Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0250-5.4.151-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0250-5.4.151-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (19 months ago) by niro
    File size: 59454 byte(s) 
    -sync kernel patches
    1 diff --git a/Makefile b/Makefile
    2 index c6b3a3d62f6ca..4eeb72027815b 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 150
    10 +SUBLEVEL = 151
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
    15 index 9cb3266e148dc..70758f99c9e47 100644
    16 --- a/arch/x86/events/intel/core.c
    17 +++ b/arch/x86/events/intel/core.c
    18 @@ -259,6 +259,7 @@ static struct event_constraint intel_icl_event_constraints[] = {
    19 INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),
    20 INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),
    21 INTEL_EVENT_CONSTRAINT_RANGE(0xd0, 0xe6, 0xf),
    22 + INTEL_EVENT_CONSTRAINT(0xef, 0xf),
    23 INTEL_EVENT_CONSTRAINT_RANGE(0xf0, 0xf4, 0xf),
    24 EVENT_CONSTRAINT_END
    25 };
    26 diff --git a/arch/x86/include/asm/kvmclock.h b/arch/x86/include/asm/kvmclock.h
    27 index eceea92990974..6c57651921028 100644
    28 --- a/arch/x86/include/asm/kvmclock.h
    29 +++ b/arch/x86/include/asm/kvmclock.h
    30 @@ -2,6 +2,20 @@
    31 #ifndef _ASM_X86_KVM_CLOCK_H
    32 #define _ASM_X86_KVM_CLOCK_H
    33
    34 +#include <linux/percpu.h>
    35 +
    36 extern struct clocksource kvm_clock;
    37
    38 +DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
    39 +
    40 +static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
    41 +{
    42 + return &this_cpu_read(hv_clock_per_cpu)->pvti;
    43 +}
    44 +
    45 +static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
    46 +{
    47 + return this_cpu_read(hv_clock_per_cpu);
    48 +}
    49 +
    50 #endif /* _ASM_X86_KVM_CLOCK_H */
    51 diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
    52 index 4a0802af2e3e0..d81e34e614e00 100644
    53 --- a/arch/x86/kernel/kvmclock.c
    54 +++ b/arch/x86/kernel/kvmclock.c
    55 @@ -50,18 +50,9 @@ early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall);
    56 static struct pvclock_vsyscall_time_info
    57 hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE);
    58 static struct pvclock_wall_clock wall_clock __bss_decrypted;
    59 -static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
    60 static struct pvclock_vsyscall_time_info *hvclock_mem;
    61 -
    62 -static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
    63 -{
    64 - return &this_cpu_read(hv_clock_per_cpu)->pvti;
    65 -}
    66 -
    67 -static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
    68 -{
    69 - return this_cpu_read(hv_clock_per_cpu);
    70 -}
    71 +DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
    72 +EXPORT_PER_CPU_SYMBOL_GPL(hv_clock_per_cpu);
    73
    74 /*
    75 * The wallclock is the time of day when we booted. Since then, some time may
    76 diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
    77 index 8dee243e639f0..73bffd7af15c1 100644
    78 --- a/block/bfq-iosched.c
    79 +++ b/block/bfq-iosched.c
    80 @@ -2523,15 +2523,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
    81 * are likely to increase the throughput.
    82 */
    83 bfqq->new_bfqq = new_bfqq;
    84 - /*
    85 - * The above assignment schedules the following redirections:
    86 - * each time some I/O for bfqq arrives, the process that
    87 - * generated that I/O is disassociated from bfqq and
    88 - * associated with new_bfqq. Here we increases new_bfqq->ref
    89 - * in advance, adding the number of processes that are
    90 - * expected to be associated with new_bfqq as they happen to
    91 - * issue I/O.
    92 - */
    93 new_bfqq->ref += process_refs;
    94 return new_bfqq;
    95 }
    96 @@ -2591,10 +2582,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
    97 {
    98 struct bfq_queue *in_service_bfqq, *new_bfqq;
    99
    100 - /* if a merge has already been setup, then proceed with that first */
    101 - if (bfqq->new_bfqq)
    102 - return bfqq->new_bfqq;
    103 -
    104 /*
    105 * Do not perform queue merging if the device is non
    106 * rotational and performs internal queueing. In fact, such a
    107 @@ -2649,6 +2636,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
    108 if (bfq_too_late_for_merging(bfqq))
    109 return NULL;
    110
    111 + if (bfqq->new_bfqq)
    112 + return bfqq->new_bfqq;
    113 +
    114 if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
    115 return NULL;
    116
    117 diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
    118 index 66b05a326910e..a6f365b9cc1ad 100644
    119 --- a/drivers/cpufreq/cpufreq_governor_attr_set.c
    120 +++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
    121 @@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
    122 if (count)
    123 return count;
    124
    125 - kobject_put(&attr_set->kobj);
    126 mutex_destroy(&attr_set->update_lock);
    127 + kobject_put(&attr_set->kobj);
    128 return 0;
    129 }
    130 EXPORT_SYMBOL_GPL(gov_attr_set_put);
    131 diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
    132 index 7234b95241e91..e826c4b6b3afd 100644
    133 --- a/drivers/crypto/ccp/ccp-ops.c
    134 +++ b/drivers/crypto/ccp/ccp-ops.c
    135 @@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
    136 in_place ? DMA_BIDIRECTIONAL
    137 : DMA_TO_DEVICE);
    138 if (ret)
    139 - goto e_ctx;
    140 + goto e_aad;
    141
    142 if (in_place) {
    143 dst = src;
    144 @@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
    145 op.u.aes.size = 0;
    146 ret = cmd_q->ccp->vdata->perform->aes(&op);
    147 if (ret)
    148 - goto e_dst;
    149 + goto e_final_wa;
    150
    151 if (aes->action == CCP_AES_ACTION_ENCRYPT) {
    152 /* Put the ciphered tag after the ciphertext. */
    153 @@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
    154 ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
    155 DMA_BIDIRECTIONAL);
    156 if (ret)
    157 - goto e_tag;
    158 + goto e_final_wa;
    159 ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
    160 - if (ret)
    161 - goto e_tag;
    162 + if (ret) {
    163 + ccp_dm_free(&tag);
    164 + goto e_final_wa;
    165 + }
    166
    167 ret = crypto_memneq(tag.address, final_wa.address,
    168 authsize) ? -EBADMSG : 0;
    169 ccp_dm_free(&tag);
    170 }
    171
    172 -e_tag:
    173 +e_final_wa:
    174 ccp_dm_free(&final_wa);
    175
    176 e_dst:
    177 diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    178 index 0dc60fe22aefc..8e4d863c7570b 100644
    179 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    180 +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
    181 @@ -664,6 +664,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
    182
    183 init_data.asic_id.pci_revision_id = adev->rev_id;
    184 init_data.asic_id.hw_internal_rev = adev->external_rev_id;
    185 + init_data.asic_id.chip_id = adev->pdev->device;
    186
    187 init_data.asic_id.vram_width = adev->gmc.vram_width;
    188 /* TODO: initialize init_data.asic_id.vram_type here!!!! */
    189 diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c
    190 index 0790fbd3fc9a2..467d789f9bc2d 100644
    191 --- a/drivers/hid/hid-betopff.c
    192 +++ b/drivers/hid/hid-betopff.c
    193 @@ -56,15 +56,22 @@ static int betopff_init(struct hid_device *hid)
    194 {
    195 struct betopff_device *betopff;
    196 struct hid_report *report;
    197 - struct hid_input *hidinput =
    198 - list_first_entry(&hid->inputs, struct hid_input, list);
    199 + struct hid_input *hidinput;
    200 struct list_head *report_list =
    201 &hid->report_enum[HID_OUTPUT_REPORT].report_list;
    202 - struct input_dev *dev = hidinput->input;
    203 + struct input_dev *dev;
    204 int field_count = 0;
    205 int error;
    206 int i, j;
    207
    208 + if (list_empty(&hid->inputs)) {
    209 + hid_err(hid, "no inputs found\n");
    210 + return -ENODEV;
    211 + }
    212 +
    213 + hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
    214 + dev = hidinput->input;
    215 +
    216 if (list_empty(report_list)) {
    217 hid_err(hid, "no output reports found\n");
    218 return -ENODEV;
    219 diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
    220 index 95e0807878c7e..d70cd3d7f583b 100644
    221 --- a/drivers/hid/hid-u2fzero.c
    222 +++ b/drivers/hid/hid-u2fzero.c
    223 @@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
    224 }
    225
    226 ret = u2fzero_recv(dev, &req, &resp);
    227 - if (ret < 0)
    228 +
    229 + /* ignore errors or packets without data */
    230 + if (ret < offsetof(struct u2f_hid_msg, init.data))
    231 return 0;
    232
    233 /* only take the minimum amount of data it is safe to take */
    234 diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
    235 index 1cfbbaf6901da..8537fcdb456df 100644
    236 --- a/drivers/hid/usbhid/hid-core.c
    237 +++ b/drivers/hid/usbhid/hid-core.c
    238 @@ -503,7 +503,7 @@ static void hid_ctrl(struct urb *urb)
    239
    240 if (unplug) {
    241 usbhid->ctrltail = usbhid->ctrlhead;
    242 - } else {
    243 + } else if (usbhid->ctrlhead != usbhid->ctrltail) {
    244 usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
    245
    246 if (usbhid->ctrlhead != usbhid->ctrltail &&
    247 @@ -1221,9 +1221,20 @@ static void usbhid_stop(struct hid_device *hid)
    248 mutex_lock(&usbhid->mutex);
    249
    250 clear_bit(HID_STARTED, &usbhid->iofl);
    251 +
    252 spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */
    253 set_bit(HID_DISCONNECTED, &usbhid->iofl);
    254 + while (usbhid->ctrltail != usbhid->ctrlhead) {
    255 + if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
    256 + kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);
    257 + usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
    258 + }
    259 +
    260 + usbhid->ctrltail = (usbhid->ctrltail + 1) &
    261 + (HID_CONTROL_FIFO_SIZE - 1);
    262 + }
    263 spin_unlock_irq(&usbhid->lock);
    264 +
    265 usb_kill_urb(usbhid->urbin);
    266 usb_kill_urb(usbhid->urbout);
    267 usb_kill_urb(usbhid->urbctrl);
    268 diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
    269 index ed8d59d4eecb3..bd8f5a3aaad9c 100644
    270 --- a/drivers/hwmon/mlxreg-fan.c
    271 +++ b/drivers/hwmon/mlxreg-fan.c
    272 @@ -291,8 +291,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
    273 {
    274 struct mlxreg_fan *fan = cdev->devdata;
    275 unsigned long cur_state;
    276 + int i, config = 0;
    277 u32 regval;
    278 - int i;
    279 int err;
    280
    281 /*
    282 @@ -305,6 +305,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
    283 * overwritten.
