Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.13/0110-4.13.11-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.13/0110-4.13.11-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3019 - (show annotations) (download)
    Mon Nov 6 09:39:50 2017 UTC (6 years, 6 months ago) by niro
    File size: 53411 byte(s) 
    -linux-4.13.11
    1 diff --git a/Makefile b/Makefile
    2 index 0e30a0d282e8..8280953c8a45 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 13
    8 -SUBLEVEL = 10
    9 +SUBLEVEL = 11
    10 EXTRAVERSION =
    11 NAME = Fearless Coyote
    12
    13 diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
    14 index 53766e2bc029..58f6fbc7df39 100644
    15 --- a/arch/powerpc/kvm/book3s_64_vio.c
    16 +++ b/arch/powerpc/kvm/book3s_64_vio.c
    17 @@ -479,28 +479,30 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
    18 return ret;
    19
    20 dir = iommu_tce_direction(tce);
    21 +
    22 + idx = srcu_read_lock(&vcpu->kvm->srcu);
    23 +
    24 if ((dir != DMA_NONE) && kvmppc_gpa_to_ua(vcpu->kvm,
    25 - tce & ~(TCE_PCI_READ | TCE_PCI_WRITE), &ua, NULL))
    26 - return H_PARAMETER;
    27 + tce & ~(TCE_PCI_READ | TCE_PCI_WRITE), &ua, NULL)) {
    28 + ret = H_PARAMETER;
    29 + goto unlock_exit;
    30 + }
    31
    32 entry = ioba >> stt->page_shift;
    33
    34 list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
    35 - if (dir == DMA_NONE) {
    36 + if (dir == DMA_NONE)
    37 ret = kvmppc_tce_iommu_unmap(vcpu->kvm,
    38 stit->tbl, entry);
    39 - } else {
    40 - idx = srcu_read_lock(&vcpu->kvm->srcu);
    41 + else
    42 ret = kvmppc_tce_iommu_map(vcpu->kvm, stit->tbl,
    43 entry, ua, dir);
    44 - srcu_read_unlock(&vcpu->kvm->srcu, idx);
    45 - }
    46
    47 if (ret == H_SUCCESS)
    48 continue;
    49
    50 if (ret == H_TOO_HARD)
    51 - return ret;
    52 + goto unlock_exit;
    53
    54 WARN_ON_ONCE(1);
    55 kvmppc_clear_tce(stit->tbl, entry);
    56 @@ -508,7 +510,10 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
    57
    58 kvmppc_tce_put(stt, entry, tce);
    59
    60 - return H_SUCCESS;
    61 +unlock_exit:
    62 + srcu_read_unlock(&vcpu->kvm->srcu, idx);
    63 +
    64 + return ret;
    65 }
    66 EXPORT_SYMBOL_GPL(kvmppc_h_put_tce);
    67
    68 diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    69 index dc58c2a560f9..e92cb5fd28f2 100644
    70 --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    71 +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    72 @@ -1296,6 +1296,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
    73 bne 3f
    74 BEGIN_FTR_SECTION
    75 PPC_MSGSYNC
    76 + lwsync
    77 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
    78 lbz r0, HSTATE_HOST_IPI(r13)
    79 cmpwi r0, 0
    80 @@ -2767,6 +2768,10 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
    81 PPC_MSGCLR(6)
    82 /* see if it's a host IPI */
    83 li r3, 1
    84 +BEGIN_FTR_SECTION
    85 + PPC_MSGSYNC
    86 + lwsync
    87 +END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
    88 lbz r0, HSTATE_HOST_IPI(r13)
    89 cmpwi r0, 0
    90 bnelr
    91 diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
    92 index 1a75c0b5f4ca..86468190d4b2 100644
    93 --- a/arch/powerpc/kvm/powerpc.c
    94 +++ b/arch/powerpc/kvm/powerpc.c
    95 @@ -639,8 +639,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
    96 break;
    97 #endif
    98 case KVM_CAP_PPC_HTM:
    99 - r = cpu_has_feature(CPU_FTR_TM_COMP) &&
    100 - is_kvmppc_hv_enabled(kvm);
    101 + r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled;
    102 break;
    103 default:
    104 r = 0;
    105 diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
    106 index 6595462b1fc8..6e0c9dee724f 100644
    107 --- a/arch/powerpc/sysdev/xive/common.c
    108 +++ b/arch/powerpc/sysdev/xive/common.c
    109 @@ -447,7 +447,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
    110 int cpu, first, num, i;
    111
    112 /* Pick up a starting point CPU in the mask based on fuzz */
    113 - num = cpumask_weight(mask);
    114 + num = min_t(int, cpumask_weight(mask), nr_cpu_ids);
    115 first = fuzz % num;
    116
    117 /* Locate it */
    118 diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
    119 index 21900e1cee9c..d185aa3965bf 100644
    120 --- a/arch/s390/kernel/entry.S
    121 +++ b/arch/s390/kernel/entry.S
    122 @@ -521,12 +521,15 @@ ENTRY(pgm_check_handler)
    123 tmhh %r8,0x0001 # test problem state bit
    124 jnz 2f # -> fault in user space
    125 #if IS_ENABLED(CONFIG_KVM)
    126 - # cleanup critical section for sie64a
    127 + # cleanup critical section for program checks in sie64a
    128 lgr %r14,%r9
    129 slg %r14,BASED(.Lsie_critical_start)
    130 clg %r14,BASED(.Lsie_critical_length)
    131 jhe 0f
    132 - brasl %r14,.Lcleanup_sie
    133 + lg %r14,__SF_EMPTY(%r15) # get control block pointer
    134 + ni __SIE_PROG0C+3(%r14),0xfe # no longer in SIE
    135 + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce
    136 + larl %r9,sie_exit # skip forward to sie_exit
    137 #endif
    138 0: tmhh %r8,0x4000 # PER bit set in old PSW ?
    139 jnz 1f # -> enabled, can't be a double fault
    140 diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
    141 index 458da8509b75..6db28f17ff28 100644
    142 --- a/arch/x86/kernel/amd_nb.c
    143 +++ b/arch/x86/kernel/amd_nb.c
    144 @@ -27,6 +27,8 @@ static const struct pci_device_id amd_root_ids[] = {
    145 {}
    146 };
    147
    148 +#define PCI_DEVICE_ID_AMD_CNB17H_F4 0x1704
    149 +
    150 const struct pci_device_id amd_nb_misc_ids[] = {
    151 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
    152 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
    153 @@ -37,6 +39,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
    154 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
    155 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
    156 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
    157 + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
    158 {}
    159 };
    160 EXPORT_SYMBOL_GPL(amd_nb_misc_ids);
    161 @@ -48,6 +51,7 @@ static const struct pci_device_id amd_nb_link_ids[] = {
    162 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
    163 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
    164 { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) },
    165 + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
    166 {}
    167 };
    168
    169 @@ -402,11 +406,48 @@ void amd_flush_garts(void)
    170 }
    171 EXPORT_SYMBOL_GPL(amd_flush_garts);
    172
    173 +static void __fix_erratum_688(void *info)
    174 +{
    175 +#define MSR_AMD64_IC_CFG 0xC0011021
    176 +
    177 + msr_set_bit(MSR_AMD64_IC_CFG, 3);
    178 + msr_set_bit(MSR_AMD64_IC_CFG, 14);
    179 +}
    180 +
    181 +/* Apply erratum 688 fix so machines without a BIOS fix work. */
    182 +static __init void fix_erratum_688(void)
    183 +{
    184 + struct pci_dev *F4;
    185 + u32 val;
    186 +
    187 + if (boot_cpu_data.x86 != 0x14)
    188 + return;
    189 +
    190 + if (!amd_northbridges.num)
    191 + return;
    192 +
    193 + F4 = node_to_amd_nb(0)->link;
    194 + if (!F4)
    195 + return;
    196 +
    197 + if (pci_read_config_dword(F4, 0x164, &val))
    198 + return;
    199 +
    200 + if (val & BIT(2))
    201 + return;
    202 +
    203 + on_each_cpu(__fix_erratum_688, NULL, 0);
    204 +
    205 + pr_info("x86/cpu/AMD: CPU erratum 688 worked around\n");
    206 +}
    207 +
    208 static __init int init_amd_nbs(void)
    209 {
    210 amd_cache_northbridges();
    211 amd_cache_gart();
    212
    213 + fix_erratum_688();
    214 +
    215 return 0;
    216 }
    217
    218 diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    219 index da7043893249..ebb60db0e499 100644
    220 --- a/drivers/block/nbd.c
    221 +++ b/drivers/block/nbd.c
    222 @@ -386,6 +386,15 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
    223 return result;
    224 }
    225
    226 +/*
    227 + * Different settings for sk->sk_sndtimeo can result in different return values
    228 + * if there is a signal pending when we enter sendmsg, because reasons?
