Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.8/0114-4.8.15-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.8/0114-4.8.15-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2854 - (show annotations) (download)
    Fri Jan 6 09:45:27 2017 UTC (7 years, 3 months ago) by niro
    File size: 34840 byte(s) 
    -linux-4.8.15
    1 diff --git a/Makefile b/Makefile
    2 index 6a7492473a0d..c7f0e798ca34 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 8
    8 -SUBLEVEL = 14
    9 +SUBLEVEL = 15
    10 EXTRAVERSION =
    11 NAME = Psychotic Stoned Sheep
    12
    13 diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
    14 index 1e90bdbe3a6e..fb307de5422c 100644
    15 --- a/arch/arm/boot/dts/imx7s.dtsi
    16 +++ b/arch/arm/boot/dts/imx7s.dtsi
    17 @@ -640,9 +640,8 @@
    18 reg = <0x30730000 0x10000>;
    19 interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
    20 clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
    21 - <&clks IMX7D_CLK_DUMMY>,
    22 - <&clks IMX7D_CLK_DUMMY>;
    23 - clock-names = "pix", "axi", "disp_axi";
    24 + <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>;
    25 + clock-names = "pix", "axi";
    26 status = "disabled";
    27 };
    28 };
    29 diff --git a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
    30 index 1cf644bfd7ea..51dc734cd5b9 100644
    31 --- a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
    32 +++ b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
    33 @@ -82,6 +82,10 @@
    34 gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
    35 };
    36
    37 +&sata {
    38 + nr-ports = <2>;
    39 +};
    40 +
    41 &ehci1 {
    42 status = "okay";
    43 };
    44 diff --git a/arch/m68k/include/asm/delay.h b/arch/m68k/include/asm/delay.h
    45 index d28fa8fe26fe..c598d847d56b 100644
    46 --- a/arch/m68k/include/asm/delay.h
    47 +++ b/arch/m68k/include/asm/delay.h
    48 @@ -114,6 +114,6 @@ static inline void __udelay(unsigned long usecs)
    49 */
    50 #define HZSCALE (268435456 / (1000000 / HZ))
    51
    52 -#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000));
    53 +#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000))
    54
    55 #endif /* defined(_M68K_DELAY_H) */
    56 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
    57 index c2c43f714684..3a4ed9f91d57 100644
    58 --- a/arch/parisc/include/asm/pgtable.h
    59 +++ b/arch/parisc/include/asm/pgtable.h
    60 @@ -65,9 +65,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
    61 unsigned long flags; \
    62 spin_lock_irqsave(&pa_tlb_lock, flags); \
    63 old_pte = *ptep; \
    64 - set_pte(ptep, pteval); \
    65 if (pte_inserted(old_pte)) \
    66 purge_tlb_entries(mm, addr); \
    67 + set_pte(ptep, pteval); \
    68 spin_unlock_irqrestore(&pa_tlb_lock, flags); \
    69 } while (0)
    70
    71 @@ -478,8 +478,8 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
    72 spin_unlock_irqrestore(&pa_tlb_lock, flags);
    73 return 0;
    74 }
    75 - set_pte(ptep, pte_mkold(pte));
    76 purge_tlb_entries(vma->vm_mm, addr);
    77 + set_pte(ptep, pte_mkold(pte));
    78 spin_unlock_irqrestore(&pa_tlb_lock, flags);
    79 return 1;
    80 }
    81 @@ -492,9 +492,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
    82
    83 spin_lock_irqsave(&pa_tlb_lock, flags);
    84 old_pte = *ptep;
    85 - set_pte(ptep, __pte(0));
    86 if (pte_inserted(old_pte))
    87 purge_tlb_entries(mm, addr);
    88 + set_pte(ptep, __pte(0));
    89 spin_unlock_irqrestore(&pa_tlb_lock, flags);
    90
    91 return old_pte;
    92 @@ -504,8 +504,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
    93 {
    94 unsigned long flags;
    95 spin_lock_irqsave(&pa_tlb_lock, flags);
    96 - set_pte(ptep, pte_wrprotect(*ptep));
    97 purge_tlb_entries(mm, addr);
    98 + set_pte(ptep, pte_wrprotect(*ptep));
    99 spin_unlock_irqrestore(&pa_tlb_lock, flags);
    100 }
    101
    102 diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
    103 index c2259d4a3c33..bbb314eb7027 100644
    104 --- a/arch/parisc/kernel/cache.c
    105 +++ b/arch/parisc/kernel/cache.c
    106 @@ -393,6 +393,15 @@ void __init parisc_setup_cache_timing(void)
    107
    108 /* calculate TLB flush threshold */
    109
    110 + /* On SMP machines, skip the TLB measure of kernel text which
    111 + * has been mapped as huge pages. */
    112 + if (num_online_cpus() > 1 && !parisc_requires_coherency()) {
    113 + threshold = max(cache_info.it_size, cache_info.dt_size);
    114 + threshold *= PAGE_SIZE;
    115 + threshold /= num_online_cpus();
    116 + goto set_tlb_threshold;
    117 + }
    118 +
    119 alltime = mfctl(16);
    120 flush_tlb_all();
