
    48 + mfctl,w %cr11,%r10
    49 + .level 1.1
    50 + comib,<>,n 0,%r10,$cpu_ok
    51 +
    52 + load32 PA(msg1),%arg0
    53 + ldi msg1_end-msg1,%arg1
    54 +$iodc_panic:
    55 + copy %arg0, %r10
    56 + copy %arg1, %r11
    57 + load32 PA(init_stack),%sp
    58 +#define MEM_CONS 0x3A0
    59 + ldw MEM_CONS+32(%r0),%arg0 // HPA
    60 + ldi ENTRY_IO_COUT,%arg1
    61 + ldw MEM_CONS+36(%r0),%arg2 // SPA
    62 + ldw MEM_CONS+8(%r0),%arg3 // layers
    63 + load32 PA(__bss_start),%r1
    64 + stw %r1,-52(%sp) // arg4
    65 + stw %r0,-56(%sp) // arg5
    66 + stw %r10,-60(%sp) // arg6 = ptr to text
    67 + stw %r11,-64(%sp) // arg7 = len
    68 + stw %r0,-68(%sp) // arg8
    69 + load32 PA(.iodc_panic_ret), %rp
    70 + ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC
    71 + bv,n (%r1)
    72 +.iodc_panic_ret:
    73 + b . /* wait endless with ... */
    74 + or %r10,%r10,%r10 /* qemu idle sleep */
    75 +msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n"
    76 +msg1_end:
    77 +
    78 +$cpu_ok:
    79 +#endif
    80 +
    81 + .level PA_ASM_LEVEL
    82 +
    83 /* Initialize startup VM. Just map first 16/32 MB of memory */
    84 load32 PA(swapper_pg_dir),%r4
    85 mtctl %r4,%cr24 /* Initialize kernel root pointer */
    86 diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
    87 index 4c7fac75090ea..5be96705123f9 100644
    88 --- a/arch/s390/include/asm/hugetlb.h
    89 +++ b/arch/s390/include/asm/hugetlb.h
    90 @@ -29,9 +29,11 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
    91 static inline int prepare_hugepage_range(struct file *file,
    92 unsigned long addr, unsigned long len)
    93 {
    94 - if (len & ~HPAGE_MASK)
    95 + struct hstate *h = hstate_file(file);
    96 +
    97 + if (len & ~huge_page_mask(h))
    98 return -EINVAL;
    99 - if (addr & ~HPAGE_MASK)
    100 + if (addr & ~huge_page_mask(h))
    101 return -EINVAL;
    102 return 0;
    103 }
    104 diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
    105 index dd96b467946ba..dc2f8d46c6b0d 100644
    106 --- a/arch/s390/kernel/vmlinux.lds.S
    107 +++ b/arch/s390/kernel/vmlinux.lds.S
    108 @@ -125,6 +125,7 @@ SECTIONS
    109 /*
    110 * Table with the patch locations to undo expolines
    111 */
    112 + . = ALIGN(4);
    113 .nospec_call_table : {
    114 __nospec_call_start = . ;
    115 *(.s390_indirect*)
    116 diff --git a/arch/x86/include/asm/pmc_atom.h b/arch/x86/include/asm/pmc_atom.h
    117 index aa8744c77c6d9..b25ac6eb1fdee 100644
    118 --- a/arch/x86/include/asm/pmc_atom.h
    119 +++ b/arch/x86/include/asm/pmc_atom.h
    120 @@ -16,6 +16,8 @@
    121 #ifndef PMC_ATOM_H
    122 #define PMC_ATOM_H
    123
    124 +#include <linux/bits.h>
    125 +
    126 /* ValleyView Power Control Unit PCI Device ID */
    127 #define PCI_DEVICE_ID_VLV_PMC 0x0F1C
    128 /* CherryTrail Power Control Unit PCI Device ID */
    129 @@ -148,9 +150,9 @@
    130 #define ACPI_MMIO_REG_LEN 0x100
    131
    132 #define PM1_CNT 0x4
    133 -#define SLEEP_TYPE_MASK 0xFFFFECFF
    134 +#define SLEEP_TYPE_MASK GENMASK(12, 10)
    135 #define SLEEP_TYPE_S5 0x1C00
    136 -#define SLEEP_ENABLE 0x2000
    137 +#define SLEEP_ENABLE BIT(13)
    138
    139 extern int pmc_atom_read(int offset, u32 *value);
    140 extern int pmc_atom_write(int offset, u32 value);
    141 diff --git a/arch/x86/platform/atom/pmc_atom.c b/arch/x86/platform/atom/pmc_atom.c
    142 index 964ff4fc61f9b..b5b371d959141 100644
    143 --- a/arch/x86/platform/atom/pmc_atom.c
    144 +++ b/arch/x86/platform/atom/pmc_atom.c
    145 @@ -213,7 +213,7 @@ static void pmc_power_off(void)
    146 pm1_cnt_port = acpi_base_addr + PM1_CNT;
    147
    148 pm1_cnt_value = inl(pm1_cnt_port);
    149 - pm1_cnt_value &= SLEEP_TYPE_MASK;
    150 + pm1_cnt_value &= ~SLEEP_TYPE_MASK;
    151 pm1_cnt_value |= SLEEP_TYPE_S5;
    152 pm1_cnt_value |= SLEEP_ENABLE;
    153
    154 diff --git a/drivers/base/dd.c b/drivers/base/dd.c
    155 index ff59a1851cb4d..faaa0440b2949 100644
    156 --- a/drivers/base/dd.c
    157 +++ b/drivers/base/dd.c
    158 @@ -590,6 +590,11 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
    159 } else if (ret == -EPROBE_DEFER) {
    160 dev_dbg(dev, "Device match requests probe deferral\n");
    161 driver_deferred_probe_add(dev);
    162 + /*
    163 + * Device can't match with a driver right now, so don't attempt
    164 + * to match or bind with other drivers on the bus.
