Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.14/0157-4.14.58-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.14/0157-4.14.58-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3238 - (show annotations) (download)
    Fri Nov 9 12:14:58 2018 UTC (5 years, 5 months ago) by niro
    File size: 50455 byte(s) 
    -added up to patches-4.14.79
    1 diff --git a/Makefile b/Makefile
    2 index a44d6b2adb76..ffc9b4e3867e 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 4
    8 PATCHLEVEL = 14
    9 -SUBLEVEL = 57
    10 +SUBLEVEL = 58
    11 EXTRAVERSION =
    12 NAME = Petit Gorille
    13
    14 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
    15 index 75a5c35a2067..a48976dc9bcd 100644
    16 --- a/arch/alpha/kernel/osf_sys.c
    17 +++ b/arch/alpha/kernel/osf_sys.c
    18 @@ -1183,13 +1183,10 @@ SYSCALL_DEFINE2(osf_getrusage, int, who, struct rusage32 __user *, ru)
    19 SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
    20 struct rusage32 __user *, ur)
    21 {
    22 - unsigned int status = 0;
    23 struct rusage r;
    24 - long err = kernel_wait4(pid, &status, options, &r);
    25 + long err = kernel_wait4(pid, ustatus, options, &r);
    26 if (err <= 0)
    27 return err;
    28 - if (put_user(status, ustatus))
    29 - return -EFAULT;
    30 if (!ur)
    31 return err;
    32 if (put_tv32(&ur->ru_utime, &r.ru_utime))
    33 diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
    34 index 4383313b064a..5c8caf85c350 100644
    35 --- a/arch/arc/Kconfig
    36 +++ b/arch/arc/Kconfig
    37 @@ -408,7 +408,7 @@ config ARC_HAS_DIV_REM
    38
    39 config ARC_HAS_ACCL_REGS
    40 bool "Reg Pair ACCL:ACCH (FPU and/or MPY > 6)"
    41 - default n
    42 + default y
    43 help
    44 Depending on the configuration, CPU can contain accumulator reg-pair
    45 (also referred to as r58:r59). These can also be used by gcc as GPR so
    46 diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
    47 index ec7c849a5c8e..a8242362e551 100644
    48 --- a/arch/arc/configs/axs101_defconfig
    49 +++ b/arch/arc/configs/axs101_defconfig
    50 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    51 # CONFIG_UTS_NS is not set
    52 # CONFIG_PID_NS is not set
    53 CONFIG_BLK_DEV_INITRD=y
    54 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    55 CONFIG_EMBEDDED=y
    56 CONFIG_PERF_EVENTS=y
    57 # CONFIG_VM_EVENT_COUNTERS is not set
    58 diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
    59 index 63d3cf69e0b0..ef3c31cd7737 100644
    60 --- a/arch/arc/configs/axs103_defconfig
    61 +++ b/arch/arc/configs/axs103_defconfig
    62 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    63 # CONFIG_UTS_NS is not set
    64 # CONFIG_PID_NS is not set
    65 CONFIG_BLK_DEV_INITRD=y
    66 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    67 CONFIG_EMBEDDED=y
    68 CONFIG_PERF_EVENTS=y
    69 # CONFIG_VM_EVENT_COUNTERS is not set
    70 diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
    71 index f613ecac14a7..1757ac9cecbc 100644
    72 --- a/arch/arc/configs/axs103_smp_defconfig
    73 +++ b/arch/arc/configs/axs103_smp_defconfig
    74 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    75 # CONFIG_UTS_NS is not set
    76 # CONFIG_PID_NS is not set
    77 CONFIG_BLK_DEV_INITRD=y
    78 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    79 CONFIG_EMBEDDED=y
    80 CONFIG_PERF_EVENTS=y
    81 # CONFIG_VM_EVENT_COUNTERS is not set
    82 diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
    83 index db04ea4dd2d9..aa8240a92b60 100644
    84 --- a/arch/arc/configs/haps_hs_defconfig
    85 +++ b/arch/arc/configs/haps_hs_defconfig
    86 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    87 # CONFIG_UTS_NS is not set
    88 # CONFIG_PID_NS is not set
    89 CONFIG_BLK_DEV_INITRD=y
    90 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    91 CONFIG_EXPERT=y
    92 CONFIG_PERF_EVENTS=y
    93 # CONFIG_COMPAT_BRK is not set
    94 diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
    95 index 3507be2af6fe..bc5a24ea6cf7 100644
    96 --- a/arch/arc/configs/haps_hs_smp_defconfig
    97 +++ b/arch/arc/configs/haps_hs_smp_defconfig
    98 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    99 # CONFIG_UTS_NS is not set
    100 # CONFIG_PID_NS is not set
    101 CONFIG_BLK_DEV_INITRD=y
    102 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    103 CONFIG_EMBEDDED=y
    104 CONFIG_PERF_EVENTS=y
    105 # CONFIG_VM_EVENT_COUNTERS is not set
    106 diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
    107 index 7b8f8faf8a24..762b1fcd93dc 100644
    108 --- a/arch/arc/configs/hsdk_defconfig
    109 +++ b/arch/arc/configs/hsdk_defconfig
    110 @@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
    111 # CONFIG_UTS_NS is not set
    112 # CONFIG_PID_NS is not set
    113 CONFIG_BLK_DEV_INITRD=y
    114 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    115 CONFIG_EMBEDDED=y
    116 CONFIG_PERF_EVENTS=y
    117 # CONFIG_VM_EVENT_COUNTERS is not set
    118 diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
    119 index 6dff83a238b8..b1a78222699c 100644
    120 --- a/arch/arc/configs/nsim_700_defconfig
    121 +++ b/arch/arc/configs/nsim_700_defconfig
    122 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    123 # CONFIG_UTS_NS is not set
    124 # CONFIG_PID_NS is not set
    125 CONFIG_BLK_DEV_INITRD=y
    126 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    127 CONFIG_KALLSYMS_ALL=y
    128 CONFIG_EMBEDDED=y
    129 CONFIG_PERF_EVENTS=y
    130 diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
    131 index 31ee51b987e7..217d7ea3c956 100644
    132 --- a/arch/arc/configs/nsim_hs_defconfig
    133 +++ b/arch/arc/configs/nsim_hs_defconfig
    134 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    135 # CONFIG_UTS_NS is not set
    136 # CONFIG_PID_NS is not set
    137 CONFIG_BLK_DEV_INITRD=y
    138 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    139 CONFIG_KALLSYMS_ALL=y
    140 CONFIG_EMBEDDED=y
    141 CONFIG_PERF_EVENTS=y
    142 diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
    143 index 8d3b1f67cae4..e733e4f1a320 100644
    144 --- a/arch/arc/configs/nsim_hs_smp_defconfig
    145 +++ b/arch/arc/configs/nsim_hs_smp_defconfig