    121 alltime = mfctl(16) - alltime;
    122 @@ -411,6 +420,8 @@ void __init parisc_setup_cache_timing(void)
    123 alltime, size, rangetime);
    124
    125 threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime);
    126 +
    127 +set_tlb_threshold:
    128 if (threshold)
    129 parisc_tlb_flush_threshold = threshold;
    130 printk(KERN_INFO "TLB flush threshold set to %lu KiB\n",
    131 diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
    132 index 675521919229..a4761b772406 100644
    133 --- a/arch/parisc/kernel/pacache.S
    134 +++ b/arch/parisc/kernel/pacache.S
    135 @@ -886,19 +886,10 @@ ENTRY(flush_dcache_page_asm)
    136 fdc,m r31(%r28)
    137 fdc,m r31(%r28)
    138 fdc,m r31(%r28)
    139 - cmpb,COND(<<) %r28, %r25,1b
    140 + cmpb,COND(<<) %r28, %r25,1b
    141 fdc,m r31(%r28)
    142
    143 sync
    144 -
    145 -#ifdef CONFIG_PA20
    146 - pdtlb,l %r0(%r25)
    147 -#else
    148 - tlb_lock %r20,%r21,%r22
    149 - pdtlb %r0(%r25)
    150 - tlb_unlock %r20,%r21,%r22
    151 -#endif
    152 -
    153 bv %r0(%r2)
    154 nop
    155 .exit
    156 @@ -973,17 +964,6 @@ ENTRY(flush_icache_page_asm)
    157 fic,m %r31(%sr4,%r28)
    158
    159 sync
    160 -
    161 -#ifdef CONFIG_PA20
    162 - pdtlb,l %r0(%r28)
    163 - pitlb,l %r0(%sr4,%r25)
    164 -#else
    165 - tlb_lock %r20,%r21,%r22
    166 - pdtlb %r0(%r28)
    167 - pitlb %r0(%sr4,%r25)
    168 - tlb_unlock %r20,%r21,%r22
    169 -#endif
    170 -
    171 bv %r0(%r2)
    172 nop
    173 .exit
    174 diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
    175 index 1a2a6e8dc40d..1894beb2c208 100644
    176 --- a/arch/powerpc/boot/Makefile
    177 +++ b/arch/powerpc/boot/Makefile
    178 @@ -78,7 +78,8 @@ src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \
    179 ns16550.c serial.c simple_alloc.c div64.S util.S \
    180 gunzip_util.c elf_util.c $(zlib) devtree.c stdlib.c \
    181 oflib.c ofconsole.c cuboot.c mpsc.c cpm-serial.c \
    182 - uartlite.c mpc52xx-psc.c opal.c opal-calls.S
    183 + uartlite.c mpc52xx-psc.c opal.c
    184 +src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S
    185 src-wlib-$(CONFIG_40x) += 4xx.c planetcore.c
    186 src-wlib-$(CONFIG_44x) += 4xx.c ebony.c bamboo.c
    187 src-wlib-$(CONFIG_8xx) += mpc8xx.c planetcore.c fsl-soc.c
    188 diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c
    189 index d7b4fd47eb44..0272570d02de 100644
    190 --- a/arch/powerpc/boot/opal.c
    191 +++ b/arch/powerpc/boot/opal.c
    192 @@ -13,7 +13,7 @@
    193 #include <libfdt.h>
    194 #include "../include/asm/opal-api.h"
    195
    196 -#ifdef __powerpc64__
    197 +#ifdef CONFIG_PPC64_BOOT_WRAPPER
    198
    199 /* Global OPAL struct used by opal-call.S */
    200 struct opal {
    201 diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
    202 index 29aa8d1ce273..248f28bc4641 100644
    203 --- a/arch/powerpc/kernel/eeh_driver.c
    204 +++ b/arch/powerpc/kernel/eeh_driver.c
    205 @@ -671,8 +671,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
    206
    207 /* Clear frozen state */
    208 rc = eeh_clear_pe_frozen_state(pe, false);
    209 - if (rc)
    210 + if (rc) {
    211 + pci_unlock_rescan_remove();
    212 return rc;
    213 + }
    214
    215 /* Give the system 5 seconds to finish running the user-space
    216 * hotplug shutdown scripts, e.g. ifdown for ethernet. Yes,
    217 diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
    218 index 42c702b3be1f..6fa450c12d6d 100644
    219 --- a/arch/powerpc/mm/hash64_4k.c
    220 +++ b/arch/powerpc/mm/hash64_4k.c
    221 @@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
    222 */
    223 rflags = htab_convert_pte_flags(new_pte);
    224
    225 - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    226 + if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    227 !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
    228 rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
    229
    230 diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
    231 index 3bbbea07378c..1a68cb19b0e3 100644
    232 --- a/arch/powerpc/mm/hash64_64k.c
    233 +++ b/arch/powerpc/mm/hash64_64k.c
    234 @@ -87,7 +87,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
    235 subpg_pte = new_pte & ~subpg_prot;
    236 rflags = htab_convert_pte_flags(subpg_pte);
    237
    238 - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    239 + if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    240 !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) {
    241
    242 /*
    243 @@ -258,7 +258,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
    244
    245 rflags = htab_convert_pte_flags(new_pte);
    246
