Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0184-4.9.85-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0184-4.9.85-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3204 - (show annotations) (download)
    Wed Aug 8 14:26:08 2018 UTC (5 years, 8 months ago) by niro
    File size: 48522 byte(s) 
    -linux-4.9.85
    1 diff --git a/Makefile b/Makefile
    2 index db13b13cdcc2..77deaa395d69 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 84
    9 +SUBLEVEL = 85
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
    14 index c743d1fd8286..5963be2e05f0 100644
    15 --- a/arch/arm64/kernel/traps.c
    16 +++ b/arch/arm64/kernel/traps.c
    17 @@ -50,7 +50,7 @@ static const char *handler[]= {
    18 "Error"
    19 };
    20
    21 -int show_unhandled_signals = 1;
    22 +int show_unhandled_signals = 0;
    23
    24 /*
    25 * Dump out the contents of some kernel memory nicely...
    26 diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
    27 index db5009ce065a..8d7e4d48db0d 100644
    28 --- a/arch/x86/entry/entry_64.S
    29 +++ b/arch/x86/entry/entry_64.S
    30 @@ -176,13 +176,26 @@ GLOBAL(entry_SYSCALL_64_after_swapgs)
    31 pushq %r8 /* pt_regs->r8 */
    32 pushq %r9 /* pt_regs->r9 */
    33 pushq %r10 /* pt_regs->r10 */
    34 + /*
    35 + * Clear extra registers that a speculation attack might
    36 + * otherwise want to exploit. Interleave XOR with PUSH
    37 + * for better uop scheduling:
    38 + */
    39 + xorq %r10, %r10 /* nospec r10 */
    40 pushq %r11 /* pt_regs->r11 */
    41 + xorq %r11, %r11 /* nospec r11 */
    42 pushq %rbx /* pt_regs->rbx */
    43 + xorl %ebx, %ebx /* nospec rbx */
    44 pushq %rbp /* pt_regs->rbp */
    45 + xorl %ebp, %ebp /* nospec rbp */
    46 pushq %r12 /* pt_regs->r12 */
    47 + xorq %r12, %r12 /* nospec r12 */
    48 pushq %r13 /* pt_regs->r13 */
    49 + xorq %r13, %r13 /* nospec r13 */
    50 pushq %r14 /* pt_regs->r14 */
    51 + xorq %r14, %r14 /* nospec r14 */
    52 pushq %r15 /* pt_regs->r15 */
    53 + xorq %r15, %r15 /* nospec r15 */
    54
    55 /* IRQs are off. */
    56 movq %rsp, %rdi
    57 diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
    58 index 28c04123b6dd..842ca3cab6b3 100644
    59 --- a/arch/x86/oprofile/nmi_int.c
    60 +++ b/arch/x86/oprofile/nmi_int.c
    61 @@ -472,7 +472,7 @@ static int nmi_setup(void)
    62 goto fail;
    63
    64 for_each_possible_cpu(cpu) {
    65 - if (!cpu)
    66 + if (!IS_ENABLED(CONFIG_SMP) || !cpu)
    67 continue;
    68
    69 memcpy(per_cpu(cpu_msrs, cpu).counters,
    70 diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
    71 index 80e4cfb2471a..d5abdf8878fe 100644
    72 --- a/arch/xtensa/mm/init.c
    73 +++ b/arch/xtensa/mm/init.c
    74 @@ -77,19 +77,75 @@ void __init zones_init(void)
    75 free_area_init_node(0, zones_size, ARCH_PFN_OFFSET, NULL);
    76 }
    77
    78 +#ifdef CONFIG_HIGHMEM
    79 +static void __init free_area_high(unsigned long pfn, unsigned long end)
    80 +{
    81 + for (; pfn < end; pfn++)
    82 + free_highmem_page(pfn_to_page(pfn));
    83 +}
    84 +
    85 +static void __init free_highpages(void)
    86 +{
    87 + unsigned long max_low = max_low_pfn;
    88 + struct memblock_region *mem, *res;
    89 +
    90 + reset_all_zones_managed_pages();
    91 + /* set highmem page free */
    92 + for_each_memblock(memory, mem) {
    93 + unsigned long start = memblock_region_memory_base_pfn(mem);
    94 + unsigned long end = memblock_region_memory_end_pfn(mem);
    95 +
    96 + /* Ignore complete lowmem entries */
    97 + if (end <= max_low)
    98 + continue;
    99 +
    100 + if (memblock_is_nomap(mem))
    101 + continue;
    102 +
    103 + /* Truncate partial highmem entries */
    104 + if (start < max_low)
    105 + start = max_low;
    106 +
    107 + /* Find and exclude any reserved regions */
    108 + for_each_memblock(reserved, res) {
    109 + unsigned long res_start, res_end;
    110 +
    111 + res_start = memblock_region_reserved_base_pfn(res);
    112 + res_end = memblock_region_reserved_end_pfn(res);
    113 +
    114 + if (res_end < start)
    115 + continue;
    116 + if (res_start < start)
    117 + res_start = start;
    118 + if (res_start > end)
    119 + res_start = end;
    120 + if (res_end > end)
    121 + res_end = end;
    122 + if (res_start != start)
    123 + free_area_high(start, res_start);
    124 + start = res_end;
    125 + if (start == end)
    126 + break;
    127 + }
    128 +
    129 + /* And now free anything which remains */
    130 + if (start < end)
    131 + free_area_high(start, end);
    132 + }
    133 +}
    134 +#else
    135 +static void __init free_highpages(void)
    136 +{
    137 +}
    138 +#endif
    139 +
    140 /*
    141 * Initialize memory pages.
    142 */
    143
    144 void __init mem_init(void)
    145 {
    146 -#ifdef CONFIG_HIGHMEM
    147 - unsigned long tmp;
    148 -
    149 - reset_all_zones_managed_pages();
    150 - for (tmp = max_low_pfn; tmp < max_pfn; tmp++)
    151 - free_highmem_page(pfn_to_page(tmp));
    152 -#endif
    153 + free_highpages();
    154
    155 max_mapnr = max_pfn - ARCH_PFN_OFFSET;
    156 high_memory = (void *)__va(max_low_pfn << PAGE_SHIFT);
    157 diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
    158 index 5a37962d2199..df1bde273bba 100644
    159 --- a/crypto/asymmetric_keys/pkcs7_verify.c
    160 +++ b/crypto/asymmetric_keys/pkcs7_verify.c
    161 @@ -261,7 +261,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
    162 sinfo->index);
    163 return 0;
    164 }
    165 - ret = public_key_verify_signature(p->pub, p->sig);
    166 + ret = public_key_verify_signature(p->pub, x509->sig);
    167 if (ret < 0)
    168 return ret;
    169 x509->signer = p;
    170 diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
    171 index 4955eb66e361..8525fe474abd 100644
    172 --- a/crypto/asymmetric_keys/public_key.c
    173 +++ b/crypto/asymmetric_keys/public_key.c
    174 @@ -93,9 +93,11 @@ int public_key_verify_signature(const struct public_key *pkey,
    175
    176 BUG_ON(!pkey);
    177 BUG_ON(!sig);
    178 - BUG_ON(!sig->digest);
    179 BUG_ON(!sig->s);
    180
    181 + if (!sig->digest)
    182 + return -ENOPKG;
    183 +
    184 alg_name = sig->pkey_algo;
    185 if (strcmp(sig->pkey_algo, "rsa") == 0) {
    186 /* The data wangled by the RSA algorithm is typically padded
    187 diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
    188 index 19d1afb9890f..09b1374dc619 100644
    189 --- a/crypto/asymmetric_keys/restrict.c
    190 +++ b/crypto/asymmetric_keys/restrict.c
    191 @@ -66,8 +66,9 @@ __setup("ca_keys=", ca_keys_setup);
    192 *
    193 * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a
    194 * matching parent certificate in the trusted list, -EKEYREJECTED if the
    195 - * signature check fails or the key is blacklisted and some other error if
    196 - * there is a matching certificate but the signature check cannot be performed.
