From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id B01741382C5 for ; Thu, 19 Apr 2018 10:45:33 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D8193E0950; Thu, 19 Apr 2018 10:45:32 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A46B1E0950 for ; Thu, 19 Apr 2018 10:45:32 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 73589335C73 for ; Thu, 19 Apr 2018 10:45:30 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id DE645285 for ; Thu, 19 Apr 2018 10:45:28 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1524134710.c5d7520a8ab2025158549e082b06f5608b5f4642.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.16 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1002_linux-4.16.3.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: c5d7520a8ab2025158549e082b06f5608b5f4642 X-VCS-Branch: 4.16 Date: Thu, 19 Apr 2018 10:45:28 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 49f83589-bbd0-40eb-b439-a323ba6d9642 X-Archives-Hash: 8bff893aab83d2c812f9591a5f0ab177 commit: c5d7520a8ab2025158549e082b06f5608b5f4642 Author: Mike Pagano gentoo org> AuthorDate: Thu Apr 19 10:45:10 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Thu Apr 19 10:45:10 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c5d7520a Linux patch 4.16.3 0000_README | 4 + 1002_linux-4.16.3.patch | 3089 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3093 insertions(+) diff --git a/0000_README b/0000_README index d6bf216..65c079f 100644 --- a/0000_README +++ b/0000_README @@ -51,6 +51,10 @@ Patch: 1001_linux-4.16.2.patch From: http://www.kernel.org Desc: Linux 4.16.2 +Patch: 1002_linux-4.16.3.patch +From: http://www.kernel.org +Desc: Linux 4.16.3 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1002_linux-4.16.3.patch b/1002_linux-4.16.3.patch new file mode 100644 index 0000000..f3cc2d8 --- /dev/null +++ b/1002_linux-4.16.3.patch @@ -0,0 +1,3089 @@ +diff --git a/Makefile b/Makefile +index f0040b05df30..38df392e45e4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 16 +-SUBLEVEL = 2 ++SUBLEVEL = 3 + EXTRAVERSION = + NAME = Fearless Coyote + +diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c +index 16a8a804e958..e8fe51f4e97a 100644 +--- a/arch/arm/boot/compressed/misc.c ++++ b/arch/arm/boot/compressed/misc.c +@@ -128,12 +128,7 @@ asmlinkage void __div0(void) + error("Attempting division by 0!"); + } + +-unsigned long __stack_chk_guard; +- +-void __stack_chk_guard_setup(void) +-{ +- __stack_chk_guard = 0x000a0dff; +-} ++const unsigned long __stack_chk_guard = 0x000a0dff; + + void __stack_chk_fail(void) + { +@@ -150,8 +145,6 @@ decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p, + { + int ret; + +- __stack_chk_guard_setup(); +- + output_data = (unsigned char *)output_start; + free_mem_ptr = free_mem_ptr_p; + free_mem_end_ptr = free_mem_ptr_end_p; +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index fdf99e9dd4c3..81df9047e110 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -76,12 +76,7 @@ void error(char *x) + #include "../../../../lib/decompress_unxz.c" + #endif + +-unsigned long __stack_chk_guard; +- +-void __stack_chk_guard_setup(void) +-{ +- __stack_chk_guard = 0x000a0dff; +-} ++const unsigned long __stack_chk_guard = 0x000a0dff; + + void __stack_chk_fail(void) + { +@@ -92,8 +87,6 @@ void decompress_kernel(unsigned long boot_heap_start) + { + unsigned long zimage_start, zimage_size; + +- __stack_chk_guard_setup(); +- + zimage_start = (unsigned long)(&__image_begin); + zimage_size = (unsigned long)(&__image_end) - + (unsigned long)(&__image_begin); +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index 29b99b8964aa..d4240aa7f8b1 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -651,6 +651,10 @@ static int match_pci_device(struct device *dev, int index, + (modpath->mod == PCI_FUNC(devfn))); + } + ++ /* index might be out of bounds for bc[] */ ++ if (index >= 6) ++ return 0; ++ + id = PCI_SLOT(pdev->devfn) | (PCI_FUNC(pdev->devfn) << 5); + return (modpath->bc[index] == id); + } +diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S +index 8d072c44f300..781c3b9a3e46 100644 +--- a/arch/parisc/kernel/hpmc.S ++++ b/arch/parisc/kernel/hpmc.S +@@ -84,6 +84,7 @@ END(hpmc_pim_data) + .text + + .import intr_save, code ++ .align 16 + ENTRY_CFI(os_hpmc) + .os_hpmc: + +@@ -300,12 +301,15 @@ os_hpmc_6: + + b . + nop ++ .align 16 /* make function length multiple of 16 bytes */ + ENDPROC_CFI(os_hpmc) + .os_hpmc_end: + + + __INITRODATA ++.globl os_hpmc_size + .align 4 +- .export os_hpmc_size ++ .type os_hpmc_size, @object ++ .size os_hpmc_size, 4 + os_hpmc_size: + .word .os_hpmc_end-.os_hpmc +diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +index e1c083fbe434..78e6a392330f 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +@@ -470,8 +470,6 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues, + for (i = 0; i < npages; ++i) { + asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : : + "r" (rbvalues[i]), "r" (kvm->arch.lpid)); +- trace_tlbie(kvm->arch.lpid, 0, rbvalues[i], +- kvm->arch.lpid, 0, 0, 0); + } + + if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) { +@@ -492,8 +490,6 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues, + for (i = 0; i < npages; ++i) { + asm volatile(PPC_TLBIEL(%0,%1,0,0,0) : : + "r" (rbvalues[i]), "r" (0)); +- trace_tlbie(kvm->arch.lpid, 1, rbvalues[i], +- 0, 0, 0, 0); + } + asm volatile("ptesync" : : : "memory"); + } +diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c +index 18c1eeb847b2..6f2a193ccccc 100644 +--- a/arch/s390/kernel/compat_signal.c ++++ b/arch/s390/kernel/compat_signal.c +@@ -279,7 +279,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set, + if (put_compat_sigset((compat_sigset_t __user *)frame->sc.oldmask, + set, sizeof(compat_sigset_t))) + return -EFAULT; +- if (__put_user(ptr_to_compat(&frame->sc), &frame->sc.sregs)) ++ if (__put_user(ptr_to_compat(&frame->sregs), &frame->sc.sregs)) + return -EFAULT; + + /* Store registers needed to create the signal frame */ +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 34477c1aee6d..502c90525a0e 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -776,6 +776,7 @@ static ssize_t reipl_generic_loadparm_store(struct ipl_parameter_block *ipb, + /* copy and convert to ebcdic */ + memcpy(ipb->hdr.loadparm, buf, lp_len); + ASCEBC(ipb->hdr.loadparm, LOADPARM_LEN); ++ ipb->hdr.flags |= DIAG308_FLAGS_LP_VALID; + return len; + } + +diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c +index 627ce8e75e01..c15cac9251b9 100644 +--- a/arch/sh/boot/compressed/misc.c ++++ b/arch/sh/boot/compressed/misc.c +@@ -104,12 +104,7 @@ static void error(char *x) + while(1); /* Halt */ + } + +-unsigned long __stack_chk_guard; +- +-void __stack_chk_guard_setup(void) +-{ +- __stack_chk_guard = 0x000a0dff; +-} ++const unsigned long __stack_chk_guard = 0x000a0dff; + + void __stack_chk_fail(void) + { +@@ -130,8 +125,6 @@ void decompress_kernel(void) + { + unsigned long output_addr; + +- __stack_chk_guard_setup(); +- + #ifdef CONFIG_SUPERH64 + output_addr = (CONFIG_MEMORY_START + 0x2000); + #else +diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h +index 98722773391d..f01eef8b392e 100644 +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -319,7 +319,7 @@ struct apic { + /* Probe, setup and smpboot functions */ + int (*probe)(void); + int (*acpi_madt_oem_check)(char *oem_id, char *oem_table_id); +- int (*apic_id_valid)(int apicid); ++ int (*apic_id_valid)(u32 apicid); + int (*apic_id_registered)(void); + + bool (*check_apicid_used)(physid_mask_t *map, int apicid); +@@ -492,7 +492,7 @@ static inline unsigned int read_apic_id(void) + return apic->get_apic_id(reg); + } + +-extern int default_apic_id_valid(int apicid); ++extern int default_apic_id_valid(u32 apicid); + extern int default_acpi_madt_oem_check(char *, char *); + extern void default_setup_apic_routing(void); + +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index 96ea4b5ba658..340070415c2c 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -346,6 +346,7 @@ enum smca_bank_types { + SMCA_IF, /* Instruction Fetch */ + SMCA_L2_CACHE, /* L2 Cache */ + SMCA_DE, /* Decoder Unit */ ++ SMCA_RESERVED, /* Reserved */ + SMCA_EX, /* Execution Unit */ + SMCA_FP, /* Floating Point */ + SMCA_L3_CACHE, /* L3 Cache */ +diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h +index aebf60357758..a06cbf019744 100644 +--- a/arch/x86/include/uapi/asm/bootparam.h ++++ b/arch/x86/include/uapi/asm/bootparam.h +@@ -137,15 +137,15 @@ struct boot_e820_entry { + * setup data structure. + */ + struct jailhouse_setup_data { +- u16 version; +- u16 compatible_version; +- u16 pm_timer_address; +- u16 num_cpus; +- u64 pci_mmconfig_base; +- u32 tsc_khz; +- u32 apic_khz; +- u8 standard_ioapic; +- u8 cpu_ids[255]; ++ __u16 version; ++ __u16 compatible_version; ++ __u16 pm_timer_address; ++ __u16 num_cpus; ++ __u64 pci_mmconfig_base; ++ __u32 tsc_khz; ++ __u32 apic_khz; ++ __u8 standard_ioapic; ++ __u8 cpu_ids[255]; + } __attribute__((packed)); + + /* The so-called "zeropage" */ +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 2aa92094b59d..5ee33a6e33bb 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -200,7 +200,7 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) + { + struct acpi_madt_local_x2apic *processor = NULL; + #ifdef CONFIG_X86_X2APIC +- int apic_id; ++ u32 apic_id; + u8 enabled; + #endif + +@@ -222,10 +222,13 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) + * to not preallocating memory for all NR_CPUS + * when we use CPU hotplug. + */ +- if (!apic->apic_id_valid(apic_id) && enabled) +- printk(KERN_WARNING PREFIX "x2apic entry ignored\n"); +- else +- acpi_register_lapic(apic_id, processor->uid, enabled); ++ if (!apic->apic_id_valid(apic_id)) { ++ if (enabled) ++ pr_warn(PREFIX "x2apic entry ignored\n"); ++ return 0; ++ } ++ ++ acpi_register_lapic(apic_id, processor->uid, enabled); + #else + printk(KERN_WARNING PREFIX "x2apic entry ignored\n"); + #endif +diff --git a/arch/x86/kernel/apic/apic_common.c b/arch/x86/kernel/apic/apic_common.c +index a360801779ae..02b4839478b1 100644 +--- a/arch/x86/kernel/apic/apic_common.c ++++ b/arch/x86/kernel/apic/apic_common.c +@@ -40,7 +40,7 @@ int default_check_phys_apicid_present(int phys_apicid) + return physid_isset(phys_apicid, phys_cpu_present_map); + } + +-int default_apic_id_valid(int apicid) ++int default_apic_id_valid(u32 apicid) + { + return (apicid < 255); + } +diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c +index 134e04506ab4..78778b54f904 100644 +--- a/arch/x86/kernel/apic/apic_numachip.c ++++ b/arch/x86/kernel/apic/apic_numachip.c +@@ -56,7 +56,7 @@ static u32 numachip2_set_apic_id(unsigned int id) + return id << 24; + } + +-static int numachip_apic_id_valid(int apicid) ++static int numachip_apic_id_valid(u32 apicid) + { + /* Trust what bootloader passes in MADT */ + return 1; +diff --git a/arch/x86/kernel/apic/x2apic.h b/arch/x86/kernel/apic/x2apic.h +index b107de381cb5..a49b3604027f 100644 +--- a/arch/x86/kernel/apic/x2apic.h ++++ b/arch/x86/kernel/apic/x2apic.h +@@ -1,6 +1,6 @@ + /* Common bits for X2APIC cluster/physical modes. */ + +-int x2apic_apic_id_valid(int apicid); ++int x2apic_apic_id_valid(u32 apicid); + int x2apic_apic_id_registered(void); + void __x2apic_send_IPI_dest(unsigned int apicid, int