From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id B24FB1382C5 for ; Sun, 8 Apr 2018 14:31:14 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CF2E6E08CA; Sun, 8 Apr 2018 14:31:13 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9487CE08CA for ; Sun, 8 Apr 2018 14:31:13 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 92EEC335C30 for ; Sun, 8 Apr 2018 14:31:11 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id BC59C26D for ; Sun, 8 Apr 2018 14:31:09 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1523197859.14243423be4baa539a5f9b13c2ddbeed904b7cad.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.15 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1015_linux-4.15.16.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 14243423be4baa539a5f9b13c2ddbeed904b7cad X-VCS-Branch: 4.15 Date: Sun, 8 Apr 2018 14:31:09 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 5c1e851a-74b8-459f-8798-a20fb4bd23a6 X-Archives-Hash: 8be3e6e4584a4406dda859020f0d4f54 commit: 14243423be4baa539a5f9b13c2ddbeed904b7cad Author: Mike Pagano gentoo org> AuthorDate: Sun Apr 8 14:30:59 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun Apr 8 14:30:59 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=14243423 Linux patch 4.15.16 0000_README | 4 + 1015_linux-4.15.16.patch | 2899 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2903 insertions(+) diff --git a/0000_README b/0000_README index f1a4ce6..ba8435c 100644 --- a/0000_README +++ b/0000_README @@ -103,6 +103,10 @@ Patch: 1014_linux-4.15.15.patch From: http://www.kernel.org Desc: Linux 4.15.15 +Patch: 1015_linux-4.15.16.patch +From: http://www.kernel.org +Desc: Linux 4.15.16 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1015_linux-4.15.16.patch b/1015_linux-4.15.16.patch new file mode 100644 index 0000000..bec9a07 --- /dev/null +++ b/1015_linux-4.15.16.patch @@ -0,0 +1,2899 @@ +diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt +index dad3b2ec66d4..aeb6db4e35c3 100644 +--- a/Documentation/devicetree/bindings/serial/8250.txt ++++ b/Documentation/devicetree/bindings/serial/8250.txt +@@ -24,6 +24,7 @@ Required properties: + - "ti,da830-uart" + - "aspeed,ast2400-vuart" + - "aspeed,ast2500-vuart" ++ - "nuvoton,npcm750-uart" + - "serial" if the port type is unknown. + - reg : offset and length of the register set for the device. + - interrupts : should contain uart interrupt. +diff --git a/Makefile b/Makefile +index 20c9b7bfeed4..b28f0f721ec7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 15 +-SUBLEVEL = 15 ++SUBLEVEL = 16 + EXTRAVERSION = + NAME = Fearless Coyote + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 9fb7426070ce..03c7d77023c6 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/dra76-evm.dts b/arch/arm/boot/dts/dra76-evm.dts +index b024a65c6e27..f64aab450315 100644 +--- a/arch/arm/boot/dts/dra76-evm.dts ++++ b/arch/arm/boot/dts/dra76-evm.dts +@@ -148,6 +148,7 @@ + compatible = "ti,tps65917"; + reg = <0x58>; + ti,system-power-controller; ++ ti,palmas-override-powerhold; + interrupt-controller; + #interrupt-cells = <2>; + +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 5362139d5312..669c51c00c00 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -558,7 +558,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -575,7 +575,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +index 51e6f1d21c32..b2758dd8ce43 100644 +--- a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +@@ -42,7 +42,6 @@ + + /dts-v1/; + #include "sun6i-a31s.dtsi" +-#include "sunxi-common-regulators.dtsi" + #include + + / { +@@ -99,6 +98,7 @@ + pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>; + phy = <&phy1>; + phy-mode = "rgmii"; ++ phy-supply = <®_dldo1>; + snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */ + snps,reset-active-low; + snps,reset-delays-us = <0 10000 30000>; +@@ -118,7 +118,7 @@ + &mmc0 { + pinctrl-names = "default"; + pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>; +- vmmc-supply = <®_vcc3v0>; ++ vmmc-supply = <®_dcdc1>; + bus-width = <4>; + cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */ + cd-inverted; +@@ -132,7 +132,7 @@ + &mmc2 { + pinctrl-names = "default"; + pinctrl-0 = <&mmc2_pins_a>; +- vmmc-supply = <®_vcc3v0>; ++ vmmc-supply = <®_aldo1>; + mmc-pwrseq = <&mmc2_pwrseq>; + bus-width = <4>; + non-removable; +@@ -163,6 +163,8 @@ + reg = <0x68>; + interrupt-parent = <&nmi_intc>; + interrupts = <0 IRQ_TYPE_LEVEL_LOW>; ++ eldoin-supply = <®_dcdc1>; ++ x-powers,drive-vbus-en; + }; + }; + +@@ -193,7 +195,28 @@ + + #include "axp22x.dtsi" + ++®_aldo1 { ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-wifi"; ++}; ++ ++®_aldo2 { ++ regulator-always-on; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ regulator-name = "vcc-gmac"; ++}; ++ ++®_aldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ regulator-name = "avcc"; ++}; ++ + ®_dc5ldo { ++ regulator-always-on; + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1320000>; + regulator-name = "vdd-cpus"; +@@ -233,6 +256,40 @@ + regulator-name = "vcc-dram"; + }; + ++®_dldo1 { ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ regulator-name = "vcc-mac"; ++}; ++ ++®_dldo2 { ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ regulator-name = "avdd-csi"; ++}; ++ ++®_dldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-pb"; ++}; ++ ++®_eldo1 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-name = "vdd-csi"; ++ status = "okay"; ++}; ++ ++®_ldo_io1 { ++ regulator-always-on; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-name = "vcc-pm-cpus"; ++ status = "okay"; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pins_a>; +diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile +index 30ef8e291271..c9919c2b7ad1 100644 +--- a/arch/arm/crypto/Makefile ++++ b/arch/arm/crypto/Makefile +@@ -54,6 +54,7 @@ crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o + crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o + chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o + ++ifdef REGENERATE_ARM_CRYPTO + quiet_cmd_perl = PERL $@ + cmd_perl = $(PERL) $(<) > $(@) + +@@ -62,5 +63,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha256-armv4.pl + + $(src)/sha512-core.S_shipped: $(src)/sha512-armv4.pl + $(call cmd,perl) ++endif + + .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S +diff --git a/arch/arm/plat-omap/include/plat/sram.h b/arch/arm/plat-omap/include/plat/sram.h +index fb061cf0d736..30a07730807a 100644 +--- a/arch/arm/plat-omap/include/plat/sram.h ++++ b/arch/arm/plat-omap/include/plat/sram.h +@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long size, + unsigned long skip, int cached); + void omap_sram_reset(void); + +-extern void *omap_sram_push_address(unsigned long size); +- +-/* Macro to push a function to the internal SRAM, using the fncpy API */ +-#define omap_sram_push(funcp, size) ({ \ +- typeof(&(funcp)) _res = NULL; \ +- void *_sram_address = omap_sram_push_address(size); \ +- if (_sram_address) \ +- _res = fncpy(_sram_address, &(funcp), size); \ +- _res; \ +-}) ++extern void *omap_sram_push(void *funcp, unsigned long size); +diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c +index a5bc92d7e476..921840acf65c 100644 +--- a/arch/arm/plat-omap/sram.c ++++ b/arch/arm/plat-omap/sram.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil; + * Note that fncpy requires the returned address to be aligned + * to an 8-byte boundary. + */ +-void *omap_sram_push_address(unsigned long size) ++static void *omap_sram_push_address(unsigned long size) + { + unsigned long available, new_ceil = (unsigned long)omap_sram_ceil; + +@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned long size) + return (void *)omap_sram_ceil; + } + ++void *omap_sram_push(void *funcp, unsigned long size) ++{ ++ void *sram; ++ unsigned long base; ++ int pages; ++ void *dst = NULL; ++ ++ sram = omap_sram_push_address(size); ++ if (!sram) ++ return NULL; ++ ++ base = (unsigned long)sram & PAGE_MASK; ++ pages = PAGE_ALIGN(size) / PAGE_SIZE; ++ ++ set_memory_rw(base, pages); ++ ++ dst = fncpy(sram, funcp, size); ++ ++ set_memory_ro(base, pages); ++ set_memory_x(base, pages); ++ ++ return dst; ++} ++ + /* + * The SRAM context is lost during off-idle and stack + * needs to be reset. +@@ -75,6 +100,9 @@ void omap_sram_reset(void) + void __init omap_map_sram(unsigned long start, unsigned long size, + unsigned long skip, int cached) + { ++ unsigned long base; ++ int pages; ++ + if (size == 0) + return; + +@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long start, unsigned long size, + */ + memset_io(omap_sram_base + omap_sram_skip, 0, + omap_sram_size - omap_sram_skip); ++ ++ base = (unsigned long)omap_sram_base; ++ pages = PAGE_ALIGN(omap_sram_size) / PAGE_SIZE; ++ ++ set_memory_ro(base, pages); ++ set_memory_x(base, pages); + } +diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c +index a71a48e71fff..aa7496be311d 100644 +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp, + */ + static int vfp_dying_cpu(unsigned int cpu) + { +- vfp_force_reload(cpu, current_thread_info()); ++ vfp_current_hw_state[cpu] = NULL; + return 0; + } + +diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile +index b5edc5918c28..12fd81af1d1c 100644 +--- a/arch/arm64/crypto/Makefile ++++ b/arch/arm64/crypto/Makefile +@@ -58,6 +58,7 @@ CFLAGS_aes-glue-ce.o := -DUSE_V8_CRYPTO_EXTENSIONS + $(obj)/aes-glue-%.o: $(src)/aes-glue.c FORCE + $(call if_changed_rule,cc_o_c) + ++ifdef REGENERATE_ARM64_CRYPTO + quiet_cmd_perlasm = PERLASM $@ + cmd_perlasm = $(PERL) $(<) void $(@) + +@@ -66,5 +67,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha512-armv8.pl + + $(src)/sha512-core.S_shipped: $(src)/sha512-armv8.pl + $(call cmd,perlasm) ++endif + + .