Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0331-4.9.232-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0331-4.9.232-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3606 - (show annotations) (download)
    Thu Aug 13 10:21:45 2020 UTC (3 years, 8 months ago) by niro
    File size: 64977 byte(s) 
    linux-232
    1 diff --git a/Makefile b/Makefile
    2 index 1b1342a8785a..934db3609c16 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 231
    9 +SUBLEVEL = 232
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 @@ -505,7 +505,7 @@ ifeq ($(cc-name),clang)
    14 ifneq ($(CROSS_COMPILE),)
    15 CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%))
    16 GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
    17 -CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)
    18 +CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
    19 GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
    20 endif
    21 ifneq ($(GCC_TOOLCHAIN),)
    22 diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
    23 index a5236a3e5297..3101d1b61713 100644
    24 --- a/arch/arm64/kernel/debug-monitors.c
    25 +++ b/arch/arm64/kernel/debug-monitors.c
    26 @@ -380,14 +380,14 @@ void user_rewind_single_step(struct task_struct *task)
    27 * If single step is active for this thread, then set SPSR.SS
    28 * to 1 to avoid returning to the active-pending state.
    29 */
    30 - if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
    31 + if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
    32 set_regs_spsr_ss(task_pt_regs(task));
    33 }
    34 NOKPROBE_SYMBOL(user_rewind_single_step);
    35
    36 void user_fastforward_single_step(struct task_struct *task)
    37 {
    38 - if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
    39 + if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
    40 clear_regs_spsr_ss(task_pt_regs(task));
    41 }
    42
    43 diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
    44 index 5394b9c5f914..1616428a5f95 100644
    45 --- a/arch/parisc/include/asm/atomic.h
    46 +++ b/arch/parisc/include/asm/atomic.h
    47 @@ -255,6 +255,8 @@ atomic64_set(atomic64_t *v, s64 i)
    48 _atomic_spin_unlock_irqrestore(v, flags);
    49 }
    50
    51 +#define atomic64_set_release(v, i) atomic64_set((v), (i))
    52 +
    53 static __inline__ s64
    54 atomic64_read(const atomic64_t *v)
    55 {
    56 diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
    57 index d258f59564e1..3b40c98bbbd4 100644
    58 --- a/arch/x86/math-emu/wm_sqrt.S
    59 +++ b/arch/x86/math-emu/wm_sqrt.S
    60 @@ -208,7 +208,7 @@ sqrt_stage_2_finish:
    61
    62 #ifdef PARANOID
    63 /* It should be possible to get here only if the arg is ffff....ffff */
    64 - cmp $0xffffffff,FPU_fsqrt_arg_1
    65 + cmpl $0xffffffff,FPU_fsqrt_arg_1
    66 jnz sqrt_stage_2_error
    67 #endif /* PARANOID */
    68
    69 diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
    70 index b9beae798d72..8679fa306206 100644
    71 --- a/arch/xtensa/kernel/setup.c
    72 +++ b/arch/xtensa/kernel/setup.c
    73 @@ -830,7 +830,8 @@ c_start(struct seq_file *f, loff_t *pos)
    74 static void *
    75 c_next(struct seq_file *f, void *v, loff_t *pos)
    76 {
    77 - return NULL;
    78 + ++*pos;
    79 + return c_start(f, pos);
    80 }
    81
    82 static void
    83 diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
    84 index 9210b9cc4ec9..455c6ec4086c 100644
    85 --- a/arch/xtensa/kernel/xtensa_ksyms.c
    86 +++ b/arch/xtensa/kernel/xtensa_ksyms.c
    87 @@ -82,13 +82,13 @@ void __xtensa_libgcc_window_spill(void)
    88 }
    89 EXPORT_SYMBOL(__xtensa_libgcc_window_spill);
    90
    91 -unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v)
    92 +unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v)
    93 {
    94 BUG();
    95 }
    96 EXPORT_SYMBOL(__sync_fetch_and_and_4);
    97
    98 -unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
    99 +unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v)
    100 {
    101 BUG();
    102 }
    103 diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
    104 index 36ce3511c733..7d0c83b47259 100644
    105 --- a/drivers/base/regmap/regmap-debugfs.c
    106 +++ b/drivers/base/regmap/regmap-debugfs.c
    107 @@ -204,6 +204,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
    108 if (*ppos < 0 || !count)
    109 return -EINVAL;
    110
    111 + if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
    112 + count = PAGE_SIZE << (MAX_ORDER - 1);
    113 +
    114 buf = kmalloc(count, GFP_KERNEL);
    115 if (!buf)
    116 return -ENOMEM;
    117 @@ -352,6 +355,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
    118 if (*ppos < 0 || !count)
    119 return -EINVAL;
    120
    121 + if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
    122 + count = PAGE_SIZE << (MAX_ORDER - 1);
    123 +
    124 buf = kmalloc(count, GFP_KERNEL);
    125 if (!buf)
    126 return -ENOMEM;
    127 diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
    128 index 1799a1dfa46e..cd984b59a8a1 100644
    129 --- a/drivers/base/regmap/regmap.c
    130 +++ b/drivers/base/regmap/regmap.c
    131 @@ -1239,7 +1239,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
    132
    133 /* If the user didn't specify a name match any */
    134 if (data)
    135 - return (*r)->name == data;
    136 + return !strcmp((*r)->name, data);
    137 else
    138 return 1;
    139 }
    140 diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
    141 index 1389f0582e29..c5a45c57b8b8 100644
    142 --- a/drivers/dma/ioat/dma.c
    143 +++ b/drivers/dma/ioat/dma.c
    144 @@ -38,6 +38,18 @@
    145
    146 #include "../dmaengine.h"
    147
    148 +int completion_timeout = 200;
    149 +module_param(completion_timeout, int, 0644);
    150 +MODULE_PARM_DESC(completion_timeout,
    151 + "set ioat completion timeout [msec] (default 200 [msec])");
    152 +int idle_timeout = 2000;
    153 +module_param(idle_timeout, int, 0644);
    154 +MODULE_PARM_DESC(idle_timeout,
    155 + "set ioat idel timeout [msec] (default 2000 [msec])");
    156 +
    157 +#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
    158 +#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
    159 +
    160 static char *chanerr_str[] = {
    161 "DMA Transfer Destination Address Error",
    162 "Next Descriptor Address Error",
    163 diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
    164 index a9bc1a15b0d1..b0152288983b 100644
    165 --- a/drivers/dma/ioat/dma.h
    166 +++ b/drivers/dma/ioat/dma.h
    167 @@ -111,8 +111,6 @@ struct ioatdma_chan {
    168 #define IOAT_RUN 5
    169 #define IOAT_CHAN_ACTIVE 6
    170 struct timer_list timer;
    171 - #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
    172 - #define IDLE_TIMEOUT msecs_to_jiffies(2000)
    173 #define RESET_DELAY msecs_to_jiffies(100)
    174 struct ioatdma_device *ioat_dma;
    175 dma_addr_t completion_dma;
    176 diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
    177 index c16c06b3dd2f..54296e262dea 100644
    178 --- a/drivers/dma/tegra210-adma.c
    179 +++ b/drivers/dma/tegra210-adma.c
    180 @@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc)
    181
    182 ret = pm_runtime_get_sync(tdc2dev(tdc));
    183 if (ret < 0) {
    184 + pm_runtime_put_noidle(tdc2dev(tdc));
    185 free_irq(tdc->irq, tdc);
    186 return ret;
    187 }
    188 @@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
    189 pm_runtime_enable(&pdev->dev);
    190
    191 ret = pm_runtime_get_sync(&pdev->dev);
    192 - if (ret < 0)
    193 + if (ret < 0) {
    194 + pm_runtime_put_noidle(&pdev->dev);
    195 goto rpm_disable;
    196 + }
    197
    198 ret = tegra_adma_init(tdma);
    199 if (ret)
    200 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
    201 index 954f5b76bfcf..d44965f805fe 100644
    202 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
    203 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
    204 @@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
    205 if (retries)
    206 udelay(400);
    207
    208 - /* transaction request, wait up to 1ms for it to complete */
    209 + /* transaction request, wait up to 2ms for it to complete */
    210 nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl);
    211
    212 - timeout = 1000;
    213 + timeout = 2000;
    214 do {
    215 ctrl = nvkm_rd32(device, 0x00e4e4 + base);
    216 udelay(1);
    217 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
    218 index 61d729b82c69..a5783f4d972e 100644
    219 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
    220 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
    221 @@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
    222 if (retries)
    223 udelay(400);
    224
    225 - /* transaction request, wait up to 1ms for it to complete */
    226 + /* transaction request, wait up to 2ms for it to complete */
    227 nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl);
    228
    229 - timeout = 1000;
    230 + timeout = 2000;
    231 do {
    232 ctrl = nvkm_rd32(device, 0x00d954 + base);
    233 udelay(1);
    234 diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
    235 index 197eb75d10ef..959a9e38b4f5 100644
    236 --- a/drivers/hid/hid-apple.c
    237 +++ b/drivers/hid/hid-apple.c
    238 @@ -55,6 +55,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
    239 struct apple_sc {
    240 unsigned long quirks;
    241 unsigned int fn_on;
    242 + unsigned int fn_found;
    243 DECLARE_BITMAP(pressed_numlock, KEY_CNT);
    244 };
    245
    246 @@ -340,12 +341,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
    247 struct hid_field *field, struct hid_usage *usage,