    165 + */
    166 + return ret;
    167 } else if (ret < 0) {
    168 dev_dbg(dev, "Bus failed to match device: %d", ret);
    169 return ret;
    170 @@ -732,6 +737,11 @@ static int __driver_attach(struct device *dev, void *data)
    171 } else if (ret == -EPROBE_DEFER) {
    172 dev_dbg(dev, "Device match requests probe deferral\n");
    173 driver_deferred_probe_add(dev);
    174 + /*
    175 + * Driver could not match with device, but may match with
    176 + * another device on the bus.
    177 + */
    178 + return 0;
    179 } else if (ret < 0) {
    180 dev_dbg(dev, "Bus failed to match device: %d", ret);
    181 return ret;
    182 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
    183 index 82b01123c3868..227c4733de2ea 100644
    184 --- a/drivers/gpu/drm/radeon/radeon_device.c
    185 +++ b/drivers/gpu/drm/radeon/radeon_device.c
    186 @@ -1661,6 +1661,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
    187 if (r) {
    188 /* delay GPU reset to resume */
    189 radeon_fence_driver_force_completion(rdev, i);
    190 + } else {
    191 + /* finish executing delayed work */
    192 + flush_delayed_work(&rdev->fence_drv[i].lockup_work);
    193 }
    194 }
    195
    196 diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
    197 index 685568b1236d4..f78e677b858e8 100644
    198 --- a/drivers/hwmon/gpio-fan.c
    199 +++ b/drivers/hwmon/gpio-fan.c
    200 @@ -422,6 +422,9 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev,
    201 if (!fan_data)
    202 return -EINVAL;
    203
    204 + if (state >= fan_data->num_speed)
    205 + return -EINVAL;
    206 +
    207 set_fan_speed(fan_data, state);
    208 return 0;
    209 }
    210 diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
    211 index f6ef5952e94b3..633762f8d7755 100644
    212 --- a/drivers/parisc/ccio-dma.c
    213 +++ b/drivers/parisc/ccio-dma.c
    214 @@ -1408,15 +1408,17 @@ ccio_init_resource(struct resource *res, char *name, void __iomem *ioaddr)
    215 }
    216 }
    217
    218 -static void __init ccio_init_resources(struct ioc *ioc)
    219 +static int __init ccio_init_resources(struct ioc *ioc)
    220 {
    221 struct resource *res = ioc->mmio_region;
    222 char *name = kmalloc(14, GFP_KERNEL);
    223 -
    224 + if (unlikely(!name))
    225 + return -ENOMEM;
    226 snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path);
    227
    228 ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low);
    229 ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv);
    230 + return 0;
    231 }
    232
    233 static int new_ioc_area(struct resource *res, unsigned long size,
    234 @@ -1566,7 +1568,10 @@ static int __init ccio_probe(struct parisc_device *dev)
    235 ioc->hw_path = dev->hw_path;
    236 ioc->ioc_regs = ioremap_nocache(dev->hpa.start, 4096);
    237 ccio_ioc_init(ioc);
    238 - ccio_init_resources(ioc);
    239 + if (ccio_init_resources(ioc)) {
    240 + kfree(ioc);
    241 + return -ENOMEM;
    242 + }
    243 hppa_dma_ops = &ccio_ops;
    244 dev->dev.platform_data = kzalloc(sizeof(struct pci_hba_data), GFP_KERNEL);
    245
    246 diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
    247 index 8063b97bf2e9b..b52a81c3f96fe 100644
    248 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
    249 +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
    250 @@ -2776,6 +2776,7 @@ static struct fw_event_work *dequeue_next_fw_event(struct MPT3SAS_ADAPTER *ioc)
    251 fw_event = list_first_entry(&ioc->fw_event_list,
    252 struct fw_event_work, list);
    253 list_del_init(&fw_event->list);
    254 + fw_event_work_put(fw_event);
    255 }
    256 spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
    257
    258 @@ -2812,7 +2813,6 @@ _scsih_fw_event_cleanup_queue(struct MPT3SAS_ADAPTER *ioc)
    259 if (cancel_work_sync(&fw_event->work))
    260 fw_event_work_put(fw_event);
    261
    262 - fw_event_work_put(fw_event);
    263 }
    264 }
    265
    266 diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
    267 index 41b667c8385cf..2014e8f899463 100644
    268 --- a/drivers/staging/rtl8712/rtl8712_cmd.c
    269 +++ b/drivers/staging/rtl8712/rtl8712_cmd.c
    270 @@ -128,34 +128,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
    271 kfree(pdrvcmd->pbuf);
    272 }
    273
    274 -static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
    275 -{
    276 - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
    277 - struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
    278 -
    279 - /* invoke cmd->callback function */
    280 - pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
    281 - if (!pcmd_callback)
    282 - r8712_free_cmd_obj(pcmd);
    283 - else
    284 - pcmd_callback(padapter, pcmd);
    285 - return H2C_SUCCESS;
    286 -}
    287 -
    288 -static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
    289 -{
    290 - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
    291 - struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
    292 -
    293 - /* invoke cmd->callback function */
    294 - pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
    295 - if (!pcmd_callback)
    296 - r8712_free_cmd_obj(pcmd);
    297 - else
    298 - pcmd_callback(padapter, pcmd);
    299 - return H2C_SUCCESS;
    300 -}
    301 -
    302 static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
    303 {
    304 struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
    305 @@ -224,14 +196,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
    306 pcmd_r = NULL;
    307
    308 switch (pcmd->cmdcode) {
    309 - case GEN_CMD_CODE(_Read_MACREG):
    310 - read_macreg_hdl(padapter, (u8 *)pcmd);
    311 - pcmd_r = pcmd;
    312 - break;
    313 - case GEN_CMD_CODE(_Write_MACREG):
    314 - write_macreg_hdl(padapter, (u8 *)pcmd);
    315 - pcmd_r = pcmd;
    316 - break;
    317 case GEN_CMD_CODE(_Read_BBREG):
    318 read_bbreg_hdl(padapter, (u8 *)pcmd);
    319 break;
    320 diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
    321 index a4c1797e30d71..8cc35656c71da 100644
    322 --- a/drivers/tty/serial/fsl_lpuart.c
    323 +++ b/drivers/tty/serial/fsl_lpuart.c
    324 @@ -951,9 +951,9 @@ static int lpuart_config_rs485(struct uart_port *port,
    325 * Note: UART is assumed to be active high.