    197 + * signature check fails or the key is blacklisted, -ENOPKG if the signature
    198 + * uses unsupported crypto, or some other error if there is a matching
    199 + * certificate but the signature check cannot be performed.
    200 */
    201 int restrict_link_by_signature(struct key *trust_keyring,
    202 const struct key_type *type,
    203 @@ -86,6 +87,8 @@ int restrict_link_by_signature(struct key *trust_keyring,
    204 return -EOPNOTSUPP;
    205
    206 sig = payload->data[asym_auth];
    207 + if (!sig)
    208 + return -ENOPKG;
    209 if (!sig->auth_ids[0] && !sig->auth_ids[1])
    210 return -ENOKEY;
    211
    212 diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    213 index 3b6ac80b2127..49199bd2ab93 100644
    214 --- a/drivers/android/binder.c
    215 +++ b/drivers/android/binder.c
    216 @@ -2628,8 +2628,10 @@ static unsigned int binder_poll(struct file *filp,
    217 binder_lock(__func__);
    218
    219 thread = binder_get_thread(proc);
    220 - if (!thread)
    221 + if (!thread) {
    222 + binder_unlock(__func__);
    223 return POLLERR;
    224 + }
    225
    226 wait_for_proc_work = thread->transaction_stack == NULL &&
    227 list_empty(&thread->todo) && thread->return_error == BR_OK;
    228 diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
    229 index 40be3747724d..473b44c008dd 100644
    230 --- a/drivers/dax/dax.c
    231 +++ b/drivers/dax/dax.c
    232 @@ -453,9 +453,21 @@ static int dax_dev_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
    233 return rc;
    234 }
    235
    236 +static int dax_dev_split(struct vm_area_struct *vma, unsigned long addr)
    237 +{
    238 + struct file *filp = vma->vm_file;
    239 + struct dax_dev *dax_dev = filp->private_data;
    240 + struct dax_region *dax_region = dax_dev->region;
    241 +
    242 + if (!IS_ALIGNED(addr, dax_region->align))
    243 + return -EINVAL;
    244 + return 0;
    245 +}
    246 +
    247 static const struct vm_operations_struct dax_dev_vm_ops = {
    248 .fault = dax_dev_fault,
    249 .pmd_fault = dax_dev_pmd_fault,
    250 + .split = dax_dev_split,
    251 };
    252
    253 static int dax_mmap(struct file *filp, struct vm_area_struct *vma)
    254 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
    255 index 6c343a933182..0e8f8972a160 100644
    256 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
    257 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
    258 @@ -14,6 +14,16 @@
    259
    260 #include "amd_acpi.h"
    261
    262 +#define AMDGPU_PX_QUIRK_FORCE_ATPX (1 << 0)
    263 +
    264 +struct amdgpu_px_quirk {
    265 + u32 chip_vendor;
    266 + u32 chip_device;
    267 + u32 subsys_vendor;
    268 + u32 subsys_device;
    269 + u32 px_quirk_flags;
    270 +};
    271 +
    272 struct amdgpu_atpx_functions {
    273 bool px_params;
    274 bool power_cntl;
    275 @@ -35,6 +45,7 @@ struct amdgpu_atpx {
    276 static struct amdgpu_atpx_priv {
    277 bool atpx_detected;
    278 bool bridge_pm_usable;
    279 + unsigned int quirks;
    280 /* handle for device - and atpx */
    281 acpi_handle dhandle;
    282 acpi_handle other_handle;
    283 @@ -205,13 +216,19 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
    284
    285 atpx->is_hybrid = false;
    286 if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
    287 - printk("ATPX Hybrid Graphics\n");
    288 - /*
    289 - * Disable legacy PM methods only when pcie port PM is usable,
    290 - * otherwise the device might fail to power off or power on.
    291 - */
    292 - atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
    293 - atpx->is_hybrid = true;
    294 + if (amdgpu_atpx_priv.quirks & AMDGPU_PX_QUIRK_FORCE_ATPX) {
    295 + printk("ATPX Hybrid Graphics, forcing to ATPX\n");
    296 + atpx->functions.power_cntl = true;
    297 + atpx->is_hybrid = false;
    298 + } else {
    299 + printk("ATPX Hybrid Graphics\n");
    300 + /*
    301 + * Disable legacy PM methods only when pcie port PM is usable,
    302 + * otherwise the device might fail to power off or power on.
    303 + */
    304 + atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
    305 + atpx->is_hybrid = true;
    306 + }
    307 }
    308
    309 atpx->dgpu_req_power_for_displays = false;
    310 @@ -547,6 +564,31 @@ static const struct vga_switcheroo_handler amdgpu_atpx_handler = {
    311 .get_client_id = amdgpu_atpx_get_client_id,
    312 };
    313
    314 +static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
    315 + /* HG _PR3 doesn't seem to work on this A+A weston board */
    316 + { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
    317 + { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
    318 + { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
    319 + { 0, 0, 0, 0, 0 },
    320 +};
    321 +
    322 +static void amdgpu_atpx_get_quirks(struct pci_dev *pdev)
    323 +{
    324 + const struct amdgpu_px_quirk *p = amdgpu_px_quirk_list;
    325 +
    326 + /* Apply PX quirks */
    327 + while (p && p->chip_device != 0) {
    328 + if (pdev->vendor == p->chip_vendor &&
    329 + pdev->device == p->chip_device &&
    330 + pdev->subsystem_vendor == p->subsys_vendor &&
    331 + pdev->subsystem_device == p->subsys_device) {
    332 + amdgpu_atpx_priv.quirks |= p->px_quirk_flags;
    333 + break;
    334 + }
    335 + ++p;
    336 + }
    337 +}
    338 +
    339 /**
    340 * amdgpu_atpx_detect - detect whether we have PX
    341 *
    342 @@ -570,6 +612,7 @@ static bool amdgpu_atpx_detect(void)
    343
    344 parent_pdev = pci_upstream_bridge(pdev);
    345 d3_supported |= parent_pdev && parent_pdev->bridge_d3;
    346 + amdgpu_atpx_get_quirks(pdev);
    347 }
    348
    349 while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
    350 @@ -579,6 +622,7 @@ static bool amdgpu_atpx_detect(void)
    351
    352 parent_pdev = pci_upstream_bridge(pdev);
    353 d3_supported |= parent_pdev && parent_pdev->bridge_d3;
    354 + amdgpu_atpx_get_quirks(pdev);
    355 }
    356
    357 if (has_atpx && vga_count == 2) {
    358 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
    359 index ce9797b6f9c7..50f18f666d67 100644
    360 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
    361 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
    362 @@ -1678,8 +1678,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,
    363 * ignore it */
    364 vga_client_register(adev->pdev, adev, NULL, amdgpu_vga_set_decode);
    365
    366 - if (amdgpu_runtime_pm == 1)
    367 - runtime = true;
    368 if (amdgpu_device_is_px(ddev))
    369 runtime = true;
    370 vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime);
    371 diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    372 index 4cb347e88cf0..002862be2df6 100644
    373 --- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    374 +++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    375 @@ -3507,6 +3507,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
    376 max_sclk = 75000;
    377 max_mclk = 80000;
    378 }
    379 + if ((adev->pdev->revision == 0xC3) ||
    380 + (adev->pdev->device == 0x6665)) {
    381 + max_sclk = 60000;
    382 + max_mclk = 80000;