    146 @@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
    147 # CONFIG_UTS_NS is not set
    148 # CONFIG_PID_NS is not set
    149 CONFIG_BLK_DEV_INITRD=y
    150 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    151 CONFIG_KALLSYMS_ALL=y
    152 CONFIG_EMBEDDED=y
    153 CONFIG_PERF_EVENTS=y
    154 diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
    155 index 6168ce2ac2ef..14377b8234f7 100644
    156 --- a/arch/arc/configs/nsimosci_defconfig
    157 +++ b/arch/arc/configs/nsimosci_defconfig
    158 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    159 # CONFIG_UTS_NS is not set
    160 # CONFIG_PID_NS is not set
    161 CONFIG_BLK_DEV_INITRD=y
    162 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    163 CONFIG_KALLSYMS_ALL=y
    164 CONFIG_EMBEDDED=y
    165 CONFIG_PERF_EVENTS=y
    166 diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
    167 index a70bdeb2b3fd..7e61c923a3cd 100644
    168 --- a/arch/arc/configs/nsimosci_hs_defconfig
    169 +++ b/arch/arc/configs/nsimosci_hs_defconfig
    170 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    171 # CONFIG_UTS_NS is not set
    172 # CONFIG_PID_NS is not set
    173 CONFIG_BLK_DEV_INITRD=y
    174 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    175 CONFIG_KALLSYMS_ALL=y
    176 CONFIG_EMBEDDED=y
    177 CONFIG_PERF_EVENTS=y
    178 diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
    179 index ef96406c446e..299fbe8003b2 100644
    180 --- a/arch/arc/configs/nsimosci_hs_smp_defconfig
    181 +++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
    182 @@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y
    183 # CONFIG_UTS_NS is not set
    184 # CONFIG_PID_NS is not set
    185 CONFIG_BLK_DEV_INITRD=y
    186 -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    187 CONFIG_PERF_EVENTS=y
    188 # CONFIG_COMPAT_BRK is not set
    189 CONFIG_KPROBES=y
    190 diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
    191 index 109baa06831c..09ddddf71cc5 100644
    192 --- a/arch/arc/include/asm/page.h
    193 +++ b/arch/arc/include/asm/page.h
    194 @@ -105,7 +105,7 @@ typedef pte_t * pgtable_t;
    195 #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr))
    196
    197 /* Default Permissions for stack/heaps pages (Non Executable) */
    198 -#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE)
    199 +#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
    200
    201 #define WANT_PAGE_VIRTUAL 1
    202
    203 diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
    204 index 08fe33830d4b..77676e18da69 100644
    205 --- a/arch/arc/include/asm/pgtable.h
    206 +++ b/arch/arc/include/asm/pgtable.h
    207 @@ -379,7 +379,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address,
    208
    209 /* Decode a PTE containing swap "identifier "into constituents */
    210 #define __swp_type(pte_lookalike) (((pte_lookalike).val) & 0x1f)
    211 -#define __swp_offset(pte_lookalike) ((pte_lookalike).val << 13)
    212 +#define __swp_offset(pte_lookalike) ((pte_lookalike).val >> 13)
    213
    214 /* NOPs, to keep generic kernel happy */
    215 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
    216 diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
    217 index 19ab3cf98f0f..fcc9a9e27e9c 100644
    218 --- a/arch/arc/plat-hsdk/Kconfig
    219 +++ b/arch/arc/plat-hsdk/Kconfig
    220 @@ -7,5 +7,7 @@
    221
    222 menuconfig ARC_SOC_HSDK
    223 bool "ARC HS Development Kit SOC"
    224 + depends on ISA_ARCV2
    225 + select ARC_HAS_ACCL_REGS
    226 select CLK_HSDK
    227 select RESET_HSDK
    228 diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
    229 index e35cebd45c35..4efbde0984b2 100644
    230 --- a/arch/powerpc/kernel/idle_book3s.S
    231 +++ b/arch/powerpc/kernel/idle_book3s.S
    232 @@ -140,6 +140,8 @@ power9_restore_additional_sprs:
    233 ld r4, STOP_MMCR2(r13)
    234 mtspr SPRN_MMCR1, r3
    235 mtspr SPRN_MMCR2, r4
    236 + ld r4, PACA_SPRG_VDSO(r13)
    237 + mtspr SPRN_SPRG3, r4
    238 blr
    239
    240 /*
    241 diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
    242 index 10b39d44981c..25386be0d757 100644
    243 --- a/arch/x86/events/intel/ds.c
    244 +++ b/arch/x86/events/intel/ds.c
    245 @@ -410,9 +410,11 @@ static int alloc_bts_buffer(int cpu)
    246 ds->bts_buffer_base = (unsigned long) cea;
    247 ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL);
    248 ds->bts_index = ds->bts_buffer_base;
    249 - max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE);
    250 - ds->bts_absolute_maximum = ds->bts_buffer_base + max;
    251 - ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16);
    252 + max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE;
    253 + ds->bts_absolute_maximum = ds->bts_buffer_base +
    254 + max * BTS_RECORD_SIZE;
    255 + ds->bts_interrupt_threshold = ds->bts_absolute_maximum -
    256 + (max / 16) * BTS_RECORD_SIZE;
    257 return 0;
    258 }
    259
    260 diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
    261 index c356098b6fb9..4d4015ddcf26 100644
    262 --- a/arch/x86/include/asm/apm.h
    263 +++ b/arch/x86/include/asm/apm.h
    264 @@ -7,8 +7,6 @@
    265 #ifndef _ASM_X86_MACH_DEFAULT_APM_H
    266 #define _ASM_X86_MACH_DEFAULT_APM_H
    267
    268 -#include <asm/nospec-branch.h>
    269 -
    270 #ifdef APM_ZERO_SEGS
    271 # define APM_DO_ZERO_SEGS \
    272 "pushl %%ds\n\t" \
    273 @@ -34,7 +32,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
    274 * N.B. We do NOT need a cld after the BIOS call
    275 * because we always save and restore the flags.
    276 */
    277 - firmware_restrict_branch_speculation_start();
    278 __asm__ __volatile__(APM_DO_ZERO_SEGS
    279 "pushl %%edi\n\t"
    280 "pushl %%ebp\n\t"
    281 @@ -47,7 +44,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
    282 "=S" (*esi)
    283 : "a" (func), "b" (ebx_in), "c" (ecx_in)
    284 : "memory", "cc");
    285 - firmware_restrict_branch_speculation_end();
    286 }
    287
    288 static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    289 @@ -60,7 +56,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    290 * N.B. We do NOT need a cld after the BIOS call
    291 * because we always save and restore the flags.