    326 */
    327 if (rs485->flags & SER_RS485_RTS_ON_SEND)
    328 - modem &= ~UARTMODEM_TXRTSPOL;
    329 - else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
    330 modem |= UARTMODEM_TXRTSPOL;
    331 + else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
    332 + modem &= ~UARTMODEM_TXRTSPOL;
    333 }
    334
    335 /* Store the new configuration */
    336 diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    337 index 29037322d047c..be93b1d51be8c 100644
    338 --- a/drivers/tty/vt/vt.c
    339 +++ b/drivers/tty/vt/vt.c
    340 @@ -4183,9 +4183,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
    341 console_lock();
    342 if (vc->vc_mode != KD_TEXT)
    343 rc = -EINVAL;
    344 - else if (vc->vc_sw->con_font_set)
    345 + else if (vc->vc_sw->con_font_set) {
    346 + if (vc_is_sel(vc))
    347 + clear_selection();
    348 rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
    349 - else
    350 + } else
    351 rc = -ENOSYS;
    352 console_unlock();
    353 kfree(font.data);
    354 @@ -4212,9 +4214,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
    355 console_unlock();
    356 return -EINVAL;
    357 }
    358 - if (vc->vc_sw->con_font_default)
    359 + if (vc->vc_sw->con_font_default) {
    360 + if (vc_is_sel(vc))
    361 + clear_selection();
    362 rc = vc->vc_sw->con_font_default(vc, &font, s);
    363 - else
    364 + } else
    365 rc = -ENOSYS;
    366 console_unlock();
    367 if (!rc) {
    368 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    369 index b7b83ca83ba0d..c5e71c8b5a0e8 100644
    370 --- a/drivers/usb/class/cdc-acm.c
    371 +++ b/drivers/usb/class/cdc-acm.c
    372 @@ -1774,6 +1774,9 @@ static const struct usb_device_id acm_ids[] = {
    373 { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
    374 .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
    375 },
    376 + { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */
    377 + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
    378 + },
    379 { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
    380 .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
    381 },
    382 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    383 index 33bf5ba438397..611ff2c28f7a4 100644
    384 --- a/drivers/usb/core/hub.c
    385 +++ b/drivers/usb/core/hub.c
    386 @@ -5701,6 +5701,11 @@ re_enumerate_no_bos:
    387 * the reset is over (using their post_reset method).
    388 *
    389 * Return: The same as for usb_reset_and_verify_device().
    390 + * However, if a reset is already in progress (for instance, if a
    391 + * driver doesn't have pre_ or post_reset() callbacks, and while
    392 + * being unbound or re-bound during the ongoing reset its disconnect()
    393 + * or probe() routine tries to perform a second, nested reset), the
    394 + * routine returns -EINPROGRESS.