    383 + }
    384 } else if (adev->asic_type == CHIP_OLAND) {
    385 if ((adev->pdev->revision == 0xC7) ||
    386 (adev->pdev->revision == 0x80) ||
    387 diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
    388 index 0151ed2de770..c6b281aa762f 100644
    389 --- a/drivers/gpu/drm/drm_edid.c
    390 +++ b/drivers/gpu/drm/drm_edid.c
    391 @@ -107,6 +107,9 @@ static const struct edid_quirk {
    392 /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
    393 { "AEO", 0, EDID_QUIRK_FORCE_6BPC },
    394
    395 + /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */
    396 + { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC },
    397 +
    398 /* Belinea 10 15 55 */
    399 { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
    400 { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
    401 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
    402 index 03cac5731afc..49406e106cee 100644
    403 --- a/drivers/hid/hid-core.c
    404 +++ b/drivers/hid/hid-core.c
    405 @@ -2443,6 +2443,9 @@ static const struct hid_device_id hid_ignore_list[] = {
    406 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
    407 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
    408 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
    409 + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
    410 + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
    411 + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
    412 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
    413 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
    414 { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
    415 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    416 index 244b97c1b74e..9347b37a1303 100644
    417 --- a/drivers/hid/hid-ids.h
    418 +++ b/drivers/hid/hid-ids.h
    419 @@ -608,6 +608,9 @@
    420 #define USB_DEVICE_ID_LD_MICROCASSYTIME 0x1033
    421 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE 0x1035
    422 #define USB_DEVICE_ID_LD_MICROCASSYPH 0x1038
    423 +#define USB_DEVICE_ID_LD_POWERANALYSERCASSY 0x1040
    424 +#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY 0x1042
    425 +#define USB_DEVICE_ID_LD_MACHINETESTCASSY 0x1043
    426 #define USB_DEVICE_ID_LD_JWM 0x1080
    427 #define USB_DEVICE_ID_LD_DMMP 0x1081
    428 #define USB_DEVICE_ID_LD_UMIP 0x1090
    429 diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
    430 index f53e9a803a0e..93b99bd93738 100644
    431 --- a/drivers/iio/imu/adis_trigger.c
    432 +++ b/drivers/iio/imu/adis_trigger.c
    433 @@ -47,6 +47,10 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
    434 if (adis->trig == NULL)
    435 return -ENOMEM;
    436
    437 + adis->trig->dev.parent = &adis->spi->dev;
    438 + adis->trig->ops = &adis_trigger_ops;
    439 + iio_trigger_set_drvdata(adis->trig, adis);
    440 +
    441 ret = request_irq(adis->spi->irq,
    442 &iio_trigger_generic_data_rdy_poll,
    443 IRQF_TRIGGER_RISING,
    444 @@ -55,9 +59,6 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
    445 if (ret)
    446 goto error_free_trig;
    447
    448 - adis->trig->dev.parent = &adis->spi->dev;
    449 - adis->trig->ops = &adis_trigger_ops;
    450 - iio_trigger_set_drvdata(adis->trig, adis);
    451 ret = iio_trigger_register(adis->trig);
    452
    453 indio_dev->trig = iio_trigger_get(adis->trig);
    454 diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
    455 index 158aaf44dd95..5d05c38c4ba9 100644
    456 --- a/drivers/iio/industrialio-buffer.c
    457 +++ b/drivers/iio/industrialio-buffer.c
    458 @@ -174,7 +174,7 @@ unsigned int iio_buffer_poll(struct file *filp,
    459 struct iio_dev *indio_dev = filp->private_data;
    460 struct iio_buffer *rb = indio_dev->buffer;
    461
    462 - if (!indio_dev->info)
    463 + if (!indio_dev->info || rb == NULL)
    464 return 0;
    465
    466 poll_wait(filp, &rb->pollq, wait);
    467 diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    468 index c22fde6207d1..8e973a2993a6 100644
    469 --- a/drivers/infiniband/core/umem.c
    470 +++ b/drivers/infiniband/core/umem.c
    471 @@ -193,7 +193,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    472 sg_list_start = umem->sg_head.sgl;
    473
    474 while (npages) {
    475 - ret = get_user_pages(cur_base,
    476 + ret = get_user_pages_longterm(cur_base,
    477 min_t(unsigned long, npages,
    478 PAGE_SIZE / sizeof (struct page *)),
    479 gup_flags, page_list, vma_list);
    480 diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
    481 index 44b1104eb168..c5e921bf9130 100644
    482 --- a/drivers/infiniband/core/uverbs_main.c
    483 +++ b/drivers/infiniband/core/uverbs_main.c
    484 @@ -735,12 +735,21 @@ static int verify_command_mask(struct ib_device *ib_dev, __u32 command)
    485 return -1;
    486 }
    487
    488 +static bool verify_command_idx(u32 command, bool extended)
    489 +{
    490 + if (extended)
    491 + return command < ARRAY_SIZE(uverbs_ex_cmd_table);
    492 +
    493 + return command < ARRAY_SIZE(uverbs_cmd_table);
    494 +}
    495 +
    496 static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
    497 size_t count, loff_t *pos)
    498 {
    499 struct ib_uverbs_file *file = filp->private_data;
    500 struct ib_device *ib_dev;
    501 struct ib_uverbs_cmd_hdr hdr;
    502 + bool extended_command;
    503 __u32 command;
    504 __u32 flags;
    505 int srcu_key;
    506 @@ -770,6 +779,15 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
    507 }
    508
    509 command = hdr.command & IB_USER_VERBS_CMD_COMMAND_MASK;
    510 + flags = (hdr.command &
    511 + IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
    512 +
    513 + extended_command = flags & IB_USER_VERBS_CMD_FLAG_EXTENDED;
    514 + if (!verify_command_idx(command, extended_command)) {
    515 + ret = -EINVAL;
    516 + goto out;
    517 + }
    518 +
    519 if (verify_command_mask(ib_dev, command)) {
    520 ret = -EOPNOTSUPP;
    521 goto out;
    522 @@ -781,12 +799,8 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
    523 goto out;
    524 }
    525
    526 - flags = (hdr.command &
    527 - IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
    528 -
    529 if (!flags) {
    530 - if (command >= ARRAY_SIZE(uverbs_cmd_table) ||
    531 - !uverbs_cmd_table[command]) {
    532 + if (!uverbs_cmd_table[command]) {
    533 ret = -EINVAL;
    534 goto out;
    535 }
    536 @@ -807,8 +821,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
    537 struct ib_udata uhw;
    538 size_t written_count = count;
    539
    540 - if (command >= ARRAY_SIZE(uverbs_ex_cmd_table) ||
    541 - !uverbs_ex_cmd_table[command]) {
    542 + if (!uverbs_ex_cmd_table[command]) {
    543 ret = -ENOSYS;
    544 goto out;
    545 }
    546 diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
    547 index a37576a1798d..fd4a78296b48 100644
    548 --- a/drivers/irqchip/irq-gic-v3.c
    549 +++ b/drivers/irqchip/irq-gic-v3.c
    550 @@ -616,7 +616,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
    551 * Ensure that stores to Normal memory are visible to the
    552 * other CPUs before issuing the IPI.
