Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0156-4.9.57-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0156-4.9.57-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3041 - (hide annotations) (download)
    Wed Dec 20 11:49:03 2017 UTC (6 years, 4 months ago) by niro
    File size: 45967 byte(s) 
    -linux-4.9.57
    1 niro 3041 diff --git a/Makefile b/Makefile
    2     index feab5f5a507c..d5a2ab9b3291 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 56
    9     +SUBLEVEL = 57
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
    14     index e9385bcd9723..9ade60ca08e0 100644
    15     --- a/arch/mips/math-emu/cp1emu.c
    16     +++ b/arch/mips/math-emu/cp1emu.c
    17     @@ -2386,7 +2386,6 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
    18     break;
    19     default:
    20     /* Reserved R6 ops */
    21     - pr_err("Reserved MIPS R6 CMP.condn.S operation\n");
    22     return SIGILL;
    23     }
    24     }
    25     @@ -2460,7 +2459,6 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
    26     break;
    27     default:
    28     /* Reserved R6 ops */
    29     - pr_err("Reserved MIPS R6 CMP.condn.D operation\n");
    30     return SIGILL;
    31     }
    32     }
    33     diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
    34     index e7636bac7372..6c98821fef5e 100644
    35     --- a/arch/x86/include/asm/alternative-asm.h
    36     +++ b/arch/x86/include/asm/alternative-asm.h
    37     @@ -62,8 +62,10 @@
    38     #define new_len2 145f-144f
    39    
    40     /*
    41     - * max without conditionals. Idea adapted from:
    42     + * gas compatible max based on the idea from:
    43     * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax
    44     + *
    45     + * The additional "-" is needed because gas uses a "true" value of -1.
    46     */
    47     #define alt_max_short(a, b) ((a) ^ (((a) ^ (b)) & -(-((a) < (b)))))
    48    
    49     diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
    50     index 1b020381ab38..d4aea31eec03 100644
    51     --- a/arch/x86/include/asm/alternative.h
    52     +++ b/arch/x86/include/asm/alternative.h
    53     @@ -103,12 +103,12 @@ static inline int alternatives_text_reserved(void *start, void *end)
    54     alt_end_marker ":\n"
    55    
    56     /*
    57     - * max without conditionals. Idea adapted from:
    58     + * gas compatible max based on the idea from:
    59     * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax
    60     *
    61     - * The additional "-" is needed because gas works with s32s.
    62     + * The additional "-" is needed because gas uses a "true" value of -1.
    63     */
    64     -#define alt_max_short(a, b) "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") - (" b ")))))"
    65     +#define alt_max_short(a, b) "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") < (" b ")))))"
    66    
    67     /*
    68     * Pad the second replacement alternative with additional NOPs if it is
    69     diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
    70     index 5f2412704b81..d29c745f10ad 100644
    71     --- a/arch/x86/kvm/mmu.c
    72     +++ b/arch/x86/kvm/mmu.c
    73     @@ -3648,13 +3648,6 @@ static bool sync_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
    74     static inline bool is_last_gpte(struct kvm_mmu *mmu,
    75     unsigned level, unsigned gpte)
    76     {
    77     - /*
    78     - * PT_PAGE_TABLE_LEVEL always terminates. The RHS has bit 7 set
    79     - * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
    80     - * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
    81     - */
    82     - gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
    83     -
    84     /*
    85     * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
    86     * If it is clear, there are no large pages at this level, so clear
    87     @@ -3662,6 +3655,13 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu,
    88     */
    89     gpte &= level - mmu->last_nonleaf_level;
    90    
    91     + /*
    92     + * PT_PAGE_TABLE_LEVEL always terminates. The RHS has bit 7 set
    93     + * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
    94     + * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
    95     + */
    96     + gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
    97     +
    98     return gpte & PT_PAGE_SIZE_MASK;
    99     }
    100    
    101     @@ -4169,6 +4169,7 @@ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly)
    102    
    103     update_permission_bitmask(vcpu, context, true);
    104     update_pkru_bitmask(vcpu, context, true);
    105     + update_last_nonleaf_level(vcpu, context);
    106     reset_rsvds_bits_mask_ept(vcpu, context, execonly);
    107     reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
    108     }
    109     diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
    110     index a01105485315..37363900297d 100644
    111     --- a/arch/x86/kvm/paging_tmpl.h
    112     +++ b/arch/x86/kvm/paging_tmpl.h
    113     @@ -324,10 +324,11 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
    114     --walker->level;
    115    
    116     index = PT_INDEX(addr, walker->level);
    117     -
    118     table_gfn = gpte_to_gfn(pte);
    119     offset = index * sizeof(pt_element_t);
    120     pte_gpa = gfn_to_gpa(table_gfn) + offset;
    121     +
    122     + BUG_ON(walker->level < 1);
    123     walker->table_gfn[walker->level - 1] = table_gfn;
    124     walker->pte_gpa[walker->level - 1] = pte_gpa;
    125    
    126     diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    127     index fb49212d25df..a8ae57acb6f6 100644
    128     --- a/arch/x86/kvm/vmx.c
    129     +++ b/arch/x86/kvm/vmx.c
    130     @@ -10690,7 +10690,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
    131     * (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask();
    132     */
    133     vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
    134     - kvm_set_cr4(vcpu, vmcs12->host_cr4);
    135     + vmx_set_cr4(vcpu, vmcs12->host_cr4);
    136    
    137     nested_ept_uninit_mmu_context(vcpu);
    138    
    139     diff --git a/block/bio.c b/block/bio.c
    140     index 655c9016052a..07f287b14cff 100644
    141     --- a/block/bio.c
    142     +++ b/block/bio.c
    143     @@ -1171,8 +1171,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
    144     */
    145     bmd->is_our_pages = map_data ? 0 : 1;
    146     memcpy(bmd->iov, iter->iov, sizeof(struct iovec) * iter->nr_segs);