    395 *
    396 * Note:
    397 * The caller must own the device lock. For example, it's safe to use
    398 @@ -5734,6 +5739,10 @@ int usb_reset_device(struct usb_device *udev)
    399 return -EISDIR;
    400 }
    401
    402 + if (udev->reset_in_progress)
    403 + return -EINPROGRESS;
    404 + udev->reset_in_progress = 1;
    405 +
    406 port_dev = hub->ports[udev->portnum - 1];
    407
    408 /*
    409 @@ -5798,6 +5807,7 @@ int usb_reset_device(struct usb_device *udev)
    410
    411 usb_autosuspend_device(udev);
    412 memalloc_noio_restore(noio_flag);
    413 + udev->reset_in_progress = 0;
    414 return ret;
    415 }
    416 EXPORT_SYMBOL_GPL(usb_reset_device);
    417 diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
    418 index b6d6fe4565fdf..fb00dccfc3737 100644
    419 --- a/drivers/usb/dwc3/core.c
    420 +++ b/drivers/usb/dwc3/core.c
    421 @@ -602,15 +602,15 @@ static void dwc3_core_exit(struct dwc3 *dwc)
    422 {
    423 dwc3_event_buffers_cleanup(dwc);
    424
    425 - usb_phy_shutdown(dwc->usb2_phy);
    426 - usb_phy_shutdown(dwc->usb3_phy);
    427 - phy_exit(dwc->usb2_generic_phy);
    428 - phy_exit(dwc->usb3_generic_phy);
    429 -
    430 usb_phy_set_suspend(dwc->usb2_phy, 1);
    431 usb_phy_set_suspend(dwc->usb3_phy, 1);
    432 phy_power_off(dwc->usb2_generic_phy);
    433 phy_power_off(dwc->usb3_generic_phy);
    434 +
    435 + usb_phy_shutdown(dwc->usb2_phy);
    436 + usb_phy_shutdown(dwc->usb3_phy);
    437 + phy_exit(dwc->usb2_generic_phy);
    438 + phy_exit(dwc->usb3_generic_phy);
    439 }
    440
    441 /**
    442 @@ -1149,16 +1149,16 @@ static int dwc3_probe(struct platform_device *pdev)
    443 err5:
    444 dwc3_event_buffers_cleanup(dwc);
    445
    446 - usb_phy_shutdown(dwc->usb2_phy);
    447 - usb_phy_shutdown(dwc->usb3_phy);
    448 - phy_exit(dwc->usb2_generic_phy);
    449 - phy_exit(dwc->usb3_generic_phy);
    450 -
    451 usb_phy_set_suspend(dwc->usb2_phy, 1);
    452 usb_phy_set_suspend(dwc->usb3_phy, 1);
    453 phy_power_off(dwc->usb2_generic_phy);
    454 phy_power_off(dwc->usb3_generic_phy);
    455
    456 + usb_phy_shutdown(dwc->usb2_phy);
    457 + usb_phy_shutdown(dwc->usb3_phy);
    458 + phy_exit(dwc->usb2_generic_phy);
    459 + phy_exit(dwc->usb3_generic_phy);
    460 +
    461 dwc3_ulpi_exit(dwc);
    462
    463 err4:
    464 diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c
    465 index 8fbf6861690d2..b43c6dbfc6fb3 100644
    466 --- a/drivers/usb/gadget/function/storage_common.c
    467 +++ b/drivers/usb/gadget/function/storage_common.c
    468 @@ -298,8 +298,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub);
    469 void store_cdrom_address(u8 *dest, int msf, u32 addr)
    470 {
    471 if (msf) {
    472 - /* Convert to Minutes-Seconds-Frames */
    473 - addr >>= 2; /* Convert to 2048-byte frames */
    474 + /*
    475 + * Convert to Minutes-Seconds-Frames.
    476 + * Sector size is already set to 2048 bytes.
    477 + */
    478 addr += 2*75; /* Lead-in occupies 2 seconds */
    479 dest[3] = addr % 75; /* Frames */
    480 addr /= 75;
    481 diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    482 index 9708dbb52b702..78b65f70812f1 100644
    483 --- a/drivers/usb/host/xhci-hub.c
    484 +++ b/drivers/usb/host/xhci-hub.c
    485 @@ -1297,6 +1297,17 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
    486
    487 status = bus_state->resuming_ports;
    488
    489 + /*
    490 + * SS devices are only visible to roothub after link training completes.
    491 + * Keep polling roothubs for a grace period after xHC start
    492 + */
    493 + if (xhci->run_graceperiod) {
    494 + if (time_before(jiffies, xhci->run_graceperiod))
    495 + status = 1;
    496 + else
    497 + xhci->run_graceperiod = 0;
    498 + }
    499 +
    500 mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
    501
    502 /* For each port, did anything change? If so, set that bit in buf. */
    503 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    504 index ebf09503be394..ceb0a02c4ac37 100644
    505 --- a/drivers/usb/host/xhci.c
    506 +++ b/drivers/usb/host/xhci.c
    507 @@ -144,9 +144,11 @@ static int xhci_start(struct xhci_hcd *xhci)
    508 xhci_err(xhci, "Host took too long to start, "
    509 "waited %u microseconds.\n",
    510 XHCI_MAX_HALT_USEC);
    511 - if (!ret)
    512 + if (!ret) {
    513 /* clear state flags. Including dying, halted or removing */
    514 xhci->xhc_state = 0;
    515 + xhci->run_graceperiod = jiffies + msecs_to_jiffies(500);
    516 + }
    517
    518 return ret;
    519 }
    520 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    521 index 2b8df83dad38d..9f76ad09911b4 100644
    522 --- a/drivers/usb/host/xhci.h
    523 +++ b/drivers/usb/host/xhci.h
    524 @@ -1607,7 +1607,7 @@ struct xhci_hcd {
    525
    526 /* Host controller watchdog timer structures */
    527 unsigned int xhc_state;
    528 -
    529 + unsigned long run_graceperiod;
    530 u32 command;
    531 struct s3_save s3;
    532 /* Host controller is dying - not responding to commands. "I'm not dead yet!"
