From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 252B615808B for ; Mon, 28 Mar 2022 10:53:25 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 386ABE091A; Mon, 28 Mar 2022 10:53:24 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 71773E091A for ; Mon, 28 Mar 2022 10:53:23 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 1E6C03412D4 for ; Mon, 28 Mar 2022 10:53:22 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 4634F177 for ; Mon, 28 Mar 2022 10:53:20 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1648464785.19741bd3d3d380bb76ef3a795e876d9af3481ea9.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:5.17 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1000_linux-5.17.1.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 19741bd3d3d380bb76ef3a795e876d9af3481ea9 X-VCS-Branch: 5.17 Date: Mon, 28 Mar 2022 10:53:20 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 9168a217-f3a6-40d3-bc56-0611ab4e213b X-Archives-Hash: 56b49a8cd273443e914c3df5c35b009f commit: 19741bd3d3d380bb76ef3a795e876d9af3481ea9 Author: Mike Pagano gentoo org> AuthorDate: Mon Mar 28 10:53:05 2022 +0000 Commit: Mike Pagano gentoo org> CommitDate: Mon Mar 28 10:53:05 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=19741bd3 Linux patch 5.17.1 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1000_linux-5.17.1.patch | 1721 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1725 insertions(+) diff --git a/0000_README b/0000_README index c012760e..684989ae 100644 --- a/0000_README +++ b/0000_README @@ -43,6 +43,10 @@ EXPERIMENTAL Individual Patch Descriptions: -------------------------------------------------------------------------- +Patch: 1000_linux-5.17.1.patch +From: http://www.kernel.org +Desc: Linux 5.17.1 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1000_linux-5.17.1.patch b/1000_linux-5.17.1.patch new file mode 100644 index 00000000..bfdbbde3 --- /dev/null +++ b/1000_linux-5.17.1.patch @@ -0,0 +1,1721 @@ +diff --git a/Makefile b/Makefile +index 7214f075e1f06..34f9f5a9457af 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 17 +-SUBLEVEL = 0 ++SUBLEVEL = 1 + EXTRAVERSION = + NAME = Superb Owl + +diff --git a/arch/csky/include/asm/uaccess.h b/arch/csky/include/asm/uaccess.h +index c40f06ee8d3ef..ac5a54f57d407 100644 +--- a/arch/csky/include/asm/uaccess.h ++++ b/arch/csky/include/asm/uaccess.h +@@ -3,14 +3,13 @@ + #ifndef __ASM_CSKY_UACCESS_H + #define __ASM_CSKY_UACCESS_H + +-#define user_addr_max() \ +- (uaccess_kernel() ? KERNEL_DS.seg : get_fs().seg) ++#define user_addr_max() (current_thread_info()->addr_limit.seg) + + static inline int __access_ok(unsigned long addr, unsigned long size) + { +- unsigned long limit = current_thread_info()->addr_limit.seg; ++ unsigned long limit = user_addr_max(); + +- return ((addr < limit) && ((addr + size) < limit)); ++ return (size <= limit) && (addr <= (limit - size)); + } + #define __access_ok __access_ok + +diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h +index ef5bfef8d490c..719ba3f3c45cd 100644 +--- a/arch/hexagon/include/asm/uaccess.h ++++ b/arch/hexagon/include/asm/uaccess.h +@@ -25,17 +25,17 @@ + * Returns true (nonzero) if the memory block *may* be valid, false (zero) + * if it is definitely invalid. + * +- * User address space in Hexagon, like x86, goes to 0xbfffffff, so the +- * simple MSB-based tests used by MIPS won't work. Some further +- * optimization is probably possible here, but for now, keep it +- * reasonably simple and not *too* slow. After all, we've got the +- * MMU for backup. + */ ++#define uaccess_kernel() (get_fs().seg == KERNEL_DS.seg) ++#define user_addr_max() (uaccess_kernel() ? ~0UL : TASK_SIZE) + +-#define __access_ok(addr, size) \ +- ((get_fs().seg == KERNEL_DS.seg) || \ +- (((unsigned long)addr < get_fs().seg) && \ +- (unsigned long)size < (get_fs().seg - (unsigned long)addr))) ++static inline int __access_ok(unsigned long addr, unsigned long size) ++{ ++ unsigned long limit = TASK_SIZE; ++ ++ return (size <= limit) && (addr <= (limit - size)); ++} ++#define __access_ok __access_ok + + /* + * When a kernel-mode page fault is taken, the faulting instruction +diff --git a/arch/m68k/include/asm/uaccess.h b/arch/m68k/include/asm/uaccess.h +index ba670523885c8..60b786eb2254e 100644 +--- a/arch/m68k/include/asm/uaccess.h ++++ b/arch/m68k/include/asm/uaccess.h +@@ -12,14 +12,17 @@ + #include + + /* We let the MMU do all checking */ +-static inline int access_ok(const void __user *addr, ++static inline int access_ok(const void __user *ptr, + unsigned long size) + { +- /* +- * XXX: for !CONFIG_CPU_HAS_ADDRESS_SPACES this really needs to check +- * for TASK_SIZE! +- */ +- return 1; ++ unsigned long limit = TASK_SIZE; ++ unsigned long addr = (unsigned long)ptr; ++ ++ if (IS_ENABLED(CONFIG_CPU_HAS_ADDRESS_SPACES) || ++ !IS_ENABLED(CONFIG_MMU)) ++ return 1; ++ ++ return (size <= limit) && (addr <= (limit - size)); + } + + /* +diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h +index d2a8ef9f89787..5b6e0e7788f44 100644 +--- a/arch/microblaze/include/asm/uaccess.h ++++ b/arch/microblaze/include/asm/uaccess.h +@@ -39,24 +39,13 @@ + + # define uaccess_kernel() (get_fs().seg == KERNEL_DS.seg) + +-static inline int access_ok(const void __user *addr, unsigned long size) ++static inline int __access_ok(unsigned long addr, unsigned long size) + { +- if (!size) +- goto ok; ++ unsigned long limit = user_addr_max(); + +- if ((get_fs().seg < ((unsigned long)addr)) || +- (get_fs().seg < ((unsigned long)addr + size - 1))) { +- pr_devel("ACCESS fail at 0x%08x (size 0x%x), seg 0x%08x\n", +- (__force u32)addr, (u32)size, +- (u32)get_fs().seg); +- return 0; +- } +-ok: +- pr_devel("ACCESS OK at 0x%08x (size 0x%x), seg 0x%08x\n", +- (__force u32)addr, (u32)size, +- (u32)get_fs().seg); +- return 1; ++ return (size <= limit) && (addr <= (limit - size)); + } ++#define access_ok(addr, size) __access_ok((unsigned long)addr, size) + + # define __FIXUP_SECTION ".section .fixup,\"ax\"\n" + # define __EX_TABLE_SECTION ".section __ex_table,\"a\"\n" +diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h +index d4cbf069dc224..37a40981deb3b 100644 +--- a/arch/nds32/include/asm/uaccess.h ++++ b/arch/nds32/include/asm/uaccess.h +@@ -70,9 +70,7 @@ static inline void set_fs(mm_segment_t fs) + * versions are void (ie, don't return a value as such). + */ + +-#define get_user __get_user \ +- +-#define __get_user(x, ptr) \ ++#define get_user(x, ptr) \ + ({ \ + long __gu_err = 0; \ + __get_user_check((x), (ptr), __gu_err); \ +@@ -85,6 +83,14 @@ static inline void set_fs(mm_segment_t fs) + (void)0; \ + }) + ++#define __get_user(x, ptr) \ ++({ \ ++ long __gu_err = 0; \ ++ const __typeof__(*(ptr)) __user *__p = (ptr); \ ++ __get_user_err((x), __p, (__gu_err)); \ ++ __gu_err; \ ++}) ++ + #define __get_user_check(x, ptr, err) \ + ({ \ + const __typeof__(*(ptr)) __user *__p = (ptr); \ +@@ -165,12 +171,18 @@ do { \ + : "r"(addr), "i"(-EFAULT) \ + : "cc") + +-#define put_user __put_user \ ++#define put_user(x, ptr) \ ++({ \ ++ long __pu_err = 0; \ ++ __put_user_check((x), (ptr), __pu_err); \ ++ __pu_err; \ ++}) + + #define __put_user(x, ptr) \ + ({ \ + long __pu_err = 0; \ +- __put_user_err((x), (ptr), __pu_err); \ ++ __typeof__(*(ptr)) __user *__p = (ptr); \ ++ __put_user_err((x), __p, __pu_err); \ + __pu_err; \ + }) + +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 5b6d1a95776f0..0d01e7f5078c2 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -1328,6 +1328,17 @@ static int __init disable_acpi_pci(const struct dmi_system_id *d) + return 0; + } + ++static int __init disable_acpi_xsdt(const struct dmi_system_id *d) ++{ ++ if (!acpi_force) { ++ pr_notice("%s detected: force use of acpi=rsdt\n", d->ident); ++ acpi_gbl_do_not_use_xsdt = TRUE; ++ } else { ++ pr_notice("Warning: DMI blacklist says broken, but acpi XSDT forced\n"); ++ } ++ return 0; ++} ++ + static int __init dmi_disable_acpi(const struct dmi_system_id *d) + { + if (!acpi_force) { +@@ -1451,6 +1462,19 @@ static const struct dmi_system_id acpi_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"), + }, + }, ++ /* ++ * Boxes that need ACPI XSDT use disabled due to corrupted tables ++ */ ++ { ++ .callback = disable_acpi_xsdt, ++ .ident = "Advantech DAC-BJ01", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Bearlake CRB Board"), ++ DMI_MATCH(DMI_BIOS_VERSION, "V1.12"), ++ DMI_MATCH(DMI_BIOS_DATE, "02/01/2011"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index ea31ae01458b4..dc208f5f5a1f7 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -59,6 +59,10 @@ MODULE_PARM_DESC(cache_time, "cache time in milliseconds"); + + static const struct acpi_device_id battery_device_ids[] = { + {"PNP0C0A", 0}, ++ ++ /* Microsoft Surface Go 3 */ ++ {"MSHW0146", 0}, ++ + {"", 0}, + }; + +@@ -1148,6 +1152,14 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), + }, + }, ++ { ++ /* Microsoft Surface Go 3 */ ++ .callback = battery_notification_delay_quirk, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"), ++ }, ++ }, + {}, + }; + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 4f64713e9917b..becc198e4c224 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -415,6 +415,81 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "GA503"), + }, + }, ++ /* ++ * Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a ++ * working native and video interface. However the default detection ++ * mechanism first registers the video interface before unregistering ++ * it again and switching to the native interface during boot. This ++ * results in a dangling SBIOS request for backlight change for some ++ * reason, causing the backlight to switch to ~2% once per boot on the ++ * first power cord connect or disconnect event. Setting the native ++ * interface explicitly circumvents this buggy behaviour, by avoiding ++ * the unregistering process. ++ */ ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, + + /* + * Desktops which falsely report a backlight and which our heuristics +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c30d131da7847..19d5686f8a2a1 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -405,6 +405,8 @@ static const struct usb_device_id blacklist_table[] = { + BTUSB_WIDEBAND_SPEECH }, + + /* Realtek 8852AE Bluetooth devices */ ++ { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK | +@@ -482,6 +484,8 @@ static const struct usb_device_id blacklist_table[] = { + /* Additional Realtek 8761BU Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, +@@ -2041,6 +2045,8 @@ static int btusb_setup_csr(struct hci_dev *hdev) + */ + set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); + set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); ++ set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks); ++ set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks); + + /* Clear the reset quirk since this is not an actual + * early Bluetooth 1.1 device from CSR. +@@ -2051,7 +2057,7 @@ static int btusb_setup_csr(struct hci_dev *hdev) + /* + * Special workaround for these BT 4.0 chip clones, and potentially more: + * +- * - 0x0134: a Barrot 8041a02 (HCI rev: 0x1012 sub: 0x0810) ++ * - 0x0134: a Barrot 8041a02 (HCI rev: 0x0810 sub: 0x1012) + * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709) + * + * These controllers are really messed-up. +@@ -2080,7 +2086,7 @@ static int btusb_setup_csr(struct hci_dev *hdev) + if (ret >= 0) + msleep(200); + else +- bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround"); ++ bt_dev_warn(hdev, "CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround"); + + pm_runtime_forbid(&data->udev->dev); + +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index b009e7479b702..783d65fc71f07 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) + kfree(chip); + } + +-static void tpm_devs_release(struct device *dev) +-{ +- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); +- +- /* release the master device reference */ +- put_device(&chip->dev); +-} +- + /** + * tpm_class_shutdown() - prepare the TPM device for loss of power. + * @dev: device to which the chip is associated. +@@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev_num = rc; + + device_initialize(&chip->dev); +- device_initialize(&chip->devs); + + chip->dev.class = tpm_class; + chip->dev.class->shutdown_pre = tpm_class_shutdown; +@@ -352,29 +343,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev.parent = pdev; + chip->dev.groups = chip->groups; + +- chip->devs.parent = pdev; +- chip->devs.class = tpmrm_class; +- chip->devs.release = tpm_devs_release; +- /* get extra reference on main device to hold on +- * behalf of devs. This holds the chip structure +- * while cdevs is in use. The corresponding put +- * is in the tpm_devs_release (TPM2 only) +- */ +- if (chip->flags & TPM_CHIP_FLAG_TPM2) +- get_device(&chip->dev); +- + if (chip->dev_num == 0) + chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); + else + chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); + +- chip->devs.devt = +- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); +- + rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); +- if (rc) +- goto out; +- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out; + +@@ -382,9 +356,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->flags |= TPM_CHIP_FLAG_VIRTUAL; + + cdev_init(&chip->cdev, &tpm_fops); +- cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdev.owner = THIS_MODULE; +- chip->cdevs.owner = THIS_MODULE; + + rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { +@@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + return chip; + + out: +- put_device(&chip->devs); + put_device(&chip->dev); + return ERR_PTR(rc); + } +@@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) + } + + if (chip->flags & TPM_CHIP_FLAG_TPM2 && !tpm_is_firmware_upgrade(chip)) { +- rc = cdev_device_add(&chip->cdevs, &chip->devs); +- if (rc) { +- dev_err(&chip->devs, +- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", +- dev_name(&chip->devs), MAJOR(chip->devs.devt), +- MINOR(chip->devs.devt), rc); +- return rc; +- } ++ rc = tpm_devs_add(chip); ++ if (rc) ++ goto err_del_cdev; + } + + /* Make the chip available. */ +@@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) + idr_replace(&dev_nums_idr, chip, chip->dev_num); + mutex_unlock(&idr_lock); + ++ return 0; ++ ++err_del_cdev: ++ cdev_device_del(&chip->cdev, &chip->dev); + return rc; + } + +@@ -654,7 +624,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) + hwrng_unregister(&chip->hwrng); + tpm_bios_log_teardown(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2 && !tpm_is_firmware_upgrade(chip)) +- cdev_device_del(&chip->cdevs, &chip->devs); ++ tpm_devs_remove(chip); + tpm_del_char_device(chip); + } + EXPORT_SYMBOL_GPL(tpm_chip_unregister); +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index c08cbb306636b..dc4c0a0a51290 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -69,7 +69,13 @@ static void tpm_dev_async_work(struct work_struct *work) + ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, + sizeof(priv->data_buffer)); + tpm_put_ops(priv->chip); +- if (ret > 0) { ++ ++ /* ++ * If ret is > 0 then tpm_dev_transmit returned the size of the ++ * response. If ret is < 0 then tpm_dev_transmit failed and ++ * returned an error code. ++ */ ++ if (ret != 0) { + priv->response_length = ret; + mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); + } +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 283f78211c3a7..2163c6ee0d364 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -234,6 +234,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, + size_t cmdsiz); + int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, + size_t *bufsiz); ++int tpm_devs_add(struct tpm_chip *chip); ++void tpm_devs_remove(struct tpm_chip *chip); + + void tpm_bios_log_setup(struct tpm_chip *chip); + void tpm_bios_log_teardown(struct tpm_chip *chip); +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 97e916856cf3e..ffb35f0154c16 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -58,12 +58,12 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) + + void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) + { +- mutex_lock(&chip->tpm_mutex); +- if (!tpm_chip_start(chip)) { ++ ++ if (tpm_try_get_ops(chip) == 0) { + tpm2_flush_sessions(chip, space); +- tpm_chip_stop(chip); ++ tpm_put_ops(chip); + } +- mutex_unlock(&chip->tpm_mutex); ++ + kfree(space->context_buf); + kfree(space->session_buf); + } +@@ -574,3 +574,68 @@ out: + dev_err(&chip->dev, "%s: error %d\n", __func__, rc); + return rc; + } ++ ++/* ++ * Put the reference to the main device. ++ */ ++static void tpm_devs_release(struct device *dev) ++{ ++ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); ++ ++ /* release the master device reference */ ++ put_device(&chip->dev); ++} ++ ++/* ++ * Remove the device file for exposed TPM spaces and release the device ++ * reference. This may also release the reference to the master device. ++ */ ++void tpm_devs_remove(struct tpm_chip *chip) ++{ ++ cdev_device_del(&chip->cdevs, &chip->devs); ++ put_device(&chip->devs); ++} ++ ++/* ++ * Add a device file to expose TPM spaces. Also take a reference to the ++ * main device. ++ */ ++int tpm_devs_add(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ device_initialize(&chip->devs); ++ chip->devs.parent = chip->dev.parent; ++ chip->devs.class = tpmrm_class; ++ ++ /* ++ * Get extra reference on main device to hold on behalf of devs. ++ * This holds the chip structure while cdevs is in use. The ++ * corresponding put is in the tpm_devs_release. ++ */ ++ get_device(&chip->dev); ++ chip->devs.release = tpm_devs_release; ++ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); ++ cdev_init(&chip->cdevs, &tpmrm_fops); ++ chip->cdevs.owner = THIS_MODULE; ++ ++ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); ++ if (rc) ++ goto err_put_devs; ++ ++ rc = cdev_device_add(&chip->cdevs, &chip->devs); ++ if (rc) { ++ dev_err(&chip->devs, ++ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", ++ dev_name(&chip->devs), MAJOR(chip->devs.devt), ++ MINOR(chip->devs.devt), rc); ++ goto err_put_devs; ++ } ++ ++ return 0; ++ ++err_put_devs: ++ put_device(&chip->devs); ++ ++ return rc; ++} +diff --git a/drivers/crypto/qat/qat_4xxx/adf_drv.c b/drivers/crypto/qat/qat_4xxx/adf_drv.c +index a6c78b9c730bc..fa4c350c1bf92 100644 +--- a/drivers/crypto/qat/qat_4xxx/adf_drv.c ++++ b/drivers/crypto/qat/qat_4xxx/adf_drv.c +@@ -75,6 +75,13 @@ static int adf_crypto_dev_config(struct adf_accel_dev *accel_dev) + if (ret) + goto err; + ++ /* Temporarily set the number of crypto instances to zero to avoid ++ * registering the crypto algorithms. ++ * This will be removed when the algorithms will support the ++ * CRYPTO_TFM_REQ_MAY_BACKLOG flag ++ */ ++ instances = 0; ++ + for (i = 0; i < instances; i++) { + val = i; + bank = i * 2; +diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c +index 7234c4940fae4..67c9588e89df9 100644 +--- a/drivers/crypto/qat/qat_common/qat_crypto.c ++++ b/drivers/crypto/qat/qat_common/qat_crypto.c +@@ -161,6 +161,13 @@ int qat_crypto_dev_config(struct adf_accel_dev *accel_dev) + if (ret) + goto err; + ++ /* Temporarily set the number of crypto instances to zero to avoid ++ * registering the crypto algorithms. ++ * This will be removed when the algorithms will support the ++ * CRYPTO_TFM_REQ_MAY_BACKLOG flag ++ */ ++ instances = 0; ++ + for (i = 0; i < instances; i++) { + val = i; + snprintf(key, sizeof(key), ADF_CY "%d" ADF_RING_ASYM_BANK_NUM, i); +diff --git a/drivers/gpu/drm/msm/msm_gpu_devfreq.c b/drivers/gpu/drm/msm/msm_gpu_devfreq.c +index 9bf319be11f60..12641616acd30 100644 +--- a/drivers/gpu/drm/msm/msm_gpu_devfreq.c ++++ b/drivers/gpu/drm/msm/msm_gpu_devfreq.c +@@ -83,6 +83,12 @@ static struct