    247 - if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    248 + if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
    249 !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
    250 rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
    251
    252 diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
    253 index a4e070a51584..8c925ecaf534 100644
    254 --- a/arch/x86/events/core.c
    255 +++ b/arch/x86/events/core.c
    256 @@ -68,7 +68,7 @@ u64 x86_perf_event_update(struct perf_event *event)
    257 int shift = 64 - x86_pmu.cntval_bits;
    258 u64 prev_raw_count, new_raw_count;
    259 int idx = hwc->idx;
    260 - s64 delta;
    261 + u64 delta;
    262
    263 if (idx == INTEL_PMC_IDX_FIXED_BTS)
    264 return 0;
    265 diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
    266 index 4c9a79b9cd69..3ef34c6e63ca 100644
    267 --- a/arch/x86/events/intel/core.c
    268 +++ b/arch/x86/events/intel/core.c
    269 @@ -4024,7 +4024,7 @@ __init int intel_pmu_init(void)
    270
    271 /* Support full width counters using alternative MSR range */
    272 if (x86_pmu.intel_cap.full_width_write) {
    273 - x86_pmu.max_period = x86_pmu.cntval_mask;
    274 + x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
    275 x86_pmu.perfctr = MSR_IA32_PMC0;
    276 pr_cont("full-width counters, ");
    277 }
    278 diff --git a/crypto/Makefile b/crypto/Makefile
    279 index 99cc64ac70ef..bd6a029094e6 100644
    280 --- a/crypto/Makefile
    281 +++ b/crypto/Makefile
    282 @@ -40,6 +40,7 @@ obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
    283
    284 $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h
    285 $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h
    286 +$(obj)/rsa_helper.o: $(obj)/rsapubkey-asn1.h $(obj)/rsaprivkey-asn1.h
    287 clean-files += rsapubkey-asn1.c rsapubkey-asn1.h
    288 clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h
    289
    290 diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
    291 index 86fb59b109a9..c6e992082259 100644
    292 --- a/crypto/mcryptd.c
    293 +++ b/crypto/mcryptd.c
    294 @@ -254,18 +254,22 @@ out_free_inst:
    295 goto out;
    296 }
    297
    298 -static inline void mcryptd_check_internal(struct rtattr **tb, u32 *type,
    299 +static inline bool mcryptd_check_internal(struct rtattr **tb, u32 *type,
    300 u32 *mask)
    301 {
    302 struct crypto_attr_type *algt;
    303
    304 algt = crypto_get_attr_type(tb);
    305 if (IS_ERR(algt))
    306 - return;
    307 - if ((algt->type & CRYPTO_ALG_INTERNAL))
    308 - *type |= CRYPTO_ALG_INTERNAL;
    309 - if ((algt->mask & CRYPTO_ALG_INTERNAL))
    310 - *mask |= CRYPTO_ALG_INTERNAL;
    311 + return false;
    312 +
    313 + *type |= algt->type & CRYPTO_ALG_INTERNAL;
    314 + *mask |= algt->mask & CRYPTO_ALG_INTERNAL;
    315 +
    316 + if (*type & *mask & CRYPTO_ALG_INTERNAL)
    317 + return true;
    318 + else
    319 + return false;
    320 }
    321
    322 static int mcryptd_hash_init_tfm(struct crypto_tfm *tfm)
    323 @@ -492,7 +496,8 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
    324 u32 mask = 0;
    325 int err;
    326
    327 - mcryptd_check_internal(tb, &type, &mask);
    328 + if (!mcryptd_check_internal(tb, &type, &mask))
    329 + return -EINVAL;
    330
    331 halg = ahash_attr_alg(tb[1], type, mask);
    332 if (IS_ERR(halg))
    333 diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
    334 index 2accf784534e..93e0d8333a20 100644
    335 --- a/drivers/acpi/nfit/core.c
    336 +++ b/drivers/acpi/nfit/core.c
    337 @@ -94,7 +94,7 @@ static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
    338 return to_acpi_device(acpi_desc->dev);
    339 }
    340
    341 -static int xlat_status(void *buf, unsigned int cmd, u32 status)
    342 +static int xlat_bus_status(void *buf, unsigned int cmd, u32 status)
    343 {
    344 struct nd_cmd_clear_error *clear_err;
    345 struct nd_cmd_ars_status *ars_status;
    346 @@ -113,7 +113,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    347 flags = ND_ARS_PERSISTENT | ND_ARS_VOLATILE;
    348 if ((status >> 16 & flags) == 0)
    349 return -ENOTTY;
    350 - break;
    351 + return 0;
    352 case ND_CMD_ARS_START:
    353 /* ARS is in progress */
    354 if ((status & 0xffff) == NFIT_ARS_START_BUSY)
    355 @@ -122,7 +122,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    356 /* Command failed */
    357 if (status & 0xffff)
    358 return -EIO;
    359 - break;
    360 + return 0;
    361 case ND_CMD_ARS_STATUS:
    362 ars_status = buf;
    363 /* Command failed */
    364 @@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    365 * then just continue with the returned results.