    248 unsigned long **bit, int *max)
    249 {
    250 + struct apple_sc *asc = hid_get_drvdata(hdev);
    251 +
    252 if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
    253 usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
    254 usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
    255 /* The fn key on Apple USB keyboards */
    256 set_bit(EV_REP, hi->input->evbit);
    257 hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
    258 + asc->fn_found = true;
    259 apple_setup_input(hi->input);
    260 return 1;
    261 }
    262 @@ -372,6 +376,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,
    263 return 0;
    264 }
    265
    266 +static int apple_input_configured(struct hid_device *hdev,
    267 + struct hid_input *hidinput)
    268 +{
    269 + struct apple_sc *asc = hid_get_drvdata(hdev);
    270 +
    271 + if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
    272 + hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
    273 + asc->quirks = 0;
    274 + }
    275 +
    276 + return 0;
    277 +}
    278 +
    279 static int apple_probe(struct hid_device *hdev,
    280 const struct hid_device_id *id)
    281 {
    282 @@ -593,6 +610,7 @@ static struct hid_driver apple_driver = {
    283 .event = apple_event,
    284 .input_mapping = apple_input_mapping,
    285 .input_mapped = apple_input_mapped,
    286 + .input_configured = apple_input_configured,
    287 };
    288 module_hid_driver(apple_driver);
    289
    290 diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    291 index 681ac9bc68b3..f98c1e1b1dbd 100644
    292 --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    293 +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    294 @@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
    295 },
    296 .driver_data = (void *)&sipodev_desc
    297 },
    298 + {
    299 + .ident = "Mediacom FlexBook edge 13",
    300 + .matches = {
    301 + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
    302 + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"),
    303 + },
    304 + .driver_data = (void *)&sipodev_desc
    305 + },
    306 {
    307 .ident = "Odys Winbook 13",
    308 .matches = {
    309 diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
    310 index 3a352f76e633..427d4dbc9735 100644
    311 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
    312 +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
    313 @@ -1023,8 +1023,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
    314 if (epause->tx_pause)
    315 link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
    316
    317 - if (netif_running(dev))
    318 + if (netif_running(dev)) {
    319 + mutex_lock(&bp->link_lock);
    320 rc = bnxt_hwrm_set_pause(bp);
    321 + mutex_unlock(&bp->link_lock);
    322 + }
    323 return rc;
    324 }
    325
    326 diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
    327 index 49f692907a30..c4197d0ec4d2 100644
    328 --- a/drivers/net/ethernet/marvell/sky2.c
    329 +++ b/drivers/net/ethernet/marvell/sky2.c
    330 @@ -215,7 +215,7 @@ io_error:
    331
    332 static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
    333 {
    334 - u16 v;
    335 + u16 v = 0;
    336 __gm_phy_read(hw, port, reg, &v);
    337 return v;
    338 }
    339 diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
    340 index b0c72167bade..3c221ca2cc12 100644
    341 --- a/drivers/net/ethernet/smsc/smc91x.c
    342 +++ b/drivers/net/ethernet/smsc/smc91x.c
    343 @@ -2294,7 +2294,7 @@ static int smc_drv_probe(struct platform_device *pdev)
    344 ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
    345 "power", 0, 0, 100);
    346 if (ret)
    347 - return ret;
    348 + goto out_free_netdev;
    349
    350 /*
    351 * Optional reset GPIO configured? Minimum 100 ns reset needed
    352 @@ -2303,7 +2303,7 @@ static int smc_drv_probe(struct platform_device *pdev)
    353 ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
    354 "reset", 0, 0, 100);
    355 if (ret)
    356 - return ret;
    357 + goto out_free_netdev;
    358
    359 /*
    360 * Need to wait for optional EEPROM to load, max 750 us according
    361 diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
    362 index 313e006f74fe..6f3519123eb6 100644
    363 --- a/drivers/net/hippi/rrunner.c
    364 +++ b/drivers/net/hippi/rrunner.c
    365 @@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev)
    366 rrpriv->info = NULL;
    367 }
    368 if (rrpriv->rx_ctrl) {
    369 - pci_free_consistent(pdev, sizeof(struct ring_ctrl),
    370 + pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
    371 rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
    372 rrpriv->rx_ctrl = NULL;
    373 }
    374 diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
    375 index 7e94526de51c..5649cc075ccb 100644
    376 --- a/drivers/net/phy/dp83640.c
    377 +++ b/drivers/net/phy/dp83640.c
    378 @@ -1337,6 +1337,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
    379 dp83640->hwts_rx_en = 1;
    380 dp83640->layer = PTP_CLASS_L4;
    381 dp83640->version = PTP_CLASS_V1;
    382 + cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
    383 break;
    384 case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
    385 case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
    386 @@ -1344,6 +1345,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
    387 dp83640->hwts_rx_en = 1;
    388 dp83640->layer = PTP_CLASS_L4;
    389 dp83640->version = PTP_CLASS_V2;
    390 + cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
    391 break;
    392 case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
    393 case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
    394 @@ -1351,6 +1353,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
    395 dp83640->hwts_rx_en = 1;
    396 dp83640->layer = PTP_CLASS_L2;
    397 dp83640->version = PTP_CLASS_V2;
    398 + cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
    399 break;
    400 case HWTSTAMP_FILTER_PTP_V2_EVENT:
    401 case HWTSTAMP_FILTER_PTP_V2_SYNC:
    402 @@ -1358,6 +1361,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
    403 dp83640->hwts_rx_en = 1;
    404 dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
    405 dp83640->version = PTP_CLASS_V2;
    406 + cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
    407 break;
    408 default:
    409 return -ERANGE;
    410 diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
    411 index 2c50497cc4ed..7ec8992401fb 100644
    412 --- a/drivers/net/usb/ax88172a.c
    413 +++ b/drivers/net/usb/ax88172a.c
    414 @@ -217,6 +217,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
    415 ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
    416 if (ret < ETH_ALEN) {
    417 netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
    418 + ret = -EIO;
    419 goto free;
    420 }
    421 memcpy(dev->net->dev_addr, buf, ETH_ALEN);
    422 diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
    423 index 6676607164d6..f5657783fad4 100644
    424 --- a/drivers/net/wan/lapbether.c
    425 +++ b/drivers/net/wan/lapbether.c
    426 @@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev)
    427 dev->netdev_ops = &lapbeth_netdev_ops;
    428 dev->destructor = free_netdev;
    429 dev->type = ARPHRD_X25;
    430 - dev->hard_header_len = 3;
    431 dev->mtu = 1000;
    432 dev->addr_len = 0;
    433 }
    434 @@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev)
    435 if (!ndev)
    436 goto out;
    437
    438 + /* When transmitting data:
    439 + * first this driver removes a pseudo header of 1 byte,
    440 + * then the lapb module prepends an LAPB header of at most 3 bytes,
    441 + * then this driver prepends a length field of 2 bytes,
    442 + * then the underlying Ethernet device prepends its own header.
    443 + */
    444 + ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
    445 +
    446 lapbeth = netdev_priv(ndev);
    447 lapbeth->axdev = ndev;
    448
    449 diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
    450 index eb56bb5916be..3b983f645726 100644
    451 --- a/drivers/net/wan/x25_asy.c
    452 +++ b/drivers/net/wan/x25_asy.c
    453 @@ -186,7 +186,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl)
    454 netif_wake_queue(sl->dev);
    455 }
    456
    457 -/* Send one completely decapsulated IP datagram to the IP layer. */
    458 +/* Send an LAPB frame to the LAPB module to process. */
    459
    460 static void x25_asy_bump(struct x25_asy *sl)
    461 {
    462 @@ -198,13 +198,12 @@ static void x25_asy_bump(struct x25_asy *sl)
    463 count = sl->rcount;
    464 dev->stats.rx_bytes += count;
    465
    466 - skb = dev_alloc_skb(count+1);
    467 + skb = dev_alloc_skb(count);
    468 if (skb == NULL) {
    469 netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
    470 dev->stats.rx_dropped++;
    471 return;
    472 }
    473 - skb_push(skb, 1); /* LAPB internal control */
    474 memcpy(skb_put(skb, count), sl->rbuff, count);
    475 skb->protocol = x25_type_trans(skb, sl->dev);
    476 err = lapb_data_received(skb->dev, skb);
    477 @@ -212,7 +211,6 @@ static void x25_asy_bump(struct x25_asy *sl)
    478 kfree_skb(skb);
    479 printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
    480 } else {
    481 - netif_rx(skb);
    482 dev->stats.rx_packets++;
    483 }
    484 }
    485 @@ -358,12 +356,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
    486 */
    487
    488 /*
    489 - * Called when I frame data arrives. We did the work above - throw it
    490 - * at the net layer.
    491 + * Called when I frame data arrive. We add a pseudo header for upper
    492 + * layers and pass it to upper layers.
    493 */
    494
    495 static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb)
    496 {
    497 + if (skb_cow(skb, 1)) {
    498 + kfree_skb(skb);
    499 + return NET_RX_DROP;
    500 + }
    501 + skb_push(skb, 1);
    502 + skb->data[0] = X25_IFACE_DATA;
    503 +
    504 + skb->protocol = x25_type_trans(skb, dev);
    505 +
    506 return netif_rx(skb);
    507 }
    508
    509 @@ -659,7 +666,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
    510 switch (s) {
    511 case X25_END:
    512 if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
    513 - sl->rcount > 2)
    514 + sl->rcount >= 2)
    515 x25_asy_bump(sl);
    516 clear_bit(SLF_ESCAPE, &sl->flags);
    517 sl->rcount = 0;
    518 diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
    519 index 84b5f8a144ff..fb5b7ce3d2c3 100644
    520 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c
    521 +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
    522 @@ -641,9 +641,9 @@ err:
    523
    524 static void ath9k_hif_usb_rx_cb(struct urb *urb)
    525 {
    526 - struct sk_buff *skb = (struct sk_buff *) urb->context;
    527 - struct hif_device_usb *hif_dev =
    528 - usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
    529 + struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
    530 + struct hif_device_usb *hif_dev = rx_buf->hif_dev;
    531 + struct sk_buff *skb = rx_buf->skb;
    532 int ret;
    533
    534 if (!skb)
    535 @@ -683,14 +683,15 @@ resubmit:
    536 return;
    537 free:
    538 kfree_skb(skb);
    539 + kfree(rx_buf);
    540 }
    541
    542 static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
    543 {
    544 - struct sk_buff *skb = (struct sk_buff *) urb->context;
    545 + struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
    546 + struct hif_device_usb *hif_dev = rx_buf->hif_dev;
    547 + struct sk_buff *skb = rx_buf->skb;
    548 struct sk_buff *nskb;
    549 - struct hif_device_usb *hif_dev =
    550 - usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
    551 int ret;
    552
    553 if (!skb)
    554 @@ -730,11 +731,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
    555 return;
    556 }
    557
    558 + rx_buf->skb = nskb;
    559 +
    560 usb_fill_int_urb(urb, hif_dev->udev,
    561 usb_rcvintpipe(hif_dev->udev,
    562 USB_REG_IN_PIPE),
    563 nskb->data, MAX_REG_IN_BUF_SIZE,
    564 - ath9k_hif_usb_reg_in_cb, nskb, 1);
    565 + ath9k_hif_usb_reg_in_cb, rx_buf, 1);
    566 }
    567
    568 resubmit:
    569 @@ -748,6 +751,7 @@ resubmit:
    570 return;
    571 free:
    572 kfree_skb(skb);
    573 + kfree(rx_buf);
    574 urb->context = NULL;
    575 }
    576
    577 @@ -793,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
    578 init_usb_anchor(&hif_dev->mgmt_submitted);
    579
    580 for (i = 0; i < MAX_TX_URB_NUM; i++) {
    581 - tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
    582 + tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
    583 if (!tx_buf)
    584 goto err;
    585
    586 @@ -830,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
    587
    588 static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
    589 {
    590 - struct urb *urb = NULL;
    591 + struct rx_buf *rx_buf = NULL;
    592 struct sk_buff *skb = NULL;
    593 + struct urb *urb = NULL;
    594 int i, ret;
    595
    596 init_usb_anchor(&hif_dev->rx_submitted);
    597 @@ -839,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
    598
    599 for (i = 0; i < MAX_RX_URB_NUM; i++) {
    600
    601 + rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
    602 + if (!rx_buf) {
    603 + ret = -ENOMEM;
    604 + goto err_rxb;
    605 + }
    606 +
    607 /* Allocate URB */
    608 urb = usb_alloc_urb(0, GFP_KERNEL);
    609 if (urb == NULL) {
    610 @@ -853,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
    611 goto err_skb;
    612 }
    613
    614 + rx_buf->hif_dev = hif_dev;
    615 + rx_buf->skb = skb;
    616 +
    617 usb_fill_bulk_urb(urb, hif_dev->udev,
    618 usb_rcvbulkpipe(hif_dev->udev,
    619 USB_WLAN_RX_PIPE),
    620 skb->data, MAX_RX_BUF_SIZE,
    621 - ath9k_hif_usb_rx_cb, skb);
    622 + ath9k_hif_usb_rx_cb, rx_buf);
    623
    624 /* Anchor URB */
    625 usb_anchor_urb(urb, &hif_dev->rx_submitted);
    626 @@ -883,6 +897,8 @@ err_submit:
    627 err_skb:
    628 usb_free_urb(urb);
    629 err_urb:
    630 + kfree(rx_buf);
    631 +err_rxb:
    632 ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
    633 return ret;
    634 }
    635 @@ -894,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
    636
    637 static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
    638 {
    639 - struct urb *urb = NULL;
    640 + struct rx_buf *rx_buf = NULL;
    641 struct sk_buff *skb = NULL;
    642 + struct urb *urb = NULL;
    643 int i, ret;
    644
    645 init_usb_anchor(&hif_dev->reg_in_submitted);
    646
    647 for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
    648
    649 + rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
    650 + if (!rx_buf) {
    651 + ret = -ENOMEM;
    652 + goto err_rxb;
    653 + }
    654 +
    655 /* Allocate URB */
    656 urb = usb_alloc_urb(0, GFP_KERNEL);
    657 if (urb == NULL) {
    658 @@ -916,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
    659 goto err_skb;
    660 }
    661
    662 + rx_buf->hif_dev = hif_dev;
    663 + rx_buf->skb = skb;
    664 +
    665 usb_fill_int_urb(urb, hif_dev->udev,
    666 usb_rcvintpipe(hif_dev->udev,
    667 USB_REG_IN_PIPE),
    668 skb->data, MAX_REG_IN_BUF_SIZE,
    669 - ath9k_hif_usb_reg_in_cb, skb, 1);
    670 + ath9k_hif_usb_reg_in_cb, rx_buf, 1);
    671
    672 /* Anchor URB */
    673 usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
    674 @@ -946,6 +972,8 @@ err_submit:
    675 err_skb:
    676 usb_free_urb(urb);
    677 err_urb:
    678 + kfree(rx_buf);
    679 +err_rxb:
    680 ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
    681 return ret;
    682 }
    683 diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
    684 index a95cdf562611..835264c36595 100644
    685 --- a/drivers/net/wireless/ath/ath9k/hif_usb.h
    686 +++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
    687 @@ -84,6 +84,11 @@ struct tx_buf {
    688 struct list_head list;
    689 };
    690
    691 +struct rx_buf {
    692 + struct sk_buff *skb;
    693 + struct hif_device_usb *hif_dev;
    694 +};
    695 +
    696 #define HIF_USB_TX_STOP BIT(0)
    697 #define HIF_USB_TX_FLUSH BIT(1)
    698
    699 diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
    700 index e8bbb20779d0..83597e1d6dcd 100644
    701 --- a/drivers/pinctrl/pinctrl-amd.h
    702 +++ b/drivers/pinctrl/pinctrl-amd.h
    703 @@ -250,7 +250,7 @@ static const struct amd_pingroup kerncz_groups[] = {
    704 {
    705 .name = "uart0",
    706 .pins = uart0_pins,
    707 - .npins = 9,
    708 + .npins = 5,
    709 },
    710 {
    711 .name = "uart1",
    712 diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
    713 index 319868f3f674..083cd11ce7d7 100644
    714 --- a/drivers/scsi/scsi_transport_spi.c
    715 +++ b/drivers/scsi/scsi_transport_spi.c
    716 @@ -353,7 +353,7 @@ store_spi_transport_##field(struct device *dev, \
    717 struct spi_transport_attrs *tp \
    718 = (struct spi_transport_attrs *)&starget->starget_data; \
    719 \
    720 - if (i->f->set_##field) \
    721 + if (!i->f->set_##field) \
    722 return -EINVAL; \
    723 val = simple_strtoul(buf, NULL, 0); \
    724 if (val > tp->max_##field) \
    725 diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
    726 index ccd1a91290bf..536a135cd00b 100644
    727 --- a/drivers/staging/comedi/drivers/addi_apci_1032.c
    728 +++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
    729 @@ -115,14 +115,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
    730 unsigned int *data)
    731 {
    732 struct apci1032_private *devpriv = dev->private;
    733 - unsigned int shift, oldmask;
    734 + unsigned int shift, oldmask, himask, lomask;
    735
    736 switch (data[0]) {
    737 case INSN_CONFIG_DIGITAL_TRIG:
    738 if (data[1] != 0)
    739 return -EINVAL;
    740 shift = data[3];
    741 - oldmask = (1U << shift) - 1;
    742 + if (shift < 32) {
    743 + oldmask = (1U << shift) - 1;
    744 + himask = data[4] << shift;
    745 + lomask = data[5] << shift;
    746 + } else {
    747 + oldmask = 0xffffffffu;
    748 + himask = 0;
    749 + lomask = 0;
    750 + }
    751 switch (data[2]) {
    752 case COMEDI_DIGITAL_TRIG_DISABLE:
    753 devpriv->ctrl = 0;
    754 @@ -145,8 +153,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
    755 devpriv->mode2 &= oldmask;
    756 }
    757 /* configure specified channels */
    758 - devpriv->mode1 |= data[4] << shift;
    759 - devpriv->mode2 |= data[5] << shift;
    760 + devpriv->mode1 |= himask;
    761 + devpriv->mode2 |= lomask;
    762 break;
    763 case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
    764 if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
    765 @@ -163,8 +171,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
    766 devpriv->mode2 &= oldmask;
    767 }
    768 /* configure specified channels */
    769 - devpriv->mode1 |= data[4] << shift;
    770 - devpriv->mode2 |= data[5] << shift;
    771 + devpriv->mode1 |= himask;
    772 + devpriv->mode2 |= lomask;
    773 break;
    774 default:
    775 return -EINVAL;
    776 diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
    777 index 79a8799b1262..c4e36fb6df9d 100644
    778 --- a/drivers/staging/comedi/drivers/addi_apci_1500.c
    779 +++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
    780 @@ -461,13 +461,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
    781 struct apci1500_private *devpriv = dev->private;
    782 unsigned int trig = data[1];
    783 unsigned int shift = data[3];
    784 - unsigned int hi_mask = data[4] << shift;
    785 - unsigned int lo_mask = data[5] << shift;
    786 - unsigned int chan_mask = hi_mask | lo_mask;
    787 - unsigned int old_mask = (1 << shift) - 1;
    788 + unsigned int hi_mask;
    789 + unsigned int lo_mask;
    790 + unsigned int chan_mask;
    791 + unsigned int old_mask;
    792 unsigned int pm;
    793 unsigned int pt;
    794 unsigned int pp;
    795 + unsigned int invalid_chan;
    796
    797 if (trig > 1) {
    798 dev_dbg(dev->class_dev,
    799 @@ -475,7 +476,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
    800 return -EINVAL;
    801 }
    802
    803 - if (chan_mask > 0xffff) {
    804 + if (shift <= 16) {
    805 + hi_mask = data[4] << shift;
    806 + lo_mask = data[5] << shift;
    807 + old_mask = (1U << shift) - 1;
    808 + invalid_chan = (data[4] | data[5]) >> (16 - shift);
    809 + } else {
    810 + hi_mask = 0;
    811 + lo_mask = 0;
    812 + old_mask = 0xffff;
    813 + invalid_chan = data[4] | data[5];
    814 + }
    815 + chan_mask = hi_mask | lo_mask;
    816 +
    817 + if (invalid_chan) {
    818 dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
    819 return -EINVAL;
    820 }
    821 diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c
    822 index 9bfb79c2e5c8..1b4ba19d599e 100644
    823 --- a/drivers/staging/comedi/drivers/addi_apci_1564.c
    824 +++ b/drivers/staging/comedi/drivers/addi_apci_1564.c
    825 @@ -340,14 +340,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
    826 unsigned int *data)
    827 {
    828 struct apci1564_private *devpriv = dev->private;
    829 - unsigned int shift, oldmask;
    830 + unsigned int shift, oldmask, himask, lomask;
    831
    832 switch (data[0]) {
    833 case INSN_CONFIG_DIGITAL_TRIG:
    834 if (data[1] != 0)
    835 return -EINVAL;
    836 shift = data[3];
    837 - oldmask = (1U << shift) - 1;
    838 + if (shift < 32) {
    839 + oldmask = (1U << shift) - 1;
    840 + himask = data[4] << shift;
    841 + lomask = data[5] << shift;
    842 + } else {
    843 + oldmask = 0xffffffffu;
    844 + himask = 0;
    845 + lomask = 0;
    846 + }
    847 switch (data[2]) {
    848 case COMEDI_DIGITAL_TRIG_DISABLE:
    849 devpriv->ctrl = 0;
    850 @@ -371,8 +379,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
    851 devpriv->mode2 &= oldmask;
    852 }
    853 /* configure specified channels */
    854 - devpriv->mode1 |= data[4] << shift;
    855 - devpriv->mode2 |= data[5] << shift;
    856 + devpriv->mode1 |= himask;
    857 + devpriv->mode2 |= lomask;
    858 break;
    859 case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
    860 if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
    861 @@ -389,8 +397,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
    862 devpriv->mode2 &= oldmask;
    863 }
    864 /* configure specified channels */
    865 - devpriv->mode1 |= data[4] << shift;
    866 - devpriv->mode2 |= data[5] << shift;
    867 + devpriv->mode1 |= himask;
    868 + devpriv->mode2 |= lomask;
    869 break;
    870 default:
    871 return -EINVAL;
    872 diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
    873 index 84c62e256094..6e411b634015 100644
    874 --- a/drivers/staging/comedi/drivers/ni_6527.c
    875 +++ b/drivers/staging/comedi/drivers/ni_6527.c
    876 @@ -341,7 +341,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev,
    877 case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
    878 /* check shift amount */
    879 shift = data[3];
    880 - if (shift >= s->n_chan) {
    881 + if (shift >= 32) {
    882 mask = 0;
    883 rising = 0;
    884 falling = 0;
    885 diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
    886 index f7149bb23180..5297e7d1c663 100644
    887 --- a/drivers/staging/wlan-ng/prism2usb.c
    888 +++ b/drivers/staging/wlan-ng/prism2usb.c
    889 @@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
    890 const struct usb_device_id *id)
    891 {
    892 struct usb_device *dev;
    893 -
    894 + const struct usb_endpoint_descriptor *epd;
    895 + const struct usb_host_interface *iface_desc = interface->cur_altsetting;
    896 struct wlandevice *wlandev = NULL;
    897 struct hfa384x *hw = NULL;
    898 int result = 0;
    899
    900 + if (iface_desc->desc.bNumEndpoints != 2) {
    901 + result = -ENODEV;
    902 + goto failed;
    903 + }
    904 +
    905 + result = -EINVAL;
    906 + epd = &iface_desc->endpoint[1].desc;
    907 + if (!usb_endpoint_is_bulk_in(epd))
    908 + goto failed;
    909 + epd = &iface_desc->endpoint[2].desc;
    910 + if (!usb_endpoint_is_bulk_out(epd))
    911 + goto failed;
    912 +
    913 dev = interface_to_usbdev(interface);
    914 wlandev = create_wlan();
    915 if (!wlandev) {
    916 diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
    917 index c4e9eba36023..6624cc07ac04 100644
    918 --- a/drivers/tty/serial/8250/8250_core.c
    919 +++ b/drivers/tty/serial/8250/8250_core.c
    920 @@ -529,6 +529,7 @@ static void __init serial8250_isa_init_ports(void)
    921 */
    922 up->mcr_mask = ~ALPHA_KLUDGE_MCR;
    923 up->mcr_force = ALPHA_KLUDGE_MCR;
    924 + serial8250_set_defaults(up);
    925 }
    926
    927 /* chain base port ops to support Remote Supervisor Adapter */
    928 @@ -552,7 +553,6 @@ static void __init serial8250_isa_init_ports(void)
    929 port->membase = old_serial_port[i].iomem_base;
    930 port->iotype = old_serial_port[i].io_type;
    931 port->regshift = old_serial_port[i].iomem_reg_shift;
    932 - serial8250_set_defaults(up);
    933
    934 port->irqflags |= irqflag;
    935 if (serial8250_isa_config != NULL)
    936 diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
    937 index 91db9ca1c6c9..c54f57e4a7dd 100644
    938 --- a/drivers/tty/serial/8250/8250_mtk.c
    939 +++ b/drivers/tty/serial/8250/8250_mtk.c
    940 @@ -45,8 +45,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
    941 unsigned long flags;
    942 unsigned int baud, quot;
    943
    944 + /*
    945 + * Store the requested baud rate before calling the generic 8250
    946 + * set_termios method. Standard 8250 port expects bauds to be
    947 + * no higher than (uartclk / 16) so the baud will be clamped if it
    948 + * gets out of that bound. Mediatek 8250 port supports speed
    949 + * higher than that, therefore we'll get original baud rate back
    950 + * after calling the generic set_termios method and recalculate
    951 + * the speed later in this method.
    952 + */
    953 + baud = tty_termios_baud_rate(termios);
    954 +
    955 serial8250_do_set_termios(port, termios, old);
    956
    957 + tty_termios_encode_baud_rate(termios, baud, baud);
    958 +
    959 /*
    960 * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS)
    961 *
    962 @@ -85,6 +98,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
    963 */
    964 spin_lock_irqsave(&port->lock, flags);
    965
    966 + /*
    967 + * Update the per-port timeout.
    968 + */
    969 + uart_update_timeout(port, termios->c_cflag, baud);
    970 +
    971 /* set DLAB we have cval saved in up->lcr from the call to the core */
    972 serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB);
    973 serial_dl_write(up, quot);
    974 diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    975 index 29fb08c8a2fd..3e5a3614fad0 100644
    976 --- a/drivers/tty/vt/vt.c
    977 +++ b/drivers/tty/vt/vt.c
    978 @@ -765,10 +765,19 @@ static const struct tty_port_operations vc_port_ops = {
    979 .destruct = vc_port_destruct,
    980 };
    981
    982 +/*
    983 + * Change # of rows and columns (0 means unchanged/the size of fg_console)
    984 + * [this is to be used together with some user program
    985 + * like resize that changes the hardware videomode]
    986 + */
    987 +#define VC_MAXCOL (32767)
    988 +#define VC_MAXROW (32767)
    989 +
    990 int vc_allocate(unsigned int currcons) /* return 0 on success */
    991 {
    992 struct vt_notifier_param param;
    993 struct vc_data *vc;
    994 + int err;
    995
    996 WARN_CONSOLE_UNLOCKED();
    997
    998 @@ -798,6 +807,11 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */
    999 if (!*vc->vc_uni_pagedir_loc)
    1000 con_set_default_unimap(vc);
    1001
    1002 + err = -EINVAL;
    1003 + if (vc->vc_cols > VC_MAXCOL || vc->vc_rows > VC_MAXROW ||
    1004 + vc->vc_screenbuf_size > KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size)
    1005 + goto err_free;
    1006 + err = -ENOMEM;
    1007 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);
    1008 if (!vc->vc_screenbuf)
    1009 goto err_free;
    1010 @@ -815,7 +829,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */
    1011 err_free:
    1012 kfree(vc);
    1013 vc_cons[currcons].d = NULL;
    1014 - return -ENOMEM;
    1015 + return err;
    1016 }
    1017
    1018 static inline int resize_screen(struct vc_data *vc, int width, int height,
    1019 @@ -830,14 +844,6 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
    1020 return err;
    1021 }
    1022
    1023 -/*
    1024 - * Change # of rows and columns (0 means unchanged/the size of fg_console)
    1025 - * [this is to be used together with some user program
    1026 - * like resize that changes the hardware videomode]
    1027 - */
    1028 -#define VC_RESIZE_MAXCOL (32767)
    1029 -#define VC_RESIZE_MAXROW (32767)
    1030 -
    1031 /**
    1032 * vc_do_resize - resizing method for the tty
    1033 * @tty: tty being resized
    1034 @@ -872,7 +878,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
    1035 user = vc->vc_resize_user;
    1036 vc->vc_resize_user = 0;
    1037
    1038 - if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
    1039 + if (cols > VC_MAXCOL || lines > VC_MAXROW)
    1040 return -EINVAL;
    1041
    1042 new_cols = (cols ? cols : vc->vc_cols);
    1043 @@ -883,7 +889,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
    1044 if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
    1045 return 0;
    1046
    1047 - if (new_screen_size > (4 << 20))
    1048 + if (new_screen_size > (4 << 20) || !new_screen_size)
    1049 return -EINVAL;
    1050 newscreen = kzalloc(new_screen_size, GFP_USER);
    1051 if (!newscreen)
    1052 @@ -3033,6 +3039,7 @@ static int __init con_init(void)
    1053 INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
    1054 tty_port_init(&vc->port);
    1055 visual_init(vc, currcons, 1);
    1056 + /* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */
    1057 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
    1058 vc_init(vc, vc->vc_rows, vc->vc_cols,
    1059 currcons || !vc->vc_sw->con_save_screen);
    1060 diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
    1061 index 9e246d2e55ca..f2b165182b4b 100644
    1062 --- a/drivers/usb/gadget/udc/gr_udc.c
    1063 +++ b/drivers/usb/gadget/udc/gr_udc.c
    1064 @@ -2000,9 +2000,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
    1065
    1066 if (num == 0) {
    1067 _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
    1068 + if (!_req)
    1069 + return -ENOMEM;
    1070 +
    1071 buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
    1072 - if (!_req || !buf) {
    1073 - /* possible _req freed by gr_probe via gr_remove */
    1074 + if (!buf) {
    1075 + gr_free_request(&ep->ep, _req);
    1076 return -ENOMEM;
    1077 }
    1078
    1079 diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
    1080 index 144674913c78..3929ac8c6a73 100644
    1081 --- a/drivers/usb/host/xhci-mtk-sch.c
    1082 +++ b/drivers/usb/host/xhci-mtk-sch.c
    1083 @@ -284,6 +284,10 @@ static bool need_bw_sch(struct usb_host_endpoint *ep,
    1084 if (is_fs_or_ls(speed) && !has_tt)
    1085 return false;
    1086
    1087 + /* skip endpoint with zero maxpkt */
    1088 + if (usb_endpoint_maxp(&ep->desc) == 0)
    1089 + return false;
    1090 +
    1091 return true;
    1092 }
    1093
    1094 diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    1095 index 4355fbc36fce..bb63cc5cbca0 100644
    1096 --- a/drivers/usb/host/xhci-pci.c
    1097 +++ b/drivers/usb/host/xhci-pci.c
    1098 @@ -213,6 +213,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    1099 if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
    1100 pdev->device == 0x1142)
    1101 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
    1102 + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
    1103 + pdev->device == 0x2142)
    1104 + xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
    1105
    1106 if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
    1107 pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
    1108 diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
    1109 index 2973d256bb44..bb008ac507fe 100644
    1110 --- a/fs/btrfs/backref.c
    1111 +++ b/fs/btrfs/backref.c
    1112 @@ -1550,6 +1550,7 @@ static int __btrfs_find_all_roots(struct btrfs_trans_handle *trans,
    1113 if (ret < 0 && ret != -ENOENT) {
    1114 ulist_free(tmp);
    1115 ulist_free(*roots);
    1116 + *roots = NULL;
    1117 return ret;
    1118 }
    1119 node = ulist_next(tmp, &uiter);
    1120 diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
    1121 index 70aa22a8a9cc..bace03a546b2 100644
    1122 --- a/fs/btrfs/volumes.c
    1123 +++ b/fs/btrfs/volumes.c
    1124 @@ -6854,6 +6854,14 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
    1125 mutex_lock(&uuid_mutex);
    1126 lock_chunks(root);
    1127
    1128 + /*
    1129 + * It is possible for mount and umount to race in such a way that
    1130 + * we execute this code path, but open_fs_devices failed to clear
    1131 + * total_rw_bytes. We certainly want it cleared before reading the
    1132 + * device items, so clear it here.
    1133 + */
    1134 + root->fs_info->fs_devices->total_rw_bytes = 0;
    1135 +
    1136 /*
    1137 * Read all device items, and then all the chunk items. All
    1138 * device items are found before any chunk item (their object id
    1139 diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
    1140 index acd8e0dccab4..5478902a0100 100644
    1141 --- a/fs/cifs/inode.c
    1142 +++ b/fs/cifs/inode.c
    1143 @@ -1770,7 +1770,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
    1144 FILE_UNIX_BASIC_INFO *info_buf_target;
    1145 unsigned int xid;
    1146 int rc, tmprc;
    1147 - bool new_target = d_really_is_negative(target_dentry);
    1148
    1149 if (flags & ~RENAME_NOREPLACE)
    1150 return -EINVAL;
    1151 @@ -1847,13 +1846,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
    1152 */
    1153
    1154 unlink_target:
    1155 - /*
    1156 - * If the target dentry was created during the rename, try
    1157 - * unlinking it if it's not negative
    1158 - */
    1159 - if (new_target &&
    1160 - d_really_is_positive(target_dentry) &&
    1161 - (rc == -EACCES || rc == -EEXIST)) {
    1162 + /* Try unlinking the target dentry if it's not negative */
    1163 + if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
    1164 if (d_is_dir(target_dentry))
    1165 tmprc = cifs_rmdir(target_dir, target_dentry);
    1166 else
    1167 diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
    1168 index 1affdec23729..de135d2591ff 100644
    1169 --- a/fs/nfs/direct.c
    1170 +++ b/fs/nfs/direct.c
    1171 @@ -379,6 +379,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
    1172 {
    1173 struct inode *inode = dreq->inode;
    1174
    1175 + inode_dio_end(inode);
    1176 +
    1177 if (dreq->iocb) {
    1178 long res = (long) dreq->error;
    1179 if (dreq->count != 0) {
    1180 @@ -390,10 +392,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
    1181
    1182 complete(&dreq->completion);
    1183
    1184 - igrab(inode);
    1185 nfs_direct_req_release(dreq);
    1186 - inode_dio_end(inode);
    1187 - iput(inode);
    1188 }
    1189
    1190 static void nfs_direct_readpage_release(struct nfs_page *req)
    1191 @@ -535,10 +534,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
    1192 * generic layer handle the completion.
    1193 */
    1194 if (requested_bytes == 0) {
    1195 - igrab(inode);
    1196 - nfs_direct_req_release(dreq);
    1197 inode_dio_end(inode);
    1198 - iput(inode);
    1199 + nfs_direct_req_release(dreq);
    1200 return result < 0 ? result : -EIO;
    1201 }
    1202
    1203 @@ -956,10 +953,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
    1204 * generic layer handle the completion.