    147     - iov_iter_init(&bmd->iter, iter->type, bmd->iov,
    148     - iter->nr_segs, iter->count);
    149     + bmd->iter = *iter;
    150     + bmd->iter.iov = bmd->iov;
    151    
    152     ret = -ENOMEM;
    153     bio = bio_kmalloc(gfp_mask, nr_pages);
    154     @@ -1266,6 +1266,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
    155     int ret, offset;
    156     struct iov_iter i;
    157     struct iovec iov;
    158     + struct bio_vec *bvec;
    159    
    160     iov_for_each(iov, i, *iter) {
    161     unsigned long uaddr = (unsigned long) iov.iov_base;
    162     @@ -1310,7 +1311,12 @@ struct bio *bio_map_user_iov(struct request_queue *q,
    163     ret = get_user_pages_fast(uaddr, local_nr_pages,
    164     (iter->type & WRITE) != WRITE,
    165     &pages[cur_page]);
    166     - if (ret < local_nr_pages) {
    167     + if (unlikely(ret < local_nr_pages)) {
    168     + for (j = cur_page; j < page_limit; j++) {
    169     + if (!pages[j])
    170     + break;
    171     + put_page(pages[j]);
    172     + }
    173     ret = -EFAULT;
    174     goto out_unmap;
    175     }
    176     @@ -1318,6 +1324,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
    177     offset = offset_in_page(uaddr);
    178     for (j = cur_page; j < page_limit; j++) {
    179     unsigned int bytes = PAGE_SIZE - offset;
    180     + unsigned short prev_bi_vcnt = bio->bi_vcnt;
    181    
    182     if (len <= 0)
    183     break;
    184     @@ -1332,6 +1339,13 @@ struct bio *bio_map_user_iov(struct request_queue *q,
    185     bytes)
    186     break;
    187    
    188     + /*
    189     + * check if vector was merged with previous
    190     + * drop page reference if needed
    191     + */
    192     + if (bio->bi_vcnt == prev_bi_vcnt)
    193     + put_page(pages[j]);
    194     +
    195     len -= bytes;
    196     offset = 0;
    197     }
    198     @@ -1364,10 +1378,8 @@ struct bio *bio_map_user_iov(struct request_queue *q,
    199     return bio;
    200    
    201     out_unmap:
    202     - for (j = 0; j < nr_pages; j++) {
    203     - if (!pages[j])
    204     - break;
    205     - put_page(pages[j]);
    206     + bio_for_each_segment_all(bvec, bio, j) {
    207     + put_page(bvec->bv_page);
    208     }
    209     out:
    210     kfree(pages);
    211     diff --git a/crypto/shash.c b/crypto/shash.c
    212     index a051541a4a17..4d8a671d1614 100644
    213     --- a/crypto/shash.c
    214     +++ b/crypto/shash.c
    215     @@ -274,12 +274,14 @@ static int shash_async_finup(struct ahash_request *req)
    216    
    217     int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
    218     {
    219     - struct scatterlist *sg = req->src;
    220     - unsigned int offset = sg->offset;
    221     unsigned int nbytes = req->nbytes;
    222     + struct scatterlist *sg;
    223     + unsigned int offset;
    224     int err;
    225    
    226     - if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
    227     + if (nbytes &&
    228     + (sg = req->src, offset = sg->offset,
    229     + nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
    230     void *data;
    231    
    232     data = kmap_atomic(sg_page(sg));
    233     diff --git a/drivers/base/property.c b/drivers/base/property.c
    234     index 06f66687fe0b..7b313b567f4c 100644
    235     --- a/drivers/base/property.c
    236     +++ b/drivers/base/property.c
    237     @@ -20,6 +20,7 @@
    238     #include <linux/phy.h>
    239    
    240     struct property_set {
    241     + struct device *dev;
    242     struct fwnode_handle fwnode;
    243     struct property_entry *properties;
    244     };
    245     @@ -817,6 +818,7 @@ static struct property_set *pset_copy_set(const struct property_set *pset)
    246     void device_remove_properties(struct device *dev)
    247     {
    248     struct fwnode_handle *fwnode;
    249     + struct property_set *pset;
    250    
    251     fwnode = dev_fwnode(dev);
    252     if (!fwnode)
    253     @@ -826,16 +828,16 @@ void device_remove_properties(struct device *dev)
    254     * the pset. If there is no real firmware node (ACPI/DT) primary
    255     * will hold the pset.
    256     */
    257     - if (is_pset_node(fwnode)) {
    258     + pset = to_pset_node(fwnode);
    259     + if (pset) {
    260     set_primary_fwnode(dev, NULL);
    261     - pset_free_set(to_pset_node(fwnode));
    262     } else {
    263     - fwnode = fwnode->secondary;
    264     - if (!IS_ERR(fwnode) && is_pset_node(fwnode)) {
    265     + pset = to_pset_node(fwnode->secondary);
    266     + if (pset && dev == pset->dev)
    267     set_secondary_fwnode(dev, NULL);
    268     - pset_free_set(to_pset_node(fwnode));
    269     - }
    270     }
    271     + if (pset && dev == pset->dev)
    272     + pset_free_set(pset);
    273     }
    274     EXPORT_SYMBOL_GPL(device_remove_properties);
    275    
    276     @@ -863,6 +865,7 @@ int device_add_properties(struct device *dev, struct property_entry *properties)
    277    
    278     p->fwnode.type = FWNODE_PDATA;
    279     set_secondary_fwnode(dev, &p->fwnode);
    280     + p->dev = dev;
    281     return 0;
    282     }
    283     EXPORT_SYMBOL_GPL(device_add_properties);
    284     diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
    285     index 77242b37ef87..57962bff7532 100644
    286     --- a/drivers/dma/edma.c
    287     +++ b/drivers/dma/edma.c
    288     @@ -1143,11 +1143,24 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
    289     struct edma_desc *edesc;
    290     struct device *dev = chan->device->dev;
    291     struct edma_chan *echan = to_edma_chan(chan);
    292     - unsigned int width, pset_len;
    293     + unsigned int width, pset_len, array_size;
    294    
    295     if (unlikely(!echan || !len))
    296     return NULL;
    297    
    298     + /* Align the array size (acnt block) with the transfer properties */
    299     + switch (__ffs((src | dest | len))) {
    300     + case 0:
    301     + array_size = SZ_32K - 1;
    302     + break;
    303     + case 1:
    304     + array_size = SZ_32K - 2;
    305     + break;
    306     + default:
    307     + array_size = SZ_32K - 4;
    308     + break;
    309     + }
    310     +
    311     if (len < SZ_64K) {
    312     /*
    313     * Transfer size less than 64K can be handled with one paRAM
    314     @@ -1169,7 +1182,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
    315     * When the full_length is multibple of 32767 one slot can be
    316     * used to complete the transfer.
