Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0266-4.9.167-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0266-4.9.167-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3343 - (show annotations) (download)
    Tue Jun 18 09:41:57 2019 UTC (4 years, 10 months ago) by niro
    File size: 64432 byte(s) 
    -linux-4.9.167
    1 diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
    2 index 3ff58a8ffabb..d1908e50b506 100644
    3 --- a/Documentation/virtual/kvm/api.txt
    4 +++ b/Documentation/virtual/kvm/api.txt
    5 @@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes
    6
    7 - VM ioctls: These query and set attributes that affect an entire virtual
    8 machine, for example memory layout. In addition a VM ioctl is used to
    9 - create virtual cpus (vcpus).
    10 + create virtual cpus (vcpus) and devices.
    11
    12 Only run VM ioctls from the same process (address space) that was used
    13 to create the VM.
    14 @@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes
    15 Only run vcpu ioctls from the same thread that was used to create the
    16 vcpu.
    17
    18 + - device ioctls: These query and set attributes that control the operation
    19 + of a single device.
    20 +
    21 + device ioctls must be issued from the same process (address space) that
    22 + was used to create the VM.
    23
    24 2. File descriptors
    25 -------------------
    26 @@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial
    27 open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
    28 can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this
    29 handle will create a VM file descriptor which can be used to issue VM
    30 -ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu
    31 -and return a file descriptor pointing to it. Finally, ioctls on a vcpu
    32 -fd can be used to control the vcpu, including the important task of
    33 -actually running guest code.
    34 +ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
    35 +create a virtual cpu or device and return a file descriptor pointing to
    36 +the new resource. Finally, ioctls on a vcpu or device fd can be used
    37 +to control the vcpu or device. For vcpus, this includes the important
    38 +task of actually running guest code.
    39
    40 In general file descriptors can be migrated among processes by means
    41 of fork() and the SCM_RIGHTS facility of unix domain socket. These
    42 diff --git a/Makefile b/Makefile
    43 index 90478086eff5..2f030baeb162 100644
    44 --- a/Makefile
    45 +++ b/Makefile
    46 @@ -1,6 +1,6 @@
    47 VERSION = 4
    48 PATCHLEVEL = 9
    49 -SUBLEVEL = 166
    50 +SUBLEVEL = 167
    51 EXTRAVERSION =
    52 NAME = Roaring Lionus
    53
    54 diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c
    55 index bfeb25aaf9a2..326e870d7123 100644
    56 --- a/arch/arm/mach-imx/cpuidle-imx6q.c
    57 +++ b/arch/arm/mach-imx/cpuidle-imx6q.c
    58 @@ -16,30 +16,23 @@
    59 #include "cpuidle.h"
    60 #include "hardware.h"
    61
    62 -static atomic_t master = ATOMIC_INIT(0);
    63 -static DEFINE_SPINLOCK(master_lock);
    64 +static int num_idle_cpus = 0;
    65 +static DEFINE_SPINLOCK(cpuidle_lock);
    66
    67 static int imx6q_enter_wait(struct cpuidle_device *dev,
    68 struct cpuidle_driver *drv, int index)
    69 {
    70 - if (atomic_inc_return(&master) == num_online_cpus()) {
    71 - /*
    72 - * With this lock, we prevent other cpu to exit and enter
    73 - * this function again and become the master.
    74 - */
    75 - if (!spin_trylock(&master_lock))
    76 - goto idle;
    77 + spin_lock(&cpuidle_lock);
    78 + if (++num_idle_cpus == num_online_cpus())
    79 imx6_set_lpm(WAIT_UNCLOCKED);
    80 - cpu_do_idle();
    81 - imx6_set_lpm(WAIT_CLOCKED);
    82 - spin_unlock(&master_lock);
    83 - goto done;
    84 - }
    85 + spin_unlock(&cpuidle_lock);
    86
    87 -idle:
    88 cpu_do_idle();
    89 -done:
    90 - atomic_dec(&master);
    91 +
    92 + spin_lock(&cpuidle_lock);
    93 + if (num_idle_cpus-- == num_online_cpus())
    94 + imx6_set_lpm(WAIT_CLOCKED);
    95 + spin_unlock(&cpuidle_lock);
    96
    97 return index;
    98 }
    99 diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
    100 index 3e43874568f9..2eb8ae1b2d03 100644
    101 --- a/arch/arm64/Kconfig
    102 +++ b/arch/arm64/Kconfig
    103 @@ -1079,6 +1079,10 @@ config SYSVIPC_COMPAT
    104 def_bool y
    105 depends on COMPAT && SYSVIPC
    106
    107 +config KEYS_COMPAT
    108 + def_bool y
    109 + depends on COMPAT && KEYS
    110 +
    111 endmenu
    112
    113 menu "Power management options"
    114 diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
    115 index c4ced1d01d57..48e8f1f14872 100644
    116 --- a/arch/powerpc/include/asm/ppc-opcode.h
    117 +++ b/arch/powerpc/include/asm/ppc-opcode.h
    118 @@ -225,6 +225,7 @@
    119 /* Misc instructions for BPF compiler */
    120 #define PPC_INST_LBZ 0x88000000
    121 #define PPC_INST_LD 0xe8000000
    122 +#define PPC_INST_LDX 0x7c00002a
    123 #define PPC_INST_LHZ 0xa0000000
    124 #define PPC_INST_LWZ 0x80000000
    125 #define PPC_INST_LHBRX 0x7c00062c
    126 @@ -232,6 +233,7 @@
    127 #define PPC_INST_STB 0x98000000
    128 #define PPC_INST_STH 0xb0000000
    129 #define PPC_INST_STD 0xf8000000
    130 +#define PPC_INST_STDX 0x7c00012a
    131 #define PPC_INST_STDU 0xf8000001
    132 #define PPC_INST_STW 0x90000000
    133 #define PPC_INST_STWU 0x94000000
    134 diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
    135 index 89f70073dec8..7b1d1721a26a 100644
    136 --- a/arch/powerpc/net/bpf_jit.h
    137 +++ b/arch/powerpc/net/bpf_jit.h
    138 @@ -51,6 +51,8 @@
    139 #define PPC_LIS(r, i) PPC_ADDIS(r, 0, i)
    140 #define PPC_STD(r, base, i) EMIT(PPC_INST_STD | ___PPC_RS(r) | \
    141 ___PPC_RA(base) | ((i) & 0xfffc))
    142 +#define PPC_STDX(r, base, b) EMIT(PPC_INST_STDX | ___PPC_RS(r) | \
    143 + ___PPC_RA(base) | ___PPC_RB(b))
    144 #define PPC_STDU(r, base, i) EMIT(PPC_INST_STDU | ___PPC_RS(r) | \
    145 ___PPC_RA(base) | ((i) & 0xfffc))
    146 #define PPC_STW(r, base, i) EMIT(PPC_INST_STW | ___PPC_RS(r) | \
    147 @@ -65,7 +67,9 @@
    148 #define PPC_LBZ(r, base, i) EMIT(PPC_INST_LBZ | ___PPC_RT(r) | \
    149 ___PPC_RA(base) | IMM_L(i))
    150 #define PPC_LD(r, base, i) EMIT(PPC_INST_LD | ___PPC_RT(r) | \
    151 - ___PPC_RA(base) | IMM_L(i))
    152 + ___PPC_RA(base) | ((i) & 0xfffc))
    153 +#define PPC_LDX(r, base, b) EMIT(PPC_INST_LDX | ___PPC_RT(r) | \
    154 + ___PPC_RA(base) | ___PPC_RB(b))
    155 #define PPC_LWZ(r, base, i) EMIT(PPC_INST_LWZ | ___PPC_RT(r) | \
    156 ___PPC_RA(base) | IMM_L(i))
    157 #define PPC_LHZ(r, base, i) EMIT(PPC_INST_LHZ | ___PPC_RT(r) | \
    158 @@ -85,17 +89,6 @@
    159 ___PPC_RA(a) | ___PPC_RB(b))
    160 #define PPC_BPF_STDCX(s, a, b) EMIT(PPC_INST_STDCX | ___PPC_RS(s) | \
    161 ___PPC_RA(a) | ___PPC_RB(b))
    162 -
    163 -#ifdef CONFIG_PPC64
    164 -#define PPC_BPF_LL(r, base, i) do { PPC_LD(r, base, i); } while(0)
    165 -#define PPC_BPF_STL(r, base, i) do { PPC_STD(r, base, i); } while(0)
    166 -#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0)
    167 -#else
    168 -#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0)
    169 -#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0)
    170 -#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0)
    171 -#endif
    172 -
    173 #define PPC_CMPWI(a, i) EMIT(PPC_INST_CMPWI | ___PPC_RA(a) | IMM_L(i))
    174 #define PPC_CMPDI(a, i) EMIT(PPC_INST_CMPDI | ___PPC_RA(a) | IMM_L(i))
    175 #define PPC_CMPW(a, b) EMIT(PPC_INST_CMPW | ___PPC_RA(a) | \
    176 diff --git a/arch/powerpc/net/bpf_jit32.h b/arch/powerpc/net/bpf_jit32.h
    177 index a8cd7e289ecd..81a9045d8410 100644
    178 --- a/arch/powerpc/net/bpf_jit32.h
    179 +++ b/arch/powerpc/net/bpf_jit32.h
    180 @@ -122,6 +122,10 @@ DECLARE_LOAD_FUNC(sk_load_byte_msh);
    181 #define PPC_NTOHS_OFFS(r, base, i) PPC_LHZ_OFFS(r, base, i)
    182 #endif
    183
    184 +#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0)
    185 +#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0)
    186 +#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0)
    187 +
    188 #define SEEN_DATAREF 0x10000 /* might call external helpers */
    189 #define SEEN_XREG 0x20000 /* X reg is used */
    190 #define SEEN_MEM 0x40000 /* SEEN_MEM+(1<<n) = use mem[n] for temporary
    191 diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h
    192 index 62fa7589db2b..bb944b6018d7 100644
    193 --- a/arch/powerpc/net/bpf_jit64.h
    194 +++ b/arch/powerpc/net/bpf_jit64.h
    195 @@ -86,6 +86,26 @@ DECLARE_LOAD_FUNC(sk_load_byte);
    196 (imm >= SKF_LL_OFF ? func##_negative_offset : func) : \
    197 func##_positive_offset)
    198
    199 +/*
    200 + * WARNING: These can use TMP_REG_2 if the offset is not at word boundary,
    201 + * so ensure that it isn't in use already.