    292 */
    293 - firmware_restrict_branch_speculation_start();
    294 __asm__ __volatile__(APM_DO_ZERO_SEGS
    295 "pushl %%edi\n\t"
    296 "pushl %%ebp\n\t"
    297 @@ -73,7 +68,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    298 "=S" (si)
    299 : "a" (func), "b" (ebx_in), "c" (ecx_in)
    300 : "memory", "cc");
    301 - firmware_restrict_branch_speculation_end();
    302 return error;
    303 }
    304
    305 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
    306 index 2a7fd56e67b3..63d3e6a6b5ef 100644
    307 --- a/arch/x86/kernel/apm_32.c
    308 +++ b/arch/x86/kernel/apm_32.c
    309 @@ -240,6 +240,7 @@
    310 #include <asm/olpc.h>
    311 #include <asm/paravirt.h>
    312 #include <asm/reboot.h>
    313 +#include <asm/nospec-branch.h>
    314
    315 #if defined(CONFIG_APM_DISPLAY_BLANK) && defined(CONFIG_VT)
    316 extern int (*console_blank_hook)(int);
    317 @@ -614,11 +615,13 @@ static long __apm_bios_call(void *_call)
    318 gdt[0x40 / 8] = bad_bios_desc;
    319
    320 apm_irq_save(flags);
    321 + firmware_restrict_branch_speculation_start();
    322 APM_DO_SAVE_SEGS;
    323 apm_bios_call_asm(call->func, call->ebx, call->ecx,
    324 &call->eax, &call->ebx, &call->ecx, &call->edx,
    325 &call->esi);
    326 APM_DO_RESTORE_SEGS;
    327 + firmware_restrict_branch_speculation_end();
    328 apm_irq_restore(flags);
    329 gdt[0x40 / 8] = save_desc_40;
    330 put_cpu();
    331 @@ -690,10 +693,12 @@ static long __apm_bios_call_simple(void *_call)
    332 gdt[0x40 / 8] = bad_bios_desc;
    333
    334 apm_irq_save(flags);
    335 + firmware_restrict_branch_speculation_start();
    336 APM_DO_SAVE_SEGS;
    337 error = apm_bios_call_simple_asm(call->func, call->ebx, call->ecx,
    338 &call->eax);
    339 APM_DO_RESTORE_SEGS;
    340 + firmware_restrict_branch_speculation_end();
    341 apm_irq_restore(flags);
    342 gdt[0x40 / 8] = save_desc_40;
    343 put_cpu();
    344 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
    345 index 58f887f5e036..98e4e4dc4a3b 100644
    346 --- a/arch/x86/kernel/cpu/mcheck/mce.c
    347 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
    348 @@ -2150,9 +2150,6 @@ static ssize_t store_int_with_restart(struct device *s,
    349 if (check_interval == old_check_interval)
    350 return ret;
    351
    352 - if (check_interval < 1)
    353 - check_interval = 1;
    354 -
    355 mutex_lock(&mce_sysfs_mutex);
    356 mce_restart();
    357 mutex_unlock(&mce_sysfs_mutex);
    358 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
    359 index a905bbb45667..114dfe67015b 100644
    360 --- a/drivers/cpufreq/intel_pstate.c
    361 +++ b/drivers/cpufreq/intel_pstate.c
    362 @@ -2188,6 +2188,18 @@ static bool __init intel_pstate_no_acpi_pss(void)
    363 return true;
    364 }
    365
    366 +static bool __init intel_pstate_no_acpi_pcch(void)
    367 +{
    368 + acpi_status status;
    369 + acpi_handle handle;
    370 +
    371 + status = acpi_get_handle(NULL, "\\_SB", &handle);
    372 + if (ACPI_FAILURE(status))
    373 + return true;
    374 +
    375 + return !acpi_has_method(handle, "PCCH");
    376 +}
    377 +
    378 static bool __init intel_pstate_has_acpi_ppc(void)
    379 {
    380 int i;
    381 @@ -2247,7 +2259,10 @@ static bool __init intel_pstate_platform_pwr_mgmt_exists(void)
    382
    383 switch (plat_info[idx].data) {
    384 case PSS:
    385 - return intel_pstate_no_acpi_pss();
    386 + if (!intel_pstate_no_acpi_pss())
    387 + return false;
    388 +
    389 + return intel_pstate_no_acpi_pcch();
    390 case PPC:
    391 return intel_pstate_has_acpi_ppc() && !force_load;
    392 }
    393 diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
    394 index 3f0ce2ae35ee..0c56c9759672 100644
    395 --- a/drivers/cpufreq/pcc-cpufreq.c
    396 +++ b/drivers/cpufreq/pcc-cpufreq.c
    397 @@ -580,6 +580,10 @@ static int __init pcc_cpufreq_init(void)
    398 {
    399 int ret;
    400
    401 + /* Skip initialization if another cpufreq driver is there. */
    402 + if (cpufreq_get_current_driver())
    403 + return 0;
    404 +
    405 if (acpi_disabled)
    406 return 0;
    407
    408 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
    409 index b63893eeca73..20a471ad0ad2 100644
    410 --- a/drivers/gpu/drm/i915/i915_irq.c
    411 +++ b/drivers/gpu/drm/i915/i915_irq.c
    412 @@ -1786,10 +1786,38 @@ static void valleyview_pipestat_irq_handler(struct drm_i915_private *dev_priv,
    413
    414 static u32 i9xx_hpd_irq_ack(struct drm_i915_private *dev_priv)
    415 {
    416 - u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
    417 + u32 hotplug_status = 0, hotplug_status_mask;
    418 + int i;
    419 +
    420 + if (IS_G4X(dev_priv) ||
    421 + IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
    422 + hotplug_status_mask = HOTPLUG_INT_STATUS_G4X |
    423 + DP_AUX_CHANNEL_MASK_INT_STATUS_G4X;
    424 + else
    425 + hotplug_status_mask = HOTPLUG_INT_STATUS_I915;
    426
    427 - if (hotplug_status)
    428 + /*
    429 + * We absolutely have to clear all the pending interrupt
    430 + * bits in PORT_HOTPLUG_STAT. Otherwise the ISR port
    431 + * interrupt bit won't have an edge, and the i965/g4x
    432 + * edge triggered IIR will not notice that an interrupt
    433 + * is still pending. We can't use PORT_HOTPLUG_EN to
    434 + * guarantee the edge as the act of toggling the enable
    435 + * bits can itself generate a new hotplug interrupt :(
    436 + */
    437 + for (i = 0; i < 10; i++) {
    438 + u32 tmp = I915_READ(PORT_HOTPLUG_STAT) & hotplug_status_mask;
    439 +
    440 + if (tmp == 0)
    441 + return hotplug_status;
    442 +
    443 + hotplug_status |= tmp;
    444 I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
    445 + }
    446 +
    447 + WARN_ONCE(1,
    448 + "PORT_HOTPLUG_STAT did not clear (0x%08x)\n",
    449 + I915_READ(PORT_HOTPLUG_STAT));
    450
    451 return hotplug_status;
    452 }
    453 diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
    454 index debbbf0fd4bd..408b955e5c39 100644
    455 --- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
    456 +++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
    457 @@ -267,6 +267,7 @@ nouveau_backlight_init(struct drm_device *dev)
    458 struct nouveau_drm *drm = nouveau_drm(dev);
    459 struct nvif_device *device = &drm->client.device;
    460 struct drm_connector *connector;
    461 + struct drm_connector_list_iter conn_iter;
    462
    463 INIT_LIST_HEAD(&drm->bl_connectors);
    464
    465 @@ -275,7 +276,8 @@ nouveau_backlight_init(struct drm_device *dev)
    466 return 0;
    467 }
    468
    469 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    470 + drm_connector_list_iter_begin(dev, &conn_iter);
    471 + drm_for_each_connector_iter(connector, &conn_iter) {
    472 if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
    473 connector->connector_type != DRM_MODE_CONNECTOR_eDP)
    474 continue;
    475 @@ -292,7 +294,7 @@ nouveau_backlight_init(struct drm_device *dev)
    476 break;
    477 }
    478 }
    479 -
    480 + drm_connector_list_iter_end(&conn_iter);
    481
    482 return 0;
    483 }
    484 diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
    485 index c902a851eb51..430830d63a33 100644
    486 --- a/drivers/gpu/drm/nouveau/nouveau_connector.c
    487 +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
    488 @@ -1208,14 +1208,19 @@ nouveau_connector_create(struct drm_device *dev, int index)
    489 struct nouveau_display *disp = nouveau_display(dev);
    490 struct nouveau_connector *nv_connector = NULL;
    491 struct drm_connector *connector;
    492 + struct drm_connector_list_iter conn_iter;
    493 int type, ret = 0;
    494 bool dummy;
    495