vector, unsigned int dest); + unsigned int x2apic_get_apic_id(unsigned long id); +diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c +index f8d9d69994e6..e972405eb2b5 100644 +--- a/arch/x86/kernel/apic/x2apic_phys.c ++++ b/arch/x86/kernel/apic/x2apic_phys.c +@@ -101,7 +101,7 @@ static int x2apic_phys_probe(void) + } + + /* Common x2apic functions, also used by x2apic_cluster */ +-int x2apic_apic_id_valid(int apicid) ++int x2apic_apic_id_valid(u32 apicid) + { + return 1; + } +diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c +index f11910b44638..efaf2d4f9c3c 100644 +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -557,7 +557,7 @@ static void uv_send_IPI_all(int vector) + uv_send_IPI_mask(cpu_online_mask, vector); + } + +-static int uv_apic_id_valid(int apicid) ++static int uv_apic_id_valid(u32 apicid) + { + return 1; + } +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 0f32ad242324..12bc2863a4d6 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -82,6 +82,7 @@ static struct smca_bank_name smca_names[] = { + [SMCA_IF] = { "insn_fetch", "Instruction Fetch Unit" }, + [SMCA_L2_CACHE] = { "l2_cache", "L2 Cache" }, + [SMCA_DE] = { "decode_unit", "Decode Unit" }, ++ [SMCA_RESERVED] = { "reserved", "Reserved" }, + [SMCA_EX] = { "execution_unit", "Execution Unit" }, + [SMCA_FP] = { "floating_point", "Floating Point Unit" }, + [SMCA_L3_CACHE] = { "l3_cache", "L3 Cache" }, +@@ -110,14 +111,14 @@ const char *smca_get_long_name(enum smca_bank_types t) + } + EXPORT_SYMBOL_GPL(smca_get_long_name); + +-static enum smca_bank_types smca_get_bank_type(struct mce *m) ++static enum smca_bank_types smca_get_bank_type(unsigned int bank) + { + struct smca_bank *b; + +- if (m->bank >= N_SMCA_BANK_TYPES) ++ if (bank >= MAX_NR_BANKS) + return N_SMCA_BANK_TYPES; + +- b = &smca_banks[m->bank]; ++ b = &smca_banks[bank]; + if (!b->hwid) + return N_SMCA_BANK_TYPES; + +@@ -127,6 +128,9 @@ static enum smca_bank_types smca_get_bank_type(struct mce *m) + static struct smca_hwid smca_hwid_mcatypes[] = { + /* { bank_type, hwid_mcatype, xec_bitmap } */ + ++ /* Reserved type */ ++ { SMCA_RESERVED, HWID_MCATYPE(0x00, 0x0), 0x0 }, ++ + /* ZN Core (HWID=0xB0) MCA types */ + { SMCA_LS, HWID_MCATYPE(0xB0, 0x0), 0x1FFFEF }, + { SMCA_IF, HWID_MCATYPE(0xB0, 0x1), 0x3FFF }, +@@ -432,7 +436,25 @@ static u32 get_block_address(unsigned int cpu, u32 current_addr, u32 low, u32 hi + { + u32 addr = 0, offset = 0; + ++ if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS)) ++ return addr; ++ ++ /* Get address from already initialized block. */ ++ if (per_cpu(threshold_banks, cpu)) { ++ struct threshold_bank *bankp = per_cpu(threshold_banks, cpu)[bank]; ++ ++ if (bankp && bankp->blocks) { ++ struct threshold_block *blockp = &bankp->blocks[block]; ++ ++ if (blockp) ++ return blockp->address; ++ } ++ } ++ + if (mce_flags.smca) { ++ if (smca_get_bank_type(bank) == SMCA_RESERVED) ++ return addr; ++ + if (!block) { + addr = MSR_AMD64_SMCA_MCx_MISC(bank); + } else { +@@ -760,7 +782,7 @@ bool amd_mce_is_memory_error(struct mce *m) + u8 xec = (m->status >> 16) & 0x1f; + + if (mce_flags.smca) +- return smca_get_bank_type(m) == SMCA_UMC && xec == 0x0; ++ return smca_get_bank_type(m->bank) == SMCA_UMC && xec == 0x0; + + return m->bank == 4 && xec == 0x8; + } +@@ -1063,7 +1085,7 @@ static struct kobj_type threshold_ktype = { + + static const char *get_name(unsigned int bank, struct threshold_block *b) + { +- unsigned int bank_type; ++ enum smca_bank_types bank_type; + + if (!mce_flags.smca) { + if (b && bank == 4) +@@ -1072,11 +1094,10 @@ static const char *get_name(unsigned int bank, struct threshold_block *b) + return th_names[bank]; + } + +- if (!smca_banks[bank].hwid) ++ bank_type = smca_get_bank_type(bank); ++ if (bank_type >= N_SMCA_BANK_TYPES) + return NULL; + +- bank_type = smca_banks[bank].hwid->bank_type; +- + if (b && bank_type == SMCA_UMC) { + if (b->block < ARRAY_SIZE(smca_umc_block_names)) + return smca_umc_block_names[b->block]; +diff --git a/arch/x86/xen/apic.c b/arch/x86/xen/apic.c +index de58533d3664..2fa79e2e73ea 100644 +--- a/arch/x86/xen/apic.c ++++ b/arch/x86/xen/apic.c +@@ -112,7 +112,7 @@ static int xen_madt_oem_check(char *oem_id, char *oem_table_id) + return xen_pv_domain(); + } + +-static int xen_id_always_valid(int apicid) ++static int xen_id_always_valid(u32 apicid) + { + return 1; + } +diff --git a/block/blk-core.c b/block/blk-core.c +index 6d82c4f7fadd..3b489527c8f2 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -827,7 +827,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags) + bool success = false; + int ret; + +- rcu_read_lock_sched(); ++ rcu_read_lock(); + if (percpu_ref_tryget_live(&q->q_usage_counter)) { + /* + * The code that sets the PREEMPT_ONLY flag is +@@ -840,7 +840,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags) + percpu_ref_put(&q->q_usage_counter); + } + } +- rcu_read_unlock_sched(); ++ rcu_read_unlock(); + + if (success) + return 0; +diff --git a/block/blk-mq-cpumap.c b/block/blk-mq-cpumap.c +index 9f8cffc8a701..3eb169f15842 100644 +--- a/block/blk-mq-cpumap.c ++++ b/block/blk-mq-cpumap.c +@@ -16,11 +16,6 @@ + + static int cpu_to_queue_index(unsigned int nr_queues, const int cpu) + { +- /* +- * Non present CPU will be mapped to queue index 0. +- */ +- if (!cpu_present(cpu)) +- return 0; + return cpu % nr_queues; + } + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 16e83e6df404..56e0c3699f9e 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1188,7 +1188,12 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + struct blk_mq_queue_data bd; + + rq = list_first_entry(list, struct request, queuelist); +- if (!blk_mq_get_driver_tag(rq, &hctx, false)) { ++ ++ hctx = blk_mq_map_queue(rq->q, rq->mq_ctx->cpu); ++ if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) ++ break; ++ ++ if (!blk_mq_get_driver_tag(rq, NULL, false)) { + /* + * The initial allocation attempt failed, so we need to + * rerun the hardware queue when a tag is freed. The +@@ -1197,8 +1202,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + * we'll re-run it below. + */ + if (!blk_mq_mark_tag_wait(&hctx, rq)) { +- if (got_budget) +- blk_mq_put_dispatch_budget(hctx); ++ blk_mq_put_dispatch_budget(hctx); + /* + * For non-shared tags, the RESTART check + * will suffice. +@@ -1209,11 +1213,6 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + } + } + +- if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) { +- blk_mq_put_driver_tag(rq); +- break; +- } +- + list_del_init(&rq->queuelist); + + bd.rq = rq; +@@ -1812,11 +1811,11 @@ static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx, + if (q->elevator && !bypass_insert) + goto insert; + +- if (!blk_mq_get_driver_tag(rq, NULL, false)) ++ if (!blk_mq_get_dispatch_budget(hctx)) + goto insert; + +- if (!blk_mq_get_dispatch_budget(hctx)) { +- blk_mq_put_driver_tag(rq); ++ if (!blk_mq_get_driver_tag(rq, NULL, false)) { ++ blk_mq_put_dispatch_budget(hctx); + goto insert; + } + +@@ -2440,6 +2439,8 @@ static void blk_mq_map_swqueue(struct request_queue *q) + */ + hctx->next_cpu = cpumask_first_and(hctx->cpumask, + cpu_online_mask); ++ if (hctx->next_cpu >= nr_cpu_ids) ++ hctx->next_cpu = cpumask_first(hctx->cpumask); + hctx->next_cpu_batch = BLK_MQ_CPU_WORK_BATCH; + } + } +diff --git a/block/blk-timeout.c b/block/blk-timeout.c +index a05e3676d24a..f0e6e412891f 100644 +--- a/block/blk-timeout.c ++++ b/block/blk-timeout.c +@@ -165,7 +165,7 @@ void blk_abort_request(struct request *req) + * No need for fancy synchronizations. + */ + blk_rq_set_deadline(req, jiffies); +- mod_timer(&req->q->timeout, 0); ++ kblockd_schedule_work(&req->q->timeout_work); + } else { + if (blk_mark_rq_complete(req)) + return; +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index eb09ef55c38a..9f8f39d49396 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3024,15 +3024,21 @@ static void acpi_nfit_scrub(struct work_struct *work) + static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc) + { + struct nfit_spa *nfit_spa; +- int rc; + +- list_for_each_entry(nfit_spa, &acpi_desc->spas, list) +- if (nfit_spa_type(nfit_spa->spa) == NFIT_SPA_DCR) { +- /* BLK regions don't need to wait for ars results */ +- rc = acpi_nfit_register_region(acpi_desc, nfit_spa); +- if (rc) +- return rc; +- } ++ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) { ++ int rc, type = nfit_spa_type(nfit_spa->spa); ++ ++ /* PMEM and VMEM will be registered by the ARS workqueue */ ++ if (type == NFIT_SPA_PM || type == NFIT_SPA_VOLATILE) ++ continue; ++ /* BLK apertures belong to BLK region registration below */ ++ if (type == NFIT_SPA_BDW) ++ continue; ++ /* BLK regions don't need to wait for ARS results */ ++ rc = acpi_nfit_register_region(acpi_desc, nfit_spa); ++ if (rc) ++ return rc; ++ } + + acpi_desc->ars_start_flags = 0; + if (!acpi_desc->cancel) +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ee62d2d517bf..fe92cb972dd1 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1103,11 +1103,15 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + if (info->lo_encrypt_type) { + unsigned int type = info->lo_encrypt_type; + +- if (type >= MAX_LO_CRYPT) +- return -EINVAL; ++ if (type >= MAX_LO_CRYPT) { ++ err = -EINVAL; ++ goto exit; ++ } + xfer = xfer_funcs[type]; +- if (xfer == NULL) +- return -EINVAL; ++ if (xfer == NULL) { ++ err = -EINVAL; ++ goto exit; ++ } + } else + xfer = NULL; + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 47a4127a6067..1a81f6b8c2ce 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -795,22 +795,6 @@ static const struct acpi_gpio_mapping acpi_bcm_int_first_gpios[] = { + #ifdef CONFIG_ACPI + /* IRQ polarity of some chipsets are not defined correctly in ACPI table. */ + static const struct dmi_system_id bcm_active_low_irq_dmi_table[] = { +- { +- .ident = "Asus T100TA", +- .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, +- "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"), +- }, +- }, +- { +- .ident = "Asus T100CHI", +- .