    202 + */
    203 +#define PPC_BPF_LL(r, base, i) do { \
    204 + if ((i) % 4) { \
    205 + PPC_LI(b2p[TMP_REG_2], (i)); \
    206 + PPC_LDX(r, base, b2p[TMP_REG_2]); \
    207 + } else \
    208 + PPC_LD(r, base, i); \
    209 + } while(0)
    210 +#define PPC_BPF_STL(r, base, i) do { \
    211 + if ((i) % 4) { \
    212 + PPC_LI(b2p[TMP_REG_2], (i)); \
    213 + PPC_STDX(r, base, b2p[TMP_REG_2]); \
    214 + } else \
    215 + PPC_STD(r, base, i); \
    216 + } while(0)
    217 +#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0)
    218 +
    219 #define SEEN_FUNC 0x1000 /* might call external helpers */
    220 #define SEEN_STACK 0x2000 /* uses BPF stack */
    221 #define SEEN_SKB 0x4000 /* uses sk_buff */
    222 diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
    223 index bdbbc320b006..e7d78f9156ce 100644
    224 --- a/arch/powerpc/net/bpf_jit_comp64.c
    225 +++ b/arch/powerpc/net/bpf_jit_comp64.c
    226 @@ -265,7 +265,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
    227 * if (tail_call_cnt > MAX_TAIL_CALL_CNT)
    228 * goto out;
    229 */
    230 - PPC_LD(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx));
    231 + PPC_BPF_LL(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx));
    232 PPC_CMPLWI(b2p[TMP_REG_1], MAX_TAIL_CALL_CNT);
    233 PPC_BCC(COND_GT, out);
    234
    235 @@ -278,7 +278,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
    236 /* prog = array->ptrs[index]; */
    237 PPC_MULI(b2p[TMP_REG_1], b2p_index, 8);
    238 PPC_ADD(b2p[TMP_REG_1], b2p[TMP_REG_1], b2p_bpf_array);
    239 - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs));
    240 + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs));
    241
    242 /*
    243 * if (prog == NULL)
    244 @@ -288,7 +288,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
    245 PPC_BCC(COND_EQ, out);
    246
    247 /* goto *(prog->bpf_func + prologue_size); */
    248 - PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func));
    249 + PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func));
    250 #ifdef PPC64_ELF_ABI_v1
    251 /* skip past the function descriptor */
    252 PPC_ADDI(b2p[TMP_REG_1], b2p[TMP_REG_1],
    253 @@ -620,7 +620,7 @@ bpf_alu32_trunc:
    254 * the instructions generated will remain the
    255 * same across all passes
    256 */
    257 - PPC_STD(dst_reg, 1, bpf_jit_stack_local(ctx));
    258 + PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx));
    259 PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx));
    260 PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]);
    261 break;
    262 @@ -676,7 +676,7 @@ emit_clear:
    263 PPC_LI32(b2p[TMP_REG_1], imm);
    264 src_reg = b2p[TMP_REG_1];
    265 }
    266 - PPC_STD(src_reg, dst_reg, off);
    267 + PPC_BPF_STL(src_reg, dst_reg, off);
    268 break;
    269
    270 /*
    271 @@ -723,7 +723,7 @@ emit_clear:
    272 break;
    273 /* dst = *(u64 *)(ul) (src + off) */
    274 case BPF_LDX | BPF_MEM | BPF_DW:
    275 - PPC_LD(dst_reg, src_reg, off);
    276 + PPC_BPF_LL(dst_reg, src_reg, off);
    277 break;
    278
    279 /*
    280 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    281 index e31001ec4c07..5a4591ff8407 100644
    282 --- a/arch/x86/Kconfig
    283 +++ b/arch/x86/Kconfig
    284 @@ -2051,14 +2051,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
    285 If unsure, leave at the default value.
    286
    287 config HOTPLUG_CPU
    288 - bool "Support for hot-pluggable CPUs"
    289 + def_bool y
    290 depends on SMP
    291 - ---help---
    292 - Say Y here to allow turning CPUs off and on. CPUs can be
    293 - controlled through /sys/devices/system/cpu.
    294 - ( Note: power management support will enable this option
    295 - automatically on SMP systems. )
    296 - Say N if you want to disable CPU hotplug.
    297
    298 config BOOTPARAM_HOTPLUG_CPU0
    299 bool "Set default setting of cpu0_hotpluggable"
    300 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
    301 index 9a8167b175d5..83b5b2990b49 100644
    302 --- a/arch/x86/include/asm/kvm_host.h
    303 +++ b/arch/x86/include/asm/kvm_host.h
    304 @@ -487,6 +487,7 @@ struct kvm_vcpu_arch {
    305 bool tpr_access_reporting;
    306 u64 ia32_xss;
    307 u64 microcode_version;
    308 + u64 arch_capabilities;
    309
    310 /*
    311 * Paging state of the vcpu
    312 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    313 index a34fb7284024..75466d9417b8 100644
    314 --- a/arch/x86/kvm/vmx.c
    315 +++ b/arch/x86/kvm/vmx.c
    316 @@ -714,7 +714,6 @@ struct vcpu_vmx {
    317 u64 msr_guest_kernel_gs_base;
    318 #endif
    319
    320 - u64 arch_capabilities;
    321 u64 spec_ctrl;
    322
    323 u32 vm_entry_controls_shadow;
    324 @@ -3209,12 +3208,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    325
    326 msr_info->data = to_vmx(vcpu)->spec_ctrl;
    327 break;
    328 - case MSR_IA32_ARCH_CAPABILITIES:
    329 - if (!msr_info->host_initiated &&
    330 - !guest_cpuid_has_arch_capabilities(vcpu))
    331 - return 1;
    332 - msr_info->data = to_vmx(vcpu)->arch_capabilities;
    333 - break;
    334 case MSR_IA32_SYSENTER_CS:
    335 msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
    336 break;
    337 @@ -3376,11 +3369,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    338 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
    339 MSR_TYPE_W);
    340 break;
    341 - case MSR_IA32_ARCH_CAPABILITIES:
    342 - if (!msr_info->host_initiated)
    343 - return 1;
    344 - vmx->arch_capabilities = data;
    345 - break;
    346 case MSR_IA32_CR_PAT:
    347 if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
    348 if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
    349 @@ -5468,8 +5456,6 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
    350 ++vmx->nmsrs;
    351 }
    352
    353 - vmx->arch_capabilities = kvm_get_arch_capabilities();
    354 -
    355 vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl);
    356
    357 /* 22.2.1, 20.8.1 */
    358 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    359 index a29df9ccbfde..8285142556b5 100644
    360 --- a/arch/x86/kvm/x86.c
    361 +++ b/arch/x86/kvm/x86.c
    362 @@ -2197,6 +2197,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    363 if (msr_info->host_initiated)
    364 vcpu->arch.microcode_version = data;
    365 break;
    366 + case MSR_IA32_ARCH_CAPABILITIES:
    367 + if (!msr_info->host_initiated)
    368 + return 1;
    369 + vcpu->arch.arch_capabilities = data;
    370 + break;
    371 case MSR_EFER:
    372 return set_efer(vcpu, data);
    373 case MSR_K7_HWCR:
    374 @@ -2473,6 +2478,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    375 case MSR_IA32_UCODE_REV:
    376 msr_info->data = vcpu->arch.microcode_version;
    377 break;
    378 + case MSR_IA32_ARCH_CAPABILITIES:
    379 + if (!msr_info->host_initiated &&
    380 + !guest_cpuid_has_arch_capabilities(vcpu))
    381 + return 1;
    382 + msr_info->data = vcpu->arch.arch_capabilities;
    383 + break;
    384 case MSR_MTRRcap:
    385 case 0x200 ... 0x2ff:
    386 return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data);
    387 @@ -7672,6 +7683,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
    388 {
    389 int r;
    390
    391 + vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
    392 kvm_vcpu_mtrr_init(vcpu);
    393 r = vcpu_load(vcpu);
    394 if (r)
    395 diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c
    396 index 8ff7b0d3eac6..3b68c03a281d 100644
    397 --- a/drivers/gpio/gpio-adnp.c
    398 +++ b/drivers/gpio/gpio-adnp.c
    399 @@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
    400 if (err < 0)
    401 goto out;
    402
    403 - if (err & BIT(pos))
    404 - err = -EACCES;
    405 + if (value & BIT(pos)) {
    406 + err = -EPERM;
    407 + goto out;
    408 + }
    409
    410 err = 0;
    411
    412 diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
    413 index 480c2d7794eb..8feb8e9e29a6 100644
    414 --- a/drivers/isdn/hardware/mISDN/hfcmulti.c
    415 +++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
    416 @@ -4370,7 +4370,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev,
    417 if (m->clock2)
    418 test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip);
    419
    420 - if (ent->device == 0xB410) {
    421 + if (ent->vendor == PCI_VENDOR_ID_DIGIUM &&
    422 + ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) {
    423 test_and_set_bit(HFC_CHIP_B410P, &hc->chip);
    424 test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip);
    425 test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip);
    426 diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
    427 index 7f64a76acd37..ebfbaf8597f4 100644
    428 --- a/drivers/net/dsa/qca8k.c
    429 +++ b/drivers/net/dsa/qca8k.c
    430 @@ -630,22 +630,6 @@ qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy)
    431 qca8k_port_set_status(priv, port, 1);
    432 }
    433
    434 -static int
    435 -qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum)
    436 -{
    437 - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