    366 */
    367 if (status == NFIT_ARS_STATUS_INTR) {
    368 - if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
    369 + if (ars_status->out_length >= 40 && (ars_status->flags
    370 + & NFIT_ARS_F_OVERFLOW))
    371 return -ENOSPC;
    372 return 0;
    373 }
    374 @@ -154,7 +155,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    375 /* Unknown status */
    376 if (status >> 16)
    377 return -EIO;
    378 - break;
    379 + return 0;
    380 case ND_CMD_CLEAR_ERROR:
    381 clear_err = buf;
    382 if (status & 0xffff)
    383 @@ -163,7 +164,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    384 return -EIO;
    385 if (clear_err->length > clear_err->cleared)
    386 return clear_err->cleared;
    387 - break;
    388 + return 0;
    389 default:
    390 break;
    391 }
    392 @@ -174,6 +175,16 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
    393 return 0;
    394 }
    395
    396 +static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd,
    397 + u32 status)
    398 +{
    399 + if (!nvdimm)
    400 + return xlat_bus_status(buf, cmd, status);
    401 + if (status)
    402 + return -EIO;
    403 + return 0;
    404 +}
    405 +
    406 static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
    407 struct nvdimm *nvdimm, unsigned int cmd, void *buf,
    408 unsigned int buf_len, int *cmd_rc)
    409 @@ -298,7 +309,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
    410
    411 for (i = 0, offset = 0; i < desc->out_num; i++) {
    412 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
    413 - (u32 *) out_obj->buffer.pointer);
    414 + (u32 *) out_obj->buffer.pointer,
    415 + out_obj->buffer.length - offset);
    416
    417 if (offset + out_size > out_obj->buffer.length) {
    418 dev_dbg(dev, "%s:%s output object underflow cmd: %s field: %d\n",
    419 @@ -333,7 +345,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
    420 */
    421 rc = buf_len - offset - in_buf.buffer.length;
    422 if (cmd_rc)
    423 - *cmd_rc = xlat_status(buf, cmd, fw_status);
    424 + *cmd_rc = xlat_status(nvdimm, buf, cmd,
    425 + fw_status);
    426 } else {
    427 dev_err(dev, "%s:%s underrun cmd: %s buf_len: %d out_len: %d\n",
    428 __func__, dimm_name, cmd_name, buf_len,
    429 @@ -343,7 +356,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
    430 } else {
    431 rc = 0;
    432 if (cmd_rc)
    433 - *cmd_rc = xlat_status(buf, cmd, fw_status);
    434 + *cmd_rc = xlat_status(nvdimm, buf, cmd, fw_status);
    435 }
    436
    437 out:
    438 @@ -1857,19 +1870,32 @@ static int ars_get_status(struct acpi_nfit_desc *acpi_desc)
    439 return cmd_rc;
    440 }
    441
    442 -static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
    443 +static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
    444 struct nd_cmd_ars_status *ars_status)
    445 {
    446 + struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
    447 int rc;
    448 u32 i;
    449
    450 + /*
    451 + * First record starts at 44 byte offset from the start of the
    452 + * payload.
    453 + */
    454 + if (ars_status->out_length < 44)
    455 + return 0;
    456 for (i = 0; i < ars_status->num_records; i++) {
    457 + /* only process full records */
    458 + if (ars_status->out_length
    459 + < 44 + sizeof(struct nd_ars_record) * (i + 1))
    460 + break;
    461 rc = nvdimm_bus_add_poison(nvdimm_bus,
    462 ars_status->records[i].err_address,
    463 ars_status->records[i].length);
    464 if (rc)
    465 return rc;
    466 }
    467 + if (i < ars_status->num_records)
    468 + dev_warn(acpi_desc->dev, "detected truncated ars results\n");
    469
    470 return 0;
    471 }
    472 @@ -2122,8 +2148,7 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc,
    473 if (rc < 0 && rc != -ENOSPC)
    474 return rc;
    475
    476 - if (ars_status_process_records(acpi_desc->nvdimm_bus,
    477 - acpi_desc->ars_status))
    478 + if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
    479 return -ENOMEM;
    480
    481 return 0;
    482 diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
    483 index 2b38c1bb0446..7a2e4d45b266 100644
    484 --- a/drivers/acpi/sleep.c
    485 +++ b/drivers/acpi/sleep.c
    486 @@ -47,32 +47,15 @@ static void acpi_sleep_tts_switch(u32 acpi_state)
    487 }
    488 }
    489
    490 -static void acpi_sleep_pts_switch(u32 acpi_state)
    491 -{
    492 - acpi_status status;
    493 -
    494 - status = acpi_execute_simple_method(NULL, "\\_PTS", acpi_state);
    495 - if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
    496 - /*
    497 - * OS can't evaluate the _PTS object correctly. Some warning
    498 - * message will be printed. But it won't break anything.
    499 - */
    500 - printk(KERN_NOTICE "Failure in evaluating _PTS object\n");
    501 - }
    502 -}
    503 -
    504 -static int sleep_notify_reboot(struct notifier_block *this,
    505 +static int tts_notify_reboot(struct notifier_block *this,
    506 unsigned long code, void *x)
    507 {
    508 acpi_sleep_tts_switch(ACPI_STATE_S5);
    509 -
    510 - acpi_sleep_pts_switch(ACPI_STATE_S5);
    511 -
    512 return NOTIFY_DONE;
    513 }
    514
    515 -static struct notifier_block sleep_notifier = {
    516 - .notifier_call = sleep_notify_reboot,
    517 +static struct notifier_block tts_notifier = {
    518 + .notifier_call = tts_notify_reboot,
    519 .next = NULL,
    520 .priority = 0,
    521 };
    522 @@ -916,9 +899,9 @@ int __init acpi_sleep_init(void)
    523 pr_info(PREFIX "(supports%s)\n", supported);
    524
    525 /*
    526 - * Register the sleep_notifier to reboot notifier list so that the _TTS
    527 - * and _PTS object can also be evaluated when the system enters S5.