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, +- "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100CHI"), +- }, +- }, + { /* Handle ThinkPad 8 tablets with BCM2E55 chipset ACPI ID */ + .ident = "Lenovo ThinkPad 8", + .matches = { +@@ -838,7 +822,9 @@ static int bcm_resource(struct acpi_resource *ares, void *data) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_EXTENDED_IRQ: + irq = &ares->data.extended_irq; +- dev->irq_active_low = irq->polarity == ACPI_ACTIVE_LOW; ++ if (irq->polarity != ACPI_ACTIVE_LOW) ++ dev_info(dev->dev, "ACPI Interrupt resource is active-high, this is usually wrong, treating the IRQ as active-low\n"); ++ dev->irq_active_low = true; + break; + + case ACPI_RESOURCE_TYPE_GPIO: +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 6768cb2dd740..f5b2d69316a1 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -252,6 +252,9 @@ struct smi_info { + /* Default driver model device. */ + struct platform_device *pdev; + ++ /* Have we added the device group to the device? */ ++ bool dev_group_added; ++ + /* Counters and things for the proc filesystem. */ + atomic_t stats[SI_NUM_STATS]; + +@@ -2027,8 +2030,8 @@ int ipmi_si_add_smi(struct si_sm_io *io) + if (initialized) { + rv = try_smi_init(new_smi); + if (rv) { +- mutex_unlock(&smi_infos_lock); + cleanup_one_si(new_smi); ++ mutex_unlock(&smi_infos_lock); + return rv; + } + } +@@ -2187,6 +2190,7 @@ static int try_smi_init(struct smi_info *new_smi) + rv); + goto out_err_stop_timer; + } ++ new_smi->dev_group_added = true; + + rv = ipmi_register_smi(&handlers, + new_smi, +@@ -2240,7 +2244,10 @@ static int try_smi_init(struct smi_info *new_smi) + return 0; + + out_err_remove_attrs: +- device_remove_group(new_smi->io.dev, &ipmi_si_dev_attr_group); ++ if (new_smi->dev_group_added) { ++ device_remove_group(new_smi->io.dev, &ipmi_si_dev_attr_group); ++ new_smi->dev_group_added = false; ++ } + dev_set_drvdata(new_smi->io.dev, NULL); + + out_err_stop_timer: +@@ -2288,6 +2295,7 @@ static int try_smi_init(struct smi_info *new_smi) + else + platform_device_put(new_smi->pdev); + new_smi->pdev = NULL; ++ new_smi->io.dev = NULL; + } + + kfree(init_name); +@@ -2384,8 +2392,10 @@ static void cleanup_one_si(struct smi_info *to_clean) + } + } + +- device_remove_group(to_clean->io.dev, &ipmi_si_dev_attr_group); +- dev_set_drvdata(to_clean->io.dev, NULL); ++ if (to_clean->dev_group_added) ++ device_remove_group(to_clean->io.dev, &ipmi_si_dev_attr_group); ++ if (to_clean->io.dev) ++ dev_set_drvdata(to_clean->io.dev, NULL); + + list_del(&to_clean->link); + +diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c +index a11a671c7a38..2ab4d61ee47e 100644 +--- a/drivers/edac/mce_amd.c ++++ b/drivers/edac/mce_amd.c +@@ -854,21 +854,24 @@ static void decode_mc6_mce(struct mce *m) + static void decode_smca_error(struct mce *m) + { + struct smca_hwid *hwid; +- unsigned int bank_type; ++ enum smca_bank_types bank_type; + const char *ip_name; + u8 xec = XEC(m->status, xec_mask); + + if (m->bank >= ARRAY_SIZE(smca_banks)) + return; + +- if (x86_family(m->cpuid) >= 0x17 && m->bank == 4) +- pr_emerg(HW_ERR "Bank 4 is reserved on Fam17h.\n"); +- + hwid = smca_banks[m->bank].hwid; + if (!hwid) + return; + + bank_type = hwid->bank_type; ++ ++ if (bank_type == SMCA_RESERVED) { ++ pr_emerg(HW_ERR "Bank %d is reserved.\n", m->bank); ++ return; ++ } ++ + ip_name = smca_get_long_name(bank_type); + + pr_emerg(HW_ERR "%s Extended Error Code: %d\n", ip_name, xec); +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index 31f5ad605e59..5b6aeccd3d90 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -240,9 +240,10 @@ int radeon_bo_create(struct radeon_device *rdev, + * may be slow + * See https://bugs.freedesktop.org/show_bug.cgi?id=88758 + */ +- ++#ifndef CONFIG_COMPILE_TEST + #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \ + thanks to write-combining ++#endif + + if (bo->flags & RADEON_GEM_GTT_WC) + DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for " +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index c21020b69114..55ee5e87073a 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -71,7 +71,7 @@ static const struct vmbus_device vmbus_devs[] = { + /* PCIE */ + { .dev_type = HV_PCIE, + HV_PCIE_GUID, +- .perf_device = true, ++ .perf_device = false, + }, + + /* Synthetic Frame Buffer */ +diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c +index 4257451f1bd8..0b86ed01e85d 100644 +--- a/drivers/media/platform/vsp1/vsp1_dl.c ++++ b/drivers/media/platform/vsp1/vsp1_dl.c +@@ -509,7 +509,8 @@ static bool vsp1_dl_list_hw_update_pending(struct vsp1_dl_manager *dlm) + return !!(vsp1_read(vsp1, VI6_DL_BODY_SIZE) + & VI6_DL_BODY_SIZE_UPD); + else +- return !!(vsp1_read(vsp1, VI6_CMD(dlm->index) & VI6_CMD_UPDHDR)); ++ return !!(vsp1_read(vsp1, VI6_CMD(dlm->index)) ++ & VI6_CMD_UPDHDR); + } + + static void vsp1_dl_list_hw_enqueue(struct vsp1_dl_list *dl) +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 5198c9eeb348..4312935f1dfc 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -101,7 +101,7 @@ static int get_v4l2_window32(struct v4l2_window __user *kp, + static int put_v4l2_window32(struct v4l2_window __user *kp, + struct v4l2_window32 __user *up) + { +- struct v4l2_clip __user *kclips = kp->clips; ++ struct v4l2_clip __user *kclips; + struct v4l2_clip32 __user *uclips; + compat_caddr_t p; + u32 clipcount; +@@ -116,6 +116,8 @@ static int put_v4l2_window32(struct v4l2_window __user *kp, + if (!clipcount) + return 0; + ++ if (get_user(kclips, &kp->clips)) ++ return -EFAULT; + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); +diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c +index 0301fe426a43..1d0b2208e8fb 100644 +--- a/drivers/media/v4l2-core/v4l2-dev.c ++++ b/drivers/media/v4l2-core/v4l2-dev.c +@@ -939,10 +939,14 @@ int __video_register_device(struct video_device *vdev, + #endif + vdev->minor = i + minor_offset; + vdev->num = nr; +- devnode_set(vdev); + + /* Should not happen since we thought this minor was free */ +- WARN_ON(video_device[vdev->minor] != NULL); ++ if (WARN_ON(video_device[vdev->minor])) { ++ mutex_unlock(&videodev_lock); ++ printk(KERN_ERR "video_device not empty!\n"); ++ return -ENFILE; ++ } ++ devnode_set(vdev); + vdev->index = get_index(vdev); + video_device[vdev->minor] = vdev; + mutex_unlock(&videodev_lock); +diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c +index 5782733959f0..f4e93f5fc204 100644 +--- a/drivers/net/slip/slhc.c ++++ b/drivers/net/slip/slhc.c +@@ -509,6 +509,10 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) + if(x < 0 || x > comp->rslot_limit) + goto bad; + ++ /* Check if the cstate is initialized */ ++ if (!comp->rstate[x].initialized) ++ goto bad; ++ + comp->flags &=~ SLF_TOSS; + comp->recv_current = x; + } else { +@@ -673,6 +677,7 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) + if (cs->cs_tcp.doff > 5) + memcpy(cs->cs_tcpopt, icp + ihl*4 + sizeof(struct tcphdr), (cs->cs_tcp.doff - 5) * 4); + cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2; ++ cs->initialized = true; + /* Put headers back on packet + * Neither header checksum is recalculated + */ +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index fff4b13eece2..5c42cf81a08b 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -901,6 +901,12 @@ static const struct usb_device_id products[] = { + USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&wwan_info, ++}, { ++ /* Cinterion AHS3 modem by GEMALTO */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x1e2d, 0x0055, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&wwan_info, + }, { + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 55a78eb96961..32cf21716f19 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -928,7 +928,8 @@ static int lan78xx_read_otp(struct lan78xx_net *dev, u32 offset, + offset += 0x100; + else + ret = -EINVAL; +- ret = lan78xx_read_raw_otp(dev, offset, length, data); ++ if (!ret) ++ ret = lan78xx_read_raw_otp(dev, offset, length, data); + } + + return ret; +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 396bf05c6bf6..d8b041f48ca8 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2892,6 +2892,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + struct ath_txq *txq; + int tidno; + ++ rcu_read_lock(); ++ + for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) { + tid = ath_node_to_tid(an, tidno); + txq = tid->txq; +@@ -2909,6 +2911,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + if (!an->sta) + break; /* just one multicast ath_atx_tid */ + } ++ ++ rcu_read_unlock(); + } + + #ifdef CONFIG_ATH9K_TX99 +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index e323d3abb6ac..959de2f8bb28 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016-2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -36,6 +37,7 @@ + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * All rights reserved. + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions +@@ -517,9 +519,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)}, + + /* 9000 Series */ +- {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_cfg)}, +@@ -544,11 +546,15 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)}, +- {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)}, +@@ -569,16 +575,42 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_shared_clk)}, +@@ -595,12 +627,94 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x42A4, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg_soc)}, +@@ -626,11 +740,44 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x9DF0, 0x0610, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0710, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x4030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x42A4, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_cfg_soc)}, +@@ -647,10 +794,16 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0xA370, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)}, + + /* 22000 Series */ + {IWL_PCI_DEVICE(0x2720, 0x0A10, iwl22000_2ac_cfg_hr_cdb)}, +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +index 121b94f09714..9a1d15b3ce45 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +@@ -1450,6 +1450,7 @@ static int rtl8187_probe(struct usb_interface *intf, + goto err_free_dev; + } + mutex_init(&priv->io_mutex); ++ mutex_init(&priv->conf_mutex); + + SET_IEEE80211_DEV(dev, &intf->dev); + usb_set_intfdata(intf, dev); +@@ -1625,7 +1626,6 @@ static int rtl8187_probe(struct usb_interface *intf, + printk(KERN_ERR "rtl8187: Cannot register device\n"); + goto err_free_dmabuf; + } +- mutex_init(&priv->conf_mutex); + skb_queue_head_init(&priv->b_tx_status.queue); + + wiphy_info(dev->wiphy, "hwaddr %pM, %s V%d + %s, rfkill mask %d\n", +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 7aeca5db7916..0b9e60861e53 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2793,6 +2793,7 @@ static int __nvme_check_ids(struct nvme_subsystem *subsys, + + list_for_each_entry(h, &subsys->nsheads, entry) { + if (nvme_ns_ids_valid(&new->ids) && ++ !list_empty(&h->list) && + nvme_ns_ids_equal(&new->ids, &h->ids)) + return -EINVAL; + } +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 2faf38eab785..cb694d2a1228 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -447,7 +447,6 @@ struct hv_pcibus_device { + spinlock_t device_list_lock; /* Protect lists below */ + void __iomem *cfg_addr; + +- struct semaphore enum_sem; + struct list_head resources_for_children; + + struct list_head children; +@@ -461,6 +460,8 @@ struct hv_pcibus_device { + struct retarget_msi_interrupt retarget_msi_interrupt_params; + + spinlock_t retarget_msi_interrupt_lock; ++ ++ struct workqueue_struct *wq; + }; + + /* +@@ -520,6 +521,8 @@ struct hv_pci_compl { + s32 completion_status; + }; + ++static void hv_pci_onchannelcallback(void *context); ++ + /** + * hv_pci_generic_compl() - Invoked for a completion packet + * @context: Set up by the sender of the packet. +@@ -664,6 +667,31 @@ static void _hv_pcifront_read_config(struct hv_pci_dev *hpdev, int where, + } + } + ++static u16 hv_pcifront_get_vendor_id(struct hv_pci_dev *hpdev) ++{ ++ u16 ret; ++ unsigned long flags; ++ void __iomem *addr = hpdev->hbus->cfg_addr + CFG_PAGE_OFFSET + ++ PCI_VENDOR_ID; ++ ++ spin_lock_irqsave(&hpdev->hbus->config_lock, flags); ++ ++ /* Choose the function to be read. (See comment above) */ ++ writel(hpdev->desc.win_slot.slot, hpdev->hbus->cfg_addr); ++ /* Make sure the function was chosen before we start reading. */ ++ mb(); ++ /* Read from that function's config space. */ ++ ret = readw(addr); ++ /* ++ * mb() is not required here, because the spin_unlock_irqrestore() ++ * is a barrier. ++ */ ++ ++ spin_unlock_irqrestore(&hpdev->hbus->config_lock, flags); ++ ++ return ret; ++} ++ + /** + * _hv_pcifront_write_config() - Internal PCI config write + * @hpdev: The PCI driver's representation of the device +@@ -1106,8 +1134,37 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + * Since this function is called with IRQ locks held, can't + * do normal wait for completion; instead poll. + */ +- while (!try_wait_for_completion(&comp.comp_pkt.host_event)) ++ while (!try_wait_for_completion(&comp.comp_pkt.host_event)) { ++ /* 0xFFFF means an invalid PCI VENDOR ID. */ ++ if (hv_pcifront_get_vendor_id(hpdev) == 0xFFFF) { ++ dev_err_once(&hbus->hdev->device, ++ "the device has gone\n"); ++ goto free_int_desc; ++ } ++ ++ /* ++ * When the higher level interrupt code calls us with ++ * interrupt disabled, we must poll the channel by calling ++ * the channel callback directly when channel->target_cpu is ++ * the current CPU. When the higher level interrupt code ++ * calls us with interrupt enabled, let's add the ++ * local_bh_disable()/enable() to avoid race. ++ */ ++ local_bh_disable(); ++ ++ if (hbus->hdev->channel->target_cpu == smp_processor_id()) ++ hv_pci_onchannelcallback(hbus); ++ ++ local_bh_enable(); ++ ++ if (hpdev->state == hv_pcichild_ejecting) { ++ dev_err_once(&hbus->hdev->device, ++ "the device is being ejected\n"); ++ goto free_int_desc; ++ } ++ + udelay(100); ++ } + + if (comp.comp_pkt.completion_status < 0) { + dev_err(&hbus->hdev->device, +@@ -1590,12 +1647,8 @@ static struct hv_pci_dev *get_pcichild_wslot(struct hv_pcibus_device *hbus, + * It must also treat the omission of a previously observed device as + * notification that the device no longer exists. + * +- * Note that this function is a work item, and it may not be +- * invoked in the order that it was queued. Back to back +- * updates of the list of present devices may involve queuing +- * multiple work items, and this one may run before ones that +- * were sent later. As such, this function only does something +- * if is the last one in the queue. ++ * Note that this function is serialized with hv_eject_device_work(), ++ * because both are pushed to the ordered workqueue hbus->wq. + */ + static void pci_devices_present_work(struct work_struct *work) + { +@@ -1616,11 +1669,6 @@ static void pci_devices_present_work(struct work_struct *work) + + INIT_LIST_HEAD(&removed); + +- if (down_interruptible(&hbus->enum_sem)) { +- put_hvpcibus(hbus); +- return; +- } +- + /* Pull this off the queue and process it if it was the last one. */ + spin_lock_irqsave(&hbus->device_list_lock, flags); + while (!list_empty(&hbus->dr_list)) { +@@ -1637,7 +1685,6 @@ static void pci_devices_present_work(struct work_struct *work) + spin_unlock_irqrestore(&hbus->device_list_lock, flags); + + if (!dr) { +- up(&hbus->enum_sem); + put_hvpcibus(hbus); + return; + } +@@ -1724,7 +1771,6 @@ static void pci_devices_present_work(struct work_struct *work) + break; + } + +- up(&hbus->enum_sem); + put_hvpcibus(hbus); + kfree(dr); + } +@@ -1770,7 +1816,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus, + spin_unlock_irqrestore(&hbus->device_list_lock, flags); + + get_hvpcibus(hbus); +- schedule_work(&dr_wrk->wrk); ++ queue_work(hbus->wq, &dr_wrk->wrk); + } + + /** +@@ -1848,7 +1894,7 @@ static void hv_pci_eject_device(struct hv_pci_dev *hpdev) + get_pcichild(hpdev, hv_pcidev_ref_pnp); + INIT_WORK(&hpdev->wrk, hv_eject_device_work); + get_hvpcibus(hpdev->hbus); +- schedule_work(&hpdev->wrk); ++ queue_work(hpdev->hbus->wq, &hpdev->wrk); + } + + /** +@@ -2461,13 +2507,18 @@ static int hv_pci_probe(struct hv_device *hdev, + spin_lock_init(&hbus->config_lock); + spin_lock_init(&hbus->device_list_lock); + spin_lock_init(&hbus->retarget_msi_interrupt_lock); +- sema_init(&hbus->enum_sem, 1); + init_completion(&hbus->remove_event); ++ hbus->wq = alloc_ordered_workqueue("hv_pci_%x", 0, ++ hbus->sysdata.domain); ++ if (!hbus->wq) { ++ ret = -ENOMEM; ++ goto free_bus; ++ } + + ret = vmbus_open(hdev->channel, pci_ring_size, pci_ring_size, NULL, 0, + hv_pci_onchannelcallback, hbus); + if (ret) +- goto free_bus; ++ goto destroy_wq; + + hv_set_drvdata(hdev, hbus); + +@@ -2536,6 +2587,8 @@ static int hv_pci_probe(struct hv_device *hdev, + hv_free_config_window(hbus); + close: + vmbus_close(hdev->channel); ++destroy_wq: ++ destroy_workqueue(hbus->wq); + free_bus: + free_page((unsigned long)hbus); + return ret; +@@ -2615,6 +2668,7 @@ static int hv_pci_remove(struct hv_device *hdev) + irq_domain_free_fwnode(hbus->sysdata.fwnode); + put_hvpcibus(hbus); + wait_for_completion(&hbus->remove_event); ++ destroy_workqueue(hbus->wq); + free_page((unsigned long)hbus); + return 0; + } +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index d5b02de02a3a..bfad63b5a13d 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -128,7 +128,7 @@ static inline int qdio_check_ccq(struct qdio_q *q, unsigned int ccq) + static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state, + int start, int count, int auto_ack) + { +- int rc, tmp_count = count, tmp_start = start, nr = q->nr, retried = 0; ++ int rc, tmp_count = count, tmp_start = start, nr = q->nr; + unsigned int ccq = 0; + + qperf_inc(q, eqbs); +@@ -151,14 +151,7 @@ static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state, + qperf_inc(q, eqbs_partial); + DBF_DEV_EVENT(DBF_WARN, q->irq_ptr, "EQBS part:%02x", + tmp_count); +- /* +- * Retry once, if that fails bail out and process the +- * extracted buffers before trying again. +- */ +- if (!retried++) +- goto again; +- else +- return count - tmp_count; ++ return count - tmp_count; + } + + DBF_ERROR("%4x EQBS ERROR", SCH_NO(q)); +@@ -214,7 +207,10 @@ static int qdio_do_sqbs(struct qdio_q *q, unsigned char state, int start, + return 0; + } + +-/* returns number of examined buffers and their common state in *state */ ++/* ++ * Returns number of examined buffers and their common state in *state. ++ * Requested number of buffers-to-examine must be > 0. ++ */ + static inline int get_buf_states(struct qdio_q *q, unsigned int bufnr, + unsigned char *state, unsigned int count, + int auto_ack, int merge_pending) +@@ -225,17 +221,23 @@ static inline int get_buf_states(struct qdio_q *q, unsigned int bufnr, + if (is_qebsm(q)) + return qdio_do_eqbs(q, state, bufnr, count, auto_ack); + +- for (i = 0; i < count; i++) { +- if (!__state) { +- __state = q->slsb.val[bufnr]; +- if (merge_pending && __state == SLSB_P_OUTPUT_PENDING) +- __state = SLSB_P_OUTPUT_EMPTY; +- } else if (merge_pending) { +- if ((q->slsb.val[bufnr] & __state) != __state) +- break; +- } else if (q->slsb.val[bufnr] != __state) +- break; ++ /* get initial state: */ ++ __state = q->slsb.val[bufnr]; ++ if (merge_pending && __state == SLSB_P_OUTPUT_PENDING) ++ __state = SLSB_P_OUTPUT_EMPTY; ++ ++ for (i = 1; i < count; i++) { + bufnr = next_buf(bufnr); ++ ++ /* merge PENDING into EMPTY: */ ++ if (merge_pending && ++ q->slsb.val[bufnr] == SLSB_P_OUTPUT_PENDING && ++ __state == SLSB_P_OUTPUT_EMPTY) ++ continue; ++ ++ /* stop if next state differs from initial state: */ ++ if (q->slsb.val[bufnr] != __state) ++ break; + } + *state = __state; + return i; +diff --git a/drivers/sbus/char/oradax.c b/drivers/sbus/char/oradax.c +index 03dc04739225..c44d7c7ffc92 100644 +--- a/drivers/sbus/char/oradax.c ++++ b/drivers/sbus/char/oradax.c +@@ -880,7 +880,7 @@ static int dax_ccb_exec(struct dax_ctx *ctx, const char __user *buf, + dax_dbg("args: ccb_buf_len=%ld, idx=%d", count, idx); + + /* for given index and length, verify ca_buf range exists */ +- if (idx + nccbs >= DAX_CA_ELEMS) { ++ if (idx < 0 || idx > (DAX_CA_ELEMS - nccbs)) { + ctx->result.exec.status = DAX_SUBMIT_ERR_NO_CA_AVAIL; + return 0; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 5c5dcca4d1da..e1cf8c0d73dd 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -471,9 +471,6 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req, + + static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + { +- if (!ha->req_q_map) +- return; +- + if (IS_QLAFX00(ha)) { + if (req && req->ring_fx00) + dma_free_coherent(&ha->pdev->dev, +@@ -484,17 +481,14 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + (req->length + 1) * sizeof(request_t), + req->ring, req->dma); + +- if (req) { ++ if (req) + kfree(req->outstanding_cmds); +- kfree(req); +- } ++ ++ kfree(req); + } + + static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + { +- if (!ha->rsp_q_map) +- return; +- + if (IS_QLAFX00(ha)) { + if (rsp && rsp->ring) + dma_free_coherent(&ha->pdev->dev, +@@ -505,8 +499,7 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + (rsp->length + 1) * sizeof(response_t), + rsp->ring, rsp->dma); + } +- if (rsp) +- kfree(rsp); ++ kfree(rsp); + } + + static void qla2x00_free_queues(struct qla_hw_data *ha) +@@ -3107,7 +3100,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + goto probe_failed; + + /* Alloc arrays of request and response ring ptrs */ +- if (qla2x00_alloc_queues(ha, req, rsp)) { ++ ret = qla2x00_alloc_queues(ha, req, rsp); ++ if (ret) { + ql_log(ql_log_fatal, base_vha, 0x003d, + "Failed to allocate memory for queue pointers..." + "aborting.\n"); +@@ -3408,8 +3402,15 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + } + + qla2x00_free_device(base_vha); +- + scsi_host_put(base_vha->host); ++ /* ++ * Need to NULL out local req/rsp after ++ * qla2x00_free_device => qla2x00_free_queues frees ++ * what these are pointing to. Or else we'll ++ * fall over below in qla2x00_free_req/rsp_que. ++ */ ++ req = NULL; ++ rsp = NULL; + + probe_hw_failed: + qla2x00_mem_free(ha); +@@ -4115,6 +4116,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + (*rsp)->dma = 0; + fail_rsp_ring: + kfree(*rsp); ++ *rsp = NULL; + fail_rsp: + dma_free_coherent(&ha->pdev->dev, ((*req)->length + 1) * + sizeof(request_t), (*req)->ring, (*req)->dma); +@@ -4122,6 +4124,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + (*req)->dma = 0; + fail_req_ring: + kfree(*req); ++ *req = NULL; + fail_req: + dma_free_coherent(&ha->pdev->dev, sizeof(struct ct_sns_pkt), + ha->ct_sns, ha->ct_sns_dma); +@@ -4509,16 +4512,11 @@ qla2x00_mem_free(struct qla_hw_data *ha) + dma_free_coherent(&ha->pdev->dev, ha->init_cb_size, + ha->init_cb, ha->init_cb_dma); + +- if (ha->optrom_buffer) +- vfree(ha->optrom_buffer); +- if (ha->nvram) +- kfree(ha->nvram); +- if (ha->npiv_info) +- kfree(ha->npiv_info); +- if (ha->swl) +- kfree(ha->swl); +- if (ha->loop_id_map) +- kfree(ha->loop_id_map); ++ vfree(ha->optrom_buffer); ++ kfree(ha->nvram); ++ kfree(ha->npiv_info); ++ kfree(ha->swl); ++ kfree(ha->loop_id_map); + + ha->srb_mempool = NULL; + ha->ctx_mempool = NULL; +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index b88b5dbbc444..188f30572aa1 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -112,6 +112,9 @@ static struct scsi_device_handler *scsi_dh_lookup(const char *name) + { + struct scsi_device_handler *dh; + ++ if (!name || strlen(name) == 0) ++ return NULL; ++ + dh = __scsi_dh_lookup(name); + if (!dh) { + request_module("scsi_dh_%s", name); +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index c84f931388f2..912eacdc2d83 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -721,8 +721,6 @@ static blk_status_t __scsi_error_from_host_byte(struct scsi_cmnd *cmd, + int