    496 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    497 + drm_connector_list_iter_begin(dev, &conn_iter);
    498 + nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
    499 nv_connector = nouveau_connector(connector);
    500 - if (nv_connector->index == index)
    501 + if (nv_connector->index == index) {
    502 + drm_connector_list_iter_end(&conn_iter);
    503 return connector;
    504 + }
    505 }
    506 + drm_connector_list_iter_end(&conn_iter);
    507
    508 nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL);
    509 if (!nv_connector)
    510 diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
    511 index a4d1a059bd3d..dc7454e7f19a 100644
    512 --- a/drivers/gpu/drm/nouveau/nouveau_connector.h
    513 +++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
    514 @@ -33,6 +33,7 @@
    515 #include <drm/drm_encoder.h>
    516 #include <drm/drm_dp_helper.h>
    517 #include "nouveau_crtc.h"
    518 +#include "nouveau_encoder.h"
    519
    520 struct nvkm_i2c_port;
    521
    522 @@ -60,19 +61,46 @@ static inline struct nouveau_connector *nouveau_connector(
    523 return container_of(con, struct nouveau_connector, base);
    524 }
    525
    526 +static inline bool
    527 +nouveau_connector_is_mst(struct drm_connector *connector)
    528 +{
    529 + const struct nouveau_encoder *nv_encoder;
    530 + const struct drm_encoder *encoder;
    531 +
    532 + if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
    533 + return false;
    534 +
    535 + nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY);
    536 + if (!nv_encoder)
    537 + return false;
    538 +
    539 + encoder = &nv_encoder->base.base;
    540 + return encoder->encoder_type == DRM_MODE_ENCODER_DPMST;
    541 +}
    542 +
    543 +#define nouveau_for_each_non_mst_connector_iter(connector, iter) \
    544 + drm_for_each_connector_iter(connector, iter) \
    545 + for_each_if(!nouveau_connector_is_mst(connector))
    546 +
    547 static inline struct nouveau_connector *
    548 nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
    549 {
    550 struct drm_device *dev = nv_crtc->base.dev;
    551 struct drm_connector *connector;
    552 + struct drm_connector_list_iter conn_iter;
    553 + struct nouveau_connector *nv_connector = NULL;
    554 struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
    555
    556 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    557 - if (connector->encoder && connector->encoder->crtc == crtc)
    558 - return nouveau_connector(connector);
    559 + drm_connector_list_iter_begin(dev, &conn_iter);
    560 + nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
    561 + if (connector->encoder && connector->encoder->crtc == crtc) {
    562 + nv_connector = nouveau_connector(connector);
    563 + break;
    564 + }
    565 }
    566 + drm_connector_list_iter_end(&conn_iter);
    567
    568 - return NULL;
    569 + return nv_connector;
    570 }
    571
    572 struct drm_connector *
    573 diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    574 index 2e7785f49e6d..caf53503c0f7 100644
    575 --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    576 +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    577 @@ -405,6 +405,7 @@ nouveau_display_init(struct drm_device *dev)
    578 struct nouveau_display *disp = nouveau_display(dev);
    579 struct nouveau_drm *drm = nouveau_drm(dev);
    580 struct drm_connector *connector;
    581 + struct drm_connector_list_iter conn_iter;
    582 int ret;
    583
    584 ret = disp->init(dev);
    585 @@ -412,10 +413,12 @@ nouveau_display_init(struct drm_device *dev)
    586 return ret;
    587
    588 /* enable hotplug interrupts */
    589 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    590 + drm_connector_list_iter_begin(dev, &conn_iter);
    591 + nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
    592 struct nouveau_connector *conn = nouveau_connector(connector);
    593 nvif_notify_get(&conn->hpd);
    594 }
    595 + drm_connector_list_iter_end(&conn_iter);
    596
    597 /* enable flip completion events */
    598 nvif_notify_get(&drm->flip);
    599 @@ -428,6 +431,7 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
    600 struct nouveau_display *disp = nouveau_display(dev);
    601 struct nouveau_drm *drm = nouveau_drm(dev);
    602 struct drm_connector *connector;
    603 + struct drm_connector_list_iter conn_iter;
    604
    605 if (!suspend) {
    606 if (drm_drv_uses_atomic_modeset(dev))
    607 @@ -440,10 +444,12 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
    608 nvif_notify_put(&drm->flip);
    609
    610 /* disable hotplug interrupts */
    611 - list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    612 + drm_connector_list_iter_begin(dev, &conn_iter);
    613 + nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
    614 struct nouveau_connector *conn = nouveau_connector(connector);
    615 nvif_notify_put(&conn->hpd);
    616 }
    617 + drm_connector_list_iter_end(&conn_iter);
    618
    619 drm_kms_helper_poll_disable(dev);
    620 disp->fini(dev);
    621 diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
    622 index a0c44d16bf30..c75daba57fd7 100644
    623 --- a/drivers/misc/cxl/api.c
    624 +++ b/drivers/misc/cxl/api.c
    625 @@ -102,15 +102,15 @@ static struct file *cxl_getfile(const char *name,
    626 d_instantiate(path.dentry, inode);
    627
    628 file = alloc_file(&path, OPEN_FMODE(flags), fops);
    629 - if (IS_ERR(file))
    630 - goto err_dput;
    631 + if (IS_ERR(file)) {
    632 + path_put(&path);
    633 + goto err_fs;
    634 + }
    635 file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
    636 file->private_data = priv;
    637
    638 return file;
    639
    640 -err_dput:
    641 - path_put(&path);
    642 err_inode:
    643 iput(inode);
    644 err_fs:
    645 diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
    646 index 1e856e8b9a92..0fff2432ab4c 100644
    647 --- a/drivers/net/ethernet/broadcom/bcmsysport.c
    648 +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
    649 @@ -1851,8 +1851,8 @@ static int bcm_sysport_open(struct net_device *dev)
    650 if (!priv->is_lite)
    651 priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
    652 else
    653 - priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
    654 - GIB_FCS_STRIP);
    655 + priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
    656 + GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
    657
    658 phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
    659 0, priv->phy_interface);
    660 diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
    661 index a2006f5fc26f..86ae751ccb5c 100644
    662 --- a/drivers/net/ethernet/broadcom/bcmsysport.h
    663 +++ b/drivers/net/ethernet/broadcom/bcmsysport.h
    664 @@ -277,7 +277,8 @@ struct bcm_rsb {
    665 #define GIB_GTX_CLK_EXT_CLK (0 << GIB_GTX_CLK_SEL_SHIFT)
    666 #define GIB_GTX_CLK_125MHZ (1 << GIB_GTX_CLK_SEL_SHIFT)
    667 #define GIB_GTX_CLK_250MHZ (2 << GIB_GTX_CLK_SEL_SHIFT)
    668 -#define GIB_FCS_STRIP (1 << 6)
    669 +#define GIB_FCS_STRIP_SHIFT 6
    670 +#define GIB_FCS_STRIP (1 << GIB_FCS_STRIP_SHIFT)
    671 #define GIB_LCL_LOOP_EN (1 << 7)
    672 #define GIB_LCL_LOOP_TXEN (1 << 8)
    673 #define GIB_RMT_LOOP_EN (1 << 9)
    674 diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    675 index 9a8ef630466f..1b1d2a67f412 100644
    676 --- a/drivers/net/ethernet/broadcom/tg3.c
    677 +++ b/drivers/net/ethernet/broadcom/tg3.c
    678 @@ -9279,6 +9279,15 @@ static int tg3_chip_reset(struct tg3 *tp)
    679
    680 tg3_restore_clk(tp);
    681
    682 + /* Increase the core clock speed to fix tx timeout issue for 5762
    683 + * with 100Mbps link speed.