    553 */
    554 - smp_wmb();
    555 + wmb();
    556
    557 for_each_cpu(cpu, mask) {
    558 unsigned long cluster_id = cpu_logical_map(cpu) & ~0xffUL;
    559 diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
    560 index 1db0af6c7f94..b6189a4958c5 100644
    561 --- a/drivers/media/v4l2-core/videobuf-dma-sg.c
    562 +++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
    563 @@ -185,12 +185,13 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
    564 dprintk(1, "init user [0x%lx+0x%lx => %d pages]\n",
    565 data, size, dma->nr_pages);
    566
    567 - err = get_user_pages(data & PAGE_MASK, dma->nr_pages,
    568 + err = get_user_pages_longterm(data & PAGE_MASK, dma->nr_pages,
    569 flags, dma->pages, NULL);
    570
    571 if (err != dma->nr_pages) {
    572 dma->nr_pages = (err >= 0) ? err : 0;
    573 - dprintk(1, "get_user_pages: err=%d [%d]\n", err, dma->nr_pages);
    574 + dprintk(1, "get_user_pages_longterm: err=%d [%d]\n", err,
    575 + dma->nr_pages);
    576 return err < 0 ? err : -EINVAL;
    577 }
    578 return 0;
    579 diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    580 index 9e073fb6870a..6fd3be69ff21 100644
    581 --- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    582 +++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    583 @@ -2596,7 +2596,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
    584 }
    585
    586 #define EEPROM_STAT_ADDR 0x7bfc
    587 -#define VPD_SIZE 0x800
    588 #define VPD_BASE 0x400
    589 #define VPD_BASE_OLD 0
    590 #define VPD_LEN 1024
    591 @@ -2634,15 +2633,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
    592 if (!vpd)
    593 return -ENOMEM;
    594
    595 - /* We have two VPD data structures stored in the adapter VPD area.
    596 - * By default, Linux calculates the size of the VPD area by traversing
    597 - * the first VPD area at offset 0x0, so we need to tell the OS what
    598 - * our real VPD size is.
    599 - */
    600 - ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
    601 - if (ret < 0)
    602 - goto out;
    603 -
    604 /* Card information normally starts at VPD_BASE but early cards had
    605 * it at 0.
    606 */
    607 diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
    608 index 0392eb8a0dea..8311a93cabd8 100644
    609 --- a/drivers/nvdimm/bus.c
    610 +++ b/drivers/nvdimm/bus.c
    611 @@ -812,16 +812,17 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
    612 int read_only, unsigned int ioctl_cmd, unsigned long arg)
    613 {
    614 struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
    615 - size_t buf_len = 0, in_len = 0, out_len = 0;
    616 static char out_env[ND_CMD_MAX_ENVELOPE];
    617 static char in_env[ND_CMD_MAX_ENVELOPE];
    618 const struct nd_cmd_desc *desc = NULL;
    619 unsigned int cmd = _IOC_NR(ioctl_cmd);
    620 void __user *p = (void __user *) arg;
    621 struct device *dev = &nvdimm_bus->dev;
    622 - struct nd_cmd_pkg pkg;
    623 const char *cmd_name, *dimm_name;
    624 + u32 in_len = 0, out_len = 0;
    625 unsigned long cmd_mask;
    626 + struct nd_cmd_pkg pkg;
    627 + u64 buf_len = 0;
    628 void *buf;
    629 int rc, i;
    630
    631 @@ -882,7 +883,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
    632 }
    633
    634 if (cmd == ND_CMD_CALL) {
    635 - dev_dbg(dev, "%s:%s, idx: %llu, in: %zu, out: %zu, len %zu\n",
    636 + dev_dbg(dev, "%s:%s, idx: %llu, in: %u, out: %u, len %llu\n",
    637 __func__, dimm_name, pkg.nd_command,
    638 in_len, out_len, buf_len);
    639
    640 @@ -912,9 +913,9 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
    641 out_len += out_size;
    642 }
    643
    644 - buf_len = out_len + in_len;
    645 + buf_len = (u64) out_len + (u64) in_len;
    646 if (buf_len > ND_IOCTL_MAX_BUFLEN) {
    647 - dev_dbg(dev, "%s:%s cmd: %s buf_len: %zu > %d\n", __func__,
    648 + dev_dbg(dev, "%s:%s cmd: %s buf_len: %llu > %d\n", __func__,
    649 dimm_name, cmd_name, buf_len,
    650 ND_IOCTL_MAX_BUFLEN);
    651 return -EINVAL;
    652 diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
    653 index 42abdd2391c9..d6aa59ca68b9 100644
    654 --- a/drivers/nvdimm/pfn_devs.c
    655 +++ b/drivers/nvdimm/pfn_devs.c
    656 @@ -563,6 +563,12 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
    657 return altmap;
    658 }
    659
    660 +static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
    661 +{
    662 + return min_t(u64, PHYS_SECTION_ALIGN_DOWN(phys),
    663 + ALIGN_DOWN(phys, nd_pfn->align));
    664 +}
    665 +
    666 static int nd_pfn_init(struct nd_pfn *nd_pfn)
    667 {
    668 u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
    669 @@ -618,13 +624,16 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
    670 start = nsio->res.start;
    671 size = PHYS_SECTION_ALIGN_UP(start + size) - start;
    672 if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
    673 - IORES_DESC_NONE) == REGION_MIXED) {
    674 + IORES_DESC_NONE) == REGION_MIXED
    675 + || !IS_ALIGNED(start + resource_size(&nsio->res),
    676 + nd_pfn->align)) {
    677 size = resource_size(&nsio->res);
    678 - end_trunc = start + size - PHYS_SECTION_ALIGN_DOWN(start + size);
    679 + end_trunc = start + size - phys_pmem_align_down(nd_pfn,
    680 + start + size);
    681 }
    682
    683 if (start_pad + end_trunc)
    684 - dev_info(&nd_pfn->dev, "%s section collision, truncate %d bytes\n",
    685 + dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
    686 dev_name(&ndns->dev), start_pad + end_trunc);
    687
    688 /*
    689 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    690 index 98eba9127a0b..0c9edc9d7c44 100644
    691 --- a/drivers/pci/quirks.c
    692 +++ b/drivers/pci/quirks.c
    693 @@ -3369,22 +3369,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
    694
    695 static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
    696 {
    697 - pci_set_vpd_size(dev, 8192);
    698 -}
    699 -
    700 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
    701 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
    702 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
    703 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
    704 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
    705 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
    706 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
    707 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
    708 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
    709 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
    710 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
    711 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
    712 -DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
    713 + int chip = (dev->device & 0xf000) >> 12;
    714 + int func = (dev->device & 0x0f00) >> 8;
    715 + int prod = (dev->device & 0x00ff) >> 0;
    716 +
    717 + /*
    718 + * If this is a T3-based adapter, there's a 1KB VPD area at offset
    719 + * 0xc00 which contains the preferred VPD values. If this is a T4 or
    720 + * later based adapter, the special VPD is at offset 0x400 for the
    721 + * Physical Functions (the SR-IOV Virtual Functions have no VPD
    722 + * Capabilities). The PCI VPD Access core routines will normally
    723 + * compute the size of the VPD by parsing the VPD Data Structure at
    724 + * offset 0x000. This will result in silent failures when attempting
    725 + * to accesses these other VPD areas which are beyond those computed
    726 + * limits.