result) + { + switch (host_byte(result)) { +- case DID_OK: +- return BLK_STS_OK; + case DID_TRANSPORT_FAILFAST: + return BLK_STS_TRANSPORT; + case DID_TARGET_FAILURE: +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 5320039671b7..be6a4b6a76c6 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -744,7 +744,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, + struct iov_iter t; + void __user *uaddr = vhost_vq_meta_fetch(vq, + (u64)(uintptr_t)to, size, +- VHOST_ADDR_DESC); ++ VHOST_ADDR_USED); + + if (uaddr) + return __copy_to_user(uaddr, from, size); +@@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, + /* Caller should have vq mutex and device mutex */ + int vhost_vq_access_ok(struct vhost_virtqueue *vq) + { +- int ret = vq_log_access_ok(vq, vq->log_base); ++ if (!vq_log_access_ok(vq, vq->log_base)) ++ return 0; + +- if (ret || vq->iotlb) +- return ret; ++ /* Access validation occurs at prefetch time with IOTLB */ ++ if (vq->iotlb) ++ return 1; + + return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); + } +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index a493e99bed21..81a84b3c1c50 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -365,7 +365,7 @@ void xenbus_dev_queue_reply(struct xb_req_data *req) + if (WARN_ON(rc)) + goto out; + } +- } else if (req->msg.type == XS_TRANSACTION_END) { ++ } else if (req->type == XS_TRANSACTION_END) { + trans = xenbus_get_transaction(u, req->msg.tx_id); + if (WARN_ON(!trans)) + goto out; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index aa720cc44509..b9d93fd532a9 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -191,8 +191,9 @@ static void select_policy(struct f2fs_sb_info *sbi, int gc_type, + if (gc_type != FG_GC && p->max_search > sbi->max_victim_search) + p->max_search = sbi->max_victim_search; + +- /* let's select beginning hot/small space first */ +- if (type == CURSEG_HOT_DATA || IS_NODESEG(type)) ++ /* let's select beginning hot/small space first in no_heap mode*/ ++ if (test_opt(sbi, NOHEAP) && ++ (type == CURSEG_HOT_DATA || IS_NODESEG(type))) + p->offset = 0; + else + p->offset = SIT_I(sbi)->last_victim[p->gc_mode]; +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index b16a8e6625aa..205b0d934c44 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -2164,7 +2164,8 @@ static unsigned int __get_next_segno(struct f2fs_sb_info *sbi, int type) + if (sbi->segs_per_sec != 1) + return CURSEG_I(sbi, type)->segno; + +- if (type == CURSEG_HOT_DATA || IS_NODESEG(type)) ++ if (test_opt(sbi, NOHEAP) && ++ (type == CURSEG_HOT_DATA || IS_NODESEG(type))) + return 0; + + if (SIT_I(sbi)->last_victim[ALLOC_NEXT]) +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index b9a254dcc0e7..d508c7844681 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -138,10 +138,14 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) + + /* + * page based offset in vm_pgoff could be sufficiently large to +- * overflow a (l)off_t when converted to byte offset. ++ * overflow a loff_t when converted to byte offset. This can ++ * only happen on architectures where sizeof(loff_t) == ++ * sizeof(unsigned long). So, only check in those instances. + */ +- if (vma->vm_pgoff & PGOFF_LOFFT_MAX) +- return -EINVAL; ++ if (sizeof(unsigned long) == sizeof(loff_t)) { ++ if (vma->vm_pgoff & PGOFF_LOFFT_MAX) ++ return -EINVAL; ++ } + + /* must be huge page aligned */ + if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT)) +diff --git a/fs/namei.c b/fs/namei.c +index cafa365eeb70..b61d6aa9279d 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -222,9 +222,10 @@ getname_kernel(const char * filename) + if (len <= EMBEDDED_NAME_MAX) { + result->name = (char *)result->iname; + } else if (len <= PATH_MAX) { ++ const size_t size = offsetof(struct filename, iname[1]); + struct filename *tmp; + +- tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); ++ tmp = kmalloc(size, GFP_KERNEL); + if (unlikely(!tmp)) { + __putname(result); + return ERR_PTR(-ENOMEM); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index a0bed2b2004d..7fce5c3540ce 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -32,6 +32,7 @@ + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ ++#include + #include + #include + #include +@@ -252,11 +253,13 @@ do_open_lookup(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, stru + * Note: create modes (UNCHECKED,GUARDED...) are the same + * in NFSv4 as in v3 except EXCLUSIVE4_1. + */ ++ current->fs->umask = open->op_umask; + status = do_nfsd_create(rqstp, current_fh, open->op_fname.data, + open->op_fname.len, &open->op_iattr, + *resfh, open->op_createmode, + (u32 *)open->op_verf.data, + &open->op_truncate, &open->op_created); ++ current->fs->umask = 0; + + if (!status && open->op_label.len) + nfsd4_security_inode_setsecctx(*resfh, &open->op_label, open->op_bmval); +@@ -603,6 +606,7 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + if (status) + return status; + ++ current->fs->umask = create->cr_umask; + switch (create->cr_type) { + case NF4LNK: + status = nfsd_symlink(rqstp, &cstate->current_fh, +@@ -611,20 +615,22 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + break; + + case NF4BLK: ++ status = nfserr_inval; + rdev = MKDEV(create->cr_specdata1, create->cr_specdata2); + if (MAJOR(rdev) != create->cr_specdata1 || + MINOR(rdev) != create->cr_specdata2) +- return nfserr_inval; ++ goto out_umask; + status = nfsd_create(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + &create->cr_iattr, S_IFBLK, rdev, &resfh); + break; + + case NF4CHR: ++ status = nfserr_inval; + rdev = MKDEV(create->cr_specdata1, create->cr_specdata2); + if (MAJOR(rdev) != create->cr_specdata1 || + MINOR(rdev) != create->cr_specdata2) +- return nfserr_inval; ++ goto out_umask; + status = nfsd_create(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + &create->cr_iattr,S_IFCHR, rdev, &resfh); +@@ -668,6 +674,8 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + fh_dup2(&cstate->current_fh, &resfh); + out: + fh_put(&resfh); ++out_umask: ++ current->fs->umask = 0; + return status; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index e502fd16246b..45f0f0500ee4 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -33,7 +33,6 @@ + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +-#include + #include + #include + #include +@@ -682,7 +681,7 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + + status = nfsd4_decode_fattr(argp, create->cr_bmval, &create->cr_iattr, + &create->cr_acl, &create->cr_label, +- ¤t->fs->umask); ++ &create->cr_umask); + if (status) + goto out; + +@@ -927,7 +926,6 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + case NFS4_OPEN_NOCREATE: + break; + case NFS4_OPEN_CREATE: +- current->fs->umask = 0; + READ_BUF(4); + open->op_createmode = be32_to_cpup(p++); + switch (open->op_createmode) { +@@ -935,7 +933,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + case NFS4_CREATE_GUARDED: + status = nfsd4_decode_fattr(argp, open->op_bmval, + &open->op_iattr, &open->op_acl, &open->op_label, +- ¤t->fs->umask); ++ &open->op_umask); + if (status) + goto out; + break; +@@ -950,7 +948,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + COPYMEM(open->op_verf.data, NFS4_VERIFIER_SIZE); + status = nfsd4_decode_fattr(argp, open->op_bmval, + &open->op_iattr, &open->op_acl, &open->op_label, +- ¤t->fs->umask); ++ &open->op_umask); + if (status) + goto out; + break; +diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h +index bc29511b6405..f47c392cbd57 100644 +--- a/fs/nfsd/xdr4.h ++++ b/fs/nfsd/xdr4.h +@@ -118,6 +118,7 @@ struct nfsd4_create { + } u; + u32 cr_bmval[3]; /* request */ + struct iattr cr_iattr; /* request */ ++ int cr_umask; /* request */ + struct nfsd4_change_info cr_cinfo; /* response */ + struct nfs4_acl *cr_acl; + struct xdr_netobj cr_label; +@@ -228,6 +229,7 @@ struct nfsd4_open { + u32 op_why_no_deleg; /* response - DELEG_NONE_EXT only */ + u32 op_create; /* request */ + u32 op_createmode; /* request */ ++ int op_umask; /* request */ + u32 op_bmval[3]; /* request */ + struct iattr op_iattr; /* UNCHECKED4, GUARDED4, EXCLUSIVE4_1 */ + nfs4_verifier op_verf __attribute__((aligned(32))); +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index 3b1bd469accd..1d75b2e96c96 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -118,13 +118,10 @@ int ovl_getattr(const struct path *path, struct kstat *stat, + */ + if (ovl_test_flag(OVL_INDEX, d_inode(dentry)) || + (!ovl_verify_lower(dentry->d_sb) && +- (is_dir || lowerstat.nlink == 1))) ++ (is_dir || lowerstat.nlink == 1))) { + stat->ino = lowerstat.ino; +- +- if (samefs) +- WARN_ON_ONCE(stat->dev != lowerstat.dev); +- else + stat->dev = ovl_get_pseudo_dev(dentry); ++ } + } + if (samefs) { + /* +@@ -459,9 +456,20 @@ static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode *inode) + #endif + } + +-static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev) ++static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev, ++ unsigned long ino) + { +- inode->i_ino = get_next_ino(); ++ /* ++ * When NFS export is enabled and d_ino is consistent with st_ino ++ * (samefs), set the same value to i_ino, because nfsd readdirplus ++ * compares d_ino values to i_ino values of child entries. When called ++ * from ovl_new_inode(), ino arg is 0, so i_ino will be updated to real ++ * upper inode i_ino on ovl_inode_init() or ovl_inode_update(). ++ */ ++ if (inode->i_sb->s_export_op && ovl_same_sb(inode->i_sb)) ++ inode->i_ino = ino; ++ else ++ inode->i_ino = get_next_ino(); + inode->i_mode = mode; + inode->i_flags |= S_NOCMTIME; + #ifdef CONFIG_FS_POSIX_ACL +@@ -597,7 +605,7 @@ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev) + + inode = new_inode(sb); + if (inode) +- ovl_fill_inode(inode, mode, rdev); ++ ovl_fill_inode(inode, mode, rdev, 0); + + return inode; + } +@@ -710,6 +718,7 @@ struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry, + struct inode *inode; + bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, index); + bool is_dir; ++ unsigned long ino = 0; + + if (!realinode) + realinode = d_inode(lowerdentry); +@@ -748,13 +757,14 @@ struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry, + if (!is_dir) + nlink = ovl_get_nlink(lowerdentry, upperdentry, nlink); + set_nlink(inode, nlink); ++ ino = key->i_ino; + } else { + /* Lower hardlink that will be broken on copy up */ + inode = new_inode(sb); + if (!inode) + goto out_nomem; + } +- ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev); ++ ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev, ino); + ovl_inode_init(inode, upperdentry, lowerdentry); + + if (upperdentry && ovl_is_impuredir(upperdentry)) +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 70fcfcc684cc..35418317ecf2 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -56,6 +56,15 @@ static int ovl_check_redirect(struct dentry *dentry, struct ovl_lookup_data *d, + if (s == next) + goto invalid; + } ++ /* ++ * One of the ancestor path elements in an absolute path ++ * lookup in ovl_lookup_layer() could have been opaque and ++ * that will stop further lookup in lower layers (d->stop=true) ++ * But we have found an absolute redirect in decendant path ++ * element and that should force continue lookup in lower ++ * layers (reset d->stop). ++ */ ++ d->stop = false; + } else { + if (strchr(buf, '/') != NULL) + goto invalid; +@@ -815,7 +824,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, + .is_dir = false, + .opaque = false, + .stop = false, +- .last = !poe->numlower, ++ .last = ofs->config.redirect_follow ? false : !poe->numlower, + .redirect = NULL, + }; + +@@ -873,7 +882,11 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, + for (i = 0; !d.stop && i < poe->numlower; i++) { + struct ovl_path lower = poe->lowerstack[i]; + +- d.last = i == poe->numlower - 1; ++ if (!ofs->config.redirect_follow) ++ d.last = i == poe->numlower - 1; ++ else ++ d.last = lower.layer->idx == roe->numlower; ++ + err = ovl_lookup_layer(lower.dentry, &d, &this); + if (err) + goto out_put; +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index 930784a26623..493f9b76fbf6 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -279,12 +279,16 @@ void ovl_dentry_set_redirect(struct dentry *dentry, const char *redirect) + void ovl_inode_init(struct inode *inode, struct dentry *upperdentry, + struct dentry *lowerdentry) + { ++ struct inode *realinode = d_inode(upperdentry ?: lowerdentry); ++ + if (upperdentry) + OVL_I(inode)->__upperdentry = upperdentry; + if (lowerdentry) + OVL_I(inode)->lower = igrab(d_inode(lowerdentry)); + +- ovl_copyattr(d_inode(upperdentry ?: lowerdentry), inode); ++ ovl_copyattr(realinode, inode); ++ if (!inode->i_ino) ++ inode->i_ino = realinode->i_ino; + } + + void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) +@@ -299,6 +303,8 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) + smp_wmb(); + OVL_I(inode)->__upperdentry = upperdentry; + if (inode_unhashed(inode)) { ++ if (!inode->i_ino) ++ inode->i_ino = upperinode->i_ino; + inode->i_private = upperinode; + __insert_inode_hash(inode, (unsigned long) upperinode); + } +diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h +index 53f32022fabe..7f0bda760a58 100644 +--- a/include/media/v4l2-dev.h ++++ b/include/media/v4l2-dev.h +@@ -33,13 +33,13 @@ + */ + enum vfl_devnode_type { + VFL_TYPE_GRABBER = 0, +- VFL_TYPE_VBI = 1, +- VFL_TYPE_RADIO = 2, +- VFL_TYPE_SUBDEV = 3, +- VFL_TYPE_SDR = 4, +- VFL_TYPE_TOUCH = 5, ++ VFL_TYPE_VBI, ++ VFL_TYPE_RADIO, ++ VFL_TYPE_SUBDEV, ++ VFL_TYPE_SDR, ++ VFL_TYPE_TOUCH, ++ VFL_TYPE_MAX /* Shall be the last one */ + }; +-#define VFL_TYPE_MAX VFL_TYPE_TOUCH + + /** + * enum vfl_direction - Identifies if a &struct video_device corresponds +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 95ccc1eef558..b619a190ff12 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -895,7 +895,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + u16 conn_timeout); + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, u8 sec_level, u16 conn_timeout, +- u8 role); ++ u8 role, bdaddr_t *direct_rpa); + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type); + struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, +diff --git a/include/net/slhc_vj.h b/include/net/slhc_vj.h +index 8716d5942b65..8fcf8908a694 100644 +--- a/include/net/slhc_vj.h ++++ b/include/net/slhc_vj.h +@@ -127,6 +127,7 @@ typedef __u32 int32; + */ + struct cstate { + byte_t cs_this; /* connection id number (xmit) */ ++ bool initialized; /* true if initialized */ + struct cstate *next; /* next in ring (xmit) */ + struct iphdr cs_ip; /* ip/tcp hdr from most recent packet */ + struct tcphdr cs_tcp; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 709a55b9ad97..b32bc0698a2a 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4123,6 +4123,9 @@ static void _free_event(struct perf_event *event) + if (event->ctx) + put_ctx(event->ctx); + ++ if (event->hw.target) ++ put_task_struct(event->hw.target); ++ + exclusive_event_destroy(event); + module_put(event->pmu->module); + +@@ -9488,6 +9491,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + * and we cannot use the ctx information because we need the + * pmu before we get a ctx. + */ ++ get_task_struct(task); + event->hw.target = task; + } + +@@ -9603,6 +9607,8 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + perf_detach_cgroup(event); + if (event->ns) + put_pid_ns(event->ns); ++ if (event->hw.target) ++ put_task_struct(event->hw.target); + kfree(event); + + return ERR_PTR(err); +diff --git a/lib/bitmap.c b/lib/bitmap.c +index 9e498c77ed0e..a42eff7e8c48 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -607,7 +607,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + /* if no digit is after '-', it's wrong*/ + if (at_start && in_range) + return -EINVAL; +- if (!(a <= b) || !(used_size <= group_size)) ++ if (!(a <= b) || group_size == 0 || !(used_size <= group_size)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c +index b3f235baa05d..413367cf569e 100644 +--- a/lib/test_bitmap.c ++++ b/lib/test_bitmap.c +@@ -255,6 +255,10 @@ static const struct test_bitmap_parselist parselist_tests[] __initconst = { + {-EINVAL, "-1", NULL, 8, 0}, + {-EINVAL, "-0", NULL, 8, 0}, + {-EINVAL, "10-1", NULL, 8, 0}, ++ {-EINVAL, "0-31:", NULL, 8, 0}, ++ {-EINVAL, "0-31:0", NULL, 8, 0}, ++ {-EINVAL, "0-31:0/0", NULL, 8, 0}, ++ {-EINVAL, "0-31:1/0", NULL, 8, 0}, + {-EINVAL, "0-31:10/1", NULL, 8, 0}, + }; + +diff --git a/mm/gup.c b/mm/gup.c +index 6afae32571ca..8f3a06408e28 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1806,9 +1806,12 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, + len = (unsigned long) nr_pages << PAGE_SHIFT; + end = start + len; + ++ if (nr_pages <= 0) ++ return 0; ++ + if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, + (void __user *)start, len))) +- return 0; ++ return -EFAULT; + + if (gup_fast_permitted(start, nr_pages, write)) { + local_irq_disable(); +diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c +index 5c8e2abeaa15..0f44759486e2 100644 +--- a/mm/gup_benchmark.c ++++ b/mm/gup_benchmark.c +@@ -23,7 +23,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + struct page **pages; + + nr_pages = gup->size / PAGE_SIZE; +- pages = kvmalloc(sizeof(void *) * nr_pages, GFP_KERNEL); ++ pages = kvzalloc(sizeof(void *) * nr_pages, GFP_KERNEL); + if (!pages) + return -ENOMEM; + +@@ -41,6 +41,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd, + } + + nr = get_user_pages_fast(addr, nr, gup->flags & 1, pages + i); ++ if (nr <= 0) ++ break; + i += nr; + } + end_time = ktime_get(); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index a9682534c377..45ff5dc124cc 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -749,18 +749,31 @@ static bool conn_use_rpa(struct hci_conn *conn) + } + + static void hci_req_add_le_create_conn(struct hci_request *req, +- struct hci_conn *conn) ++ struct hci_conn *conn, ++ bdaddr_t *direct_rpa) + { + struct hci_cp_le_create_conn cp; + struct hci_dev *hdev = conn->hdev; + u8 own_addr_type; + +- /* Update random address, but set require_privacy to false so +- * that we never connect with an non-resolvable address. ++ /* If direct address was provided we use it instead of current ++ * address. + */ +- if (hci_update_random_address(req, false, conn_use_rpa(conn), +- &own_addr_type)) +- return; ++ if (direct_rpa) { ++ if (bacmp(&req->hdev->random_addr, direct_rpa)) ++ hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, ++ direct_rpa); ++ ++ /* direct address is always RPA */ ++ own_addr_type = ADDR_LE_DEV_RANDOM; ++ } else { ++ /* Update random address, but set require_privacy to false so ++ * that we never connect with an non-resolvable address. ++ */ ++ if (hci_update_random_address(req, false, conn_use_rpa(conn), ++ &own_addr_type)) ++ return; ++ } + + memset(&cp, 0, sizeof(cp)); + +@@ -825,7 +838,7 @@ static void hci_req_directed_advertising(struct hci_request *req, + + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, u8 sec_level, u16 conn_timeout, +- u8 role) ++ u8 role, bdaddr_t *direct_rpa) + { + struct hci_conn_params *params; + struct hci_conn *conn; +@@ -940,7 +953,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); + } + +- hci_req_add_le_create_conn(&req, conn); ++ hci_req_add_le_create_conn(&req, conn, direct_rpa); + + create_conn: + err = hci_req_run(&req, create_le_conn_complete); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index cd3bbb766c24..139707cd9d35 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4648,7 +4648,8 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, + /* This function requires the caller holds hdev->lock */ + static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + bdaddr_t *addr, +- u8 addr_type, u8 adv_type) ++ u8 addr_type, u8 adv_type, ++ bdaddr_t *direct_rpa) + { + struct hci_conn *conn; + struct hci_conn_params *params; +@@ -4699,7 +4700,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + } + + conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW, +- HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER); ++ HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER, ++ direct_rpa); + if (!IS_ERR(conn)) { + /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned + * by higher layer that tried to connect, if no then +@@ -4808,8 +4810,13 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + bdaddr_type = irk->addr_type; + } + +- /* Check if we have been requested to connect to this device */ +- conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type); ++ /* Check if we have been requested to connect to this device. ++ * ++ * direct_addr is set only for directed advertising reports (it is NULL ++ * for advertising reports) and is already verified to be RPA above. ++ */ ++ conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type, ++ direct_addr); + if (conn && type == LE_ADV_IND) { + /* Store report for later inclusion by + * mgmt_device_connected +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index fc6615d59165..9b7907ebfa01 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -7156,7 +7156,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, + hcon = hci_connect_le(hdev, dst, dst_type, + chan->sec_level, + HCI_LE_CONN_TIMEOUT, +- HCI_ROLE_SLAVE); ++ HCI_ROLE_SLAVE, NULL); + else + hcon = hci_connect_le_scan(hdev, dst, dst_type, + chan->sec_level, +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 0901de42ed85..586a008b1642 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -778,8 +778,14 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu) + tunnel->encap.type == TUNNEL_ENCAP_NONE) { + dev->features |= NETIF_F_GSO_SOFTWARE; + dev->hw_features |= NETIF_F_GSO_SOFTWARE; ++ } else { ++ dev->features &= ~NETIF_F_GSO_SOFTWARE; ++ dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; + } + dev->features |= NETIF_F_LLTX; ++ } else { ++ dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; ++ dev->features &= ~(NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE); + } + } + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 14b67dfacc4b..0fbd3ee26165 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -335,26 +335,6 @@ int l2tp_session_register(struct l2tp_session *session, + } + EXPORT_SYMBOL_GPL(l2tp_session_register); + +-/* Lookup a tunnel by id +- */ +-struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id) +-{ +- struct l2tp_tunnel *tunnel; +- struct l2tp_net *pn = l2tp_pernet(net); +- +- rcu_read_lock_bh(); +- list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- if (tunnel->tunnel_id == tunnel_id) { +- rcu_read_unlock_bh(); +- return tunnel; +- } +- } +- rcu_read_unlock_bh(); +- +- return