    528 + * Register the tts_notifier to reboot notifier list so that the _TTS
    529 + * object can also be evaluated when the system enters S5.
    530 */
    531 - register_reboot_notifier(&sleep_notifier);
    532 + register_reboot_notifier(&tts_notifier);
    533 return 0;
    534 }
    535 diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
    536 index 5163c8f918cb..5497f7fc44d0 100644
    537 --- a/drivers/block/zram/zram_drv.c
    538 +++ b/drivers/block/zram/zram_drv.c
    539 @@ -1413,8 +1413,14 @@ static ssize_t hot_remove_store(struct class *class,
    540 return ret ? ret : count;
    541 }
    542
    543 +/*
    544 + * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a
    545 + * sense that reading from this file does alter the state of your system -- it
    546 + * creates a new un-initialized zram device and returns back this device's
    547 + * device_id (or an error code if it fails to create a new device).
    548 + */
    549 static struct class_attribute zram_control_class_attrs[] = {
    550 - __ATTR_RO(hot_add),
    551 + __ATTR(hot_add, 0400, hot_add_show, NULL),
    552 __ATTR_WO(hot_remove),
    553 __ATTR_NULL,
    554 };
    555 diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
    556 index 0ec112ee5204..2341f3799591 100644
    557 --- a/drivers/crypto/caam/ctrl.c
    558 +++ b/drivers/crypto/caam/ctrl.c
    559 @@ -557,8 +557,9 @@ static int caam_probe(struct platform_device *pdev)
    560 * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel,
    561 * long pointers in master configuration register
    562 */
    563 - clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH |
    564 - MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE | MCFGR_LARGE_BURST |
    565 + clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK | MCFGR_LONG_PTR,
    566 + MCFGR_AWCACHE_CACH | MCFGR_AWCACHE_BUFF |
    567 + MCFGR_WDENABLE | MCFGR_LARGE_BURST |
    568 (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0));
    569
    570 /*
    571 diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
    572 index b111e14bac1e..13e89afdbb87 100644
    573 --- a/drivers/crypto/marvell/hash.c
    574 +++ b/drivers/crypto/marvell/hash.c
    575 @@ -168,12 +168,11 @@ static void mv_cesa_ahash_std_step(struct ahash_request *req)
    576 mv_cesa_adjust_op(engine, &creq->op_tmpl);
    577 memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
    578
    579 - digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
    580 - for (i = 0; i < digsize / 4; i++)
    581 - writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
    582 -
    583 - mv_cesa_adjust_op(engine, &creq->op_tmpl);
    584 - memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
    585 + if (!sreq->offset) {
    586 + digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
    587 + for (i = 0; i < digsize / 4; i++)
    588 + writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
    589 + }
    590
    591 if (creq->cache_ptr)
    592 memcpy_toio(engine->sram + CESA_SA_DATA_SRAM_OFFSET,
    593 diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
    594 index ff64313770bd..4894199cebab 100644
    595 --- a/drivers/dax/dax.c
    596 +++ b/drivers/dax/dax.c
    597 @@ -324,7 +324,7 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma,
    598 return -ENXIO;
    599
    600 /* prevent private mappings from being established */
    601 - if ((vma->vm_flags & VM_SHARED) != VM_SHARED) {
    602 + if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
    603 dev_info(dev, "%s: %s: fail, attempted private mapping\n",
    604 current->comm, func);
    605 return -EINVAL;
    606 diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    607 index bfb91d8fa460..1006af40481d 100644
    608 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    609 +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    610 @@ -872,23 +872,25 @@ lbl_free_candev:
    611 static void peak_usb_disconnect(struct usb_interface *intf)
    612 {
    613 struct peak_usb_device *dev;
    614 + struct peak_usb_device *dev_prev_siblings;
    615
    616 /* unregister as many netdev devices as siblings */
    617 - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
    618 + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
    619 struct net_device *netdev = dev->netdev;
    620 char name[IFNAMSIZ];
    621
    622 + dev_prev_siblings = dev->prev_siblings;
    623 dev->state &= ~PCAN_USB_STATE_CONNECTED;
    624 strncpy(name, netdev->name, IFNAMSIZ);
    625
    626 unregister_netdev(netdev);
    627 - free_candev(netdev);
    628
    629 kfree(dev->cmd_buf);
    630 dev->next_siblings = NULL;
    631 if (dev->adapter->dev_free)
    632 dev->adapter->dev_free(dev);
    633
    634 + free_candev(netdev);
    635 dev_info(&intf->dev, "%s removed\n", name);
    636 }
    637
    638 diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
    639 index a8b6949a8778..23d4a1728cdf 100644
    640 --- a/drivers/nvdimm/bus.c
    641 +++ b/drivers/nvdimm/bus.c
    642 @@ -715,7 +715,7 @@ EXPORT_SYMBOL_GPL(nd_cmd_in_size);
    643
    644 u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
    645 const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
    646 - const u32 *out_field)
    647 + const u32 *out_field, unsigned long remainder)
    648 {
    649 if (idx >= desc->out_num)
    650 return UINT_MAX;
    651 @@ -727,9 +727,24 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
    652 return in_field[1];
    653 else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2)
    654 return out_field[1];
    655 - else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2)
    656 - return out_field[1] - 8;
    657 - else if (cmd == ND_CMD_CALL) {
    658 + else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) {
    659 + /*
    660 + * Per table 9-276 ARS Data in ACPI 6.1, out_field[1] is
    661 + * "Size of Output Buffer in bytes, including this
    662 + * field."