    727 + */
    728 + if (chip == 0x0 && prod >= 0x20)
    729 + pci_set_vpd_size(dev, 8192);
    730 + else if (chip >= 0x4 && func < 0x8)
    731 + pci_set_vpd_size(dev, 2048);
    732 +}
    733 +
    734 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
    735 + quirk_chelsio_extend_vpd);
    736
    737 #ifdef CONFIG_ACPI
    738 /*
    739 diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
    740 index 9a0696f68f37..b81a53c4a9a8 100644
    741 --- a/drivers/scsi/ibmvscsi/ibmvfc.h
    742 +++ b/drivers/scsi/ibmvscsi/ibmvfc.h
    743 @@ -367,7 +367,7 @@ enum ibmvfc_fcp_rsp_info_codes {
    744 };
    745
    746 struct ibmvfc_fcp_rsp_info {
    747 - __be16 reserved;
    748 + u8 reserved[3];
    749 u8 rsp_code;
    750 u8 reserved2[4];
    751 }__attribute__((packed, aligned (2)));
    752 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    753 index c05c4f877750..774c97bb1c08 100644
    754 --- a/drivers/usb/core/quirks.c
    755 +++ b/drivers/usb/core/quirks.c
    756 @@ -225,6 +225,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    757 { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    758 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    759
    760 + /* Corsair K70 RGB */
    761 + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
    762 +
    763 /* Corsair Strafe RGB */
    764 { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
    765
    766 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    767 index f483c3b1e971..26efe8c7535f 100644
    768 --- a/drivers/usb/dwc3/gadget.c
    769 +++ b/drivers/usb/dwc3/gadget.c
    770 @@ -2528,6 +2528,8 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
    771 break;
    772 }
    773
    774 + dwc->eps[1]->endpoint.maxpacket = dwc->gadget.ep0->maxpacket;
    775 +
    776 /* Enable USB2 LPM Capability */
    777
    778 if ((dwc->revision > DWC3_REVISION_194A) &&
    779 diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
    780 index d90bf57ba30e..48f52138bb1a 100644
    781 --- a/drivers/usb/gadget/function/f_fs.c
    782 +++ b/drivers/usb/gadget/function/f_fs.c
    783 @@ -2956,10 +2956,8 @@ static int _ffs_func_bind(struct usb_configuration *c,
    784 struct ffs_data *ffs = func->ffs;
    785
    786 const int full = !!func->ffs->fs_descs_count;
    787 - const int high = gadget_is_dualspeed(func->gadget) &&
    788 - func->ffs->hs_descs_count;
    789 - const int super = gadget_is_superspeed(func->gadget) &&
    790 - func->ffs->ss_descs_count;
    791 + const int high = !!func->ffs->hs_descs_count;
    792 + const int super = !!func->ffs->ss_descs_count;
    793
    794 int fs_len, hs_len, ss_len, ret, i;
    795 struct ffs_ep *eps_ptr;
    796 diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
    797 index f6c7a2744e5c..a646ca3b0d00 100644
    798 --- a/drivers/usb/host/ohci-hcd.c
    799 +++ b/drivers/usb/host/ohci-hcd.c
    800 @@ -73,6 +73,7 @@ static const char hcd_name [] = "ohci_hcd";
    801
    802 #define STATECHANGE_DELAY msecs_to_jiffies(300)
    803 #define IO_WATCHDOG_DELAY msecs_to_jiffies(275)
    804 +#define IO_WATCHDOG_OFF 0xffffff00
    805
    806 #include "ohci.h"
    807 #include "pci-quirks.h"
    808 @@ -230,7 +231,7 @@ static int ohci_urb_enqueue (
    809 }
    810
    811 /* Start up the I/O watchdog timer, if it's not running */
    812 - if (!timer_pending(&ohci->io_watchdog) &&
    813 + if (ohci->prev_frame_no == IO_WATCHDOG_OFF &&
    814 list_empty(&ohci->eds_in_use) &&
    815 !(ohci->flags & OHCI_QUIRK_QEMU)) {
    816 ohci->prev_frame_no = ohci_frame_no(ohci);
    817 @@ -501,6 +502,7 @@ static int ohci_init (struct ohci_hcd *ohci)
    818
    819 setup_timer(&ohci->io_watchdog, io_watchdog_func,
    820 (unsigned long) ohci);
    821 + ohci->prev_frame_no = IO_WATCHDOG_OFF;
    822
    823 ohci->hcca = dma_alloc_coherent (hcd->self.controller,
    824 sizeof(*ohci->hcca), &ohci->hcca_dma, GFP_KERNEL);
    825 @@ -730,7 +732,7 @@ static void io_watchdog_func(unsigned long _ohci)
    826 u32 head;
    827 struct ed *ed;
    828 struct td *td, *td_start, *td_next;
    829 - unsigned frame_no;
    830 + unsigned frame_no, prev_frame_no = IO_WATCHDOG_OFF;
    831 unsigned long flags;
    832
    833 spin_lock_irqsave(&ohci->lock, flags);
    834 @@ -835,7 +837,7 @@ static void io_watchdog_func(unsigned long _ohci)
    835 }
    836 }
    837 if (!list_empty(&ohci->eds_in_use)) {
    838 - ohci->prev_frame_no = frame_no;
    839 + prev_frame_no = frame_no;
    840 ohci->prev_wdh_cnt = ohci->wdh_cnt;
    841 ohci->prev_donehead = ohci_readl(ohci,
    842 &ohci->regs->donehead);
    843 @@ -845,6 +847,7 @@ static void io_watchdog_func(unsigned long _ohci)
    844 }
    845
    846 done:
    847 + ohci->prev_frame_no = prev_frame_no;
    848 spin_unlock_irqrestore(&ohci->lock, flags);
    849 }
    850
    851 @@ -973,6 +976,7 @@ static void ohci_stop (struct usb_hcd *hcd)
    852 if (quirk_nec(ohci))
    853 flush_work(&ohci->nec_work);
    854 del_timer_sync(&ohci->io_watchdog);
    855 + ohci->prev_frame_no = IO_WATCHDOG_OFF;
    856
    857 ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
    858 ohci_usb_reset(ohci);
    859 diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
    860 index ed678c17c4ea..798b2d25dda9 100644
    861 --- a/drivers/usb/host/ohci-hub.c
    862 +++ b/drivers/usb/host/ohci-hub.c
    863 @@ -310,8 +310,10 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
    864 rc = ohci_rh_suspend (ohci, 0);
    865 spin_unlock_irq (&ohci->lock);
    866
    867 - if (rc == 0)
    868 + if (rc == 0) {
    869 del_timer_sync(&ohci->io_watchdog);
    870 + ohci->prev_frame_no = IO_WATCHDOG_OFF;
    871 + }
    872 return rc;
    873 }
    874
    875 diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
    876 index 641fed609911..24edb7674710 100644
    877 --- a/drivers/usb/host/ohci-q.c
    878 +++ b/drivers/usb/host/ohci-q.c
    879 @@ -1018,6 +1018,8 @@ static void finish_unlinks(struct ohci_hcd *ohci)
    880 * have modified this list. normally it's just prepending
    881 * entries (which we'd ignore), but paranoia won't hurt.
    882 */
    883 + *last = ed->ed_next;
    884 + ed->ed_next = NULL;
    885 modified = 0;
    886
    887 /* unlink urbs as requested, but rescan the list after
    888 @@ -1076,21 +1078,22 @@ static void finish_unlinks(struct ohci_hcd *ohci)
    889 goto rescan_this;
    890
    891 /*
    892 - * If no TDs are queued, take ED off the ed_rm_list.
    893 + * If no TDs are queued, ED is now idle.
    894 * Otherwise, if the HC is running, reschedule.
    895 - * If not, leave it on the list for further dequeues.
    896 + * If the HC isn't running, add ED back to the
    897 + * start of the list for later processing.
    898 */
    899 if (list_empty(&ed->td_list)) {
    900 - *last = ed->ed_next;
    901 - ed->ed_next = NULL;
    902 ed->state = ED_IDLE;
    903 list_del(&ed->in_use_list);
    904 } else if (ohci->rh_state == OHCI_RH_RUNNING) {
    905 - *last = ed->ed_next;
    906 - ed->ed_next = NULL;
    907 ed_schedule(ohci, ed);
    908 } else {
    909 - last = &ed->ed_next;
    910 + ed->ed_next = ohci->ed_rm_list;
    911 + ohci->ed_rm_list = ed;
    912 + /* Don't loop on the same ED */
    913 + if (last == &ohci->ed_rm_list)
    914 + last = &ed->ed_next;
    915 }
    916
    917 if (modified)
    918 diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
    919 index 9ca595632f17..c5e3032a4d6b 100644
    920 --- a/drivers/usb/misc/ldusb.c
    921 +++ b/drivers/usb/misc/ldusb.c
    922 @@ -46,6 +46,9 @@
    923 #define USB_DEVICE_ID_LD_MICROCASSYTIME 0x1033 /* USB Product ID of Micro-CASSY Time (reserved) */
    924 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE 0x1035 /* USB Product ID of Micro-CASSY Temperature */
    925 #define USB_DEVICE_ID_LD_MICROCASSYPH 0x1038 /* USB Product ID of Micro-CASSY pH */
    926 +#define USB_DEVICE_ID_LD_POWERANALYSERCASSY 0x1040 /* USB Product ID of Power Analyser CASSY */
    927 +#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY 0x1042 /* USB Product ID of Converter Controller CASSY */
    928 +#define USB_DEVICE_ID_LD_MACHINETESTCASSY 0x1043 /* USB Product ID of Machine Test CASSY */
    929 #define USB_DEVICE_ID_LD_JWM 0x1080 /* USB Product ID of Joule and Wattmeter */
    930 #define USB_DEVICE_ID_LD_DMMP 0x1081 /* USB Product ID of Digital Multimeter P (reserved) */
    931 #define USB_DEVICE_ID_LD_UMIP 0x1090 /* USB Product ID of UMI P */
    932 @@ -88,6 +91,9 @@ static const struct usb_device_id ld_usb_table[] = {
    933 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
    934 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
    935 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
    936 + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
    937 + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
    938 + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
    939 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
    940 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
    941 { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
    942 diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
    943 index 55c624f2a8c0..43033895e8f6 100644
    944 --- a/drivers/usb/musb/musb_host.c
    945 +++ b/drivers/usb/musb/musb_host.c
    946 @@ -418,13 +418,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
    947 }
    948 }
    949
    950 - /*
    951 - * The pipe must be broken if current urb->status is set, so don't
    952 - * start next urb.
    953 - * TODO: to minimize the risk of regression, only check urb->status
    954 - * for RX, until we have a test case to understand the behavior of TX.
    955 - */
    956 - if ((!status || !is_in) && qh && qh->is_ready) {
    957 + if (qh != NULL && qh->is_ready) {
    958 musb_dbg(musb, "... next ep%d %cX urb %p",
    959 hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
    960 musb_start_urb(musb, is_in, qh);
    961 diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
    962 index 6c6a3a8df07a..968ade5a35f5 100644
    963 --- a/drivers/usb/renesas_usbhs/fifo.c
    964 +++ b/drivers/usb/renesas_usbhs/fifo.c
    965 @@ -1001,6 +1001,10 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
    966 if ((uintptr_t)pkt->buf & (USBHS_USB_DMAC_XFER_SIZE - 1))
    967 goto usbhsf_pio_prepare_pop;
    968
    969 + /* return at this time if the pipe is running */
    970 + if (usbhs_pipe_is_running(pipe))
    971 + return 0;
    972 +
    973 usbhs_pipe_config_change_bfre(pipe, 1);
    974
    975 ret = usbhsf_fifo_select(pipe, fifo, 0);
    976 @@ -1191,6 +1195,7 @@ static int usbhsf_dma_pop_done_with_usb_dmac(struct usbhs_pkt *pkt,
    977 usbhsf_fifo_clear(pipe, fifo);
    978 pkt->actual = usbhs_dma_calc_received_size(pkt, chan, rcv_len);
    979
    980 + usbhs_pipe_running(pipe, 0);
    981 usbhsf_dma_stop(pipe, fifo);
    982 usbhsf_dma_unmap(pkt);
    983 usbhsf_fifo_unselect(pipe, pipe->fifo);
    984 diff --git a/fs/dax.c b/fs/dax.c
    985 index 800748f10b3d..71f87d74afe1 100644
    986 --- a/fs/dax.c
    987 +++ b/fs/dax.c
    988 @@ -785,6 +785,7 @@ int dax_writeback_mapping_range(struct address_space *mapping,
    989 if (ret < 0)
    990 return ret;
    991 }
    992 + start_index = indices[pvec.nr - 1] + 1;
    993 }
    994 return 0;
    995 }
    996 diff --git a/include/linux/dax.h b/include/linux/dax.h
    997 index add6c4bc568f..ed9cf2f5cd06 100644
    998 --- a/include/linux/dax.h
    999 +++ b/include/linux/dax.h
    1000 @@ -61,11 +61,6 @@ static inline int dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
    1001 int dax_pfn_mkwrite(struct vm_area_struct *, struct vm_fault *);
    1002 #define dax_mkwrite(vma, vmf, gb) dax_fault(vma, vmf, gb)
    1003
    1004 -static inline bool vma_is_dax(struct vm_area_struct *vma)
    1005 -{
    1006 - return vma->vm_file && IS_DAX(vma->vm_file->f_mapping->host);
    1007 -}
    1008 -
    1009 static inline bool dax_mapping(struct address_space *mapping)
    1010 {
    1011 return mapping->host && IS_DAX(mapping->host);
    1012 diff --git a/include/linux/fs.h b/include/linux/fs.h
    1013 index d705ae084edd..745ea1b2e02c 100644
    1014 --- a/include/linux/fs.h
    1015 +++ b/include/linux/fs.h
    1016 @@ -18,6 +18,7 @@
    1017 #include <linux/bug.h>
    1018 #include <linux/mutex.h>
    1019 #include <linux/rwsem.h>
    1020 +#include <linux/mm_types.h>
    1021 #include <linux/capability.h>
    1022 #include <linux/semaphore.h>
    1023 #include <linux/fiemap.h>
    1024 @@ -3033,6 +3034,25 @@ static inline bool io_is_direct(struct file *filp)
    1025 return (filp->f_flags & O_DIRECT) || IS_DAX(filp->f_mapping->host);
    1026 }
    1027
    1028 +static inline bool vma_is_dax(struct vm_area_struct *vma)
    1029 +{
    1030 + return vma->vm_file && IS_DAX(vma->vm_file->f_mapping->host);
    1031 +}
    1032 +
    1033 +static inline bool vma_is_fsdax(struct vm_area_struct *vma)
    1034 +{
    1035 + struct inode *inode;
    1036 +
    1037 + if (!vma->vm_file)
    1038 + return false;
    1039 + if (!vma_is_dax(vma))
    1040 + return false;
    1041 + inode = file_inode(vma->vm_file);
    1042 + if (inode->i_mode == S_IFCHR)
    1043 + return false; /* device-dax */
    1044 + return true;
    1045 +}
    1046 +
    1047 static inline int iocb_flags(struct file *file)
    1048 {
    1049 int res = 0;
    1050 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
    1051 index bc6ed52a39b9..61054f12be7c 100644
    1052 --- a/include/linux/kernel.h
    1053 +++ b/include/linux/kernel.h
    1054 @@ -46,6 +46,7 @@
    1055 #define REPEAT_BYTE(x) ((~0ul / 0xff) * (x))