    229 + */
    230 +static inline int was_interrupted(int result)
    231 +{
    232 + return result == -ERESTARTSYS || result == -EINTR;
    233 +}
    234 +
    235 /* always call with the tx_lock held */
    236 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
    237 {
    238 @@ -458,7 +467,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
    239 result = sock_xmit(nbd, index, 1, &from,
    240 (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
    241 if (result <= 0) {
    242 - if (result == -ERESTARTSYS) {
    243 + if (was_interrupted(result)) {
    244 /* If we havne't sent anything we can just return BUSY,
    245 * however if we have sent something we need to make
    246 * sure we only allow this req to be sent until we are
    247 @@ -502,7 +511,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
    248 }
    249 result = sock_xmit(nbd, index, 1, &from, flags, &sent);
    250 if (result <= 0) {
    251 - if (result == -ERESTARTSYS) {
    252 + if (was_interrupted(result)) {
    253 /* We've already sent the header, we
    254 * have no choice but to set pending and
    255 * return BUSY.
    256 diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
    257 index 1f01020ce3a9..6cdf43a8bf6a 100644
    258 --- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
    259 +++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
    260 @@ -830,7 +830,7 @@ uint32_t smu7_get_xclk(struct pp_hwmgr *hwmgr)
    261 {
    262 uint32_t reference_clock, tmp;
    263 struct cgs_display_info info = {0};
    264 - struct cgs_mode_info mode_info;
    265 + struct cgs_mode_info mode_info = {0};
    266
    267 info.mode_info = &mode_info;
    268
    269 @@ -3951,10 +3951,9 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
    270 uint32_t ref_clock;
    271 uint32_t refresh_rate = 0;
    272 struct cgs_display_info info = {0};
    273 - struct cgs_mode_info mode_info;
    274 + struct cgs_mode_info mode_info = {0};
    275
    276 info.mode_info = &mode_info;
    277 -
    278 cgs_get_active_displays_info(hwmgr->device, &info);
    279 num_active_displays = info.display_count;
    280
    281 @@ -3970,6 +3969,7 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
    282 frame_time_in_us = 1000000 / refresh_rate;
    283
    284 pre_vbi_time_in_us = frame_time_in_us - 200 - mode_info.vblank_time_us;
    285 +
    286 data->frame_time_x2 = frame_time_in_us * 2 / 100;
    287
    288 display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
    289 diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
    290 index f33d90226704..1c3f92533778 100644
    291 --- a/drivers/gpu/drm/i915/i915_perf.c
    292 +++ b/drivers/gpu/drm/i915/i915_perf.c
    293 @@ -2480,6 +2480,10 @@ static const struct file_operations fops = {
    294 .poll = i915_perf_poll,
    295 .read = i915_perf_read,
    296 .unlocked_ioctl = i915_perf_ioctl,
    297 + /* Our ioctl have no arguments, so it's safe to use the same function
    298 + * to handle 32bits compatibility.
    299 + */
    300 + .compat_ioctl = i915_perf_ioctl,
    301 };
    302
    303
    304 diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
    305 index cfbc8ba4c96c..a6b762271a40 100644
    306 --- a/drivers/input/mouse/elan_i2c_core.c
    307 +++ b/drivers/input/mouse/elan_i2c_core.c
    308 @@ -1253,6 +1253,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
    309 { "ELAN0605", 0 },
    310 { "ELAN0609", 0 },
    311 { "ELAN060B", 0 },
    312 + { "ELAN0611", 0 },
    313 { "ELAN1000", 0 },
    314 { }
    315 };
    316 diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
    317 index b796e891e2ee..4b8b9d7aa75e 100644
    318 --- a/drivers/input/tablet/gtco.c
    319 +++ b/drivers/input/tablet/gtco.c
    320 @@ -230,13 +230,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
    321
    322 /* Walk this report and pull out the info we need */
    323 while (i < length) {
    324 - prefix = report[i];
    325 -
    326 - /* Skip over prefix */
    327 - i++;
    328 + prefix = report[i++];
    329
    330 /* Determine data size and save the data in the proper variable */
    331 - size = PREF_SIZE(prefix);
    332 + size = (1U << PREF_SIZE(prefix)) >> 1;
    333 + if (i + size > length) {
    334 + dev_err(ddev,
    335 + "Not enough data (need %d, have %d)\n",
    336 + i + size, length);
    337 + break;
    338 + }
    339 +
    340 switch (size) {
    341 case 1:
    342 data = report[i];
    343 @@ -244,8 +248,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
    344 case 2:
    345 data16 = get_unaligned_le16(&report[i]);
    346 break;
    347 - case 3:
    348 - size = 4;
    349 + case 4:
    350 data32 = get_unaligned_le32(&report[i]);
    351 break;
    352 }
    353 diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
    354 index 68ef0a4cd821..b0c80859f746 100644
    355 --- a/drivers/net/can/sun4i_can.c
    356 +++ b/drivers/net/can/sun4i_can.c
    357 @@ -342,7 +342,7 @@ static int sun4i_can_start(struct net_device *dev)
    358
    359 /* enter the selected mode */
    360 mod_reg_val = readl(priv->base + SUN4I_REG_MSEL_ADDR);
    361 - if (priv->can.ctrlmode & CAN_CTRLMODE_PRESUME_ACK)
    362 + if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)
    363 mod_reg_val |= SUN4I_MSEL_LOOPBACK_MODE;
    364 else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)
    365 mod_reg_val |= SUN4I_MSEL_LISTEN_ONLY_MODE;
    366 @@ -811,7 +811,6 @@ static int sun4ican_probe(struct platform_device *pdev)
    367 priv->can.ctrlmode_supported = CAN_CTRLMODE_BERR_REPORTING |
    368 CAN_CTRLMODE_LISTENONLY |
    369 CAN_CTRLMODE_LOOPBACK |
    370 - CAN_CTRLMODE_PRESUME_ACK |
    371 CAN_CTRLMODE_3_SAMPLES;
    372 priv->base = addr;
    373 priv->clk = clk;
    374 diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
    375 index 18cc529fb807..9b18d96ef526 100644
    376 --- a/drivers/net/can/usb/kvaser_usb.c
    377 +++ b/drivers/net/can/usb/kvaser_usb.c
    378 @@ -137,6 +137,7 @@ static inline bool kvaser_is_usbcan(const struct usb_device_id *id)
    379 #define CMD_RESET_ERROR_COUNTER 49
    380 #define CMD_TX_ACKNOWLEDGE 50
    381 #define CMD_CAN_ERROR_EVENT 51
    382 +#define CMD_FLUSH_QUEUE_REPLY 68
    383
    384 #define CMD_LEAF_USB_THROTTLE 77
    385 #define CMD_LEAF_LOG_MESSAGE 106
    386 @@ -1301,6 +1302,11 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev,
    387 goto warn;
    388 break;
    389
    390 + case CMD_FLUSH_QUEUE_REPLY:
    391 + if (dev->family != KVASER_LEAF)
    392 + goto warn;
    393 + break;
    394 +
    395 default:
    396 warn: dev_warn(dev->udev->dev.parent,
    397 "Unhandled message (%d)\n", msg->id);
    398 @@ -1609,7 +1615,8 @@ static int kvaser_usb_close(struct net_device *netdev)
    399 if (err)
    400 netdev_warn(netdev, "Cannot flush queue, error %d\n", err);
    401
    402 - if (kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel))
    403 + err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel);
    404 + if (err)
    405 netdev_warn(netdev, "Cannot reset card, error %d\n", err);
    406
    407 err = kvaser_usb_stop_chip(priv);
    408 diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
    409 index 5c2a08ef08ba..0cc96e9ae6ff 100644
    410 --- a/drivers/nvme/host/fc.c
    411 +++ b/drivers/nvme/host/fc.c
    412 @@ -2477,10 +2477,10 @@ nvme_fc_delete_association(struct nvme_fc_ctrl *ctrl)
    413 nvme_fc_abort_aen_ops(ctrl);
    414
    415 /* wait for all io that had to be aborted */