    438 -
    439 - return mdiobus_read(priv->bus, phy, regnum);
    440 -}
    441 -
    442 -static int
    443 -qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val)
    444 -{
    445 - struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
    446 -
    447 - return mdiobus_write(priv->bus, phy, regnum, val);
    448 -}
    449 -
    450 static void
    451 qca8k_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
    452 {
    453 @@ -961,8 +945,6 @@ static struct dsa_switch_ops qca8k_switch_ops = {
    454 .setup = qca8k_setup,
    455 .adjust_link = qca8k_adjust_link,
    456 .get_strings = qca8k_get_strings,
    457 - .phy_read = qca8k_phy_read,
    458 - .phy_write = qca8k_phy_write,
    459 .get_ethtool_stats = qca8k_get_ethtool_stats,
    460 .get_sset_count = qca8k_get_sset_count,
    461 .get_eee = qca8k_get_eee,
    462 diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c
    463 index b9283901136e..0fdc9ad32a2e 100644
    464 --- a/drivers/net/ethernet/8390/mac8390.c
    465 +++ b/drivers/net/ethernet/8390/mac8390.c
    466 @@ -156,8 +156,6 @@ static void dayna_block_output(struct net_device *dev, int count,
    467 #define memcpy_fromio(a, b, c) memcpy((a), (void *)(b), (c))
    468 #define memcpy_toio(a, b, c) memcpy((void *)(a), (b), (c))
    469
    470 -#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c))
    471 -
    472 /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */
    473 static void slow_sane_get_8390_hdr(struct net_device *dev,
    474 struct e8390_pkt_hdr *hdr, int ring_page);
    475 @@ -237,19 +235,26 @@ static enum mac8390_type __init mac8390_ident(struct nubus_dev *dev)
    476
    477 static enum mac8390_access __init mac8390_testio(volatile unsigned long membase)
    478 {
    479 - unsigned long outdata = 0xA5A0B5B0;
    480 - unsigned long indata = 0x00000000;
    481 + u32 outdata = 0xA5A0B5B0;
    482 + u32 indata = 0;
    483 +
    484 /* Try writing 32 bits */
    485 - memcpy_toio(membase, &outdata, 4);
    486 - /* Now compare them */
    487 - if (memcmp_withio(&outdata, membase, 4) == 0)
    488 + nubus_writel(outdata, membase);
    489 + /* Now read it back */
    490 + indata = nubus_readl(membase);
    491 + if (outdata == indata)
    492 return ACCESS_32;
    493 +
    494 + outdata = 0xC5C0D5D0;
    495 + indata = 0;
    496 +
    497 /* Write 16 bit output */
    498 word_memcpy_tocard(membase, &outdata, 4);
    499 /* Now read it back */
    500 word_memcpy_fromcard(&indata, membase, 4);
    501 if (outdata == indata)
    502 return ACCESS_16;
    503 +
    504 return ACCESS_UNKNOWN;
    505 }
    506
    507 diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    508 index 20a2b01b392c..fc437d75ac76 100644
    509 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    510 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    511 @@ -2931,6 +2931,20 @@ static int stmmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
    512 return ret;
    513 }
    514
    515 +static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
    516 +{
    517 + struct stmmac_priv *priv = netdev_priv(ndev);
    518 + int ret = 0;
    519 +
    520 + ret = eth_mac_addr(ndev, addr);
    521 + if (ret)
    522 + return ret;
    523 +
    524 + priv->hw->mac->set_umac_addr(priv->hw, ndev->dev_addr, 0);
    525 +
    526 + return ret;
    527 +}
    528 +
    529 #ifdef CONFIG_DEBUG_FS
    530 static struct dentry *stmmac_fs_dir;
    531
    532 @@ -3137,7 +3151,7 @@ static const struct net_device_ops stmmac_netdev_ops = {
    533 #ifdef CONFIG_NET_POLL_CONTROLLER
    534 .ndo_poll_controller = stmmac_poll_controller,
    535 #endif
    536 - .ndo_set_mac_address = eth_mac_addr,
    537 + .ndo_set_mac_address = stmmac_set_mac_address,
    538 };
    539
    540 /**
    541 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
    542 index 24cc94453d38..88fe38d6a7ef 100644
    543 --- a/drivers/net/tun.c
    544 +++ b/drivers/net/tun.c
    545 @@ -1194,9 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
    546 u32 rxhash;
    547 ssize_t n;
    548
    549 - if (!(tun->dev->flags & IFF_UP))
    550 - return -EIO;
    551 -
    552 if (!(tun->flags & IFF_NO_PI)) {
    553 if (len < sizeof(pi))
    554 return -EINVAL;
    555 @@ -1273,9 +1270,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
    556 err = skb_copy_datagram_from_iter(skb, 0, from, len);
    557
    558 if (err) {
    559 + err = -EFAULT;
    560 +drop:
    561 this_cpu_inc(tun->pcpu_stats->rx_dropped);
    562 kfree_skb(skb);
    563 - return -EFAULT;
    564 + return err;
    565 }
    566
    567 err = virtio_net_hdr_to_skb(skb, &gso, tun_is_little_endian(tun));
    568 @@ -1327,7 +1326,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
    569 skb_probe_transport_header(skb, 0);
    570
    571 rxhash = skb_get_hash(skb);
    572 +
    573 + rcu_read_lock();
    574 + if (unlikely(!(tun->dev->flags & IFF_UP))) {
    575 + err = -EIO;
    576 + rcu_read_unlock();
    577 + goto drop;
    578 + }
    579 +
    580 netif_rx_ni(skb);
    581 + rcu_read_unlock();
    582
    583 stats = get_cpu_ptr(tun->pcpu_stats);
    584 u64_stats_update_begin(&stats->syncp);
    585 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
    586 index 016f5da425ab..b6ee0c1690d8 100644
    587 --- a/drivers/net/vxlan.c
    588 +++ b/drivers/net/vxlan.c
    589 @@ -3375,10 +3375,8 @@ static void __net_exit vxlan_exit_net(struct net *net)
    590 /* If vxlan->dev is in the same netns, it has already been added
    591 * to the list by the previous loop.
    592 */
    593 - if (!net_eq(dev_net(vxlan->dev), net)) {
    594 - gro_cells_destroy(&vxlan->gro_cells);
    595 + if (!net_eq(dev_net(vxlan->dev), net))
    596 unregister_netdevice_queue(vxlan->dev, &list);
    597 - }
    598 }
    599
    600 unregister_netdevice_many(&list);
    601 diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
    602 index 2abcd331b05d..abe460eac712 100644
    603 --- a/drivers/s390/scsi/zfcp_erp.c
    604 +++ b/drivers/s390/scsi/zfcp_erp.c
    605 @@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action)
    606 add_timer(&erp_action->timer);
    607 }
    608
    609 +void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
    610 + int clear, char *dbftag)
    611 +{
    612 + unsigned long flags;
    613 + struct zfcp_port *port;
    614 +
    615 + write_lock_irqsave(&adapter->erp_lock, flags);
    616 + read_lock(&adapter->port_list_lock);
    617 + list_for_each_entry(port, &adapter->port_list, list)
    618 + _zfcp_erp_port_forced_reopen(port, clear, dbftag);
    619 + read_unlock(&adapter->port_list_lock);
    620 + write_unlock_irqrestore(&adapter->erp_lock, flags);
    621 +}
    622 +
    623 static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
    624 int clear, char *id)
    625 {
    626 @@ -1306,6 +1320,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
    627 struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
    628 int lun_status;
    629
    630 + if (sdev->sdev_state == SDEV_DEL ||
    631 + sdev->sdev_state == SDEV_CANCEL)
    632 + continue;
    633 if (zsdev->port != port)
    634 continue;
    635 /* LUN under port of interest */
    636 diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
    637 index b326f05c7f89..a39a74500e23 100644
    638 --- a/drivers/s390/scsi/zfcp_ext.h
    639 +++ b/drivers/s390/scsi/zfcp_ext.h
    640 @@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32);
    641 extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *);
    642 extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *);
    643 extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *);
    644 +extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
    645 + int clear, char *dbftag);
    646 extern void zfcp_erp_set_lun_status(struct scsi_device *, u32);
    647 extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32);
    648 extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *);
    649 diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
    650 index 3afb200b2829..bdb257eaa2e5 100644
    651 --- a/drivers/s390/scsi/zfcp_scsi.c
    652 +++ b/drivers/s390/scsi/zfcp_scsi.c
    653 @@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
    654 struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
    655 int ret = SUCCESS, fc_ret;
    656
    657 + if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) {
    658 + zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p");
    659 + zfcp_erp_wait(adapter);
    660 + }
    661 zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
    662 zfcp_erp_wait(adapter);
    663 fc_ret = fc_block_scsi_eh(scpnt);
    664 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    665 index 3e9cbba41464..58345d3d4682 100644
    666 --- a/drivers/scsi/sd.c
    667 +++ b/drivers/scsi/sd.c
    668 @@ -1284,11 +1284,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode)
    669 scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
    670 }
    671
    672 - /*
    673 - * XXX and what if there are packets in flight and this close()
    674 - * XXX is followed by a "rmmod sd_mod"?