    284 */
    285 if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) {
    286 + /*
    287 + * This is configuration change, which is only supported through sysfs.
    288 + * For configuration non-zero value is to be returned to avoid thermal
    289 + * statistics update.
    290 + */
    291 + config = 1;
    292 state -= MLXREG_FAN_MAX_STATE;
    293 for (i = 0; i < state; i++)
    294 fan->cooling_levels[i] = state;
    295 @@ -319,7 +325,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
    296
    297 cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval);
    298 if (state < cur_state)
    299 - return 0;
    300 + return config;
    301
    302 state = cur_state;
    303 }
    304 @@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
    305 dev_err(fan->dev, "Failed to write PWM duty\n");
    306 return err;
    307 }
    308 - return 0;
    309 + return config;
    310 }
    311
    312 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
    313 diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
    314 index a94e35cff3e5f..876ccf77a825a 100644
    315 --- a/drivers/hwmon/tmp421.c
    316 +++ b/drivers/hwmon/tmp421.c
    317 @@ -100,23 +100,17 @@ struct tmp421_data {
    318 s16 temp[4];
    319 };
    320
    321 -static int temp_from_s16(s16 reg)
    322 +static int temp_from_raw(u16 reg, bool extended)
    323 {
    324 /* Mask out status bits */
    325 int temp = reg & ~0xf;
    326
    327 - return (temp * 1000 + 128) / 256;
    328 -}
    329 -
    330 -static int temp_from_u16(u16 reg)
    331 -{
    332 - /* Mask out status bits */
    333 - int temp = reg & ~0xf;
    334 -
    335 - /* Add offset for extended temperature range. */
    336 - temp -= 64 * 256;
    337 + if (extended)
    338 + temp = temp - 64 * 256;
    339 + else
    340 + temp = (s16)temp;
    341
    342 - return (temp * 1000 + 128) / 256;
    343 + return DIV_ROUND_CLOSEST(temp * 1000, 256);
    344 }
    345
    346 static struct tmp421_data *tmp421_update_device(struct device *dev)
    347 @@ -153,17 +147,15 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
    348
    349 switch (attr) {
    350 case hwmon_temp_input:
    351 - if (tmp421->config & TMP421_CONFIG_RANGE)
    352 - *val = temp_from_u16(tmp421->temp[channel]);
    353 - else
    354 - *val = temp_from_s16(tmp421->temp[channel]);
    355 + *val = temp_from_raw(tmp421->temp[channel],
    356 + tmp421->config & TMP421_CONFIG_RANGE);
    357 return 0;
    358 case hwmon_temp_fault:
    359 /*
    360 - * The OPEN bit signals a fault. This is bit 0 of the temperature
    361 - * register (low byte).
    362 + * Any of OPEN or /PVLD bits indicate a hardware mulfunction
    363 + * and the conversion result may be incorrect
    364 */
    365 - *val = tmp421->temp[channel] & 0x01;
    366 + *val = !!(tmp421->temp[channel] & 0x03);
    367 return 0;
    368 default:
    369 return -EOPNOTSUPP;
    370 @@ -176,9 +168,6 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type,
    371 {
    372 switch (attr) {
    373 case hwmon_temp_fault:
    374 - if (channel == 0)
    375 - return 0;
    376 - return 0444;
    377 case hwmon_temp_input:
    378 return 0444;
    379 default:
    380 diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
    381 index aad8d4da5802b..b586e917e6ede 100644
    382 --- a/drivers/hwmon/w83791d.c
    383 +++ b/drivers/hwmon/w83791d.c
    384 @@ -273,9 +273,6 @@ struct w83791d_data {
    385 char valid; /* !=0 if following fields are valid */
    386 unsigned long last_updated; /* In jiffies */
    387
    388 - /* array of 2 pointers to subclients */
    389 - struct i2c_client *lm75[2];
    390 -
    391 /* volts */
    392 u8 in[NUMBER_OF_VIN]; /* Register value */
    393 u8 in_max[NUMBER_OF_VIN]; /* Register value */
    394 @@ -1258,7 +1255,6 @@ static const struct attribute_group w83791d_group_fanpwm45 = {
    395 static int w83791d_detect_subclients(struct i2c_client *client)
    396 {
    397 struct i2c_adapter *adapter = client->adapter;
    398 - struct w83791d_data *data = i2c_get_clientdata(client);
    399 int address = client->addr;
    400 int i, id;
    401 u8 val;
    402 @@ -1281,22 +1277,19 @@ static int w83791d_detect_subclients(struct i2c_client *client)
    403 }
    404
    405 val = w83791d_read(client, W83791D_REG_I2C_SUBADDR);
    406 - if (!(val & 0x08))
    407 - data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
    408 - 0x48 + (val & 0x7));
    409 - if (!(val & 0x80)) {
    410 - if (!IS_ERR(data->lm75[0]) &&
    411 - ((val & 0x7) == ((val >> 4) & 0x7))) {
    412 - dev_err(&client->dev,
    413 - "duplicate addresses 0x%x, "
    414 - "use force_subclient\n",
    415 - data->lm75[0]->addr);
    416 - return -ENODEV;
    417 - }
    418 - data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
    419 - 0x48 + ((val >> 4) & 0x7));
    420 +
    421 + if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
    422 + dev_err(&client->dev,
    423 + "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
    424 + return -ENODEV;
    425 }
    426
    427 + if (!(val & 0x08))
    428 + devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (val & 0x7));
    429 +
    430 + if (!(val & 0x80))
    431 + devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
    432 +
    433 return 0;
    434 }
    435
    436 diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
    437 index 7fc8a1160c8f9..f91db4be2fc79 100644
    438 --- a/drivers/hwmon/w83792d.c
    439 +++ b/drivers/hwmon/w83792d.c
    440 @@ -264,9 +264,6 @@ struct w83792d_data {
    441 char valid; /* !=0 if following fields are valid */
    442 unsigned long last_updated; /* In jiffies */
    443
    444 - /* array of 2 pointers to subclients */
    445 - struct i2c_client *lm75[2];
    446 -
    447 u8 in[9]; /* Register value */
    448 u8 in_max[9]; /* Register value */
    449 u8 in_min[9]; /* Register value */
    450 @@ -928,7 +925,6 @@ w83792d_detect_subclients(struct i2c_client *new_client)
    451 int address = new_client->addr;
    452 u8 val;
    453 struct i2c_adapter *adapter = new_client->adapter;
    454 - struct w83792d_data *data = i2c_get_clientdata(new_client);
    455
    456 id = i2c_adapter_id(adapter);
    457 if (force_subclients[0] == id && force_subclients[1] == address) {
    458 @@ -947,21 +943,19 @@ w83792d_detect_subclients(struct i2c_client *new_client)
    459 }
    460
    461 val = w83792d_read_value(new_client, W83792D_REG_I2C_SUBADDR);
    462 - if (!(val & 0x08))
    463 - data->lm75[0] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
    464 - 0x48 + (val & 0x7));
    465 - if (!(val & 0x80)) {
    466 - if (!IS_ERR(data->lm75[0]) &&
    467 - ((val & 0x7) == ((val >> 4) & 0x7))) {
    468 - dev_err(&new_client->dev,
    469 - "duplicate addresses 0x%x, use force_subclient\n",
    470 - data->lm75[0]->addr);
    471 - return -ENODEV;
    472 - }
    473 - data->lm75[1] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
    474 - 0x48 + ((val >> 4) & 0x7));
    475 +
    476 + if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
    477 + dev_err(&new_client->dev,
    478 + "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
    479 + return -ENODEV;
    480 }
    481
    482 + if (!(val & 0x08))
    483 + devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + (val & 0x7));
    484 +
    485 + if (!(val & 0x80))
    486 + devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
    487 +
    488 return 0;
    489 }
    490
    491 diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
    492 index 9df48b70c70c7..640330a3a8dc4 100644
    493 --- a/drivers/hwmon/w83793.c
    494 +++ b/drivers/hwmon/w83793.c
    495 @@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s8 min, s8 max)
    496 }
    497
    498 struct w83793_data {
    499 - struct i2c_client *lm75[2];
    500 struct device *hwmon_dev;
    501 struct mutex update_lock;
    502 char valid; /* !=0 if following fields are valid */
    503 @@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_client *client)
    504 int address = client->addr;
    505 u8 tmp;
    506 struct i2c_adapter *adapter = client->adapter;