    317     */
    318     - width = SZ_32K - 1;
    319     + width = array_size;
    320     pset_len = rounddown(len, width);
    321     /* One slot is enough for lengths multiple of (SZ_32K -1) */
    322     if (unlikely(pset_len == len))
    323     @@ -1217,7 +1230,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
    324     }
    325     dest += pset_len;
    326     src += pset_len;
    327     - pset_len = width = len % (SZ_32K - 1);
    328     + pset_len = width = len % array_size;
    329    
    330     ret = edma_config_pset(chan, &edesc->pset[1], src, dest, 1,
    331     width, pset_len, DMA_MEM_TO_MEM);
    332     diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
    333     index 2403475a37cf..88a00d06def6 100644
    334     --- a/drivers/dma/ti-dma-crossbar.c
    335     +++ b/drivers/dma/ti-dma-crossbar.c
    336     @@ -262,13 +262,14 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
    337     mutex_lock(&xbar->mutex);
    338     map->xbar_out = find_first_zero_bit(xbar->dma_inuse,
    339     xbar->dma_requests);
    340     - mutex_unlock(&xbar->mutex);
    341     if (map->xbar_out == xbar->dma_requests) {
    342     + mutex_unlock(&xbar->mutex);
    343     dev_err(&pdev->dev, "Run out of free DMA requests\n");
    344     kfree(map);
    345     return ERR_PTR(-ENOMEM);
    346     }
    347     set_bit(map->xbar_out, xbar->dma_inuse);
    348     + mutex_unlock(&xbar->mutex);
    349    
    350     map->xbar_in = (u16)dma_spec->args[0];
    351    
    352     diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
    353     index 8aeb7f8ee59c..80c5cc5640c1 100644
    354     --- a/drivers/gpu/drm/i915/intel_bios.c
    355     +++ b/drivers/gpu/drm/i915/intel_bios.c
    356     @@ -1219,7 +1219,7 @@ static void parse_ddi_ports(struct drm_i915_private *dev_priv,
    357     {
    358     enum port port;
    359    
    360     - if (!HAS_DDI(dev_priv))
    361     + if (!HAS_DDI(dev_priv) && !IS_CHERRYVIEW(dev_priv))
    362     return;
    363    
    364     if (!dev_priv->vbt.child_dev_num)
    365     diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    366     index f8efd20e4a90..ce32303b3013 100644
    367     --- a/drivers/gpu/drm/i915/intel_display.c
    368     +++ b/drivers/gpu/drm/i915/intel_display.c
    369     @@ -11471,13 +11471,10 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
    370     {
    371     struct drm_i915_private *dev_priv = to_i915(dev);
    372     struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
    373     - enum transcoder cpu_transcoder = intel_crtc->config->cpu_transcoder;
    374     + enum transcoder cpu_transcoder;
    375     struct drm_display_mode *mode;
    376     struct intel_crtc_state *pipe_config;
    377     - int htot = I915_READ(HTOTAL(cpu_transcoder));
    378     - int hsync = I915_READ(HSYNC(cpu_transcoder));
    379     - int vtot = I915_READ(VTOTAL(cpu_transcoder));
    380     - int vsync = I915_READ(VSYNC(cpu_transcoder));
    381     + u32 htot, hsync, vtot, vsync;
    382     enum pipe pipe = intel_crtc->pipe;
    383    
    384     mode = kzalloc(sizeof(*mode), GFP_KERNEL);
    385     @@ -11505,6 +11502,13 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
    386     i9xx_crtc_clock_get(intel_crtc, pipe_config);
    387    
    388     mode->clock = pipe_config->port_clock / pipe_config->pixel_multiplier;
    389     +
    390     + cpu_transcoder = pipe_config->cpu_transcoder;
    391     + htot = I915_READ(HTOTAL(cpu_transcoder));
    392     + hsync = I915_READ(HSYNC(cpu_transcoder));
    393     + vtot = I915_READ(VTOTAL(cpu_transcoder));
    394     + vsync = I915_READ(VSYNC(cpu_transcoder));
    395     +
    396     mode->hdisplay = (htot & 0xffff) + 1;
    397     mode->htotal = ((htot & 0xffff0000) >> 16) + 1;
    398     mode->hsync_start = (hsync & 0xffff) + 1;
    399     diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
    400     index 7b06280b23aa..afa3d010c650 100644
    401     --- a/drivers/gpu/drm/i915/intel_dp.c
    402     +++ b/drivers/gpu/drm/i915/intel_dp.c
    403     @@ -2193,8 +2193,8 @@ static void edp_panel_off(struct intel_dp *intel_dp)
    404     I915_WRITE(pp_ctrl_reg, pp);
    405     POSTING_READ(pp_ctrl_reg);
    406    
    407     - intel_dp->panel_power_off_time = ktime_get_boottime();
    408     wait_panel_off(intel_dp);
    409     + intel_dp->panel_power_off_time = ktime_get_boottime();
    410    
    411     /* We got a reference when we enabled the VDD. */
    412     power_domain = intel_display_port_aux_power_domain(intel_encoder);
    413     diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
    414     index ae83af649a60..7838343eb37c 100644
    415     --- a/drivers/hid/usbhid/hid-core.c
    416     +++ b/drivers/hid/usbhid/hid-core.c
    417     @@ -971,6 +971,8 @@ static int usbhid_parse(struct hid_device *hid)
    418     unsigned int rsize = 0;
    419     char *rdesc;
    420     int ret, n;
    421     + int num_descriptors;
    422     + size_t offset = offsetof(struct hid_descriptor, desc);
    423    
    424     quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
    425     le16_to_cpu(dev->descriptor.idProduct));
    426     @@ -993,10 +995,18 @@ static int usbhid_parse(struct hid_device *hid)
    427     return -ENODEV;
    428     }
    429    
    430     + if (hdesc->bLength < sizeof(struct hid_descriptor)) {
    431     + dbg_hid("hid descriptor is too short\n");
    432     + return -EINVAL;
    433     + }
    434     +
    435     hid->version = le16_to_cpu(hdesc->bcdHID);
    436     hid->country = hdesc->bCountryCode;
    437    
    438     - for (n = 0; n < hdesc->bNumDescriptors; n++)
    439     + num_descriptors = min_t(int, hdesc->bNumDescriptors,
    440     + (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
    441     +
    442     + for (n = 0; n < num_descriptors; n++)
    443     if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
    444     rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
    445    
    446     diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    447     index c380b7e8f1c6..1a0b110f12c0 100644
    448     --- a/drivers/iommu/amd_iommu.c
    449     +++ b/drivers/iommu/amd_iommu.c
    450     @@ -3120,6 +3120,7 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
    451     mutex_unlock(&domain->api_lock);
    452    
    453     domain_flush_tlb_pde(domain);
    454     + domain_flush_complete(domain);
    455    
    456     return unmap_size;
    457     }
    458     diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
    459     index 0e75d94972ba..671610c989b6 100644
    460     --- a/drivers/pinctrl/Kconfig
    461     +++ b/drivers/pinctrl/Kconfig
    462     @@ -82,6 +82,7 @@ config PINCTRL_AMD
    463     tristate "AMD GPIO pin control"
    464     depends on GPIOLIB
    465     select GPIOLIB_IRQCHIP
    466     + select PINMUX
    467     select PINCONF
    468     select GENERIC_PINCONF
    469     help
    470     diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    471     index baa7cdcc0ebc..325bf21ba13b 100644
    472     --- a/drivers/usb/gadget/composite.c
    473     +++ b/drivers/usb/gadget/composite.c
    474     @@ -2018,6 +2018,8 @@ static DEVICE_ATTR_RO(suspended);
    475     static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
    476     {
    477     struct usb_composite_dev *cdev = get_gadget_data(gadget);
    478     + struct usb_gadget_strings *gstr = cdev->driver->strings[0];
    479     + struct usb_string *dev_str = gstr->strings;
    480    
    481     /* composite_disconnect() must already have been called
    482     * by the underlying peripheral controller driver!
    483     @@ -2037,6 +2039,9 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
    484    
    485     composite_dev_cleanup(cdev);
    486    
    487     + if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
    488     + dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
    489     +
    490     kfree(cdev->def_manufacturer);
    491     kfree(cdev);
    492     set_gadget_data(gadget, NULL);
    493     diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
    494     index 3984787f8e97..502a096fc380 100644
    495     --- a/drivers/usb/gadget/configfs.c
    496     +++ b/drivers/usb/gadget/configfs.c
    497     @@ -1140,11 +1140,12 @@ static struct configfs_attribute *interf_grp_attrs[] = {
    498     NULL
    499     };
    500    
    501     -int usb_os_desc_prepare_interf_dir(struct config_group *parent,
    502     - int n_interf,
    503     - struct usb_os_desc **desc,
    504     - char **names,
    505     - struct module *owner)
    506     +struct config_group *usb_os_desc_prepare_interf_dir(
    507     + struct config_group *parent,
    508     + int n_interf,
    509     + struct usb_os_desc **desc,
    510     + char **names,
    511     + struct module *owner)
    512     {
    513     struct config_group *os_desc_group;
    514     struct config_item_type *os_desc_type, *interface_type;
    515     @@ -1156,7 +1157,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
    516    
    517     char *vlabuf = kzalloc(vla_group_size(data_chunk), GFP_KERNEL);
    518     if (!vlabuf)
    519     - return -ENOMEM;
    520     + return ERR_PTR(-ENOMEM);
    521    
    522     os_desc_group = vla_ptr(vlabuf, data_chunk, os_desc_group);
    523     os_desc_type = vla_ptr(vlabuf, data_chunk, os_desc_type);
    524     @@ -1181,7 +1182,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
    525     configfs_add_default_group(&d->group, os_desc_group);
    526     }
    527    
    528     - return 0;
    529     + return os_desc_group;
    530     }
    531     EXPORT_SYMBOL(usb_os_desc_prepare_interf_dir);
    532    
    533     diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
    534     index 36c468c4f5e9..540d5e92ed22 100644
    535     --- a/drivers/usb/gadget/configfs.h
    536     +++ b/drivers/usb/gadget/configfs.h
    537     @@ -5,11 +5,12 @@
    538    
    539     void unregister_gadget_item(struct config_item *item);
    540    
    541     -int usb_os_desc_prepare_interf_dir(struct config_group *parent,
    542     - int n_interf,
    543     - struct usb_os_desc **desc,
    544     - char **names,
    545     - struct module *owner);
    546     +struct config_group *usb_os_desc_prepare_interf_dir(
    547     + struct config_group *parent,
    548     + int n_interf,
    549     + struct usb_os_desc **desc,
    550     + char **names,
    551     + struct module *owner);
    552    
    553     static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item)
    554     {
    555     diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
    556     index 16562e461121..ba00cdb809d6 100644
    557     --- a/drivers/usb/gadget/function/f_rndis.c
    558     +++ b/drivers/usb/gadget/function/f_rndis.c
    559     @@ -892,6 +892,7 @@ static void rndis_free_inst(struct usb_function_instance *f)
    560     free_netdev(opts->net);
    561     }
    562    
    563     + kfree(opts->rndis_interf_group); /* single VLA chunk */
    564     kfree(opts);
    565     }
    566    
    567     @@ -900,6 +901,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
    568     struct f_rndis_opts *opts;
    569     struct usb_os_desc *descs[1];
    570     char *names[1];
    571     + struct config_group *rndis_interf_group;
    572    
    573     opts = kzalloc(sizeof(*opts), GFP_KERNEL);
    574     if (!opts)
    575     @@ -920,8 +922,14 @@ static struct usb_function_instance *rndis_alloc_inst(void)
    576     names[0] = "rndis";
    577     config_group_init_type_name(&opts->func_inst.group, "",
    578     &rndis_func_type);
    579     - usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
    580     - names, THIS_MODULE);
    581     + rndis_interf_group =
    582     + usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
    583     + names, THIS_MODULE);
    584     + if (IS_ERR(rndis_interf_group)) {
    585     + rndis_free_inst(&opts->func_inst);
    586     + return ERR_CAST(rndis_interf_group);
    587     + }
    588     + opts->rndis_interf_group = rndis_interf_group;
    589    
    590     return &opts->func_inst;
    591     }
    592     diff --git a/drivers/usb/gadget/function/u_rndis.h b/drivers/usb/gadget/function/u_rndis.h
    593     index 4eafd5050545..4e2ad04fe8d6 100644
    594     --- a/drivers/usb/gadget/function/u_rndis.h
    595     +++ b/drivers/usb/gadget/function/u_rndis.h
    596     @@ -26,6 +26,7 @@ struct f_rndis_opts {
    597     bool bound;
    598     bool borrowed_net;
    599    
    600     + struct config_group *rndis_interf_group;
    601     struct usb_os_desc rndis_os_desc;
    602     char rndis_ext_compat_id[16];
    603    
    604     diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
    605     index fb17fb23fa9a..b62a3de65075 100644
    606     --- a/drivers/usb/gadget/udc/dummy_hcd.c
    607     +++ b/drivers/usb/gadget/udc/dummy_hcd.c
    608     @@ -420,6 +420,7 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
    609     static void set_link_state(struct dummy_hcd *dum_hcd)
    610     {
    611     struct dummy *dum = dum_hcd->dum;
    612     + unsigned int power_bit;
    613    
    614     dum_hcd->active = 0;
    615     if (dum->pullup)
    616     @@ -430,17 +431,19 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
    617     return;
    618    
    619     set_link_state_by_speed(dum_hcd);
    620     + power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ?
    621     + USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER);
    622    
    623     if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 ||
    624     dum_hcd->active)
    625     dum_hcd->resuming = 0;
    626    
    627     /* Currently !connected or in reset */
    628     - if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 ||
    629     + if ((dum_hcd->port_status & power_bit) == 0 ||
    630     (dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) {
    631     - unsigned disconnect = USB_PORT_STAT_CONNECTION &
    632     + unsigned int disconnect = power_bit &
    633     dum_hcd->old_status & (~dum_hcd->port_status);
    634     - unsigned reset = USB_PORT_STAT_RESET &
    635     + unsigned int reset = USB_PORT_STAT_RESET &
    636     (~dum_hcd->old_status) & dum_hcd->port_status;
    637    
    638     /* Report reset and disconnect events to the driver */
    639     diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
    640     index 8897195396b2..6c6a3a8df07a 100644
    641     --- a/drivers/usb/renesas_usbhs/fifo.c
    642     +++ b/drivers/usb/renesas_usbhs/fifo.c
    643     @@ -860,9 +860,9 @@ static void xfer_work(struct work_struct *work)
    644     fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
    645    
    646     usbhs_pipe_running(pipe, 1);
    647     - usbhsf_dma_start(pipe, fifo);
    648     usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
    649     dma_async_issue_pending(chan);
    650     + usbhsf_dma_start(pipe, fifo);
    651     usbhs_pipe_enable(pipe);
    652    
    653     xfer_work_end:
    654     diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
    655     index b6f1adefb758..76062ce2d459 100644
    656     --- a/drivers/usb/serial/console.c
    657     +++ b/drivers/usb/serial/console.c
    658     @@ -186,6 +186,7 @@ static int usb_console_setup(struct console *co, char *options)
    659     tty_kref_put(tty);
    660     reset_open_count:
    661     port->port.count = 0;
    662     + info->port = NULL;
    663     usb_autopm_put_interface(serial->interface);
    664     error_get_interface:
    665     usb_serial_put(serial);
    666     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    667     index 470b17b0c11b..11ee55e080e5 100644
    668     --- a/drivers/usb/serial/cp210x.c
    669     +++ b/drivers/usb/serial/cp210x.c
    670     @@ -171,6 +171,7 @@ static const struct usb_device_id id_table[] = {
    671     { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
    672     { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
    673     { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
    674     + { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */
    675     { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
    676     { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
    677     { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
    678     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    679     index 19394963f675..3249f42b4b93 100644
    680     --- a/drivers/usb/serial/ftdi_sio.c
    681     +++ b/drivers/usb/serial/ftdi_sio.c
    682     @@ -1015,6 +1015,8 @@ static const struct usb_device_id id_table_combined[] = {
    683     { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
    684     { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
    685     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    686     + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
    687     + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
    688     { } /* Terminating entry */
    689     };
    690    
    691     diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    692     index 4fcf1cecb6d7..f9d15bd62785 100644
    693     --- a/drivers/usb/serial/ftdi_sio_ids.h
    694     +++ b/drivers/usb/serial/ftdi_sio_ids.h
    695     @@ -609,6 +609,13 @@
    696     #define ADI_GNICE_PID 0xF000
    697     #define ADI_GNICEPLUS_PID 0xF001
    698    
    699     +/*
    700     + * Cypress WICED USB UART
    701     + */
    702     +#define CYPRESS_VID 0x04B4
    703     +#define CYPRESS_WICED_BT_USB_PID 0x009B
    704     +#define CYPRESS_WICED_WL_USB_PID 0xF900
    705     +
    706     /*
    707     * Microchip Technology, Inc.
    708     *
    709     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    710     index 2a9944326210..db3d34c2c82e 100644
    711     --- a/drivers/usb/serial/option.c
    712     +++ b/drivers/usb/serial/option.c
    713     @@ -522,6 +522,7 @@ static void option_instat_callback(struct urb *urb);
    714    
    715     /* TP-LINK Incorporated products */
    716     #define TPLINK_VENDOR_ID 0x2357
    717     +#define TPLINK_PRODUCT_LTE 0x000D
    718     #define TPLINK_PRODUCT_MA180 0x0201
    719    
    720     /* Changhong products */
    721     @@ -2011,6 +2012,7 @@ static const struct usb_device_id option_ids[] = {
    722     { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
    723     { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
    724     { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
    725     + { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */
    726     { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
    727     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    728     { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */
    729     diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    730     index 652b4334b26d..e1c1e329c877 100644
    731     --- a/drivers/usb/serial/qcserial.c
    732     +++ b/drivers/usb/serial/qcserial.c
    733     @@ -174,6 +174,10 @@ static const struct usb_device_id id_table[] = {
    734     {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
    735     {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
    736     {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
    737     + {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
    738     + {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */
    739     + {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */
    740     + {DEVICE_SWI(0x413c, 0x81d2)}, /* Dell Wireless 5818 */
    741    
    742     /* Huawei devices */
    743     {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
    744     diff --git a/fs/block_dev.c b/fs/block_dev.c
    745     index 07e46b786500..cb936c90ae82 100644
    746     --- a/fs/block_dev.c
    747     +++ b/fs/block_dev.c
    748     @@ -450,10 +450,12 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
    749    
    750     set_page_writeback(page);
    751     result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, true);
    752     - if (result)
    753     + if (result) {
    754     end_page_writeback(page);
    755     - else
    756     + } else {
    757     + clean_page_buffers(page);
    758     unlock_page(page);
    759     + }
    760     blk_queue_exit(bdev->bd_queue);
    761     return result;
    762     }
    763     diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
    764     index 48ef401c3c61..7b496a4e650e 100644
    765     --- a/fs/cifs/cifsglob.h
    766     +++ b/fs/cifs/cifsglob.h
    767     @@ -365,6 +365,8 @@ struct smb_version_operations {
    768     unsigned int (*calc_smb_size)(void *);
    769     /* check for STATUS_PENDING and process it in a positive case */
    770     bool (*is_status_pending)(char *, struct TCP_Server_Info *, int);
    771     + /* check for STATUS_NETWORK_SESSION_EXPIRED */
    772     + bool (*is_session_expired)(char *);
    773     /* send oplock break response */
    774     int (*oplock_response)(struct cifs_tcon *, struct cifs_fid *,
    775     struct cifsInodeInfo *);
    776     diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
    777     index 1f91c9dadd5b..cc420d6b71f7 100644
    778     --- a/fs/cifs/cifssmb.c
    779     +++ b/fs/cifs/cifssmb.c
    780     @@ -1457,6 +1457,13 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
    781     return length;
    782     server->total_read += length;
    783    
    784     + if (server->ops->is_session_expired &&
    785     + server->ops->is_session_expired(buf)) {
    786     + cifs_reconnect(server);
    787     + wake_up(&server->response_q);
    788     + return -1;
    789     + }
    790     +
    791     if (server->ops->is_status_pending &&
    792     server->ops->is_status_pending(buf, server, 0)) {
    793     discard_remaining_data(server);
    794     diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    795     index f6712b6128d8..580b3a4ca53a 100644
    796     --- a/fs/cifs/connect.c
    797     +++ b/fs/cifs/connect.c
    798     @@ -796,6 +796,13 @@ standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
    799     cifs_dump_mem("Bad SMB: ", buf,
    800     min_t(unsigned int, server->total_read, 48));
    801    
    802     + if (server->ops->is_session_expired &&
    803     + server->ops->is_session_expired(buf)) {
    804     + cifs_reconnect(server);
    805     + wake_up(&server->response_q);
    806     + return -1;
    807     + }
    808     +
    809     if (server->ops->is_status_pending &&
    810     server->ops->is_status_pending(buf, server, length))
    811     return -1;
    812     diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
    813     index b6968241c26f..812e4884c392 100644
    814     --- a/fs/cifs/smb2ops.c
    815     +++ b/fs/cifs/smb2ops.c
    816     @@ -1018,6 +1018,18 @@ smb2_is_status_pending(char *buf, struct TCP_Server_Info *server, int length)
    817     return true;
    818     }
    819    
    820     +static bool
    821     +smb2_is_session_expired(char *buf)
    822     +{
    823     + struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
    824     +
    825     + if (hdr->Status != STATUS_NETWORK_SESSION_EXPIRED)
    826     + return false;
    827     +
    828     + cifs_dbg(FYI, "Session expired\n");
    829     + return true;
    830     +}
    831     +
    832     static int
    833     smb2_oplock_response(struct cifs_tcon *tcon, struct cifs_fid *fid,
    834     struct cifsInodeInfo *cinode)
    835     @@ -1609,6 +1621,7 @@ struct smb_version_operations smb20_operations = {
    836     .close_dir = smb2_close_dir,
    837     .calc_smb_size = smb2_calc_size,
    838     .is_status_pending = smb2_is_status_pending,
    839     + .is_session_expired = smb2_is_session_expired,
    840     .oplock_response = smb2_oplock_response,
    841     .queryfs = smb2_queryfs,
    842     .mand_lock = smb2_mand_lock,
    843     @@ -1690,6 +1703,7 @@ struct smb_version_operations smb21_operations = {
    844     .close_dir = smb2_close_dir,
    845     .calc_smb_size = smb2_calc_size,
    846     .is_status_pending = smb2_is_status_pending,
    847     + .is_session_expired = smb2_is_session_expired,
    848     .oplock_response = smb2_oplock_response,
    849     .queryfs = smb2_queryfs,
    850     .mand_lock = smb2_mand_lock,
    851     @@ -1773,6 +1787,7 @@ struct smb_version_operations smb30_operations = {
    852     .close_dir = smb2_close_dir,
    853     .calc_smb_size = smb2_calc_size,
    854     .is_status_pending = smb2_is_status_pending,
    855     + .is_session_expired = smb2_is_session_expired,
    856     .oplock_response = smb2_oplock_response,
    857     .queryfs = smb2_queryfs,
    858     .mand_lock = smb2_mand_lock,
    859     @@ -1862,6 +1877,7 @@ struct smb_version_operations smb311_operations = {
    860     .close_dir = smb2_close_dir,
    861     .calc_smb_size = smb2_calc_size,
    862     .is_status_pending = smb2_is_status_pending,
    863     + .is_session_expired = smb2_is_session_expired,
    864     .oplock_response = smb2_oplock_response,
    865     .queryfs = smb2_queryfs,
    866     .mand_lock = smb2_mand_lock,
    867     diff --git a/fs/direct-io.c b/fs/direct-io.c
    868     index c60756e89833..c6220a2daefd 100644
    869     --- a/fs/direct-io.c
    870     +++ b/fs/direct-io.c
    871     @@ -835,7 +835,8 @@ submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
    872     */
    873     if (sdio->boundary) {
    874     ret = dio_send_cur_page(dio, sdio, map_bh);
    875     - dio_bio_submit(dio, sdio);
    876     + if (sdio->bio)
    877     + dio_bio_submit(dio, sdio);
    878     put_page(sdio->cur_page);
    879     sdio->cur_page = NULL;
    880     }
    881     diff --git a/fs/ext4/file.c b/fs/ext4/file.c
    882     index d17d12ed6f73..510e66422f04 100644
    883     --- a/fs/ext4/file.c
    884     +++ b/fs/ext4/file.c
    885     @@ -527,7 +527,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
    886     inode_lock(inode);
    887    
    888     isize = i_size_read(inode);
    889     - if (offset >= isize) {
    890     + if (offset < 0 || offset >= isize) {
    891     inode_unlock(inode);
    892     return -ENXIO;
    893     }
    894     @@ -590,7 +590,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
    895     inode_lock(inode);
    896    
    897     isize = i_size_read(inode);
    898     - if (offset >= isize) {
    899     + if (offset < 0 || offset >= isize) {
    900     inode_unlock(inode);
    901     return -ENXIO;
    902     }
    903     diff --git a/fs/mpage.c b/fs/mpage.c
    904     index d2fcb149720d..e2ea442bb9e1 100644
    905     --- a/fs/mpage.c
    906     +++ b/fs/mpage.c
    907     @@ -466,6 +466,16 @@ static void clean_buffers(struct page *page, unsigned first_unmapped)
    908     try_to_free_buffers(page);
    909     }
    910    
    911     +/*
    912     + * For situations where we want to clean all buffers attached to a page.
    913     + * We don't need to calculate how many buffers are attached to the page,
    914     + * we just need to specify a number larger than the maximum number of buffers.
    915     + */
    916     +void clean_page_buffers(struct page *page)
    917     +{
    918     + clean_buffers(page, ~0U);
    919     +}
    920     +
    921     static int __mpage_writepage(struct page *page, struct writeback_control *wbc,
    922     void *data)
    923     {
    924     @@ -604,10 +614,8 @@ static int __mpage_writepage(struct page *page, struct writeback_control *wbc,
    925     if (bio == NULL) {
    926     if (first_unmapped == blocks_per_page) {
    927     if (!bdev_write_page(bdev, blocks[0] << (blkbits - 9),
    928     - page, wbc)) {
    929     - clean_buffers(page, first_unmapped);
    930     + page, wbc))
    931     goto out;
    932     - }
    933     }
    934     bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
    935     BIO_MAX_PAGES, GFP_NOFS|__GFP_HIGH);
    936     diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
    937     index ebbacd14d450..447a915db25d 100644
    938     --- a/include/linux/buffer_head.h
    939     +++ b/include/linux/buffer_head.h
    940     @@ -226,6 +226,7 @@ int generic_write_end(struct file *, struct address_space *,
    941     loff_t, unsigned, unsigned,
    942     struct page *, void *);
    943     void page_zero_new_buffers(struct page *page, unsigned from, unsigned to);
    944     +void clean_page_buffers(struct page *page);
    945     int cont_write_begin(struct file *, struct address_space *, loff_t,
    946     unsigned, unsigned, struct page **, void **,
    947     get_block_t *, loff_t *);
    948     diff --git a/include/sound/seq_virmidi.h b/include/sound/seq_virmidi.h
    949     index a03acd0d398a..695257ae64ac 100644
    950     --- a/include/sound/seq_virmidi.h
    951     +++ b/include/sound/seq_virmidi.h
    952     @@ -60,6 +60,7 @@ struct snd_virmidi_dev {