    533 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    534 index b0c98c61c53af..ddb795a5cd759 100644
    535 --- a/drivers/usb/serial/cp210x.c
    536 +++ b/drivers/usb/serial/cp210x.c
    537 @@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = {
    538 { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
    539 { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
    540 { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
    541 + { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */
    542 { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
    543 { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
    544 { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
    545 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    546 index d818aed9043d5..eceb6f27fec8b 100644
    547 --- a/drivers/usb/serial/ftdi_sio.c
    548 +++ b/drivers/usb/serial/ftdi_sio.c
    549 @@ -1040,6 +1040,8 @@ static const struct usb_device_id id_table_combined[] = {
    550 /* IDS GmbH devices */
    551 { USB_DEVICE(IDS_VID, IDS_SI31A_PID) },
    552 { USB_DEVICE(IDS_VID, IDS_CM31A_PID) },
    553 + /* Omron devices */
    554 + { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) },
    555 /* U-Blox devices */
    556 { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
    557 { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
    558 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    559 index e2f0bb716a5f3..6a2808430b6a9 100644
    560 --- a/drivers/usb/serial/ftdi_sio_ids.h
    561 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    562 @@ -660,6 +660,12 @@
    563 #define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
    564 #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
    565
    566 +/*
    567 + * Omron corporation (https://www.omron.com)
    568 + */
    569 + #define OMRON_VID 0x0590
    570 + #define OMRON_CS1W_CIF31_PID 0x00b2
    571 +
    572 /*
    573 * Acton Research Corp.
    574 */
    575 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    576 index f54ab5706cd11..dc39243688e4c 100644
    577 --- a/drivers/usb/serial/option.c
    578 +++ b/drivers/usb/serial/option.c
    579 @@ -434,6 +434,8 @@ static void option_instat_callback(struct urb *urb);
    580 #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9
    581 #define CINTERION_PRODUCT_MV32_WA 0x00f1
    582 #define CINTERION_PRODUCT_MV32_WB 0x00f2
    583 +#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3
    584 +#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4
    585
    586 /* Olivetti products */
    587 #define OLIVETTI_VENDOR_ID 0x0b3c
    588 @@ -569,6 +571,10 @@ static void option_instat_callback(struct urb *urb);
    589 #define WETELECOM_PRODUCT_6802 0x6802
    590 #define WETELECOM_PRODUCT_WMD300 0x6803
    591
    592 +/* OPPO products */
    593 +#define OPPO_VENDOR_ID 0x22d9
    594 +#define OPPO_PRODUCT_R11 0x276c
    595 +
    596
    597 /* Device flags */
    598
    599 @@ -1962,8 +1968,12 @@ static const struct usb_device_id option_ids[] = {
    600 .driver_info = RSVD(0)},
    601 { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
    602 .driver_info = RSVD(3)},
    603 + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff),
    604 + .driver_info = RSVD(0) },
    605 { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
    606 .driver_info = RSVD(3)},
    607 + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff),
    608 + .driver_info = RSVD(0) },
    609 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
    610 .driver_info = RSVD(4) },
    611 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
    612 @@ -2126,6 +2136,7 @@ static const struct usb_device_id option_ids[] = {
    613 { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
    614 { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
    615 { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
    616 + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
    617 { } /* Terminating entry */
    618 };
    619 MODULE_DEVICE_TABLE(usb, option_ids);
    620 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    621 index 801351f360da6..5a6ca14607113 100644
    622 --- a/drivers/usb/storage/unusual_devs.h
    623 +++ b/drivers/usb/storage/unusual_devs.h
    624 @@ -2301,6 +2301,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
    625 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    626 US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
    627
    628 +/* Reported by Witold Lipieta <witold.lipieta@thaumatec.com> */
    629 +UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100,
    630 + "NXP Semiconductors",
    631 + "PN7462AU",
    632 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    633 + US_FL_IGNORE_RESIDUE ),
    634 +
    635 /* Supplied with some Castlewood ORB removable drives */
    636 UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999,
    637 "Double-H Technology",
    638 diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
    639 index 84a3778552eba..ec1f8af165e9e 100644
    640 --- a/drivers/video/fbdev/chipsfb.c
    641 +++ b/drivers/video/fbdev/chipsfb.c
    642 @@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
    643 err_release_fb:
    644 framebuffer_release(p);
    645 err_disable:
    646 + pci_disable_device(dp);
    647 err_out:
    648 return rc;
    649 }
    650 diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
    651 index 9b32b9fc44a5c..50b569d047b10 100644
    652 --- a/drivers/video/fbdev/pm2fb.c
    653 +++ b/drivers/video/fbdev/pm2fb.c
    654 @@ -619,6 +619,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
    655 return -EINVAL;
    656 }
    657
    658 + if (!var->pixclock) {
    659 + DPRINTK("pixclock is zero\n");
    660 + return -EINVAL;
    661 + }
    662 +
    663 if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
    664 DPRINTK("pixclock too high (%ldKHz)\n",
    665 PICOS2KHZ(var->pixclock));
    666 diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
    667 index 13a63ab47ef55..110cfe65a0515 100644
    668 --- a/include/linux/buffer_head.h
    669 +++ b/include/linux/buffer_head.h
    670 @@ -132,6 +132,17 @@ BUFFER_FNS(Defer_Completion, defer_completion)
    671
    672 static __always_inline void set_buffer_uptodate(struct buffer_head *bh)
    673 {
    674 + /*
    675 + * If somebody else already set this uptodate, they will
    676 + * have done the memory barrier, and a reader will thus
    677 + * see *some* valid buffer state.
    678 + *
    679 + * Any other serialization (with IO errors or whatever that
    680 + * might clear the bit) has to come from other state (eg BH_Lock).