    507 - struct w83793_data *data = i2c_get_clientdata(client);
    508
    509 id = i2c_adapter_id(adapter);
    510 if (force_subclients[0] == id && force_subclients[1] == address) {
    511 @@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_client *client)
    512 }
    513
    514 tmp = w83793_read_value(client, W83793_REG_I2C_SUBADDR);
    515 - if (!(tmp & 0x08))
    516 - data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
    517 - 0x48 + (tmp & 0x7));
    518 - if (!(tmp & 0x80)) {
    519 - if (!IS_ERR(data->lm75[0])
    520 - && ((tmp & 0x7) == ((tmp >> 4) & 0x7))) {
    521 - dev_err(&client->dev,
    522 - "duplicate addresses 0x%x, "
    523 - "use force_subclients\n", data->lm75[0]->addr);
    524 - return -ENODEV;
    525 - }
    526 - data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
    527 - 0x48 + ((tmp >> 4) & 0x7));
    528 +
    529 + if (!(tmp & 0x88) && (tmp & 0x7) == ((tmp >> 4) & 0x7)) {
    530 + dev_err(&client->dev,
    531 + "duplicate addresses 0x%x, use force_subclient\n", 0x48 + (tmp & 0x7));
    532 + return -ENODEV;
    533 }
    534
    535 + if (!(tmp & 0x08))
    536 + devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (tmp & 0x7));
    537 +
    538 + if (!(tmp & 0x80))
    539 + devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((tmp >> 4) & 0x7));
    540 +
    541 return 0;
    542 }
    543
    544 diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
    545 index 9c2a4b5d30cfc..0f1dca623b5a1 100644
    546 --- a/drivers/ipack/devices/ipoctal.c
    547 +++ b/drivers/ipack/devices/ipoctal.c
    548 @@ -35,6 +35,7 @@ struct ipoctal_channel {
    549 unsigned int pointer_read;
    550 unsigned int pointer_write;
    551 struct tty_port tty_port;
    552 + bool tty_registered;
    553 union scc2698_channel __iomem *regs;
    554 union scc2698_block __iomem *block_regs;
    555 unsigned int board_id;
    556 @@ -83,22 +84,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
    557 return 0;
    558 }
    559
    560 -static int ipoctal_open(struct tty_struct *tty, struct file *file)
    561 +static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
    562 {
    563 struct ipoctal_channel *channel = dev_get_drvdata(tty->dev);
    564 struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
    565 - int err;
    566 -
    567 - tty->driver_data = channel;
    568 + int res;
    569
    570 if (!ipack_get_carrier(ipoctal->dev))
    571 return -EBUSY;
    572
    573 - err = tty_port_open(&channel->tty_port, tty, file);
    574 - if (err)
    575 - ipack_put_carrier(ipoctal->dev);
    576 + res = tty_standard_install(driver, tty);
    577 + if (res)
    578 + goto err_put_carrier;
    579 +
    580 + tty->driver_data = channel;
    581 +
    582 + return 0;
    583 +
    584 +err_put_carrier:
    585 + ipack_put_carrier(ipoctal->dev);
    586 +
    587 + return res;
    588 +}
    589 +
    590 +static int ipoctal_open(struct tty_struct *tty, struct file *file)
    591 +{
    592 + struct ipoctal_channel *channel = tty->driver_data;
    593
    594 - return err;
    595 + return tty_port_open(&channel->tty_port, tty, file);
    596 }
    597
    598 static void ipoctal_reset_stats(struct ipoctal_stats *stats)
    599 @@ -266,7 +279,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    600 int res;
    601 int i;
    602 struct tty_driver *tty;
    603 - char name[20];
    604 struct ipoctal_channel *channel;
    605 struct ipack_region *region;
    606 void __iomem *addr;
    607 @@ -357,8 +369,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    608 /* Fill struct tty_driver with ipoctal data */
    609 tty->owner = THIS_MODULE;
    610 tty->driver_name = KBUILD_MODNAME;
    611 - sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
    612 - tty->name = name;
    613 + tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
    614 + if (!tty->name) {
    615 + res = -ENOMEM;
    616 + goto err_put_driver;
    617 + }
    618 tty->major = 0;
    619
    620 tty->minor_start = 0;
    621 @@ -374,8 +389,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    622 res = tty_register_driver(tty);
    623 if (res) {
    624 dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
    625 - put_tty_driver(tty);
    626 - return res;
    627 + goto err_free_name;
    628 }
    629
    630 /* Save struct tty_driver for use it when uninstalling the device */
    631 @@ -386,7 +400,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    632
    633 channel = &ipoctal->channel[i];
    634 tty_port_init(&channel->tty_port);
    635 - tty_port_alloc_xmit_buf(&channel->tty_port);
    636 + res = tty_port_alloc_xmit_buf(&channel->tty_port);
    637 + if (res)
    638 + continue;
    639 channel->tty_port.ops = &ipoctal_tty_port_ops;
    640
    641 ipoctal_reset_stats(&channel->stats);
    642 @@ -394,13 +410,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    643 spin_lock_init(&channel->lock);
    644 channel->pointer_read = 0;
    645 channel->pointer_write = 0;
    646 - tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL);
    647 + tty_dev = tty_port_register_device_attr(&channel->tty_port, tty,
    648 + i, NULL, channel, NULL);
    649 if (IS_ERR(tty_dev)) {
    650 dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
    651 + tty_port_free_xmit_buf(&channel->tty_port);
    652 tty_port_destroy(&channel->tty_port);
    653 continue;
    654 }
    655 - dev_set_drvdata(tty_dev, channel);
    656 + channel->tty_registered = true;
    657 }
    658
    659 /*
    660 @@ -412,6 +430,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
    661 ipoctal_irq_handler, ipoctal);
    662
    663 return 0;
    664 +
    665 +err_free_name:
    666 + kfree(tty->name);
    667 +err_put_driver:
    668 + put_tty_driver(tty);
    669 +
    670 + return res;
    671 }
    672
    673 static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
    674 @@ -652,6 +677,7 @@ static void ipoctal_cleanup(struct tty_struct *tty)
    675
    676 static const struct tty_operations ipoctal_fops = {
    677 .ioctl = NULL,
    678 + .install = ipoctal_install,
    679 .open = ipoctal_open,
    680 .close = ipoctal_close,
    681 .write = ipoctal_write_tty,
    682 @@ -694,12 +720,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
    683
    684 for (i = 0; i < NR_CHANNELS; i++) {
    685 struct ipoctal_channel *channel = &ipoctal->channel[i];
    686 +
    687 + if (!channel->tty_registered)
    688 + continue;
    689 +
    690 tty_unregister_device(ipoctal->tty_drv, i);
    691 tty_port_free_xmit_buf(&channel->tty_port);
    692 tty_port_destroy(&channel->tty_port);
    693 }
    694
    695 tty_unregister_driver(ipoctal->tty_drv);
    696 + kfree(ipoctal->tty_drv->name);
    697 put_tty_driver(ipoctal->tty_drv);
    698 kfree(ipoctal);
    699 }
    700 diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
    701 index db9c8f943811b..ffd1018d43fbe 100644
    702 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
    703 +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
    704 @@ -452,6 +452,11 @@ static int hns3_nic_net_open(struct net_device *netdev)
    705 if (hns3_nic_resetting(netdev))
    706 return -EBUSY;
    707
    708 + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
    709 + netdev_warn(netdev, "net open repeatedly!\n");
    710 + return 0;
    711 + }
    712 +
    713 netif_carrier_off(netdev);
    714
    715 ret = hns3_nic_set_real_num_queue(netdev);
    716 diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
    717 index 911b3d2a94e1c..70962967d7141 100644
    718 --- a/drivers/net/ethernet/intel/e100.c
    719 +++ b/drivers/net/ethernet/intel/e100.c
    720 @@ -2435,11 +2435,15 @@ static void e100_get_drvinfo(struct net_device *netdev,
    721 sizeof(info->bus_info));
    722 }
    723
    724 -#define E100_PHY_REGS 0x1C
    725 +#define E100_PHY_REGS 0x1D
    726 static int e100_get_regs_len(struct net_device *netdev)
    727 {
    728 struct nic *nic = netdev_priv(netdev);
    729 - return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);
    730 +
    731 + /* We know the number of registers, and the size of the dump buffer.
