Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0317-5.4.218-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-5.4/0317-5.4.218-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (hide annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (19 months, 2 weeks ago) by niro
    File size: 39774 byte(s) 
    -sync kernel patches
    1 niro 3635 diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
    2     index 8a9f3559335b5..7e14e26676ec9 100644
    3     --- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
    4     +++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
    5     @@ -34,8 +34,8 @@ Example:
    6     Use specific request line passing from dma
    7     For example, MMC request line is 5
    8    
    9     - sdhci: sdhci@98e00000 {
    10     - compatible = "moxa,moxart-sdhci";
    11     + mmc: mmc@98e00000 {
    12     + compatible = "moxa,moxart-mmc";
    13     reg = <0x98e00000 0x5C>;
    14     interrupts = <5 0>;
    15     clocks = <&clk_apb>;
    16     diff --git a/Makefile b/Makefile
    17     index 201ac8e410a94..c26d5ce1d6768 100644
    18     --- a/Makefile
    19     +++ b/Makefile
    20     @@ -1,7 +1,7 @@
    21     # SPDX-License-Identifier: GPL-2.0
    22     VERSION = 5
    23     PATCHLEVEL = 4
    24     -SUBLEVEL = 217
    25     +SUBLEVEL = 218
    26     EXTRAVERSION =
    27     NAME = Kleptomaniac Octopus
    28    
    29     diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts
    30     index eb5291b0ee3aa..e07b807b4cec5 100644
    31     --- a/arch/arm/boot/dts/moxart-uc7112lx.dts
    32     +++ b/arch/arm/boot/dts/moxart-uc7112lx.dts
    33     @@ -79,7 +79,7 @@
    34     clocks = <&ref12>;
    35     };
    36    
    37     -&sdhci {
    38     +&mmc {
    39     status = "okay";
    40     };
    41    
    42     diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi
    43     index f5f070a874823..764832ddfa78a 100644
    44     --- a/arch/arm/boot/dts/moxart.dtsi
    45     +++ b/arch/arm/boot/dts/moxart.dtsi
    46     @@ -93,8 +93,8 @@
    47     clock-names = "PCLK";
    48     };
    49    
    50     - sdhci: sdhci@98e00000 {
    51     - compatible = "moxa,moxart-sdhci";
    52     + mmc: mmc@98e00000 {
    53     + compatible = "moxa,moxart-mmc";
    54     reg = <0x98e00000 0x5C>;
    55     interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
    56     clocks = <&clk_apb>;
    57     diff --git a/arch/um/Makefile b/arch/um/Makefile
    58     index 275f5ffdf6f0a..773120be0f56f 100644
    59     --- a/arch/um/Makefile
    60     +++ b/arch/um/Makefile
    61     @@ -132,10 +132,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT)
    62     # The wrappers will select whether using "malloc" or the kernel allocator.
    63     LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
    64    
    65     +# Avoid binutils 2.39+ warnings by marking the stack non-executable and
    66     +# ignorning warnings for the kallsyms sections.
    67     +LDFLAGS_EXECSTACK = -z noexecstack
    68     +ifeq ($(CONFIG_LD_IS_BFD),y)
    69     +LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments)
    70     +endif
    71     +
    72     LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt))
    73    
    74     # Used by link-vmlinux.sh which has special support for um link
    75     export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE)
    76     +export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK)
    77    
    78     # When cleaning we don't include .config, so we don't include
    79     # TT or skas makefiles and don't clean skas_ptregs.h.
    80     diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h
    81     index 68fd2cf526fd7..f6e9f84397e79 100644
    82     --- a/arch/x86/um/shared/sysdep/syscalls_32.h
    83     +++ b/arch/x86/um/shared/sysdep/syscalls_32.h
    84     @@ -6,10 +6,9 @@
    85     #include <asm/unistd.h>
    86     #include <sysdep/ptrace.h>
    87    
    88     -typedef long syscall_handler_t(struct pt_regs);
    89     +typedef long syscall_handler_t(struct syscall_args);
    90    
    91     extern syscall_handler_t *sys_call_table[];
    92    
    93     #define EXECUTE_SYSCALL(syscall, regs) \
    94     - ((long (*)(struct syscall_args)) \
    95     - (*sys_call_table[syscall]))(SYSCALL_ARGS(&regs->regs))
    96     + ((*sys_call_table[syscall]))(SYSCALL_ARGS(&regs->regs))
    97     diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
    98     index ac8eee093f9cd..66162eafd8e8f 100644
    99     --- a/arch/x86/um/tls_32.c
    100     +++ b/arch/x86/um/tls_32.c
    101     @@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)
    102     struct thread_struct *t = &task->thread;
    103     int idx;
    104    
    105     - if (!t->arch.tls_array)
    106     - return GDT_ENTRY_TLS_MIN;
    107     -
    108     for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
    109     if (!t->arch.tls_array[idx].present)
    110     return idx + GDT_ENTRY_TLS_MIN;
    111     @@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info,
    112     {
    113     struct thread_struct *t = &task->thread;
    114    
    115     - if (!t->arch.tls_array)
    116     - goto clear;
    117     -
    118     if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
    119     return -EINVAL;
    120    
    121     diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile
    122     index 0caddd6acb226..bec115036f872 100644
    123     --- a/arch/x86/um/vdso/Makefile
    124     +++ b/arch/x86/um/vdso/Makefile
    125     @@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO $@
    126     -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
    127     sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
    128    
    129     -VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv
    130     +VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack
    131     GCOV_PROFILE := n
    132    
    133     #
    134     diff --git a/drivers/char/mem.c b/drivers/char/mem.c
    135     index 6b56bff9b68cc..c5025ae6a37ed 100644
    136     --- a/drivers/char/mem.c
    137     +++ b/drivers/char/mem.c
    138     @@ -953,8 +953,8 @@ static const struct memdev {
    139     #endif