    681 + */
    682 + if (test_bit(BH_Uptodate, &bh->b_state))
    683 + return;
    684 +
    685 /*
    686 * make it consistent with folio_mark_uptodate
    687 * pairs with smp_load_acquire in buffer_uptodate
    688 diff --git a/include/linux/usb.h b/include/linux/usb.h
    689 index 9dd98dcdb080f..33e0867788566 100644
    690 --- a/include/linux/usb.h
    691 +++ b/include/linux/usb.h
    692 @@ -531,6 +531,7 @@ struct usb3_lpm_parameters {
    693 * @level: number of USB hub ancestors
    694 * @can_submit: URBs may be submitted
    695 * @persist_enabled: USB_PERSIST enabled for this device
    696 + * @reset_in_progress: the device is being reset
    697 * @have_langid: whether string_langid is valid
    698 * @authorized: policy has said we can use it;
    699 * (user space) policy determines if we authorize this device to be
    700 @@ -609,6 +610,7 @@ struct usb_device {
    701
    702 unsigned can_submit:1;
    703 unsigned persist_enabled:1;
    704 + unsigned reset_in_progress:1;
    705 unsigned have_langid:1;
    706 unsigned authorized:1;
    707 unsigned authenticated:1;
    708 diff --git a/mm/kmemleak.c b/mm/kmemleak.c
    709 index c1360b2509194..59bb2b9ec0e2e 100644
    710 --- a/mm/kmemleak.c
    711 +++ b/mm/kmemleak.c
    712 @@ -1130,7 +1130,7 @@ EXPORT_SYMBOL(kmemleak_no_scan);
    713 void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
    714 gfp_t gfp)
    715 {
    716 - if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    717 + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    718 kmemleak_alloc(__va(phys), size, min_count, gfp);
    719 }
    720 EXPORT_SYMBOL(kmemleak_alloc_phys);
    721 @@ -1141,7 +1141,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys);
    722 */
    723 void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size)
    724 {
    725 - if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    726 + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    727 kmemleak_free_part(__va(phys), size);
    728 }
    729 EXPORT_SYMBOL(kmemleak_free_part_phys);
    730 @@ -1152,7 +1152,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys);
    731 */
    732 void __ref kmemleak_not_leak_phys(phys_addr_t phys)
    733 {
    734 - if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    735 + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    736 kmemleak_not_leak(__va(phys));
    737 }
    738 EXPORT_SYMBOL(kmemleak_not_leak_phys);
    739 @@ -1163,7 +1163,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys);
    740 */
    741 void __ref kmemleak_ignore_phys(phys_addr_t phys)
    742 {
    743 - if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    744 + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    745 kmemleak_ignore(__va(phys));
    746 }
    747 EXPORT_SYMBOL(kmemleak_ignore_phys);
    748 diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
    749 index 11d4d18012fed..560a36c68be20 100644
    750 --- a/net/bridge/br_netfilter_hooks.c
    751 +++ b/net/bridge/br_netfilter_hooks.c
    752 @@ -382,6 +382,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_
    753 /* - Bridged-and-DNAT'ed traffic doesn't
    754 * require ip_forwarding. */
    755 if (rt->dst.dev == dev) {
    756 + skb_dst_drop(skb);
    757 skb_dst_set(skb, &rt->dst);
    758 goto bridged_dnat;
    759 }
    760 @@ -411,6 +412,7 @@ bridged_dnat:
    761 kfree_skb(skb);
    762 return 0;
    763 }
    764 + skb_dst_drop(skb);
    765 skb_dst_set_noref(skb, &rt->dst);
    766 }
    767
    768 diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
    769 index 8c08dd07419f6..54dcead37dfd0 100644
    770 --- a/net/bridge/br_netfilter_ipv6.c
    771 +++ b/net/bridge/br_netfilter_ipv6.c
    772 @@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc
    773 kfree_skb(skb);
    774 return 0;
    775 }
    776 + skb_dst_drop(skb);
    777 skb_dst_set_noref(skb, &rt->dst);
    778 }
    779
    780 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    781 index b12a329ef1873..2029e7a36cbb4 100644
    782 --- a/net/ipv4/tcp_input.c
    783 +++ b/net/ipv4/tcp_input.c
    784 @@ -2468,6 +2468,21 @@ static inline bool tcp_may_undo(const struct tcp_sock *tp)
    785 return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp));
    786 }
    787
    788 +static bool tcp_is_non_sack_preventing_reopen(struct sock *sk)
    789 +{
    790 + struct tcp_sock *tp = tcp_sk(sk);
    791 +
    792 + if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
    793 + /* Hold old state until something *above* high_seq
    794 + * is ACKed. For Reno it is MUST to prevent false
    795 + * fast retransmits (RFC2582). SACK TCP is safe. */
    796 + if (!tcp_any_retrans_done(sk))
    797 + tp->retrans_stamp = 0;
    798 + return true;
    799 + }
    800 + return false;
    801 +}
    802 +
    803 /* People celebrate: "We love our President!" */
    804 static bool tcp_try_undo_recovery(struct sock *sk)
    805 {
    806 @@ -2488,14 +2503,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