    732 + * Calculate the total size in bytes.
    733 + */
    734 + return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);
    735 }
    736
    737 static void e100_get_regs(struct net_device *netdev,
    738 @@ -2453,14 +2457,18 @@ static void e100_get_regs(struct net_device *netdev,
    739 buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 |
    740 ioread8(&nic->csr->scb.cmd_lo) << 16 |
    741 ioread16(&nic->csr->scb.status);
    742 - for (i = E100_PHY_REGS; i >= 0; i--)
    743 - buff[1 + E100_PHY_REGS - i] =
    744 - mdio_read(netdev, nic->mii.phy_id, i);
    745 + for (i = 0; i < E100_PHY_REGS; i++)
    746 + /* Note that we read the registers in reverse order. This
    747 + * ordering is the ABI apparently used by ethtool and other
    748 + * applications.
    749 + */
    750 + buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,
    751 + E100_PHY_REGS - 1 - i);
    752 memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));
    753 e100_exec_cb(nic, NULL, e100_dump);
    754 msleep(10);
    755 - memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,
    756 - sizeof(nic->mem->dump_buf));
    757 + memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,
    758 + sizeof(nic->mem->dump_buf));
    759 }
    760
    761 static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
    762 diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    763 index e09851c7da9b8..835ac178bc8c0 100644
    764 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    765 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    766 @@ -4855,8 +4855,6 @@ int stmmac_resume(struct device *dev)
    767 stmmac_mdio_reset(priv->mii);
    768 }
    769
    770 - netif_device_attach(ndev);
    771 -
    772 mutex_lock(&priv->lock);
    773
    774 stmmac_reset_queues_param(priv);
    775 @@ -4880,6 +4878,8 @@ int stmmac_resume(struct device *dev)
    776
    777 phylink_mac_change(priv->phylink, true);
    778
    779 + netif_device_attach(ndev);
    780 +
    781 return 0;
    782 }
    783 EXPORT_SYMBOL_GPL(stmmac_resume);
    784 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
    785 index 9ad1f093c4ae1..31200275a0640 100644
    786 --- a/drivers/net/usb/hso.c
    787 +++ b/drivers/net/usb/hso.c
    788 @@ -2497,7 +2497,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    789 hso_net_init);
    790 if (!net) {
    791 dev_err(&interface->dev, "Unable to create ethernet device\n");
    792 - goto exit;
    793 + goto err_hso_dev;
    794 }
    795
    796 hso_net = netdev_priv(net);
    797 @@ -2510,13 +2510,13 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    798 USB_DIR_IN);
    799 if (!hso_net->in_endp) {
    800 dev_err(&interface->dev, "Can't find BULK IN endpoint\n");
    801 - goto exit;
    802 + goto err_net;
    803 }
    804 hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,
    805 USB_DIR_OUT);
    806 if (!hso_net->out_endp) {
    807 dev_err(&interface->dev, "Can't find BULK OUT endpoint\n");
    808 - goto exit;
    809 + goto err_net;
    810 }
    811 SET_NETDEV_DEV(net, &interface->dev);
    812 SET_NETDEV_DEVTYPE(net, &hso_type);
    813 @@ -2525,18 +2525,18 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    814 for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
    815 hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL);
    816 if (!hso_net->mux_bulk_rx_urb_pool[i])
    817 - goto exit;
    818 + goto err_mux_bulk_rx;
    819 hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE,
    820 GFP_KERNEL);
    821 if (!hso_net->mux_bulk_rx_buf_pool[i])
    822 - goto exit;
    823 + goto err_mux_bulk_rx;
    824 }
    825 hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL);
    826 if (!hso_net->mux_bulk_tx_urb)
    827 - goto exit;
    828 + goto err_mux_bulk_rx;
    829 hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL);
    830 if (!hso_net->mux_bulk_tx_buf)
    831 - goto exit;
    832 + goto err_free_tx_urb;
    833
    834 add_net_device(hso_dev);
    835
    836 @@ -2544,7 +2544,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    837 result = register_netdev(net);
    838 if (result) {
    839 dev_err(&interface->dev, "Failed to register device\n");
    840 - goto exit;
    841 + goto err_free_tx_buf;
    842 }
    843
    844 hso_log_port(hso_dev);
    845 @@ -2552,8 +2552,21 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    846 hso_create_rfkill(hso_dev, interface);
    847
    848 return hso_dev;
    849 -exit:
    850 - hso_free_net_device(hso_dev);
    851 +
    852 +err_free_tx_buf:
    853 + remove_net_device(hso_dev);
    854 + kfree(hso_net->mux_bulk_tx_buf);
    855 +err_free_tx_urb:
    856 + usb_free_urb(hso_net->mux_bulk_tx_urb);
    857 +err_mux_bulk_rx:
    858 + for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
    859 + usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]);
    860 + kfree(hso_net->mux_bulk_rx_buf_pool[i]);
    861 + }
    862 +err_net:
    863 + free_netdev(net);
    864 +err_hso_dev:
    865 + kfree(hso_dev);
    866 return NULL;
    867 }
    868
    869 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    870 index 1033513d3d9de..07b070b14d75d 100644
    871 --- a/drivers/net/wireless/mac80211_hwsim.c
    872 +++ b/drivers/net/wireless/mac80211_hwsim.c
    873 @@ -1603,8 +1603,8 @@ mac80211_hwsim_beacon(struct hrtimer *timer)
    874 bcn_int -= data->bcn_delta;
    875 data->bcn_delta = 0;
    876 }
    877 - hrtimer_forward(&data->beacon_timer, hrtimer_get_expires(timer),
    878 - ns_to_ktime(bcn_int * NSEC_PER_USEC));
    879 + hrtimer_forward_now(&data->beacon_timer,
    880 + ns_to_ktime(bcn_int * NSEC_PER_USEC));
    881 return HRTIMER_RESTART;
    882 }
    883
    884 diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
    885 index f9f76f6ba07b1..7e65306b2bf24 100644
    886 --- a/drivers/nvdimm/pmem.c
    887 +++ b/drivers/nvdimm/pmem.c
    888 @@ -423,11 +423,11 @@ static int pmem_attach_disk(struct device *dev,
    889 pmem->pfn_flags |= PFN_MAP;
    890 memcpy(&bb_res, &pmem->pgmap.res, sizeof(bb_res));
    891 } else {
    892 + addr = devm_memremap(dev, pmem->phys_addr,
    893 + pmem->size, ARCH_MEMREMAP_PMEM);
    894 if (devm_add_action_or_reset(dev, pmem_release_queue,
    895 &pmem->pgmap))
    896 return -ENOMEM;
    897 - addr = devm_memremap(dev, pmem->phys_addr,
    898 - pmem->size, ARCH_MEMREMAP_PMEM);
    899 memcpy(&bb_res, &nsio->res, sizeof(bb_res));
    900 }
    901
    902 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    903 index f28213b625279..a41d04c57642d 100644
    904 --- a/drivers/pci/probe.c
    905 +++ b/drivers/pci/probe.c
    906 @@ -564,7 +564,7 @@ static struct pci_bus *pci_alloc_bus(struct pci_bus *parent)
    907 return b;
    908 }
    909
    910 -static void devm_pci_release_host_bridge_dev(struct device *dev)
    911 +static void pci_release_host_bridge_dev(struct device *dev)
    912 {
    913 struct pci_host_bridge *bridge = to_pci_host_bridge(dev);
    914
    915 @@ -573,12 +573,7 @@ static void devm_pci_release_host_bridge_dev(struct device *dev)
    916
    917 pci_free_resource_list(&bridge->windows);
    918 pci_free_resource_list(&bridge->dma_ranges);
    919 -}
    920 -
    921 -static void pci_release_host_bridge_dev(struct device *dev)
    922 -{
    923 - devm_pci_release_host_bridge_dev(dev);
    924 - kfree(to_pci_host_bridge(dev));
    925 + kfree(bridge);
    926 }
    927
    928 static void pci_init_host_bridge(struct pci_host_bridge *bridge)
    929 @@ -597,6 +592,8 @@ static void pci_init_host_bridge(struct pci_host_bridge *bridge)
    930 bridge->native_shpc_hotplug = 1;
    931 bridge->native_pme = 1;
    932 bridge->native_ltr = 1;
    933 +
    934 + device_initialize(&bridge->dev);
    935 }
    936
    937 struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
    938 @@ -614,17 +611,25 @@ struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
    939 }
    940 EXPORT_SYMBOL(pci_alloc_host_bridge);
    941
    942 +static void devm_pci_alloc_host_bridge_release(void *data)
    943 +{
    944 + pci_free_host_bridge(data);
    945 +}
    946 +
    947 struct pci_host_bridge *devm_pci_alloc_host_bridge(struct device *dev,
    948 size_t priv)
    949 {
    950 + int ret;
    951 struct pci_host_bridge *bridge;
    952