    675 - */
    676 -
    677 scsi_disk_put(sdkp);
    678 }
    679
    680 @@ -2846,6 +2841,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp,
    681 unsigned int opt_xfer_bytes =
    682 logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
    683
    684 + if (sdkp->opt_xfer_blocks == 0)
    685 + return false;
    686 +
    687 if (sdkp->opt_xfer_blocks > dev_max) {
    688 sd_first_printk(KERN_WARNING, sdkp,
    689 "Optimal transfer size %u logical blocks " \
    690 @@ -3257,11 +3255,23 @@ static void scsi_disk_release(struct device *dev)
    691 {
    692 struct scsi_disk *sdkp = to_scsi_disk(dev);
    693 struct gendisk *disk = sdkp->disk;
    694 -
    695 + struct request_queue *q = disk->queue;
    696 +
    697 spin_lock(&sd_index_lock);
    698 ida_remove(&sd_index_ida, sdkp->index);
    699 spin_unlock(&sd_index_lock);
    700
    701 + /*
    702 + * Wait until all requests that are in progress have completed.
    703 + * This is necessary to avoid that e.g. scsi_end_request() crashes
    704 + * due to clearing the disk->private_data pointer. Wait from inside
    705 + * scsi_disk_release() instead of from sd_release() to avoid that
    706 + * freezing and unfreezing the request queue affects user space I/O
    707 + * in case multiple processes open a /dev/sd... node concurrently.
    708 + */
    709 + blk_mq_freeze_queue(q);
    710 + blk_mq_unfreeze_queue(q);
    711 +
    712 disk->private_data = NULL;
    713 put_disk(disk);
    714 put_device(&sdkp->device->sdev_gendev);
    715 diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h
    716 index dcb637665eb7..35432fbd6551 100644
    717 --- a/drivers/staging/comedi/comedidev.h
    718 +++ b/drivers/staging/comedi/comedidev.h
    719 @@ -984,6 +984,8 @@ int comedi_dio_insn_config(struct comedi_device *, struct comedi_subdevice *,
    720 unsigned int mask);
    721 unsigned int comedi_dio_update_state(struct comedi_subdevice *,
    722 unsigned int *data);
    723 +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
    724 + struct comedi_cmd *cmd);
    725 unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s);
    726 unsigned int comedi_nscans_left(struct comedi_subdevice *s,
    727 unsigned int nscans);
    728 diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
    729 index 1736248bc5b8..8ca5493c66fe 100644
    730 --- a/drivers/staging/comedi/drivers.c
    731 +++ b/drivers/staging/comedi/drivers.c
    732 @@ -390,11 +390,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
    733 EXPORT_SYMBOL_GPL(comedi_dio_update_state);
    734
    735 /**
    736 - * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
    737 + * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in
    738 + * bytes
    739 * @s: COMEDI subdevice.
    740 + * @cmd: COMEDI command.
    741 *
    742 * Determines the overall scan length according to the subdevice type and the
    743 - * number of channels in the scan.
    744 + * number of channels in the scan for the specified command.
    745 *
    746 * For digital input, output or input/output subdevices, samples for
    747 * multiple channels are assumed to be packed into one or more unsigned
    748 @@ -404,9 +406,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state);
    749 *
    750 * Returns the overall scan length in bytes.
    751 */
    752 -unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
    753 +unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
    754 + struct comedi_cmd *cmd)
    755 {
    756 - struct comedi_cmd *cmd = &s->async->cmd;
    757 unsigned int num_samples;
    758 unsigned int bits_per_sample;
    759
    760 @@ -423,6 +425,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
    761 }
    762 return comedi_samples_to_bytes(s, num_samples);
    763 }
    764 +EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd);
    765 +
    766 +/**
    767 + * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
    768 + * @s: COMEDI subdevice.
    769 + *
    770 + * Determines the overall scan length according to the subdevice type and the
    771 + * number of channels in the scan for the current command.
    772 + *
    773 + * For digital input, output or input/output subdevices, samples for
    774 + * multiple channels are assumed to be packed into one or more unsigned
    775 + * short or unsigned int values according to the subdevice's %SDF_LSAMPL
    776 + * flag. For other types of subdevice, samples are assumed to occupy a
    777 + * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag.
    778 + *
    779 + * Returns the overall scan length in bytes.
    780 + */
    781 +unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
    782 +{
    783 + struct comedi_cmd *cmd = &s->async->cmd;
    784 +
    785 + return comedi_bytes_per_scan_cmd(s, cmd);
    786 +}
    787 EXPORT_SYMBOL_GPL(comedi_bytes_per_scan);
    788
    789 static unsigned int __comedi_nscans_left(struct comedi_subdevice *s,
    790 diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
    791 index 0fa85d55c82f..fe03a41dc5cf 100644
    792 --- a/drivers/staging/comedi/drivers/ni_mio_common.c
    793 +++ b/drivers/staging/comedi/drivers/ni_mio_common.c
    794 @@ -3477,6 +3477,7 @@ static int ni_cdio_check_chanlist(struct comedi_device *dev,
    795 static int ni_cdio_cmdtest(struct comedi_device *dev,
    796 struct comedi_subdevice *s, struct comedi_cmd *cmd)
    797 {
    798 + unsigned int bytes_per_scan;
    799 int err = 0;
    800 int tmp;
    801
    802 @@ -3506,9 +3507,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev,
    803 err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0);
    804 err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg,
    805 cmd->chanlist_len);
    806 - err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
    807 - s->async->prealloc_bufsz /
    808 - comedi_bytes_per_scan(s));
    809 + bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd);
    810 + if (bytes_per_scan) {
    811 + err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
    812 + s->async->prealloc_bufsz /
    813 + bytes_per_scan);
    814 + }
    815
    816 if (err)
    817 return 3;
    818 diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
    819 index ab96629b7889..22e5116e74f8 100644
    820 --- a/drivers/staging/vt6655/device_main.c
    821 +++ b/drivers/staging/vt6655/device_main.c
    822 @@ -977,8 +977,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
    823 return;
    824 }
    825
    826 - MACvIntDisable(priv->PortOffset);
    827 -
    828 spin_lock_irqsave(&priv->lock, flags);
    829
    830 /* Read low level stats */
    831 @@ -1067,8 +1065,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
    832 }
    833
    834 spin_unlock_irqrestore(&priv->lock, flags);
    835 -
    836 - MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
    837 }
    838
    839 static void vnt_interrupt_work(struct work_struct *work)
    840 @@ -1078,14 +1074,17 @@ static void vnt_interrupt_work(struct work_struct *work)
    841
    842 if (priv->vif)
    843 vnt_interrupt_process(priv);
    844 +
    845 + MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
    846 }
    847
    848 static irqreturn_t vnt_interrupt(int irq, void *arg)
    849 {
    850 struct vnt_private *priv = arg;
    851
    852 - if (priv->vif)
    853 - schedule_work(&priv->interrupt_work);
    854 + schedule_work(&priv->interrupt_work);
    855 +
    856 + MACvIntDisable(priv->PortOffset);
    857
    858 return IRQ_HANDLED;
    859 }
    860 diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    861 index 5a341b1c65c3..d8e1945cb627 100644
    862 --- a/drivers/tty/serial/atmel_serial.c
    863 +++ b/drivers/tty/serial/atmel_serial.c
    864 @@ -1166,6 +1166,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
    865 sg_dma_len(&atmel_port->sg_rx)/2,
    866 DMA_DEV_TO_MEM,
    867 DMA_PREP_INTERRUPT);
    868 + if (!desc) {
    869 + dev_err(port->dev, "Preparing DMA cyclic failed\n");
    870 + goto chan_err;
    871 + }
    872 desc->callback = atmel_complete_rx_dma;
    873 desc->callback_param = port;
    874 atmel_port->desc_rx = desc;
    875 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
    876 index f2b0d8cee8ef..0314e78e31ff 100644
    877 --- a/drivers/tty/serial/kgdboc.c
    878 +++ b/drivers/tty/serial/kgdboc.c
    879 @@ -148,8 +148,10 @@ static int configure_kgdboc(void)
    880 char *cptr = config;
    881 struct console *cons;
    882
    883 - if (!strlen(config) || isspace(config[0]))
    884 + if (!strlen(config) || isspace(config[0])) {
    885 + err = 0;
    886 goto noconfig;
    887 + }
    888
    889 kgdboc_io_ops.is_console = 0;
    890 kgdb_tty_driver = NULL;
    891 diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
    892 index 8a3e92638e10..5331baf3f699 100644
    893 --- a/drivers/tty/serial/max310x.c
    894 +++ b/drivers/tty/serial/max310x.c
    895 @@ -1323,6 +1323,8 @@ static int max310x_spi_probe(struct spi_device *spi)
    896 if (spi->dev.of_node) {
    897 const struct of_device_id *of_id =
    898 of_match_device(max310x_dt_ids, &spi->dev);
    899 + if (!of_id)
    900 + return -ENODEV;
    901
    902 devtype = (struct max310x_devtype *)of_id->data;
    903 } else {
    904 diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
    905 index 6ff53b604ff6..bcb997935c5e 100644
    906 --- a/drivers/tty/serial/sh-sci.c
    907 +++ b/drivers/tty/serial/sh-sci.c
    908 @@ -834,19 +834,9 @@ static void sci_transmit_chars(struct uart_port *port)
    909
    910 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
    911 uart_write_wakeup(port);
    912 - if (uart_circ_empty(xmit)) {
    913 + if (uart_circ_empty(xmit))
    914 sci_stop_tx(port);
    915 - } else {
    916 - ctrl = serial_port_in(port, SCSCR);
    917 -
    918 - if (port->type != PORT_SCI) {
    919 - serial_port_in(port, SCxSR); /* Dummy read */
    920 - sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port));
    921 - }
    922
    923 - ctrl |= SCSCR_TIE;
    924 - serial_port_out(port, SCSCR, ctrl);
    925 - }
    926 }
    927
    928 /* On SH3, SCIF may read end-of-break as a space->mark char */
    929 diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
    930 index 5ef8da6e67c3..64c76403a542 100644
    931 --- a/drivers/usb/common/common.c
    932 +++ b/drivers/usb/common/common.c
    933 @@ -148,6 +148,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0)
    934
    935 do {
    936 controller = of_find_node_with_property(controller, "phys");
    937 + if (!of_device_is_available(controller))
    938 + continue;
    939 index = 0;
    940 do {
    941 if (arg0 == -1) {
    942 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    943 index c6578b321838..5e6136d2ed71 100644
    944 --- a/drivers/usb/core/config.c
    945 +++ b/drivers/usb/core/config.c
    946 @@ -763,21 +763,18 @@ void usb_destroy_configuration(struct usb_device *dev)
    947 return;
    948
    949 if (dev->rawdescriptors) {
    950 - for (i = 0; i < dev->descriptor.bNumConfigurations &&
    951 - i < USB_MAXCONFIG; i++)
    952 + for (i = 0; i < dev->descriptor.bNumConfigurations; i++)
    953 kfree(dev->rawdescriptors[i]);
    954
    955 kfree(dev->rawdescriptors);
    956 dev->rawdescriptors = NULL;
    957 }
    958
    959 - for (c = 0; c < dev->descriptor.bNumConfigurations &&
    960 - c < USB_MAXCONFIG; c++) {
    961 + for (c = 0; c < dev->descriptor.bNumConfigurations; c++) {
    962 struct usb_host_config *cf = &dev->config[c];
    963
    964 kfree(cf->string);
    965 - for (i = 0; i < cf->desc.bNumInterfaces &&
    966 - i < USB_MAXINTERFACES; i++) {
    967 + for (i = 0; i < cf->desc.bNumInterfaces; i++) {
    968 if (cf->intf_cache[i])
    969 kref_put(&cf->intf_cache[i]->ref,
    970 usb_release_interface_cache);
    971 diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
    972 index 5815120c0402..8e83649f77ce 100644
    973 --- a/drivers/usb/gadget/function/f_hid.c
    974 +++ b/drivers/usb/gadget/function/f_hid.c
    975 @@ -340,20 +340,20 @@ try_again:
    976 req->complete = f_hidg_req_complete;
    977 req->context = hidg;
    978
    979 + spin_unlock_irqrestore(&hidg->write_spinlock, flags);
    980 +
    981 status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
    982 if (status < 0) {
    983 ERROR(hidg->func.config->cdev,
    984 "usb_ep_queue error on int endpoint %zd\n", status);
    985 - goto release_write_pending_unlocked;
    986 + goto release_write_pending;
    987 } else {
    988 status = count;
    989 }
    990 - spin_unlock_irqrestore(&hidg->write_spinlock, flags);
    991
    992 return status;
    993 release_write_pending:
    994 spin_lock_irqsave(&hidg->write_spinlock, flags);
    995 -release_write_pending_unlocked:
    996 hidg->write_pending = 0;
    997 spin_unlock_irqrestore(&hidg->write_spinlock, flags);
    998
    999 diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
    1000 index 0e4535e632ec..64ee8154f2bb 100644
    1001 --- a/drivers/usb/host/xhci-rcar.c
    1002 +++ b/drivers/usb/host/xhci-rcar.c
    1003 @@ -192,5 +192,6 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd)
    1004 xhci_rcar_is_gen3(hcd->self.controller))
    1005 xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
    1006
    1007 + xhci->quirks |= XHCI_TRUST_TX_LENGTH;
    1008 return xhci_rcar_download_firmware(hcd);
    1009 }
    1010 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1011 index f4e34a75d413..879d82223068 100644
    1012 --- a/drivers/usb/host/xhci-ring.c
    1013 +++ b/drivers/usb/host/xhci-ring.c
    1014 @@ -1645,10 +1645,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
    1015 }
    1016 }
    1017
    1018 - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 &&
    1019 - DEV_SUPERSPEED_ANY(temp)) {
    1020 + if ((temp & PORT_PLC) &&
    1021 + DEV_SUPERSPEED_ANY(temp) &&
    1022 + ((temp & PORT_PLS_MASK) == XDEV_U0 ||
    1023 + (temp & PORT_PLS_MASK) == XDEV_U1 ||
    1024 + (temp & PORT_PLS_MASK) == XDEV_U2)) {
    1025 xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
    1026 - /* We've just brought the device into U0 through either the
    1027 + /* We've just brought the device into U0/1/2 through either the
    1028 * Resume state after a device remote wakeup, or through the
    1029 * U3Exit state after a host-initiated resume. If it's a device
    1030 * initiated remote wake, don't pass up the link state change,
    1031 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    1032 index e679fec9ce3a..de4771ce0df6 100644
    1033 --- a/drivers/usb/host/xhci.h
    1034 +++ b/drivers/usb/host/xhci.h
    1035 @@ -311,6 +311,7 @@ struct xhci_op_regs {
    1036 */
    1037 #define PORT_PLS_MASK (0xf << 5)
    1038 #define XDEV_U0 (0x0 << 5)
    1039 +#define XDEV_U1 (0x1 << 5)
    1040 #define XDEV_U2 (0x2 << 5)
    1041 #define XDEV_U3 (0x3 << 5)
    1042 #define XDEV_INACTIVE (0x6 << 5)
    1043 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1044 index 7bbf2ca73f68..40c58145bf80 100644
    1045 --- a/drivers/usb/serial/cp210x.c
    1046 +++ b/drivers/usb/serial/cp210x.c
    1047 @@ -77,6 +77,7 @@ static const struct usb_device_id id_table[] = {
    1048 { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */
    1049 { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
    1050 { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
    1051 + { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */
    1052 { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
    1053 { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
    1054 { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
    1055 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    1056 index b88a72220acd..f54931aa7528 100644
    1057 --- a/drivers/usb/serial/ftdi_sio.c
    1058 +++ b/drivers/usb/serial/ftdi_sio.c
    1059 @@ -604,6 +604,8 @@ static const struct usb_device_id id_table_combined[] = {
    1060 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    1061 { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
    1062 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    1063 + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
    1064 + { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
    1065 { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
    1066 { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
    1067 { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
    1068 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    1069 index ddf5ab983dc9..15d220eaf6e6 100644
    1070 --- a/drivers/usb/serial/ftdi_sio_ids.h
    1071 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    1072 @@ -566,7 +566,9 @@
    1073 /*
    1074 * NovaTech product ids (FTDI_VID)
    1075 */
    1076 -#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
    1077 +#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
    1078 +#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */
    1079 +#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
    1080
    1081 /*
    1082 * Synapse Wireless product ids (FTDI_VID)
    1083 diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    1084 index 135eb04368f9..ea20322e1416 100644
    1085 --- a/drivers/usb/serial/mos7720.c
    1086 +++ b/drivers/usb/serial/mos7720.c
    1087 @@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
    1088 if (!urbtrack)
    1089 return -ENOMEM;
    1090
    1091 - kref_get(&mos_parport->ref_count);
    1092 - urbtrack->mos_parport = mos_parport;
    1093 urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
    1094 if (!urbtrack->urb) {
    1095 kfree(urbtrack);
    1096 @@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
    1097 usb_sndctrlpipe(usbdev, 0),
    1098 (unsigned char *)urbtrack->setup,
    1099 NULL, 0, async_complete, urbtrack);
    1100 + kref_get(&mos_parport->ref_count);
    1101 + urbtrack->mos_parport = mos_parport;
    1102 kref_init(&urbtrack->ref_count);
    1103 INIT_LIST_HEAD(&urbtrack->urblist_entry);
    1104
    1105 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1106 index b2b7c12e5c86..9f96dd274370 100644
    1107 --- a/drivers/usb/serial/option.c
    1108 +++ b/drivers/usb/serial/option.c
    1109 @@ -1066,7 +1066,8 @@ static const struct usb_device_id option_ids[] = {
    1110 .driver_info = RSVD(3) },
    1111 { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
    1112 { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
    1113 - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
    1114 + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
    1115 + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
    1116 /* Quectel products using Qualcomm vendor ID */
    1117 { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
    1118 { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
    1119 @@ -1941,10 +1942,12 @@ static const struct usb_device_id option_ids[] = {
    1120 .driver_info = RSVD(4) },
    1121 { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
    1122 .driver_info = RSVD(4) },
    1123 - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
    1124 - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
    1125 - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
    1126 - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
    1127 + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
    1128 + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
    1129 + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
    1130 + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
    1131 + .driver_info = RSVD(4) },
    1132 + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
    1133 { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
    1134 { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
    1135 { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
    1136 diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
    1137 index 14a93cb21310..66d58e93bc32 100644
    1138 --- a/drivers/video/fbdev/goldfishfb.c
    1139 +++ b/drivers/video/fbdev/goldfishfb.c
    1140 @@ -234,7 +234,7 @@ static int goldfish_fb_probe(struct platform_device *pdev)
    1141 fb->fb.var.activate = FB_ACTIVATE_NOW;
    1142 fb->fb.var.height = readl(fb->reg_base + FB_GET_PHYS_HEIGHT);
    1143 fb->fb.var.width = readl(fb->reg_base + FB_GET_PHYS_WIDTH);
    1144 - fb->fb.var.pixclock = 10000;
    1145 + fb->fb.var.pixclock = 0;
    1146
    1147 fb->fb.var.red.offset = 11;
    1148 fb->fb.var.red.length = 5;
    1149 diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
    1150 index af6a776fa18c..5aa07de5750e 100644
    1151 --- a/fs/btrfs/raid56.c
    1152 +++ b/fs/btrfs/raid56.c
    1153 @@ -2395,8 +2395,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
    1154 bitmap_clear(rbio->dbitmap, pagenr, 1);
    1155 kunmap(p);
    1156
    1157 - for (stripe = 0; stripe < rbio->real_stripes; stripe++)
    1158 + for (stripe = 0; stripe < nr_data; stripe++)
    1159 kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
    1160 + kunmap(p_page);
    1161 }
    1162
    1163 __free_page(p_page);
    1164 diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
    1165 index 47d11a30bee7..a36bb75383dc 100644
    1166 --- a/fs/btrfs/tree-log.c
    1167 +++ b/fs/btrfs/tree-log.c
    1168 @@ -3343,9 +3343,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
    1169 }
    1170 btrfs_release_path(path);
    1171
    1172 - /* find the first key from this transaction again */
    1173 + /*
    1174 + * Find the first key from this transaction again. See the note for
    1175 + * log_new_dir_dentries, if we're logging a directory recursively we
    1176 + * won't be holding its i_mutex, which means we can modify the directory
    1177 + * while we're logging it. If we remove an entry between our first
    1178 + * search and this search we'll not find the key again and can just
    1179 + * bail.
    1180 + */
    1181 ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
    1182 - if (WARN_ON(ret != 0))
    1183 + if (ret != 0)
    1184 goto done;
    1185
    1186 /*
    1187 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
    1188 index eb55ab6930b5..6d0d94fc243d 100644
    1189 --- a/fs/nfs/nfs4proc.c
    1190 +++ b/fs/nfs/nfs4proc.c
    1191 @@ -2748,7 +2748,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
    1192 nfs4_schedule_stateid_recovery(server, state);
    1193 }
    1194 out:
    1195 - nfs4_sequence_free_slot(&opendata->o_res.seq_res);
    1196 + if (!opendata->cancelled)
    1197 + nfs4_sequence_free_slot(&opendata->o_res.seq_res);
    1198 return ret;
    1199 }
    1200
    1201 diff --git a/fs/open.c b/fs/open.c
    1202 index a6c6244f4993..f1deb36ee1b7 100644
    1203 --- a/fs/open.c
    1204 +++ b/fs/open.c
    1205 @@ -717,6 +717,12 @@ static int do_dentry_open(struct file *f,
    1206 return 0;
    1207 }
    1208
    1209 + /* Any file opened for execve()/uselib() has to be a regular file. */
    1210 + if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
    1211 + error = -EACCES;
    1212 + goto cleanup_file;
    1213 + }
    1214 +
    1215 if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
    1216 error = get_write_access(inode);
    1217 if (unlikely(error))
    1218 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
    1219 index 1999e85840d5..6f30cf8ef7a1 100644
    1220 --- a/fs/proc/proc_sysctl.c
    1221 +++ b/fs/proc/proc_sysctl.c
    1222 @@ -1604,7 +1604,8 @@ static void drop_sysctl_table(struct ctl_table_header *header)
    1223 if (--header->nreg)
    1224 return;
    1225
    1226 - put_links(header);
    1227 + if (parent)
    1228 + put_links(header);
    1229 start_unregistering(header);
    1230 if (!--header->count)
    1231 kfree_rcu(header, rcu);
    1232 diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
    1233 index 4a5b9a306c69..803fc26ef0ba 100644
    1234 --- a/include/net/sctp/checksum.h
    1235 +++ b/include/net/sctp/checksum.h
    1236 @@ -60,7 +60,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2,
    1237 static inline __le32 sctp_compute_cksum(const struct sk_buff *skb,
    1238 unsigned int offset)
    1239 {
    1240 - struct sctphdr *sh = sctp_hdr(skb);
    1241 + struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
    1242 __le32 ret, old = sh->checksum;
    1243 const struct skb_checksum_ops ops = {
    1244 .update = sctp_csum_update,
    1245 diff --git a/include/net/sock.h b/include/net/sock.h
    1246 index 15bb04dec40e..116308632fae 100644
    1247 --- a/include/net/sock.h
    1248 +++ b/include/net/sock.h
    1249 @@ -650,6 +650,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list)
    1250 hlist_add_head_rcu(&sk->sk_node, list);
    1251 }
    1252
    1253 +static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list)
    1254 +{
    1255 + sock_hold(sk);
    1256 + hlist_add_tail_rcu(&sk->sk_node, list);
    1257 +}
    1258 +
    1259 static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
    1260 {
    1261 hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
    1262 diff --git a/kernel/cpu.c b/kernel/cpu.c
    1263 index b5a0165b7300..bf24e8400903 100644
    1264 --- a/kernel/cpu.c
    1265 +++ b/kernel/cpu.c
    1266 @@ -591,6 +591,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
    1267 }
    1268 }
    1269
    1270 +static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st)
    1271 +{
    1272 + if (IS_ENABLED(CONFIG_HOTPLUG_CPU))
    1273 + return true;
    1274 + /*
    1275 + * When CPU hotplug is disabled, then taking the CPU down is not
    1276 + * possible because takedown_cpu() and the architecture and
    1277 + * subsystem specific mechanisms are not available. So the CPU
    1278 + * which would be completely unplugged again needs to stay around
    1279 + * in the current state.