    684 + */
    685 + if (tg3_asic_rev(tp) == ASIC_REV_5762) {
    686 + val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
    687 + tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
    688 + TG3_CPMU_MAC_ORIDE_ENABLE);
    689 + }
    690 +
    691 /* Reprobe ASF enable state. */
    692 tg3_flag_clear(tp, ENABLE_ASF);
    693 tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
    694 diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
    695 index b97a55c827eb..ab2a9dbb46c7 100644
    696 --- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
    697 +++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
    698 @@ -472,10 +472,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
    699 {
    700 const struct mlx4_en_frag_info *frag_info = priv->frag_info;
    701 unsigned int truesize = 0;
    702 + bool release = true;
    703 int nr, frag_size;
    704 struct page *page;
    705 dma_addr_t dma;
    706 - bool release;
    707
    708 /* Collect used fragments while replacing them in the HW descriptors */
    709 for (nr = 0;; frags++) {
    710 @@ -498,7 +498,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
    711 release = page_count(page) != 1 ||
    712 page_is_pfmemalloc(page) ||
    713 page_to_nid(page) != numa_mem_id();
    714 - } else {
    715 + } else if (!priv->rx_headroom) {
    716 + /* rx_headroom for non XDP setup is always 0.
    717 + * When XDP is set, the above condition will
    718 + * guarantee page is always released.
    719 + */
    720 u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
    721
    722 frags->page_offset += sz_align;
    723 diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
    724 index 701be5d81062..806239b89990 100644
    725 --- a/drivers/net/hyperv/netvsc.c
    726 +++ b/drivers/net/hyperv/netvsc.c
    727 @@ -1250,6 +1250,7 @@ int netvsc_poll(struct napi_struct *napi, int budget)
    728 struct hv_device *device = netvsc_channel_to_device(channel);
    729 struct net_device *ndev = hv_get_drvdata(device);
    730 int work_done = 0;
    731 + int ret;
    732
    733 /* If starting a new interval */
    734 if (!nvchan->desc)
    735 @@ -1261,16 +1262,18 @@ int netvsc_poll(struct napi_struct *napi, int budget)
    736 nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
    737 }
    738
    739 - /* If send of pending receive completions suceeded
    740 - * and did not exhaust NAPI budget this time
    741 - * and not doing busy poll
    742 + /* Send any pending receive completions */
    743 + ret = send_recv_completions(ndev, net_device, nvchan);
    744 +
    745 + /* If it did not exhaust NAPI budget this time
    746 + * and not doing busy poll
    747 * then re-enable host interrupts
    748 - * and reschedule if ring is not empty.
    749 + * and reschedule if ring is not empty
    750 + * or sending receive completion failed.
    751 */
    752 - if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
    753 - work_done < budget &&
    754 + if (work_done < budget &&
    755 napi_complete_done(napi, work_done) &&
    756 - hv_end_read(&channel->inbound) &&
    757 + (ret || hv_end_read(&channel->inbound)) &&
    758 napi_schedule_prep(napi)) {
    759 hv_begin_read(&channel->inbound);
    760 __napi_schedule(napi);
    761 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
    762 index a1e7ea4d4b16..a174d05a9752 100644
    763 --- a/drivers/net/phy/phy_device.c
    764 +++ b/drivers/net/phy/phy_device.c
    765 @@ -1686,11 +1686,8 @@ EXPORT_SYMBOL(genphy_loopback);
    766
    767 static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
    768 {
    769 - /* The default values for phydev->supported are provided by the PHY
    770 - * driver "features" member, we want to reset to sane defaults first
    771 - * before supporting higher speeds.
    772 - */
    773 - phydev->supported &= PHY_DEFAULT_FEATURES;
    774 + phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
    775 + PHY_10BT_FEATURES);
    776
    777 switch (max_speed) {
    778 default:
    779 diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
    780 index 3d4f7959dabb..b1b3d8f7e67d 100644
    781 --- a/drivers/net/usb/asix_devices.c
    782 +++ b/drivers/net/usb/asix_devices.c
    783 @@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
    784 priv->presvd_phy_advertise);
    785
    786 /* Restore BMCR */
    787 + if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
    788 + priv->presvd_phy_bmcr |= BMCR_ANRESTART;
    789 +
    790 asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
    791 priv->presvd_phy_bmcr);
    792
    793 - mii_nway_restart(&dev->mii);
    794 priv->presvd_phy_advertise = 0;
    795 priv->presvd_phy_bmcr = 0;
    796 }
    797 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    798 index 0db500bf86d9..6d3811c869fd 100644
    799 --- a/drivers/net/usb/qmi_wwan.c
    800 +++ b/drivers/net/usb/qmi_wwan.c
    801 @@ -1252,6 +1252,7 @@ static const struct usb_device_id products[] = {
    802 {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */
    803 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
    804 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
    805 + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
    806 {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
    807 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
    808
    809 diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
    810 index 58a97d420572..51364621f77c 100644
    811 --- a/drivers/ptp/ptp_chardev.c
    812 +++ b/drivers/ptp/ptp_chardev.c
    813 @@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
    814 case PTP_PF_PHYSYNC:
    815 if (chan != 0)
    816 return -EINVAL;
    817 + break;
    818 default:
    819 return -EINVAL;
    820 }
    821 diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
    822 index ea9e1e0ed5b8..f4944dde6c8e 100644
    823 --- a/drivers/scsi/sd_zbc.c
    824 +++ b/drivers/scsi/sd_zbc.c
    825 @@ -430,7 +430,8 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp,
    826 * Check that all zones of the device are equal. The last zone can however
    827 * be smaller. The zone size must also be a power of two number of LBAs.
    828 *
    829 - * Returns the zone size in bytes upon success or an error code upon failure.
    830 + * Returns the zone size in number of blocks upon success or an error code
    831 + * upon failure.
    832 */
    833 static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
    834 {
    835 @@ -440,7 +441,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
    836 unsigned char *rec;
    837 unsigned int buf_len;
    838 unsigned int list_length;
    839 - int ret;
    840 + s64 ret;
    841 u8 same;
    842
    843 /* Get a buffer */
    844 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    845 index e5bccc6d49cf..fe84b36627ec 100644
    846 --- a/drivers/usb/host/xhci.c
    847 +++ b/drivers/usb/host/xhci.c
    848 @@ -856,6 +856,41 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
    849 spin_unlock_irqrestore(&xhci->lock, flags);
    850 }
    851
    852 +static bool xhci_pending_portevent(struct xhci_hcd *xhci)
    853 +{
    854 + __le32 __iomem **port_array;
    855 + int port_index;
    856 + u32 status;
    857 + u32 portsc;
    858 +
    859 + status = readl(&xhci->op_regs->status);
    860 + if (status & STS_EINT)
    861 + return true;
    862 + /*
    863 + * Checking STS_EINT is not enough as there is a lag between a change
    864 + * bit being set and the Port Status Change Event that it generated
    865 + * being written to the Event Ring. See note in xhci 1.1 section 4.19.2.
    866 + */
    867 +
    868 + port_index = xhci->num_usb2_ports;
    869 + port_array = xhci->usb2_ports;
    870 + while (port_index--) {
    871 + portsc = readl(port_array[port_index]);
    872 + if (portsc & PORT_CHANGE_MASK ||
    873 + (portsc & PORT_PLS_MASK) == XDEV_RESUME)
    874 + return true;
    875 + }
    876 + port_index = xhci->num_usb3_ports;
    877 + port_array = xhci->usb3_ports;
    878 + while (port_index--) {
    879 + portsc = readl(port_array[port_index]);
    880 + if (portsc & PORT_CHANGE_MASK ||
    881 + (portsc & PORT_PLS_MASK) == XDEV_RESUME)
    882 + return true;
    883 + }
    884 + return false;
    885 +}
    886 +
    887 /*
    888 * Stop HC (not bus-specific)
    889 *
    890 @@ -955,7 +990,7 @@ EXPORT_SYMBOL_GPL(xhci_suspend);
    891 */
    892 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    893 {
    894 - u32 command, temp = 0, status;
    895 + u32 command, temp = 0;
    896 struct usb_hcd *hcd = xhci_to_hcd(xhci);
    897 struct usb_hcd *secondary_hcd;
    898 int retval = 0;
    899 @@ -1077,8 +1112,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    900 done:
    901 if (retval == 0) {
    902 /* Resume root hubs only when have pending events. */
    903 - status = readl(&xhci->op_regs->status);
    904 - if (status & STS_EINT) {
    905 + if (xhci_pending_portevent(xhci)) {
    906 usb_hcd_resume_root_hub(xhci->shared_hcd);
    907 usb_hcd_resume_root_hub(hcd);
    908 }
    909 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    910 index 2a72060dda1b..11232e62b898 100644
    911 --- a/drivers/usb/host/xhci.h
    912 +++ b/drivers/usb/host/xhci.h
    913 @@ -392,6 +392,10 @@ struct xhci_op_regs {
    914 #define PORT_PLC (1 << 22)
    915 /* port configure error change - port failed to configure its link partner */
    916 #define PORT_CEC (1 << 23)
    917 +#define PORT_CHANGE_MASK (PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
    918 + PORT_RC | PORT_PLC | PORT_CEC)
    919 +
    920 +
    921 /* Cold Attach Status - xHC can set this bit to report device attached during
    922 * Sx state. Warm port reset should be perfomed to clear this bit and move port
    923 * to connected state.