    953 - bridge = devm_kzalloc(dev, sizeof(*bridge) + priv, GFP_KERNEL);
    954 + bridge = pci_alloc_host_bridge(priv);
    955 if (!bridge)
    956 return NULL;
    957
    958 - pci_init_host_bridge(bridge);
    959 - bridge->dev.release = devm_pci_release_host_bridge_dev;
    960 + ret = devm_add_action_or_reset(dev, devm_pci_alloc_host_bridge_release,
    961 + bridge);
    962 + if (ret)
    963 + return NULL;
    964
    965 return bridge;
    966 }
    967 @@ -632,10 +637,7 @@ EXPORT_SYMBOL(devm_pci_alloc_host_bridge);
    968
    969 void pci_free_host_bridge(struct pci_host_bridge *bridge)
    970 {
    971 - pci_free_resource_list(&bridge->windows);
    972 - pci_free_resource_list(&bridge->dma_ranges);
    973 -
    974 - kfree(bridge);
    975 + put_device(&bridge->dev);
    976 }
    977 EXPORT_SYMBOL(pci_free_host_bridge);
    978
    979 @@ -866,7 +868,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
    980 if (err)
    981 goto free;
    982
    983 - err = device_register(&bridge->dev);
    984 + err = device_add(&bridge->dev);
    985 if (err) {
    986 put_device(&bridge->dev);
    987 goto free;
    988 @@ -933,7 +935,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
    989
    990 unregister:
    991 put_device(&bridge->dev);
    992 - device_unregister(&bridge->dev);
    993 + device_del(&bridge->dev);
    994
    995 free:
    996 kfree(bus);
    997 @@ -2945,7 +2947,7 @@ struct pci_bus *pci_create_root_bus(struct device *parent, int bus,
    998 return bridge->bus;
    999
    1000 err_out:
    1001 - kfree(bridge);
    1002 + put_device(&bridge->dev);
    1003 return NULL;
    1004 }
    1005 EXPORT_SYMBOL_GPL(pci_create_root_bus);
    1006 diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
    1007 index e9c6b120cf451..95dec03d9f2a9 100644
    1008 --- a/drivers/pci/remove.c
    1009 +++ b/drivers/pci/remove.c
    1010 @@ -160,6 +160,6 @@ void pci_remove_root_bus(struct pci_bus *bus)
    1011 host_bridge->bus = NULL;
    1012
    1013 /* remove the host bridge */
    1014 - device_unregister(&host_bridge->dev);
    1015 + device_del(&host_bridge->dev);
    1016 }
    1017 EXPORT_SYMBOL_GPL(pci_remove_root_bus);
    1018 diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
    1019 index a6dd704d7f2de..1b8ccadc7cf67 100644
    1020 --- a/drivers/scsi/csiostor/csio_init.c
    1021 +++ b/drivers/scsi/csiostor/csio_init.c
    1022 @@ -1257,3 +1257,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl);
    1023 MODULE_VERSION(CSIO_DRV_VERSION);
    1024 MODULE_FIRMWARE(FW_FNAME_T5);
    1025 MODULE_FIRMWARE(FW_FNAME_T6);
    1026 +MODULE_SOFTDEP("pre: cxgb4");
    1027 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
    1028 index 0429ba5d7d23c..24396f4d5f2d3 100644
    1029 --- a/drivers/scsi/ufs/ufshcd.c
    1030 +++ b/drivers/scsi/ufs/ufshcd.c
    1031 @@ -320,8 +320,7 @@ static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, unsigned int tag,
    1032 static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
    1033 const char *str)
    1034 {
    1035 - int off = (int)tag - hba->nutrs;
    1036 - struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off];
    1037 + struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];
    1038
    1039 trace_ufshcd_upiu(dev_name(hba->dev), str, &descp->req_header,
    1040 &descp->input_param1);
    1041 diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    1042 index 404b80dc06b87..d1ab8561e2581 100644
    1043 --- a/drivers/tty/vt/vt.c
    1044 +++ b/drivers/tty/vt/vt.c
    1045 @@ -1215,8 +1215,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
    1046 new_row_size = new_cols << 1;
    1047 new_screen_size = new_row_size * new_rows;
    1048
    1049 - if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
    1050 - return 0;
    1051 + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
    1052 + /*
    1053 + * This function is being called here to cover the case
    1054 + * where the userspace calls the FBIOPUT_VSCREENINFO twice,
    1055 + * passing the same fb_var_screeninfo containing the fields
    1056 + * yres/xres equal to a number non-multiple of vc_font.height
    1057 + * and yres_virtual/xres_virtual equal to number lesser than the
    1058 + * vc_font.height and yres/xres.
    1059 + * In the second call, the struct fb_var_screeninfo isn't
    1060 + * being modified by the underlying driver because of the
    1061 + * if above, and this causes the fbcon_display->vrows to become
    1062 + * negative and it eventually leads to out-of-bound
    1063 + * access by the imageblit function.
    1064 + * To give the correct values to the struct and to not have
    1065 + * to deal with possible errors from the code below, we call
    1066 + * the resize_screen here as well.
    1067 + */
    1068 + return resize_screen(vc, new_cols, new_rows, user);
    1069 + }
    1070
    1071 if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
    1072 return -EINVAL;
    1073 diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
    1074 index c3bf54cc530f9..296f2ee1b6803 100644
    1075 --- a/drivers/usb/cdns3/gadget.c
    1076 +++ b/drivers/usb/cdns3/gadget.c
    1077 @@ -807,6 +807,19 @@ static void cdns3_wa1_tray_restore_cycle_bit(struct cdns3_device *priv_dev,
    1078 cdns3_wa1_restore_cycle_bit(priv_ep);
    1079 }
    1080
    1081 +static void cdns3_rearm_drdy_if_needed(struct cdns3_endpoint *priv_ep)
    1082 +{
    1083 + struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
    1084 +
    1085 + if (priv_dev->dev_ver < DEV_VER_V3)
    1086 + return;
    1087 +
    1088 + if (readl(&priv_dev->regs->ep_sts) & EP_STS_TRBERR) {
    1089 + writel(EP_STS_TRBERR, &priv_dev->regs->ep_sts);
    1090 + writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
    1091 + }
    1092 +}
    1093 +
    1094 /**
    1095 * cdns3_ep_run_transfer - start transfer on no-default endpoint hardware
    1096 * @priv_ep: endpoint object
    1097 @@ -1003,6 +1016,7 @@ int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
    1098 /*clearing TRBERR and EP_STS_DESCMIS before seting DRDY*/
    1099 writel(EP_STS_TRBERR | EP_STS_DESCMIS, &priv_dev->regs->ep_sts);
    1100 writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
    1101 + cdns3_rearm_drdy_if_needed(priv_ep);
    1102 trace_cdns3_doorbell_epx(priv_ep->name,
    1103 readl(&priv_dev->regs->ep_traddr));
    1104 }
    1105 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    1106 index 7ce3cfd965d25..72cd871544ac0 100644
    1107 --- a/fs/binfmt_elf.c
    1108 +++ b/fs/binfmt_elf.c
    1109 @@ -583,7 +583,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
    1110
    1111 vaddr = eppnt->p_vaddr;
    1112 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
    1113 - elf_type |= MAP_FIXED_NOREPLACE;
    1114 + elf_type |= MAP_FIXED;
    1115 else if (no_base && interp_elf_ex->e_type == ET_DYN)
    1116 load_addr = -vaddr;
    1117
    1118 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
    1119 index 1c74a7cbf5b19..e595a29bf46e3 100644
    1120 --- a/fs/debugfs/inode.c
    1121 +++ b/fs/debugfs/inode.c
    1122 @@ -522,7 +522,7 @@ struct dentry *debugfs_create_file_size(const char *name, umode_t mode,
    1123 {
    1124 struct dentry *de = debugfs_create_file(name, mode, parent, data, fops);
    1125
    1126 - if (de)
    1127 + if (!IS_ERR(de))
    1128 d_inode(de)->i_size = file_size;
    1129 return de;
    1130 }
    1131 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
    1132 index 0589e914663fb..e8275b5d27439 100644
    1133 --- a/fs/ext4/dir.c
    1134 +++ b/fs/ext4/dir.c
    1135 @@ -536,7 +536,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
    1136 struct dir_private_info *info = file->private_data;
    1137 struct inode *inode = file_inode(file);
    1138 struct fname *fname;
    1139 - int ret;
    1140 + int ret = 0;
    1141
    1142 if (!info) {
    1143 info = ext4_htree_create_dir_info(file, ctx->pos);
    1144 @@ -584,7 +584,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
    1145 info->curr_minor_hash,
    1146 &info->next_hash);
    1147 if (ret < 0)
    1148 - return ret;
    1149 + goto finished;
    1150 if (ret == 0) {
    1151 ctx->pos = ext4_get_htree_eof(file);
    1152 break;
    1153 @@ -615,7 +615,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