    663 + */
    664 + if (out_field[1] < 4)
    665 + return 0;
    666 + /*
    667 + * ACPI 6.1 is ambiguous if 'status' is included in the
    668 + * output size. If we encounter an output size that
    669 + * overshoots the remainder by 4 bytes, assume it was
    670 + * including 'status'.
    671 + */
    672 + if (out_field[1] - 8 == remainder)
    673 + return remainder;
    674 + return out_field[1] - 4;
    675 + } else if (cmd == ND_CMD_CALL) {
    676 struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
    677
    678 return pkg->nd_size_out;
    679 @@ -876,7 +891,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
    680 /* process an output envelope */
    681 for (i = 0; i < desc->out_num; i++) {
    682 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
    683 - (u32 *) in_env, (u32 *) out_env);
    684 + (u32 *) in_env, (u32 *) out_env, 0);
    685 u32 copy;
    686
    687 if (out_size == UINT_MAX) {
    688 diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
    689 index 7080ce2920fd..8214ebae9d50 100644
    690 --- a/drivers/scsi/lpfc/lpfc_sli.c
    691 +++ b/drivers/scsi/lpfc/lpfc_sli.c
    692 @@ -1323,18 +1323,20 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
    693 {
    694 lockdep_assert_held(&phba->hbalock);
    695
    696 - BUG_ON(!piocb || !piocb->vport);
    697 + BUG_ON(!piocb);
    698
    699 list_add_tail(&piocb->list, &pring->txcmplq);
    700 piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
    701
    702 if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
    703 (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
    704 - (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
    705 - (!(piocb->vport->load_flag & FC_UNLOADING)))
    706 - mod_timer(&piocb->vport->els_tmofunc,
    707 - jiffies +
    708 - msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
    709 + (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) {
    710 + BUG_ON(!piocb->vport);
    711 + if (!(piocb->vport->load_flag & FC_UNLOADING))
    712 + mod_timer(&piocb->vport->els_tmofunc,
    713 + jiffies +
    714 + msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
    715 + }
    716
    717 return 0;
    718 }
    719 diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
    720 index e3b30ea9ece5..a504e2e003da 100644
    721 --- a/drivers/vhost/vsock.c
    722 +++ b/drivers/vhost/vsock.c
    723 @@ -506,7 +506,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
    724 * executing.
    725 */
    726
    727 - if (!vhost_vsock_get(vsk->local_addr.svm_cid)) {
    728 + if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
    729 sock_set_flag(sk, SOCK_DONE);
    730 vsk->peer_shutdown = SHUTDOWN_MASK;
    731 sk->sk_state = SS_UNCONNECTED;
    732 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
    733 index df4b3e6fa563..93142bfe6112 100644
    734 --- a/fs/ceph/dir.c
    735 +++ b/fs/ceph/dir.c
    736 @@ -1257,26 +1257,30 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
    737 return -ECHILD;
    738
    739 op = ceph_snap(dir) == CEPH_SNAPDIR ?
    740 - CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP;
    741 + CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_GETATTR;
    742 req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS);
    743 if (!IS_ERR(req)) {
    744 req->r_dentry = dget(dentry);
    745 - req->r_num_caps = 2;
    746 + req->r_num_caps = op == CEPH_MDS_OP_GETATTR ? 1 : 2;
    747
    748 mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED;
    749 if (ceph_security_xattr_wanted(dir))
    750 mask |= CEPH_CAP_XATTR_SHARED;
    751 req->r_args.getattr.mask = mask;
    752
    753 - req->r_locked_dir = dir;
    754 err = ceph_mdsc_do_request(mdsc, NULL, req);
    755 - if (err == 0 || err == -ENOENT) {
    756 - if (dentry == req->r_dentry) {
    757 - valid = !d_unhashed(dentry);
    758 - } else {
    759 - d_invalidate(req->r_dentry);
    760 - err = -EAGAIN;
    761 - }
    762 + switch (err) {
    763 + case 0:
    764 + if (d_really_is_positive(dentry) &&
    765 + d_inode(dentry) == req->r_target_inode)
    766 + valid = 1;
    767 + break;
    768 + case -ENOENT:
    769 + if (d_really_is_negative(dentry))
    770 + valid = 1;
    771 + /* Fallthrough */
    772 + default:
    773 + break;
    774 }
    775 ceph_mdsc_put_request(req);
    776 dout("d_revalidate %p lookup result=%d\n",
    777 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
    778 index 4ff9251e9d3a..eb5373a026e3 100644
    779 --- a/fs/fuse/dir.c
    780 +++ b/fs/fuse/dir.c
    781 @@ -1709,8 +1709,6 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
    782 return -EACCES;
    783
    784 if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
    785 - int kill;
    786 -
    787 attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
    788 ATTR_MODE);
    789 /*