    807
    808 NET_INC_STATS(sock_net(sk), mib_idx);
    809 }
    810 - if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
    811 - /* Hold old state until something *above* high_seq
    812 - * is ACKed. For Reno it is MUST to prevent false
    813 - * fast retransmits (RFC2582). SACK TCP is safe. */
    814 - if (!tcp_any_retrans_done(sk))
    815 - tp->retrans_stamp = 0;
    816 + if (tcp_is_non_sack_preventing_reopen(sk))
    817 return true;
    818 - }
    819 tcp_set_ca_state(sk, TCP_CA_Open);
    820 tp->is_sack_reneg = 0;
    821 return false;
    822 @@ -2529,6 +2538,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
    823 NET_INC_STATS(sock_net(sk),
    824 LINUX_MIB_TCPSPURIOUSRTOS);
    825 inet_csk(sk)->icsk_retransmits = 0;
    826 + if (tcp_is_non_sack_preventing_reopen(sk))
    827 + return true;
    828 if (frto_undo || tcp_is_sack(tp)) {
    829 tcp_set_ca_state(sk, TCP_CA_Open);
    830 tp->is_sack_reneg = 0;
    831 diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
    832 index 3796c24defcb9..61df96cd2237f 100644
    833 --- a/net/mac80211/ibss.c
    834 +++ b/net/mac80211/ibss.c
    835 @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
    836
    837 sdata_assert_lock(sdata);
    838
    839 + /* When not connected/joined, sending CSA doesn't make sense. */
    840 + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
    841 + return -ENOLINK;
    842 +
    843 /* update cfg80211 bss information with the new channel */
    844 if (!is_zero_ether_addr(ifibss->bssid)) {
    845 cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
    846 diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
    847 index 4dcf6e18563a6..060ccd0e14ce7 100644
    848 --- a/net/mac802154/rx.c
    849 +++ b/net/mac802154/rx.c
    850 @@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
    851
    852 switch (mac_cb(skb)->dest.mode) {
    853 case IEEE802154_ADDR_NONE:
    854 - if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
    855 + if (hdr->source.mode != IEEE802154_ADDR_NONE)
    856 /* FIXME: check if we are PAN coordinator */
    857 skb->pkt_type = PACKET_OTHERHOST;
    858 else
    859 diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
    860 index 1972a149f9583..c6a8bdc3a226d 100644
    861 --- a/net/netfilter/nf_conntrack_irc.c
    862 +++ b/net/netfilter/nf_conntrack_irc.c
    863 @@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    864
    865 /* dcc_ip can be the internal OR external (NAT'ed) IP */
    866 tuple = &ct->tuplehash[dir].tuple;
    867 - if (tuple->src.u3.ip != dcc_ip &&
    868 - tuple->dst.u3.ip != dcc_ip) {
    869 + if ((tuple->src.u3.ip != dcc_ip &&
    870 + ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
    871 + dcc_port == 0) {
    872 net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
    873 &tuple->src.u3.ip,
    874 &dcc_ip, dcc_port);
    875 diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
    876 index bc176bd48c026..2973d82fb21cc 100644
    877 --- a/net/sched/sch_sfb.c
    878 +++ b/net/sched/sch_sfb.c
    879 @@ -137,15 +137,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q)
    880 }
    881 }
    882
    883 -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q)
    884 +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_data *q)
    885 {
    886 u32 sfbhash;
    887
    888 - sfbhash = sfb_hash(skb, 0);
    889 + sfbhash = cb->hashes[0];
    890 if (sfbhash)
    891 increment_one_qlen(sfbhash, 0, q);
    892
    893 - sfbhash = sfb_hash(skb, 1);
    894 + sfbhash = cb->hashes[1];
    895 if (sfbhash)
    896 increment_one_qlen(sfbhash, 1, q);
    897 }
    898 @@ -281,8 +281,10 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
    899 {
    900
    901 struct sfb_sched_data *q = qdisc_priv(sch);
    902 + unsigned int len = qdisc_pkt_len(skb);
    903 struct Qdisc *child = q->qdisc;
    904 struct tcf_proto *fl;
    905 + struct sfb_skb_cb cb;
    906 int i;
    907 u32 p_min = ~0;
    908 u32 minqlen = ~0;
    909 @@ -399,11 +401,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
    910 }
    911
    912 enqueue:
    913 + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb));
    914 ret = qdisc_enqueue(skb, child, to_free);
    915 if (likely(ret == NET_XMIT_SUCCESS)) {
    916 - qdisc_qstats_backlog_inc(sch, skb);
    917 + sch->qstats.backlog += len;
    918 sch->q.qlen++;
    919 - increment_qlen(skb, q);
    920 + increment_qlen(&cb, q);
    921 } else if (net_xmit_drop_count(ret)) {
    922 q->stats.childdrop++;
    923 qdisc_qstats_drop(sch);
    924 diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
    925 index ff263ece44a73..a213ada2d265b 100644
    926 --- a/net/sunrpc/xprt.c
    927 +++ b/net/sunrpc/xprt.c
    928 @@ -1451,9 +1451,9 @@ static void xprt_destroy(struct rpc_xprt *xprt)
    929 * is cleared. We use ->transport_lock to ensure the mod_timer()
    930 * can only run *before* del_time_sync(), never after.