    416 - spin_lock_irqsave(&ctrl->lock, flags);
    417 + spin_lock_irq(&ctrl->lock);
    418 wait_event_lock_irq(ctrl->ioabort_wait, ctrl->iocnt == 0, ctrl->lock);
    419 ctrl->flags &= ~FCCTRL_TERMIO;
    420 - spin_unlock_irqrestore(&ctrl->lock, flags);
    421 + spin_unlock_irq(&ctrl->lock);
    422
    423 nvme_fc_term_aen_ops(ctrl);
    424
    425 @@ -2693,6 +2693,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
    426 ctrl->rport = rport;
    427 ctrl->dev = lport->dev;
    428 ctrl->cnum = idx;
    429 + init_waitqueue_head(&ctrl->ioabort_wait);
    430
    431 get_device(ctrl->dev);
    432 kref_init(&ctrl->ref);
    433 diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
    434 index 60f431831582..ca29d49fdadd 100644
    435 --- a/drivers/regulator/fan53555.c
    436 +++ b/drivers/regulator/fan53555.c
    437 @@ -476,7 +476,10 @@ static const struct i2c_device_id fan53555_id[] = {
    438 .name = "fan53555",
    439 .driver_data = FAN53555_VENDOR_FAIRCHILD
    440 }, {
    441 - .name = "syr82x",
    442 + .name = "syr827",
    443 + .driver_data = FAN53555_VENDOR_SILERGY
    444 + }, {
    445 + .name = "syr828",
    446 .driver_data = FAN53555_VENDOR_SILERGY
    447 },
    448 { },
    449 diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
    450 index bcc8f3dfd4c4..b3f9243cfed5 100644
    451 --- a/drivers/s390/scsi/zfcp_aux.c
    452 +++ b/drivers/s390/scsi/zfcp_aux.c
    453 @@ -358,6 +358,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
    454
    455 adapter->next_port_scan = jiffies;
    456
    457 + adapter->erp_action.adapter = adapter;
    458 +
    459 if (zfcp_qdio_setup(adapter))
    460 goto failed;
    461
    462 @@ -514,6 +516,9 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn,
    463 port->dev.groups = zfcp_port_attr_groups;
    464 port->dev.release = zfcp_port_release;
    465
    466 + port->erp_action.adapter = adapter;
    467 + port->erp_action.port = port;
    468 +
    469 if (dev_set_name(&port->dev, "0x%016llx", (unsigned long long)wwpn)) {
    470 kfree(port);
    471 goto err_out;
    472 diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
    473 index 7ccfce559034..3b23d6754598 100644
    474 --- a/drivers/s390/scsi/zfcp_erp.c
    475 +++ b/drivers/s390/scsi/zfcp_erp.c
    476 @@ -193,9 +193,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
    477 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE,
    478 &zfcp_sdev->status);
    479 erp_action = &zfcp_sdev->erp_action;
    480 - memset(erp_action, 0, sizeof(struct zfcp_erp_action));
    481 - erp_action->port = port;
    482 - erp_action->sdev = sdev;
    483 + WARN_ON_ONCE(erp_action->port != port);
    484 + WARN_ON_ONCE(erp_action->sdev != sdev);
    485 if (!(atomic_read(&zfcp_sdev->status) &
    486 ZFCP_STATUS_COMMON_RUNNING))
    487 act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
    488 @@ -208,8 +207,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
    489 zfcp_erp_action_dismiss_port(port);
    490 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &port->status);
    491 erp_action = &port->erp_action;
    492 - memset(erp_action, 0, sizeof(struct zfcp_erp_action));
    493 - erp_action->port = port;
    494 + WARN_ON_ONCE(erp_action->port != port);
    495 + WARN_ON_ONCE(erp_action->sdev != NULL);
    496 if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_RUNNING))
    497 act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
    498 break;
    499 @@ -219,7 +218,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
    500 zfcp_erp_action_dismiss_adapter(adapter);
    501 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status);
    502 erp_action = &adapter->erp_action;
    503 - memset(erp_action, 0, sizeof(struct zfcp_erp_action));
    504 + WARN_ON_ONCE(erp_action->port != NULL);
    505 + WARN_ON_ONCE(erp_action->sdev != NULL);
    506 if (!(atomic_read(&adapter->status) &
    507 ZFCP_STATUS_COMMON_RUNNING))
    508 act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
    509 @@ -229,7 +229,11 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
    510 return NULL;
    511 }
    512
    513 - erp_action->adapter = adapter;
    514 + WARN_ON_ONCE(erp_action->adapter != adapter);
    515 + memset(&erp_action->list, 0, sizeof(erp_action->list));
    516 + memset(&erp_action->timer, 0, sizeof(erp_action->timer));
    517 + erp_action->step = ZFCP_ERP_STEP_UNINITIALIZED;
    518 + erp_action->fsf_req_id = 0;
    519 erp_action->action = need;
    520 erp_action->status = act_status;
    521
    522 diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
    523 index a1eeeaaa0fca..1c11b8402b41 100644
    524 --- a/drivers/s390/scsi/zfcp_scsi.c
    525 +++ b/drivers/s390/scsi/zfcp_scsi.c
    526 @@ -115,10 +115,15 @@ static int zfcp_scsi_slave_alloc(struct scsi_device *sdev)
    527 struct zfcp_unit *unit;
    528 int npiv = adapter->connection_features & FSF_FEATURE_NPIV_MODE;
    529
    530 + zfcp_sdev->erp_action.adapter = adapter;
    531 + zfcp_sdev->erp_action.sdev = sdev;
    532 +
    533 port = zfcp_get_port_by_wwpn(adapter, rport->port_name);
    534 if (!port)
    535 return -ENXIO;
    536
    537 + zfcp_sdev->erp_action.port = port;
    538 +
    539 unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev));
    540 if (unit)
    541 put_device(&unit->dev);
    542 diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
    543 index 9ee025b1d0e0..289b6fe306fd 100644
    544 --- a/drivers/scsi/aacraid/comminit.c
    545 +++ b/drivers/scsi/aacraid/comminit.c
    546 @@ -302,9 +302,11 @@ int aac_send_shutdown(struct aac_dev * dev)
    547 return -ENOMEM;
    548 aac_fib_init(fibctx);
    549
    550 - mutex_lock(&dev->ioctl_mutex);
    551 - dev->adapter_shutdown = 1;
    552 - mutex_unlock(&dev->ioctl_mutex);
    553 + if (!dev->adapter_shutdown) {
    554 + mutex_lock(&dev->ioctl_mutex);
    555 + dev->adapter_shutdown = 1;
    556 + mutex_unlock(&dev->ioctl_mutex);
    557 + }
    558
    559 cmd = (struct aac_close *) fib_data(fibctx);
    560 cmd->command = cpu_to_le32(VM_CloseAll);
    561 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
    562 index 0f277df73af0..231bd3345f44 100644
    563 --- a/drivers/scsi/aacraid/linit.c
    564 +++ b/drivers/scsi/aacraid/linit.c
    565 @@ -1401,8 +1401,9 @@ static void __aac_shutdown(struct aac_dev * aac)
    566 {
    567 int i;
    568
    569 + mutex_lock(&aac->ioctl_mutex);
    570 aac->adapter_shutdown = 1;
    571 - aac_send_shutdown(aac);
    572 + mutex_unlock(&aac->ioctl_mutex);
    573
    574 if (aac->aif_thread) {
    575 int i;
    576 @@ -1415,7 +1416,11 @@ static void __aac_shutdown(struct aac_dev * aac)
    577 }
    578 kthread_stop(aac->thread);
    579 }
    580 +
    581 + aac_send_shutdown(aac);
    582 +
    583 aac_adapter_disable_int(aac);
    584 +
    585 if (aac_is_src(aac)) {
    586 if (aac->max_msix > 1) {
    587 for (i = 0; i < aac->max_msix; i++) {
    588 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
    589 index 5da006d81900..2bf6d4022af0 100644
    590 --- a/drivers/scsi/qla2xxx/qla_os.c
    591 +++ b/drivers/scsi/qla2xxx/qla_os.c
    592 @@ -3051,6 +3051,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
    593 host->max_cmd_len, host->max_channel, host->max_lun,
    594 host->transportt, sht->vendor_id);
    595
    596 + INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
    597 +
    598 /* Set up the irqs */
    599 ret = qla2x00_request_irqs(ha, rsp);
    600 if (ret)