    790 @@ -1722,12 +1720,11 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
    791 return ret;
    792
    793 attr->ia_mode = inode->i_mode;
    794 - kill = should_remove_suid(entry);
    795 - if (kill & ATTR_KILL_SUID) {
    796 + if (inode->i_mode & S_ISUID) {
    797 attr->ia_valid |= ATTR_MODE;
    798 attr->ia_mode &= ~S_ISUID;
    799 }
    800 - if (kill & ATTR_KILL_SGID) {
    801 + if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
    802 attr->ia_valid |= ATTR_MODE;
    803 attr->ia_mode &= ~S_ISGID;
    804 }
    805 diff --git a/include/linux/cpu.h b/include/linux/cpu.h
    806 index 797d9c8e9a1b..c8938eb21e34 100644
    807 --- a/include/linux/cpu.h
    808 +++ b/include/linux/cpu.h
    809 @@ -105,22 +105,16 @@ extern bool cpuhp_tasks_frozen;
    810 { .notifier_call = fn, .priority = pri }; \
    811 __register_cpu_notifier(&fn##_nb); \
    812 }
    813 -#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    814 -#define cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    815 -#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    816 -#endif /* #else #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    817
    818 -#ifdef CONFIG_HOTPLUG_CPU
    819 extern int register_cpu_notifier(struct notifier_block *nb);
    820 extern int __register_cpu_notifier(struct notifier_block *nb);
    821 extern void unregister_cpu_notifier(struct notifier_block *nb);
    822 extern void __unregister_cpu_notifier(struct notifier_block *nb);
    823 -#else
    824
    825 -#ifndef MODULE
    826 -extern int register_cpu_notifier(struct notifier_block *nb);
    827 -extern int __register_cpu_notifier(struct notifier_block *nb);
    828 -#else
    829 +#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    830 +#define cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    831 +#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    832 +
    833 static inline int register_cpu_notifier(struct notifier_block *nb)
    834 {
    835 return 0;
    836 @@ -130,7 +124,6 @@ static inline int __register_cpu_notifier(struct notifier_block *nb)
    837 {
    838 return 0;
    839 }
    840 -#endif
    841
    842 static inline void unregister_cpu_notifier(struct notifier_block *nb)
    843 {
    844 diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
    845 index bbfce62a0bd7..d02d65dfe2d0 100644
    846 --- a/include/linux/libnvdimm.h
    847 +++ b/include/linux/libnvdimm.h
    848 @@ -153,7 +153,7 @@ u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
    849 const struct nd_cmd_desc *desc, int idx, void *buf);
    850 u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
    851 const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
    852 - const u32 *out_field);
    853 + const u32 *out_field, unsigned long remainder);
    854 int nvdimm_bus_check_dimm_count(struct nvdimm_bus *nvdimm_bus, int dimm_count);
    855 struct nd_region *nvdimm_pmem_region_create(struct nvdimm_bus *nvdimm_bus,
    856 struct nd_region_desc *ndr_desc);
    857 diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
    858 index 9692cda5f8fc..c48d93a28d1a 100644
    859 --- a/include/uapi/linux/can.h
    860 +++ b/include/uapi/linux/can.h
    861 @@ -196,5 +196,6 @@ struct can_filter {
    862 };
    863
    864 #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */
    865 +#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */
    866
    867 #endif /* !_UAPI_CAN_H */
    868 diff --git a/kernel/cpu.c b/kernel/cpu.c
    869 index 341bf80f80bd..73fb59fda809 100644
    870 --- a/kernel/cpu.c
    871 +++ b/kernel/cpu.c
    872 @@ -578,7 +578,6 @@ void __init cpuhp_threads_init(void)
    873 kthread_unpark(this_cpu_read(cpuhp_state.thread));
    874 }
    875
    876 -#ifdef CONFIG_HOTPLUG_CPU
    877 EXPORT_SYMBOL(register_cpu_notifier);
    878 EXPORT_SYMBOL(__register_cpu_notifier);
    879 void unregister_cpu_notifier(struct notifier_block *nb)
    880 @@ -595,6 +594,7 @@ void __unregister_cpu_notifier(struct notifier_block *nb)
    881 }
    882 EXPORT_SYMBOL(__unregister_cpu_notifier);
    883
    884 +#ifdef CONFIG_HOTPLUG_CPU
    885 /**
    886 * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
    887 * @cpu: a CPU id
    888 diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
    889 index 1ec0f48962b3..2c49d76f96c3 100644
    890 --- a/kernel/locking/rtmutex.c
    891 +++ b/kernel/locking/rtmutex.c
    892 @@ -65,8 +65,72 @@ static inline void clear_rt_mutex_waiters(struct rt_mutex *lock)
    893
    894 static void fixup_rt_mutex_waiters(struct rt_mutex *lock)
    895 {
    896 - if (!rt_mutex_has_waiters(lock))
    897 - clear_rt_mutex_waiters(lock);
    898 + unsigned long owner, *p = (unsigned long *) &lock->owner;
    899 +
    900 + if (rt_mutex_has_waiters(lock))
    901 + return;
    902 +
    903 + /*
    904 + * The rbtree has no waiters enqueued, now make sure that the