    924 diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
    925 index f041b1a6cf66..695b9d1a1aae 100644
    926 --- a/drivers/vfio/pci/vfio_pci.c
    927 +++ b/drivers/vfio/pci/vfio_pci.c
    928 @@ -28,6 +28,7 @@
    929 #include <linux/uaccess.h>
    930 #include <linux/vfio.h>
    931 #include <linux/vgaarb.h>
    932 +#include <linux/nospec.h>
    933
    934 #include "vfio_pci_private.h"
    935
    936 @@ -746,6 +747,9 @@ static long vfio_pci_ioctl(void *device_data,
    937 if (info.index >=
    938 VFIO_PCI_NUM_REGIONS + vdev->num_regions)
    939 return -EINVAL;
    940 + info.index = array_index_nospec(info.index,
    941 + VFIO_PCI_NUM_REGIONS +
    942 + vdev->num_regions);
    943
    944 i = info.index - VFIO_PCI_NUM_REGIONS;
    945
    946 diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
    947 index 63112c36ab2d..b751dd60e41a 100644
    948 --- a/drivers/vfio/vfio_iommu_spapr_tce.c
    949 +++ b/drivers/vfio/vfio_iommu_spapr_tce.c
    950 @@ -457,13 +457,13 @@ static void tce_iommu_unuse_page(struct tce_container *container,
    951 }
    952
    953 static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container,
    954 - unsigned long tce, unsigned long size,
    955 + unsigned long tce, unsigned long shift,
    956 unsigned long *phpa, struct mm_iommu_table_group_mem_t **pmem)
    957 {
    958 long ret = 0;
    959 struct mm_iommu_table_group_mem_t *mem;
    960
    961 - mem = mm_iommu_lookup(container->mm, tce, size);
    962 + mem = mm_iommu_lookup(container->mm, tce, 1ULL << shift);
    963 if (!mem)
    964 return -EINVAL;
    965
    966 @@ -487,7 +487,7 @@ static void tce_iommu_unuse_page_v2(struct tce_container *container,
    967 if (!pua)
    968 return;
    969
    970 - ret = tce_iommu_prereg_ua_to_hpa(container, *pua, IOMMU_PAGE_SIZE(tbl),
    971 + ret = tce_iommu_prereg_ua_to_hpa(container, *pua, tbl->it_page_shift,
    972 &hpa, &mem);
    973 if (ret)
    974 pr_debug("%s: tce %lx at #%lx was not cached, ret=%d\n",
    975 @@ -609,7 +609,7 @@ static long tce_iommu_build_v2(struct tce_container *container,
    976 entry + i);
    977
    978 ret = tce_iommu_prereg_ua_to_hpa(container,
    979 - tce, IOMMU_PAGE_SIZE(tbl), &hpa, &mem);
    980 + tce, tbl->it_page_shift, &hpa, &mem);
    981 if (ret)
    982 break;
    983
    984 diff --git a/fs/fat/inode.c b/fs/fat/inode.c
    985 index c7a4dee206b9..3b40937b942a 100644
    986 --- a/fs/fat/inode.c
    987 +++ b/fs/fat/inode.c
    988 @@ -696,13 +696,21 @@ static void fat_set_state(struct super_block *sb,
    989 brelse(bh);
    990 }
    991
    992 +static void fat_reset_iocharset(struct fat_mount_options *opts)
    993 +{
    994 + if (opts->iocharset != fat_default_iocharset) {
    995 + /* Note: opts->iocharset can be NULL here */
    996 + kfree(opts->iocharset);
    997 + opts->iocharset = fat_default_iocharset;
    998 + }
    999 +}
    1000 +
    1001 static void delayed_free(struct rcu_head *p)
    1002 {
    1003 struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
    1004 unload_nls(sbi->nls_disk);
    1005 unload_nls(sbi->nls_io);
    1006 - if (sbi->options.iocharset != fat_default_iocharset)
    1007 - kfree(sbi->options.iocharset);
    1008 + fat_reset_iocharset(&sbi->options);
    1009 kfree(sbi);
    1010 }
    1011
    1012 @@ -1117,7 +1125,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
    1013 opts->fs_fmask = opts->fs_dmask = current_umask();
    1014 opts->allow_utime = -1;
    1015 opts->codepage = fat_default_codepage;
    1016 - opts->iocharset = fat_default_iocharset;
    1017 + fat_reset_iocharset(opts);
    1018 if (is_vfat) {
    1019 opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
    1020 opts->rodir = 0;
    1021 @@ -1274,8 +1282,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
    1022
    1023 /* vfat specific */
    1024 case Opt_charset:
    1025 - if (opts->iocharset != fat_default_iocharset)
    1026 - kfree(opts->iocharset);
    1027 + fat_reset_iocharset(opts);
    1028 iocharset = match_strdup(&args[0]);
    1029 if (!iocharset)
    1030 return -ENOMEM;
    1031 @@ -1866,8 +1873,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
    1032 iput(fat_inode);
    1033 unload_nls(sbi->nls_io);
    1034 unload_nls(sbi->nls_disk);
    1035 - if (sbi->options.iocharset != fat_default_iocharset)
    1036 - kfree(sbi->options.iocharset);
    1037 + fat_reset_iocharset(&sbi->options);
    1038 sb->s_fs_info = NULL;
    1039 kfree(sbi);
    1040 return error;
    1041 diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
    1042 index 05b8650f06f5..a74ec619ac51 100644
    1043 --- a/include/linux/sched/task.h
    1044 +++ b/include/linux/sched/task.h
    1045 @@ -75,7 +75,7 @@ extern long _do_fork(unsigned long, unsigned long, unsigned long, int __user *,
    1046 extern long do_fork(unsigned long, unsigned long, unsigned long, int __user *, int __user *);
    1047 struct task_struct *fork_idle(int);
    1048 extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
    1049 -extern long kernel_wait4(pid_t, int *, int, struct rusage *);
    1050 +extern long kernel_wait4(pid_t, int __user *, int, struct rusage *);
    1051
    1052 extern void free_task(struct task_struct *tsk);
    1053
    1054 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    1055 index be45224b01d7..9cf971c68401 100644
    1056 --- a/include/linux/skbuff.h
    1057 +++ b/include/linux/skbuff.h
    1058 @@ -624,6 +624,7 @@ typedef unsigned char *sk_buff_data_t;
    1059 * @hash: the packet hash
    1060 * @queue_mapping: Queue mapping for multiqueue devices
    1061 * @xmit_more: More SKBs are pending for this queue
    1062 + * @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
    1063 * @ndisc_nodetype: router type (from link layer)
    1064 * @ooo_okay: allow the mapping of a socket to a queue to be changed