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S +diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h +index c9448e19847a..62290feddd56 100644 +--- a/arch/powerpc/include/asm/book3s/64/mmu.h ++++ b/arch/powerpc/include/asm/book3s/64/mmu.h +@@ -87,6 +87,9 @@ typedef struct { + /* Number of bits in the mm_cpumask */ + atomic_t active_cpus; + ++ /* Number of users of the external (Nest) MMU */ ++ atomic_t copros; ++ + /* NPU NMMU context */ + struct npu_context *npu_context; + +diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h +index e2a2b8400490..4f8a03c74e3f 100644 +--- a/arch/powerpc/include/asm/mmu_context.h ++++ b/arch/powerpc/include/asm/mmu_context.h +@@ -92,15 +92,23 @@ static inline void dec_mm_active_cpus(struct mm_struct *mm) + static inline void mm_context_add_copro(struct mm_struct *mm) + { + /* +- * On hash, should only be called once over the lifetime of +- * the context, as we can't decrement the active cpus count +- * and flush properly for the time being. ++ * If any copro is in use, increment the active CPU count ++ * in order to force TLB invalidations to be global as to ++ * propagate to the Nest MMU. + */ +- inc_mm_active_cpus(mm); ++ if (atomic_inc_return(&mm->context.copros) == 1) ++ inc_mm_active_cpus(mm); + } + + static inline void mm_context_remove_copro(struct mm_struct *mm) + { ++ int c; ++ ++ c = atomic_dec_if_positive(&mm->context.copros); ++ ++ /* Detect imbalance between add and remove */ ++ WARN_ON(c < 0); ++ + /* + * Need to broadcast a global flush of the full mm before + * decrementing active_cpus count, as the next TLBI may be +@@ -111,7 +119,7 @@ static inline void mm_context_remove_copro(struct mm_struct *mm) + * for the time being. Invalidations will remain global if + * used on hash. + */ +- if (radix_enabled()) { ++ if (c == 0 && radix_enabled()) { + flush_all_mm(mm); + dec_mm_active_cpus(mm); + } +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 2dc10bf646b8..9b060a41185e 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb) + ld r3, PACA_EXSLB+EX_DAR(r13) + std r3, _DAR(r1) + beq cr6, 2f +- li r10, 0x480 /* fix trap number for I-SLB miss */ ++ li r10, 0x481 /* fix trap number for I-SLB miss */ + std r10, _TRAP(r1) + 2: bl save_nvgprs + addi r3, r1, STACK_FRAME_OVERHEAD +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index b7a84522e652..c933632aa08d 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -475,6 +475,14 @@ void force_external_irq_replay(void) + */ + WARN_ON(!arch_irqs_disabled()); + ++ /* ++ * Interrupts must always be hard disabled before irq_happened is ++ * modified (to prevent lost update in case of interrupt between ++ * load and store). ++ */ ++ __hard_irq_disable(); ++ local_paca->irq_happened |= PACA_IRQ_HARD_DIS; ++ + /* Indicate in the PACA that we have an interrupt to replay */ + local_paca->irq_happened |= PACA_IRQ_EE; + } +diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c +index 59c0766ae4e0..5066276229f8 100644 +--- a/arch/powerpc/mm/mmu_context_book3s64.c ++++ b/arch/powerpc/mm/mmu_context_book3s64.c +@@ -171,6 +171,7 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) + mm_iommu_init(mm); + #endif + atomic_set(&mm->context.active_cpus, 0); ++ atomic_set(&mm->context.copros, 0); + + return 0; + } +diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c +index 913a2b81b177..91afe00abbb0 100644 +--- a/arch/powerpc/mm/tlb-radix.c ++++ b/arch/powerpc/mm/tlb-radix.c +@@ -85,7 +85,23 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric) + static inline void _tlbie_pid(unsigned long pid, unsigned long ric) + { + asm volatile("ptesync": : :"memory"); +- __tlbie_pid(pid, ric); ++ ++ /* ++ * Workaround the fact that the "ric" argument to __tlbie_pid ++ * must be a compile-time contraint to match the "i" constraint ++ * in the asm statement. ++ */ ++ switch (ric) { ++ case RIC_FLUSH_TLB: ++ __tlbie_pid(pid, RIC_FLUSH_TLB); ++ break; ++ case RIC_FLUSH_PWC: ++ __tlbie_pid(pid, RIC_FLUSH_PWC); ++ break; ++ case RIC_FLUSH_ALL: ++ default: ++ __tlbie_pid(pid, RIC_FLUSH_ALL); ++ } + asm volatile("eieio; tlbsync; ptesync": : :"memory"); + } + +@@ -245,6 +261,16 @@ void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmadd + } + EXPORT_SYMBOL(radix__local_flush_tlb_page); + ++static bool mm_needs_flush_escalation(struct mm_struct *mm) ++{ ++ /* ++ * P9 nest MMU has issues with the page walk cache ++ * caching PTEs and not flushing them properly when ++ * RIC = 0 for a PID/LPID invalidate ++ */ ++ return atomic_read(&mm->context.copros) != 0; ++} ++ + #ifdef CONFIG_SMP + void radix__flush_tlb_mm(struct mm_struct *mm) + { +@@ -255,9 +281,12 @@ void radix__flush_tlb_mm(struct mm_struct *mm) + return; + + preempt_disable(); +- if (!mm_is_thread_local(mm)) +- _tlbie_pid(pid, RIC_FLUSH_TLB); +- else ++ if (!mm_is_thread_local(mm)) { ++ if (mm_needs_flush_escalation(mm)) ++ _tlbie_pid(pid, RIC_FLUSH_ALL); ++ else ++ _tlbie_pid(pid, RIC_FLUSH_TLB); ++ } else + _tlbiel_pid(pid, RIC_FLUSH_TLB); + preempt_enable(); + } +@@ -369,10 +398,14 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start, + } + + if (full) { +- if (local) ++ if (local) { + _tlbiel_pid(pid, RIC_FLUSH_TLB); +- else +- _tlbie_pid(pid, RIC_FLUSH_TLB); ++ } else { ++ if (mm_needs_flush_escalation(mm)) ++ _tlbie_pid(pid, RIC_FLUSH_ALL); ++ else ++ _tlbie_pid(pid, RIC_FLUSH_TLB); ++ } + } else { + bool hflush = false; + unsigned long hstart, hend; +@@ -482,6 +515,9 @@ static inline void __radix__flush_tlb_range_psize(struct mm_struct *mm, + } + + if (full) { ++ if (!local && mm_needs_flush_escalation(mm)) ++ also_pwc = true; ++ + if (local) + _tlbiel_pid(pid, also_pwc ? RIC_FLUSH_ALL : RIC_FLUSH_TLB); + else +diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c +index dbea6020ffe7..575292a33bdf 100644 +--- a/arch/x86/crypto/cast5_avx_glue.c ++++ b/arch/x86/crypto/cast5_avx_glue.c +@@ -66,8 +66,6 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + void (*fn)(struct cast5_ctx *ctx, u8 *dst, const u8 *src); + int err; + +- fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; +- + err = blkcipher_walk_virt(desc, walk); + desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; + +@@ -79,6 +77,7 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + + /* Process multi-block batch */ + if (nbytes >= bsize * CAST5_PARALLEL_BLOCKS) { ++ fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; + do { + fn(ctx, wdst, wsrc); + +diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h +index 2851077b6051..32e666e1231e 100644 +--- a/arch/x86/include/asm/hw_irq.h ++++ b/arch/x86/include/asm/hw_irq.h +@@ -36,6 +36,7 @@ extern asmlinkage void kvm_posted_intr_wakeup_ipi(void); + extern asmlinkage void kvm_posted_intr_nested_ipi(void); + extern asmlinkage void error_interrupt(void); + extern asmlinkage void irq_work_interrupt(void); ++extern asmlinkage void uv_bau_message_intr1(void); + + extern asmlinkage void spurious_interrupt(void); + extern asmlinkage void thermal_interrupt(void); +diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c +index 50bee5fe1140..2c3a1b4294eb 100644 +--- a/arch/x86/kernel/idt.c ++++ b/arch/x86/kernel/idt.c +@@ -140,6 +140,9 @@ static const __initconst struct idt_data apic_idts[] = { + # ifdef CONFIG_IRQ_WORK + INTG(IRQ_WORK_VECTOR, irq_work_interrupt), + # endif ++#ifdef CONFIG_X86_UV ++ INTG(UV_BAU_MESSAGE, uv_bau_message_intr1), ++#endif + INTG(SPURIOUS_APIC_VECTOR, spurious_interrupt), + INTG(ERROR_APIC_VECTOR, error_interrupt), + #endif +diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c +index 7d5d53f36a7a..0b530c53de1f 100644 +--- a/arch/x86/platform/uv/tlb_uv.c ++++ b/arch/x86/platform/uv/tlb_uv.c +@@ -2254,8 +2254,6 @@ static int __init uv_bau_init(void) + init_uvhub(uvhub, vector, uv_base_pnode); + } + +- alloc_intr_gate(vector, uv_bau_message_intr1); +- + for_each_possible_blade(uvhub) { + if (uv_blade_nr_possible_cpus(uvhub)) { + unsigned long val; +diff --git a/block/bio.c b/block/bio.c +index 9ef6cf3addb3..2dd0c1305be5 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -43,9 +43,9 @@ + * break badly! cannot be bigger than what you can fit into an + * unsigned short + */ +-#define BV(x) { .nr_vecs = x, .name = "biovec-"__stringify(x) } ++#define BV(x, n) { .nr_vecs = x, .name = "biovec-"#n } + static struct biovec_slab bvec_slabs[BVEC_POOL_NR] __read_mostly = { +- BV(1), BV(4), BV(16), BV(64), BV(128), BV(BIO_MAX_PAGES), ++ BV(1, 1), BV(4, 4), BV(16, 16), BV(64, 64), BV(128, 128), BV(BIO_MAX_PAGES, max), + }; + #undef BV + +diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c +index 0af3a3db6fb0..82c44f7df911 100644 +--- a/block/partitions/msdos.c ++++ b/block/partitions/msdos.c +@@ -301,7 +301,9 @@ static void parse_bsd(struct parsed_partitions *state, + continue; + bsd_start = le32_to_cpu(p->p_offset); + bsd_size = le32_to_cpu(p->p_size); +- if (memcmp(flavour, "bsd\0", 4) == 0) ++ /* FreeBSD has relative offset if C partition offset is zero */ ++ if (memcmp(flavour, "bsd\0", 4) == 0 && ++ le32_to_cpu(l->d_partitions[2].p_offset) == 0) + bsd_start += offset; + if (offset == bsd_start && size == bsd_size) + /* full parent partition, we have it already */ +diff --git a/crypto/ahash.c b/crypto/ahash.c +index 266fc1d64f61..c03cc177870b 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -92,13 +92,14 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) + + if (nbytes && walk->offset & alignmask && !err) { + walk->offset = ALIGN(walk->offset, alignmask + 1); +- walk->data += walk->offset; +- + nbytes = min(nbytes, + ((unsigned int)(PAGE_SIZE)) - walk->offset); + walk->entrylen -= nbytes; + +- return nbytes; ++ if (nbytes) { ++ walk->data += walk->offset; ++ return nbytes; ++ } + } + + if (walk->flags & CRYPTO_ALG_ASYNC) +diff --git a/crypto/lrw.c b/crypto/lrw.c +index cbbd7c50ad19..1d813a6d3fec 100644 +--- a/crypto/lrw.c ++++ b/crypto/lrw.c +@@ -313,7 +313,7 @@ static void exit_crypt(struct skcipher_request *req) + rctx->left = 0; + + if (rctx->ext) +- kfree(rctx->ext); ++ kzfree(rctx->ext); + } + + static int do_encrypt(struct skcipher_request *req, int err) +diff --git a/crypto/testmgr.h b/crypto/testmgr.h +index a714b6293959..a3cd18476e40 100644 +--- a/crypto/testmgr.h ++++ b/crypto/testmgr.h +@@ -548,7 +548,7 @@ static const struct akcipher_testvec rsa_tv_template[] = { + static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = { + { + .key = +- "\x30\x82\x03\x1f\x02\x01\x10\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" ++ "\x30\x82\x03\x1f\x02\x01\x00\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" + "\x8c\x92\x31\xe7\x69\x02\xa2\xd5\x5c\x78\xde\xa2\x0c\x8f\xfe\x28" + "\x59\x31\xdf\x40\x9c\x60\x61\x06\xb9\x2f\x62\x40\x80\x76\xcb\x67" + "\x4a\xb5\x59\x56\x69\x17\x07\xfa\xf9\x4c\xbd\x6c\x37\x7a\x46\x7d" +@@ -597,8 +597,8 @@ static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = { + "\xfe\xf8\x27\x1b\xd6\x55\x60\x5e\x48\xb7\x6d\x9a\xa8\x37\xf9\x7a" + "\xde\x1b\xcd\x5d\x1a\x30\xd4\xe9\x9e\x5b\x3c\x15\xf8\x9c\x1f\xda" + "\xd1\x86\x48\x55\xce\x83\xee\x8e\x51\xc7\xde\x32\x12\x47\x7d\x46" +- "\xb8\x35\xdf\x41\x02\x01\x30\x02\x01\x30\x02\x01\x30\x02\x01\x30" +- "\x02\x01\x30", ++ "\xb8\x35\xdf\x41\x02\x01\x00\x02\x01\x00\x02\x01\x00\x02\x01\x00" ++ "\x02\x01\x00", + .key_len = 804, + /* + * m is SHA256 hash of following message: +diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c +index 4de87b0b53c8..8bfd498d3090 100644 +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -175,11 +175,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) + } + + #ifdef CONFIG_CPU_FREQ +-static cpumask_var_t cpus_to_visit __initdata; +-static void __init parsing_done_workfn(struct work_struct *work); +-static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn); ++static cpumask_var_t cpus_to_visit; ++static void parsing_done_workfn(struct work_struct *work); ++static DECLARE_WORK(parsing_done_work, parsing_done_workfn); + +-static int __init ++static int + init_cpu_capacity_callback(struct notifier_block *nb, + unsigned long val, + void *data) +@@ -215,7 +215,7 @@ init_cpu_capacity_callback(struct notifier_block *nb, + return 