    1056
    1057 #define ALIGN(x, a) __ALIGN_KERNEL((x), (a))
    1058 +#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a))
    1059 #define __ALIGN_MASK(x, mask) __ALIGN_KERNEL_MASK((x), (mask))
    1060 #define PTR_ALIGN(p, a) ((typeof(p))ALIGN((unsigned long)(p), (a)))
    1061 #define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0)
    1062 diff --git a/include/linux/mm.h b/include/linux/mm.h
    1063 index 2217e2f18247..8e506783631b 100644
    1064 --- a/include/linux/mm.h
    1065 +++ b/include/linux/mm.h
    1066 @@ -1288,6 +1288,19 @@ long __get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm,
    1067 struct page **pages, unsigned int gup_flags);
    1068 long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages,
    1069 struct page **pages, unsigned int gup_flags);
    1070 +#ifdef CONFIG_FS_DAX
    1071 +long get_user_pages_longterm(unsigned long start, unsigned long nr_pages,
    1072 + unsigned int gup_flags, struct page **pages,
    1073 + struct vm_area_struct **vmas);
    1074 +#else
    1075 +static inline long get_user_pages_longterm(unsigned long start,
    1076 + unsigned long nr_pages, unsigned int gup_flags,
    1077 + struct page **pages, struct vm_area_struct **vmas)
    1078 +{
    1079 + return get_user_pages(start, nr_pages, gup_flags, pages, vmas);
    1080 +}
    1081 +#endif /* CONFIG_FS_DAX */
    1082 +
    1083 int get_user_pages_fast(unsigned long start, int nr_pages, int write,
    1084 struct page **pages);
    1085
    1086 diff --git a/kernel/memremap.c b/kernel/memremap.c
    1087 index 426547a21a0c..f61a8c387c3e 100644
    1088 --- a/kernel/memremap.c
    1089 +++ b/kernel/memremap.c
    1090 @@ -194,7 +194,7 @@ void put_zone_device_page(struct page *page)
    1091 }
    1092 EXPORT_SYMBOL(put_zone_device_page);
    1093
    1094 -static void pgmap_radix_release(struct resource *res)
    1095 +static void pgmap_radix_release(struct resource *res, resource_size_t end_key)
    1096 {
    1097 resource_size_t key, align_start, align_size, align_end;
    1098
    1099 @@ -203,8 +203,11 @@ static void pgmap_radix_release(struct resource *res)
    1100 align_end = align_start + align_size - 1;
    1101
    1102 mutex_lock(&pgmap_lock);
    1103 - for (key = res->start; key <= res->end; key += SECTION_SIZE)
    1104 + for (key = res->start; key <= res->end; key += SECTION_SIZE) {
    1105 + if (key >= end_key)
    1106 + break;
    1107 radix_tree_delete(&pgmap_radix, key >> PA_SECTION_SHIFT);
    1108 + }
    1109 mutex_unlock(&pgmap_lock);
    1110 }
    1111
    1112 @@ -255,7 +258,7 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
    1113 unlock_device_hotplug();
    1114
    1115 untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
    1116 - pgmap_radix_release(res);
    1117 + pgmap_radix_release(res, -1);
    1118 dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
    1119 "%s: failed to free all reserved pages\n", __func__);
    1120 }
    1121 @@ -289,7 +292,7 @@ struct dev_pagemap *find_dev_pagemap(resource_size_t phys)
    1122 void *devm_memremap_pages(struct device *dev, struct resource *res,
    1123 struct percpu_ref *ref, struct vmem_altmap *altmap)
    1124 {
    1125 - resource_size_t key, align_start, align_size, align_end;
    1126 + resource_size_t key = 0, align_start, align_size, align_end;
    1127 pgprot_t pgprot = PAGE_KERNEL;
    1128 struct dev_pagemap *pgmap;
    1129 struct page_map *page_map;
    1130 @@ -392,7 +395,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
    1131 untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
    1132 err_pfn_remap:
    1133 err_radix:
    1134 - pgmap_radix_release(res);
    1135 + pgmap_radix_release(res, key);
    1136 devres_free(page_map);
    1137 return ERR_PTR(error);
    1138 }
    1139 diff --git a/mm/frame_vector.c b/mm/frame_vector.c
    1140 index db77dcb38afd..375a103d7a56 100644
    1141 --- a/mm/frame_vector.c
    1142 +++ b/mm/frame_vector.c
    1143 @@ -52,6 +52,18 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
    1144 ret = -EFAULT;
    1145 goto out;
    1146 }
    1147 +
    1148 + /*
    1149 + * While get_vaddr_frames() could be used for transient (kernel
    1150 + * controlled lifetime) pinning of memory pages all current
    1151 + * users establish long term (userspace controlled lifetime)
    1152 + * page pinning. Treat get_vaddr_frames() like
    1153 + * get_user_pages_longterm() and disallow it for filesystem-dax
    1154 + * mappings.
    1155 + */
    1156 + if (vma_is_fsdax(vma))
    1157 + return -EOPNOTSUPP;
    1158 +
    1159 if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
    1160 vec->got_ref = true;
    1161 vec->is_pfns = false;
    1162 diff --git a/mm/gup.c b/mm/gup.c
    1163 index c63a0341ae38..6c3b4e822946 100644
    1164 --- a/mm/gup.c
    1165 +++ b/mm/gup.c
    1166 @@ -982,6 +982,70 @@ long get_user_pages(unsigned long start, unsigned long nr_pages,
    1167 }
    1168 EXPORT_SYMBOL(get_user_pages);
    1169
    1170 +#ifdef CONFIG_FS_DAX
    1171 +/*
    1172 + * This is the same as get_user_pages() in that it assumes we are
    1173 + * operating on the current task's mm, but it goes further to validate
    1174 + * that the vmas associated with the address range are suitable for
    1175 + * longterm elevated page reference counts. For example, filesystem-dax
    1176 + * mappings are subject to the lifetime enforced by the filesystem and
    1177 + * we need guarantees that longterm users like RDMA and V4L2 only
    1178 + * establish mappings that have a kernel enforced revocation mechanism.
    1179 + *
    1180 + * "longterm" == userspace controlled elevated page count lifetime.
    1181 + * Contrast this to iov_iter_get_pages() usages which are transient.
    1182 + */
    1183 +long get_user_pages_longterm(unsigned long start, unsigned long nr_pages,
    1184 + unsigned int gup_flags, struct page **pages,
    1185 + struct vm_area_struct **vmas_arg)
    1186 +{
    1187 + struct vm_area_struct **vmas = vmas_arg;
    1188 + struct vm_area_struct *vma_prev = NULL;
    1189 + long rc, i;
    1190 +
    1191 + if (!pages)
    1192 + return -EINVAL;
    1193 +
    1194 + if (!vmas) {
    1195 + vmas = kcalloc(nr_pages, sizeof(struct vm_area_struct *),
    1196 + GFP_KERNEL);
    1197 + if (!vmas)
    1198 + return -ENOMEM;
    1199 + }
    1200 +
    1201 + rc = get_user_pages(start, nr_pages, gup_flags, pages, vmas);
    1202 +
    1203 + for (i = 0; i < rc; i++) {
    1204 + struct vm_area_struct *vma = vmas[i];
    1205 +
    1206 + if (vma == vma_prev)
    1207 + continue;
    1208 +
    1209 + vma_prev = vma;
    1210 +
    1211 + if (vma_is_fsdax(vma))
    1212 + break;
    1213 + }
    1214 +
    1215 + /*
    1216 + * Either get_user_pages() failed, or the vma validation
    1217 + * succeeded, in either case we don't need to put_page() before
    1218 + * returning.