    1065 * @l4_hash: indicate hash is a canonical 4-tuple hash over transport
    1066 @@ -722,7 +723,7 @@ struct sk_buff {
    1067 peeked:1,
    1068 head_frag:1,
    1069 xmit_more:1,
    1070 - __unused:1; /* one bit hole */
    1071 + pfmemalloc:1;
    1072
    1073 /* fields enclosed in headers_start/headers_end are copied
    1074 * using a single memcpy() in __copy_skb_header()
    1075 @@ -741,31 +742,30 @@ struct sk_buff {
    1076
    1077 __u8 __pkt_type_offset[0];
    1078 __u8 pkt_type:3;
    1079 - __u8 pfmemalloc:1;
    1080 __u8 ignore_df:1;
    1081 -
    1082 __u8 nf_trace:1;
    1083 __u8 ip_summed:2;
    1084 __u8 ooo_okay:1;
    1085 +
    1086 __u8 l4_hash:1;
    1087 __u8 sw_hash:1;
    1088 __u8 wifi_acked_valid:1;
    1089 __u8 wifi_acked:1;
    1090 -
    1091 __u8 no_fcs:1;
    1092 /* Indicates the inner headers are valid in the skbuff. */
    1093 __u8 encapsulation:1;
    1094 __u8 encap_hdr_csum:1;
    1095 __u8 csum_valid:1;
    1096 +
    1097 __u8 csum_complete_sw:1;
    1098 __u8 csum_level:2;
    1099 __u8 csum_not_inet:1;
    1100 -
    1101 __u8 dst_pending_confirm:1;
    1102 #ifdef CONFIG_IPV6_NDISC_NODETYPE
    1103 __u8 ndisc_nodetype:2;
    1104 #endif
    1105 __u8 ipvs_property:1;
    1106 +
    1107 __u8 inner_protocol_type:1;
    1108 __u8 remcsum_offload:1;
    1109 #ifdef CONFIG_NET_SWITCHDEV
    1110 diff --git a/include/net/ipv6.h b/include/net/ipv6.h
    1111 index a54b8c58ccb7..e59f385da38e 100644
    1112 --- a/include/net/ipv6.h
    1113 +++ b/include/net/ipv6.h
    1114 @@ -795,7 +795,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
    1115 * to minimize possbility that any useful information to an
    1116 * attacker is leaked. Only lower 20 bits are relevant.
    1117 */
    1118 - rol32(hash, 16);
    1119 + hash = rol32(hash, 16);
    1120
    1121 flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
    1122
    1123 diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
    1124 index 64c0291b579c..2f6fa95de2d8 100644
    1125 --- a/kernel/stop_machine.c
    1126 +++ b/kernel/stop_machine.c
    1127 @@ -270,7 +270,11 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1,
    1128 goto retry;
    1129 }
    1130
    1131 - wake_up_q(&wakeq);
    1132 + if (!err) {
    1133 + preempt_disable();
    1134 + wake_up_q(&wakeq);
    1135 + preempt_enable();
    1136 + }
    1137
    1138 return err;
    1139 }
    1140 diff --git a/lib/rhashtable.c b/lib/rhashtable.c
    1141 index b734ce731a7a..39215c724fc7 100644
    1142 --- a/lib/rhashtable.c
    1143 +++ b/lib/rhashtable.c
    1144 @@ -878,8 +878,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
    1145
    1146 static size_t rounded_hashtable_size(const struct rhashtable_params *params)
    1147 {
    1148 - return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
    1149 - (unsigned long)params->min_size);
    1150 + size_t retsize;
    1151 +
    1152 + if (params->nelem_hint)
    1153 + retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
    1154 + (unsigned long)params->min_size);
    1155 + else
    1156 + retsize = max(HASH_DEFAULT_SIZE,
    1157 + (unsigned long)params->min_size);
    1158 +
    1159 + return retsize;
    1160 }
    1161
    1162 static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
    1163 @@ -936,8 +944,6 @@ int rhashtable_init(struct rhashtable *ht,
    1164 struct bucket_table *tbl;
    1165 size_t size;
    1166
    1167 - size = HASH_DEFAULT_SIZE;
    1168 -
    1169 if ((!params->key_len && !params->obj_hashfn) ||
    1170 (params->obj_hashfn && !params->obj_cmpfn))
    1171 return -EINVAL;
    1172 @@ -964,8 +970,7 @@ int rhashtable_init(struct rhashtable *ht,
    1173
    1174 ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE);
    1175
    1176 - if (params->nelem_hint)
    1177 - size = rounded_hashtable_size(&ht->p);
    1178 + size = rounded_hashtable_size(&ht->p);
    1179
    1180 if (params->locks_mul)
    1181 ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
    1182 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
    1183 index 8af604f3b370..255469f78217 100644
    1184 --- a/mm/huge_memory.c
    1185 +++ b/mm/huge_memory.c
    1186 @@ -2069,6 +2069,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
    1187 if (vma_is_dax(vma))
    1188 return;
    1189 page = pmd_page(_pmd);
    1190 + if (!PageDirty(page) && pmd_dirty(_pmd))
    1191 + set_page_dirty(page);
    1192 if (!PageReferenced(page) && pmd_young(_pmd))
    1193 SetPageReferenced(page);
    1194 page_remove_rmap(page, true);
    1195 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    1196 index 942d9342b63b..db69d938e9ed 100644
    1197 --- a/mm/memcontrol.c
    1198 +++ b/mm/memcontrol.c
    1199 @@ -879,7 +879,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
    1200 int nid;
    1201 int i;
    1202
    1203 - while ((memcg = parent_mem_cgroup(memcg))) {
    1204 + for (; memcg; memcg = parent_mem_cgroup(memcg)) {
    1205 for_each_node(nid) {
    1206 mz = mem_cgroup_nodeinfo(memcg, nid);
    1207 for (i = 0; i <= DEF_PRIORITY; i++) {
    1208 diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
    1209 index 87f28557b329..441c04adedba 100644
    1210 --- a/net/core/gen_stats.c
    1211 +++ b/net/core/gen_stats.c
    1212 @@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
    1213 d->lock = lock;
    1214 spin_lock_bh(lock);
    1215 }
    1216 - if (d->tail)
    1217 - return gnet_stats_copy(d, type, NULL, 0, padattr);
    1218 + if (d->tail) {
    1219 + int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
    1220 +
    1221 + /* The initial attribute added in gnet_stats_copy() may be
    1222 + * preceded by a padding attribute, in which case d->tail will
    1223 + * end up pointing at the padding instead of the real attribute.
    1224 + * Fix this so gnet_stats_finish_copy() adjusts the length of
    1225 + * the right attribute.