devfreq_dev_profile msm_devfreq_profile = { + static void msm_devfreq_boost_work(struct kthread_work *work); + static void msm_devfreq_idle_work(struct kthread_work *work); + ++static bool has_devfreq(struct msm_gpu *gpu) ++{ ++ struct msm_gpu_devfreq *df = &gpu->devfreq; ++ return !!df->devfreq; ++} ++ + void msm_devfreq_init(struct msm_gpu *gpu) + { + struct msm_gpu_devfreq *df = &gpu->devfreq; +@@ -149,6 +155,9 @@ void msm_devfreq_cleanup(struct msm_gpu *gpu) + { + struct msm_gpu_devfreq *df = &gpu->devfreq; + ++ if (!has_devfreq(gpu)) ++ return; ++ + devfreq_cooling_unregister(gpu->cooling); + dev_pm_qos_remove_request(&df->boost_freq); + dev_pm_qos_remove_request(&df->idle_freq); +@@ -156,16 +165,24 @@ void msm_devfreq_cleanup(struct msm_gpu *gpu) + + void msm_devfreq_resume(struct msm_gpu *gpu) + { +- gpu->devfreq.busy_cycles = 0; +- gpu->devfreq.time = ktime_get(); ++ struct msm_gpu_devfreq *df = &gpu->devfreq; + +- devfreq_resume_device(gpu->devfreq.devfreq); ++ if (!has_devfreq(gpu)) ++ return; ++ ++ df->busy_cycles = 0; ++ df->time = ktime_get(); ++ ++ devfreq_resume_device(df->devfreq); + } + + void msm_devfreq_suspend(struct msm_gpu *gpu) + { + struct msm_gpu_devfreq *df = &gpu->devfreq; + ++ if (!has_devfreq(gpu)) ++ return; ++ + devfreq_suspend_device(df->devfreq); + + cancel_idle_work(df); +@@ -185,6 +202,9 @@ void msm_devfreq_boost(struct msm_gpu *gpu, unsigned factor) + struct msm_gpu_devfreq *df = &gpu->devfreq; + uint64_t freq; + ++ if (!has_devfreq(gpu)) ++ return; ++ + freq = get_freq(gpu); + freq *= factor; + +@@ -207,7 +227,7 @@ void msm_devfreq_active(struct msm_gpu *gpu) + struct devfreq_dev_status status; + unsigned int idle_time; + +- if (!df->devfreq) ++ if (!has_devfreq(gpu)) + return; + + /* +@@ -253,7 +273,7 @@ void msm_devfreq_idle(struct msm_gpu *gpu) + { + struct msm_gpu_devfreq *df = &gpu->devfreq; + +- if (!df->devfreq) ++ if (!has_devfreq(gpu)) + return; + + msm_hrtimer_queue_work(&df->idle_work, ms_to_ktime(1), +diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c +index 2de61b63ef91d..48d3c9955f0dd 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_gem.c ++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c +@@ -248,6 +248,9 @@ void virtio_gpu_array_put_free(struct virtio_gpu_object_array *objs) + { + u32 i; + ++ if (!objs) ++ return; ++ + for (i = 0; i < objs->nents; i++) + drm_gem_object_put(objs->objs[i]); + virtio_gpu_array_free(objs); +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +index ff2d099aab218..53dc8d5fede86 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -696,6 +696,12 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + buf_pool->rx_skb[skb_index] = NULL; + + datalen = xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1)); ++ ++ /* strip off CRC as HW isn't doing this */ ++ nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); ++ if (!nv) ++ datalen -= 4; ++ + skb_put(skb, datalen); + prefetch(skb->data - NET_IP_ALIGN); + skb->protocol = eth_type_trans(skb, ndev); +@@ -717,12 +723,8 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + } + } + +- nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); +- if (!nv) { +- /* strip off CRC as HW isn't doing this */ +- datalen -= 4; ++ if (!nv) + goto skip_jumbo; +- } + + slots = page_pool->slots - 1; + head = page_pool->head; +diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c +index b2400e2417a55..f15e7bd690b5b 100644 +--- a/drivers/net/wireless/ath/regd.c ++++ b/drivers/net/wireless/ath/regd.c +@@ -667,14 +667,14 @@ ath_regd_init_wiphy(struct ath_regulatory *reg, + + /* + * Some users have reported their EEPROM programmed with +- * 0x8000 or 0x0 set, this is not a supported regulatory +- * domain but since we have more than one user with it we +- * need a solution for them. We default to 0x64, which is +- * the default Atheros world regulatory domain. ++ * 0x8000 set, this is not a supported regulatory domain ++ * but since we have more than one user with it we need ++ * a solution for them. We default to 0x64, which is the ++ * default Atheros world regulatory domain. + */ + static void ath_regd_sanitize(struct ath_regulatory *reg) + { +- if (reg->current_rd != COUNTRY_ERD_FLAG && reg->current_rd != 0) ++ if (reg->current_rd != COUNTRY_ERD_FLAG) + return; + printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n"); + reg->current_rd = 0x64; +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 9575d7373bf27..ac2813ed851c4 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -1513,6 +1513,9 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn, + if (iris_node) { + if (of_device_is_compatible(iris_node, "qcom,wcn3620")) + wcn->rf_id = RF_IRIS_WCN3620; ++ if (of_device_is_compatible(iris_node, "qcom,wcn3660") || ++ of_device_is_compatible(iris_node, "qcom,wcn3660b")) ++ wcn->rf_id = RF_IRIS_WCN3660; + if (of_device_is_compatible(iris_node, "qcom,wcn3680")) + wcn->rf_id = RF_IRIS_WCN3680; + of_node_put(iris_node); +diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h +index fbd0558c2c196..5d3f8f56e5681 100644 +--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h ++++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h +@@ -97,6 +97,7 @@ enum wcn36xx_ampdu_state { + + #define RF_UNKNOWN 0x0000 + #define RF_IRIS_WCN3620 0x3620 ++#define RF_IRIS_WCN3660 0x3660 + #define RF_IRIS_WCN3680 0x3680 + + static inline void buff_to_be(u32 *buf, size_t len) +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 8e2f8275a2535..259e00046a8bd 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -842,27 +842,38 @@ EXPORT_SYMBOL(jbd2_journal_restart); + */ + void jbd2_journal_wait_updates(journal_t *journal) + { +- transaction_t *commit_transaction = journal->j_running_transaction; ++ DEFINE_WAIT(wait); + +- if (!commit_transaction) +- return; ++ while (1) { ++ /* ++ * Note that the running transaction can get freed under us if ++ * this transaction is getting committed in ++ * jbd2_journal_commit_transaction() -> ++ * jbd2_journal_free_transaction(). This can only happen when we ++ * release j_state_lock -> schedule() -> acquire j_state_lock. ++ * Hence we should everytime retrieve new j_running_transaction ++ * value (after j_state_lock release acquire cycle), else it may ++ * lead to use-after-free of old freed transaction. ++ */ ++ transaction_t *transaction = journal->j_running_transaction; + +- spin_lock(&commit_transaction->t_handle_lock); +- while (atomic_read(&commit_transaction->t_updates)) { +- DEFINE_WAIT(wait); ++ if (!transaction) ++ break; + ++ spin_lock(&transaction->t_handle_lock); + prepare_to_wait(&journal->j_wait_updates, &wait, +- TASK_UNINTERRUPTIBLE); +- if (atomic_read(&commit_transaction->t_updates)) { +- spin_unlock(&commit_transaction->t_handle_lock); +- write_unlock(&journal->j_state_lock); +- schedule(); +- write_lock(&journal->j_state_lock); +- spin_lock(&commit_transaction->t_handle_lock); ++ TASK_UNINTERRUPTIBLE); ++ if (!atomic_read(&transaction->t_updates)) { ++ spin_unlock(&transaction->t_handle_lock); ++ finish_wait(&journal->j_wait_updates, &wait); ++ break; + } ++ spin_unlock(&transaction->t_handle_lock); ++ write_unlock(&journal->j_state_lock); ++ schedule(); + finish_wait(&journal->j_wait_updates, &wait); ++ write_lock(&journal->j_state_lock); + } +- spin_unlock(&commit_transaction->t_handle_lock); + } + + /** +@@ -877,8 +888,6 @@ void jbd2_journal_wait_updates(journal_t *journal) + */ + void jbd2_journal_lock_updates(journal_t *journal) + { +- DEFINE_WAIT(wait); +- + jbd2_might_wait_for_commit(journal); + + write_lock(&journal->j_state_lock); +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 35c073d44ec5a..5cb095b09a940 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -255,6 +255,16 @@ enum { + * during the hdev->setup vendor callback. + */ + HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, ++ ++ /* When this quirk is set, HCI_OP_SET_EVENT_FLT requests with ++ * HCI_FLT_CLEAR_ALL are ignored and event filtering is ++ * completely avoided. A subset of the CSR controller ++ * clones struggle with this and instantly lock up. ++ * ++ * Note that devices using this must (separately) disable ++ * runtime suspend, because event filtering takes place there. ++ */ ++ HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, + }; + + /* HCI device flags */ +diff --git a/include/sound/pcm.h b/include/sound/pcm.h +index 36da42cd07748..314f2779cab52 100644 +--- a/include/sound/pcm.h ++++ b/include/sound/pcm.h +@@ -401,6 +401,7 @@ struct snd_pcm_runtime { + wait_queue_head_t tsleep; /* transfer sleep */ + struct fasync_struct *fasync; + bool stop_operating; /* sync_stop will be called */ ++ struct mutex buffer_mutex; /* protect for buffer changes */ + + /* -- private section -- */ + void *private_data; +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index c5b45c2f68a15..5678bee7aefee 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -556,16 +556,16 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags) + raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + } + +- /* Unboost if we were boosted. */ +- if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) +- rt_mutex_futex_unlock(&rnp->boost_mtx.rtmutex); +- + /* + * If this was the last task on the expedited lists, + * then we need to report up the rcu_node hierarchy. + */ + if (!empty_exp && empty_exp_now) + rcu_report_exp_rnp(rnp, true); ++ ++ /* Unboost if we were boosted. */ ++ if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) ++ rt_mutex_futex_unlock(&rnp->boost_mtx.rtmutex); + } else { + local_irq_restore(flags); + } +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index ab9aa700b6b33..5e93f37c2e04d 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -2806,6 +2806,9 @@ static int hci_set_event_filter_sync(struct hci_dev *hdev, u8 flt_type, + if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) + return 0; + ++ if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) ++ return 0; ++ + memset(&cp, 0, sizeof(cp)); + cp.flt_type = flt_type; + +@@ -2826,6 +2829,13 @@ static int hci_clear_event_filter_sync(struct hci_dev *hdev) + if (!hci_dev_test_flag(hdev, HCI_EVENT_FILTER_CONFIGURED)) + return 0; + ++ /* In theory the state machine should not reach here unless ++ * a hci_set_event_filter_sync() call succeeds, but we do ++ * the check both for parity and as a future reminder. ++ */ ++ if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) ++ return 0; ++ + return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00, + BDADDR_ANY, 0x00); + } +@@ -4825,6 +4835,12 @@ static int hci_update_event_filter_sync(struct hci_dev *hdev) + if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) + return 0; + ++ /* Some fake CSR controllers lock up after setting this type of ++ * filter, so avoid sending the request altogether. ++ */ ++ if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) ++ return 0; ++ + /* Always clear event filter when starting */ + hci_clear_event_filter_sync(hdev); + +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 26c00ebf4fbae..7f555d2e5357f 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -275,6 +275,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + { + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); ++ struct net_device *dev = NULL; + struct llc_sap *sap; + int rc = -EINVAL; + +@@ -286,16 +287,15 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + goto out; + rc = -ENODEV; + if (sk->sk_bound_dev_if) { +- llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); +- if (llc->dev && addr->sllc_arphrd != llc->dev->type) { +- dev_put(llc->dev); +- llc->dev = NULL; ++ dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); ++ if (dev && addr->sllc_arphrd != dev->type) { ++ dev_put(dev); ++ dev = NULL; + } + } else +- llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); +- if (!llc->dev) ++ dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); ++ if (!dev) + goto out; +- netdev_tracker_alloc(llc->dev, &llc->dev_tracker, GFP_KERNEL); + rc = -EUSERS; + llc->laddr.lsap = llc_ui_autoport(); + if (!llc->laddr.lsap) +@@ -304,6 +304,12 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + sap = llc_sap_open(llc->laddr.lsap, NULL); + if (!sap) + goto out; ++ ++ /* Note: We do not expect errors from this point. */ ++ llc->dev = dev; ++ netdev_tracker_alloc(llc->dev, &llc->dev_tracker, GFP_KERNEL); ++ dev = NULL; ++ + memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN); + memcpy(&llc->addr, addr, sizeof(llc->addr)); + /* assign new connection to its SAP */ +@@ -311,6 +317,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + sock_reset_flag(sk, SOCK_ZAPPED); + rc = 0; + out: ++ dev_put(dev); + return rc; + } + +@@ -333,6 +340,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr; + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); ++ struct net_device *dev = NULL; + struct llc_sap *sap; + int rc = -EINVAL; + +@@ -348,25 +356,27 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + rc = -ENODEV; + rcu_read_lock(); + if (sk->sk_bound_dev_if) { +- llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); +- if (llc->dev) { ++ dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); ++ if (dev) { + if (is_zero_ether_addr(addr->sllc_mac)) +- memcpy(addr->sllc_mac, llc->dev->dev_addr, ++ memcpy(addr->sllc_mac, dev->dev_addr, + IFHWADDRLEN); +- if (addr->sllc_arphrd != llc->dev->type || ++ if (addr->sllc_arphrd != dev->type || + !ether_addr_equal(addr->sllc_mac, +- llc->dev->dev_addr)) { ++ dev->dev_addr)) { + rc = -EINVAL; +- llc->dev = NULL; ++ dev = NULL; + } + } +- } else +- llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, ++ } else { ++ dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, + addr->sllc_mac); +- dev_hold_track(llc->dev, &llc->dev_tracker, GFP_ATOMIC); ++ } ++ dev_hold(dev); + rcu_read_unlock(); +- if (!llc->dev) ++ if (!dev) + goto out; ++ + if (!addr->sllc_sap) { + rc = -EUSERS; + addr->sllc_sap = llc_ui_autoport(); +@@ -398,6 +408,12 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + goto out_put; + } + } ++ ++ /* Note: We do not expect errors from this point. */ ++ llc->dev = dev; ++ netdev_tracker_alloc(llc->dev, &llc->dev_tracker, GFP_KERNEL); ++ dev = NULL; ++ + llc->laddr.lsap = addr->sllc_sap; + memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN); + memcpy(&llc->addr, addr, sizeof(llc->addr)); +@@ -408,6 +424,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + out_put: + llc_sap_put(sap); + out: ++ dev_put(dev); + release_sock(sk); + return rc; + } +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 87a208089caf7..58ff57dc669c4 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2148,14 +2148,12 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, + const struct mesh_setup *setup) + { + u8 *new_ie; +- const u8 *old_ie; + struct ieee80211_sub_if_data *sdata = container_of(ifmsh, + struct ieee80211_sub_if_data, u.mesh); + int i; + + /* allocate information elements */ + new_ie = NULL; +- old_ie = ifmsh->ie; + + if (setup->ie_len) { + new_ie = kmemdup(setup->ie, setup->ie_len, +@@ -2165,7 +2163,6 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, + } + ifmsh->ie_len = setup->ie_len; + ifmsh->ie = new_ie; +- kfree(old_ie); + + /* now copy the rest of the setup parameters */ + ifmsh->mesh_id_len = setup->mesh_id_len; +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index d71a33ae39b35..1f5a0eece0d14 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -9275,17 +9275,23 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) + } + EXPORT_SYMBOL_GPL(nft_parse_u32_check); + +-static unsigned int nft_parse_register(const struct nlattr *attr) ++static unsigned int nft_parse_register(const struct nlattr *attr, u32 *preg) + { + unsigned int reg; + + reg = ntohl(nla_get_be32(attr)); + switch (reg) { + case NFT_REG_VERDICT...NFT_REG_4: +- return reg * NFT_REG_SIZE / NFT_REG32_SIZE; ++ *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; ++ break; ++ case NFT_REG32_00...NFT_REG32_15: ++ *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; ++ break; + default: +- return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; ++ return -ERANGE; + } ++ ++ return 0; + } + + /** +@@ -9327,7 +9333,10 @@ int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) + u32 reg; + int err; + +- reg = nft_parse_register(attr); ++ err = nft_parse_register(attr, ®); ++ if (err < 0) ++ return err; ++ + err = nft_validate_register_load(reg, len); + if (err < 0) + return err; +@@ -9382,7 +9391,10 @@ int nft_parse_register_store(const struct nft_ctx *ctx, + int err; + u32 reg; + +- reg = nft_parse_register(attr); ++ err = nft_parse_register(attr, ®); ++ if (err < 0) ++ return err; ++ + err = nft_validate_register_store(ctx, reg, data, type, len); + if (err < 0) + return err; +diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c +index 36e73f9828c50..8af98239655db 100644 +--- a/net/netfilter/nf_tables_core.c ++++ b/net/netfilter/nf_tables_core.c +@@ -201,7 +201,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) + const struct nft_rule_dp *rule, *last_rule; + const struct net *net = nft_net(pkt); + const struct nft_expr *expr, *last; +- struct nft_regs regs; ++ struct nft_regs regs = {}; + unsigned int stackptr = 0; + struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE]; + bool genbit = READ_ONCE(net->nft.gencursor); +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 3ee9edf858156..f158f0abd25d8 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -774,6 +774,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, + + if (oss_period_size < 16) + return -EINVAL; ++ ++ /* don't allocate too large period; 1MB period must be enough */ ++ if (oss_period_size > 1024 * 1024) ++ return -ENOMEM; ++ + runtime->oss.period_bytes = oss_period_size; + runtime->oss.period_frames = 1; + runtime->oss.periods = oss_periods; +@@ -1043,10 +1048,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + goto failure; + } + #endif +- oss_period_size *= oss_frame_size; +- +- oss_buffer_size = oss_period_size * runtime->oss.periods; +- if (oss_buffer_size < 0) { ++ oss_period_size = array_size(oss_period_size, oss_frame_size); ++ oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); ++ if (oss_buffer_size <= 0) { + err = -EINVAL; + goto failure; + } +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index 061ba06bc9262..82e180c776ae1 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -62,7 +62,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t + width = snd_pcm_format_physical_width(format->format); + if (width < 0) + return width; +- size = frames * format->channels * width; ++ size = array3_size(frames, format->channels, width); ++ /* check for too large period size once again */ ++ if (size > 1024 * 1024) ++ return -ENOMEM; + if (snd_BUG_ON(size % 8)) + return -ENXIO; + size /= 8; +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index ba4a987ed1c62..edd9849210f2d 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -969,6 +969,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, + init_waitqueue_head(&runtime->tsleep); + + runtime->status->state = SNDRV_PCM_STATE_OPEN; ++ mutex_init(&runtime->buffer_mutex); + + substream->runtime = runtime; + substream->private_data = pcm->private_data; +@@ -1002,6 +1003,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream) + } else { + substream->runtime = NULL; + } ++ mutex_destroy(&runtime->buffer_mutex); + kfree(runtime); + put_pid(substream->pid); + substream->pid = NULL; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index f2090025236b9..a40a35e51fad7 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1906,9 +1906,11 @@ static int wait_for_avail(struct snd_pcm_substream *substream, + if (avail >= runtime->twake) + break; + snd_pcm_stream_unlock_irq(substream); ++ mutex_unlock(&runtime->buffer_mutex); + + tout = schedule_timeout(wait_time); + ++ mutex_lock(&runtime->buffer_mutex); + snd_pcm_stream_lock_irq(substream); + set_current_state(TASK_INTERRUPTIBLE); + switch (runtime->status->state) { +@@ -2219,6 +2221,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream, + + nonblock = !!