    1219 + */
    1220 + if (i >= rc)
    1221 + goto out;
    1222 +
    1223 + for (i = 0; i < rc; i++)
    1224 + put_page(pages[i]);
    1225 + rc = -EOPNOTSUPP;
    1226 +out:
    1227 + if (vmas != vmas_arg)
    1228 + kfree(vmas);
    1229 + return rc;
    1230 +}
    1231 +EXPORT_SYMBOL(get_user_pages_longterm);
    1232 +#endif /* CONFIG_FS_DAX */
    1233 +
    1234 /**
    1235 * populate_vma_page_range() - populate a range of pages in the vma.
    1236 * @vma: target vma
    1237 diff --git a/mm/memory.c b/mm/memory.c
    1238 index e2e68767a373..d2db2c4eb0a4 100644
    1239 --- a/mm/memory.c
    1240 +++ b/mm/memory.c
    1241 @@ -2848,6 +2848,17 @@ static int __do_fault(struct fault_env *fe, pgoff_t pgoff,
    1242 return ret;
    1243 }
    1244
    1245 +/*
    1246 + * The ordering of these checks is important for pmds with _PAGE_DEVMAP set.
    1247 + * If we check pmd_trans_unstable() first we will trip the bad_pmd() check
    1248 + * inside of pmd_none_or_trans_huge_or_clear_bad(). This will end up correctly
    1249 + * returning 1 but not before it spams dmesg with the pmd_clear_bad() output.
    1250 + */
    1251 +static int pmd_devmap_trans_unstable(pmd_t *pmd)
    1252 +{
    1253 + return pmd_devmap(*pmd) || pmd_trans_unstable(pmd);
    1254 +}
    1255 +
    1256 static int pte_alloc_one_map(struct fault_env *fe)
    1257 {
    1258 struct vm_area_struct *vma = fe->vma;
    1259 @@ -2871,18 +2882,27 @@ static int pte_alloc_one_map(struct fault_env *fe)
    1260 map_pte:
    1261 /*
    1262 * If a huge pmd materialized under us just retry later. Use
    1263 - * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
    1264 - * didn't become pmd_trans_huge under us and then back to pmd_none, as
    1265 - * a result of MADV_DONTNEED running immediately after a huge pmd fault
    1266 - * in a different thread of this mm, in turn leading to a misleading
    1267 - * pmd_trans_huge() retval. All we have to ensure is that it is a
    1268 - * regular pmd that we can walk with pte_offset_map() and we can do that
    1269 - * through an atomic read in C, which is what pmd_trans_unstable()
    1270 - * provides.
    1271 + * pmd_trans_unstable() via pmd_devmap_trans_unstable() instead of
    1272 + * pmd_trans_huge() to ensure the pmd didn't become pmd_trans_huge
    1273 + * under us and then back to pmd_none, as a result of MADV_DONTNEED
    1274 + * running immediately after a huge pmd fault in a different thread of
    1275 + * this mm, in turn leading to a misleading pmd_trans_huge() retval.
    1276 + * All we have to ensure is that it is a regular pmd that we can walk
    1277 + * with pte_offset_map() and we can do that through an atomic read in
    1278 + * C, which is what pmd_trans_unstable() provides.
    1279 */
    1280 - if (pmd_trans_unstable(fe->pmd) || pmd_devmap(*fe->pmd))
    1281 + if (pmd_devmap_trans_unstable(fe->pmd))
    1282 return VM_FAULT_NOPAGE;
    1283
    1284 + /*
    1285 + * At this point we know that our vmf->pmd points to a page of ptes
    1286 + * and it cannot become pmd_none(), pmd_devmap() or pmd_trans_huge()
    1287 + * for the duration of the fault. If a racing MADV_DONTNEED runs and
    1288 + * we zap the ptes pointed to by our vmf->pmd, the vmf->ptl will still
    1289 + * be valid and we will re-check to make sure the vmf->pte isn't
    1290 + * pte_none() under vmf->ptl protection when we return to
    1291 + * alloc_set_pte().
    1292 + */
    1293 fe->pte = pte_offset_map_lock(vma->vm_mm, fe->pmd, fe->address,
    1294 &fe->ptl);
    1295 return 0;
    1296 @@ -3456,7 +3476,7 @@ static int handle_pte_fault(struct fault_env *fe)
    1297 fe->pte = NULL;
    1298 } else {
    1299 /* See comment in pte_alloc_one_map() */
    1300 - if (pmd_trans_unstable(fe->pmd) || pmd_devmap(*fe->pmd))
    1301 + if (pmd_devmap_trans_unstable(fe->pmd))
    1302 return 0;
    1303 /*
    1304 * A regular pmd is established and it can't morph into a huge
    1305 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
    1306 index bf62fa487262..fd1e6b8562e0 100644
    1307 --- a/net/ipv4/ip_sockglue.c
    1308 +++ b/net/ipv4/ip_sockglue.c
    1309 @@ -1552,10 +1552,7 @@ int ip_getsockopt(struct sock *sk, int level,
    1310 if (get_user(len, optlen))
    1311 return -EFAULT;
    1312
    1313 - lock_sock(sk);
    1314 - err = nf_getsockopt(sk, PF_INET, optname, optval,
    1315 - &len);
    1316 - release_sock(sk);
    1317 + err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
    1318 if (err >= 0)
    1319 err = put_user(len, optlen);
    1320 return err;
    1321 @@ -1587,9 +1584,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
    1322 if (get_user(len, optlen))
    1323 return -EFAULT;
    1324
    1325 - lock_sock(sk);
    1326 err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
    1327 - release_sock(sk);
    1328 if (err >= 0)
    1329 err = put_user(len, optlen);
    1330 return err;
    1331 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
    1332 index 493a32f6a5f2..c66b9a87e995 100644
    1333 --- a/net/ipv6/ipv6_sockglue.c
    1334 +++ b/net/ipv6/ipv6_sockglue.c
    1335 @@ -1343,10 +1343,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
    1336 if (get_user(len, optlen))
    1337 return -EFAULT;
    1338
    1339 - lock_sock(sk);
    1340 - err = nf_getsockopt(sk, PF_INET6, optname, optval,
    1341 - &len);
    1342 - release_sock(sk);
    1343 + err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
    1344 if (err >= 0)
    1345 err = put_user(len, optlen);
    1346 }
    1347 @@ -1385,10 +1382,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
    1348 if (get_user(len, optlen))
    1349 return -EFAULT;
    1350
    1351 - lock_sock(sk);
    1352 - err = compat_nf_getsockopt(sk, PF_INET6,
    1353 - optname, optval, &len);
    1354 - release_sock(sk);
    1355 + err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
    1356 if (err >= 0)
    1357 err = put_user(len, optlen);
    1358 }
    1359 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
    1360 index 07001b6d36cc..dee60428c78c 100644
    1361 --- a/net/mac80211/cfg.c
    1362 +++ b/net/mac80211/cfg.c
    1363 @@ -2792,7 +2792,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
    1364 }
    1365 if (beacon->probe_resp_len) {
    1366 new_beacon->probe_resp_len = beacon->probe_resp_len;
    1367 - beacon->probe_resp = pos;
    1368 + new_beacon->probe_resp = pos;
    1369 memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
    1370 pos += beacon->probe_resp_len;
    1371 }