    1226 + */
    1227 + if (ret == 0 && d->tail->nla_type == padattr)
    1228 + d->tail = (struct nlattr *)((char *)d->tail +
    1229 + NLA_ALIGN(d->tail->nla_len));
    1230 + return ret;
    1231 + }
    1232
    1233 return 0;
    1234 }
    1235 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    1236 index c132eca9e383..23041b5c0b27 100644
    1237 --- a/net/core/skbuff.c
    1238 +++ b/net/core/skbuff.c
    1239 @@ -858,6 +858,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
    1240 n->cloned = 1;
    1241 n->nohdr = 0;
    1242 n->peeked = 0;
    1243 + C(pfmemalloc);
    1244 n->destructor = NULL;
    1245 C(tail);
    1246 C(end);
    1247 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
    1248 index df8fd3ce713d..67eebcb113f3 100644
    1249 --- a/net/ipv4/fib_frontend.c
    1250 +++ b/net/ipv4/fib_frontend.c
    1251 @@ -290,6 +290,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
    1252 if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
    1253 struct flowi4 fl4 = {
    1254 .flowi4_iif = LOOPBACK_IFINDEX,
    1255 + .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
    1256 .daddr = ip_hdr(skb)->saddr,
    1257 .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
    1258 .flowi4_scope = scope,
    1259 diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
    1260 index 5a29dc5083a3..d82e8344fc54 100644
    1261 --- a/net/ipv4/sysctl_net_ipv4.c
    1262 +++ b/net/ipv4/sysctl_net_ipv4.c
    1263 @@ -186,8 +186,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
    1264 if (write && ret == 0) {
    1265 low = make_kgid(user_ns, urange[0]);
    1266 high = make_kgid(user_ns, urange[1]);
    1267 - if (!gid_valid(low) || !gid_valid(high) ||
    1268 - (urange[1] < urange[0]) || gid_lt(high, low)) {
    1269 + if (!gid_valid(low) || !gid_valid(high))
    1270 + return -EINVAL;
    1271 + if (urange[1] < urange[0] || gid_lt(high, low)) {
    1272 low = make_kgid(&init_user_ns, 1);
    1273 high = make_kgid(&init_user_ns, 0);
    1274 }
    1275 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    1276 index e3ece12f0250..e81ff9d545a4 100644
    1277 --- a/net/ipv4/tcp.c
    1278 +++ b/net/ipv4/tcp.c
    1279 @@ -3415,8 +3415,7 @@ int tcp_abort(struct sock *sk, int err)
    1280 struct request_sock *req = inet_reqsk(sk);
    1281
    1282 local_bh_disable();
    1283 - inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
    1284 - req);
    1285 + inet_csk_reqsk_queue_drop(req->rsk_listener, req);
    1286 local_bh_enable();
    1287 return 0;
    1288 }
    1289 diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
    1290 index ea71e4b0ab7a..2d36fd097299 100644
    1291 --- a/net/ipv6/Kconfig
    1292 +++ b/net/ipv6/Kconfig
    1293 @@ -109,6 +109,7 @@ config IPV6_MIP6
    1294 config IPV6_ILA
    1295 tristate "IPv6: Identifier Locator Addressing (ILA)"
    1296 depends on NETFILTER
    1297 + select DST_CACHE
    1298 select LWTUNNEL
    1299 ---help---
    1300 Support for IPv6 Identifier Locator Addressing (ILA).
    1301 diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    1302 index d081db125905..528218460bc5 100644
    1303 --- a/net/ipv6/ndisc.c
    1304 +++ b/net/ipv6/ndisc.c
    1305 @@ -803,7 +803,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
    1306 return;
    1307 }
    1308 }
    1309 - if (ndopts.nd_opts_nonce)
    1310 + if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
    1311 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
    1312
    1313 inc = ipv6_addr_is_multicast(daddr);
    1314 diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
    1315 index f055ca10bbc1..abacbbc0b0e8 100644
    1316 --- a/sound/core/rawmidi.c
    1317 +++ b/sound/core/rawmidi.c
    1318 @@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card,
    1319 int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
    1320 struct snd_rawmidi_params * params)
    1321 {
    1322 - char *newbuf;
    1323 + char *newbuf, *oldbuf;
    1324 struct snd_rawmidi_runtime *runtime = substream->runtime;
    1325
    1326 if (substream->append && substream->use_count > 1)
    1327 @@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
    1328 return -EINVAL;
    1329 }
    1330 if (params->buffer_size != runtime->buffer_size) {
    1331 - newbuf = krealloc(runtime->buffer, params->buffer_size,
    1332 - GFP_KERNEL);
    1333 + newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
    1334 if (!newbuf)
    1335 return -ENOMEM;
    1336 + spin_lock_irq(&runtime->lock);
    1337 + oldbuf = runtime->buffer;
    1338 runtime->buffer = newbuf;
    1339 runtime->buffer_size = params->buffer_size;
    1340 runtime->avail = runtime->buffer_size;
    1341 + runtime->appl_ptr = runtime->hw_ptr = 0;
    1342 + spin_unlock_irq(&runtime->lock);
    1343 + kfree(oldbuf);
    1344 }
    1345 runtime->avail_min = params->avail_min;
    1346 substream->active_sensing = !params->no_active_sensing;
    1347 @@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params);
    1348 int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
    1349 struct snd_rawmidi_params * params)
    1350 {
    1351 - char *newbuf;
    1352 + char *newbuf, *oldbuf;
    1353 struct snd_rawmidi_runtime *runtime = substream->runtime;
    1354
    1355 snd_rawmidi_drain_input(substream);
    1356 @@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
    1357 return -EINVAL;
    1358 }
    1359 if (params->buffer_size != runtime->buffer_size) {
    1360 - newbuf = krealloc(runtime->buffer, params->buffer_size,
    1361 - GFP_KERNEL);
    1362 + newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
    1363 if (!newbuf)
    1364 return -ENOMEM;
    1365 + spin_lock_irq(&runtime->lock);
    1366 + oldbuf = runtime->buffer;
    1367 runtime->buffer = newbuf;
    1368 runtime->buffer_size = params->buffer_size;
    1369 + runtime->appl_ptr = runtime->hw_ptr = 0;
    1370 + spin_unlock_irq(&runtime->lock);
    1371 + kfree(oldbuf);
    1372 }
    1373 runtime->avail_min = params->avail_min;
    1374 return 0;
    1375 diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
    1376 index ba9a7e552183..88ce2f1022e1 100644
    1377 --- a/sound/pci/hda/patch_conexant.c
    1378 +++ b/sound/pci/hda/patch_conexant.c
    1379 @@ -965,6 +965,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
    1380 SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
    1381 SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
    1382 SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
    1383 + SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
    1384 SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
    1385 SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
    1386 SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
    1387 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1388 index bf7737fc3b28..dcc9e6551b51 100644
    1389 --- a/sound/pci/hda/patch_realtek.c
    1390 +++ b/sound/pci/hda/patch_realtek.c
    1391 @@ -6402,6 +6402,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    1392 SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
    1393 SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
    1394 SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
    1395 + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
    1396 SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
    1397 SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
    1398 SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
    1399 diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
    1400 index f2ac53ab8243..58a9b31b0dd5 100644
    1401 --- a/virt/kvm/eventfd.c
    1402 +++ b/virt/kvm/eventfd.c
    1403 @@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work)
    1404 {
    1405 struct kvm_kernel_irqfd *irqfd =
    1406 container_of(work, struct kvm_kernel_irqfd, shutdown);
    1407 + struct kvm *kvm = irqfd->kvm;
    1408 u64 cnt;
    1409
    1410 + /* Make sure irqfd has been initalized in assign path. */
    1411 + synchronize_srcu(&kvm->irq_srcu);
    1412 +
    1413 /*
    1414 * Synchronize with the wait-queue and unhook ourselves to prevent
    1415 * further events.
    1416 @@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
    1417
    1418 idx = srcu_read_lock(&kvm->irq_srcu);
    1419 irqfd_update(kvm, irqfd);
    1420 - srcu_read_unlock(&kvm->irq_srcu, idx);
    1421
    1422 list_add_tail(&irqfd->list, &kvm->irqfds.items);
    1423
    1424 @@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
    1425 }
    1426 #endif
    1427
    1428 + srcu_read_unlock(&kvm->irq_srcu, idx);
    1429 return 0;
    1430
    1431 fail: