diff options
author | Mike Pagano <mpagano@gentoo.org> | 2014-06-27 07:30:11 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2014-06-27 07:30:11 -0400 |
commit | 869cfedf5b4ae47bbc00a95d2936b1efd797b6d9 (patch) | |
tree | 3f0eefffa1e2cb55a9687d1c833758ba5dbf2092 | |
parent | Adding cpu optimization patch (diff) | |
download | linux-patches-869cfedf5b4ae47bbc00a95d2936b1efd797b6d9.tar.gz linux-patches-869cfedf5b4ae47bbc00a95d2936b1efd797b6d9.tar.bz2 linux-patches-869cfedf5b4ae47bbc00a95d2936b1efd797b6d9.zip |
Linux patch 3.15.23.15-4
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1001_linux-3.15.2.patch | 2455 |
2 files changed, 2459 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 019dbd26..58bb4676 100644 --- a/0000_README +++ b/0000_README @@ -47,6 +47,10 @@ Patch: 1000_linux-3.15.1.patch From: http://www.kernel.org Desc: Linux 3.15.1 +Patch: 1001_linux-3.15.2.patch +From: http://www.kernel.org +Desc: Linux 3.15.2 + Patch: 1700_enable-thinkpad-micled.patch From: https://bugs.gentoo.org/show_bug.cgi?id=449248 Desc: Enable mic mute led in thinkpads diff --git a/1001_linux-3.15.2.patch b/1001_linux-3.15.2.patch new file mode 100644 index 00000000..3be738a6 --- /dev/null +++ b/1001_linux-3.15.2.patch @@ -0,0 +1,2455 @@ +diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy +index f1c5cc9d17a8..4c3efe434806 100644 +--- a/Documentation/ABI/testing/ima_policy ++++ b/Documentation/ABI/testing/ima_policy +@@ -23,7 +23,7 @@ Description: + [fowner]] + lsm: [[subj_user=] [subj_role=] [subj_type=] + [obj_user=] [obj_role=] [obj_type=]] +- option: [[appraise_type=]] ++ option: [[appraise_type=]] [permit_directio] + + base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] + mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] +diff --git a/Makefile b/Makefile +index e2846acd2841..475e0853a2f4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 15 +-SUBLEVEL = 1 ++SUBLEVEL = 2 + EXTRAVERSION = + NAME = Shuffling Zombie Juror + +diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c +index 2ba694f9626b..f8bc3511a8c8 100644 +--- a/arch/arm/mach-at91/sysirq_mask.c ++++ b/arch/arm/mach-at91/sysirq_mask.c +@@ -25,24 +25,28 @@ + + #include "generic.h" + +-#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ +-#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ ++#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IRQ_MASK 0x1f /* Available IRQs mask */ + + void __init at91_sysirq_mask_rtc(u32 rtc_base) + { + void __iomem *base; +- u32 mask; + + base = ioremap(rtc_base, 64); + if (!base) + return; + +- mask = readl_relaxed(base + AT91_RTC_IMR); +- if (mask) { +- pr_info("AT91: Disabling rtc irq\n"); +- writel_relaxed(mask, base + AT91_RTC_IDR); +- (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ +- } ++ /* ++ * sam9x5 SoCs have the following errata: ++ * "RTC: Interrupt Mask Register cannot be used ++ * Interrupt Mask Register read always returns 0." ++ * ++ * Hence we're not relying on IMR values to disable ++ * interrupts. ++ */ ++ writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR); ++ (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ + + iounmap(base); + } +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index da5186fbd77a..5efce56f0df0 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + if (cpu_has_veic || cpu_has_vint) { + size = 0x200 + VECTORSPACING * 64; + } else { +- size = 0x200; ++ size = 0x4000; + } + + /* Save Linux EBASE */ +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index 200a8f9390b6..0c734baea2d4 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -900,7 +900,7 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu, + return 0; + } + +-static void clear_floating_interrupts(struct kvm *kvm) ++void kvm_s390_clear_float_irqs(struct kvm *kvm) + { + struct kvm_s390_float_interrupt *fi; + struct kvm_s390_interrupt_info *n, *inti = NULL; +@@ -1246,7 +1246,7 @@ static int flic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr) + break; + case KVM_DEV_FLIC_CLEAR_IRQS: + r = 0; +- clear_floating_interrupts(dev->kvm); ++ kvm_s390_clear_float_irqs(dev->kvm); + break; + case KVM_DEV_FLIC_APF_ENABLE: + dev->kvm->arch.gmap->pfault_enabled = 1; +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 9ae6664ff08c..6c3699ec998e 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -322,6 +322,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) + { + VCPU_EVENT(vcpu, 3, "%s", "free cpu"); + trace_kvm_s390_destroy_vcpu(vcpu->vcpu_id); ++ kvm_s390_clear_local_irqs(vcpu); + kvm_clear_async_pf_completion_queue(vcpu); + if (!kvm_is_ucontrol(vcpu->kvm)) { + clear_bit(63 - vcpu->vcpu_id, +@@ -372,6 +373,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm) + if (!kvm_is_ucontrol(kvm)) + gmap_free(kvm->arch.gmap); + kvm_s390_destroy_adapters(kvm); ++ kvm_s390_clear_float_irqs(kvm); + } + + /* Section: vcpu related */ +diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h +index 3c1e2274d9ea..604872125309 100644 +--- a/arch/s390/kvm/kvm-s390.h ++++ b/arch/s390/kvm/kvm-s390.h +@@ -130,6 +130,7 @@ void kvm_s390_tasklet(unsigned long parm); + void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu); + void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu); + void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu); ++void kvm_s390_clear_float_irqs(struct kvm *kvm); + int __must_check kvm_s390_inject_vm(struct kvm *kvm, + struct kvm_s390_interrupt *s390int); + int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu, +diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c +index a82c6b2a9780..49cee4af16f4 100644 +--- a/arch/sparc/net/bpf_jit_comp.c ++++ b/arch/sparc/net/bpf_jit_comp.c +@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_) + #define BNE (F2(0, 2) | CONDNE) + + #ifdef CONFIG_SPARC64 +-#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20)) ++#define BE_PTR (F2(0, 1) | CONDE | (2 << 20)) + #else +-#define BNE_PTR BNE ++#define BE_PTR BE + #endif + + #define SETHI(K, REG) \ +@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_IFINDEX: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load32(r_A, struct net_device, ifindex, r_A); + break; +@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_HATYPE: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load16(r_A, struct net_device, type, r_A); + break; +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 9736529ade08..006911858174 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic) + + static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + { ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR)) + ++apic->isr_count; + BUG_ON(apic->isr_count > MAX_APIC_VECTOR); +@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + apic->highest_isr_cache = vec; + } + ++static inline int apic_find_highest_isr(struct kvm_lapic *apic) ++{ ++ int result; ++ ++ /* ++ * Note that isr_count is always 1, and highest_isr_cache ++ * is always -1, with APIC virtualization enabled. ++ */ ++ if (!apic->isr_count) ++ return -1; ++ if (likely(apic->highest_isr_cache != -1)) ++ return apic->highest_isr_cache; ++ ++ result = find_highest_vector(apic->regs + APIC_ISR); ++ ASSERT(result == -1 || result >= 16); ++ ++ return result; ++} ++ + static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) + { +- if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ struct kvm_vcpu *vcpu; ++ if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ return; ++ ++ vcpu = apic->vcpu; ++ ++ /* ++ * We do get here for APIC virtualization enabled if the guest ++ * uses the Hyper-V APIC enlightenment. In this case we may need ++ * to trigger a new interrupt delivery by writing the SVI field; ++ * on the other hand isr_count and highest_isr_cache are unused ++ * and must be left alone. ++ */ ++ if (unlikely(kvm_apic_vid_enabled(vcpu->kvm))) ++ kvm_x86_ops->hwapic_isr_update(vcpu->kvm, ++ apic_find_highest_isr(apic)); ++ else { + --apic->isr_count; +- BUG_ON(apic->isr_count < 0); +- apic->highest_isr_cache = -1; ++ BUG_ON(apic->isr_count < 0); ++ apic->highest_isr_cache = -1; ++ } + } + + int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu) +@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu) + __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention); + } + +-static inline int apic_find_highest_isr(struct kvm_lapic *apic) +-{ +- int result; +- +- /* Note that isr_count is always 1 with vid enabled */ +- if (!apic->isr_count) +- return -1; +- if (likely(apic->highest_isr_cache != -1)) +- return apic->highest_isr_cache; +- +- result = find_highest_vector(apic->regs + APIC_ISR); +- ASSERT(result == -1 || result >= 16); +- +- return result; +-} +- + void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr) + { + struct kvm_lapic *apic = vcpu->arch.apic; +@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu) + int vector = kvm_apic_has_interrupt(vcpu); + struct kvm_lapic *apic = vcpu->arch.apic; + ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (vector == -1) + return -1; + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 2e7801af466e..05827eccc53a 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -224,8 +224,8 @@ cleanup: + vmbus_connection.int_page = NULL; + } + +- free_pages((unsigned long)vmbus_connection.monitor_pages[0], 1); +- free_pages((unsigned long)vmbus_connection.monitor_pages[1], 1); ++ free_pages((unsigned long)vmbus_connection.monitor_pages[0], 0); ++ free_pages((unsigned long)vmbus_connection.monitor_pages[1], 0); + vmbus_connection.monitor_pages[0] = NULL; + vmbus_connection.monitor_pages[1] = NULL; + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index 7e6d78dc9437..5e90c5d771a7 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -19,6 +19,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include <linux/kernel.h> ++#include <linux/jiffies.h> + #include <linux/mman.h> + #include <linux/delay.h> + #include <linux/init.h> +@@ -459,6 +460,11 @@ static bool do_hot_add; + */ + static uint pressure_report_delay = 45; + ++/* ++ * The last time we posted a pressure report to host. ++ */ ++static unsigned long last_post_time; ++ + module_param(hot_add, bool, (S_IRUGO | S_IWUSR)); + MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); + +@@ -542,6 +548,7 @@ struct hv_dynmem_device { + + static struct hv_dynmem_device dm_device; + ++static void post_status(struct hv_dynmem_device *dm); + #ifdef CONFIG_MEMORY_HOTPLUG + + static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size) +@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size, + * have not been "onlined" within the allowed time. + */ + wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ); +- ++ post_status(&dm_device); + } + + return; +@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem_device *dm) + { + struct dm_status status; + struct sysinfo val; ++ unsigned long now = jiffies; ++ unsigned long last_post = last_post_time; + + if (pressure_report_delay > 0) { + --pressure_report_delay; + return; + } ++ ++ if (!time_after(now, (last_post_time + HZ))) ++ return; ++ + si_meminfo(&val); + memset(&status, 0, sizeof(struct dm_status)); + status.hdr.type = DM_STATUS_REPORT; +@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem_device *dm) + if (status.hdr.trans_id != atomic_read(&trans_id)) + return; + ++ /* ++ * If the last post time that we sampled has changed, ++ * we have raced, don't post the status. ++ */ ++ if (last_post != last_post_time) ++ return; ++ ++ last_post_time = jiffies; + vmbus_sendpacket(dm->dev->channel, &status, + sizeof(struct dm_status), + (unsigned long)NULL, +@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struct *dummy) + + if (ret == -EAGAIN) + msleep(20); +- ++ post_status(&dm_device); + } while (ret == -EAGAIN); + + if (ret) { +@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynmem_device *dm, + struct dm_unballoon_response resp; + int i; + +- for (i = 0; i < range_count; i++) ++ for (i = 0; i < range_count; i++) { + free_balloon_pages(dm, &range_array[i]); ++ post_status(&dm_device); ++ } + + if (req->more_pages == 1) + return; +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index 89777ed9abd8..be0b2accf895 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct iio_dev *idev) + return idev->num_channels; + } + +-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, ++static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + struct at91_adc_trigger *triggers, + const char *trigger_name) + { + struct at91_adc_state *st = iio_priv(idev); +- u8 value = 0; + int i; + + for (i = 0; i < st->trigger_number; i++) { +@@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + return -ENOMEM; + + if (strcmp(trigger_name, name) == 0) { +- value = triggers[i].value; + kfree(name); +- break; ++ if (triggers[i].value == 0) ++ return -EINVAL; ++ return triggers[i].value; + } + + kfree(name); + } + +- return value; ++ return -EINVAL; + } + + static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) +@@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + struct iio_buffer *buffer = idev->buffer; + struct at91_adc_reg_desc *reg = st->registers; + u32 status = at91_adc_readl(st, reg->trigger_register); +- u8 value; ++ int value; + u8 bit; + + value = at91_adc_get_trigger_value_by_name(idev, + st->trigger_list, + idev->trig->name); +- if (value == 0) +- return -EINVAL; ++ if (value < 0) ++ return value; + + if (state) { + st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL); +diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c +index 9cf3229a7272..1b3b74be5c20 100644 +--- a/drivers/iio/adc/max1363.c ++++ b/drivers/iio/adc/max1363.c +@@ -1252,8 +1252,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11605] = { + .bits = 8, +@@ -1262,8 +1262,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11606] = { + .bits = 10, +@@ -1312,8 +1312,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11611] = { + .bits = 10, +@@ -1322,8 +1322,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11612] = { + .bits = 12, +diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c +index 6989c16aec2b..b58d6302521f 100644 +--- a/drivers/iio/adc/men_z188_adc.c ++++ b/drivers/iio/adc/men_z188_adc.c +@@ -121,8 +121,8 @@ static int men_z188_probe(struct mcb_device *dev, + indio_dev->num_channels = ARRAY_SIZE(z188_adc_iio_channels); + + mem = mcb_request_mem(dev, "z188-adc"); +- if (!mem) +- return -ENOMEM; ++ if (IS_ERR(mem)) ++ return PTR_ERR(mem); + + adc->base = ioremap(mem->start, resource_size(mem)); + if (adc->base == NULL) +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 74866d1efd1b..2a524acabec8 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + { + struct ak8975_data *data = iio_priv(indio_dev); + struct i2c_client *client = data->client; +- u16 meas_reg; +- s16 raw; + int ret; + + mutex_lock(&data->lock); +@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + dev_err(&client->dev, "Read axis data fails\n"); + goto exit; + } +- meas_reg = ret; + + mutex_unlock(&data->lock); + +- /* Endian conversion of the measured values. */ +- raw = (s16) (le16_to_cpu(meas_reg)); +- + /* Clamp to valid range. */ +- raw = clamp_t(s16, raw, -4096, 4095); +- *val = raw; ++ *val = clamp_t(s16, ret, -4096, 4095); + return IIO_VAL_INT; + + exit: +diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c +index ba6d0c520e63..01b2e0b18878 100644 +--- a/drivers/iio/pressure/mpl3115.c ++++ b/drivers/iio/pressure/mpl3115.c +@@ -98,7 +98,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, + mutex_unlock(&data->lock); + if (ret < 0) + return ret; +- *val = sign_extend32(be32_to_cpu(tmp) >> 12, 23); ++ *val = be32_to_cpu(tmp) >> 12; + return IIO_VAL_INT; + case IIO_TEMP: /* in 0.0625 celsius / LSB */ + mutex_lock(&data->lock); +@@ -112,7 +112,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, + mutex_unlock(&data->lock); + if (ret < 0) + return ret; +- *val = sign_extend32(be32_to_cpu(tmp) >> 20, 15); ++ *val = sign_extend32(be32_to_cpu(tmp) >> 20, 11); + return IIO_VAL_INT; + default: + return -EINVAL; +@@ -185,7 +185,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { +- .sign = 's', ++ .sign = 'u', + .realbits = 20, + .storagebits = 32, + .shift = 12, +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 6a9509ccd33b..08ed9a30c3a7 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -307,6 +307,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = { + }; + + static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = { ++ [EDMR] = 0x0000, ++ [EDTRR] = 0x0004, ++ [EDRRR] = 0x0008, ++ [TDLAR] = 0x000c, ++ [RDLAR] = 0x0010, ++ [EESR] = 0x0014, ++ [EESIPR] = 0x0018, ++ [TRSCER] = 0x001c, ++ [RMFCR] = 0x0020, ++ [TFTR] = 0x0024, ++ [FDR] = 0x0028, ++ [RMCR] = 0x002c, ++ [EDOCR] = 0x0030, ++ [FCFTR] = 0x0034, ++ [RPADIR] = 0x0038, ++ [TRIMD] = 0x003c, ++ [RBWAR] = 0x0040, ++ [RDFAR] = 0x0044, ++ [TBRAR] = 0x004c, ++ [TDFAR] = 0x0050, ++ + [ECMR] = 0x0160, + [ECSR] = 0x0164, + [ECSIPR] = 0x0168, +@@ -546,7 +567,6 @@ static struct sh_eth_cpu_data sh7757_data = { + .register_type = SH_ETH_REG_FAST_SH4, + + .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff, +- .rmcr_value = RMCR_RNC, + + .tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO, + .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE | +@@ -624,7 +644,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000072f, +- .rmcr_value = RMCR_RNC, + + .irq_flags = IRQF_SHARED, + .apr = 1, +@@ -752,7 +771,6 @@ static struct sh_eth_cpu_data r8a7740_data = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000070f, +- .rmcr_value = RMCR_RNC, + + .apr = 1, + .mpr = 1, +@@ -784,7 +802,6 @@ static struct sh_eth_cpu_data r7s72100_data = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000070f, +- .rmcr_value = RMCR_RNC, + + .no_psr = 1, + .apr = 1, +@@ -833,9 +850,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd) + if (!cd->fdr_value) + cd->fdr_value = DEFAULT_FDR_INIT; + +- if (!cd->rmcr_value) +- cd->rmcr_value = DEFAULT_RMCR_VALUE; +- + if (!cd->tx_check) + cd->tx_check = DEFAULT_TX_CHECK; + +@@ -1287,8 +1301,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start) + sh_eth_write(ndev, mdp->cd->fdr_value, FDR); + sh_eth_write(ndev, 0, TFTR); + +- /* Frame recv control */ +- sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR); ++ /* Frame recv control (enable multiple-packets per rx irq) */ ++ sh_eth_write(ndev, RMCR_RNC, RMCR); + + sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER); + +diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h +index d55e37cd5fec..b37c427144ee 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.h ++++ b/drivers/net/ethernet/renesas/sh_eth.h +@@ -319,7 +319,6 @@ enum TD_STS_BIT { + enum RMCR_BIT { + RMCR_RNC = 0x00000001, + }; +-#define DEFAULT_RMCR_VALUE 0x00000000 + + /* ECMR */ + enum FELIC_MODE_BIT { +@@ -466,7 +465,6 @@ struct sh_eth_cpu_data { + unsigned long fdr_value; + unsigned long fcftr_value; + unsigned long rpadir_value; +- unsigned long rmcr_value; + + /* interrupt checking mask */ + unsigned long tx_check; +diff --git a/drivers/net/ethernet/sfc/io.h b/drivers/net/ethernet/sfc/io.h +index 4d3f119b67b3..afb94aa2c15e 100644 +--- a/drivers/net/ethernet/sfc/io.h ++++ b/drivers/net/ethernet/sfc/io.h +@@ -66,10 +66,17 @@ + #define EFX_USE_QWORD_IO 1 + #endif + ++/* Hardware issue requires that only 64-bit naturally aligned writes ++ * are seen by hardware. Its not strictly necessary to restrict to ++ * x86_64 arch, but done for safety since unusual write combining behaviour ++ * can break PIO. ++ */ ++#ifdef CONFIG_X86_64 + /* PIO is a win only if write-combining is possible */ + #ifdef ARCH_HAS_IOREMAP_WC + #define EFX_USE_PIO 1 + #endif ++#endif + + #ifdef EFX_USE_QWORD_IO + static