NULL; +-} +-EXPORT_SYMBOL_GPL(l2tp_tunnel_find); +- + struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth) + { + struct l2tp_net *pn = l2tp_pernet(net); +@@ -1436,74 +1416,11 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + { + struct l2tp_tunnel *tunnel = NULL; + int err; +- struct socket *sock = NULL; +- struct sock *sk = NULL; +- struct l2tp_net *pn; + enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP; + +- /* Get the tunnel socket from the fd, which was opened by +- * the userspace L2TP daemon. If not specified, create a +- * kernel socket. +- */ +- if (fd < 0) { +- err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id, +- cfg, &sock); +- if (err < 0) +- goto err; +- } else { +- sock = sockfd_lookup(fd, &err); +- if (!sock) { +- pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n", +- tunnel_id, fd, err); +- err = -EBADF; +- goto err; +- } +- +- /* Reject namespace mismatches */ +- if (!net_eq(sock_net(sock->sk), net)) { +- pr_err("tunl %u: netns mismatch\n", tunnel_id); +- err = -EINVAL; +- goto err; +- } +- } +- +- sk = sock->sk; +- + if (cfg != NULL) + encap = cfg->encap; + +- /* Quick sanity checks */ +- err = -EPROTONOSUPPORT; +- if (sk->sk_type != SOCK_DGRAM) { +- pr_debug("tunl %hu: fd %d wrong socket type\n", +- tunnel_id, fd); +- goto err; +- } +- switch (encap) { +- case L2TP_ENCAPTYPE_UDP: +- if (sk->sk_protocol != IPPROTO_UDP) { +- pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", +- tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP); +- goto err; +- } +- break; +- case L2TP_ENCAPTYPE_IP: +- if (sk->sk_protocol != IPPROTO_L2TP) { +- pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", +- tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP); +- goto err; +- } +- break; +- } +- +- /* Check if this socket has already been prepped */ +- tunnel = l2tp_tunnel(sk); +- if (tunnel != NULL) { +- /* This socket has already been prepped */ +- err = -EBUSY; +- goto err; +- } +- + tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL); + if (tunnel == NULL) { + err = -ENOMEM; +@@ -1520,72 +1437,126 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + rwlock_init(&tunnel->hlist_lock); + tunnel->acpt_newsess = true; + +- /* The net we belong to */ +- tunnel->l2tp_net = net; +- pn = l2tp_pernet(net); +- + if (cfg != NULL) + tunnel->debug = cfg->debug; + +- /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ + tunnel->encap = encap; +- if (encap == L2TP_ENCAPTYPE_UDP) { +- struct udp_tunnel_sock_cfg udp_cfg = { }; +- +- udp_cfg.sk_user_data = tunnel; +- udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP; +- udp_cfg.encap_rcv = l2tp_udp_encap_recv; +- udp_cfg.encap_destroy = l2tp_udp_encap_destroy; +- +- setup_udp_tunnel_sock(net, sock, &udp_cfg); +- } else { +- sk->sk_user_data = tunnel; +- } + +- /* Bump the reference count. The tunnel context is deleted +- * only when this drops to zero. A reference is also held on +- * the tunnel socket to ensure that it is not released while +- * the tunnel is extant. Must be done before sk_destruct is +- * set. +- */ + refcount_set(&tunnel->ref_count, 1); +- sock_hold(sk); +- tunnel->sock = sk; + tunnel->fd = fd; + +- /* Hook on the tunnel socket destructor so that we can cleanup +- * if the tunnel socket goes away. +- */ +- tunnel->old_sk_destruct = sk->sk_destruct; +- sk->sk_destruct = &l2tp_tunnel_destruct; +- lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock"); +- +- sk->sk_allocation = GFP_ATOMIC; +- + /* Init delete workqueue struct */ + INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work); + +- /* Add tunnel to our list */ + INIT_LIST_HEAD(&tunnel->list); +- spin_lock_bh(&pn->l2tp_tunnel_list_lock); +- list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); +- spin_unlock_bh(&pn->l2tp_tunnel_list_lock); + + err = 0; + err: + if (tunnelp) + *tunnelp = tunnel; + +- /* If tunnel's socket was created by the kernel, it doesn't +- * have a file. +- */ +- if (sock && sock->file) +- sockfd_put(sock); +- + return err; + } + EXPORT_SYMBOL_GPL(l2tp_tunnel_create); + ++static int l2tp_validate_socket(const struct sock *sk, const struct net *net, ++ enum l2tp_encap_type encap) ++{ ++ if (!net_eq(sock_net(sk), net)) ++ return -EINVAL; ++ ++ if (sk->sk_type != SOCK_DGRAM) ++ return -EPROTONOSUPPORT; ++ ++ if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) || ++ (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP)) ++ return -EPROTONOSUPPORT; ++ ++ if (sk->sk_user_data) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, ++ struct l2tp_tunnel_cfg *cfg) ++{ ++ struct l2tp_tunnel *tunnel_walk; ++ struct l2tp_net *pn; ++ struct socket *sock; ++ struct sock *sk; ++ int ret; ++ ++ if (tunnel->fd < 0) { ++ ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id, ++ tunnel->peer_tunnel_id, cfg, ++ &sock); ++ if (ret < 0) ++ goto err; ++ } else { ++ sock = sockfd_lookup(tunnel->fd, &ret); ++ if (!sock) ++ goto err; ++ ++ ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); ++ if (ret < 0) ++ goto err_sock; ++ } ++ ++ sk = sock->sk; ++ ++ sock_hold(sk); ++ tunnel->sock = sk; ++ tunnel->l2tp_net = net; ++ ++ pn = l2tp_pernet(net); ++ ++ spin_lock_bh(&pn->l2tp_tunnel_list_lock); ++ list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) { ++ if (tunnel_walk->tunnel_id == tunnel->tunnel_id) { ++ spin_unlock_bh(&pn->l2tp_tunnel_list_lock); ++ ++ ret = -EEXIST; ++ goto err_sock; ++ } ++ } ++ list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); ++ spin_unlock_bh(&pn->l2tp_tunnel_list_lock); ++ ++ if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { ++ struct udp_tunnel_sock_cfg udp_cfg = { ++ .sk_user_data = tunnel, ++ .encap_type = UDP_ENCAP_L2TPINUDP, ++ .encap_rcv = l2tp_udp_encap_recv, ++ .encap_destroy = l2tp_udp_encap_destroy, ++ }; ++ ++ setup_udp_tunnel_sock(net, sock, &udp_cfg); ++ } else { ++ sk->sk_user_data = tunnel; ++ } ++ ++ tunnel->old_sk_destruct = sk->sk_destruct; ++ sk->sk_destruct = &l2tp_tunnel_destruct; ++ lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, ++ "l2tp_sock"); ++ sk->sk_allocation = GFP_ATOMIC; ++ ++ if (tunnel->fd >= 0) ++ sockfd_put(sock); ++ ++ return 0; ++ ++err_sock: ++ if (tunnel->fd < 0) ++ sock_release(sock); ++ else ++ sockfd_put(sock); ++err: ++ return ret; ++} ++EXPORT_SYMBOL_GPL(l2tp_tunnel_register); ++ + /* This function is used by the netlink TUNNEL_DELETE command. + */ + void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 2718d0b284d0..ba33cbec71eb 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -220,12 +220,14 @@ struct l2tp_session *l2tp_session_get(const struct net *net, + struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth); + struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net, + const char *ifname); +-struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id); + struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth); + + int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, + u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, + struct l2tp_tunnel **tunnelp); ++int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, ++ struct l2tp_tunnel_cfg *cfg); ++ + void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel); + void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); + struct l2tp_session *l2tp_session_create(int priv_size, +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index e7ea9c4b89ff..b05dbd9ffcb2 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -236,12 +236,6 @@ static int l2tp_nl_cmd_tunnel_create(struct sk_buff *skb, struct genl_info *info + if (info->attrs[L2TP_ATTR_DEBUG]) + cfg.debug = nla_get_u32(info->attrs[L2TP_ATTR_DEBUG]); + +- tunnel = l2tp_tunnel_find(net, tunnel_id); +- if (tunnel != NULL) { +- ret = -EEXIST; +- goto out; +- } +- + ret = -EINVAL; + switch (cfg.encap) { + case L2TP_ENCAPTYPE_UDP: +@@ -251,9 +245,19 @@ static int l2tp_nl_cmd_tunnel_create(struct sk_buff *skb, struct genl_info *info + break; + } + +- if (ret >= 0) +- ret = l2tp_tunnel_notify(&l2tp_nl_family, info, +- tunnel, L2TP_CMD_TUNNEL_CREATE); ++ if (ret < 0) ++ goto out; ++ ++ l2tp_tunnel_inc_refcount(tunnel); ++ ret = l2tp_tunnel_register(tunnel, net, &cfg); ++ if (ret < 0) { ++ kfree(tunnel); ++ goto out; ++ } ++ ret = l2tp_tunnel_notify(&l2tp_nl_family, info, tunnel, ++ L2TP_CMD_TUNNEL_CREATE); ++ l2tp_tunnel_dec_refcount(tunnel); ++ + out: + return ret; + } +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index 3b02f24ea9ec..3d7887cc599b 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -698,6 +698,15 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); + if (error < 0) + goto end; ++ ++ l2tp_tunnel_inc_refcount(tunnel); ++ error = l2tp_tunnel_register(tunnel, sock_net(sk), ++ &tcfg); ++ if (error < 0) { ++ kfree(tunnel); ++ goto end; ++ } ++ drop_tunnel = true; + } + } else { + /* Error if we can't find the tunnel */ +diff --git a/net/rds/send.c b/net/rds/send.c +index b1b0022b8370..85734e5a018e 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2006 Oracle. All rights reserved. ++ * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved. + * + * This software is available to you under a choice of one of two + * licenses. You may choose to be licensed under the terms of the GNU +@@ -997,10 +997,15 @@ static int rds_send_mprds_hash(struct rds_sock *rs, struct rds_connection *conn) + if (conn->c_npaths == 0 && hash != 0) { + rds_send_ping(conn, 0); + +- if (conn->c_npaths == 0) { +- wait_event_interruptible(conn->c_hs_waitq, +- (conn->c_npaths != 0)); +- } ++ /* The underlying connection is not up yet. Need to wait ++ * until it is up to be sure that the non-zero c_path can be ++ * used. But if we are interrupted, we have to use the zero ++ * c_path in case the connection ends up being non-MP capable. ++ */ ++ if (conn->c_npaths == 0) ++ if (wait_event_interruptible(conn->c_hs_waitq, ++ conn->c_npaths != 0)) ++ hash = 0; + if (conn->c_npaths == 1) + hash = 0; + } +diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c +index 12649c9fedab..8654494b4d0a 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c ++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c +@@ -237,9 +237,6 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + + ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); + +- err = crypto_ahash_init(req); +- if (err) +- goto out; + err = crypto_ahash_setkey(hmac_md5, cksumkey, kctx->gk5e->keylength); + if (err) + goto out; +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index a9428daa69f3..b28c55447e63 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -1189,9 +1189,7 @@ static int seq_ns_level_show(struct seq_file *seq, void *v) + static int seq_ns_name_show(struct seq_file *seq, void *v) + { + struct aa_label *label = begin_current_label_crit_section(); +- +- seq_printf(seq, "%s\n", aa_ns_name(labels_ns(label), +- labels_ns(label), true)); ++ seq_printf(seq, "%s\n", labels_ns(label)->base.name); + end_current_label_crit_section(label); + + return 0; +diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h +index 4ac095118717..2ebc00a579fd 100644 +--- a/security/apparmor/include/audit.h ++++ b/security/apparmor/include/audit.h +@@ -126,6 +126,10 @@ struct apparmor_audit_data { + const char *target; + kuid_t ouid; + } fs; ++ struct { ++ int rlim; ++ unsigned long max; ++ } rlim; + int signal; + }; + }; +@@ -134,10 +138,6 @@ struct apparmor_audit_data { + const char *ns; + long pos; + } iface; +- struct { +- int rlim; +- unsigned long max; +- } rlim; + struct { + const char *src_name; + const char *type; +diff --git a/security/apparmor/include/sig_names.h b/security/apparmor/include/sig_names.h +index 92e62fe95292..5ca47c50dfa7 100644 +--- a/security/apparmor/include/sig_names.h ++++ b/security/apparmor/include/sig_names.h +@@ -2,6 +2,8 @@ + + #define SIGUNKNOWN 0 + #define MAXMAPPED_SIG 35 ++#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1) ++ + /* provide a mapping of arch signal to internal signal # for mediation + * those that are always an alias SIGCLD for SIGCLHD and SIGPOLL for SIGIO + * map to the same entry those that may/or may not get a separate entry +@@ -56,7 +58,7 @@ static const int sig_map[MAXMAPPED_SIG] = { + }; + + /* this table is ordered post sig_map[sig] mapping */ +-static const char *const sig_names[MAXMAPPED_SIG + 1] = { ++static const char *const sig_names[MAXMAPPED_SIGNAME] = { + "unknown", + "hup", + "int", +diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c +index b40678f3c1d5..586facd35f7c 100644 +--- a/security/apparmor/ipc.c ++++ b/security/apparmor/ipc.c +@@ -174,7 +174,7 @@ static void audit_signal_cb(struct audit_buffer *ab, void *va) + audit_signal_mask(ab, aad(sa)->denied); + } + } +- if (aad(sa)->signal < MAXMAPPED_SIG) ++ if (aad(sa)->signal < MAXMAPPED_SIGNAME) + audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]); + else + audit_log_format(ab, " signal=rtmin+%d", +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index aa1593ce551d..f9157aed1289 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -1378,6 +1378,7 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder) + intel_pt_clear_tx_flags(decoder); + decoder->have_tma = false; + decoder->cbr = 0; ++ decoder->timestamp_insn_cnt = 0; + decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC; + decoder->overflow = true; + return -EOVERFLOW; +@@ -1616,6 +1617,7 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder *decoder) + case INTEL_PT_PWRX: + intel_pt_log("ERROR: Missing TIP after FUP\n"); + decoder->pkt_state = INTEL_PT_STATE_ERR3; ++ decoder->pkt_step = 0; + return -ENOENT; + + case INTEL_PT_OVF: +@@ -2390,14 +2392,6 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) + return &decoder->state; + } + +-static bool intel_pt_at_psb(unsigned char *buf, size_t len) +-{ +- if (len < INTEL_PT_PSB_LEN) +- return false; +- return memmem(buf, INTEL_PT_PSB_LEN, INTEL_PT_PSB_STR, +- INTEL_PT_PSB_LEN); +-} +- + /** + * intel_pt_next_psb - move buffer pointer to the start of the next PSB packet. + * @buf: pointer to buffer pointer +@@ -2486,6 +2480,7 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len) + * @buf: buffer + * @len: size of buffer + * @tsc: TSC value returned ++ * @rem: returns remaining size when TSC is found + * + * Find a TSC packet in @buf and return the TSC value. This function assumes + * that @buf starts at a PSB and that PSB+ will contain TSC and so stops if a +@@ -2493,7 +2488,8 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len) + * + * Return: %true if TSC is found, false otherwise. + */ +-static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc) ++static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc, ++ size_t *rem) + { + struct intel_pt_pkt packet; + int ret; +@@ -2504,6 +2500,7 @@ static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc) + return false; + if (packet.type == INTEL_PT_TSC) { + *tsc = packet.payload; ++ *rem = len; + return true; + } + if (packet.type == INTEL_PT_PSBEND) +@@ -2554,6 +2551,8 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) + * @len_a: size of first buffer + * @buf_b: second buffer + * @len_b: size of second buffer ++ * @consecutive: returns true if there is data in buf_b that is consecutive ++ * to buf_a + * + * If the trace contains TSC we can look at the last TSC of @buf_a and the + * first TSC of @buf_b in order to determine if the buffers overlap, and then +@@ -2566,33 +2565,41 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) + static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + size_t len_a, + unsigned char *buf_b, +- size_t len_b) ++ size_t len_b, bool *consecutive) + { + uint64_t tsc_a, tsc_b; + unsigned char *p; +- size_t len; ++ size_t len, rem_a, rem_b; + + p = intel_pt_last_psb(buf_a, len_a); + if (!p) + return buf_b; /* No PSB in buf_a => no overlap */ + + len = len_a - (p - buf_a); +- if (!intel_pt_next_tsc(p, len, &tsc_a)) { ++ if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a)) { + /* The last PSB+ in buf_a is incomplete, so go back one more */ + len_a -= len; + p = intel_pt_last_psb(buf_a, len_a); + if (!p) + return buf_b; /* No full PSB+ => assume no overlap */ + len = len_a - (p - buf_a); +- if (!intel_pt_next_tsc(p, len, &tsc_a)) ++ if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a)) + return buf_b; /* No TSC in buf_a => assume no overlap */ + } + + while (1) { + /* Ignore PSB+ with no TSC */ +- if (intel_pt_next_tsc(buf_b, len_b, &tsc_b) && +- intel_pt_tsc_cmp(tsc_a, tsc_b) < 0) +- return buf_b; /* tsc_a < tsc_b => no overlap */ ++ if (intel_pt_next_tsc(buf_b, len_b, &tsc_b, &rem_b)) { ++ int cmp = intel_pt_tsc_cmp(tsc_a, tsc_b); ++ ++ /* Same TSC, so buffers are consecutive */ ++ if (!cmp && rem_b >= rem_a) { ++ *consecutive = true; ++ return buf_b + len_b - (rem_b - rem_a); ++ } ++ if (cmp < 0) ++ return buf_b; /* tsc_a < tsc_b => no overlap */ ++ } + + if (!intel_pt_step_psb(&buf_b, &len_b)) + return buf_b + len_b; /* No PSB in buf_b => no data */ +@@ -2606,6 +2613,8 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + * @buf_b: second buffer + * @len_b: size of second buffer + * @have_tsc: can use TSC packets to detect overlap ++ * @consecutive: returns true if there is data in buf_b that is consecutive ++ * to buf_a + * + * When trace samples or snapshots are recorded there is the possibility that + * the data overlaps. Note that, for the purposes of decoding, data is only +@@ -2616,7 +2625,7 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + */ + unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + unsigned char *buf_b, size_t len_b, +- bool have_tsc) ++ bool have_tsc, bool *consecutive) + { + unsigned char *found; + +@@ -2628,7 +2637,8 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + return buf_b; /* No overlap */ + + if (have_tsc) { +- found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b); ++ found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b, ++ consecutive); + if (found) + return found; + } +@@ -2643,28 +2653,16 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + } + + /* Now len_b >= len_a */ +- if (len_b > len_a) { +- /* The leftover buffer 'b' must start at a PSB */ +- while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) { +- if (!intel_pt_step_psb(&buf_a, &len_a)) +- return buf_b; /* No overlap */ +- } +- } +- + while (1) { + /* Potential overlap so check the bytes */ + found = memmem(buf_a, len_a, buf_b, len_a); +- if (found) ++ if (found) { ++ *consecutive = true; + return buf_b + len_a; ++ } + + /* Try again at next PSB in buffer 'a' */ + if (!intel_pt_step_psb(&buf_a, &len_a)) + return buf_b; /* No overlap */ +- +- /* The leftover buffer 'b' must start at a PSB */ +- while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) { +- if (!intel_pt_step_psb(&buf_a, &len_a)) +- return buf_b; /* No overlap */ +- } + } + } +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +index 921b22e8ca0e..fc1752d50019 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +@@ -117,7 +117,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder); + + unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + unsigned char *buf_b, size_t len_b, +- bool have_tsc); ++ bool have_tsc, bool *consecutive); + + int intel_pt__strerror(int code, char *buf, size_t buflen); + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 3773d9c54f45..0979a6e8b2b7 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -143,6 +143,7 @@ struct intel_pt_queue { + bool stop; + bool step_through_buffers; + bool use_buffer_pid_tid; ++ bool sync_switch; + pid_t pid, tid; + int cpu; + int switch_state; +@@ -207,14 +208,17 @@ static void intel_pt_dump_event(struct intel_pt *pt, unsigned char *buf, + static int intel_pt_do_fix_overlap(struct intel_pt *pt, struct auxtrace_buffer *a, + struct auxtrace_buffer *b) + { ++ bool consecutive = false; + void *start; + + start = intel_pt_find_overlap(a->data, a->size, b->data, b->size, +- pt->have_tsc); ++ pt->have_tsc, &consecutive); + if (!start) + return -EINVAL; + b->use_size = b->data + b->size - start; + b->use_data = start; ++ if (b->use_size && consecutive) ++ b->consecutive = true; + return 0; + } + +@@ -960,10 +964,12 @@ static int intel_pt_setup_queue(struct intel_pt *pt, + if (pt->timeless_decoding || !pt->have_sched_switch) + ptq->use_buffer_pid_tid = true; + } ++ ++ ptq->sync_switch = pt->sync_switch; + } + + if (!ptq->on_heap && +- (!pt->sync_switch || ++ (!ptq->sync_switch || + ptq->switch_state != INTEL_PT_SS_EXPECTING_SWITCH_EVENT)) { + const struct intel_pt_state *state; + int ret; +@@ -1546,7 +1552,7 @@ static int intel_pt_sample(struct intel_pt_queue *ptq) + if (pt->synth_opts.last_branch) + intel_pt_update_last_branch_rb(ptq); + +- if (!pt->sync_switch) ++ if (!ptq->sync_switch) + return 0; + + if (intel_pt_is_switch_ip(ptq, state->to_ip)) { +@@ -1627,6 +1633,21 @@ static u64 intel_pt_switch_ip(struct intel_pt *pt, u64 *ptss_ip) + return switch_ip; + } + ++static void intel_pt_enable_sync_switch(struct intel_pt *pt) ++{ ++ unsigned int i; ++ ++ pt->sync_switch = true; ++ ++ for (i = 0; i < pt->queues.nr_queues; i++) { ++ struct auxtrace_queue *queue = &pt->queues.queue_array[i]; ++ struct intel_pt_queue *ptq = queue->priv; ++ ++ if (ptq) ++ ptq->sync_switch = true; ++ } ++} ++ + static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + { + const struct intel_pt_state *state = ptq->state; +@@ -1643,7 +1664,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + if (pt->switch_ip) { + intel_pt_log("switch_ip: %"PRIx64" ptss_ip: %"PRIx64"\n", + pt->switch_ip, pt->ptss_ip); +- pt->sync_switch = true; ++ intel_pt_enable_sync_switch(pt); + } + } + } +@@ -1659,9 +1680,9 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + if (state->err) { + if (state->err == INTEL_PT_ERR_NODATA) + return 1; +- if (pt->sync_switch && ++ if (ptq->sync_switch && + state->from_ip >= pt->kernel_start) { +- pt->sync_switch = false; ++ ptq->sync_switch = false; + intel_pt_next_tid(pt, ptq); + } + if (pt->synth_opts.errors) { +@@ -1687,7 +1708,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + state->timestamp, state->est_timestamp); + ptq->timestamp = state->est_timestamp; + /* Use estimated TSC in unknown switch state */ +- } else if (pt->sync_switch && ++ } else if (ptq->sync_switch && + ptq->switch_state == INTEL_PT_SS_UNKNOWN && + intel_pt_is_switch_ip(ptq, state->to_ip) && + ptq->next_tid == -1) { +@@ -1834,7 +1855,7 @@ static int intel_pt_sync_switch(struct intel_pt *pt, int cpu, pid_t tid, + return 1; + + ptq = intel_pt_cpu_to_ptq(pt, cpu); +- if (!ptq) ++ if (!ptq || !ptq->sync_switch) + return 1; + + switch (ptq->switch_state) {