    601 @@ -3165,8 +3167,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
    602 host->can_queue, base_vha->req,
    603 base_vha->mgmt_svr_loop_id, host->sg_tablesize);
    604
    605 - INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
    606 -
    607 if (ha->mqenable) {
    608 bool mq = false;
    609 bool startit = false;
    610 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
    611 index 1a9de8419997..d99b10c73c55 100644
    612 --- a/drivers/scsi/sg.c
    613 +++ b/drivers/scsi/sg.c
    614 @@ -837,7 +837,7 @@ sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
    615
    616 val = 0;
    617 list_for_each_entry(srp, &sfp->rq_list, entry) {
    618 - if (val > SG_MAX_QUEUE)
    619 + if (val >= SG_MAX_QUEUE)
    620 break;
    621 rinfo[val].req_state = srp->done + 1;
    622 rinfo[val].problem =
    623 diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
    624 index 6c7d7a460689..53a04267eb38 100644
    625 --- a/drivers/spi/spi-armada-3700.c
    626 +++ b/drivers/spi/spi-armada-3700.c
    627 @@ -161,7 +161,7 @@ static void a3700_spi_deactivate_cs(struct a3700_spi *a3700_spi,
    628 }
    629
    630 static int a3700_spi_pin_mode_set(struct a3700_spi *a3700_spi,
    631 - unsigned int pin_mode)
    632 + unsigned int pin_mode, bool receiving)
    633 {
    634 u32 val;
    635
    636 @@ -177,6 +177,9 @@ static int a3700_spi_pin_mode_set(struct a3700_spi *a3700_spi,
    637 break;
    638 case SPI_NBITS_QUAD:
    639 val |= A3700_SPI_DATA_PIN1;
    640 + /* RX during address reception uses 4-pin */
    641 + if (receiving)
    642 + val |= A3700_SPI_ADDR_PIN;
    643 break;
    644 default:
    645 dev_err(&a3700_spi->master->dev, "wrong pin mode %u", pin_mode);
    646 @@ -392,7 +395,8 @@ static bool a3700_spi_wait_completion(struct spi_device *spi)
    647
    648 spireg_write(a3700_spi, A3700_SPI_INT_MASK_REG, 0);
    649
    650 - return true;
    651 + /* Timeout was reached */
    652 + return false;
    653 }
    654
    655 static bool a3700_spi_transfer_wait(struct spi_device *spi,
    656 @@ -653,7 +657,7 @@ static int a3700_spi_transfer_one(struct spi_master *master,
    657 else if (xfer->rx_buf)
    658 nbits = xfer->rx_nbits;
    659
    660 - a3700_spi_pin_mode_set(a3700_spi, nbits);
    661 + a3700_spi_pin_mode_set(a3700_spi, nbits, xfer->rx_buf ? true : false);
    662
    663 if (xfer->rx_buf) {
    664 /* Set read data length */
    665 diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
    666 index b19722ba908c..31eb882ed62d 100644
    667 --- a/drivers/spi/spi-bcm-qspi.c
    668 +++ b/drivers/spi/spi-bcm-qspi.c
    669 @@ -1278,7 +1278,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
    670 goto qspi_probe_err;
    671 }
    672 } else {
    673 - goto qspi_probe_err;
    674 + goto qspi_resource_err;
    675 }
    676
    677 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
    678 @@ -1300,7 +1300,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
    679 qspi->base[CHIP_SELECT] = devm_ioremap_resource(dev, res);
    680 if (IS_ERR(qspi->base[CHIP_SELECT])) {
    681 ret = PTR_ERR(qspi->base[CHIP_SELECT]);
    682 - goto qspi_probe_err;
    683 + goto qspi_resource_err;
    684 }
    685 }
    686
    687 @@ -1308,7 +1308,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
    688 GFP_KERNEL);
    689 if (!qspi->dev_ids) {
    690 ret = -ENOMEM;
    691 - goto qspi_probe_err;
    692 + goto qspi_resource_err;
    693 }
    694
    695 for (val = 0; val < num_irqs; val++) {
    696 @@ -1397,8 +1397,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
    697 bcm_qspi_hw_uninit(qspi);
    698 clk_disable_unprepare(qspi->clk);
    699 qspi_probe_err:
    700 - spi_master_put(master);
    701 kfree(qspi->dev_ids);
    702 +qspi_resource_err:
    703 + spi_master_put(master);
    704 return ret;
    705 }
    706 /* probe function to be called by SoC specific platform driver probe */
    707 diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
    708 index 82360594fa8e..57efbd3b053b 100644
    709 --- a/drivers/xen/gntdev.c
    710 +++ b/drivers/xen/gntdev.c
    711 @@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
    712 mutex_unlock(&priv->lock);
    713
    714 if (use_ptemod) {
    715 + map->pages_vm_start = vma->vm_start;
    716 err = apply_to_page_range(vma->vm_mm, vma->vm_start,
    717 vma->vm_end - vma->vm_start,
    718 find_grant_ptes, map);
    719 @@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
    720 set_grant_ptes_as_special, NULL);
    721 }
    722 #endif
    723 - map->pages_vm_start = vma->vm_start;
    724 }
    725
    726 return 0;
    727 diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
    728 index e89136ab851e..b437fccd4e62 100644
    729 --- a/drivers/xen/xen-balloon.c
    730 +++ b/drivers/xen/xen-balloon.c
    731 @@ -57,7 +57,7 @@ static int register_balloon(struct device *dev);
    732 static void watch_target(struct xenbus_watch *watch,
    733 const char *path, const char *token)
    734 {
    735 - unsigned long long new_target;
    736 + unsigned long long new_target, static_max;
    737 int err;
    738 static bool watch_fired;
    739 static long target_diff;
    740 @@ -72,13 +72,20 @@ static void watch_target(struct xenbus_watch *watch,
    741 * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
    742 */
    743 new_target >>= PAGE_SHIFT - 10;
    744 - if (watch_fired) {
    745 - balloon_set_new_target(new_target - target_diff);
    746 - return;
    747 +
    748 + if (!watch_fired) {
    749 + watch_fired = true;
    750 + err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
    751 + &static_max);
    752 + if (err != 1)
    753 + static_max = new_target;
    754 + else
    755 + static_max >>= PAGE_SHIFT - 10;
    756 + target_diff = xen_pv_domain() ? 0
    757 + : static_max - balloon_stats.target_pages;
    758 }
    759
    760 - watch_fired = true;
    761 - target_diff = new_target - balloon_stats.target_pages;
    762 + balloon_set_new_target(new_target - target_diff);
    763 }
    764 static struct xenbus_watch target_watch = {
    765 .node = "memory/target",
    766 diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
    767 index 7007ae2a5ad2..388f0267cec5 100644
    768 --- a/fs/ceph/caps.c
    769 +++ b/fs/ceph/caps.c
    770 @@ -1985,6 +1985,7 @@ static int try_flush_caps(struct inode *inode, u64 *ptid)
    771 retry:
    772 spin_lock(&ci->i_ceph_lock);
    773 if (ci->i_ceph_flags & CEPH_I_NOFLUSH) {
    774 + spin_unlock(&ci->i_ceph_lock);
    775 dout("try_flush_caps skipping %p I_NOFLUSH set\n", inode);
    776 goto out;
    777 }
    778 @@ -2002,8 +2003,10 @@ static int try_flush_caps(struct inode *inode, u64 *ptid)
    779 mutex_lock(&session->s_mutex);
    780 goto retry;
    781 }
    782 - if (cap->session->s_state < CEPH_MDS_SESSION_OPEN)
    783 + if (cap->session->s_state < CEPH_MDS_SESSION_OPEN) {
    784 + spin_unlock(&ci->i_ceph_lock);
    785 goto out;
    786 + }
    787
    788 flushing = __mark_caps_flushing(inode, session, true,
    789 &flush_tid, &oldest_flush_tid);
    790 diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
    791 index f7243617316c..d5b2e12b5d02 100644
    792 --- a/fs/cifs/Kconfig
    793 +++ b/fs/cifs/Kconfig
    794 @@ -5,9 +5,14 @@ config CIFS
    795 select CRYPTO
    796 select CRYPTO_MD4
    797 select CRYPTO_MD5
    798 + select CRYPTO_SHA256
    799 + select CRYPTO_CMAC
    800 select CRYPTO_HMAC
    801 select CRYPTO_ARC4
    802 + select CRYPTO_AEAD2