0; + } + +-static struct notifier_block init_cpu_capacity_notifier __initdata = { ++static struct notifier_block init_cpu_capacity_notifier = { + .notifier_call = init_cpu_capacity_callback, + }; + +@@ -248,7 +248,7 @@ static int __init register_cpufreq_notifier(void) + } + core_initcall(register_cpufreq_notifier); + +-static void __init parsing_done_workfn(struct work_struct *work) ++static void parsing_done_workfn(struct work_struct *work) + { + cpufreq_unregister_notifier(&init_cpu_capacity_notifier, + CPUFREQ_POLICY_NOTIFIER); +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index 052011bcf100..ffeb60d3434c 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -137,7 +137,7 @@ static ssize_t read_mem(struct file *file, char __user *buf, + + while (count > 0) { + unsigned long remaining; +- int allowed; ++ int allowed, probe; + + sz = size_inside_page(p, count); + +@@ -160,9 +160,9 @@ static ssize_t read_mem(struct file *file, char __user *buf, + if (!ptr) + goto failed; + +- err = probe_kernel_read(bounce, ptr, sz); ++ probe = probe_kernel_read(bounce, ptr, sz); + unxlate_dev_mem_ptr(p, ptr); +- if (err) ++ if (probe) + goto failed; + + remaining = copy_to_user(buf, bounce, sz); +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index d6a3038a128d..41d148af7748 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -637,8 +637,6 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } +- if (t && !try_module_get(t->owner)) +- t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -767,10 +765,6 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); +- +- if (new_policy.governor) +- module_put(new_policy.governor->owner); +- + return ret ? ret : count; + } + +diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c +index e1d4ae1153c4..39f70411f28f 100644 +--- a/drivers/crypto/caam/ctrl.c ++++ b/drivers/crypto/caam/ctrl.c +@@ -813,9 +813,6 @@ static int caam_probe(struct platform_device *pdev) + return 0; + + caam_remove: +-#ifdef CONFIG_DEBUG_FS +- debugfs_remove_recursive(ctrlpriv->dfs_root); +-#endif + caam_remove(pdev); + return ret; + +diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c +index e6db8672d89c..05850dfd7940 100644 +--- a/drivers/crypto/ccp/ccp-crypto-rsa.c ++++ b/drivers/crypto/ccp/ccp-crypto-rsa.c +@@ -60,10 +60,9 @@ static int ccp_rsa_complete(struct crypto_async_request *async_req, int ret) + + static unsigned int ccp_rsa_maxsize(struct crypto_akcipher *tfm) + { +- if (ccp_version() > CCP_VERSION(3, 0)) +- return CCP5_RSA_MAXMOD; +- else +- return CCP_RSA_MAXMOD; ++ struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm); ++ ++ return ctx->u.rsa.n_len; + } + + static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt) +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 4bcef78a08aa..d4c81cb73bee 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -789,7 +789,7 @@ static int safexcel_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + +- priv->clk = of_clk_get(dev->of_node, 0); ++ priv->clk = devm_clk_get(&pdev->dev, NULL); + if (!IS_ERR(priv->clk)) { + ret = clk_prepare_enable(priv->clk); + if (ret) { +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index 6882fa2f8bad..c805d0122c0b 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -832,8 +832,6 @@ struct talitos_ctx { + unsigned int keylen; + unsigned int enckeylen; + unsigned int authkeylen; +- dma_addr_t dma_buf; +- dma_addr_t dma_hw_context; + }; + + #define HASH_MAX_BLOCK_SIZE SHA512_BLOCK_SIZE +@@ -1130,10 +1128,10 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count, + return count; + } + +-static int talitos_sg_map(struct device *dev, struct scatterlist *src, +- unsigned int len, struct talitos_edesc *edesc, +- struct talitos_ptr *ptr, +- int sg_count, unsigned int offset, int tbl_off) ++static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src, ++ unsigned int len, struct talitos_edesc *edesc, ++ struct talitos_ptr *ptr, int sg_count, ++ unsigned int offset, int tbl_off, int elen) + { + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); +@@ -1142,6 +1140,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src, + to_talitos_ptr(ptr, 0, 0, is_sec1); + return 1; + } ++ to_talitos_ptr_ext_set(ptr, elen, is_sec1); + if (sg_count == 1) { + to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1); + return sg_count; +@@ -1150,7 +1149,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src, + to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1); + return sg_count; + } +- sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, ++ sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen, + &edesc->link_tbl[tbl_off]); + if (sg_count == 1) { + /* Only one segment now, so no link tbl needed*/ +@@ -1164,6 +1163,15 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src, + return sg_count; + } + ++static int talitos_sg_map(struct device *dev, struct scatterlist *src, ++ unsigned int len, struct talitos_edesc *edesc, ++ struct talitos_ptr *ptr, int sg_count, ++ unsigned int offset, int tbl_off) ++{ ++ return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset, ++ tbl_off, 0); ++} ++ + /* + * fill in and submit ipsec_esp descriptor + */ +@@ -1181,7 +1189,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + unsigned int ivsize = crypto_aead_ivsize(aead); + int tbl_off = 0; + int sg_count, ret; +- int sg_link_tbl_len; ++ int elen = 0; + bool sync_needed = false; + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); +@@ -1223,17 +1231,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + * extent is bytes of HMAC postpended to ciphertext, + * typically 12 for ipsec + */ +- sg_link_tbl_len = cryptlen; +- +- if (is_ipsec_esp) { +- to_talitos_ptr_ext_set(&desc->ptr[4], authsize, is_sec1); +- +- if (desc->hdr & DESC_HDR_MODE1_MDEU_CICV) +- sg_link_tbl_len += authsize; +- } ++ if (is_ipsec_esp && (desc->hdr & DESC_HDR_MODE1_MDEU_CICV)) ++ elen = authsize; + +- ret = talitos_sg_map(dev, areq->src, sg_link_tbl_len, edesc, +- &desc->ptr[4], sg_count, areq->assoclen, tbl_off); ++ ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4], ++ sg_count, areq->assoclen, tbl_off, elen); + + if (ret > 1) { + tbl_off += ret; +@@ -1690,9 +1692,30 @@ static void common_nonsnoop_hash_unmap(struct device *dev, + struct ahash_request *areq) + { + struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); ++ struct talitos_private *priv = dev_get_drvdata(dev); ++ bool is_sec1 = has_ftr_sec1(priv); ++ struct talitos_desc *desc = &edesc->desc; ++ struct talitos_desc *desc2 = desc + 1; ++ ++ unmap_single_talitos_ptr(dev, &edesc->desc.ptr[5], DMA_FROM_DEVICE); ++ if (desc->next_desc && ++ desc->ptr[5].ptr != desc2->ptr[5].ptr) ++ unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE); + + talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0); + ++ /* When using hashctx-in, must unmap it. */ ++ if (from_talitos_ptr_len(&edesc->desc.ptr[1], is_sec1)) ++ unmap_single_talitos_ptr(dev, &edesc->desc.ptr[1], ++ DMA_TO_DEVICE); ++ else if (desc->next_desc) ++ unmap_single_talitos_ptr(dev, &desc2->ptr[1], ++ DMA_TO_DEVICE); ++ ++ if (is_sec1 && req_ctx->nbuf) ++ unmap_single_talitos_ptr(dev, &desc->ptr[3], ++ DMA_TO_DEVICE); ++ + if (edesc->dma_len) + dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len, + DMA_BIDIRECTIONAL); +@@ -1766,8 +1789,10 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, + + /* hash context in */ + if (!req_ctx->first || req_ctx->swinit) { +- to_talitos_ptr(&desc->ptr[1], ctx->dma_hw_context, +- req_ctx->hw_context_size, is_sec1); ++ map_single_talitos_ptr(dev, &desc->ptr[1], ++ req_ctx->hw_context_size, ++ (char *)req_ctx->hw_context, ++ DMA_TO_DEVICE); + req_ctx->swinit = 0; + } + /* Indicate next op is not the first. */ +@@ -1793,10 +1818,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, + * data in + */ + if (is_sec1 && req_ctx->nbuf) { +- dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx * +- HASH_MAX_BLOCK_SIZE; +- +- to_talitos_ptr(&desc->ptr[3], dma_buf, req_ctx->nbuf, is_sec1); ++ map_single_talitos_ptr(dev, &desc->ptr[3], req_ctx->nbuf, ++ req_ctx->buf[req_ctx->buf_idx], ++ DMA_TO_DEVICE); + } else { + sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc, + &desc->ptr[3], sg_count, offset, 0); +@@ -1812,8 +1836,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, + crypto_ahash_digestsize(tfm), + areq->result, DMA_FROM_DEVICE); + else +- to_talitos_ptr(&desc->ptr[5], ctx->dma_hw_context, +- req_ctx->hw_context_size, is_sec1); ++ map_single_talitos_ptr(dev, &desc->ptr[5], ++ req_ctx->hw_context_size, ++ req_ctx->hw_context, DMA_FROM_DEVICE); + + /* last DWORD empty */ + +@@ -1832,9 +1857,14 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, + desc->hdr |= DESC_HDR_MODE0_MDEU_CONT; + desc->hdr &= ~DESC_HDR_DONE_NOTIFY; + +- to_talitos_ptr(&desc2->ptr[1], ctx->dma_hw_context, +- req_ctx->hw_context_size, is_sec1); +- ++ if (desc->ptr[1].ptr) ++ copy_talitos_ptr(&desc2->ptr[1], &desc->ptr[1], ++ is_sec1); ++ else ++ map_single_talitos_ptr(dev, &desc2->ptr[1], ++ req_ctx->hw_context_size, ++ req_ctx->hw_context, ++ DMA_TO_DEVICE); + copy_talitos_ptr(&desc2->ptr[2], &desc->ptr[2], is_sec1); + sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc, + &desc2->ptr[3], sg_count, offset, 0); +@@ -1842,8 +1872,10 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, + sync_needed = true; + copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1); + if (req_ctx->last) +- to_talitos_ptr(&desc->ptr[5], ctx->dma_hw_context, +- req_ctx->hw_context_size, is_sec1); ++ map_single_talitos_ptr(dev, &desc->ptr[5], ++ req_ctx->hw_context_size, ++ req_ctx->hw_context, ++ DMA_FROM_DEVICE); + + next_desc = dma_map_single(dev, &desc2->hdr1, TALITOS_DESC_SIZE, + DMA_BIDIRECTIONAL); +@@ -1881,12 +1913,8 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq, + static int ahash_init(struct ahash_request *areq) + { + struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); +- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm); +- struct device *dev = ctx->dev; + struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); + unsigned int size; +- struct talitos_private *priv = dev_get_drvdata(dev); +- bool is_sec1 = has_ftr_sec1(priv); + + /* Initialize the context */ + req_ctx->buf_idx = 0; +@@ -1898,18 +1926,6 @@ static int ahash_init(struct ahash_request *areq) + : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; + req_ctx->hw_context_size = size; + +- if (ctx->dma_hw_context) +- dma_unmap_single(dev, ctx->dma_hw_context, size, +- DMA_BIDIRECTIONAL); +- ctx->dma_hw_context = dma_map_single(dev, req_ctx->hw_context, size, +- DMA_BIDIRECTIONAL); +- if (ctx->dma_buf) +- dma_unmap_single(dev, ctx->dma_buf, sizeof(req_ctx->buf), +- DMA_TO_DEVICE); +- if (is_sec1) +- ctx->dma_buf = dma_map_single(dev, req_ctx->buf, +- sizeof(req_ctx->buf), +- DMA_TO_DEVICE); + return 0; + } + +@@ -1920,9 +1936,6 @@ static int ahash_init(struct ahash_request *areq) + static int ahash_init_sha224_swinit(struct ahash_request *areq) + { + struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); +- struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); +- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm); +- struct device *dev = ctx->dev; + + ahash_init(areq); + req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/ +@@ -1940,9 +1953,6 @@ static int ahash_init_sha224_swinit(struct ahash_request *areq) + req_ctx->hw_context[8] = 0; + req_ctx->hw_context[9] = 0; + +- dma_sync_single_for_device(dev, ctx->dma_hw_context, +- req_ctx->hw_context_size, DMA_TO_DEVICE); +- + return 0; + } + +@@ -2046,13 +2056,6 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes) + /* request SEC to INIT hash. */ + if (req_ctx->first && !req_ctx->swinit) + edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT; +- if (is_sec1) { +- dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx * +- HASH_MAX_BLOCK_SIZE; +- +- dma_sync_single_for_device(dev, dma_buf, +- req_ctx->nbuf, DMA_TO_DEVICE); +- } + + /* When the tfm context has a keylen, it's an HMAC. + * A first or last (ie. not middle) descriptor must request HMAC. +@@ -2106,12 +2109,7 @@ static int ahash_export(struct ahash_request *areq, void *out) + { + struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq); + struct talitos_export_state *export = out; +- struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq); +- struct talitos_ctx *ctx = crypto_ahash_ctx(ahash); +- struct device *dev = ctx->dev; + +- dma_sync_single_for_cpu(dev, ctx->dma_hw_context, +- req_ctx->hw_context_size, DMA_FROM_DEVICE); + memcpy(export->hw_context, req_ctx->hw_context, + req_ctx->hw_context_size); + memcpy(export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf); +@@ -2130,31 +2128,14 @@ static int ahash_import(struct ahash_request *areq, const void *in) + struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); + const struct talitos_export_state *export = in; + unsigned int size; +- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm); +- struct device *dev = ctx->dev; +- struct talitos_private *priv = dev_get_drvdata(dev); +- bool is_sec1 = has_ftr_sec1(priv); + + memset(req_ctx, 0, sizeof(*req_ctx)); + size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE) + ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 + : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; + req_ctx->hw_context_size = size; +- if (ctx->dma_hw_context) +- dma_unmap_single(dev, ctx->dma_hw_context, size, +- DMA_BIDIRECTIONAL); +- + memcpy(req_ctx->hw_context, export->hw_context, size); +- ctx->dma_hw_context = dma_map_single(dev, req_ctx->hw_context, size, +- DMA_BIDIRECTIONAL); +- if (ctx->dma_buf) +- dma_unmap_single(dev, ctx->dma_buf, sizeof(req_ctx->buf), +- DMA_TO_DEVICE); + memcpy(req_ctx->buf[0], export->buf, export->nbuf); +- if (is_sec1) +- ctx->dma_buf = dma_map_single(dev, req_ctx->buf, +- sizeof(req_ctx->buf), +- DMA_TO_DEVICE); + req_ctx->swinit = export->swinit; + req_ctx->first = export->first; + req_ctx->last = export->last; +@@ -3064,27 +3045,6 @@ static void talitos_cra_exit(struct crypto_tfm *tfm) + dma_unmap_single(dev, ctx->dma_key, ctx->keylen, DMA_TO_DEVICE); + } + +-static void talitos_cra_exit_ahash(struct crypto_tfm *tfm) +-{ +- struct talitos_ctx *ctx = crypto_tfm_ctx(tfm); +- struct device *dev = ctx->dev; +- unsigned int size; +- +- talitos_cra_exit(tfm); +- +- size = (crypto_ahash_digestsize(__crypto_ahash_cast(tfm)) <= +- SHA256_DIGEST_SIZE) +- ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 +- : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; +- +- if (ctx->dma_hw_context) +- dma_unmap_single(dev, ctx->dma_hw_context, size, +- DMA_BIDIRECTIONAL); +- if (ctx->dma_buf) +- dma_unmap_single(dev, ctx->dma_buf, HASH_MAX_BLOCK_SIZE * 2, +- DMA_TO_DEVICE); +-} +- + /* + * given the alg's descriptor header template, determine whether descriptor + * type and primary/secondary execution units required match the hw +@@ -3183,7 +3143,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + case CRYPTO_ALG_TYPE_AHASH: + alg = &t_alg->algt.alg.hash.halg.base; + alg->cra_init = talitos_cra_init_ahash; +- alg->cra_exit = talitos_cra_exit_ahash; ++ alg->cra_exit = talitos_cra_exit; + alg->cra_type = &crypto_ahash_type; + t_alg->algt.alg.hash.init = ahash_init; + t_alg->algt.alg.hash.update = ahash_update; +diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c +index 58a3755544b2..38e53d6b8127 100644 +--- a/drivers/gpu/drm/i915/intel_ddi.c ++++ b/drivers/gpu/drm/i915/intel_ddi.c +@@ -2208,8 +2208,7 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder, + intel_prepare_dp_ddi_buffers(encoder); + + intel_ddi_init_dp_buf_reg(encoder); +- if (!is_mst) +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); ++ intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); + intel_dp_start_link_train(intel_dp); + if (port != PORT_A || INTEL_GEN(dev_priv) >= 9) + intel_dp_stop_link_train(intel_dp); +@@ -2294,19 +2293,12 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder, + struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); + struct intel_digital_port *dig_port = enc_to_dig_port(&encoder->base); + struct intel_dp *intel_dp = &dig_port->dp; +- /* +- * old_crtc_state and old_conn_state are NULL when called from +- * DP_MST. The main connector associated with this port is never +- * bound to a crtc for MST. +- */ +- bool is_mst = !old_crtc_state; + + /* + * Power down sink before disabling the port, otherwise we end + * up getting interrupts from the sink on detecting link loss. + */ +- if (!is_mst) +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF); ++ intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF); + + intel_disable_ddi_buf(encoder); + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index b445b3bb0bb1..f273e28c39db 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -888,6 +888,11 @@ static int stm32f7_i2c_probe(struct platform_device *pdev) + } + + setup = of_device_get_match_data(&pdev->dev); ++ if (!setup) { ++ dev_err(&pdev->dev, "Can't get device data\n"); ++ ret = -ENODEV; ++ goto clk_free; ++ } + i2c_dev->setup = *setup; + + ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns", +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index f4e8185bccd3..0885b8cfbe0b 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr) + } + EXPORT_SYMBOL(rdma_addr_size); + ++int rdma_addr_size_in6(struct sockaddr_in6 *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_in6); ++ ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_kss); ++ + static struct rdma_addr_client self; + + void rdma_addr_register_client(struct rdma_addr_client *client) +@@ -598,6 +614,15 @@ static void process_one_req(struct work_struct *_work) + list_del(&req->list); + mutex_unlock(&lock); + ++ /* ++ * Although the work will normally have been canceled by the ++ * workqueue, it can still be requeued as long as it is on the ++ * req_list, so it could have been requeued before we grabbed &lock. ++ * We need to cancel it after it is removed from req_list to really be ++ * sure it is safe to free. ++ */ ++ cancel_delayed_work(&req->work); ++ + req->callback(req->status, (struct sockaddr *)&req->src_addr, + req->addr, req->context); + put_client(req->client); +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 77ca9da570a2..722235bed075 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id, + ctx = idr_find(&ctx_idr, id); + if (!ctx) + ctx = ERR_PTR(-ENOENT); +- else if (ctx->file != file) ++ else if (ctx->file != file || !ctx->cm_id) + ctx = ERR_PTR(-EINVAL); + return ctx; + } +@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + struct rdma_ucm_create_id cmd; + struct rdma_ucm_create_id_resp resp; + struct ucma_context *ctx; ++ struct rdma_cm_id *cm_id; + enum ib_qp_type qp_type; + int ret; + +@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + return -ENOMEM; + + ctx->uid = cmd.uid; +- ctx->cm_id = rdma_create_id(current->nsproxy->net_ns, +- ucma_event_handler, ctx, cmd.ps, qp_type); +- if (IS_ERR(ctx->cm_id)) { +- ret = PTR_ERR(ctx->cm_id); ++ cm_id = rdma_create_id(current->nsproxy->net_ns, ++ ucma_event_handler, ctx, cmd.ps, qp_type); ++ if (IS_ERR(cm_id)) { ++ ret = PTR_ERR(cm_id); + goto err1; + } + +@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + ret = -EFAULT; + goto err2; + } ++ ++ ctx->cm_id = cm_id; + return 0; + + err2: +- rdma_destroy_id(ctx->cm_id); ++ rdma_destroy_id(cm_id); + err1: + mutex_lock(&mut); + idr_remove(&ctx_idr, ctx->id); + mutex_unlock(&mut); ++ mutex_lock(&file->mut); ++ list_del(&ctx->list); ++ mutex_unlock(&file->mut); + kfree(ctx); + return ret; + } +@@ -626,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -639,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf, + int in_len, int out_len) + { + struct rdma_ucm_bind cmd; +- struct sockaddr *addr; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- addr = (struct sockaddr *) &cmd.addr; +- if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr))) ++ if (cmd.reserved || !cmd.addr_size || ++ cmd.addr_size != rdma_addr_size_kss(&cmd.addr)) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_bind_addr(ctx->cm_id, addr); ++ ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr); + ucma_put_ctx(ctx); + return ret; + } +@@ -670,13 +678,16 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.src_addr) || ++ !rdma_addr_size_in6(&cmd.dst_addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + + ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, +- (struct sockaddr *) &cmd.dst_addr, +- cmd.timeout_ms); ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -686,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file, + int in_len, int out_len) + { + struct rdma_ucm_resolve_addr cmd; +- struct sockaddr *src, *dst; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- src = (struct sockaddr *) &cmd.src_addr; +- dst = (struct sockaddr *) &cmd.dst_addr; +- if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) || +- !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst))) ++ if (cmd.reserved || ++ (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) || ++ !