    1205 */
    1206 if (requested_bytes == 0) {
    1207 - igrab(inode);
    1208 - nfs_direct_req_release(dreq);
    1209 inode_dio_end(inode);
    1210 - iput(inode);
    1211 + nfs_direct_req_release(dreq);
    1212 return result < 0 ? result : -EIO;
    1213 }
    1214
    1215 diff --git a/fs/nfs/file.c b/fs/nfs/file.c
    1216 index a89d2f793c1b..1eec947c562d 100644
    1217 --- a/fs/nfs/file.c
    1218 +++ b/fs/nfs/file.c
    1219 @@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp)
    1220 dprintk("NFS: release(%pD2)\n", filp);
    1221
    1222 nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
    1223 - inode_dio_wait(inode);
    1224 nfs_file_clear_open_context(filp);
    1225 return 0;
    1226 }
    1227 diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
    1228 index 9ca8809ee3d0..e390a7882933 100644
    1229 --- a/fs/xfs/libxfs/xfs_bmap.c
    1230 +++ b/fs/xfs/libxfs/xfs_bmap.c
    1231 @@ -781,6 +781,8 @@ try_another_ag:
    1232 *logflagsp = 0;
    1233 if ((error = xfs_alloc_vextent(&args))) {
    1234 xfs_iroot_realloc(ip, -1, whichfork);
    1235 + ASSERT(ifp->if_broot == NULL);
    1236 + XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
    1237 xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
    1238 return error;
    1239 }
    1240 @@ -801,6 +803,8 @@ try_another_ag:
    1241 }
    1242 if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
    1243 xfs_iroot_realloc(ip, -1, whichfork);
    1244 + ASSERT(ifp->if_broot == NULL);
    1245 + XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
    1246 xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
    1247 return -ENOSPC;
    1248 }
    1249 diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
    1250 index 58df02bd93c9..fa46183b163b 100644
    1251 --- a/include/linux/io-mapping.h
    1252 +++ b/include/linux/io-mapping.h
    1253 @@ -120,9 +120,12 @@ io_mapping_init_wc(struct io_mapping *iomap,
    1254 resource_size_t base,
    1255 unsigned long size)
    1256 {
    1257 + iomap->iomem = ioremap_wc(base, size);
    1258 + if (!iomap->iomem)
    1259 + return NULL;
    1260 +
    1261 iomap->base = base;
    1262 iomap->size = size;
    1263 - iomap->iomem = ioremap_wc(base, size);
    1264 #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */
    1265 iomap->prot = pgprot_noncached_wc(PAGE_KERNEL);
    1266 #elif defined(pgprot_writecombine)
    1267 diff --git a/include/linux/tcp.h b/include/linux/tcp.h
    1268 index 7f517458c64f..53eb9fecd263 100644
    1269 --- a/include/linux/tcp.h
    1270 +++ b/include/linux/tcp.h
    1271 @@ -218,6 +218,8 @@ struct tcp_sock {
    1272 u8 reord; /* reordering detected */
    1273 } rack;
    1274 u16 advmss; /* Advertised MSS */
    1275 + u8 tlp_retrans:1, /* TLP is a retransmission */
    1276 + unused_1:7;
    1277 u8 rate_app_limited:1, /* rate_{delivered,interval_us} limited? */
    1278 is_sack_reneg:1, /* in recovery from loss with SACK reneg? */
    1279 unused:6;
    1280 @@ -234,7 +236,7 @@ struct tcp_sock {
    1281 syn_data_acked:1,/* data in SYN is acked by SYN-ACK */
    1282 save_syn:1, /* Save headers of SYN packet */
    1283 is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */
    1284 - u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */
    1285 + u32 tlp_high_seq; /* snd_nxt at the time of TLP */
    1286
    1287 /* RTT measurement */
    1288 u32 srtt_us; /* smoothed round trip time << 3 in usecs */
    1289 diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
    1290 index 1fcaa174ed32..3f1d008a7c28 100644
    1291 --- a/kernel/events/uprobes.c
    1292 +++ b/kernel/events/uprobes.c
    1293 @@ -1885,7 +1885,7 @@ static void handle_swbp(struct pt_regs *regs)
    1294 if (!uprobe) {
    1295 if (is_swbp > 0) {
    1296 /* No matching uprobe; signal SIGTRAP. */
    1297 - send_sig(SIGTRAP, current, 0);
    1298 + force_sig(SIGTRAP, current);
    1299 } else {
    1300 /*
    1301 * Either we raced with uprobe_unregister() or we can't
    1302 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    1303 index 2f7f934bf435..d4232744c59f 100644
    1304 --- a/mm/memcontrol.c
    1305 +++ b/mm/memcontrol.c
    1306 @@ -4794,7 +4794,6 @@ static void __mem_cgroup_clear_mc(void)
    1307 if (!mem_cgroup_is_root(mc.to))
    1308 page_counter_uncharge(&mc.to->memory, mc.moved_swap);
    1309
    1310 - mem_cgroup_id_get_many(mc.to, mc.moved_swap);
    1311 css_put_many(&mc.to->css, mc.moved_swap);
    1312
    1313 mc.moved_swap = 0;
    1314 @@ -4972,7 +4971,8 @@ put: /* get_mctgt_type() gets the page */
    1315 ent = target.ent;
    1316 if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) {
    1317 mc.precharge--;
    1318 - /* we fixup refcnts and charges later. */
    1319 + mem_cgroup_id_get_many(mc.to, 1);
    1320 + /* we fixup other refcnts and charges later. */
    1321 mc.moved_swap++;
    1322 }
    1323 break;
    1324 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    1325 index 02be8ee23271..64fede18aa33 100644
    1326 --- a/net/ax25/af_ax25.c
    1327 +++ b/net/ax25/af_ax25.c
    1328 @@ -1191,7 +1191,10 @@ static int __must_check ax25_connect(struct socket *sock,
    1329 if (addr_len > sizeof(struct sockaddr_ax25) &&
    1330 fsa->fsa_ax25.sax25_ndigis != 0) {
    1331 /* Valid number of digipeaters ? */
    1332 - if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
    1333 + if (fsa->fsa_ax25.sax25_ndigis < 1 ||
    1334 + fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
    1335 + addr_len < sizeof(struct sockaddr_ax25) +
    1336 + sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
    1337 err = -EINVAL;
    1338 goto out_release;
    1339 }
    1340 @@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
    1341 struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
    1342
    1343 /* Valid number of digipeaters ? */
    1344 - if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
    1345 + if (usax->sax25_ndigis < 1 ||
    1346 + usax->sax25_ndigis > AX25_MAX_DIGIS ||
    1347 + addr_len < sizeof(struct sockaddr_ax25) +
    1348 + sizeof(ax25_address) * usax->sax25_ndigis) {
    1349 err = -EINVAL;
    1350 goto out;
    1351 }
    1352 diff --git a/net/core/dev.c b/net/core/dev.c
    1353 index 267b648a0645..dd8d36feb69f 100644
    1354 --- a/net/core/dev.c
    1355 +++ b/net/core/dev.c
    1356 @@ -4392,7 +4392,7 @@ static void flush_backlog(struct work_struct *work)
    1357 skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
    1358 if (skb->dev->reg_state == NETREG_UNREGISTERING) {
    1359 __skb_unlink(skb, &sd->input_pkt_queue);
    1360 - kfree_skb(skb);
    1361 + dev_kfree_skb_irq(skb);
    1362 input_queue_head_incr(sd);
    1363 }
    1364 }
    1365 diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
    1366 index 3333693d8052..3fb5d8ecc849 100644
    1367 --- a/net/core/net-sysfs.c
    1368 +++ b/net/core/net-sysfs.c
    1369 @@ -1018,7 +1018,7 @@ static ssize_t show_trans_timeout(struct netdev_queue *queue,
    1370 trans_timeout = queue->trans_timeout;
    1371 spin_unlock_irq(&queue->_xmit_lock);
    1372
    1373 - return sprintf(buf, "%lu", trans_timeout);
    1374 + return sprintf(buf, fmt_ulong, trans_timeout);
    1375 }
    1376
    1377 #ifdef CONFIG_XPS
    1378 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    1379 index b3953f789891..23246d8a3eae 100644
    1380 --- a/net/ipv4/tcp_input.c
    1381 +++ b/net/ipv4/tcp_input.c
    1382 @@ -3566,10 +3566,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
    1383 }
    1384 }
    1385
    1386 -/* This routine deals with acks during a TLP episode.
    1387 - * We mark the end of a TLP episode on receiving TLP dupack or when
    1388 - * ack is after tlp_high_seq.
    1389 - * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
    1390 +/* This routine deals with acks during a TLP episode and ends an episode by
    1391 + * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
    1392 */
    1393 static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
    1394 {
    1395 @@ -3578,7 +3576,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
    1396 if (before(ack, tp->tlp_high_seq))
    1397 return;
    1398
    1399 - if (flag & FLAG_DSACKING_ACK) {
    1400 + if (!tp->tlp_retrans) {
    1401 + /* TLP of new data has been acknowledged */
    1402 + tp->tlp_high_seq = 0;
    1403 + } else if (flag & FLAG_DSACKING_ACK) {
    1404 /* This DSACK means original and TLP probe arrived; no loss */
    1405 tp->tlp_high_seq = 0;
    1406 } else if (after(ack, tp->tlp_high_seq)) {
    1407 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1408 index 84d74c431f83..b730b994b1c7 100644
    1409 --- a/net/ipv4/tcp_output.c
    1410 +++ b/net/ipv4/tcp_output.c
    1411 @@ -2357,6 +2357,11 @@ void tcp_send_loss_probe(struct sock *sk)
    1412 int pcount;
    1413 int mss = tcp_current_mss(sk);
    1414
    1415 + /* At most one outstanding TLP */
    1416 + if (tp->tlp_high_seq)
    1417 + goto rearm_timer;
    1418 +
    1419 + tp->tlp_retrans = 0;
    1420 skb = tcp_send_head(sk);
    1421 if (skb) {
    1422 if (tcp_snd_wnd_test(tp, skb, mss)) {
    1423 @@ -2379,10 +2384,6 @@ void tcp_send_loss_probe(struct sock *sk)
    1424 return;
    1425 }
    1426
    1427 - /* At most one outstanding TLP retransmission. */
    1428 - if (tp->tlp_high_seq)
    1429 - goto rearm_timer;
    1430 -
    1431 if (skb_still_in_host_queue(sk, skb))
    1432 goto rearm_timer;
    1433
    1434 @@ -2403,10 +2404,12 @@ void tcp_send_loss_probe(struct sock *sk)
    1435 if (__tcp_retransmit_skb(sk, skb, 1))
    1436 goto rearm_timer;
    1437
    1438 + tp->tlp_retrans = 1;
    1439 +
    1440 +probe_sent:
    1441 /* Record snd_nxt for loss detection. */
    1442 tp->tlp_high_seq = tp->snd_nxt;
    1443
    1444 -probe_sent:
    1445 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
    1446 /* Reset s.t. tcp_rearm_rto will restart timer from now */
    1447 inet_csk(sk)->icsk_pending = 0;
    1448 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1449 index 1bb1e27d3d13..18a1a4890c5f 100644
    1450 --- a/net/ipv4/udp.c
    1451 +++ b/net/ipv4/udp.c
    1452 @@ -1554,7 +1554,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
    1453 /*
    1454 * UDP-Lite specific tests, ignored on UDP sockets
    1455 */
    1456 - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    1457 + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    1458
    1459 /*
    1460 * MIB statistics other than incrementing the error count are
    1461 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
    1462 index ca001ecb7197..e0a2a3d6772d 100644
    1463 --- a/net/ipv6/ip6_gre.c
    1464 +++ b/net/ipv6/ip6_gre.c
    1465 @@ -1130,15 +1130,16 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head)
    1466 static int __net_init ip6gre_init_net(struct net *net)
    1467 {
    1468 struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
    1469 + struct net_device *ndev;
    1470 int err;
    1471
    1472 - ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
    1473 - NET_NAME_UNKNOWN,
    1474 - ip6gre_tunnel_setup);
    1475 - if (!ign->fb_tunnel_dev) {
    1476 + ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
    1477 + NET_NAME_UNKNOWN, ip6gre_tunnel_setup);
    1478 + if (!ndev) {
    1479 err = -ENOMEM;
    1480 goto err_alloc_dev;
    1481 }
    1482 + ign->fb_tunnel_dev = ndev;
    1483 dev_net_set(ign->fb_tunnel_dev, net);
    1484 /* FB netdevice is special: we have one, and only one per netns.
    1485 * Allowing to move it to another netns is clearly unsafe.
    1486 @@ -1158,7 +1159,7 @@ static int __net_init ip6gre_init_net(struct net *net)
    1487 return 0;
    1488
    1489 err_reg_dev:
    1490 - ip6gre_dev_free(ign->fb_tunnel_dev);
    1491 + ip6gre_dev_free(ndev);
    1492 err_alloc_dev:
    1493 return err;
    1494 }
    1495 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1496 index 6a397e110b46..1ad84e18c03b 100644
    1497 --- a/net/ipv6/udp.c
    1498 +++ b/net/ipv6/udp.c
    1499 @@ -601,7 +601,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
    1500 /*
    1501 * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
    1502 */
    1503 - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    1504 + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    1505
    1506 if (up->pcrlen == 0) { /* full coverage was set */
    1507 net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n",
    1508 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    1509 index d3334fd84ca2..9be82ed02e0e 100644
    1510 --- a/net/mac80211/rx.c
    1511 +++ b/net/mac80211/rx.c
    1512 @@ -2098,6 +2098,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
    1513
    1514 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
    1515 {
    1516 + struct ieee80211_hdr *hdr = (void *)rx->skb->data;
    1517 struct sk_buff *skb = rx->skb;
    1518 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
    1519
    1520 @@ -2108,6 +2109,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
    1521 if (status->flag & RX_FLAG_DECRYPTED)
    1522 return 0;
    1523
    1524 + /* check mesh EAPOL frames first */
    1525 + if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
    1526 + ieee80211_is_data(fc))) {
    1527 + struct ieee80211s_hdr *mesh_hdr;
    1528 + u16 hdr_len = ieee80211_hdrlen(fc);
    1529 + u16 ethertype_offset;
    1530 + __be16 ethertype;
    1531 +
    1532 + if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
    1533 + goto drop_check;
    1534 +
    1535 + /* make sure fixed part of mesh header is there, also checks skb len */
    1536 + if (!pskb_may_pull(rx->skb, hdr_len + 6))
    1537 + goto drop_check;
    1538 +
    1539 + mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
    1540 + ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
    1541 + sizeof(rfc1042_header);
    1542 +
    1543 + if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
    1544 + ethertype == rx->sdata->control_port_protocol)
    1545 + return 0;
    1546 + }
    1547 +
    1548 +drop_check:
    1549 /* Drop unencrypted frames if key is set. */
    1550 if (unlikely(!ieee80211_has_protected(fc) &&
    1551 !ieee80211_is_any_nullfunc(fc) &&
    1552 diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
    1553 index 72de69175476..702ebcfa18dc 100644
    1554 --- a/net/rxrpc/recvmsg.c
    1555 +++ b/net/rxrpc/recvmsg.c
    1556 @@ -439,7 +439,7 @@ try_again:
    1557 list_empty(&rx->recvmsg_q) &&
    1558 rx->sk.sk_state != RXRPC_SERVER_LISTENING) {
    1559 release_sock(&rx->sk);
    1560 - return -ENODATA;
    1561 + return -EAGAIN;
    1562 }
    1563
    1564 if (list_empty(&rx->recvmsg_q)) {
    1565 diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
    1566 index 1de27c39564b..2ec1c29eeba4 100644
    1567 --- a/net/rxrpc/sendmsg.c
    1568 +++ b/net/rxrpc/sendmsg.c
    1569 @@ -191,7 +191,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
    1570 /* this should be in poll */
    1571 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
    1572
    1573 - if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
    1574 + if (sk->sk_shutdown & SEND_SHUTDOWN)
    1575 return -EPIPE;
    1576
    1577 more = msg->msg_flags & MSG_MORE;
    1578 diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
    1579 index 98cf6343afcd..61564e56e3aa 100755
    1580 --- a/scripts/decode_stacktrace.sh
    1581 +++ b/scripts/decode_stacktrace.sh
    1582 @@ -76,8 +76,8 @@ parse_symbol() {
    1583 return
    1584 fi
    1585
    1586 - # Strip out the base of the path
    1587 - code=${code#$basepath/}
    1588 + # Strip out the base of the path on each line
    1589 + code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
    1590
    1591 # In the case of inlines, move everything to same line
    1592 code=${code//$'\n'/' '}
    1593 diff --git a/sound/core/info.c b/sound/core/info.c
    1594 index 358a6947342d..8a6fa8fd0aab 100644
    1595 --- a/sound/core/info.c
    1596 +++ b/sound/core/info.c
    1597 @@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
    1598 {
    1599 int c = -1;
    1600
    1601 - if (snd_BUG_ON(!buffer || !buffer->buffer))
    1602 + if (snd_BUG_ON(!buffer))
    1603 + return 1;
    1604 + if (!buffer->buffer)
    1605 return 1;
    1606 if (len <= 0 || buffer->stop || buffer->error)
    1607 return 1;
    1608 diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h
    1609 index 3f1b0f1df809..e4e31e82311d 100644
    1610 --- a/sound/soc/codecs/rt5670.h
    1611 +++ b/sound/soc/codecs/rt5670.h
    1612 @@ -760,7 +760,7 @@
    1613 #define RT5670_PWR_VREF2_BIT 4
    1614 #define RT5670_PWR_FV2 (0x1 << 3)
    1615 #define RT5670_PWR_FV2_BIT 3
    1616 -#define RT5670_LDO_SEL_MASK (0x3)
    1617 +#define RT5670_LDO_SEL_MASK (0x7)
    1618 #define RT5670_LDO_SEL_SFT 0
    1619
    1620 /* Power Management for Analog 2 (0x64) */
    1621 diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
    1622 index 7228d141a789..676568286eef 100644
    1623 --- a/tools/perf/builtin-script.c
    1624 +++ b/tools/perf/builtin-script.c
    1625 @@ -1516,7 +1516,7 @@ static int is_directory(const char *base_path, const struct dirent *dent)
    1626 char path[PATH_MAX];
    1627 struct stat st;
    1628
    1629 - sprintf(path, "%s/%s", base_path, dent->d_name);
    1630 + scnprintf(path, PATH_MAX, "%s/%s", base_path, dent->d_name);
    1631 if (stat(path, &st))
    1632 return 0;
    1633
    1634 @@ -1702,8 +1702,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
    1635 }
    1636
    1637 for_each_lang(scripts_path, scripts_dir, lang_dirent) {
    1638 - snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
    1639 - lang_dirent->d_name);
    1640 + scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
    1641 + lang_dirent->d_name);
    1642 lang_dir = opendir(lang_path);
    1643 if (!lang_dir)
    1644 continue;
    1645 @@ -1712,8 +1712,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
    1646 script_root = get_script_root(script_dirent, REPORT_SUFFIX);
    1647 if (script_root) {
    1648 desc = script_desc__findnew(script_root);
    1649 - snprintf(script_path, MAXPATHLEN, "%s/%s",
    1650 - lang_path, script_dirent->d_name);
    1651 + scnprintf(script_path, MAXPATHLEN, "%s/%s",
    1652 + lang_path, script_dirent->d_name);
    1653 read_script_info(desc, script_path);
    1654 free(script_root);
    1655 }
    1656 @@ -1749,7 +1749,7 @@ static int check_ev_match(char *dir_name, char *scriptname,
    1657 int match, len;
    1658 FILE *fp;
    1659
    1660 - sprintf(filename, "%s/bin/%s-record", dir_name, scriptname);
    1661 + scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, scriptname);
    1662
    1663 fp = fopen(filename, "r");
    1664 if (!fp)
    1665 @@ -1825,8 +1825,8 @@ int find_scripts(char **scripts_array, char **scripts_path_array)
    1666 }
    1667
    1668 for_each_lang(scripts_path, scripts_dir, lang_dirent) {
    1669 - snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
    1670 - lang_dirent->d_name);
    1671 + scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
    1672 + lang_dirent->d_name);
    1673 #ifdef NO_LIBPERL
    1674 if (strstr(lang_path, "perl"))
    1675 continue;
    1676 @@ -1881,8 +1881,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
    1677 return NULL;
    1678
    1679 for_each_lang(scripts_path, scripts_dir, lang_dirent) {
    1680 - snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
    1681 - lang_dirent->d_name);
    1682 + scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
    1683 + lang_dirent->d_name);
    1684 lang_dir = opendir(lang_path);
    1685 if (!lang_dir)
    1686 continue;
    1687 @@ -1893,8 +1893,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
    1688 free(__script_root);
    1689 closedir(lang_dir);
    1690 closedir(scripts_dir);
    1691 - snprintf(script_path, MAXPATHLEN, "%s/%s",
    1692 - lang_path, script_dirent->d_name);
    1693 + scnprintf(script_path, MAXPATHLEN, "%s/%s",
    1694 + lang_path, script_dirent->d_name);
    1695 return strdup(script_path);
    1696 }
    1697 free(__script_root);
    1698 diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c
    1699 index b60a6fd66517..a607d2a851ef 100644
    1700 --- a/tools/perf/tests/attr.c
    1701 +++ b/tools/perf/tests/attr.c
    1702 @@ -147,8 +147,8 @@ static int run_dir(const char *d, const char *perf)
    1703 if (verbose)
    1704 vcnt++;
    1705
    1706 - snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
    1707 - d, d, perf, vcnt, v);
    1708 + scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
    1709 + d, d, perf, vcnt, v);
    1710
    1711 return system(cmd) ? TEST_FAIL : TEST_OK;
    1712 }
    1713 diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
    1714 index 1e2ba2602930..1802ad3f45b6 100644
    1715 --- a/tools/perf/tests/pmu.c
    1716 +++ b/tools/perf/tests/pmu.c
    1717 @@ -95,7 +95,7 @@ static char *test_format_dir_get(void)
    1718 struct test_format *format = &test_formats[i];
    1719 FILE *file;
    1720
    1721 - snprintf(name, PATH_MAX, "%s/%s", dir, format->name);
    1722 + scnprintf(name, PATH_MAX, "%s/%s", dir, format->name);
    1723
    1724 file = fopen(name, "w");
    1725 if (!file)
    1726 diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
    1727 index 3336cbc6ec48..1d4807c46efd 100644
    1728 --- a/tools/perf/util/annotate.c
    1729 +++ b/tools/perf/util/annotate.c
    1730 @@ -1302,7 +1302,7 @@ fallback:
    1731 int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
    1732 {
    1733 struct dso *dso = map->dso;
    1734 - char command[PATH_MAX * 2];
    1735 + char *command;
    1736 FILE *file;
    1737 char symfs_filename[PATH_MAX];
    1738 struct kcore_extract kce;
    1739 @@ -1364,7 +1364,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
    1740 strcpy(symfs_filename, tmp);
    1741 }
    1742
    1743 - snprintf(command, sizeof(command),
    1744 + err = asprintf(&command,
    1745 "%s %s%s --start-address=0x%016" PRIx64
    1746 " --stop-address=0x%016" PRIx64
    1747 " -l -d %s %s -C %s 2>/dev/null|grep -v %s|expand",
    1748 @@ -1377,12 +1377,17 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
    1749 symbol_conf.annotate_src ? "-S" : "",
    1750 symfs_filename, symfs_filename);
    1751
    1752 + if (err < 0) {
    1753 + pr_err("Failure allocating memory for the command to run\n");
    1754 + goto out_remove_tmp;
    1755 + }
    1756 +
    1757 pr_debug("Executing: %s\n", command);
    1758
    1759 err = -1;
    1760 if (pipe(stdout_fd) < 0) {
    1761 pr_err("Failure creating the pipe to run %s\n", command);
    1762 - goto out_remove_tmp;
    1763 + goto out_free_command;
    1764 }
    1765
    1766 pid = fork();
    1767 @@ -1409,7 +1414,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
    1768 * If we were using debug info should retry with
    1769 * original binary.