    905 + * lock->owner still has the waiters bit set, otherwise the
    906 + * following can happen:
    907 + *
    908 + * CPU 0 CPU 1 CPU2
    909 + * l->owner=T1
    910 + * rt_mutex_lock(l)
    911 + * lock(l->lock)
    912 + * l->owner = T1 | HAS_WAITERS;
    913 + * enqueue(T2)
    914 + * boost()
    915 + * unlock(l->lock)
    916 + * block()
    917 + *
    918 + * rt_mutex_lock(l)
    919 + * lock(l->lock)
    920 + * l->owner = T1 | HAS_WAITERS;
    921 + * enqueue(T3)
    922 + * boost()
    923 + * unlock(l->lock)
    924 + * block()
    925 + * signal(->T2) signal(->T3)
    926 + * lock(l->lock)
    927 + * dequeue(T2)
    928 + * deboost()
    929 + * unlock(l->lock)
    930 + * lock(l->lock)
    931 + * dequeue(T3)
    932 + * ==> wait list is empty
    933 + * deboost()
    934 + * unlock(l->lock)
    935 + * lock(l->lock)
    936 + * fixup_rt_mutex_waiters()
    937 + * if (wait_list_empty(l) {
    938 + * l->owner = owner
    939 + * owner = l->owner & ~HAS_WAITERS;
    940 + * ==> l->owner = T1
    941 + * }
    942 + * lock(l->lock)
    943 + * rt_mutex_unlock(l) fixup_rt_mutex_waiters()
    944 + * if (wait_list_empty(l) {
    945 + * owner = l->owner & ~HAS_WAITERS;
    946 + * cmpxchg(l->owner, T1, NULL)
    947 + * ===> Success (l->owner = NULL)
    948 + *
    949 + * l->owner = owner
    950 + * ==> l->owner = T1
    951 + * }
    952 + *
    953 + * With the check for the waiter bit in place T3 on CPU2 will not
    954 + * overwrite. All tasks fiddling with the waiters bit are
    955 + * serialized by l->lock, so nothing else can modify the waiters
    956 + * bit. If the bit is set then nothing can change l->owner either
    957 + * so the simple RMW is safe. The cmpxchg() will simply fail if it
    958 + * happens in the middle of the RMW because the waiters bit is
    959 + * still set.
    960 + */
    961 + owner = READ_ONCE(*p);
    962 + if (owner & RT_MUTEX_HAS_WAITERS)
    963 + WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS);
    964 }
    965
    966 /*
    967 diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
    968 index 4f5f83c7d2d3..e317e1cbb3eb 100644
    969 --- a/kernel/locking/rtmutex_common.h
    970 +++ b/kernel/locking/rtmutex_common.h
    971 @@ -75,8 +75,9 @@ task_top_pi_waiter(struct task_struct *p)
    972
    973 static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
    974 {
    975 - return (struct task_struct *)
    976 - ((unsigned long)lock->owner & ~RT_MUTEX_OWNER_MASKALL);
    977 + unsigned long owner = (unsigned long) READ_ONCE(lock->owner);
    978 +
    979 + return (struct task_struct *) (owner & ~RT_MUTEX_OWNER_MASKALL);
    980 }
    981
    982 /*
    983 diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
    984 index a5d966cb8891..418d9b6276a3 100644
    985 --- a/kernel/sched/auto_group.c
    986 +++ b/kernel/sched/auto_group.c
    987 @@ -192,6 +192,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
    988 {
    989 static unsigned long next = INITIAL_JIFFIES;
    990 struct autogroup *ag;
    991 + unsigned long shares;
    992 int err;
    993
    994 if (nice < MIN_NICE || nice > MAX_NICE)
    995 @@ -210,9 +211,10 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
    996
    997 next = HZ / 10 + jiffies;
    998 ag = autogroup_task_get(p);
    999 + shares = scale_load(sched_prio_to_weight[nice + 20]);
    1000
    1001 down_write(&ag->lock);
    1002 - err = sched_group_set_shares(ag->tg, sched_prio_to_weight[nice + 20]);
    1003 + err = sched_group_set_shares(ag->tg, shares);
    1004 if (!err)
    1005 ag->nice = nice;
    1006 up_write(&ag->lock);
    1007 diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
    1008 index 7e6df7a4964a..67f8fa9fc15a 100644
    1009 --- a/net/batman-adv/translation-table.c
    1010 +++ b/net/batman-adv/translation-table.c
    1011 @@ -2849,7 +2849,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
    1012 &tvlv_tt_data,
    1013 &tt_change,
    1014 &tt_len);
    1015 - if (!tt_len)
    1016 + if (!tt_len || !tvlv_len)
    1017 goto unlock;
    1018
    1019 /* Copy the last orig_node's OGM buffer */
    1020 @@ -2867,7 +2867,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
    1021 &tvlv_tt_data,
    1022 &tt_change,
    1023 &tt_len);
    1024 - if (!tt_len)
    1025 + if (!tt_len || !tvlv_len)
    1026 goto out;
    1027
    1028 /* fill the rest of the tvlv with the real TT entries */
    1029 diff --git a/net/can/raw.c b/net/can/raw.c
    1030 index 972c187d40ab..b075f028d7e2 100644
    1031 --- a/net/can/raw.c
    1032 +++ b/net/can/raw.c
    1033 @@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    1034 if (optlen % sizeof(struct can_filter) != 0)
    1035 return -EINVAL;
    1036
    1037 + if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter))
    1038 + return -EINVAL;
    1039 +
    1040 count = optlen / sizeof(struct can_filter);
    1041
    1042 if (count > 1) {