    140     [5] = { "zero", 0666, &zero_fops, 0 },
    141     [7] = { "full", 0666, &full_fops, 0 },
    142     - [8] = { "random", 0666, &random_fops, 0 },
    143     - [9] = { "urandom", 0666, &urandom_fops, 0 },
    144     + [8] = { "random", 0666, &random_fops, FMODE_NOWAIT },
    145     + [9] = { "urandom", 0666, &urandom_fops, FMODE_NOWAIT },
    146     #ifdef CONFIG_PRINTK
    147     [11] = { "kmsg", 0644, &kmsg_fops, 0 },
    148     #endif
    149     diff --git a/drivers/char/random.c b/drivers/char/random.c
    150     index 1ef94d1125210..364dd5eaebda4 100644
    151     --- a/drivers/char/random.c
    152     +++ b/drivers/char/random.c
    153     @@ -890,20 +890,23 @@ void __init add_bootloader_randomness(const void *buf, size_t len)
    154     }
    155    
    156     struct fast_pool {
    157     - struct work_struct mix;
    158     unsigned long pool[4];
    159     unsigned long last;
    160     unsigned int count;
    161     + struct timer_list mix;
    162     };
    163    
    164     +static void mix_interrupt_randomness(struct timer_list *work);
    165     +
    166     static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = {
    167     #ifdef CONFIG_64BIT
    168     #define FASTMIX_PERM SIPHASH_PERMUTATION
    169     - .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 }
    170     + .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 },
    171     #else
    172     #define FASTMIX_PERM HSIPHASH_PERMUTATION
    173     - .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 }
    174     + .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 },
    175     #endif
    176     + .mix = __TIMER_INITIALIZER(mix_interrupt_randomness, 0)
    177     };
    178    
    179     /*
    180     @@ -945,7 +948,7 @@ int __cold random_online_cpu(unsigned int cpu)
    181     }
    182     #endif
    183    
    184     -static void mix_interrupt_randomness(struct work_struct *work)
    185     +static void mix_interrupt_randomness(struct timer_list *work)
    186     {
    187     struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix);
    188     /*
    189     @@ -976,7 +979,7 @@ static void mix_interrupt_randomness(struct work_struct *work)
    190     local_irq_enable();
    191    
    192     mix_pool_bytes(pool, sizeof(pool));
    193     - credit_init_bits(max(1u, (count & U16_MAX) / 64));
    194     + credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8));
    195    
    196     memzero_explicit(pool, sizeof(pool));
    197     }
    198     @@ -999,10 +1002,11 @@ void add_interrupt_randomness(int irq)
    199     if (new_count < 1024 && !time_is_before_jiffies(fast_pool->last + HZ))
    200     return;
    201    
    202     - if (unlikely(!fast_pool->mix.func))
    203     - INIT_WORK(&fast_pool->mix, mix_interrupt_randomness);
    204     fast_pool->count |= MIX_INFLIGHT;
    205     - queue_work_on(raw_smp_processor_id(), system_highpri_wq, &fast_pool->mix);
    206     + if (!timer_pending(&fast_pool->mix)) {
    207     + fast_pool->mix.expires = jiffies;
    208     + add_timer_on(&fast_pool->mix, raw_smp_processor_id());
    209     + }
    210     }
    211     EXPORT_SYMBOL_GPL(add_interrupt_randomness);
    212    
    213     @@ -1294,6 +1298,11 @@ static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
    214     {
    215     int ret;
    216    
    217     + if (!crng_ready() &&
    218     + ((kiocb->ki_flags & IOCB_NOWAIT) ||
    219     + (kiocb->ki_filp->f_flags & O_NONBLOCK)))
    220     + return -EAGAIN;
    221     +
    222     ret = wait_for_random_bytes();
    223     if (ret != 0)
    224     return ret;
    225     diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
    226     index 7729b8d22553e..3bb711e735ab9 100644
    227     --- a/drivers/dma/xilinx/xilinx_dma.c
    228     +++ b/drivers/dma/xilinx/xilinx_dma.c
    229     @@ -2683,7 +2683,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
    230     if (err < 0) {
    231     dev_err(xdev->dev,
    232     "missing xlnx,num-fstores property\n");
    233     - return err;
    234     + goto disable_clks;
    235     }
    236    
    237     err = of_property_read_u32(node, "xlnx,flush-fsync",
    238     @@ -2703,7 +2703,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
    239     xdev->ext_addr = false;
    240    
    241     /* Set the dma mask bits */
    242     - dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
    243     + err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
    244     + if (err < 0) {
    245     + dev_err(xdev->dev, "DMA mask error %d\n", err);
    246     + goto disable_clks;
    247     + }
    248    
    249     /* Initialize the DMA engine */
    250     xdev->common.dev = &pdev->dev;
    251     diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
    252     index 177874adccf0d..b0c8962b98854 100644
    253     --- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
    254     +++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
    255     @@ -106,9 +106,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
    256     scmi_pd_data->domains = domains;
    257     scmi_pd_data->num_domains = num_domains;
    258    
    259     + dev_set_drvdata(dev, scmi_pd_data);
    260     +
    261     return of_genpd_add_provider_onecell(np, scmi_pd_data);
    262     }
    263    
    264     +static void scmi_pm_domain_remove(struct scmi_device *sdev)
    265     +{
    266     + int i;
    267     + struct genpd_onecell_data *scmi_pd_data;
    268     + struct device *dev = &sdev->dev;
    269     + struct device_node *np = dev->of_node;
    270     +
    271     + of_genpd_del_provider(np);
    272     +
    273     + scmi_pd_data = dev_get_drvdata(dev);
    274     + for (i = 0; i < scmi_pd_data->num_domains; i++) {
    275     + if (!scmi_pd_data->domains[i])
    276     + continue;
    277     + pm_genpd_remove(scmi_pd_data->domains[i]);
    278     + }
    279     +}
    280     +
    281     static const struct scmi_device_id scmi_id_table[] = {
    282     { SCMI_PROTOCOL_POWER },
    283     { },
    284     @@ -118,6 +137,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);
    285     static struct scmi_driver scmi_power_domain_driver = {