    1154 }
    1155 finished:
    1156 info->last_pos = ctx->pos;
    1157 - return 0;
    1158 + return ret < 0 ? ret : 0;
    1159 }
    1160
    1161 static int ext4_dir_open(struct inode * inode, struct file * filp)
    1162 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
    1163 index 1429d01d836bb..48b467353f6f1 100644
    1164 --- a/fs/ext4/inode.c
    1165 +++ b/fs/ext4/inode.c
    1166 @@ -1782,6 +1782,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
    1167 struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    1168 int ret;
    1169 bool allocated = false;
    1170 + bool reserved = false;
    1171
    1172 /*
    1173 * If the cluster containing lblk is shared with a delayed,
    1174 @@ -1798,6 +1799,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
    1175 ret = ext4_da_reserve_space(inode);
    1176 if (ret != 0) /* ENOSPC */
    1177 goto errout;
    1178 + reserved = true;
    1179 } else { /* bigalloc */
    1180 if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {
    1181 if (!ext4_es_scan_clu(inode,
    1182 @@ -1810,6 +1812,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
    1183 ret = ext4_da_reserve_space(inode);
    1184 if (ret != 0) /* ENOSPC */
    1185 goto errout;
    1186 + reserved = true;
    1187 } else {
    1188 allocated = true;
    1189 }
    1190 @@ -1820,6 +1823,8 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
    1191 }
    1192
    1193 ret = ext4_es_insert_delayed_block(inode, lblk, allocated);
    1194 + if (ret && reserved)
    1195 + ext4_da_release_space(inode, 1);
    1196
    1197 errout:
    1198 return ret;
    1199 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    1200 index ce8372ceaa43e..1211ae203face 100644
    1201 --- a/fs/ext4/super.c
    1202 +++ b/fs/ext4/super.c
    1203 @@ -1141,6 +1141,12 @@ static void ext4_destroy_inode(struct inode *inode)
    1204 true);
    1205 dump_stack();
    1206 }
    1207 +
    1208 + if (EXT4_I(inode)->i_reserved_data_blocks)
    1209 + ext4_msg(inode->i_sb, KERN_ERR,
    1210 + "Inode %lu (%p): i_reserved_data_blocks (%u) not cleared!",
    1211 + inode->i_ino, EXT4_I(inode),
    1212 + EXT4_I(inode)->i_reserved_data_blocks);
    1213 }
    1214
    1215 static void init_once(void *foo)
    1216 @@ -2830,17 +2836,17 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
    1217 */
    1218 static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)
    1219 {
    1220 - loff_t res = EXT4_NDIR_BLOCKS;
    1221 + unsigned long long upper_limit, res = EXT4_NDIR_BLOCKS;
    1222 int meta_blocks;
    1223 - loff_t upper_limit;
    1224 - /* This is calculated to be the largest file size for a dense, block
    1225 +
    1226 + /*
    1227 + * This is calculated to be the largest file size for a dense, block
    1228 * mapped file such that the file's total number of 512-byte sectors,
    1229 * including data and all indirect blocks, does not exceed (2^48 - 1).
    1230 *
    1231 * __u32 i_blocks_lo and _u16 i_blocks_high represent the total
    1232 * number of 512-byte sectors of the file.
    1233 */
    1234 -
    1235 if (!has_huge_files) {
    1236 /*
    1237 * !has_huge_files or implies that the inode i_block field
    1238 @@ -2883,7 +2889,7 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)
    1239 if (res > MAX_LFS_FILESIZE)
    1240 res = MAX_LFS_FILESIZE;
    1241
    1242 - return res;
    1243 + return (loff_t)res;
    1244 }
    1245
    1246 static ext4_fsblk_t descriptor_loc(struct super_block *sb,
    1247 diff --git a/fs/verity/enable.c b/fs/verity/enable.c
    1248 index eabc6ac199064..1370bfd17e870 100644
    1249 --- a/fs/verity/enable.c
    1250 +++ b/fs/verity/enable.c
    1251 @@ -136,7 +136,7 @@ static int build_merkle_tree(struct inode *inode,
    1252 * (level 0) and ascending to the root node (level 'num_levels - 1').
    1253 * Then at the end (level 'num_levels'), calculate the root hash.
    1254 */
    1255 - blocks = (inode->i_size + params->block_size - 1) >>
    1256 + blocks = ((u64)inode->i_size + params->block_size - 1) >>
    1257 params->log_blocksize;
    1258 for (level = 0; level <= params->num_levels; level++) {
    1259 err = build_merkle_tree_level(inode, level, blocks, params,
    1260 diff --git a/fs/verity/open.c b/fs/verity/open.c
    1261 index 63d1004b688cb..6200826107c24 100644
    1262 --- a/fs/verity/open.c
    1263 +++ b/fs/verity/open.c
    1264 @@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params,
    1265 */
    1266
    1267 /* Compute number of levels and the number of blocks in each level */
    1268 - blocks = (inode->i_size + params->block_size - 1) >> log_blocksize;
    1269 + blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize;
    1270 pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);
    1271 while (blocks > 1) {
    1272 if (params->num_levels >= FS_VERITY_MAX_LEVELS) {
    1273 diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
    1274 index ffbae7683450a..cb6c125628990 100644
    1275 --- a/include/net/ip_fib.h
    1276 +++ b/include/net/ip_fib.h
    1277 @@ -524,5 +524,5 @@ int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
    1278 int fib_nexthop_info(struct sk_buff *skb, const struct fib_nh_common *nh,
    1279 u8 rt_family, unsigned char *flags, bool skip_oif);
    1280 int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nh,
    1281 - int nh_weight, u8 rt_family);
    1282 + int nh_weight, u8 rt_family, u32 nh_tclassid);
    1283 #endif /* _NET_FIB_H */
    1284 diff --git a/include/net/nexthop.h b/include/net/nexthop.h
    1285 index 18a5aca264767..5ad614793af26 100644
    1286 --- a/include/net/nexthop.h
    1287 +++ b/include/net/nexthop.h
    1288 @@ -173,7 +173,7 @@ int nexthop_mpath_fill_node(struct sk_buff *skb, struct nexthop *nh,
    1289 struct fib_nh_common *nhc = &nhi->fib_nhc;
    1290 int weight = nhg->nh_entries[i].weight;
    1291
    1292 - if (fib_add_nexthop(skb, nhc, weight, rt_family) < 0)
    1293 + if (fib_add_nexthop(skb, nhc, weight, rt_family, 0) < 0)
    1294 return -EMSGSIZE;
    1295 }
    1296
    1297 diff --git a/include/net/sock.h b/include/net/sock.h
    1298 index d3dd89b6e2cba..079b5f6f13d81 100644
    1299 --- a/include/net/sock.h
    1300 +++ b/include/net/sock.h
    1301 @@ -470,8 +470,10 @@ struct sock {
    1302 u32 sk_ack_backlog;
    1303 u32 sk_max_ack_backlog;
    1304 kuid_t sk_uid;
    1305 + spinlock_t sk_peer_lock;
    1306 struct pid *sk_peer_pid;
    1307 const struct cred *sk_peer_cred;
    1308 +
    1309 long sk_rcvtimeo;
    1310 ktime_t sk_stamp;
    1311 #if BITS_PER_LONG==32
    1312 diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
    1313 index 4cb80e6042c4f..831fee509404e 100644
    1314 --- a/kernel/sched/cpufreq_schedutil.c
    1315 +++ b/kernel/sched/cpufreq_schedutil.c
    1316 @@ -624,9 +624,17 @@ static struct attribute *sugov_attrs[] = {
    1317 };
    1318 ATTRIBUTE_GROUPS(sugov);
    1319
    1320 +static void sugov_tunables_free(struct kobject *kobj)
    1321 +{
    1322 + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj);
    1323 +
    1324 + kfree(to_sugov_tunables(attr_set));
    1325 +}
    1326 +
    1327 static struct kobj_type sugov_tunables_ktype = {
    1328 .default_groups = sugov_groups,
    1329 .sysfs_ops = &governor_sysfs_ops,
    1330 + .release = &sugov_tunables_free,
    1331 };
    1332
    1333 /********************** cpufreq governor interface *********************/
    1334 @@ -726,12 +734,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_polic
    1335 return tunables;
    1336 }
    1337
    1338 -static void sugov_tunables_free(struct sugov_tunables *tunables)
    1339 +static void sugov_clear_global_tunables(void)
    1340 {
    1341 if (!have_governor_per_policy())
    1342 global_tunables = NULL;
    1343 -
    1344 - kfree(tunables);
    1345 }
    1346
    1347 static int sugov_init(struct cpufreq_policy *policy)
    1348 @@ -794,7 +800,7 @@ out:
    1349 fail:
    1350 kobject_put(&tunables->attr_set.kobj);
    1351 policy->governor_data = NULL;
    1352 - sugov_tunables_free(tunables);
    1353 + sugov_clear_global_tunables();
    1354
    1355 stop_kthread:
    1356 sugov_kthread_stop(sg_policy);
    1357 @@ -821,7 +827,7 @@ static void sugov_exit(struct cpufreq_policy *policy)