    803 + select CRYPTO_CCM
    804 select CRYPTO_ECB
    805 + select CRYPTO_AES
    806 select CRYPTO_DES
    807 help
    808 This is the client VFS module for the SMB3 family of NAS protocols,
    809 diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
    810 index 03b6eae0ae28..ab69d895d1e9 100644
    811 --- a/fs/cifs/cifsglob.h
    812 +++ b/fs/cifs/cifsglob.h
    813 @@ -661,7 +661,9 @@ struct TCP_Server_Info {
    814 #endif
    815 unsigned int max_read;
    816 unsigned int max_write;
    817 - __u8 preauth_hash[512];
    818 +#ifdef CONFIG_CIFS_SMB311
    819 + __u8 preauth_sha_hash[64]; /* save initital negprot hash */
    820 +#endif /* 3.1.1 */
    821 struct delayed_work reconnect; /* reconnect workqueue job */
    822 struct mutex reconnect_mutex; /* prevent simultaneous reconnects */
    823 unsigned long echo_interval;
    824 @@ -849,7 +851,9 @@ struct cifs_ses {
    825 __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
    826 __u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE];
    827 __u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE];
    828 - __u8 preauth_hash[512];
    829 +#ifdef CONFIG_CIFS_SMB311
    830 + __u8 preauth_sha_hash[64];
    831 +#endif /* 3.1.1 */
    832 };
    833
    834 static inline bool
    835 diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
    836 index ddc633ef6064..834d18dbfb58 100644
    837 --- a/fs/cifs/smb2pdu.c
    838 +++ b/fs/cifs/smb2pdu.c
    839 @@ -1243,7 +1243,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
    840 struct smb2_tree_connect_req *req;
    841 struct smb2_tree_connect_rsp *rsp = NULL;
    842 struct kvec iov[2];
    843 - struct kvec rsp_iov;
    844 + struct kvec rsp_iov = { NULL, 0 };
    845 int rc = 0;
    846 int resp_buftype;
    847 int unc_path_len;
    848 @@ -1360,7 +1360,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
    849 return rc;
    850
    851 tcon_error_exit:
    852 - if (rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
    853 + if (rsp && rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
    854 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
    855 }
    856 goto tcon_exit;
    857 @@ -1963,6 +1963,9 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
    858 } else
    859 iov[0].iov_len = get_rfc1002_length(req) + 4;
    860
    861 + /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
    862 + if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
    863 + req->hdr.sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
    864
    865 rc = SendReceive2(xid, ses, iov, n_iov, &resp_buftype, flags, &rsp_iov);
    866 cifs_small_buf_release(req);
    867 diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
    868 index 67367cf1f8cd..99493946e2f9 100644
    869 --- a/fs/cifs/smb2transport.c
    870 +++ b/fs/cifs/smb2transport.c
    871 @@ -390,6 +390,7 @@ generate_smb30signingkey(struct cifs_ses *ses)
    872 return generate_smb3signingkey(ses, &triplet);
    873 }
    874
    875 +#ifdef CONFIG_CIFS_SMB311
    876 int
    877 generate_smb311signingkey(struct cifs_ses *ses)
    878
    879 @@ -398,25 +399,26 @@ generate_smb311signingkey(struct cifs_ses *ses)
    880 struct derivation *d;
    881
    882 d = &triplet.signing;
    883 - d->label.iov_base = "SMB2AESCMAC";
    884 - d->label.iov_len = 12;
    885 - d->context.iov_base = "SmbSign";
    886 - d->context.iov_len = 8;
    887 + d->label.iov_base = "SMBSigningKey";
    888 + d->label.iov_len = 14;
    889 + d->context.iov_base = ses->preauth_sha_hash;
    890 + d->context.iov_len = 64;
    891
    892 d = &triplet.encryption;
    893 - d->label.iov_base = "SMB2AESCCM";
    894 - d->label.iov_len = 11;
    895 - d->context.iov_base = "ServerIn ";
    896 - d->context.iov_len = 10;
    897 + d->label.iov_base = "SMBC2SCipherKey";
    898 + d->label.iov_len = 16;
    899 + d->context.iov_base = ses->preauth_sha_hash;
    900 + d->context.iov_len = 64;
    901
    902 d = &triplet.decryption;
    903 - d->label.iov_base = "SMB2AESCCM";
    904 - d->label.iov_len = 11;
    905 - d->context.iov_base = "ServerOut";
    906 - d->context.iov_len = 10;
    907 + d->label.iov_base = "SMBS2CCipherKey";
    908 + d->label.iov_len = 16;
    909 + d->context.iov_base = ses->preauth_sha_hash;
    910 + d->context.iov_len = 64;
    911
    912 return generate_smb3signingkey(ses, &triplet);
    913 }
    914 +#endif /* 311 */
    915
    916 int
    917 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
    918 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
    919 index 00800c07ba1c..4fbcb8721b2f 100644
    920 --- a/fs/fuse/dir.c
    921 +++ b/fs/fuse/dir.c
    922 @@ -1312,7 +1312,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
    923 */
    924 over = !dir_emit(ctx, dirent->name, dirent->namelen,
    925 dirent->ino, dirent->type);
    926 - ctx->pos = dirent->off;
    927 + if (!over)
    928 + ctx->pos = dirent->off;
    929 }
    930
    931 buf += reclen;
    932 diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
    933 index ef55c926463c..7b43b89defad 100644
    934 --- a/fs/overlayfs/inode.c
    935 +++ b/fs/overlayfs/inode.c
    936 @@ -595,18 +595,30 @@ static bool ovl_verify_inode(struct inode *inode, struct dentry *lowerdentry,
    937 return true;
    938 }
    939
    940 -struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry)
    941 +struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry,
    942 + struct dentry *index)
    943 {
    944 struct dentry *lowerdentry = ovl_dentry_lower(dentry);
    945 struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL;
    946 struct inode *inode;
    947 + /* Already indexed or could be indexed on copy up? */
    948 + bool indexed = (index || (ovl_indexdir(dentry->d_sb) && !upperdentry));
    949 +
    950 + if (WARN_ON(upperdentry && indexed && !lowerdentry))
    951 + return ERR_PTR(-EIO);
    952
    953 if (!realinode)
    954 realinode = d_inode(lowerdentry);
    955
    956 - if (!S_ISDIR(realinode->i_mode) &&
    957 - (upperdentry || (lowerdentry && ovl_indexdir(dentry->d_sb)))) {
    958 - struct inode *key = d_inode(lowerdentry ?: upperdentry);
    959 + /*
    960 + * Copy up origin (lower) may exist for non-indexed upper, but we must
    961 + * not use lower as hash key in that case.
    962 + * Hash inodes that are or could be indexed by origin inode and
    963 + * non-indexed upper inodes that could be hard linked by upper inode.
    964 + */
    965 + if (!S_ISDIR(realinode->i_mode) && (upperdentry || indexed)) {
    966 + struct inode *key = d_inode(indexed ? lowerdentry :
    967 + upperdentry);
    968 unsigned int nlink;
    969
    970 inode = iget5_locked(dentry->d_sb, (unsigned long) key,
    971 diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
    972 index 9deec68075dc..0223ef4acbe4 100644
    973 --- a/fs/overlayfs/namei.c
    974 +++ b/fs/overlayfs/namei.c
    975 @@ -405,14 +405,13 @@ int ovl_verify_index(struct dentry *index, struct path *lowerstack,
    976 * be treated as stale (i.e. after unlink of the overlay inode).
    977 * We don't know the verification rules for directory and whiteout
    978 * index entries, because they have not been implemented yet, so return
    979 - * EROFS if those entries are found to avoid corrupting an index that
    980 - * was created by a newer kernel.
    981 + * EINVAL if those entries are found to abort the mount to avoid
    982 + * corrupting an index that was created by a newer kernel.
    983 */
    984 - err = -EROFS;
    985 + err = -EINVAL;
    986 if (d_is_dir(index) || ovl_is_whiteout(index))
    987 goto fail;
    988
    989 - err = -EINVAL;
    990 if (index->d_name.len < sizeof(struct ovl_fh)*2)
    991 goto fail;
    992
    993 @@ -507,6 +506,10 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
    994 index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
    995 if (IS_ERR(index)) {
    996 err = PTR_ERR(index);
    997 + if (err == -ENOENT) {
    998 + index = NULL;
    999 + goto out;
    1000 + }
    1001 pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"
    1002 "overlayfs: mount with '-o index=off' to disable inodes index.\n",
    1003 d_inode(origin)->i_ino, name.len, name.name,
    1004 @@ -516,18 +519,9 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
    1005
    1006 inode = d_inode(index);
    1007 if (d_is_negative(index)) {
    1008 - if (upper && d_inode(origin)->i_nlink > 1) {
    1009 - pr_warn_ratelimited("overlayfs: hard link with origin but no index (ino=%lu).\n",
    1010 - d_inode(origin)->i_ino);
    1011 - goto fail;
    1012 - }
    1013 -
    1014 - dput(index);
    1015 - index = NULL;
    1016 + goto out_dput;
    1017 } else if (upper && d_inode(upper) != inode) {
    1018 - pr_warn_ratelimited("overlayfs: wrong index found (index=%pd2, ino=%lu, upper ino=%lu).\n",
    1019 - index, inode->i_ino, d_inode(upper)->i_ino);
    1020 - goto fail;
    1021 + goto out_dput;
    1022 } else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
    1023 ((inode->i_mode ^ d_inode(origin)->i_mode) & S_IFMT)) {
    1024 /*
    1025 @@ -547,6 +541,11 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
    1026 kfree(name.name);
    1027 return index;
    1028
    1029 +out_dput:
    1030 + dput(index);
    1031 + index = NULL;
    1032 + goto out;
    1033 +
    1034 fail:
    1035 dput(index);
    1036 index = ERR_PTR(-EIO);
    1037 @@ -709,7 +708,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
    1038 upperdentry = dget(index);
    1039
    1040 if (upperdentry || ctr) {
    1041 - inode = ovl_get_inode(dentry, upperdentry);
    1042 + inode = ovl_get_inode(dentry, upperdentry, index);
    1043 err = PTR_ERR(inode);
    1044 if (IS_ERR(inode))
    1045 goto out_free_oe;
    1046 diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
    1047 index f57f47742f5f..bccb1e683387 100644
    1048 --- a/fs/overlayfs/overlayfs.h
    1049 +++ b/fs/overlayfs/overlayfs.h
    1050 @@ -284,7 +284,8 @@ int ovl_update_time(struct inode *inode, struct timespec *ts, int flags);
    1051 bool ovl_is_private_xattr(const char *name);
    1052
    1053 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev);
    1054 -struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry);
    1055 +struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry,
    1056 + struct dentry *index);
    1057 static inline void ovl_copyattr(struct inode *from, struct inode *to)
    1058 {
    1059 to->i_uid = from->i_uid;
    1060 diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
    1061 index 74f7ead442f0..3ff960372cb9 100644
    1062 --- a/fs/overlayfs/readdir.c
    1063 +++ b/fs/overlayfs/readdir.c
    1064 @@ -704,13 +704,12 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
    1065 break;
    1066 }
    1067 err = ovl_verify_index(index, lowerstack, numlower);
    1068 - if (err) {
    1069 - if (err == -EROFS)
    1070 - break;
    1071 + /* Cleanup stale and orphan index entries */
    1072 + if (err && (err == -ESTALE || err == -ENOENT))
    1073 err = ovl_cleanup(dir, index);
    1074 - if (err)
    1075 - break;
    1076 - }
    1077 + if (err)
    1078 + break;
    1079 +
    1080 dput(index);
    1081 index = NULL;
    1082 }
    1083 diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
    1084 index a1464905c1ea..e2192e1eb564 100644
    1085 --- a/fs/overlayfs/super.c
    1086 +++ b/fs/overlayfs/super.c
    1087 @@ -174,6 +174,9 @@ static struct inode *ovl_alloc_inode(struct super_block *sb)
    1088 {
    1089 struct ovl_inode *oi = kmem_cache_alloc(ovl_inode_cachep, GFP_KERNEL);
    1090
    1091 + if (!oi)
    1092 + return NULL;
    1093 +
    1094 oi->cache = NULL;
    1095 oi->redirect = NULL;
    1096 oi->version = 0;
    1097 diff --git a/include/uapi/linux/spi/spidev.h b/include/uapi/linux/spi/spidev.h
    1098 index dd5f21e75805..856de39d0b89 100644
    1099 --- a/include/uapi/linux/spi/spidev.h
    1100 +++ b/include/uapi/linux/spi/spidev.h
    1101 @@ -23,6 +23,7 @@
    1102 #define SPIDEV_H
    1103
    1104 #include <linux/types.h>
    1105 +#include <linux/ioctl.h>
    1106
    1107 /* User space versions of kernel symbols for SPI clocking modes,
    1108 * matching <linux/spi/spi.h>
    1109 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
    1110 index ca937b0c3a96..d5bf849e0f48 100644
    1111 --- a/kernel/workqueue.c
    1112 +++ b/kernel/workqueue.c
    1113 @@ -68,6 +68,7 @@ enum {
    1114 * attach_mutex to avoid changing binding state while
    1115 * worker_attach_to_pool() is in progress.
    1116 */
    1117 + POOL_MANAGER_ACTIVE = 1 << 0, /* being managed */
    1118 POOL_DISASSOCIATED = 1 << 2, /* cpu can't serve workers */
    1119
    1120 /* worker flags */
    1121 @@ -165,7 +166,6 @@ struct worker_pool {
    1122 /* L: hash of busy workers */
    1123
    1124 /* see manage_workers() for details on the two manager mutexes */
    1125 - struct mutex manager_arb; /* manager arbitration */
    1126 struct worker *manager; /* L: purely informational */
    1127 struct mutex attach_mutex; /* attach/detach exclusion */
    1128 struct list_head workers; /* A: attached workers */
    1129 @@ -299,6 +299,7 @@ static struct workqueue_attrs *wq_update_unbound_numa_attrs_buf;
    1130
    1131 static DEFINE_MUTEX(wq_pool_mutex); /* protects pools and workqueues list */
    1132 static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */
    1133 +static DECLARE_WAIT_QUEUE_HEAD(wq_manager_wait); /* wait for manager to go away */
    1134
    1135 static LIST_HEAD(workqueues); /* PR: list of all workqueues */
    1136 static bool workqueue_freezing; /* PL: have wqs started freezing? */
    1137 @@ -801,7 +802,7 @@ static bool need_to_create_worker(struct worker_pool *pool)
    1138 /* Do we have too many workers and should some go away? */
    1139 static bool too_many_workers(struct worker_pool *pool)
    1140 {
    1141 - bool managing = mutex_is_locked(&pool->manager_arb);
    1142 + bool managing = pool->flags & POOL_MANAGER_ACTIVE;
    1143 int nr_idle = pool->nr_idle + managing; /* manager is considered idle */
    1144 int nr_busy = pool->nr_workers - nr_idle;
    1145
    1146 @@ -1980,24 +1981,17 @@ static bool manage_workers(struct worker *worker)
    1147 {
    1148 struct worker_pool *pool = worker->pool;
    1149
    1150 - /*
    1151 - * Anyone who successfully grabs manager_arb wins the arbitration
    1152 - * and becomes the manager. mutex_trylock() on pool->manager_arb
    1153 - * failure while holding pool->lock reliably indicates that someone
    1154 - * else is managing the pool and the worker which failed trylock
    1155 - * can proceed to executing work items. This means that anyone
    1156 - * grabbing manager_arb is responsible for actually performing
    1157 - * manager duties. If manager_arb is grabbed and released without
    1158 - * actual management, the pool may stall indefinitely.
    1159 - */
    1160 - if (!mutex_trylock(&pool->manager_arb))
    1161 + if (pool->flags & POOL_MANAGER_ACTIVE)
    1162 return false;
    1163 +
    1164 + pool->flags |= POOL_MANAGER_ACTIVE;
    1165 pool->manager = worker;
    1166
    1167 maybe_create_worker(pool);
    1168
    1169 pool->manager = NULL;
    1170 - mutex_unlock(&pool->manager_arb);
    1171 + pool->flags &= ~POOL_MANAGER_ACTIVE;
    1172 + wake_up(&wq_manager_wait);
    1173 return true;
    1174 }
    1175
    1176 @@ -3215,7 +3209,6 @@ static int init_worker_pool(struct worker_pool *pool)
    1177 setup_timer(&pool->mayday_timer, pool_mayday_timeout,
    1178 (unsigned long)pool);
    1179
    1180 - mutex_init(&pool->manager_arb);
    1181 mutex_init(&pool->attach_mutex);
    1182 INIT_LIST_HEAD(&pool->workers);
    1183
    1184 @@ -3285,13 +3278,15 @@ static void put_unbound_pool(struct worker_pool *pool)
    1185 hash_del(&pool->hash_node);
    1186
    1187 /*
    1188 - * Become the manager and destroy all workers. Grabbing
    1189 - * manager_arb prevents @pool's workers from blocking on
    1190 - * attach_mutex.
    1191 + * Become the manager and destroy all workers. This prevents
    1192 + * @pool's workers from blocking on attach_mutex. We're the last
    1193 + * manager and @pool gets freed with the flag set.
    1194 */
    1195 - mutex_lock(&pool->manager_arb);
    1196 -
    1197 spin_lock_irq(&pool->lock);
    1198 + wait_event_lock_irq(wq_manager_wait,
    1199 + !(pool->flags & POOL_MANAGER_ACTIVE), pool->lock);
    1200 + pool->flags |= POOL_MANAGER_ACTIVE;
    1201 +
    1202 while ((worker = first_idle_worker(pool)))
    1203 destroy_worker(worker);
    1204 WARN_ON(pool->nr_workers || pool->nr_idle);
    1205 @@ -3305,8 +3300,6 @@ static void put_unbound_pool(struct worker_pool *pool)
    1206 if (pool->detach_completion)
    1207 wait_for_completion(pool->detach_completion);
    1208
    1209 - mutex_unlock(&pool->manager_arb);
    1210 -
    1211 /* shut down the timers */
    1212 del_timer_sync(&pool->idle_timer);
    1213 del_timer_sync(&pool->mayday_timer);
    1214 diff --git a/lib/assoc_array.c b/lib/assoc_array.c
    1215 index 59fd7c0b119c..5cd093589c5a 100644
    1216 --- a/lib/assoc_array.c
    1217 +++ b/lib/assoc_array.c
    1218 @@ -598,21 +598,31 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
    1219 if ((edit->segment_cache[ASSOC_ARRAY_FAN_OUT] ^ base_seg) == 0)
    1220 goto all_leaves_cluster_together;
    1221
    1222 - /* Otherwise we can just insert a new node ahead of the old
    1223 - * one.
    1224 + /* Otherwise all the old leaves cluster in the same slot, but
    1225 + * the new leaf wants to go into a different slot - so we
    1226 + * create a new node (n0) to hold the new leaf and a pointer to
    1227 + * a new node (n1) holding all the old leaves.
    1228 + *
    1229 + * This can be done by falling through to the node splitting
    1230 + * path.
    1231 */
    1232 - goto present_leaves_cluster_but_not_new_leaf;
    1233 + pr_devel("present leaves cluster but not new leaf\n");
    1234 }
    1235
    1236 split_node:
    1237 pr_devel("split node\n");
    1238
    1239 - /* We need to split the current node; we know that the node doesn't
    1240 - * simply contain a full set of leaves that cluster together (it
    1241 - * contains meta pointers and/or non-clustering leaves).
    1242 + /* We need to split the current node. The node must contain anything
    1243 + * from a single leaf (in the one leaf case, this leaf will cluster
    1244 + * with the new leaf) and the rest meta-pointers, to all leaves, some
    1245 + * of which may cluster.
    1246 + *
    1247 + * It won't contain the case in which all the current leaves plus the
    1248 + * new leaves want to cluster in the same slot.
    1249 *
    1250 * We need to expel at least two leaves out of a set consisting of the
    1251 - * leaves in the node and the new leaf.
    1252 + * leaves in the node and the new leaf. The current meta pointers can
    1253 + * just be copied as they shouldn't cluster with any of the leaves.
    1254 *
    1255 * We need a new node (n0) to replace the current one and a new node to
    1256 * take the expelled nodes (n1).
    1257 @@ -717,33 +727,6 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
    1258 pr_devel("<--%s() = ok [split node]\n", __func__);
    1259 return true;
    1260
    1261 -present_leaves_cluster_but_not_new_leaf:
    1262 - /* All the old leaves cluster in the same slot, but the new leaf wants
    1263 - * to go into a different slot, so we create a new node to hold the new
    1264 - * leaf and a pointer to a new node holding all the old leaves.
    1265 - */
    1266 - pr_devel("present leaves cluster but not new leaf\n");
    1267 -
    1268 - new_n0->back_pointer = node->back_pointer;
    1269 - new_n0->parent_slot = node->parent_slot;
    1270 - new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
    1271 - new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
    1272 - new_n1->parent_slot = edit->segment_cache[0];
    1273 - new_n1->nr_leaves_on_branch = node->nr_leaves_on_branch;
    1274 - edit->adjust_count_on = new_n0;
    1275 -
    1276 - for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++)
    1277 - new_n1->slots[i] = node->slots[i];
    1278 -
    1279 - new_n0->slots[edit->segment_cache[0]] = assoc_array_node_to_ptr(new_n0);
    1280 - edit->leaf_p = &new_n0->slots[edit->segment_cache[ASSOC_ARRAY_FAN_OUT]];
    1281 -
    1282 - edit->set[0].ptr = &assoc_array_ptr_to_node(node->back_pointer)->slots[node->parent_slot];
    1283 - edit->set[0].to = assoc_array_node_to_ptr(new_n0);
    1284 - edit->excised_meta[0] = assoc_array_node_to_ptr(node);
    1285 - pr_devel("<--%s() = ok [insert node before]\n", __func__);
    1286 - return true;
    1287 -
    1288 all_leaves_cluster_together:
    1289 /* All the leaves, new and old, want to cluster together in this node
    1290 * in the same slot, so we have to replace this node with a shortcut to
    1291 diff --git a/net/wireless/sme.c b/net/wireless/sme.c
    1292 index 0a49b88070d0..b6533ecbf5b1 100644
    1293 --- a/net/wireless/sme.c
    1294 +++ b/net/wireless/sme.c
    1295 @@ -522,11 +522,6 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
    1296 return -EOPNOTSUPP;
    1297
    1298 if (wdev->current_bss) {
    1299 - if (!prev_bssid)
    1300 - return -EALREADY;
    1301 - if (prev_bssid &&
    1302 - !ether_addr_equal(prev_bssid, wdev->current_bss->pub.bssid))
    1303 - return -ENOTCONN;
    1304 cfg80211_unhold_bss(wdev->current_bss);
    1305 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
    1306 wdev->current_bss = NULL;
    1307 @@ -1063,11 +1058,35 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
    1308
    1309 ASSERT_WDEV_LOCK(wdev);
    1310
    1311 - if (WARN_ON(wdev->connect_keys)) {
    1312 - kzfree(wdev->connect_keys);
    1313 - wdev->connect_keys = NULL;
    1314 + /*
    1315 + * If we have an ssid_len, we're trying to connect or are
    1316 + * already connected, so reject a new SSID unless it's the
    1317 + * same (which is the case for re-association.)
    1318 + */
    1319 + if (wdev->ssid_len &&
    1320 + (wdev->ssid_len != connect->ssid_len ||
    1321 + memcmp(wdev->ssid, connect->ssid, wdev->ssid_len)))
    1322 + return -EALREADY;
    1323 +
    1324 + /*
    1325 + * If connected, reject (re-)association unless prev_bssid
    1326 + * matches the current BSSID.
    1327 + */
    1328 + if (wdev->current_bss) {
    1329 + if (!prev_bssid)
    1330 + return -EALREADY;
    1331 + if (!ether_addr_equal(prev_bssid, wdev->current_bss->pub.bssid))
    1332 + return -ENOTCONN;
    1333 }
    1334
    1335 + /*
    1336 + * Reject if we're in the process of connecting with WEP,
    1337 + * this case isn't very interesting and trying to handle
    1338 + * it would make the code much more complex.
    1339 + */
    1340 + if (wdev->connect_keys)
    1341 + return -EINPROGRESS;
    1342 +
    1343 cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
    1344 rdev->wiphy.ht_capa_mod_mask);
    1345
    1346 @@ -1118,7 +1137,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
    1347
    1348 if (err) {
    1349 wdev->connect_keys = NULL;
    1350 - wdev->ssid_len = 0;
    1351 + /*
    1352 + * This could be reassoc getting refused, don't clear
    1353 + * ssid_len in that case.
    1354 + */
    1355 + if (!wdev->current_bss)
    1356 + wdev->ssid_len = 0;
    1357 return err;
    1358 }
    1359
    1360 @@ -1145,6 +1169,14 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
    1361 else if (wdev->ssid_len)
    1362 err = rdev_disconnect(rdev, dev, reason);
    1363
    1364 + /*
    1365 + * Clear ssid_len unless we actually were fully connected,
    1366 + * in which case cfg80211_disconnected() will take care of
    1367 + * this later.
    1368 + */
    1369 + if (!wdev->current_bss)
    1370 + wdev->ssid_len = 0;
    1371 +
    1372 return err;
    1373 }
    1374
    1375 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    1376 index 9391ced05259..c0a6cdd42ff2 100644
    1377 --- a/net/xfrm/xfrm_user.c
    1378 +++ b/net/xfrm/xfrm_user.c
    1379 @@ -1684,32 +1684,34 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
    1380
    1381 static int xfrm_dump_policy_done(struct netlink_callback *cb)
    1382 {
    1383 - struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
    1384 + struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
    1385 struct net *net = sock_net(cb->skb->sk);
    1386
    1387 xfrm_policy_walk_done(walk, net);
    1388 return 0;
    1389 }
    1390
    1391 +static int xfrm_dump_policy_start(struct netlink_callback *cb)
    1392 +{
    1393 + struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
    1394 +
    1395 + BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
    1396 +
    1397 + xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
    1398 + return 0;
    1399 +}
    1400 +
    1401 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
    1402 {
    1403 struct net *net = sock_net(skb->sk);
    1404 - struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
    1405 + struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
    1406 struct xfrm_dump_info info;
    1407
    1408 - BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
    1409 - sizeof(cb->args) - sizeof(cb->args[0]));
    1410 -
    1411 info.in_skb = cb->skb;
    1412 info.out_skb = skb;
    1413 info.nlmsg_seq = cb->nlh->nlmsg_seq;
    1414 info.nlmsg_flags = NLM_F_MULTI;
    1415
    1416 - if (!cb->args[0]) {
    1417 - cb->args[0] = 1;
    1418 - xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
    1419 - }
    1420 -
    1421 (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
    1422
    1423 return skb->len;
    1424 @@ -2467,6 +2469,7 @@ static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
    1425
    1426 static const struct xfrm_link {
    1427 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
    1428 + int (*start)(struct netlink_callback *);
    1429 int (*dump)(struct sk_buff *, struct netlink_callback *);
    1430 int (*done)(struct netlink_callback *);
    1431 const struct nla_policy *nla_pol;
    1432 @@ -2480,6 +2483,7 @@ static const struct xfrm_link {
    1433 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
    1434 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
    1435 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
    1436 + .start = xfrm_dump_policy_start,
    1437 .dump = xfrm_dump_policy,
    1438 .done = xfrm_dump_policy_done },
    1439 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
    1440 @@ -2532,6 +2536,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
    1441
    1442 {
    1443 struct netlink_dump_control c = {
    1444 + .start = link->start,
    1445 .dump = link->dump,
    1446 .done = link->done,
    1447 };
    1448 diff --git a/samples/trace_events/trace-events-sample.c b/samples/trace_events/trace-events-sample.c
    1449 index 446beb7ac48d..5522692100ba 100644
    1450 --- a/samples/trace_events/trace-events-sample.c
    1451 +++ b/samples/trace_events/trace-events-sample.c
    1452 @@ -78,7 +78,7 @@ static int simple_thread_fn(void *arg)
    1453 }
    1454
    1455 static DEFINE_MUTEX(thread_mutex);
    1456 -static bool simple_thread_cnt;
    1457 +static int simple_thread_cnt;
    1458
    1459 int foo_bar_reg(void)
    1460 {
    1461 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1462 index 217bb582aff1..fe4d06398fc3 100644
    1463 --- a/sound/pci/hda/patch_realtek.c
    1464 +++ b/sound/pci/hda/patch_realtek.c
    1465 @@ -327,6 +327,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
    1466 case 0x10ec0215:
    1467 case 0x10ec0225:
    1468 case 0x10ec0233:
    1469 + case 0x10ec0236:
    1470 case 0x10ec0255:
    1471 case 0x10ec0256:
    1472 case 0x10ec0282:
    1473 @@ -911,6 +912,7 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
    1474 { 0x10ec0275, 0x1028, 0, "ALC3260" },
    1475 { 0x10ec0899, 0x1028, 0, "ALC3861" },
    1476 { 0x10ec0298, 0x1028, 0, "ALC3266" },
    1477 + { 0x10ec0236, 0x1028, 0, "ALC3204" },
    1478 { 0x10ec0256, 0x1028, 0, "ALC3246" },
    1479 { 0x10ec0225, 0x1028, 0, "ALC3253" },
    1480 { 0x10ec0295, 0x1028, 0, "ALC3254" },
    1481 @@ -3930,6 +3932,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
    1482 alc_process_coef_fw(codec, coef0255_1);
    1483 alc_process_coef_fw(codec, coef0255);
    1484 break;
    1485 + case 0x10ec0236:
    1486 case 0x10ec0256:
    1487 alc_process_coef_fw(codec, coef0256);
    1488 alc_process_coef_fw(codec, coef0255);
    1489 @@ -4028,6 +4031,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
    1490 };
    1491
    1492 switch (codec->core.vendor_id) {
    1493 + case 0x10ec0236:
    1494 case 0x10ec0255:
    1495 case 0x10ec0256:
    1496 alc_write_coef_idx(codec, 0x45, 0xc489);
    1497 @@ -4160,6 +4164,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)
    1498 alc_process_coef_fw(codec, alc225_pre_hsmode);
    1499 alc_process_coef_fw(codec, coef0225);
    1500 break;
    1501 + case 0x10ec0236:
    1502 case 0x10ec0255:
    1503 case 0x10ec0256:
    1504 alc_process_coef_fw(codec, coef0255);
    1505 @@ -4256,6 +4261,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
    1506 case 0x10ec0255:
    1507 alc_process_coef_fw(codec, coef0255);
    1508 break;
    1509 + case 0x10ec0236:
    1510 case 0x10ec0256:
    1511 alc_process_coef_fw(codec, coef0256);
    1512 break;
    1513 @@ -4366,6 +4372,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
    1514 case 0x10ec0255:
    1515 alc_process_coef_fw(codec, coef0255);
    1516 break;
    1517 + case 0x10ec0236:
    1518 case 0x10ec0256:
    1519 alc_process_coef_fw(codec, coef0256);
    1520 break;
    1521 @@ -4451,6 +4458,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
    1522 };
    1523
    1524 switch (codec->core.vendor_id) {
    1525 + case 0x10ec0236:
    1526 case 0x10ec0255:
    1527 case 0x10ec0256:
    1528 alc_process_coef_fw(codec, coef0255);
    1529 @@ -4705,6 +4713,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
    1530 case 0x10ec0255:
    1531 alc_process_coef_fw(codec, alc255fw);
    1532 break;
    1533 + case 0x10ec0236:
    1534 case 0x10ec0256:
    1535 alc_process_coef_fw(codec, alc256fw);
    1536 break;
    1537 @@ -6402,6 +6411,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
    1538 ALC225_STANDARD_PINS,
    1539 {0x12, 0xb7a60130},
    1540 {0x1b, 0x90170110}),
    1541 + SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1542 + {0x12, 0x90a60140},
    1543 + {0x14, 0x90170110},
    1544 + {0x21, 0x02211020}),
    1545 + SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1546 + {0x12, 0x90a60140},
    1547 + {0x14, 0x90170150},
    1548 + {0x21, 0x02211020}),
    1549 SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
    1550 {0x14, 0x90170110},
    1551 {0x21, 0x02211020}),
    1552 @@ -6789,6 +6806,7 @@ static int patch_alc269(struct hda_codec *codec)
    1553 case 0x10ec0255:
    1554 spec->codec_variant = ALC269_TYPE_ALC255;
    1555 break;
    1556 + case 0x10ec0236:
    1557 case 0x10ec0256:
    1558 spec->codec_variant = ALC269_TYPE_ALC256;
    1559 spec->shutup = alc256_shutup;
    1560 @@ -7840,6 +7858,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
    1561 HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269),
    1562 HDA_CODEC_ENTRY(0x10ec0234, "ALC234", patch_alc269),
    1563 HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269),
    1564 + HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),
    1565 HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),
    1566 HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),
    1567 HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260),