    953     int port; /* created/attached port */
    954     unsigned int flags; /* SNDRV_VIRMIDI_* */
    955     rwlock_t filelist_lock;
    956     + struct rw_semaphore filelist_sem;
    957     struct list_head filelist;
    958     };
    959    
    960     diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
    961     index 10f62c6f48e7..d1a02877a42c 100644
    962     --- a/kernel/rcu/tree.c
    963     +++ b/kernel/rcu/tree.c
    964     @@ -792,8 +792,13 @@ void rcu_irq_exit(void)
    965     long long oldval;
    966     struct rcu_dynticks *rdtp;
    967    
    968     - RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_exit() invoked with irqs enabled!!!");
    969     rdtp = this_cpu_ptr(&rcu_dynticks);
    970     +
    971     + /* Page faults can happen in NMI handlers, so check... */
    972     + if (READ_ONCE(rdtp->dynticks_nmi_nesting))
    973     + return;
    974     +
    975     + RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_exit() invoked with irqs enabled!!!");
    976     oldval = rdtp->dynticks_nesting;
    977     rdtp->dynticks_nesting--;
    978     WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
    979     @@ -930,8 +935,13 @@ void rcu_irq_enter(void)
    980     struct rcu_dynticks *rdtp;
    981     long long oldval;
    982    
    983     - RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_enter() invoked with irqs enabled!!!");
    984     rdtp = this_cpu_ptr(&rcu_dynticks);
    985     +
    986     + /* Page faults can happen in NMI handlers, so check... */
    987     + if (READ_ONCE(rdtp->dynticks_nmi_nesting))
    988     + return;
    989     +
    990     + RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_enter() invoked with irqs enabled!!!");
    991     oldval = rdtp->dynticks_nesting;
    992     rdtp->dynticks_nesting++;
    993     WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
    994     diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    995     index ece0fbc08607..c626f679e1c8 100644
    996     --- a/net/wireless/nl80211.c
    997     +++ b/net/wireless/nl80211.c
    998     @@ -541,6 +541,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
    999     [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
    1000     };
    1001    
    1002     +/* policy for packet pattern attributes */
    1003     +static const struct nla_policy
    1004     +nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
    1005     + [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
    1006     + [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
    1007     + [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
    1008     +};
    1009     +
    1010     static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
    1011     struct netlink_callback *cb,
    1012     struct cfg80211_registered_device **rdev,
    1013     @@ -10009,7 +10017,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
    1014     u8 *mask_pat;
    1015    
    1016     nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
    1017     - nla_len(pat), NULL);
    1018     + nla_len(pat), nl80211_packet_pattern_policy);
    1019     err = -EINVAL;
    1020     if (!pat_tb[NL80211_PKTPAT_MASK] ||
    1021     !pat_tb[NL80211_PKTPAT_PATTERN])
    1022     @@ -10259,7 +10267,7 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
    1023     u8 *mask_pat;
    1024    
    1025     nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
    1026     - nla_len(pat), NULL);
    1027     + nla_len(pat), nl80211_packet_pattern_policy);
    1028     if (!pat_tb[NL80211_PKTPAT_MASK] ||
    1029     !pat_tb[NL80211_PKTPAT_PATTERN])
    1030     return -EINVAL;
    1031     diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
    1032     index 67c4c68ce041..c41148353e19 100644
    1033     --- a/sound/core/seq/seq_clientmgr.c
    1034     +++ b/sound/core/seq/seq_clientmgr.c
    1035     @@ -1259,6 +1259,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
    1036     struct snd_seq_port_info *info = arg;
    1037     struct snd_seq_client_port *port;
    1038     struct snd_seq_port_callback *callback;
    1039     + int port_idx;
    1040    
    1041     /* it is not allowed to create the port for an another client */
    1042     if (info->addr.client != client->number)
    1043     @@ -1269,7 +1270,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
    1044     return -ENOMEM;
    1045    
    1046     if (client->type == USER_CLIENT && info->kernel) {
    1047     - snd_seq_delete_port(client, port->addr.port);
    1048     + port_idx = port->addr.port;
    1049     + snd_seq_port_unlock(port);
    1050     + snd_seq_delete_port(client, port_idx);
    1051     return -EINVAL;
    1052     }
    1053     if (client->type == KERNEL_CLIENT) {
    1054     @@ -1290,6 +1293,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
    1055    
    1056     snd_seq_set_port_info(port, info);
    1057     snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
    1058     + snd_seq_port_unlock(port);
    1059    
    1060     return 0;
    1061     }
    1062     diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
    1063     index fe686ee41c6d..f04714d70bf7 100644
    1064     --- a/sound/core/seq/seq_ports.c
    1065     +++ b/sound/core/seq/seq_ports.c
    1066     @@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp)
    1067     }
    1068    
    1069    
    1070     -/* create a port, port number is returned (-1 on failure) */
    1071     +/* create a port, port number is returned (-1 on failure);
    1072     + * the caller needs to unref the port via snd_seq_port_unlock() appropriately
    1073     + */
    1074     struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
    1075     int port)
    1076     {
    1077     @@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
    1078     snd_use_lock_init(&new_port->use_lock);
    1079     port_subs_info_init(&new_port->c_src);
    1080     port_subs_info_init(&new_port->c_dest);
    1081     + snd_use_lock_use(&new_port->use_lock);
    1082    
    1083     num = port >= 0 ? port : 0;
    1084     mutex_lock(&client->ports_mutex);
    1085     @@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
    1086     list_add_tail(&new_port->list, &p->list);
    1087     client->num_ports++;
    1088     new_port->addr.port = num; /* store the port number in the port */
    1089     + sprintf(new_port->name, "port-%d", num);
    1090     write_unlock_irqrestore(&client->ports_lock, flags);
    1091     mutex_unlock(&client->ports_mutex);
    1092     - sprintf(new_port->name, "port-%d", num);
    1093    
    1094     return new_port;
    1095     }
    1096     diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
    1097     index c82ed3e70506..200764948ed1 100644
    1098     --- a/sound/core/seq/seq_virmidi.c
    1099     +++ b/sound/core/seq/seq_virmidi.c
    1100     @@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
    1101     * decode input event and put to read buffer of each opened file
    1102     */
    1103     static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
    1104     - struct snd_seq_event *ev)
    1105     + struct snd_seq_event *ev,
    1106     + bool atomic)
    1107     {
    1108     struct snd_virmidi *vmidi;
    1109     unsigned char msg[4];
    1110     int len;
    1111    
    1112     - read_lock(&rdev->filelist_lock);
    1113     + if (atomic)
    1114     + read_lock(&rdev->filelist_lock);
    1115     + else
    1116     + down_read(&rdev->filelist_sem);
    1117     list_for_each_entry(vmidi, &rdev->filelist, list) {
    1118     if (!vmidi->trigger)
    1119     continue;
    1120     @@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
    1121     snd_rawmidi_receive(vmidi->substream, msg, len);