    286     .name = "scmi-power-domain",
    287     .probe = scmi_pm_domain_probe,
    288     + .remove = scmi_pm_domain_remove,
    289     .id_table = scmi_id_table,
    290     };
    291     module_scmi_driver(scmi_power_domain_driver);
    292     diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
    293     index ba101afcfc27f..70dedc0f7827c 100644
    294     --- a/drivers/input/joystick/xpad.c
    295     +++ b/drivers/input/joystick/xpad.c
    296     @@ -112,6 +112,8 @@ static const struct xpad_device {
    297     u8 xtype;
    298     } xpad_device[] = {
    299     { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
    300     + { 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 },
    301     + { 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
    302     { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
    303     { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
    304     { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
    305     @@ -242,6 +244,7 @@ static const struct xpad_device {
    306     { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
    307     { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
    308     { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
    309     + { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
    310     { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
    311     { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
    312     { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
    313     @@ -258,6 +261,7 @@ static const struct xpad_device {
    314     { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
    315     { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
    316     { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
    317     + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
    318     { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
    319     { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
    320     { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
    321     @@ -322,6 +326,7 @@ static const struct xpad_device {
    322     { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
    323     { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
    324     { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 },
    325     + { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
    326     { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
    327     { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
    328     { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
    329     @@ -331,6 +336,14 @@ static const struct xpad_device {
    330     { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
    331     { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
    332     { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
    333     + { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
    334     + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
    335     + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
    336     + { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
    337     + { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
    338     + { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 },
    339     + { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
    340     + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
    341     { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
    342     { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
    343     { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
    344     @@ -416,6 +429,7 @@ static const signed short xpad_abs_triggers[] = {
    345     static const struct usb_device_id xpad_table[] = {
    346     { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */
    347     XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */
    348     + XPAD_XBOX360_VENDOR(0x03eb), /* Wooting Keyboards (Legacy) */
    349     XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */
    350     XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */
    351     XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */
    352     @@ -426,6 +440,7 @@ static const struct usb_device_id xpad_table[] = {
    353     { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
    354     XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
    355     XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz GamePad */
    356     + XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
    357     XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f X-Box 360 controllers */
    358     XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */
    359     XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
    360     @@ -446,8 +461,12 @@ static const struct usb_device_id xpad_table[] = {
    361     XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */
    362     XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */
    363     XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */
    364     + XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
    365     + XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
    366     + XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */
    367     XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */
    368     XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
    369     + XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
    370     XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
    371     { }
    372     };
    373     @@ -1964,7 +1983,6 @@ static struct usb_driver xpad_driver = {
    374     .disconnect = xpad_disconnect,
    375     .suspend = xpad_suspend,
    376     .resume = xpad_resume,
    377     - .reset_resume = xpad_resume,
    378     .id_table = xpad_table,
    379     };
    380    
    381     diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
    382     index c6d7a0adde0db..9222931ef8f11 100644
    383     --- a/drivers/mmc/core/sd.c
    384     +++ b/drivers/mmc/core/sd.c
    385     @@ -799,7 +799,8 @@ try_again:
    386     * the CCS bit is set as well. We deliberately deviate from the spec in
    387     * regards to this, which allows UHS-I to be supported for SDSC cards.