(substream->f_flags & O_NONBLOCK); + ++ mutex_lock(&runtime->buffer_mutex); + snd_pcm_stream_lock_irq(substream); + err = pcm_accessible_state(runtime); + if (err < 0) +@@ -2310,6 +2313,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream, + if (xfer > 0 && err >= 0) + snd_pcm_update_state(substream, runtime); + snd_pcm_stream_unlock_irq(substream); ++ mutex_unlock(&runtime->buffer_mutex); + return xfer > 0 ? (snd_pcm_sframes_t)xfer : err; + } + EXPORT_SYMBOL(__snd_pcm_lib_xfer); +diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c +index b70ce3b69ab4d..8848d2f3160d8 100644 +--- a/sound/core/pcm_memory.c ++++ b/sound/core/pcm_memory.c +@@ -163,19 +163,20 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, + size_t size; + struct snd_dma_buffer new_dmab; + ++ mutex_lock(&substream->pcm->open_mutex); + if (substream->runtime) { + buffer->error = -EBUSY; +- return; ++ goto unlock; + } + if (!snd_info_get_line(buffer, line, sizeof(line))) { + snd_info_get_str(str, line, sizeof(str)); + size = simple_strtoul(str, NULL, 10) * 1024; + if ((size != 0 && size < 8192) || size > substream->dma_max) { + buffer->error = -EINVAL; +- return; ++ goto unlock; + } + if (substream->dma_buffer.bytes == size) +- return; ++ goto unlock; + memset(&new_dmab, 0, sizeof(new_dmab)); + new_dmab.dev = substream->dma_buffer.dev; + if (size > 0) { +@@ -189,7 +190,7 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, + substream->pcm->card->number, substream->pcm->device, + substream->stream ? 'c' : 'p', substream->number, + substream->pcm->name, size); +- return; ++ goto unlock; + } + substream->buffer_bytes_max = size; + } else { +@@ -201,6 +202,8 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, + } else { + buffer->error = -EINVAL; + } ++ unlock: ++ mutex_unlock(&substream->pcm->open_mutex); + } + + static inline void preallocate_info_init(struct snd_pcm_substream *substream) +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index a056b3ef3c843..704fdc9ebf911 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -685,33 +685,40 @@ static int snd_pcm_hw_params_choose(struct snd_pcm_substream *pcm, + return 0; + } + ++#if IS_ENABLED(CONFIG_SND_PCM_OSS) ++#define is_oss_stream(substream) ((substream)->oss.oss) ++#else ++#define is_oss_stream(substream) false ++#endif ++ + static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params) + { + struct snd_pcm_runtime *runtime; +- int err, usecs; ++ int err = 0, usecs; + unsigned int bits; + snd_pcm_uframes_t frames; + + if (PCM_RUNTIME_CHECK(substream)) + return -ENXIO; + runtime = substream->runtime; ++ mutex_lock(&runtime->buffer_mutex); + snd_pcm_stream_lock_irq(substream); + switch (runtime->status->state) { + case SNDRV_PCM_STATE_OPEN: + case SNDRV_PCM_STATE_SETUP: + case SNDRV_PCM_STATE_PREPARED: ++ if (!is_oss_stream(substream) && ++ atomic_read(&substream->mmap_count)) ++ err = -EBADFD; + break; + default: +- snd_pcm_stream_unlock_irq(substream); +- return -EBADFD; ++ err = -EBADFD; ++ break; + } + snd_pcm_stream_unlock_irq(substream); +-#if IS_ENABLED(CONFIG_SND_PCM_OSS) +- if (!substream->oss.oss) +-#endif +- if (atomic_read(&substream->mmap_count)) +- return -EBADFD; ++ if (err) ++ goto unlock; + + snd_pcm_sync_stop(substream, true); + +@@ -799,16 +806,21 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + if (usecs >= 0) + cpu_latency_qos_add_request(&substream->latency_pm_qos_req, + usecs); +- return 0; ++ err = 0; + _error: +- /* hardware might be unusable from this time, +- so we force application to retry to set +- the correct hardware parameter settings */ +- snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); +- if (substream->ops->hw_free != NULL) +- substream->ops->hw_free(substream); +- if (substream->managed_buffer_alloc) +- snd_pcm_lib_free_pages(substream); ++ if (err) { ++ /* hardware might be unusable from this time, ++ * so we force application to retry to set ++ * the correct hardware parameter settings ++ */ ++ snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); ++ if (substream->ops->hw_free != NULL) ++ substream->ops->hw_free(substream); ++ if (substream->managed_buffer_alloc) ++ snd_pcm_lib_free_pages(substream); ++ } ++ unlock: ++ mutex_unlock(&runtime->buffer_mutex); + return err; + } + +@@ -848,26 +860,31 @@ static int do_hw_free(struct snd_pcm_substream *substream) + static int snd_pcm_hw_free(struct snd_pcm_substream *substream) + { + struct snd_pcm_runtime *runtime; +- int result; ++ int result = 0; + + if (PCM_RUNTIME_CHECK(substream)) + return -ENXIO; + runtime = substream->runtime; ++ mutex_lock(&runtime->buffer_mutex); + snd_pcm_stream_lock_irq(substream); + switch (runtime->status->state) { + case SNDRV_PCM_STATE_SETUP: + case SNDRV_PCM_STATE_PREPARED: ++ if (atomic_read(&substream->mmap_count)) ++ result = -EBADFD; + break; + default: +- snd_pcm_stream_unlock_irq(substream); +- return -EBADFD; ++ result = -EBADFD; ++ break; + } + snd_pcm_stream_unlock_irq(substream); +- if (atomic_read(&substream->mmap_count)) +- return -EBADFD; ++ if (result) ++ goto unlock; + result = do_hw_free(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); + cpu_latency_qos_remove_request(&substream->latency_pm_qos_req); ++ unlock: ++ mutex_unlock(&runtime->buffer_mutex); + return result; + } + +@@ -1173,15 +1190,17 @@ struct action_ops { + static int snd_pcm_action_group(const struct action_ops *ops, + struct snd_pcm_substream *substream, + snd_pcm_state_t state, +- bool do_lock) ++ bool stream_lock) + { + struct snd_pcm_substream *s = NULL; + struct snd_pcm_substream *s1; + int res = 0, depth = 1; + + snd_pcm_group_for_each_entry(s, substream) { +- if (do_lock && s != substream) { +- if (s->pcm->nonatomic) ++ if (s != substream) { ++ if (!stream_lock) ++ mutex_lock_nested(&s->runtime->buffer_mutex, depth); ++ else if (s->pcm->nonatomic) + mutex_lock_nested(&s->self_group.mutex, depth); + else + spin_lock_nested(&s->self_group.lock, depth); +@@ -1209,18 +1228,18 @@ static int snd_pcm_action_group(const struct action_ops *ops, + ops->post_action(s, state); + } + _unlock: +- if (do_lock) { +- /* unlock streams */ +- snd_pcm_group_for_each_entry(s1, substream) { +- if (s1 != substream) { +- if (s1->pcm->nonatomic) +- mutex_unlock(&s1->self_group.mutex); +- else +- spin_unlock(&s1->self_group.lock); +- } +- if (s1 == s) /* end */ +- break; ++ /* unlock streams */ ++ snd_pcm_group_for_each_entry(s1, substream) { ++ if (s1 != substream) { ++ if (!stream_lock) ++ mutex_unlock(&s1->runtime->buffer_mutex); ++ else if (s1->pcm->nonatomic) ++ mutex_unlock(&s1->self_group.mutex); ++ else ++ spin_unlock(&s1->self_group.lock); + } ++ if (s1 == s) /* end */ ++ break; + } + return res; + } +@@ -1350,10 +1369,12 @@ static int snd_pcm_action_nonatomic(const struct action_ops *ops, + + /* Guarantee the group members won't change during non-atomic action */ + down_read(&snd_pcm_link_rwsem); ++ mutex_lock(&substream->runtime->buffer_mutex); + if (snd_pcm_stream_linked(substream)) + res = snd_pcm_action_group(ops, substream, state, false); + else + res = snd_pcm_action_single(ops, substream, state); ++ mutex_unlock(&substream->runtime->buffer_mutex); + up_read(&snd_pcm_link_rwsem); + return res; + } +@@ -1843,11 +1864,13 @@ static int snd_pcm_do_reset(struct snd_pcm_substream *substream, + int err = snd_pcm_ops_ioctl(substream, SNDRV_PCM_IOCTL1_RESET, NULL); + if (err < 0) + return err; ++ snd_pcm_stream_lock_irq(substream); + runtime->hw_ptr_base = 0; + runtime->hw_ptr_interrupt = runtime->status->hw_ptr - + runtime->status->hw_ptr % runtime->period_size; + runtime->silence_start = runtime->status->hw_ptr; + runtime->silence_filled = 0; ++ snd_pcm_stream_unlock_irq(substream); + return 0; + } + +@@ -1855,10 +1878,12 @@ static void snd_pcm_post_reset(struct snd_pcm_substream *substream, + snd_pcm_state_t state) + { + struct snd_pcm_runtime *runtime = substream->runtime; ++ snd_pcm_stream_lock_irq(substream); + runtime->control->appl_ptr = runtime->status->hw_ptr; + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && + runtime->silence_size > 0) + snd_pcm_playback_silence(substream, ULONG_MAX); ++ snd_pcm_stream_unlock_irq(substream); + } + + static const struct action_ops snd_pcm_action_reset = { +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index 01f296d524ce6..cb60a07d39a8e 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -938,8 +938,8 @@ static int snd_ac97_ad18xx_pcm_get_volume(struct snd_kcontrol *kcontrol, struct + int codec = kcontrol->private_value & 3; + + mutex_lock(&ac97->page_mutex); +- ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); +- ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); ++ ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); ++ ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); + mutex_unlock(&ac97->page_mutex); + return 0; + } +diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c +index 9a678b5cf2855..dab801d9d3b48 100644 +--- a/sound/pci/cmipci.c ++++ b/sound/pci/cmipci.c +@@ -298,7 +298,6 @@ MODULE_PARM_DESC(joystick_port, "Joystick port address."); + #define CM_MICGAINZ 0x01 /* mic boost */ + #define CM_MICGAINZ_SHIFT 0 + +-#define CM_REG_MIXER3 0x24 + #define CM_REG_AUX_VOL 0x26 + #define CM_VAUXL_MASK 0xf0 + #define CM_VAUXR_MASK 0x0f +@@ -3265,7 +3264,7 @@ static int snd_cmipci_probe(struct pci_dev *pci, + */ + static const unsigned char saved_regs[] = { + CM_REG_FUNCTRL1, CM_REG_CHFORMAT, CM_REG_LEGACY_CTRL, CM_REG_MISC_CTRL, +- CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_MIXER3, CM_REG_PLL, ++ CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_AUX_VOL, CM_REG_PLL, + CM_REG_CH0_FRAME1, CM_REG_CH0_FRAME2, + CM_REG_CH1_FRAME1, CM_REG_CH1_FRAME2, CM_REG_EXT_MISC, + CM_REG_INT_STATUS, CM_REG_INT_HLDCLR, CM_REG_FUNCTRL0, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3a42457984e98..75ff7e8498b83 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9020,6 +9020,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), +@@ -9103,6 +9104,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8561, "Clevo NH[57][0-9][ER][ACDH]Q", ALC269_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[57][0-9]RZ[Q]", ALC269_FIXUP_DMIC), + SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x866d, "Clevo NP5[05]PN[HJK]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x867d, "Clevo NP7[01]PN[HJK]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME), + SND_PCI_QUIRK(0x1558, 0x8a20, "Clevo NH55DCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -11067,6 +11070,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), + SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), ++ SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), + SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), +diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c +index 2ed92c990b97c..dd9013c476649 100644 +--- a/sound/soc/sti/uniperif_player.c ++++ b/sound/soc/sti/uniperif_player.c +@@ -91,7 +91,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + } + + ret = IRQ_HANDLED; +@@ -105,7 +105,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +@@ -138,7 +138,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + dev_err(player->dev, "Underflow recovery failed\n"); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c +index 136059331211d..065c5f0d1f5f0 100644 +--- a/sound/soc/sti/uniperif_reader.c ++++ b/sound/soc/sti/uniperif_reader.c +@@ -65,7 +65,7 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id) + if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) { + dev_err(reader->dev, "FIFO error detected\n"); + +- snd_pcm_stop_xrun(reader->substream); ++ snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 96991ddf5055d..64f5544d0a0aa 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -542,6 +542,16 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x05a7, 0x40fa), + .map = bose_soundlink_map, + }, ++ { ++ /* Corsair Virtuoso SE Latest (wired mode) */ ++ .id = USB_ID(0x1b1c, 0x0a3f), ++ .map = corsair_virtuoso_map, ++ }, ++ { ++ /* Corsair Virtuoso SE Latest (wireless mode) */ ++ .id = USB_ID(0x1b1c, 0x0a40), ++ .map = corsair_virtuoso_map, ++ }, + { + /* Corsair Virtuoso SE (wired mode) */ + .id = USB_ID(0x1b1c, 0x0a3d), +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index e447ddd6854cd..d35cf54cab338 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -3360,9 +3360,10 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, + if (unitid == 7 && cval->control == UAC_FU_VOLUME) + snd_dragonfly_quirk_db_scale(mixer, cval, kctl); + break; +- /* lowest playback value is muted on C-Media devices */ +- case USB_ID(0x0d8c, 0x000c): +- case USB_ID(0x0d8c, 0x0014): ++ /* lowest playback value is muted on some devices */ ++ case USB_ID(0x0d8c, 0x000c): /* C-Media */ ++ case USB_ID(0x0d8c, 0x0014): /* C-Media */ ++ case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ + if (strstr(kctl->id.name, "Playback")) + cval->min_mute = 1; + break;