    1358 count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
    1359 policy->governor_data = NULL;
    1360 if (!count)
    1361 - sugov_tunables_free(tunables);
    1362 + sugov_clear_global_tunables();
    1363
    1364 mutex_unlock(&global_tunables_lock);
    1365
    1366 diff --git a/net/core/sock.c b/net/core/sock.c
    1367 index 452883b28abab..57b7a10703c36 100644
    1368 --- a/net/core/sock.c
    1369 +++ b/net/core/sock.c
    1370 @@ -1181,6 +1181,16 @@ set_rcvbuf:
    1371 }
    1372 EXPORT_SYMBOL(sock_setsockopt);
    1373
    1374 +static const struct cred *sk_get_peer_cred(struct sock *sk)
    1375 +{
    1376 + const struct cred *cred;
    1377 +
    1378 + spin_lock(&sk->sk_peer_lock);
    1379 + cred = get_cred(sk->sk_peer_cred);
    1380 + spin_unlock(&sk->sk_peer_lock);
    1381 +
    1382 + return cred;
    1383 +}
    1384
    1385 static void cred_to_ucred(struct pid *pid, const struct cred *cred,
    1386 struct ucred *ucred)
    1387 @@ -1355,7 +1365,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
    1388 struct ucred peercred;
    1389 if (len > sizeof(peercred))
    1390 len = sizeof(peercred);
    1391 +
    1392 + spin_lock(&sk->sk_peer_lock);
    1393 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
    1394 + spin_unlock(&sk->sk_peer_lock);
    1395 +
    1396 if (copy_to_user(optval, &peercred, len))
    1397 return -EFAULT;
    1398 goto lenout;
    1399 @@ -1363,20 +1377,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
    1400
    1401 case SO_PEERGROUPS:
    1402 {
    1403 + const struct cred *cred;
    1404 int ret, n;
    1405
    1406 - if (!sk->sk_peer_cred)
    1407 + cred = sk_get_peer_cred(sk);
    1408 + if (!cred)
    1409 return -ENODATA;
    1410
    1411 - n = sk->sk_peer_cred->group_info->ngroups;
    1412 + n = cred->group_info->ngroups;
    1413 if (len < n * sizeof(gid_t)) {
    1414 len = n * sizeof(gid_t);
    1415 + put_cred(cred);
    1416 return put_user(len, optlen) ? -EFAULT : -ERANGE;
    1417 }
    1418 len = n * sizeof(gid_t);
    1419
    1420 - ret = groups_to_user((gid_t __user *)optval,
    1421 - sk->sk_peer_cred->group_info);
    1422 + ret = groups_to_user((gid_t __user *)optval, cred->group_info);
    1423 + put_cred(cred);
    1424 if (ret)
    1425 return ret;
    1426 goto lenout;
    1427 @@ -1714,9 +1731,10 @@ static void __sk_destruct(struct rcu_head *head)
    1428 sk->sk_frag.page = NULL;
    1429 }
    1430
    1431 - if (sk->sk_peer_cred)
    1432 - put_cred(sk->sk_peer_cred);
    1433 + /* We do not need to acquire sk->sk_peer_lock, we are the last user. */
    1434 + put_cred(sk->sk_peer_cred);
    1435 put_pid(sk->sk_peer_pid);
    1436 +
    1437 if (likely(sk->sk_net_refcnt))
    1438 put_net(sock_net(sk));
    1439 sk_prot_free(sk->sk_prot_creator, sk);
    1440 @@ -2915,6 +2933,8 @@ void sock_init_data(struct socket *sock, struct sock *sk)
    1441
    1442 sk->sk_peer_pid = NULL;
    1443 sk->sk_peer_cred = NULL;
    1444 + spin_lock_init(&sk->sk_peer_lock);
    1445 +
    1446 sk->sk_write_pending = 0;
    1447 sk->sk_rcvlowat = 1;
    1448 sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
    1449 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    1450 index b1b3220917ca0..dce85a9c20c60 100644
    1451 --- a/net/ipv4/fib_semantics.c
    1452 +++ b/net/ipv4/fib_semantics.c
    1453 @@ -1654,7 +1654,7 @@ EXPORT_SYMBOL_GPL(fib_nexthop_info);
    1454
    1455 #if IS_ENABLED(CONFIG_IP_ROUTE_MULTIPATH) || IS_ENABLED(CONFIG_IPV6)
    1456 int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc,
    1457 - int nh_weight, u8 rt_family)
    1458 + int nh_weight, u8 rt_family, u32 nh_tclassid)
    1459 {
    1460 const struct net_device *dev = nhc->nhc_dev;
    1461 struct rtnexthop *rtnh;
    1462 @@ -1672,6 +1672,9 @@ int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc,
    1463
    1464 rtnh->rtnh_flags = flags;
    1465
    1466 + if (nh_tclassid && nla_put_u32(skb, RTA_FLOW, nh_tclassid))
    1467 + goto nla_put_failure;
    1468 +
    1469 /* length of rtnetlink header + attributes */
    1470 rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *)rtnh;
    1471
    1472 @@ -1699,14 +1702,13 @@ static int fib_add_multipath(struct sk_buff *skb, struct fib_info *fi)
    1473 }
    1474
    1475 for_nexthops(fi) {
    1476 - if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
    1477 - AF_INET) < 0)
    1478 - goto nla_put_failure;
    1479 + u32 nh_tclassid = 0;
    1480 #ifdef CONFIG_IP_ROUTE_CLASSID
    1481 - if (nh->nh_tclassid &&
    1482 - nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
    1483 - goto nla_put_failure;
    1484 + nh_tclassid = nh->nh_tclassid;
    1485 #endif
    1486 + if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
    1487 + AF_INET, nh_tclassid) < 0)
    1488 + goto nla_put_failure;
    1489 } endfor_nexthops(fi);
    1490
    1491 mp_end:
    1492 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1493 index 6f277bd30ea3c..de04d99418850 100644
    1494 --- a/net/ipv4/udp.c
    1495 +++ b/net/ipv4/udp.c
    1496 @@ -981,7 +981,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1497 __be16 dport;
    1498 u8 tos;
    1499 int err, is_udplite = IS_UDPLITE(sk);
    1500 - int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
    1501 + int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
    1502 int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
    1503 struct sk_buff *skb;
    1504 struct ip_options_data opt_copy;
    1505 @@ -1289,7 +1289,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
    1506 }
    1507
    1508 up->len += size;
    1509 - if (!(up->corkflag || (flags&MSG_MORE)))
    1510 + if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE)))
    1511 ret = udp_push_pending_frames(sk);
    1512 if (!ret)
    1513 ret = size;
    1514 @@ -2551,9 +2551,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
    1515 switch (optname) {
    1516 case UDP_CORK:
    1517 if (val != 0) {
    1518 - up->corkflag = 1;
    1519 + WRITE_ONCE(up->corkflag, 1);
    1520 } else {
    1521 - up->corkflag = 0;
    1522 + WRITE_ONCE(up->corkflag, 0);
    1523 lock_sock(sk);
    1524 push_pending_frames(sk);
    1525 release_sock(sk);
    1526 @@ -2676,7 +2676,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
    1527
    1528 switch (optname) {
    1529 case UDP_CORK:
    1530 - val = up->corkflag;
    1531 + val = READ_ONCE(up->corkflag);
    1532 break;
    1533
    1534 case UDP_ENCAP:
    1535 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1536 index 575bd0f1b0089..3fb259c20546e 100644
    1537 --- a/net/ipv6/route.c
    1538 +++ b/net/ipv6/route.c
    1539 @@ -5523,14 +5523,15 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
    1540 goto nla_put_failure;
    1541
    1542 if (fib_add_nexthop(skb, &rt->fib6_nh->nh_common,
    1543 - rt->fib6_nh->fib_nh_weight, AF_INET6) < 0)
    1544 + rt->fib6_nh->fib_nh_weight, AF_INET6,
    1545 + 0) < 0)
    1546 goto nla_put_failure;
    1547
    1548 list_for_each_entry_safe(sibling, next_sibling,
    1549 &rt->fib6_siblings, fib6_siblings) {
    1550 if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common,
    1551 sibling->fib6_nh->fib_nh_weight,
    1552 - AF_INET6) < 0)
    1553 + AF_INET6, 0) < 0)
    1554 goto nla_put_failure;
    1555 }
    1556
    1557 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1558 index 776427e80efbd..5b8266f3e47f0 100644
    1559 --- a/net/ipv6/udp.c
    1560 +++ b/net/ipv6/udp.c
    1561 @@ -1231,7 +1231,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1562 int addr_len = msg->msg_namelen;
    1563 bool connected = false;
    1564 int ulen = len;
    1565 - int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
    1566 + int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
    1567 int err;
    1568 int is_udplite = IS_UDPLITE(sk);
    1569 int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
    1570 diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
    1571 index 031e905f684a2..bf83f512f748b 100644
    1572 --- a/net/mac80211/mesh_ps.c
    1573 +++ b/net/mac80211/mesh_ps.c
    1574 @@ -2,6 +2,7 @@
    1575 /*
    1576 * Copyright 2012-2013, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
    1577 * Copyright 2012-2013, cozybit Inc.