    388     */
    389     - if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) {
    390     + if (!mmc_host_is_spi(host) && (ocr & SD_OCR_S18R) &&
    391     + rocr && (*rocr & SD_ROCR_S18A)) {
    392     err = mmc_set_uhs_voltage(host, pocr);
    393     if (err == -EAGAIN) {
    394     retries--;
    395     diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    396     index 6b0ad6b4dd4b1..3a3a5a5706942 100644
    397     --- a/drivers/net/wireless/mac80211_hwsim.c
    398     +++ b/drivers/net/wireless/mac80211_hwsim.c
    399     @@ -3411,6 +3411,8 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
    400    
    401     rx_status.band = data2->channel->band;
    402     rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
    403     + if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
    404     + goto out;
    405     rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
    406    
    407     hdr = (void *)skb->data;
    408     diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
    409     index 0f10b3f847051..b240830a0aab0 100644
    410     --- a/drivers/rpmsg/qcom_glink_native.c
    411     +++ b/drivers/rpmsg/qcom_glink_native.c
    412     @@ -1472,7 +1472,7 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)
    413     cancel_work_sync(&channel->intent_work);
    414    
    415     if (channel->rpdev) {
    416     - strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
    417     + strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
    418     chinfo.src = RPMSG_ADDR_ANY;
    419     chinfo.dst = RPMSG_ADDR_ANY;
    420    
    421     diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
    422     index 0b1e853d8c91a..b5167ef93abf9 100644
    423     --- a/drivers/rpmsg/qcom_smd.c
    424     +++ b/drivers/rpmsg/qcom_smd.c
    425     @@ -1073,7 +1073,7 @@ static int qcom_smd_create_device(struct qcom_smd_channel *channel)
    426    
    427     /* Assign public information to the rpmsg_device */
    428     rpdev = &qsdev->rpdev;
    429     - strncpy(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
    430     + strscpy_pad(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
    431     rpdev->src = RPMSG_ADDR_ANY;
    432     rpdev->dst = RPMSG_ADDR_ANY;
    433    
    434     @@ -1304,7 +1304,7 @@ static void qcom_channel_state_worker(struct work_struct *work)
    435    
    436     spin_unlock_irqrestore(&edge->channels_lock, flags);
    437    
    438     - strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
    439     + strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
    440     chinfo.src = RPMSG_ADDR_ANY;
    441     chinfo.dst = RPMSG_ADDR_ANY;
    442     rpmsg_unregister_device(&edge->dev, &chinfo);
    443     diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
    444     index c95e04cc64240..f864ef059d29e 100644
    445     --- a/drivers/scsi/qedf/qedf_main.c
    446     +++ b/drivers/scsi/qedf/qedf_main.c
    447     @@ -3544,11 +3544,6 @@ err2:
    448     err1:
    449     scsi_host_put(lport->host);
    450     err0:
    451     - if (qedf) {
    452     - QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
    453     -
    454     - clear_bit(QEDF_PROBING, &qedf->flags);
    455     - }
    456     return rc;
    457     }
    458    
    459     diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
    460     index 33287b6bdf0ef..159ffc2bb592f 100644
    461     --- a/drivers/scsi/stex.c
    462     +++ b/drivers/scsi/stex.c
    463     @@ -668,16 +668,17 @@ stex_queuecommand_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
    464     return 0;
    465     case PASSTHRU_CMD:
    466     if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) {
    467     - struct st_drvver ver;
    468     + const struct st_drvver ver = {
    469     + .major = ST_VER_MAJOR,
    470     + .minor = ST_VER_MINOR,
    471     + .oem = ST_OEM,
    472     + .build = ST_BUILD_VER,
    473     + .signature[0] = PASSTHRU_SIGNATURE,
    474     + .console_id = host->max_id - 1,
    475     + .host_no = hba->host->host_no,
    476     + };
    477     size_t cp_len = sizeof(ver);
    478    
    479     - ver.major = ST_VER_MAJOR;
    480     - ver.minor = ST_VER_MINOR;
    481     - ver.oem = ST_OEM;
    482     - ver.build = ST_BUILD_VER;
    483     - ver.signature[0] = PASSTHRU_SIGNATURE;
    484     - ver.console_id = host->max_id - 1;
    485     - ver.host_no = hba->host->host_no;
    486     cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len);
    487     cmd->result = sizeof(ver) == cp_len ?
    488     DID_OK << 16 | COMMAND_COMPLETE << 8 :
    489     diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
    490     index f48a23adbc35d..094e812e9e692 100644
    491     --- a/drivers/usb/mon/mon_bin.c
    492     +++ b/drivers/usb/mon/mon_bin.c
    493     @@ -1268,6 +1268,11 @@ static int mon_bin_mmap(struct file *filp, struct vm_area_struct *vma)
    494     {
    495     /* don't do anything here: "fault" will set up page table entries */
    496     vma->vm_ops = &mon_bin_vm_ops;
    497     +
    498     + if (vma->vm_flags & VM_WRITE)
    499     + return -EPERM;
    500     +
    501     + vma->vm_flags &= ~VM_MAYWRITE;
    502     vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
    503     vma->vm_private_data = filp->private_data;
    504     mon_bin_vma_open(vma);
    505     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    506     index ed1b26193d7a3..9041051000740 100644
    507     --- a/drivers/usb/serial/ftdi_sio.c
    508     +++ b/drivers/usb/serial/ftdi_sio.c
    509     @@ -1320,8 +1320,7 @@ static u32 get_ftdi_divisor(struct tty_struct *tty,
    510     case 38400: div_value = ftdi_sio_b38400; break;
    511     case 57600: div_value = ftdi_sio_b57600; break;
    512     case 115200: div_value = ftdi_sio_b115200; break;
    513     - } /* baud */
    514     - if (div_value == 0) {
    515     + default:
    516     dev_dbg(dev, "%s - Baudrate (%d) requested is not supported\n",
    517     __func__, baud);
    518     div_value = ftdi_sio_b9600;
    519     diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    520     index 3f437f07356b4..b7ba15d0ed6c1 100644
    521     --- a/drivers/usb/serial/qcserial.c
    522     +++ b/drivers/usb/serial/qcserial.c
    523     @@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = {
    524     {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
    525     {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
    526     {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
    527     + {DEVICE_SWI(0x413c, 0x81c2)}, /* Dell Wireless 5811e */
    528     {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */
    529     {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */
    530     {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
    531     diff --git a/fs/ceph/file.c b/fs/ceph/file.c
    532     index aa1eac6d89f2e..83122fc5f8130 100644
    533     --- a/fs/ceph/file.c
    534     +++ b/fs/ceph/file.c
    535     @@ -452,6 +452,12 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
    536     if (dentry->d_name.len > NAME_MAX)
    537     return -ENAMETOOLONG;
    538    
    539     + /*
    540     + * Do not truncate the file, since atomic_open is called before the
    541     + * permission check. The caller will do the truncation afterward.
    542     + */
    543     + flags &= ~O_TRUNC;
    544     +
    545     if (flags & O_CREAT) {
    546     if (ceph_quota_is_max_files_exceeded(dir))
    547     return -EDQUOT;
    548     @@ -490,9 +496,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
    549    
    550     req->r_parent = dir;
    551     set_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags);
    552     - err = ceph_mdsc_do_request(mdsc,
    553     - (flags & (O_CREAT|O_TRUNC)) ? dir : NULL,
    554     - req);
    555     + err = ceph_mdsc_do_request(mdsc, (flags & O_CREAT) ? dir : NULL, req);
    556     err = ceph_handle_snapdir(req, dentry, err);
    557     if (err)
    558     goto out_req;
    559     diff --git a/fs/inode.c b/fs/inode.c
    560     index c5267a4db0f5e..140a62e5382cb 100644
    561     --- a/fs/inode.c
    562     +++ b/fs/inode.c
    563     @@ -167,8 +167,6 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
    564     inode->i_wb_frn_history = 0;
    565     #endif
    566    
    567     - if (security_inode_alloc(inode))
    568     - goto out;
    569     spin_lock_init(&inode->i_lock);
    570     lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
    571    
    572     @@ -199,11 +197,12 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
    573     inode->i_fsnotify_mask = 0;
    574     #endif
    575     inode->i_flctx = NULL;
    576     +
    577     + if (unlikely(security_inode_alloc(inode)))
    578     + return -ENOMEM;
    579     this_cpu_inc(nr_inodes);
    580    
    581     return 0;
    582     -out:
    583     - return -ENOMEM;
    584     }
    585     EXPORT_SYMBOL(inode_init_always);
    586    
    587     diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
    588     index 35b0bfe9324f2..b8ebfb16c8ec8 100644
    589     --- a/fs/nilfs2/inode.c
    590     +++ b/fs/nilfs2/inode.c
    591     @@ -451,6 +451,8 @@ int nilfs_read_inode_common(struct inode *inode,
    592     inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
    593     inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec);
    594     inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
    595     + if (nilfs_is_metadata_file_inode(inode) && !S_ISREG(inode->i_mode))
    596     + return -EIO; /* this inode is for metadata and corrupted */
    597     if (inode->i_nlink == 0)
    598     return -ESTALE; /* this inode is deleted */
    599    
    600     diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
    601     index eb3ac76190887..535543ab4e26a 100644
    602     --- a/fs/nilfs2/segment.c
    603     +++ b/fs/nilfs2/segment.c
    604     @@ -880,9 +880,11 @@ static int nilfs_segctor_create_checkpoint(struct nilfs_sc_info *sci)
    605     nilfs_mdt_mark_dirty(nilfs->ns_cpfile);
    606     nilfs_cpfile_put_checkpoint(
    607     nilfs->ns_cpfile, nilfs->ns_cno, bh_cp);
    608     - } else
    609     - WARN_ON(err == -EINVAL || err == -ENOENT);
    610     -
    611     + } else if (err == -EINVAL || err == -ENOENT) {
    612     + nilfs_error(sci->sc_super,
    613     + "checkpoint creation failed due to metadata corruption.");
    614     + err = -EIO;
    615     + }
    616     return err;
    617     }
    618    
    619     @@ -896,7 +898,11 @@ static int nilfs_segctor_fill_in_checkpoint(struct nilfs_sc_info *sci)
    620     err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, nilfs->ns_cno, 0,
    621     &raw_cp, &bh_cp);
    622     if (unlikely(err)) {
    623     - WARN_ON(err == -EINVAL || err == -ENOENT);
    624     + if (err == -EINVAL || err == -ENOENT) {
    625     + nilfs_error(sci->sc_super,
    626     + "checkpoint finalization failed due to metadata corruption.");
    627     + err = -EIO;
    628     + }
    629     goto failed_ibh;
    630     }
    631     raw_cp->cp_snapshot_list.ssl_next = 0;
    632     @@ -2786,10 +2792,9 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root)
    633     inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);
    634    
    635     err = nilfs_segctor_start_thread(nilfs->ns_writer);
    636     - if (err) {
    637     - kfree(nilfs->ns_writer);
    638     - nilfs->ns_writer = NULL;
    639     - }
    640     + if (unlikely(err))
    641     + nilfs_detach_log_writer(sb);
    642     +
    643     return err;
    644     }
    645    
    646     diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
    647     index d0d188c3294bd..a8994f307fc38 100644
    648     --- a/include/net/ieee802154_netdev.h
    649     +++ b/include/net/ieee802154_netdev.h
    650     @@ -15,6 +15,22 @@
    651     #ifndef IEEE802154_NETDEVICE_H
    652     #define IEEE802154_NETDEVICE_H
    653    
    654     +#define IEEE802154_REQUIRED_SIZE(struct_type, member) \
    655     + (offsetof(typeof(struct_type), member) + \
    656     + sizeof(((typeof(struct_type) *)(NULL))->member))
    657     +
    658     +#define IEEE802154_ADDR_OFFSET \
    659     + offsetof(typeof(struct sockaddr_ieee802154), addr)
    660     +
    661     +#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \
    662     + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type))
    663     +
    664     +#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \
    665     + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr))
    666     +
    667     +#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \
    668     + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr))
    669     +
    670     #include <net/af_ieee802154.h>
    671     #include <linux/netdevice.h>
    672     #include <linux/skbuff.h>
    673     @@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
    674     memcpy(raw, &temp, IEEE802154_ADDR_LEN);
    675     }
    676    
    677     +static inline int
    678     +ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len)
    679     +{
    680     + struct ieee802154_addr_sa *sa;
    681     +
    682     + sa = &daddr->addr;
    683     + if (len < IEEE802154_MIN_NAMELEN)
    684     + return -EINVAL;
    685     + switch (sa->addr_type) {
    686     + case IEEE802154_ADDR_SHORT:
    687     + if (len < IEEE802154_NAMELEN_SHORT)
    688     + return -EINVAL;
    689     + break;
    690     + case IEEE802154_ADDR_LONG:
    691     + if (len < IEEE802154_NAMELEN_LONG)
    692     + return -EINVAL;
    693     + break;
    694     + }
    695     + return 0;
    696     +}
    697     +
    698     static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
    699     const struct ieee802154_addr_sa *sa)
    700     {
    701     diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
    702     index 91bd749a02f7a..7738a055d9535 100644
    703     --- a/include/scsi/scsi_cmnd.h
    704     +++ b/include/scsi/scsi_cmnd.h
    705     @@ -204,7 +204,7 @@ static inline int scsi_get_resid(struct scsi_cmnd *cmd)
    706     for_each_sg(scsi_sglist(cmd), sg, nseg, __i)
    707    
    708     static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd,
    709     - void *buf, int buflen)
    710     + const void *buf, int buflen)
    711     {
    712     return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd),
    713     buf, buflen);
    714     diff --git a/mm/pagewalk.c b/mm/pagewalk.c
    715     index 4eb09e0898817..ec41e7552f37c 100644
    716     --- a/mm/pagewalk.c
    717     +++ b/mm/pagewalk.c
    718     @@ -38,7 +38,7 @@ static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
    719     do {
    720     again:
    721     next = pmd_addr_end(addr, end);
    722     - if (pmd_none(*pmd) || !walk->vma) {
    723     + if (pmd_none(*pmd)) {
    724     if (ops->pte_hole)
    725     err = ops->pte_hole(addr, next, walk);
    726     if (err)
    727     @@ -84,7 +84,7 @@ static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end,
    728     do {
    729     again:
    730     next = pud_addr_end(addr, end);
    731     - if (pud_none(*pud) || !walk->vma) {
    732     + if (pud_none(*pud)) {
    733     if (ops->pte_hole)
    734     err = ops->pte_hole(addr, next, walk);
    735     if (err)
    736     @@ -254,7 +254,7 @@ static int __walk_page_range(unsigned long start, unsigned long end,
    737     int err = 0;
    738     struct vm_area_struct *vma = walk->vma;
    739    
    740     - if (vma && is_vm_hugetlb_page(vma)) {
    741     + if (is_vm_hugetlb_page(vma)) {
    742     if (walk->ops->hugetlb_entry)
    743     err = walk_hugetlb_range(start, end, walk);
    744     } else
    745     @@ -324,9 +324,13 @@ int walk_page_range(struct mm_struct *mm, unsigned long start,
    746     if (!vma) { /* after the last vma */
    747     walk.vma = NULL;
    748     next = end;
    749     + if (ops->pte_hole)
    750     + err = ops->pte_hole(start, next, &walk);
    751     } else if (start < vma->vm_start) { /* outside vma */
    752     walk.vma = NULL;
    753     next = min(end, vma->vm_start);
    754     + if (ops->pte_hole)
    755     + err = ops->pte_hole(start, next, &walk);
    756     } else { /* inside vma */
    757     walk.vma = vma;
    758     next = min(end, vma->vm_end);
    759     @@ -344,9 +348,8 @@ int walk_page_range(struct mm_struct *mm, unsigned long start,
    760     }
    761     if (err < 0)
    762     break;
    763     - }
    764     - if (walk.vma || walk.ops->pte_hole)
    765     err = __walk_page_range(start, next, &walk);
    766     + }
    767     if (err)
    768     break;
    769     } while (start = next, start < end);
    770     diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
    771     index 9a675ba0bf0a8..a92b11999e5f2 100644
    772     --- a/net/ieee802154/socket.c
    773     +++ b/net/ieee802154/socket.c
    774     @@ -201,8 +201,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
    775     int err = 0;
    776     struct net_device *dev = NULL;
    777    
    778     - if (len < sizeof(*uaddr))
    779     - return -EINVAL;
    780     + err = ieee802154_sockaddr_check_size(uaddr, len);
    781     + if (err < 0)
    782     + return err;
    783    
    784     uaddr = (struct sockaddr_ieee802154 *)_uaddr;
    785     if (uaddr->family != AF_IEEE802154)
    786     @@ -498,7 +499,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
    787    
    788     ro->bound = 0;
    789    
    790     - if (len < sizeof(*addr))
    791     + err = ieee802154_sockaddr_check_size(addr, len);
    792     + if (err < 0)
    793     goto out;
    794    
    795     if (addr->family != AF_IEEE802154)
    796     @@ -569,8 +571,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr,
    797     struct dgram_sock *ro = dgram_sk(sk);
    798     int err = 0;
    799    
    800     - if (len < sizeof(*addr))
    801     - return -EINVAL;
    802     + err = ieee802154_sockaddr_check_size(addr, len);
    803     + if (err < 0)
    804     + return err;
    805    
    806     if (addr->family != AF_IEEE802154)
    807     return -EINVAL;
    808     @@ -609,6 +612,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
    809     struct ieee802154_mac_cb *cb;
    810     struct dgram_sock *ro = dgram_sk(sk);
    811     struct ieee802154_addr dst_addr;
    812     + DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name);
    813     int hlen, tlen;
    814     int err;
    815    
    816     @@ -617,10 +621,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
    817     return -EOPNOTSUPP;
    818     }
    819    
    820     - if (!ro->connected && !msg->msg_name)
    821     - return -EDESTADDRREQ;
    822     - else if (ro->connected && msg->msg_name)
    823     - return -EISCONN;
    824     + if (msg->msg_name) {
    825     + if (ro->connected)
    826     + return -EISCONN;
    827     + if (msg->msg_namelen < IEEE802154_MIN_NAMELEN)
    828     + return -EINVAL;
    829     + err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen);
    830     + if (err < 0)
    831     + return err;
    832     + ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
    833     + } else {
    834     + if (!ro->connected)
    835     + return -EDESTADDRREQ;
    836     + dst_addr = ro->dst_addr;
    837     + }
    838    
    839     if (!ro->bound)
    840     dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
    841     @@ -656,16 +670,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
    842     cb = mac_cb_init(skb);
    843     cb->type = IEEE802154_FC_TYPE_DATA;
    844     cb->ackreq = ro->want_ack;
    845     -
    846     - if (msg->msg_name) {
    847     - DECLARE_SOCKADDR(struct sockaddr_ieee802154*,
    848     - daddr, msg->msg_name);
    849     -
    850     - ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
    851     - } else {
    852     - dst_addr = ro->dst_addr;
    853     - }
    854     -
    855     cb->secen = ro->secen;
    856     cb->secen_override = ro->secen_override;
    857     cb->seclevel = ro->seclevel;
    858     diff --git a/net/mac80211/util.c b/net/mac80211/util.c
    859     index c1c117fdf3184..a529861256e62 100644
    860     --- a/net/mac80211/util.c
    861     +++ b/net/mac80211/util.c
    862     @@ -1289,6 +1289,8 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
    863     for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
    864     if (elem->datalen < 2)
    865     continue;
    866     + if (elem->data[0] < 1 || elem->data[0] > 8)
    867     + continue;
    868    
    869     for_each_element(sub, elem->data + 1, elem->datalen - 1) {
    870     u8 new_bssid[ETH_ALEN];
    871     diff --git a/net/wireless/scan.c b/net/wireless/scan.c
    872     index 6bb9437af28bf..c433235e6390a 100644
    873     --- a/net/wireless/scan.c
    874     +++ b/net/wireless/scan.c
    875     @@ -104,18 +104,12 @@ static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
    876     lockdep_assert_held(&rdev->bss_lock);
    877    
    878     bss->refcount++;
    879     - if (bss->pub.hidden_beacon_bss) {
    880     - bss = container_of(bss->pub.hidden_beacon_bss,
    881     - struct cfg80211_internal_bss,
    882     - pub);
    883     - bss->refcount++;
    884     - }
    885     - if (bss->pub.transmitted_bss) {
    886     - bss = container_of(bss->pub.transmitted_bss,
    887     - struct cfg80211_internal_bss,
    888     - pub);
    889     - bss->refcount++;
    890     - }
    891     +
    892     + if (bss->pub.hidden_beacon_bss)
    893     + bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
    894     +
    895     + if (bss->pub.transmitted_bss)
    896     + bss_from_pub(bss->pub.transmitted_bss)->refcount++;
    897     }
    898    
    899     static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
    900     @@ -265,7 +259,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
    901     tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
    902     tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
    903    
    904     - while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
    905     + while (tmp_old + 2 - ie <= ielen &&
    906     + tmp_old + tmp_old[1] + 2 - ie <= ielen) {
    907     if (tmp_old[0] == 0) {
    908     tmp_old++;
    909     continue;
    910     @@ -325,7 +320,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
    911     * copied to new ie, skip ssid, capability, bssid-index ie
    912     */
    913     tmp_new = sub_copy;
    914     - while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
    915     + while (tmp_new + 2 - sub_copy <= subie_len &&
    916     + tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
    917     if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
    918     tmp_new[0] == WLAN_EID_SSID)) {
    919     memcpy(pos, tmp_new, tmp_new[1] + 2);
    920     @@ -390,6 +386,15 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
    921    
    922     rcu_read_unlock();
    923    
    924     + /*
    925     + * This is a bit weird - it's not on the list, but already on another
    926     + * one! The only way that could happen is if there's some BSSID/SSID
    927     + * shared by multiple APs in their multi-BSSID profiles, potentially
    928     + * with hidden SSID mixed in ... ignore it.
    929     + */
    930     + if (!list_empty(&nontrans_bss->nontrans_list))
    931     + return -EINVAL;
    932     +
    933     /* add to the list */
    934     list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
    935     return 0;
    936     @@ -1094,6 +1099,23 @@ struct cfg80211_non_tx_bss {
    937     u8 bssid_index;
    938     };
    939    
    940     +static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
    941     + const struct cfg80211_bss_ies *new_ies,
    942     + const struct cfg80211_bss_ies *old_ies)
    943     +{
    944     + struct cfg80211_internal_bss *bss;
    945     +
    946     + /* Assign beacon IEs to all sub entries */
    947     + list_for_each_entry(bss, &known->hidden_list, hidden_list) {
    948     + const struct cfg80211_bss_ies *ies;
    949     +
    950     + ies = rcu_access_pointer(bss->pub.beacon_ies);
    951     + WARN_ON(ies != old_ies);
    952     +
    953     + rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
    954     + }
    955     +}
    956     +
    957     static bool
    958     cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
    959     struct cfg80211_internal_bss *known,
    960     @@ -1117,7 +1139,6 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
    961     kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
    962     } else if (rcu_access_pointer(new->pub.beacon_ies)) {
    963     const struct cfg80211_bss_ies *old;
    964     - struct cfg80211_internal_bss *bss;
    965    
    966     if (known->pub.hidden_beacon_bss &&
    967     !list_empty(&known->hidden_list)) {
    968     @@ -1145,16 +1166,7 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
    969     if (old == rcu_access_pointer(known->pub.ies))
    970     rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
    971    
    972     - /* Assign beacon IEs to all sub entries */
    973     - list_for_each_entry(bss, &known->hidden_list, hidden_list) {
    974     - const struct cfg80211_bss_ies *ies;
    975     -
    976     - ies = rcu_access_pointer(bss->pub.beacon_ies);
    977     - WARN_ON(ies != old);
    978     -
    979     - rcu_assign_pointer(bss->pub.beacon_ies,
    980     - new->pub.beacon_ies);
    981     - }
    982     + cfg80211_update_hidden_bsses(known, new->pub.beacon_ies, old);
    983    
    984     if (old)
    985     kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
    986     @@ -1231,6 +1243,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
    987     new->refcount = 1;
    988     INIT_LIST_HEAD(&new->hidden_list);
    989     INIT_LIST_HEAD(&new->pub.nontrans_list);
    990     + /* we'll set this later if it was non-NULL */
    991     + new->pub.transmitted_bss = NULL;
    992    
    993     if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
    994     hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
    995     @@ -1460,10 +1474,15 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
    996     spin_lock_bh(&rdev->bss_lock);
    997     if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
    998     &res->pub)) {
    999     - if (__cfg80211_unlink_bss(rdev, res))
    1000     + if (__cfg80211_unlink_bss(rdev, res)) {
    1001     rdev->bss_generation++;
    1002     + res = NULL;
    1003     + }
    1004     }
    1005     spin_unlock_bh(&rdev->bss_lock);
    1006     +
    1007     + if (!res)
    1008     + return NULL;
    1009     }
    1010    
    1011     trace_cfg80211_return_bss(&res->pub);
    1012     @@ -1582,6 +1601,8 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy,
    1013     for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
    1014     if (elem->datalen < 4)
    1015     continue;
    1016     + if (elem->data[0] < 1 || (int)elem->data[0] > 8)
    1017     + continue;
    1018     for_each_element(sub, elem->data + 1, elem->datalen - 1) {
    1019     u8 profile_len;
    1020    
    1021     @@ -1717,7 +1738,7 @@ cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
    1022     size_t new_ie_len;
    1023     struct cfg80211_bss_ies *new_ies;
    1024     const struct cfg80211_bss_ies *old;
    1025     - u8 cpy_len;
    1026     + size_t cpy_len;
    1027    
    1028     lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
    1029    
    1030     @@ -1784,6 +1805,8 @@ cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
    1031     } else {
    1032     old = rcu_access_pointer(nontrans_bss->beacon_ies);
    1033     rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
    1034     + cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
    1035     + new_ies, old);
    1036     rcu_assign_pointer(nontrans_bss->ies, new_ies);
    1037     if (old)
    1038     kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
    1039     diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
    1040     index 452011428d119..2b341aa079644 100644
    1041     --- a/security/integrity/platform_certs/load_uefi.c
    1042     +++ b/security/integrity/platform_certs/load_uefi.c
    1043     @@ -30,7 +30,7 @@ static const struct dmi_system_id uefi_skip_cert[] = {
    1044     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
    1045     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
    1046     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
    1047     - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") },
    1048     + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
    1049     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
    1050     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
    1051     { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
    1052     diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1053     index 5b892e7090ddc..e387e8db65d22 100644
    1054     --- a/sound/pci/hda/hda_intel.c
    1055     +++ b/sound/pci/hda/hda_intel.c
    1056     @@ -2532,7 +2532,8 @@ static const struct pci_device_id azx_ids[] = {
    1057     .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
    1058     /* Poulsbo */
    1059     { PCI_DEVICE(0x8086, 0x811b),
    1060     - .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
    1061     + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE |
    1062     + AZX_DCAPS_POSFIX_LPIB },
    1063     /* Oaktrail */
    1064     { PCI_DEVICE(0x8086, 0x080a),
    1065     .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
    1066     diff --git a/tools/perf/util/get_current_dir_name.c b/tools/perf/util/get_current_dir_name.c
    1067     index b205d929245f5..e68935e9ac8ce 100644
    1068     --- a/tools/perf/util/get_current_dir_name.c
    1069     +++ b/tools/perf/util/get_current_dir_name.c
    1070     @@ -3,8 +3,9 @@
    1071     //
    1072     #ifndef HAVE_GET_CURRENT_DIR_NAME
    1073     #include "get_current_dir_name.h"
    1074     +#include <limits.h>
    1075     +#include <string.h>
    1076     #include <unistd.h>
    1077     -#include <stdlib.h>
    1078    
    1079     /* Android's 'bionic' library, for one, doesn't have this */
    1080