    1280 + */
    1281 + return st->state <= CPUHP_BRINGUP_CPU;
    1282 +}
    1283 +
    1284 static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
    1285 enum cpuhp_state target)
    1286 {
    1287 @@ -601,8 +615,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
    1288 st->state++;
    1289 ret = cpuhp_invoke_callback(cpu, st->state, true, NULL);
    1290 if (ret) {
    1291 - st->target = prev_state;
    1292 - undo_cpu_up(cpu, st);
    1293 + if (can_rollback_cpu(st)) {
    1294 + st->target = prev_state;
    1295 + undo_cpu_up(cpu, st);
    1296 + }
    1297 break;
    1298 }
    1299 }
    1300 diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
    1301 index 1fc23cb4a3e0..d49aa4e6c916 100644
    1302 --- a/net/bluetooth/l2cap_core.c
    1303 +++ b/net/bluetooth/l2cap_core.c
    1304 @@ -3326,16 +3326,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
    1305
    1306 while (len >= L2CAP_CONF_OPT_SIZE) {
    1307 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
    1308 + if (len < 0)
    1309 + break;
    1310
    1311 hint = type & L2CAP_CONF_HINT;
    1312 type &= L2CAP_CONF_MASK;
    1313
    1314 switch (type) {
    1315 case L2CAP_CONF_MTU:
    1316 + if (olen != 2)
    1317 + break;
    1318 mtu = val;
    1319 break;
    1320
    1321 case L2CAP_CONF_FLUSH_TO:
    1322 + if (olen != 2)
    1323 + break;
    1324 chan->flush_to = val;
    1325 break;
    1326
    1327 @@ -3343,26 +3349,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
    1328 break;
    1329
    1330 case L2CAP_CONF_RFC:
    1331 - if (olen == sizeof(rfc))
    1332 - memcpy(&rfc, (void *) val, olen);
    1333 + if (olen != sizeof(rfc))
    1334 + break;
    1335 + memcpy(&rfc, (void *) val, olen);
    1336 break;
    1337
    1338 case L2CAP_CONF_FCS:
    1339 + if (olen != 1)
    1340 + break;
    1341 if (val == L2CAP_FCS_NONE)
    1342 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
    1343 break;
    1344
    1345 case L2CAP_CONF_EFS:
    1346 - if (olen == sizeof(efs)) {
    1347 - remote_efs = 1;
    1348 - memcpy(&efs, (void *) val, olen);
    1349 - }
    1350 + if (olen != sizeof(efs))
    1351 + break;
    1352 + remote_efs = 1;
    1353 + memcpy(&efs, (void *) val, olen);
    1354 break;
    1355
    1356 case L2CAP_CONF_EWS:
    1357 + if (olen != 2)
    1358 + break;
    1359 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
    1360 return -ECONNREFUSED;
    1361 -
    1362 set_bit(FLAG_EXT_CTRL, &chan->flags);
    1363 set_bit(CONF_EWS_RECV, &chan->conf_state);
    1364 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
    1365 @@ -3372,7 +3382,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
    1366 default:
    1367 if (hint)
    1368 break;
    1369 -
    1370 result = L2CAP_CONF_UNKNOWN;
    1371 *((u8 *) ptr++) = type;
    1372 break;
    1373 @@ -3537,58 +3546,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
    1374
    1375 while (len >= L2CAP_CONF_OPT_SIZE) {
    1376 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
    1377 + if (len < 0)
    1378 + break;
    1379
    1380 switch (type) {
    1381 case L2CAP_CONF_MTU:
    1382 + if (olen != 2)
    1383 + break;
    1384 if (val < L2CAP_DEFAULT_MIN_MTU) {
    1385 *result = L2CAP_CONF_UNACCEPT;
    1386 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
    1387 } else
    1388 chan->imtu = val;
    1389 - l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
    1390 + l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
    1391 + endptr - ptr);
    1392 break;
    1393
    1394 case L2CAP_CONF_FLUSH_TO:
    1395 + if (olen != 2)
    1396 + break;
    1397 chan->flush_to = val;
    1398 - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
    1399 - 2, chan->flush_to, endptr - ptr);
    1400 + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
    1401 + chan->flush_to, endptr - ptr);
    1402 break;
    1403
    1404 case L2CAP_CONF_RFC:
    1405 - if (olen == sizeof(rfc))
    1406 - memcpy(&rfc, (void *)val, olen);
    1407 -
    1408 + if (olen != sizeof(rfc))
    1409 + break;
    1410 + memcpy(&rfc, (void *)val, olen);
    1411 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
    1412 rfc.mode != chan->mode)
    1413 return -ECONNREFUSED;
    1414 -
    1415 chan->fcs = 0;
    1416 -
    1417 - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
    1418 - sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
    1419 + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
    1420 + (unsigned long) &rfc, endptr - ptr);
    1421 break;
    1422
    1423 case L2CAP_CONF_EWS:
    1424 + if (olen != 2)
    1425 + break;
    1426 chan->ack_win = min_t(u16, val, chan->ack_win);
    1427 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
    1428 chan->tx_win, endptr - ptr);
    1429 break;
    1430
    1431 case L2CAP_CONF_EFS:
    1432 - if (olen == sizeof(efs)) {
    1433 - memcpy(&efs, (void *)val, olen);
    1434 -
    1435 - if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
    1436 - efs.stype != L2CAP_SERV_NOTRAFIC &&
    1437 - efs.stype != chan->local_stype)
    1438 - return -ECONNREFUSED;
    1439 -
    1440 - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
    1441 - (unsigned long) &efs, endptr - ptr);
    1442 - }
    1443 + if (olen != sizeof(efs))
    1444 + break;
    1445 + memcpy(&efs, (void *)val, olen);
    1446 + if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
    1447 + efs.stype != L2CAP_SERV_NOTRAFIC &&
    1448 + efs.stype != chan->local_stype)
    1449 + return -ECONNREFUSED;
    1450 + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
    1451 + (unsigned long) &efs, endptr - ptr);
    1452 break;
    1453
    1454 case L2CAP_CONF_FCS:
    1455 + if (olen != 1)
    1456 + break;
    1457 if (*result == L2CAP_CONF_PENDING)
    1458 if (val == L2CAP_FCS_NONE)
    1459 set_bit(CONF_RECV_NO_FCS,
    1460 @@ -3717,13 +3733,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
    1461
    1462 while (len >= L2CAP_CONF_OPT_SIZE) {
    1463 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
    1464 + if (len < 0)
    1465 + break;
    1466
    1467 switch (type) {
    1468 case L2CAP_CONF_RFC:
    1469 - if (olen == sizeof(rfc))
    1470 - memcpy(&rfc, (void *)val, olen);
    1471 + if (olen != sizeof(rfc))
    1472 + break;
    1473 + memcpy(&rfc, (void *)val, olen);
    1474 break;
    1475 case L2CAP_CONF_EWS:
    1476 + if (olen != 2)
    1477 + break;
    1478 txwin_ext = val;
    1479 break;
    1480 }
    1481 diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
    1482 index 93c706172f40..87c513b5ff2e 100644
    1483 --- a/net/dccp/ipv6.c
    1484 +++ b/net/dccp/ipv6.c
    1485 @@ -431,8 +431,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
    1486 newnp->ipv6_mc_list = NULL;
    1487 newnp->ipv6_ac_list = NULL;
    1488 newnp->ipv6_fl_list = NULL;
    1489 - newnp->mcast_oif = inet6_iif(skb);
    1490 - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
    1491 + newnp->mcast_oif = inet_iif(skb);
    1492 + newnp->mcast_hops = ip_hdr(skb)->ttl;
    1493
    1494 /*
    1495 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
    1496 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1497 index 0a69d39880f2..4953466cf98f 100644
    1498 --- a/net/ipv6/tcp_ipv6.c
    1499 +++ b/net/ipv6/tcp_ipv6.c
    1500 @@ -1056,11 +1056,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
    1501 newnp->ipv6_fl_list = NULL;
    1502 newnp->pktoptions = NULL;
    1503 newnp->opt = NULL;
    1504 - newnp->mcast_oif = tcp_v6_iif(skb);
    1505 - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
    1506 - newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
    1507 + newnp->mcast_oif = inet_iif(skb);
    1508 + newnp->mcast_hops = ip_hdr(skb)->ttl;
    1509 + newnp->rcv_flowinfo = 0;
    1510 if (np->repflow)
    1511 - newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
    1512 + newnp->flow_label = 0;
    1513
    1514 /*
    1515 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
    1516 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    1517 index 14df2fcf6138..522d4ca715c9 100644
    1518 --- a/net/packet/af_packet.c
    1519 +++ b/net/packet/af_packet.c
    1520 @@ -3278,7 +3278,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
    1521 }
    1522
    1523 mutex_lock(&net->packet.sklist_lock);
    1524 - sk_add_node_rcu(sk, &net->packet.sklist);
    1525 + sk_add_node_tail_rcu(sk, &net->packet.sklist);
    1526 mutex_unlock(&net->packet.sklist_lock);
    1527
    1528 preempt_disable();
    1529 @@ -4229,7 +4229,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
    1530 struct pgv *pg_vec;
    1531 int i;
    1532
    1533 - pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL);
    1534 + pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN);
    1535 if (unlikely(!pg_vec))
    1536 goto out;
    1537
    1538 diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
    1539 index 7ca57741b2fb..7849f286bb93 100644
    1540 --- a/net/rose/rose_subr.c
    1541 +++ b/net/rose/rose_subr.c
    1542 @@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype)
    1543 struct sk_buff *skb;
    1544 unsigned char *dptr;
    1545 unsigned char lci1, lci2;
    1546 - char buffer[100];
    1547 - int len, faclen = 0;
    1548 + int maxfaclen = 0;
    1549 + int len, faclen;
    1550 + int reserve;
    1551
    1552 - len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1;
    1553 + reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1;
    1554 + len = ROSE_MIN_LEN;
    1555
    1556 switch (frametype) {
    1557 case ROSE_CALL_REQUEST:
    1558 len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN;
    1559 - faclen = rose_create_facilities(buffer, rose);
    1560 - len += faclen;
    1561 + maxfaclen = 256;
    1562 break;
    1563 case ROSE_CALL_ACCEPTED:
    1564 case ROSE_CLEAR_REQUEST:
    1565 @@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype)
    1566 break;
    1567 }
    1568
    1569 - if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
    1570 + skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC);
    1571 + if (!skb)
    1572 return;
    1573
    1574 /*
    1575 * Space for AX.25 header and PID.