    931 */
    932 - spin_lock(&xprt->transport_lock);
    933 + spin_lock_bh(&xprt->transport_lock);
    934 del_timer_sync(&xprt->timer);
    935 - spin_unlock(&xprt->transport_lock);
    936 + spin_unlock_bh(&xprt->transport_lock);
    937
    938 rpc_xprt_debugfs_unregister(xprt);
    939 rpc_destroy_wait_queue(&xprt->binding);
    940 diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
    941 index e1f4538b16532..7efcbd11a907a 100644
    942 --- a/net/tipc/monitor.c
    943 +++ b/net/tipc/monitor.c
    944 @@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v)
    945
    946 static int map_get(u64 up_map, int i)
    947 {
    948 - return (up_map & (1 << i)) >> i;
    949 + return (up_map & (1ULL << i)) >> i;
    950 }
    951
    952 static struct tipc_peer *peer_prev(struct tipc_peer *peer)
    953 diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
    954 index 5d453916a4179..6a7f4432440a5 100644
    955 --- a/net/wireless/debugfs.c
    956 +++ b/net/wireless/debugfs.c
    957 @@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file,
    958 {
    959 struct wiphy *wiphy = file->private_data;
    960 char *buf;
    961 - unsigned int offset = 0, buf_size = PAGE_SIZE, i, r;
    962 + unsigned int offset = 0, buf_size = PAGE_SIZE, i;
    963 enum nl80211_band band;
    964 struct ieee80211_supported_band *sband;
    965 + ssize_t r;
    966
    967 buf = kzalloc(buf_size, GFP_KERNEL);
    968 if (!buf)
    969 diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
    970 index cdfb8f92d5545..cc8f06638edca 100644
    971 --- a/sound/core/seq/oss/seq_oss_midi.c
    972 +++ b/sound/core/seq/oss/seq_oss_midi.c
    973 @@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void)
    974 void
    975 snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp)
    976 {
    977 + spin_lock_irq(&register_lock);
    978 dp->max_mididev = max_midi_devs;
    979 + spin_unlock_irq(&register_lock);
    980 }
    981
    982 /*
    983 diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
    984 index 198eea5c8c2f0..f905783d441fa 100644
    985 --- a/sound/core/seq/seq_clientmgr.c
    986 +++ b/sound/core/seq/seq_clientmgr.c
    987 @@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
    988 spin_unlock_irqrestore(&clients_lock, flags);
    989 #ifdef CONFIG_MODULES
    990 if (!in_interrupt()) {
    991 - static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS];
    992 - static char card_requested[SNDRV_CARDS];
    993 + static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS);
    994 + static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
    995 +
    996 if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) {
    997 int idx;
    998
    999 - if (!client_requested[clientid]) {
    1000 - client_requested[clientid] = 1;
    1001 + if (!test_and_set_bit(clientid, client_requested)) {
    1002 for (idx = 0; idx < 15; idx++) {
    1003 if (seq_client_load[idx] < 0)
    1004 break;
    1005 @@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
    1006 int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) /
    1007 SNDRV_SEQ_CLIENTS_PER_CARD;
    1008 if (card < snd_ecards_limit) {
    1009 - if (! card_requested[card]) {
    1010 - card_requested[card] = 1;
    1011 + if (!test_and_set_bit(card, card_requested))
    1012 snd_request_card(card);
    1013 - }
    1014 snd_seq_device_load_drivers();
    1015 }
    1016 }
    1017 diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
    1018 index cc600aa0f6c78..fa13df5d4f5c9 100644
    1019 --- a/sound/drivers/aloop.c
    1020 +++ b/sound/drivers/aloop.c
    1021 @@ -477,17 +477,18 @@ static unsigned int loopback_pos_update(struct loopback_cable *cable)
    1022 cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
    1023 struct loopback_pcm *dpcm_capt =
    1024 cable->streams[SNDRV_PCM_STREAM_CAPTURE];
    1025 - unsigned long delta_play = 0, delta_capt = 0;
    1026 + unsigned long delta_play = 0, delta_capt = 0, cur_jiffies;
    1027 unsigned int running, count1, count2;
    1028
    1029 + cur_jiffies = jiffies;
    1030 running = cable->running ^ cable->pause;
    1031 if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) {
    1032 - delta_play = jiffies - dpcm_play->last_jiffies;
    1033 + delta_play = cur_jiffies - dpcm_play->last_jiffies;
    1034 dpcm_play->last_jiffies += delta_play;
    1035 }
    1036
    1037 if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) {
    1038 - delta_capt = jiffies - dpcm_capt->last_jiffies;
    1039 + delta_capt = cur_jiffies - dpcm_capt->last_jiffies;
    1040 dpcm_capt->last_jiffies += delta_capt;
    1041 }
    1042
    1043 diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
    1044 index 0d2bb30d9f7ed..4c555b40ee245 100644
    1045 --- a/sound/pci/emu10k1/emupcm.c
    1046 +++ b/sound/pci/emu10k1/emupcm.c
    1047 @@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc(struct snd_emu10k1_pcm * epcm, int voic
    1048 epcm->voices[0]->epcm = epcm;
    1049 if (voices > 1) {
    1050 for (i = 1; i < voices; i++) {
    1051 - epcm->voices[i] = &epcm->emu->voices[epcm->voices[0]->number + i];
    1052 + epcm->voices[i] = &epcm->emu->voices[(epcm->voices[0]->number + i) % NUM_G];
    1053 epcm->voices[i]->epcm = epcm;
    1054 }
    1055 }
    1056 diff --git a/sound/usb/stream.c b/sound/usb/stream.c
    1057 index a50718fca613d..166a88cccca91 100644
    1058 --- a/sound/usb/stream.c
    1059 +++ b/sound/usb/stream.c
    1060 @@ -502,7 +502,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
    1061 * Dallas DS4201 workaround: It presents 5 altsettings, but the last
    1062 * one misses syncpipe, and does not produce any sound.
    1063 */
    1064 - if (chip->usb_id == USB_ID(0x04fa, 0x4201))
    1065 + if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4)
    1066 num = 4;
    1067
    1068 for (i = 0; i < num; i++) {