    1770 */
    1771 - goto out_remove_tmp;
    1772 + goto out_free_command;
    1773 }
    1774
    1775 nline = 0;
    1776 @@ -1432,6 +1437,8 @@ int symbol__disassemble(struct symbol *sym, struct map *map, size_t privsize)
    1777
    1778 fclose(file);
    1779 err = 0;
    1780 +out_free_command:
    1781 + free(command);
    1782 out_remove_tmp:
    1783 close(stdout_fd[0]);
    1784
    1785 @@ -1445,7 +1452,7 @@ out:
    1786
    1787 out_close_stdout:
    1788 close(stdout_fd[1]);
    1789 - goto out_remove_tmp;
    1790 + goto out_free_command;
    1791 }
    1792
    1793 static void insert_source_line(struct rb_root *root, struct source_line *src_line)
    1794 diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
    1795 index 8fdee24725a7..5bc2b92ace6d 100644
    1796 --- a/tools/perf/util/cgroup.c
    1797 +++ b/tools/perf/util/cgroup.c
    1798 @@ -64,7 +64,7 @@ static int open_cgroup(char *name)
    1799 if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1))
    1800 return -1;
    1801
    1802 - snprintf(path, PATH_MAX, "%s/%s", mnt, name);
    1803 + scnprintf(path, PATH_MAX, "%s/%s", mnt, name);
    1804
    1805 fd = open(path, O_RDONLY);
    1806 if (fd == -1)
    1807 diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
    1808 index 6193be6d7639..f9f7e35f47a7 100644
    1809 --- a/tools/perf/util/parse-events.c
    1810 +++ b/tools/perf/util/parse-events.c
    1811 @@ -195,8 +195,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
    1812
    1813 for_each_event(sys_dirent, evt_dir, evt_dirent) {
    1814
    1815 - snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
    1816 - evt_dirent->d_name);
    1817 + scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
    1818 + evt_dirent->d_name);
    1819 fd = open(evt_path, O_RDONLY);
    1820 if (fd < 0)
    1821 continue;
    1822 diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
    1823 index c86c1d5ea65c..39abbf827646 100644
    1824 --- a/tools/perf/util/pmu.c
    1825 +++ b/tools/perf/util/pmu.c
    1826 @@ -325,7 +325,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
    1827 if (pmu_alias_info_file(name))
    1828 continue;
    1829
    1830 - snprintf(path, PATH_MAX, "%s/%s", dir, name);
    1831 + scnprintf(path, PATH_MAX, "%s/%s", dir, name);
    1832
    1833 file = fopen(path, "r");
    1834 if (!file) {
    1835 diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
    1836 index a7452fd3b6ee..0551a02ee17c 100644
    1837 --- a/tools/perf/util/probe-event.c
    1838 +++ b/tools/perf/util/probe-event.c
    1839 @@ -118,7 +118,7 @@ static struct symbol *__find_kernel_function(u64 addr, struct map **mapp)
    1840 return machine__find_kernel_function(host_machine, addr, mapp);
    1841 }
    1842
    1843 -static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
    1844 +static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap)
    1845 {
    1846 /* kmap->ref_reloc_sym should be set if host_machine is initialized */
    1847 struct kmap *kmap;
    1848 @@ -130,6 +130,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
    1849 kmap = map__kmap(map);
    1850 if (!kmap)
    1851 return NULL;
    1852 +
    1853 + if (pmap)
    1854 + *pmap = map;
    1855 +
    1856 return kmap->ref_reloc_sym;
    1857 }
    1858
    1859 @@ -141,7 +145,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr,
    1860 struct map *map;
    1861
    1862 /* ref_reloc_sym is just a label. Need a special fix*/
    1863 - reloc_sym = kernel_get_ref_reloc_sym();
    1864 + reloc_sym = kernel_get_ref_reloc_sym(NULL);
    1865 if (reloc_sym && strcmp(name, reloc_sym->name) == 0)
    1866 *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr;
    1867 else {
    1868 @@ -742,6 +746,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
    1869 int ntevs)
    1870 {
    1871 struct ref_reloc_sym *reloc_sym;
    1872 + struct map *map;
    1873 char *tmp;
    1874 int i, skipped = 0;
    1875
    1876 @@ -750,7 +755,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
    1877 return post_process_offline_probe_trace_events(tevs, ntevs,
    1878 symbol_conf.vmlinux_name);
    1879
    1880 - reloc_sym = kernel_get_ref_reloc_sym();
    1881 + reloc_sym = kernel_get_ref_reloc_sym(&map);
    1882 if (!reloc_sym) {
    1883 pr_warning("Relocated base symbol is not found!\n");
    1884 return -EINVAL;
    1885 @@ -759,9 +764,13 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
    1886 for (i = 0; i < ntevs; i++) {
    1887 if (!tevs[i].point.address || tevs[i].point.retprobe)
    1888 continue;
    1889 - /* If we found a wrong one, mark it by NULL symbol */
    1890 + /*
    1891 + * If we found a wrong one, mark it by NULL symbol.
    1892 + * Since addresses in debuginfo is same as objdump, we need
    1893 + * to convert it to addresses on memory.
    1894 + */
    1895 if (kprobe_warn_out_range(tevs[i].point.symbol,
    1896 - tevs[i].point.address)) {
    1897 + map__objdump_2mem(map, tevs[i].point.address))) {
    1898 tmp = NULL;
    1899 skipped++;
    1900 } else {
    1901 @@ -2850,7 +2859,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
    1902
    1903 /* Note that the symbols in the kmodule are not relocated */
    1904 if (!pev->uprobes && !pp->retprobe && !pev->target) {
    1905 - reloc_sym = kernel_get_ref_reloc_sym();
    1906 + reloc_sym = kernel_get_ref_reloc_sym(NULL);
    1907 if (!reloc_sym) {
    1908 pr_warning("Relocated base symbol is not found!\n");
    1909 ret = -EINVAL;
    1910 diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
    1911 index b4db3f48e3b0..2853d4728ab9 100644
    1912 --- a/tools/perf/util/srcline.c
    1913 +++ b/tools/perf/util/srcline.c
    1914 @@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data)
    1915 bfd_vma pc, vma;
    1916 bfd_size_type size;
    1917 struct a2l_data *a2l = data;
    1918 + flagword flags;
    1919
    1920 if (a2l->found)
    1921 return;
    1922
    1923 - if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0)
    1924 +#ifdef bfd_get_section_flags
    1925 + flags = bfd_get_section_flags(abfd, section);
    1926 +#else
    1927 + flags = bfd_section_flags(section);
    1928 +#endif
    1929 + if ((flags & SEC_ALLOC) == 0)
    1930 return;
    1931
    1932 pc = a2l->addr;
    1933 +#ifdef bfd_get_section_vma
    1934 vma = bfd_get_section_vma(abfd, section);
    1935 +#else
    1936 + vma = bfd_section_vma(section);
    1937 +#endif
    1938 +#ifdef bfd_get_section_size
    1939 size = bfd_get_section_size(section);
    1940 +#else
    1941 + size = bfd_section_size(section);
    1942 +#endif
    1943
    1944 if (pc < vma || pc >= vma + size)
    1945 return;