    1578 + * Copyright (C) 2021 Intel Corporation
    1579 */
    1580
    1581 #include "mesh.h"
    1582 @@ -584,7 +585,7 @@ void ieee80211_mps_frame_release(struct sta_info *sta,
    1583
    1584 /* only transmit to PS STA with announced, non-zero awake window */
    1585 if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
    1586 - (!elems->awake_window || !le16_to_cpu(*elems->awake_window)))
    1587 + (!elems->awake_window || !get_unaligned_le16(elems->awake_window)))
    1588 return;
    1589
    1590 if (!test_sta_flag(sta, WLAN_STA_MPSP_OWNER))
    1591 diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
    1592 index 4dfac7a25e5ad..d82d22b6a2a94 100644
    1593 --- a/net/mac80211/tx.c
    1594 +++ b/net/mac80211/tx.c
    1595 @@ -2156,7 +2156,11 @@ static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
    1596 }
    1597
    1598 vht_mcs = iterator.this_arg[4] >> 4;
    1599 + if (vht_mcs > 11)
    1600 + vht_mcs = 0;
    1601 vht_nss = iterator.this_arg[4] & 0xF;
    1602 + if (!vht_nss || vht_nss > 8)
    1603 + vht_nss = 1;
    1604 break;
    1605
    1606 /*
    1607 @@ -3325,6 +3329,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
    1608 if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
    1609 goto out;
    1610
    1611 + /* If n == 2, the "while (*frag_tail)" loop above didn't execute
    1612 + * and frag_tail should be &skb_shinfo(head)->frag_list.
    1613 + * However, ieee80211_amsdu_prepare_head() can reallocate it.
    1614 + * Reload frag_tail to have it pointing to the correct place.
    1615 + */
    1616 + if (n == 2)
    1617 + frag_tail = &skb_shinfo(head)->frag_list;
    1618 +
    1619 /*
    1620 * Pad out the previous subframe to a multiple of 4 by adding the
    1621 * padding to the next one, that's being added. Note that head->len
    1622 diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
    1623 index bca47fad5a162..4eed23e276104 100644
    1624 --- a/net/mac80211/wpa.c
    1625 +++ b/net/mac80211/wpa.c
    1626 @@ -520,6 +520,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
    1627 return RX_DROP_UNUSABLE;
    1628 }
    1629
    1630 + /* reload hdr - skb might have been reallocated */
    1631 + hdr = (void *)rx->skb->data;
    1632 +
    1633 data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
    1634 if (!rx->sta || data_len < 0)
    1635 return RX_DROP_UNUSABLE;
    1636 @@ -749,6 +752,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
    1637 return RX_DROP_UNUSABLE;
    1638 }
    1639
    1640 + /* reload hdr - skb might have been reallocated */
    1641 + hdr = (void *)rx->skb->data;
    1642 +
    1643 data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
    1644 if (!rx->sta || data_len < 0)
    1645 return RX_DROP_UNUSABLE;
    1646 diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
    1647 index 500de37858ac8..1b44dfa7ba856 100644
    1648 --- a/net/netfilter/ipset/ip_set_hash_gen.h
    1649 +++ b/net/netfilter/ipset/ip_set_hash_gen.h
    1650 @@ -132,11 +132,11 @@ htable_size(u8 hbits)
    1651 {
    1652 size_t hsize;
    1653
    1654 - /* We must fit both into u32 in jhash and size_t */
    1655 + /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
    1656 if (hbits > 31)
    1657 return 0;
    1658 hsize = jhash_size(hbits);
    1659 - if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)
    1660 + if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
    1661 < hsize)
    1662 return 0;
    1663
    1664 diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
    1665 index 02f2f636798d1..d1524ca4b90ef 100644
    1666 --- a/net/netfilter/ipvs/ip_vs_conn.c
    1667 +++ b/net/netfilter/ipvs/ip_vs_conn.c
    1668 @@ -1394,6 +1394,10 @@ int __init ip_vs_conn_init(void)
    1669 int idx;
    1670
    1671 /* Compute size and mask */
    1672 + if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
    1673 + pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
    1674 + ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
    1675 + }
    1676 ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
    1677 ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
    1678
    1679 diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
    1680 index c5a0f2c2635ed..26979b4853bdb 100644
    1681 --- a/net/sched/cls_flower.c
    1682 +++ b/net/sched/cls_flower.c
    1683 @@ -1741,18 +1741,24 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
    1684
    1685 arg->count = arg->skip;
    1686
    1687 + rcu_read_lock();
    1688 idr_for_each_entry_continue_ul(&head->handle_idr, f, tmp, id) {
    1689 /* don't return filters that are being deleted */
    1690 if (!refcount_inc_not_zero(&f->refcnt))
    1691 continue;
    1692 + rcu_read_unlock();
    1693 +
    1694 if (arg->fn(tp, f, arg) < 0) {
    1695 __fl_put(f);
    1696 arg->stop = 1;
    1697 + rcu_read_lock();
    1698 break;
    1699 }
    1700 __fl_put(f);
    1701 arg->count++;
    1702 + rcu_read_lock();
    1703 }
    1704 + rcu_read_unlock();
    1705 arg->cookie = id;
    1706 }
    1707
    1708 diff --git a/net/sctp/input.c b/net/sctp/input.c
    1709 index 2aca37717ed1e..9616b600a8766 100644
    1710 --- a/net/sctp/input.c
    1711 +++ b/net/sctp/input.c
    1712 @@ -676,7 +676,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
    1713 ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
    1714
    1715 /* Break out if chunk length is less then minimal. */
    1716 - if (ntohs(ch->length) < sizeof(_ch))
    1717 + if (!ch || ntohs(ch->length) < sizeof(_ch))
    1718 break;
    1719
    1720 ch_end = offset + SCTP_PAD4(ntohs(ch->length));
    1721 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    1722 index 3098710c9c344..05470ca91bd94 100644
    1723 --- a/net/unix/af_unix.c
    1724 +++ b/net/unix/af_unix.c
    1725 @@ -595,20 +595,42 @@ static void unix_release_sock(struct sock *sk, int embrion)
    1726
    1727 static void init_peercred(struct sock *sk)
    1728 {
    1729 - put_pid(sk->sk_peer_pid);
    1730 - if (sk->sk_peer_cred)
    1731 - put_cred(sk->sk_peer_cred);
    1732 + const struct cred *old_cred;
    1733 + struct pid *old_pid;
    1734 +
    1735 + spin_lock(&sk->sk_peer_lock);
    1736 + old_pid = sk->sk_peer_pid;
    1737 + old_cred = sk->sk_peer_cred;
    1738 sk->sk_peer_pid = get_pid(task_tgid(current));
    1739 sk->sk_peer_cred = get_current_cred();
    1740 + spin_unlock(&sk->sk_peer_lock);
    1741 +
    1742 + put_pid(old_pid);
    1743 + put_cred(old_cred);
    1744 }
    1745
    1746 static void copy_peercred(struct sock *sk, struct sock *peersk)
    1747 {
    1748 - put_pid(sk->sk_peer_pid);
    1749 - if (sk->sk_peer_cred)
    1750 - put_cred(sk->sk_peer_cred);
    1751 + const struct cred *old_cred;
    1752 + struct pid *old_pid;
    1753 +
    1754 + if (sk < peersk) {
    1755 + spin_lock(&sk->sk_peer_lock);
    1756 + spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING);
    1757 + } else {
    1758 + spin_lock(&peersk->sk_peer_lock);
    1759 + spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING);
    1760 + }
    1761 + old_pid = sk->sk_peer_pid;
    1762 + old_cred = sk->sk_peer_cred;
    1763 sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);
    1764 sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
    1765 +
    1766 + spin_unlock(&sk->sk_peer_lock);
    1767 + spin_unlock(&peersk->sk_peer_lock);
    1768 +
    1769 + put_pid(old_pid);
    1770 + put_cred(old_cred);
    1771 }
    1772
    1773 static int unix_listen(struct socket *sock, int backlog)
    1774 diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
    1775 index 59ea56945e6cd..b497bb85b667f 100755
    1776 --- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
    1777 +++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
    1778 @@ -112,6 +112,14 @@ setup()
    1779 ip netns add "${NS2}"
    1780 ip netns add "${NS3}"
    1781
    1782 + # rp_filter gets confused by what these tests are doing, so disable it
    1783 + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1784 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1785 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1786 + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.default.rp_filter=0
    1787 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0
    1788 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0
    1789 +
    1790 ip link add veth1 type veth peer name veth2
    1791 ip link add veth3 type veth peer name veth4
    1792 ip link add veth5 type veth peer name veth6
    1793 @@ -236,11 +244,6 @@ setup()
    1794 ip -netns ${NS1} -6 route add ${IPv6_GRE}/128 dev veth5 via ${IPv6_6} ${VRF}
    1795 ip -netns ${NS2} -6 route add ${IPv6_GRE}/128 dev veth7 via ${IPv6_8} ${VRF}
    1796
    1797 - # rp_filter gets confused by what these tests are doing, so disable it
    1798 - ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1799 - ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1800 - ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
    1801 -
    1802 TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX)
    1803
    1804 sleep 1 # reduce flakiness