    1122     }
    1123     }
    1124     - read_unlock(&rdev->filelist_lock);
    1125     + if (atomic)
    1126     + read_unlock(&rdev->filelist_lock);
    1127     + else
    1128     + up_read(&rdev->filelist_sem);
    1129    
    1130     return 0;
    1131     }
    1132     @@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmidi *rmidi, struct snd_seq_event *ev)
    1133     struct snd_virmidi_dev *rdev;
    1134    
    1135     rdev = rmidi->private_data;
    1136     - return snd_virmidi_dev_receive_event(rdev, ev);
    1137     + return snd_virmidi_dev_receive_event(rdev, ev, true);
    1138     }
    1139     #endif /* 0 */
    1140    
    1141     @@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struct snd_seq_event *ev, int direct,
    1142     rdev = private_data;
    1143     if (!(rdev->flags & SNDRV_VIRMIDI_USE))
    1144     return 0; /* ignored */
    1145     - return snd_virmidi_dev_receive_event(rdev, ev);
    1146     + return snd_virmidi_dev_receive_event(rdev, ev, atomic);
    1147     }
    1148    
    1149     /*
    1150     @@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
    1151     struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
    1152     struct snd_rawmidi_runtime *runtime = substream->runtime;
    1153     struct snd_virmidi *vmidi;
    1154     - unsigned long flags;
    1155    
    1156     vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
    1157     if (vmidi == NULL)
    1158     @@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
    1159     vmidi->client = rdev->client;
    1160     vmidi->port = rdev->port;
    1161     runtime->private_data = vmidi;
    1162     - write_lock_irqsave(&rdev->filelist_lock, flags);
    1163     + down_write(&rdev->filelist_sem);
    1164     + write_lock_irq(&rdev->filelist_lock);
    1165     list_add_tail(&vmidi->list, &rdev->filelist);
    1166     - write_unlock_irqrestore(&rdev->filelist_lock, flags);
    1167     + write_unlock_irq(&rdev->filelist_lock);
    1168     + up_write(&rdev->filelist_sem);
    1169     vmidi->rdev = rdev;
    1170     return 0;
    1171     }
    1172     @@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
    1173     struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
    1174     struct snd_virmidi *vmidi = substream->runtime->private_data;
    1175    
    1176     + down_write(&rdev->filelist_sem);
    1177     write_lock_irq(&rdev->filelist_lock);
    1178     list_del(&vmidi->list);
    1179     write_unlock_irq(&rdev->filelist_lock);
    1180     + up_write(&rdev->filelist_sem);
    1181     snd_midi_event_free(vmidi->parser);
    1182     substream->runtime->private_data = NULL;
    1183     kfree(vmidi);
    1184     @@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *card, int device, struct snd_rawmidi **rrmi
    1185     rdev->rmidi = rmidi;
    1186     rdev->device = device;
    1187     rdev->client = -1;
    1188     + init_rwsem(&rdev->filelist_sem);
    1189     rwlock_init(&rdev->filelist_lock);
    1190     INIT_LIST_HEAD(&rdev->filelist);
    1191     rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
    1192     diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
    1193     index b871ba407e4e..4458190149d1 100644
    1194     --- a/sound/usb/caiaq/device.c
    1195     +++ b/sound/usb/caiaq/device.c
    1196     @@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
    1197    
    1198     err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
    1199     if (err)
    1200     - return err;
    1201     + goto err_kill_urb;
    1202    
    1203     - if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ))
    1204     - return -ENODEV;
    1205     + if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
    1206     + err = -ENODEV;
    1207     + goto err_kill_urb;
    1208     + }
    1209    
    1210     usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
    1211     cdev->vendor_name, CAIAQ_USB_STR_LEN);
    1212     @@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
    1213    
    1214     setup_card(cdev);
    1215     return 0;
    1216     +
    1217     + err_kill_urb:
    1218     + usb_kill_urb(&cdev->ep1_in_urb);
    1219     + return err;
    1220     }
    1221    
    1222     static int snd_probe(struct usb_interface *intf,
    1223     diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
    1224     index ab3c280a23d1..58d624938a9f 100644
    1225     --- a/sound/usb/line6/driver.c
    1226     +++ b/sound/usb/line6/driver.c
    1227     @@ -775,9 +775,10 @@ int line6_probe(struct usb_interface *interface,
    1228     return 0;
    1229    
    1230     error:
    1231     - if (line6->disconnect)
    1232     - line6->disconnect(line6);
    1233     - snd_card_free(card);
    1234     + /* we can call disconnect callback here because no close-sync is
    1235     + * needed yet at this point
    1236     + */
    1237     + line6_disconnect(interface);
    1238     return ret;
    1239     }
    1240     EXPORT_SYMBOL_GPL(line6_probe);
    1241     diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
    1242     index 49cd4a65e390..5ab9e0c89211 100644
    1243     --- a/sound/usb/line6/podhd.c
    1244     +++ b/sound/usb/line6/podhd.c
    1245     @@ -307,6 +307,9 @@ static int podhd_init(struct usb_line6 *line6,
    1246    
    1247     line6->disconnect = podhd_disconnect;
    1248    
    1249     + init_timer(&pod->startup_timer);
    1250     + INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
    1251     +
    1252     if (pod->line6.properties->capabilities & LINE6_CAP_CONTROL) {
    1253     /* create sysfs entries: */
    1254     err = snd_card_add_dev_attr(line6->card, &podhd_dev_attr_group);
    1255     @@ -330,8 +333,6 @@ static int podhd_init(struct usb_line6 *line6,
    1256     }
    1257    
    1258     /* init device and delay registering */
    1259     - init_timer(&pod->startup_timer);
    1260     - INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
    1261     podhd_startup(pod);
    1262     return 0;
    1263     }
    1264     diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
    1265     index d09c28c1deaf..d82e3c81c258 100644
    1266     --- a/sound/usb/mixer.c
    1267     +++ b/sound/usb/mixer.c
    1268     @@ -2228,6 +2228,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
    1269    
    1270     static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
    1271     {
    1272     + /* kill pending URBs */
    1273     + snd_usb_mixer_disconnect(mixer);
    1274     +
    1275     kfree(mixer->id_elems);
    1276     if (mixer->urb) {
    1277     kfree(mixer->urb->transfer_buffer);
    1278     @@ -2578,8 +2581,13 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
    1279    
    1280     void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
    1281     {
    1282     - usb_kill_urb(mixer->urb);
    1283     - usb_kill_urb(mixer->rc_urb);
    1284     + if (mixer->disconnected)
    1285     + return;
    1286     + if (mixer->urb)
    1287     + usb_kill_urb(mixer->urb);
    1288     + if (mixer->rc_urb)
    1289     + usb_kill_urb(mixer->rc_urb);
    1290     + mixer->disconnected = true;
    1291     }
    1292    
    1293     #ifdef CONFIG_PM
    1294     diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
    1295     index 2b4b067646ab..545d99b09706 100644
    1296     --- a/sound/usb/mixer.h
    1297     +++ b/sound/usb/mixer.h
    1298     @@ -22,6 +22,8 @@ struct usb_mixer_interface {
    1299     struct urb *rc_urb;
    1300     struct usb_ctrlrequest *rc_setup_packet;
    1301     u8 rc_buffer[6];
    1302     +
    1303     + bool disconnected;
    1304     };
    1305    
    1306     #define MAX_CHANNELS 16 /* max logical channels */