    1576 */
    1577 - skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1);
    1578 + skb_reserve(skb, reserve);
    1579
    1580 - dptr = skb_put(skb, skb_tailroom(skb));
    1581 + dptr = skb_put(skb, len);
    1582
    1583 lci1 = (rose->lci >> 8) & 0x0F;
    1584 lci2 = (rose->lci >> 0) & 0xFF;
    1585 @@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype)
    1586 dptr += ROSE_ADDR_LEN;
    1587 memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
    1588 dptr += ROSE_ADDR_LEN;
    1589 - memcpy(dptr, buffer, faclen);
    1590 + faclen = rose_create_facilities(dptr, rose);
    1591 + skb_put(skb, faclen);
    1592 dptr += faclen;
    1593 break;
    1594
    1595 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1596 index 549d0a4083b3..09a353c6373a 100644
    1597 --- a/net/wireless/nl80211.c
    1598 +++ b/net/wireless/nl80211.c
    1599 @@ -12942,7 +12942,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
    1600 struct sk_buff *msg;
    1601 void *hdr;
    1602
    1603 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1604 + msg = nlmsg_new(100 + len, gfp);
    1605 if (!msg)
    1606 return;
    1607
    1608 @@ -13094,7 +13094,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
    1609 struct sk_buff *msg;
    1610 void *hdr;
    1611
    1612 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1613 + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
    1614 if (!msg)
    1615 return;
    1616
    1617 @@ -13136,7 +13136,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
    1618 struct sk_buff *msg;
    1619 void *hdr;
    1620
    1621 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1622 + msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
    1623 if (!msg)
    1624 return;
    1625
    1626 @@ -13173,7 +13173,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
    1627 struct sk_buff *msg;
    1628 void *hdr;
    1629
    1630 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
    1631 + msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
    1632 if (!msg)
    1633 return;
    1634
    1635 @@ -13249,7 +13249,7 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
    1636
    1637 trace_cfg80211_notify_new_peer_candidate(dev, addr);
    1638
    1639 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1640 + msg = nlmsg_new(100 + ie_len, gfp);
    1641 if (!msg)
    1642 return;
    1643
    1644 @@ -13620,7 +13620,7 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
    1645 struct sk_buff *msg;
    1646 void *hdr;
    1647
    1648 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1649 + msg = nlmsg_new(100 + len, gfp);
    1650 if (!msg)
    1651 return -ENOMEM;
    1652
    1653 @@ -13664,7 +13664,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
    1654
    1655 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
    1656
    1657 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
    1658 + msg = nlmsg_new(100 + len, gfp);
    1659 if (!msg)
    1660 return;
    1661
    1662 @@ -14473,7 +14473,7 @@ void cfg80211_ft_event(struct net_device *netdev,
    1663 if (!ft_event->target_ap)
    1664 return;
    1665
    1666 - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
    1667 + msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
    1668 if (!msg)
    1669 return;
    1670
    1671 diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
    1672 index cfb8f5896787..824097571467 100644
    1673 --- a/sound/core/oss/pcm_oss.c
    1674 +++ b/sound/core/oss/pcm_oss.c
    1675 @@ -951,6 +951,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
    1676 oss_frame_size = snd_pcm_format_physical_width(params_format(params)) *
    1677 params_channels(params) / 8;
    1678
    1679 + err = snd_pcm_oss_period_size(substream, params, sparams);
    1680 + if (err < 0)
    1681 + goto failure;
    1682 +
    1683 + n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
    1684 + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
    1685 + if (err < 0)
    1686 + goto failure;
    1687 +
    1688 + err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
    1689 + runtime->oss.periods, NULL);
    1690 + if (err < 0)
    1691 + goto failure;
    1692 +
    1693 + snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
    1694 +
    1695 + err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams);
    1696 + if (err < 0) {
    1697 + pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
    1698 + goto failure;
    1699 + }
    1700 +
    1701 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
    1702 snd_pcm_oss_plugin_clear(substream);
    1703 if (!direct) {
    1704 @@ -985,27 +1007,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
    1705 }
    1706 #endif
    1707
    1708 - err = snd_pcm_oss_period_size(substream, params, sparams);
    1709 - if (err < 0)
    1710 - goto failure;
    1711 -
    1712 - n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
    1713 - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
    1714 - if (err < 0)
    1715 - goto failure;
    1716 -
    1717 - err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
    1718 - runtime->oss.periods, NULL);
    1719 - if (err < 0)
    1720 - goto failure;
    1721 -
    1722 - snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
    1723 -
    1724 - if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) {
    1725 - pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
    1726 - goto failure;
    1727 - }
    1728 -
    1729 if (runtime->oss.trigger) {
    1730 sw_params->start_threshold = 1;
    1731 } else {
    1732 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
    1733 index 3586ab41dec4..e1138e70dbb3 100644
    1734 --- a/sound/core/pcm_native.c
    1735 +++ b/sound/core/pcm_native.c
    1736 @@ -1258,8 +1258,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push)
    1737 static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state)
    1738 {
    1739 struct snd_pcm_runtime *runtime = substream->runtime;
    1740 - if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
    1741 + switch (runtime->status->state) {
    1742 + case SNDRV_PCM_STATE_SUSPENDED:
    1743 return -EBUSY;
    1744 + /* unresumable PCM state; return -EBUSY for skipping suspend */
    1745 + case SNDRV_PCM_STATE_OPEN:
    1746 + case SNDRV_PCM_STATE_SETUP:
    1747 + case SNDRV_PCM_STATE_DISCONNECTED:
    1748 + return -EBUSY;
    1749 + }
    1750 runtime->trigger_master = substream;
    1751 return 0;
    1752 }
    1753 diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
    1754 index 59111cadaec2..c8b2309352d7 100644
    1755 --- a/sound/core/rawmidi.c
    1756 +++ b/sound/core/rawmidi.c
    1757 @@ -29,6 +29,7 @@
    1758 #include <linux/mutex.h>
    1759 #include <linux/module.h>
    1760 #include <linux/delay.h>
    1761 +#include <linux/nospec.h>
    1762 #include <sound/rawmidi.h>
    1763 #include <sound/info.h>
    1764 #include <sound/control.h>
    1765 @@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card,
    1766 return -ENXIO;
    1767 if (info->stream < 0 || info->stream > 1)
    1768 return -EINVAL;
    1769 + info->stream = array_index_nospec(info->stream, 2);
    1770 pstr = &rmidi->streams[info->stream];
    1771 if (pstr->substream_count == 0)
    1772 return -ENOENT;
    1773 diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
    1774 index 278ebb993122..c93945917235 100644
    1775 --- a/sound/core/seq/oss/seq_oss_synth.c
    1776 +++ b/sound/core/seq/oss/seq_oss_synth.c
    1777 @@ -617,13 +617,14 @@ int
    1778 snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf)
    1779 {
    1780 struct seq_oss_synth *rec;
    1781 + struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
    1782
    1783 - if (dev < 0 || dev >= dp->max_synthdev)
    1784 + if (!info)
    1785 return -ENXIO;
    1786
    1787 - if (dp->synths[dev].is_midi) {
    1788 + if (info->is_midi) {
    1789 struct midi_info minf;
    1790 - snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
    1791 + snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
    1792 inf->synth_type = SYNTH_TYPE_MIDI;
    1793 inf->synth_subtype = 0;
    1794 inf->nr_voices = 16;
    1795 diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
    1796 index 94764efb0a6a..3c1372655c33 100644
    1797 --- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
    1798 +++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
    1799 @@ -240,19 +240,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
    1800 if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d))
    1801 decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n /
    1802 decoder->tsc_ctc_ratio_d;
    1803 -
    1804 - /*
    1805 - * Allow for timestamps appearing to backwards because a TSC
    1806 - * packet has slipped past a MTC packet, so allow 2 MTC ticks
    1807 - * or ...
    1808 - */
    1809 - decoder->tsc_slip = multdiv(2 << decoder->mtc_shift,
    1810 - decoder->tsc_ctc_ratio_n,
    1811 - decoder->tsc_ctc_ratio_d);
    1812 }
    1813 - /* ... or 0x100 paranoia */
    1814 - if (decoder->tsc_slip < 0x100)
    1815 - decoder->tsc_slip = 0x100;
    1816 +
    1817 + /*
    1818 + * A TSC packet can slip past MTC packets so that the timestamp appears
    1819 + * to go backwards. One estimate is that can be up to about 40 CPU
    1820 + * cycles, which is certainly less than 0x1000 TSC ticks, but accept
    1821 + * slippage an order of magnitude more to be on the safe side.
    1822 + */
    1823 + decoder->tsc_slip = 0x10000;
    1824
    1825 intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift);
    1826 intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n);
    1827 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    1828 index 60de4c337f0a..c72586a094ed 100644
    1829 --- a/virt/kvm/kvm_main.c
    1830 +++ b/virt/kvm/kvm_main.c
    1831 @@ -2793,6 +2793,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
    1832 {
    1833 struct kvm_device *dev = filp->private_data;
    1834
    1835 + if (dev->kvm->mm != current->mm)
    1836 + return -EIO;
    1837 +
    1838 switch (ioctl) {
    1839 case KVM_SET_DEVICE_ATTR:
    1840 return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);