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr))) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms); ++ ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -1155,6 +1165,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (!ctx->cm_id->device) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + resp.qp_attr_mask = 0; + memset(&qp_attr, 0, sizeof qp_attr); + qp_attr.qp_state = cmd.qp_state; +@@ -1320,7 +1335,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + { + struct rdma_ucm_notify cmd; + struct ucma_context *ctx; +- int ret; ++ int ret = -EINVAL; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; +@@ -1329,7 +1344,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event); ++ if (ctx->cm_id->device) ++ ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event); ++ + ucma_put_ctx(ctx); + return ret; + } +@@ -1415,7 +1432,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, + join_cmd.response = cmd.response; + join_cmd.uid = cmd.uid; + join_cmd.id = cmd.id; +- join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); ++ join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr); + if (!join_cmd.addr_size) + return -EINVAL; + +@@ -1434,7 +1451,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- if (!rdma_addr_size((struct sockaddr *)&cmd.addr)) ++ if (!rdma_addr_size_kss(&cmd.addr)) + return -EINVAL; + + return ucma_process_join(file, &cmd, out_len); +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index dbe57da8c1a1..4a3bc168a4a7 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -2544,13 +2544,31 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4], + } + + static int alps_update_dual_info_ss4_v2(unsigned char otp[][4], +- struct alps_data *priv) ++ struct alps_data *priv, ++ struct psmouse *psmouse) + { + bool is_dual = false; ++ int reg_val = 0; ++ struct ps2dev *ps2dev = &psmouse->ps2dev; + +- if (IS_SS4PLUS_DEV(priv->dev_id)) ++ if (IS_SS4PLUS_DEV(priv->dev_id)) { + is_dual = (otp[0][0] >> 4) & 0x01; + ++ if (!is_dual) { ++ /* For support TrackStick of Thinkpad L/E series */ ++ if (alps_exit_command_mode(psmouse) == 0 && ++ alps_enter_command_mode(psmouse) == 0) { ++ reg_val = alps_command_mode_read_reg(psmouse, ++ 0xD7); ++ } ++ alps_exit_command_mode(psmouse); ++ ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ ++ if (reg_val == 0x0C || reg_val == 0x1D) ++ is_dual = true; ++ } ++ } ++ + if (is_dual) + priv->flags |= ALPS_DUALPOINT | + ALPS_DUALPOINT_WITH_PRESSURE; +@@ -2573,7 +2591,7 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse, + + alps_update_btn_info_ss4_v2(otp, priv); + +- alps_update_dual_info_ss4_v2(otp, priv); ++ alps_update_dual_info_ss4_v2(otp, priv, psmouse); + + return 0; + } +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 6cbbdc6e9687..b353d494ad40 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -530,6 +530,20 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + { } + }; + ++static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { ++ { ++ /* ++ * Sony Vaio VGN-CS series require MUX or the touch sensor ++ * buttons will disturb touchpad operation ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), ++ }, ++ }, ++ { } ++}; ++ + /* + * On some Asus laptops, just running self tests cause problems. + */ +@@ -620,6 +634,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "20046"), + }, + }, ++ { ++ /* Lenovo ThinkPad L460 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"), ++ }, ++ }, + { + /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ + .matches = { +@@ -1163,6 +1184,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_nomux_table)) + i8042_nomux = true; + ++ if (dmi_check_system(i8042_dmi_forcemux_table)) ++ i8042_nomux = false; ++ + if (dmi_check_system(i8042_dmi_notimeout_table)) + i8042_notimeout = true; + +diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c +index 127f8a0c098b..0c2e628e8723 100644 +--- a/drivers/media/usb/usbtv/usbtv-core.c ++++ b/drivers/media/usb/usbtv/usbtv-core.c +@@ -112,6 +112,8 @@ static int usbtv_probe(struct usb_interface *intf, + return 0; + + usbtv_audio_fail: ++ /* we must not free at this point */ ++ usb_get_dev(usbtv->udev); + usbtv_video_free(usbtv); + + usbtv_video_fail: +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index e825f013e54e..22efc039f302 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -507,7 +507,6 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) + break; + + default: +- dev_err(dev->dev, ": unsupported ioctl %d.\n", cmd); + rets = -ENOIOCTLCMD; + } + +diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c +index 7c0b27d132b1..b479bd81120b 100644 +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base, + do { + uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi); + mask = (1 << (cfi->device_type * 8)) - 1; ++ if (ofs >= map->size) ++ return 0; + result = map_read(map, base + ofs); + bank++; + } while ((result.x[0] & mask) == CFI_MFR_CONTINUATION); +diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c +index fcbe4fd6e684..ca0a70389ba9 100644 +--- a/drivers/mtd/nand/atmel/pmecc.c ++++ b/drivers/mtd/nand/atmel/pmecc.c +@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmecc_user *user) + + static int get_sectorsize(struct atmel_pmecc_user *user) + { +- return user->cache.cfg & PMECC_LOOKUP_TABLE_SIZE_1024 ? 1024 : 512; ++ return user->cache.cfg & PMECC_CFG_SECTOR1024 ? 1024 : 512; + } + + static void atmel_pmecc_gen_syndrome(struct atmel_pmecc_user *user, int sector) +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index 86944bc3b273..74bd260ca02a 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data) + + static int hns_gmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ARRAY_SIZE(g_gmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index b62816c1574e..93e71e27401b 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) + + int hns_ppe_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ETH_PPE_STATIC_NUM; + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index 6f3570cfb501..e2e28532e4dc 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data) + */ + int hns_rcb_get_ring_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return HNS_RING_STATIC_REG_NUM; + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 7ea7f8a4aa2a..2e14a3ae1d8b 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset) + cnt--; + + return cnt; +- } else { ++ } else if (stringset == ETH_SS_STATS) { + return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset)); ++ } else { ++ return -EOPNOTSUPP; + } + } + +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index 489492b608cf..380916bff9e0 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2646,6 +2646,7 @@ enum parport_pc_pci_cards { + netmos_9901, + netmos_9865, + quatech_sppxp100, ++ wch_ch382l, + }; + + +@@ -2708,6 +2709,7 @@ static struct parport_pc_pci { + /* netmos_9901 */ { 1, { { 0, -1 }, } }, + /* netmos_9865 */ { 1, { { 0, -1 }, } }, + /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, ++ /* wch_ch382l */ { 1, { { 2, -1 }, } }, + }; + + static const struct pci_device_id parport_pc_pci_tbl[] = { +@@ -2797,6 +2799,8 @@ static const struct pci_device_id parport_pc_pci_tbl[] = { + /* Quatech SPPXP-100 Parallel port PCI ExpressCard */ + { PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 }, ++ /* WCH CH382L PCI-E single parallel port card */ ++ { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l }, + { 0, } /* terminate list */ + }; + MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl); +diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c +index c5ff4525edef..c5493ea51282 100644 +--- a/drivers/phy/qualcomm/phy-qcom-ufs.c ++++ b/drivers/phy/qualcomm/phy-qcom-ufs.c +@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy) + return 0; + } + EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off); ++ ++MODULE_AUTHOR("Yaniv Gardi "); ++MODULE_AUTHOR("Vivek Gautam "); ++MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY"); ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 398347fedc47..2cac160993bb 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -1284,6 +1284,8 @@ static void ack_a_interrupt(struct comedi_device *dev, unsigned short a_status) + ack |= NISTC_INTA_ACK_AI_START; + if (a_status & NISTC_AI_STATUS1_STOP) + ack |= NISTC_INTA_ACK_AI_STOP; ++ if (a_status & NISTC_AI_STATUS1_OVER) ++ ack |= NISTC_INTA_ACK_AI_ERR; + if (ack) + ni_stc_writew(dev, ack, NISTC_INTA_ACK_REG); + } +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index 160b8906d9b9..9835b1c1cbe1 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -316,6 +316,7 @@ static const struct of_device_id of_platform_serial_table[] = { + { .compatible = "mrvl,mmp-uart", + .data = (void *)PORT_XSCALE, }, + { .compatible = "ti,da830-uart", .data = (void *)PORT_DA830, }, ++ { .compatible = "nuvoton,npcm750-uart", .data = (void *)PORT_NPCM, }, + { /* end of list */ }, + }; + MODULE_DEVICE_TABLE(of, of_platform_serial_table); +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 11434551ac0a..2cda4b28c78a 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -47,6 +47,10 @@ + #define UART_EXAR_SLEEP 0x8b /* Sleep mode */ + #define UART_EXAR_DVID 0x8d /* Device identification */ + ++/* Nuvoton NPCM timeout register */ ++#define UART_NPCM_TOR 7 ++#define UART_NPCM_TOIE BIT(7) /* Timeout Interrupt Enable */ ++ + /* + * Debugging. + */ +@@ -293,6 +297,15 @@ static const struct serial8250_config uart_config[] = { + UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, + .flags = UART_CAP_FIFO, + }, ++ [PORT_NPCM] = { ++ .name = "Nuvoton 16550", ++ .fifo_size = 16, ++ .tx_loadsz = 16, ++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10 | ++ UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, ++ .rxtrig_bytes = {1, 4, 8, 14}, ++ .flags = UART_CAP_FIFO, ++ }, + }; + + /* Uart divisor latch read */ +@@ -2161,6 +2174,15 @@ int serial8250_do_startup(struct uart_port *port) + UART_DA830_PWREMU_MGMT_FREE); + } + ++ if (port->type == PORT_NPCM) { ++ /* ++ * Nuvoton calls the scratch register 'UART_TOR' (timeout ++ * register). Enable it, and set TIOC (timeout interrupt ++ * comparator) to be 0x20 for correct operation. ++ */ ++ serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20); ++ } ++ + #ifdef CONFIG_SERIAL_8250_RSA + /* + * If this is an RSA port, see if we can kick it up to the +@@ -2483,6 +2505,15 @@ static unsigned int xr17v35x_get_divisor(struct uart_8250_port *up, + return quot_16 >> 4; + } + ++/* Nuvoton NPCM UARTs have a custom divisor calculation */ ++static unsigned int npcm_get_divisor(struct uart_8250_port *up, ++ unsigned int baud) ++{ ++ struct uart_port *port = &up->port; ++ ++ return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2; ++} ++ + static unsigned int serial8250_get_divisor(struct uart_8250_port *up, + unsigned int baud, + unsigned int *frac) +@@ -2503,6 +2534,8 @@ static unsigned int serial8250_get_divisor(struct uart_8250_port *up, + quot = 0x8002; + else if (up->port.type == PORT_XR17V35X) + quot = xr17v35x_get_divisor(up, baud, frac); ++ else if (up->port.type == PORT_NPCM) ++ quot = npcm_get_divisor(up, baud); + else + quot = uart_get_divisor(port, baud); + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index b4e57c5a8bba..f97251f39c26 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1354,6 +1354,11 @@ static void csi_m(struct vc_data *vc) + case 3: + vc->vc_italic = 1; + break; ++ case 21: ++ /* ++ * No console drivers support double underline, so ++ * convert it to a single underline. ++ */ + case 4: + vc->vc_underline = 1; + break; +@@ -1389,7 +1394,6 @@ static void csi_m(struct vc_data *vc) + vc->vc_disp_ctrl = 1; + vc->vc_toggle_meta = 1; + break; +- case 21: + case 22: + vc->vc_intensity = 1; + break; +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 06d502b3e913..de1e759dd512 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ ++ { USB_DEVICE(0x155A, 0x1006) }, /* ELDAT Easywave RX09 */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ + { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index fc68952c994a..e456617216f9 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -769,6 +769,7 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, ++ { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, +@@ -931,6 +932,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, + { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 8b4ecd2bd297..975d02666c5a 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -923,6 +923,9 @@ + /* + * RT Systems programming cables for various ham radios + */ ++/* This device uses the VID of FTDI */ ++#define RTSYSTEMS_USB_VX8_PID 0x9e50 /* USB-VX8 USB to 7 pin modular plug for Yaesu VX-8 radio */ ++ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ + #define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */ + #define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */ +@@ -1441,6 +1444,12 @@ + */ + #define FTDI_CINTERION_MC55I_PID 0xA951 + ++/* ++ * Product: FirmwareHubEmulator ++ * Manufacturer: Harman Becker Automotive Systems ++ */ ++#define FTDI_FHE_PID 0xA9A0 ++ + /* + * Product: Comet Caller ID decoder + * Manufacturer: Crucible Technologies +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index c04183cc2117..ae07b3a2fb5d 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1257,6 +1257,8 @@ static noinline int csum_exist_in_range(struct btrfs_fs_info *fs_info, + list_del(&sums->list); + kfree(sums); + } ++ if (ret < 0) ++ return ret; + return 1; + } + +@@ -1389,10 +1391,23 @@ static noinline int run_delalloc_nocow(struct inode *inode, + goto out_check; + if (btrfs_extent_readonly(fs_info, disk_bytenr)) + goto out_check; +- if (btrfs_cross_ref_exist(root, ino, +- found_key.offset - +- extent_offset, disk_bytenr)) ++ ret = btrfs_cross_ref_exist(root, ino, ++ found_key.offset - ++ extent_offset, disk_bytenr); ++ if (ret) { ++ /* ++ * ret could be -EIO if the above fails to read ++ * metadata. ++ */ ++ if (ret < 0) { ++ if (cow_start != (u64)-1) ++ cur_offset = cow_start; ++ goto error; ++ } ++ ++ WARN_ON_ONCE(nolock); + goto out_check; ++ } + disk_bytenr += extent_offset; + disk_bytenr += cur_offset - found_key.offset; + num_bytes = min(end + 1, extent_end) - cur_offset; +@@ -1410,10 +1425,22 @@ static noinline int run_delalloc_nocow(struct inode *inode, + * this ensure that csum for a given extent are + * either valid or do not exist. + */ +- if (csum_exist_in_range(fs_info, disk_bytenr, +- num_bytes)) { ++ ret = csum_exist_in_range(fs_info, disk_bytenr, ++ num_bytes); ++ if (ret) { + if (!nolock) + btrfs_end_write_no_snapshotting(root); ++ ++ /* ++ * ret could be -EIO if the above fails to read ++ * metadata. ++ */ ++ if (ret < 0) { ++ if (cow_start != (u64)-1) ++ cur_offset = cow_start; ++ goto error; ++ } ++ WARN_ON_ONCE(nolock); + goto out_check; + } + if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) { +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 5c17125f45c7..0024d3e61bcd 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -635,7 +635,8 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to, + struct ceph_aio_request { + struct kiocb *iocb; + size_t total_len; +- int write; ++ bool write; ++ bool should_dirty; + int error; + struct list_head osd_reqs; + unsigned num_reqs; +@@ -745,7 +746,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req) + } + } + +- ceph_put_page_vector(osd_data->pages, num_pages, !aio_req->write); ++ ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty); + ceph_osdc_put_request(req); + + if (rc < 0) +@@ -842,6 +843,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + size_t count = iov_iter_count(iter); + loff_t pos = iocb->ki_pos; + bool write = iov_iter_rw(iter) == WRITE; ++ bool should_dirty = !write && iter_is_iovec(iter); + + if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP) + return -EROFS; +@@ -909,6 +911,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + if (aio_req) { + aio_req->iocb = iocb; + aio_req->write = write; ++ aio_req->should_dirty = should_dirty; + INIT_LIST_HEAD(&aio_req->osd_reqs); + if (write) { + aio_req->mtime = mtime; +@@ -966,7 +969,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + len = ret; + } + +- ceph_put_page_vector(pages, num_pages, !write); ++ ceph_put_page_vector(pages, num_pages, should_dirty); + + ceph_osdc_put_request(req); + if (ret < 0) +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index 3489253e38fc..1347b33399e1 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -271,12 +271,20 @@ static inline void bitmap_complement(unsigned long *dst, const unsigned long *sr + __bitmap_complement(dst, src, nbits); + } + ++#ifdef __LITTLE_ENDIAN ++#define BITMAP_MEM_ALIGNMENT 8 ++#else ++#define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long)) ++#endif ++#define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1) ++ + static inline int bitmap_equal(const unsigned long *src1, + const unsigned long *src2, unsigned int nbits) + { + if (small_const_nbits(nbits)) + return !((*src1 ^ *src2) & BITMAP_LAST_WORD_MASK(nbits)); +- if (__builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ if (__builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + return !memcmp(src1, src2, nbits / 8); + return __bitmap_equal(src1, src2, nbits); + } +@@ -327,8 +335,10 @@ static __always_inline void bitmap_set(unsigned long *map, unsigned int start, + { + if (__builtin_constant_p(nbits) && nbits == 1) + __set_bit(start, map); +- else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) && +- __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ else if (__builtin_constant_p(start & BITMAP_MEM_MASK) && ++ IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) && ++ __builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + memset((char *)map + start / 8, 0xff, nbits / 8); + else + __bitmap_set(map, start, nbits); +@@ -339,8 +349,10 @@ static __always_inline void bitmap_clear(unsigned long *map, unsigned int start, + { + if (__builtin_constant_p(nbits) && nbits == 1) + __clear_bit(start, map); +- else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) && +- __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ else if (__builtin_constant_p(start & BITMAP_MEM_MASK) && ++ IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) && ++ __builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + memset((char *)map + start / 8, 0, nbits / 8); + else + __bitmap_clear(map, start, nbits); +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 33f7530f96b9..8e46c35d654b 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -285,6 +285,8 @@ unsigned int *xt_alloc_entry_offsets(unsigned int size); + bool xt_find_jump_offset(const unsigned int *offsets, + unsigned int target, unsigned int size); + ++int xt_check_proc_name(const char *name, unsigned int size); ++ + int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto, + bool inv_proto); + int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto, +diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h +index 18c564f60e93..60e5cabee928 100644 +--- a/include/rdma/ib_addr.h ++++ b/include/rdma/ib_addr.h +@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr *dev_addr, + const unsigned char *dst_dev_addr); + + int rdma_addr_size(struct sockaddr *addr); ++int rdma_addr_size_in6(struct sockaddr_in6 *addr); ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr); + + int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id); + int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid, +diff --git a/include/uapi/linux/serial_core.h b/include/uapi/linux/serial_core.h +index 1c8413f93e3d..dce5f9dae121 100644 +--- a/include/uapi/linux/serial_core.h ++++ b/include/uapi/linux/serial_core.h +@@ -76,6 +76,9 @@ + #define PORT_SUNZILOG 38 + #define PORT_SUNSAB 39 + ++/* Nuvoton UART */ ++#define PORT_NPCM 40 ++ + /* Intel EG20 */ + #define PORT_PCH_8LINE 44 + #define PORT_PCH_2LINE 45 +diff --git a/ipc/shm.c b/ipc/shm.c +index 7acda23430aa..50e88fc060b1 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmf) + return sfd->vm_ops->fault(vmf); + } + ++static int shm_split(struct vm_area_struct *vma, unsigned long addr) ++{ ++ struct file *file = vma->vm_file; ++ struct shm_file_data *sfd = shm_file_data(file); ++ ++ if (sfd->vm_ops && sfd->vm_ops->split) ++ return sfd->vm_ops->split(vma, addr); ++ ++ return 0; ++} ++ + #ifdef CONFIG_NUMA + static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new) + { +@@ -510,6 +521,7 @@ static const struct vm_operations_struct shm_vm_ops = { + .open = shm_open, /* callback for a new vm-area open */ + .close = shm_close, /* callback for when the vm-area is released */ + .fault = shm_fault, ++ .split = shm_split, + #if defined(CONFIG_NUMA) + .set_policy = shm_set_policy, + .get_policy = shm_get_policy, +diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c +index 3f8cb1e14588..253ae2da13c3 100644 +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -427,16 +427,9 @@ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint); + * modify_user_hw_breakpoint - modify a user-space hardware breakpoint + * @bp: the breakpoint structure to modify + * @attr: new breakpoint attributes +- * @triggered: callback to trigger when we hit the breakpoint +- * @tsk: pointer to 'task_struct' of the process to which the address belongs + */ + int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr) + { +- u64 old_addr = bp->attr.bp_addr; +- u64 old_len = bp->attr.bp_len; +- int old_type = bp->attr.bp_type; +- int err = 0; +- + /* + * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it + * will not be possible to raise IPIs that invoke __perf_event_disable. +@@ -451,27 +444,18 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att + bp->attr.bp_addr = attr->bp_addr; + bp->attr.bp_type = attr->bp_type; + bp->attr.bp_len = attr->bp_len; ++ bp->attr.disabled = 1; + +- if (attr->disabled) +- goto end; +- +- err = validate_hw_breakpoint(bp); +- if (!err) +- perf_event_enable(bp); ++ if (!attr->disabled) { ++ int err = validate_hw_breakpoint(bp); + +- if (err) { +- bp->attr.bp_addr = old_addr; +- bp->attr.bp_type = old_type; +- bp->attr.bp_len = old_len; +- if (!bp->attr.disabled) +- perf_event_enable(bp); ++ if (err) ++ return err; + +- return err; ++ perf_event_enable(bp); ++ bp->attr.disabled = 0; + } + +-end: +- bp->attr.disabled = attr->disabled; +- + return 0; + } + EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint); +diff --git a/mm/percpu-km.c b/mm/percpu-km.c +index d2a76642c4ae..0d88d7bd5706 100644 +--- a/mm/percpu-km.c ++++ b/mm/percpu-km.c +@@ -34,7 +34,7 @@ + #include + + static int pcpu_populate_chunk(struct pcpu_chunk *chunk, +- int page_start, int page_end) ++ int page_start, int page_end, gfp_t gfp) + { + return 0; + } +@@ -45,18 +45,18 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, + /* nada */ + } + +-static struct pcpu_chunk *pcpu_create_chunk(void) ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + { + const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT; + struct pcpu_chunk *chunk; + struct page *pages; + int i; + +- chunk = pcpu_alloc_chunk(); ++ chunk = pcpu_alloc_chunk(gfp); + if (!chunk) + return NULL; + +- pages = alloc_pages(GFP_KERNEL, order_base_2(nr_pages)); ++ pages = alloc_pages(gfp | GFP_KERNEL, order_base_2(nr_pages)); + if (!pages) { + pcpu_free_chunk(chunk); + return NULL; +diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c +index 9158e5a81391..0af71eb2fff0 100644 +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -37,7 +37,7 @@ static struct page **pcpu_get_pages(void) + lockdep_assert_held(&pcpu_alloc_mutex); + + if (!pages) +- pages = pcpu_mem_zalloc(pages_size); ++ pages = pcpu_mem_zalloc(pages_size, 0); + return pages; + } + +@@ -73,18 +73,21 @@ static void pcpu_free_pages(struct pcpu_chunk *chunk, + * @pages: array to put the allocated pages into, indexed by pcpu_page_idx() + * @page_start: page index of the first page to be allocated + * @page_end: page index of the last page to be allocated + 1 ++ * @gfp: allocation flags passed to the underlying allocator + * + * Allocate pages [@page_start,@page_end) into @pages for all units. + * The allocation is for @chunk. Percpu core doesn't care about the + * content of @pages and will pass it verbatim to pcpu_map_pages(). + */ + static int pcpu_alloc_pages(struct pcpu_chunk *chunk, +- struct page **pages, int page_start, int page_end) ++ struct page **pages, int page_start, int page_end, ++ gfp_t gfp) + { +- const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM; + unsigned int cpu, tcpu; + int i; + ++ gfp |= GFP_KERNEL | __GFP_HIGHMEM; ++ + for_each_possible_cpu(cpu) { + for (i = page_start; i < page_end; i++) { + struct page **pagep = &pages[pcpu_page_idx(cpu, i)]; +@@ -262,6 +265,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk, + * @chunk: chunk of interest + * @page_start: the start page + * @page_end: the end page ++ * @gfp: allocation flags passed to the underlying memory allocator + * + * For each cpu, populate and map pages [@page_start,@page_end) into + * @chunk. +@@ -270,7 +274,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk, + * pcpu_alloc_mutex, does GFP_KERNEL allocation. + */ + static int pcpu_populate_chunk(struct pcpu_chunk *chunk, +- int page_start, int page_end) ++ int page_start, int page_end, gfp_t gfp) + { + struct page **pages; + +@@ -278,7 +282,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk, + if (!pages) + return -ENOMEM; + +- if (pcpu_alloc_pages(chunk, pages, page_start, page_end)) ++ if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp)) + return -ENOMEM; + + if (pcpu_map_pages(chunk, pages, page_start, page_end)) { +@@ -325,12 +329,12 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, + pcpu_free_pages(chunk, pages, page_start, page_end); + } + +-static struct pcpu_chunk *pcpu_create_chunk(void) ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + { + struct pcpu_chunk *chunk; + struct vm_struct **vms; + +- chunk = pcpu_alloc_chunk(); ++ chunk = pcpu_alloc_chunk(gfp); + if (!chunk) + return NULL; + +diff --git a/mm/percpu.c b/mm/percpu.c +index 50e7fdf84055..3248afb3862c 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -447,10 +447,12 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits, + /** + * pcpu_mem_zalloc - allocate memory + * @size: bytes to allocate ++ * @gfp: allocation flags + * + * Allocate @size bytes. If @size is smaller than PAGE_SIZE, +- * kzalloc() is used; otherwise, vzalloc() is used. The returned +- * memory is always zeroed. ++ * kzalloc() is used; otherwise, the equivalent of vzalloc() is used. ++ * This is to facilitate passing through whitelisted flags. The ++ * returned memory is always zeroed. + * + * CONTEXT: + * Does GFP_KERNEL allocation. +@@ -458,15 +460,16 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits, + * RETURNS: + * Pointer to the allocated area on success, NULL on failure. + */ +-static void *pcpu_mem_zalloc(size_t size) ++static void *pcpu_mem_zalloc(size_t size, gfp_t gfp) + { + if (WARN_ON_ONCE(!slab_is_available())) + return NULL; + + if (size <= PAGE_SIZE) +- return kzalloc(size, GFP_KERNEL); ++ return kzalloc(size, gfp | GFP_KERNEL); + else +- return vzalloc(size); ++ return __vmalloc(size, gfp | GFP_KERNEL | __GFP_ZERO, ++ PAGE_KERNEL); + } + + /** +@@ -1154,12 +1157,12 @@ static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr, + return chunk; + } + +-static struct pcpu_chunk *pcpu_alloc_chunk(void) ++static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp) + { + struct pcpu_chunk *chunk; + int region_bits; + +- chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size); ++ chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp); + if (!chunk) + return NULL; + +@@ -1168,17 +1171,17 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void) + region_bits = pcpu_chunk_map_bits(chunk); + + chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) * +- sizeof(chunk->alloc_map[0])); ++ sizeof(chunk->alloc_map[0]), gfp); + if (!chunk->alloc_map) + goto alloc_map_fail; + + chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) * +- sizeof(chunk->bound_map[0])); ++ sizeof(chunk->bound_map[0]), gfp); + if (!chunk->bound_map) + goto bound_map_fail; + + chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) * +- sizeof(chunk->md_blocks[0])); ++ sizeof(chunk->md_blocks[0]), gfp); + if (!chunk->md_blocks) + goto md_blocks_fail; + +@@ -1277,9 +1280,10 @@ static void pcpu_chunk_depopulated(struct pcpu_chunk *chunk, + * pcpu_addr_to_page - translate address to physical address + * pcpu_verify_alloc_info - check alloc_info is acceptable during init + */ +-static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size); ++static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size, ++ gfp_t gfp); + static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size); +-static struct pcpu_chunk *pcpu_create_chunk(void); ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp); + static void pcpu_destroy_chunk(struct pcpu_chunk *chunk); + static struct page *pcpu_addr_to_page(void *addr); + static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai); +@@ -1421,7 +1425,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, + } + + if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) { +- chunk = pcpu_create_chunk(); ++ chunk = pcpu_create_chunk(0); + if (!chunk) { + err = "failed to allocate new chunk"; + goto fail; +@@ -1450,7 +1454,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, + page_start, page_end) { + WARN_ON(chunk->immutable); + +- ret = pcpu_populate_chunk(chunk, rs, re); ++ ret = pcpu_populate_chunk(chunk, rs, re, 0); + + spin_lock_irqsave(&pcpu_lock, flags); + if (ret) { +@@ -1561,10 +1565,17 @@ void __percpu *__alloc_reserved_percpu(size_t size, size_t align) + * pcpu_balance_workfn - manage the amount of free chunks and populated pages + * @work: unused + * +- * Reclaim all fully free chunks except for the first one. ++ * Reclaim all fully free chunks except for the first one. This is also ++ * responsible for maintaining the pool of empty populated pages. However, ++ * it is possible that this is called when physical memory is scarce causing ++ * OOM killer to be triggered. We should avoid doing so until an actual ++ * allocation causes the failure as it is possible that requests can be ++ * serviced from already backed regions. + */ + static void pcpu_balance_workfn(struct work_struct *work) + { ++ /* gfp flags passed to underlying allocators */ ++ const gfp_t gfp = __GFP_NORETRY | __GFP_NOWARN; + LIST_HEAD(to_free); + struct list_head *free_head = &pcpu_slot[pcpu_nr_slots - 1]; + struct pcpu_chunk *chunk, *next; +@@ -1645,7 +1656,7 @@ static void pcpu_balance_workfn(struct work_struct *work) + chunk->nr_pages) { + int nr = min(re - rs, nr_to_pop); + +- ret = pcpu_populate_chunk(chunk, rs, rs + nr); ++ ret = pcpu_populate_chunk(chunk, rs, rs + nr, gfp); + if (!ret) { + nr_to_pop -= nr; + spin_lock_irq(&pcpu_lock); +@@ -1662,7 +1673,7 @@ static void pcpu_balance_workfn(struct work_struct *work) + + if (nr_to_pop) { + /* ran out of chunks to populate, create a new one and retry */ +- chunk = pcpu_create_chunk(); ++ chunk = pcpu_create_chunk(gfp); + if (chunk) { + spin_lock_irq(&pcpu_lock); + pcpu_chunk_relocate(chunk, -1); +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 01117ae84f1d..a2ddae2f37d7 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) + else + sec_level = authreq_to_seclevel(auth); + +- if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) ++ if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) { ++ /* If link is already encrypted with sufficient security we ++ * still need refresh encryption as per Core Spec 5.0 Vol 3, ++ * Part H 2.4.6 ++ */ ++ smp_ltk_encrypt(conn, hcon->sec_level); + return 0; ++ } + + if (sec_level > hcon->pending_sec_level) + hcon->pending_sec_level = sec_level; +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 59baaecd3e54..0b589a6b365c 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w) + return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); + } + ++static bool wormhash_offset_invalid(int off, unsigned int len) ++{ ++ if (off == 0) /* not present */ ++ return false; ++ ++ if (off < (int)sizeof(struct ebt_among_info) || ++ off % __alignof__(struct ebt_mac_wormhash)) ++ return true; ++ ++ off += sizeof(struct ebt_mac_wormhash); ++ ++ return off > len; ++} ++ ++static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b) ++{ ++ if (a == 0) ++ a = sizeof(struct ebt_among_info); ++ ++ return ebt_mac_wormhash_size(wh) + a == b; ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; +@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (expected_length > em->match_size) + return -EINVAL; + ++ if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) || ++ wormhash_offset_invalid(info->wh_src_ofs, em->match_size)) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); + if (poolsize_invalid(wh_dst)) + return -EINVAL; +@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (poolsize_invalid(wh_src)) + return -EINVAL; + ++ if (info->wh_src_ofs < info->wh_dst_ofs) { ++ if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs)) ++ return -EINVAL; ++ } else { ++ if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs)) ++ return -EINVAL; ++ } ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +index a5727036a8a8..a9670b642ba4 100644 +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -159,8 +159,20 @@ static unsigned int ipv4_conntrack_local(void *priv, + ip_hdrlen(skb) < sizeof(struct iphdr)) + return NF_ACCEPT; + +- if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */ ++ if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */ ++ enum ip_conntrack_info ctinfo; ++ struct nf_conn *tmpl; ++ ++ tmpl = nf_ct_get(skb, &ctinfo); ++ if (tmpl && nf_ct_is_template(tmpl)) { ++ /* when skipping ct, clear templates to avoid fooling ++ * later targets/matches ++ */ ++ skb->_nfct = 0; ++ nf_ct_put(tmpl); ++ } + return NF_ACCEPT; ++ } + + return nf_conntrack_in(state->net, PF_INET, state->hook, skb); + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index fa3ae1cb50d3..8c184f84f353 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -626,7 +626,6 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; +- struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -639,25 +638,6 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; +- +- if (p->flags & IP6_TNL_F_CAP_XMIT) { +- int strict = (ipv6_addr_type(&p->raddr) & +- (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); +- struct rt6_info *rt = rt6_lookup(t->net, +- &p->raddr, &p->laddr, +- p->link, strict); +- +- if (rt) +- tdev = rt->dst.dev; +- ip6_rt_put(rt); +- } +- +- if (!tdev && p->link) +- tdev = __dev_get_by_index(t->net, p->link); +- +- if (tdev) +- dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, +- IPV6_MIN_MTU); + } + + /** +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 08a2a65d3304..1f0d94439c77 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1627,11 +1627,10 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket, + struct neighbour *neigh; + __u8 neigh_flags = 0; + +- neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway); +- if (neigh) { ++ neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway); ++ if (neigh) + neigh_flags = neigh->flags; +- neigh_release(neigh); +- } ++ + if (!(neigh_flags & NTF_ROUTER)) { + RT6_TRACE("purging route %p via non-router but gateway\n", + rt); +@@ -1655,7 +1654,8 @@ void rt6_age_exceptions(struct rt6_info *rt, + if (!rcu_access_pointer(rt->rt6i_exception_bucket)) + return; + +- spin_lock_bh(&rt6_exception_lock); ++ rcu_read_lock_bh(); ++ spin_lock(&rt6_exception_lock); + bucket = rcu_dereference_protected(rt->rt6i_exception_bucket, + lockdep_is_held(&rt6_exception_lock)); + +@@ -1669,7 +1669,8 @@ void rt6_age_exceptions(struct rt6_info *rt, + bucket++; + } + } +- spin_unlock_bh(&rt6_exception_lock); ++ spin_unlock(&rt6_exception_lock); ++ rcu_read_unlock_bh(); + } + + struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index e8b26afeb194..083fa2ffee15 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -111,6 +111,13 @@ struct l2tp_net { + spinlock_t l2tp_session_hlist_lock; + }; + ++#if IS_ENABLED(CONFIG_IPV6) ++static bool l2tp_sk_is_v6(struct sock *sk) ++{ ++ return sk->sk_family == PF_INET6 && ++ !ipv6_addr_v4mapped(&sk->sk_v6_daddr); ++} ++#endif + + static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk) + { +@@ -1058,7 +1065,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, + /* Queue the packet to IP for output */ + skb->ignore_df = 1; + #if IS_ENABLED(CONFIG_IPV6) +- if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped) ++ if (l2tp_sk_is_v6(tunnel->sock)) + error = inet6_csk_xmit(tunnel->sock, skb, NULL); + else + #endif +@@ -1121,6 +1128,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + goto out_unlock; + } + ++ /* The user-space may change the connection status for the user-space ++ * provided socket at run time: we must check it under the socket lock ++ */ ++ if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) { ++ kfree_skb(skb); ++ ret = NET_XMIT_DROP; ++ goto out_unlock; ++ } ++ + /* Get routing info from the tunnel socket */ + skb_dst_drop(skb); + skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0))); +@@ -1140,7 +1156,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + + /* Calculate UDP checksum if configured to do so */ + #if IS_ENABLED(CONFIG_IPV6) +- if (sk->sk_family == PF_INET6 && !tunnel->v4mapped) ++ if (l2tp_sk_is_v6(sk)) + udp6_set_csum(udp_get_no_check6_tx(sk), + skb, &inet6_sk(sk)->saddr, + &sk->sk_v6_daddr, udp_len); +@@ -1520,24 +1536,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + if (cfg != NULL) + tunnel->debug = cfg->debug; + +-#if IS_ENABLED(CONFIG_IPV6) +- if (sk->sk_family == PF_INET6) { +- struct ipv6_pinfo *np = inet6_sk(sk); +- +- if (ipv6_addr_v4mapped(&np->saddr) && +- ipv6_addr_v4mapped(&sk->sk_v6_daddr)) { +- struct inet_sock *inet = inet_sk(sk); +- +- tunnel->v4mapped = true; +- inet->inet_saddr = np->saddr.s6_addr32[3]; +- inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3]; +- inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3]; +- } else { +- tunnel->v4mapped = false; +- } +- } +-#endif +- + /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ + tunnel->encap = encap; + if (encap == L2TP_ENCAPTYPE_UDP) { +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 8ecb1d357445..3fddfb207113 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -193,9 +193,6 @@ struct l2tp_tunnel { + struct sock *sock; /* Parent socket */ + int fd; /* Parent fd, if tunnel socket + * was created by userspace */ +-#if IS_ENABLED(CONFIG_IPV6) +- bool v4mapped; +-#endif + + struct work_struct del_work; + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index d7070d18db20..a33def530adf 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto) + return buf; + } + ++/** ++ * xt_check_proc_name - check that name is suitable for /proc file creation ++ * ++ * @name: file name candidate ++ * @size: length of buffer ++ * ++ * some x_tables modules wish to create a file in /proc. ++ * This function makes sure that the name is suitable for this ++ * purpose, it checks that name is NUL terminated and isn't a 'special' ++ * name, like "..". ++ * ++ * returns negative number on error or 0 if name is useable. ++ */ ++int xt_check_proc_name(const char *name, unsigned int size) ++{ ++ if (name[0] == '\0') ++ return -EINVAL; ++ ++ if (strnlen(name, size) == size) ++ return -ENAMETOOLONG; ++ ++ if (strcmp(name, ".") == 0 || ++ strcmp(name, "..") == 0 || ++ strchr(name, '/')) ++ return -EINVAL; ++ ++ return 0; ++} ++EXPORT_SYMBOL(xt_check_proc_name); ++ + int xt_check_match(struct xt_mtchk_param *par, + unsigned int size, u_int8_t proto, bool inv_proto) + { +@@ -1008,7 +1038,12 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + if ((size >> PAGE_SHIFT) + 2 > totalram_pages) + return NULL; + +- info = kvmalloc(sz, GFP_KERNEL); ++ /* __GFP_NORETRY is not fully supported by kvmalloc but it should ++ * work reasonably well if sz is too large and bail out rather ++ * than shoot all processes down before realizing there is nothing ++ * more to reclaim. ++ */ ++ info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY); + if (!info) + return NULL; + +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index b8a3e740ffd4..0c034597b9b8 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -915,8 +915,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par) + struct hashlimit_cfg3 cfg = {}; + int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + ret = cfg_copy(&cfg, (void *)&info->cfg, 1); + +@@ -933,8 +934,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par) + struct hashlimit_cfg3 cfg = {}; + int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + ret = cfg_copy(&cfg, (void *)&info->cfg, 2); + +@@ -948,9 +950,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par) + static int hashlimit_mt_check(const struct xt_mtchk_param *par) + { + struct xt_hashlimit_mtinfo3 *info = par->matchinfo; ++ int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg, + info->name, 3); +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index 245fa350a7a8..cf96d230e5a3 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par, + info->hit_count, XT_RECENT_MAX_NSTAMPS - 1); + return -EINVAL; + } +- if (info->name[0] == '\0' || +- strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN) +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot) + nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1; +diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c +index ccfdc7115a83..a00ec715aa46 100644 +--- a/net/xfrm/xfrm_ipcomp.c ++++ b/net/xfrm/xfrm_ipcomp.c +@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name) + struct crypto_comp *tfm; + + /* This can be any valid CPU ID so we don't need locking. */ +- tfm = __this_cpu_read(*pos->tfms); ++ tfm = this_cpu_read(*pos->tfms); + + if (!strcmp(crypto_comp_name(tfm), alg_name)) { + pos->users++; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 54e21f19d722..f9d2f2233f09 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++#ifdef CONFIG_COMPAT ++ if (in_compat_syscall()) ++ return -EOPNOTSUPP; ++#endif ++ + if (!optval && !optlen) { + xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); + xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 7f52b8eb177d..080035f056d9 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p, + struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; + struct xfrm_replay_state_esn *rs; + +- if (p->flags & XFRM_STATE_ESN) { +- if (!rt) +- return -EINVAL; ++ if (!rt) ++ return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0; + +- rs = nla_data(rt); ++ rs = nla_data(rt); + +- if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) +- return -EINVAL; +- +- if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) && +- nla_len(rt) != sizeof(*rs)) +- return -EINVAL; +- } ++ if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) ++ return -EINVAL; + +- if (!rt) +- return 0; ++ if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) && ++ nla_len(rt) != sizeof(*rs)) ++ return -EINVAL; + + /* As only ESP and AH support ESN feature. */ + if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 012881461058..d6e9a18fd821 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha + static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf, + static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index f08772568c17..b01cc015a93c 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3422,7 +3422,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream, + area, + substream->runtime->dma_area, + substream->runtime->dma_addr, +- area->vm_end - area->vm_start); ++ substream->runtime->dma_bytes); + #endif /* CONFIG_X86 */ + /* mmap with fault handler */ + area->vm_ops = &snd_pcm_vm_ops_data_fault; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index ea8f3de92fa4..794224e1d6df 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1171,6 +1171,7 @@ static bool is_teac_dsd_dac(unsigned int id) + switch (id) { + case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */ + case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */ ++ case USB_ID(0x0644, 0x804a): /* TEAC UD-301 */ + return true; + } + return false;