inline void _efx_writeq(struct efx_nic *efx, __le64 value, +diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c +index fa9475300411..ede8dcca0ff3 100644 +--- a/drivers/net/ethernet/sfc/tx.c ++++ b/drivers/net/ethernet/sfc/tx.c +@@ -189,6 +189,18 @@ struct efx_short_copy_buffer { + u8 buf[L1_CACHE_BYTES]; + }; + ++/* Copy in explicit 64-bit writes. */ ++static void efx_memcpy_64(void __iomem *dest, void *src, size_t len) ++{ ++ u64 *src64 = src; ++ u64 __iomem *dest64 = dest; ++ size_t l64 = len / 8; ++ size_t i; ++ ++ for (i = 0; i < l64; i++) ++ writeq(src64[i], &dest64[i]); ++} ++ + /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned. + * Advances piobuf pointer. Leaves additional data in the copy buffer. + */ +@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(struct efx_nic *efx, u8 __iomem **piobuf, + { + int block_len = len & ~(sizeof(copy_buf->buf) - 1); + +- memcpy_toio(*piobuf, data, block_len); ++ efx_memcpy_64(*piobuf, data, block_len); + *piobuf += block_len; + len -= block_len; + +@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(struct efx_nic *efx, u8 __iomem **piobuf, + if (copy_buf->used < sizeof(copy_buf->buf)) + return; + +- memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); ++ efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); + *piobuf += sizeof(copy_buf->buf); + data += copy_to_buf; + len -= copy_to_buf; +@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct efx_nic *efx, u8 __iomem *piobuf, + { + /* if there's anything in it, write the whole buffer, including junk */ + if (copy_buf->used) +- memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); ++ efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); + } + + /* Traverse skb structure and copy fragments in to PIO buffer. +@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue *tx_queue, struct sk_buff *skb) + */ + BUILD_BUG_ON(L1_CACHE_BYTES > + SKB_DATA_ALIGN(sizeof(struct skb_shared_info))); +- memcpy_toio(tx_queue->piobuf, skb->data, +- ALIGN(skb->len, L1_CACHE_BYTES)); ++ efx_memcpy_64(tx_queue->piobuf, skb->data, ++ ALIGN(skb->len, L1_CACHE_BYTES)); + } + + EFX_POPULATE_QWORD_5(buffer->option, +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index d53e299ae1d9..7eec598c5cb6 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct notifier_block *unused, + list_for_each_entry_safe(vlan, next, &port->vlans, list) + vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + break; + case NETDEV_PRE_TYPE_CHANGE: + /* Forbid underlaying device to change its type. */ +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index dc4bf06948c7..cf62d7e8329f 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -763,7 +763,12 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ +- {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc004, 6)}, /* Olivetti Olicard 155 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ + {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ + {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 4dbb2ed85b97..77dcf92ea350 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2275,9 +2275,9 @@ static void vxlan_setup(struct net_device *dev) + eth_hw_addr_random(dev); + ether_setup(dev); + if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6) +- dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM; ++ dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM; + else +- dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM; ++ dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM; + + dev->netdev_ops = &vxlan_netdev_ops; + dev->destructor = free_netdev; +@@ -2660,8 +2660,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, + if (!tb[IFLA_MTU]) + dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); + +- /* update header length based on lower device */ +- dev->hard_header_len = lowerdev->hard_header_len + ++ dev->needed_headroom = lowerdev->hard_header_len + + (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); + } else if (use_ipv6) + vxlan->flags |= VXLAN_F_IPV6; +diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c +index 3281c90691c3..44fe83ee9bee 100644 +--- a/drivers/rtc/rtc-at91rm9200.c ++++ b/drivers/rtc/rtc-at91rm9200.c +@@ -48,6 +48,7 @@ struct at91_rtc_config { + + static const struct at91_rtc_config *at91_rtc_config; + static DECLARE_COMPLETION(at91_rtc_updated); ++static DECLARE_COMPLETION(at91_rtc_upd_rdy); + static unsigned int at91_alarm_year = AT91_RTC_EPOCH; + static void __iomem *at91_rtc_regs; + static int irq; +@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday, + tm->tm_hour, tm->tm_min, tm->tm_sec); + ++ wait_for_completion(&at91_rtc_upd_rdy); ++ + /* Stop Time/Calendar from counting */ + cr = at91_rtc_read(AT91_RTC_CR); + at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM); +@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + + /* Restart Time/Calendar */ + cr = at91_rtc_read(AT91_RTC_CR); ++ at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV); + at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM)); ++ at91_rtc_write_ier(AT91_RTC_SECEV); + + return 0; + } +@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id) + if (rtsr) { /* this interrupt is shared! Is it ours? */ + if (rtsr & AT91_RTC_ALARM) + events |= (RTC_AF | RTC_IRQF); +- if (rtsr & AT91_RTC_SECEV) +- events |= (RTC_UF | RTC_IRQF); ++ if (rtsr & AT91_RTC_SECEV) { ++ complete(&at91_rtc_upd_rdy); ++ at91_rtc_write_idr(AT91_RTC_SECEV); ++ } + if (rtsr & AT91_RTC_ACKUPD) + complete(&at91_rtc_updated); + +@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev) + return PTR_ERR(rtc); + platform_set_drvdata(pdev, rtc); + ++ /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy ++ * completion. ++ */ ++ at91_rtc_write_ier(AT91_RTC_SECEV); ++ + dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n"); + return 0; + } +diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c +index dae8d1a9038e..52d7517b342e 100644 +--- a/drivers/staging/iio/adc/mxs-lradc.c ++++ b/drivers/staging/iio/adc/mxs-lradc.c +@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val) + LRADC_CTRL1); + mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); + ++ /* Enable / disable the divider per requirement */ ++ if (test_bit(chan, &lradc->is_divided)) ++ mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, ++ LRADC_CTRL2); ++ else ++ mxs_lradc_reg_clear(lradc, ++ 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2); ++ + /* Clean the slot's previous content, then set new one. */ + mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0), + LRADC_CTRL4); +@@ -961,15 +969,11 @@ static int mxs_lradc_write_raw(struct iio_dev *iio_dev, + if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer && + val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) { + /* divider by two disabled */ +- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, +- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR); + clear_bit(chan->channel, &lradc->is_divided); + ret = 0; + } else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer && + val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) { + /* divider by two enabled */ +- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, +- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET); + set_bit(chan->channel, &lradc->is_divided); + ret = 0; + } +diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c +index 9e0f2a9c73ae..ab338e3ddd05 100644 +--- a/drivers/staging/iio/light/tsl2x7x_core.c ++++ b/drivers/staging/iio/light/tsl2x7x_core.c +@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev) + chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] = + chip->tsl2x7x_settings.prox_pulse_count; + chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_low; ++ (chip->tsl2x7x_settings.prox_thres_low) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF; + chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_high; ++ (chip->tsl2x7x_settings.prox_thres_high) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF; + + /* and make sure we're not already on */ + if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) { +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index de77d9aa22c6..6689de6c5591 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -314,6 +314,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 789aa9eb0a1e..a51dd4efc23b 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2407,6 +2407,10 @@ static void target_release_cmd_kref(struct kref *kref) + */ + int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd) + { ++ if (!se_sess) { ++ se_cmd->se_tfo->release_cmd(se_cmd); ++ return 1; ++ } + return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref, + &se_sess->sess_cmd_lock); + } +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 904efb6035b0..6bbd203f1861 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm *acm) + static int acm_ctrl_msg(struct acm *acm, int request, int value, + void *buf, int len) + { +- int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), ++ int retval; ++ ++ retval = usb_autopm_get_interface(acm->control); ++ if (retval) ++ return retval; ++ ++ retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), + request, USB_RT_ACM, value, + acm->control->altsetting[0].desc.bInterfaceNumber, + buf, len, 5000); ++ + dev_dbg(&acm->control->dev, + "%s - rq 0x%02x, val %#x, len %#x, result %d\n", + __func__, request, value, len, retval); ++ ++ usb_autopm_put_interface(acm->control); ++ + return retval < 0 ? retval : 0; + } + +@@ -496,6 +506,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + { + struct acm *acm = container_of(port, struct acm, port); + int retval = -ENODEV; ++ int i; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + +@@ -515,21 +526,17 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + acm->control->needs_remote_wakeup = 1; + + acm->ctrlurb->dev = acm->dev; +- if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) { ++ retval = usb_submit_urb(acm->ctrlurb, GFP_KERNEL); ++ if (retval) { + dev_err(&acm->control->dev, + "%s - usb_submit_urb(ctrl irq) failed\n", __func__); +- usb_autopm_put_interface(acm->control); + goto error_submit_urb; + } + + acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS; +- if (acm_set_control(acm, acm->ctrlout) < 0 && +- (acm->ctrl_caps & USB_CDC_CAP_LINE)) { +- usb_autopm_put_interface(acm->control); ++ retval = acm_set_control(acm, acm->ctrlout); ++ if (retval < 0 && (acm->ctrl_caps & USB_CDC_CAP_LINE)) + goto error_set_control; +- } +- +- usb_autopm_put_interface(acm->control); + + /* + * Unthrottle device in case the TTY was closed while throttled. +@@ -539,23 +546,30 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + acm->throttle_req = 0; + spin_unlock_irq(&acm->read_lock); + +- if (acm_submit_read_urbs(acm, GFP_KERNEL)) ++ retval = acm_submit_read_urbs(acm, GFP_KERNEL); ++ if (retval) + goto error_submit_read_urbs; + ++ usb_autopm_put_interface(acm->control); ++ + mutex_unlock(&acm->mutex); + + return 0; + + error_submit_read_urbs: ++ for (i = 0; i < acm->rx_buflimit; i++) ++ usb_kill_urb(acm->read_urbs[i]); + acm->ctrlout = 0; + acm_set_control(acm, acm->ctrlout); + error_set_control: + usb_kill_urb(acm->ctrlurb); + error_submit_urb: ++ usb_autopm_put_interface(acm->control); + error_get_interface: + disconnected: + mutex_unlock(&acm->mutex); +- return retval; ++ ++ return usb_translate_errors(retval); + } + + static void acm_port_destruct(struct tty_port *port) +@@ -573,21 +587,35 @@ static void acm_port_destruct(struct tty_port *port) + static void acm_port_shutdown(struct tty_port *port) + { + struct acm *acm = container_of(port, struct acm, port); ++ struct urb *urb; ++ struct acm_wb *wb; + int i; ++ int pm_err; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + + mutex_lock(&acm->mutex); + if (!acm->disconnected) { +- usb_autopm_get_interface(acm->control); ++ pm_err = usb_autopm_get_interface(acm->control); + acm_set_control(acm, acm->ctrlout = 0); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ wb = urb->context; ++ wb->use = 0; ++ usb_autopm_put_interface_async(acm->control); ++ } ++ + usb_kill_urb(acm->ctrlurb); + for (i = 0; i < ACM_NW; i++) + usb_kill_urb(acm->wb[i].urb); + for (i = 0; i < acm->rx_buflimit; i++) + usb_kill_urb(acm->read_urbs[i]); + acm->control->needs_remote_wakeup = 0; +- usb_autopm_put_interface(acm->control); ++ if (!pm_err) ++ usb_autopm_put_interface(acm->control); + } + mutex_unlock(&acm->mutex); + } +@@ -646,14 +674,17 @@ static int acm_tty_write(struct tty_struct *tty, + memcpy(wb->buf, buf, count); + wb->len = count; + +- usb_autopm_get_interface_async(acm->control); ++ stat = usb_autopm_get_interface_async(acm->control); ++ if (stat) { ++ wb->use = 0; ++ spin_unlock_irqrestore(&acm->write_lock, flags); ++ return stat; ++ } ++ + if (acm->susp_count) { +- if (!acm->delayed_wb) +- acm->delayed_wb = wb; +- else +- usb_autopm_put_interface_async(acm->control); ++ usb_anchor_urb(wb->urb, &acm->delayed); + spin_unlock_irqrestore(&acm->write_lock, flags); +- return count; /* A white lie */ ++ return count; + } + usb_mark_last_busy(acm->dev); + +@@ -1269,6 +1300,7 @@ made_compressed_probe: + acm->bInterval = epread->bInterval; + tty_port_init(&acm->port); + acm->port.ops = &acm_port_ops; ++ init_usb_anchor(&acm->delayed); + + buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); + if (!buf) { +@@ -1514,18 +1546,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + struct acm *acm = usb_get_intfdata(intf); + int cnt; + ++ spin_lock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + if (PMSG_IS_AUTO(message)) { +- int b; +- +- spin_lock_irq(&acm->write_lock); +- b = acm->transmitting; +- spin_unlock_irq(&acm->write_lock); +- if (b) ++ if (acm->transmitting) { ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + return -EBUSY; ++ } + } +- +- spin_lock_irq(&acm->read_lock); +- spin_lock(&acm->write_lock); + cnt = acm->susp_count++; + spin_unlock(&acm->write_lock); + spin_unlock_irq(&acm->read_lock); +@@ -1533,8 +1562,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + if (cnt) + return 0; + +- if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) +- stop_data_traffic(acm); ++ stop_data_traffic(acm); + + return 0; + } +@@ -1542,29 +1570,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + static int acm_resume(struct usb_interface *intf) + { + struct acm *acm = usb_get_intfdata(intf); +- struct acm_wb *wb; ++ struct urb *urb; + int rv = 0; +- int cnt; + + spin_lock_irq(&acm->read_lock); +- acm->susp_count -= 1; +- cnt = acm->susp_count; +- spin_unlock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + +- if (cnt) +- return 0; ++ if (--acm->susp_count) ++ goto out; + + if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) { +- rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO); +- +- spin_lock_irq(&acm->write_lock); +- if (acm->delayed_wb) { +- wb = acm->delayed_wb; +- acm->delayed_wb = NULL; +- spin_unlock_irq(&acm->write_lock); +- acm_start_wb(acm, wb); +- } else { +- spin_unlock_irq(&acm->write_lock); ++ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ ++ acm_start_wb(acm, urb->context); + } + + /* +@@ -1572,12 +1595,14 @@ static int acm_resume(struct usb_interface *intf) + * do the write path at all cost + */ + if (rv < 0) +- goto err_out; ++ goto out; + +- rv = acm_submit_read_urbs(acm, GFP_NOIO); ++ rv = acm_submit_read_urbs(acm, GFP_ATOMIC); + } ++out: ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + +-err_out: + return rv; + } + +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index e38dc785808f..80826f843e04 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -120,7 +120,7 @@ struct acm { + unsigned int throttled:1; /* actually throttled */ + unsigned int throttle_req:1; /* throttle requested */ + u8 bInterval; +- struct acm_wb *delayed_wb; /* write queued for a device about to be woken */ ++ struct usb_anchor delayed; /* writes queued for a device about to be woken */ + }; + + #define CDC_DATA_INTERFACE_TYPE 0x0a +diff --git a/include/sound/core.h b/include/sound/core.h +index d3f5f818e0b9..88c9fbb7ed90 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -116,6 +116,8 @@ struct snd_card { + int user_ctl_count; /* count of all user controls */ + struct list_head controls; /* all controls for this card */ + struct list_head ctl_files; /* active control files */ ++ struct mutex user_ctl_lock; /* protects user controls against ++ concurrent access */ + + struct snd_info_entry *proc_root; /* root for soundcard specific files */ + struct snd_info_entry *proc_id; /* the card id */ +diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h +index 5759810e1c1b..21eed488783f 100644 +--- a/include/uapi/sound/compress_offload.h ++++ b/include/uapi/sound/compress_offload.h +@@ -80,7 +80,7 @@ struct snd_compr_tstamp { + struct snd_compr_avail { + __u64 avail; + struct snd_compr_tstamp tstamp; +-}; ++} __attribute__((packed)); + + enum snd_compr_direction { + SND_COMPRESS_PLAYBACK = 0, +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index df6839e3ce08..99a03acb7d47 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) + len = *ip++; + for (; len == 255; length += 255) + len = *ip++; ++ if (unlikely(length > (size_t)(length + len))) ++ goto _output_error; + length += len; + } + +diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c +index 569985d522d5..8563081e8da3 100644 +--- a/lib/lzo/lzo1x_decompress_safe.c ++++ b/lib/lzo/lzo1x_decompress_safe.c +@@ -19,11 +19,31 @@ + #include <linux/lzo.h> + #include "lzodefs.h" + +-#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x)) +-#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) +-#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun +-#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun +-#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun ++#define HAVE_IP(t, x) \ ++ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define HAVE_OP(t, x) \ ++ (((size_t)(op_end - op) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define NEED_IP(t, x) \ ++ do { \ ++ if (!HAVE_IP(t, x)) \ ++ goto input_overrun; \ ++ } while (0) ++ ++#define NEED_OP(t, x) \ ++ do { \ ++ if (!HAVE_OP(t, x)) \ ++ goto output_overrun; \ ++ } while (0) ++ ++#define TEST_LB(m_pos) \ ++ do { \ ++ if ((m_pos) < out) \ ++ goto lookbehind_overrun; \ ++ } while (0) + + int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len) +@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 15 + *ip++; + } + t += 3; + copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) { ++ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) { + const unsigned char *ie = ip + t; + unsigned char *oe = op + t; + do { +@@ -81,8 +101,8 @@ copy_literal_run: + } else + #endif + { +- NEED_OP(t); +- NEED_IP(t + 3); ++ NEED_OP(t, 0); ++ NEED_IP(t, 3); + do { + *op++ = *ip++; + } while (--t > 0); +@@ -95,7 +115,7 @@ copy_literal_run: + m_pos -= t >> 2; + m_pos -= *ip++ << 2; + TEST_LB(m_pos); +- NEED_OP(2); ++ NEED_OP(2, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -119,10 +139,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 31 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + m_pos = op - 1; + next = get_unaligned_le16(ip); +@@ -137,10 +157,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 7 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + next = get_unaligned_le16(ip); + ip += 2; +@@ -154,7 +174,7 @@ copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) + if (op - m_pos >= 8) { + unsigned char *oe = op + t; +- if (likely(HAVE_OP(t + 15))) { ++ if (likely(HAVE_OP(t, 15))) { + do { + COPY8(op, m_pos); + op += 8; +@@ -164,7 +184,7 @@ copy_literal_run: + m_pos += 8; + } while (op < oe); + op = oe; +- if (HAVE_IP(6)) { ++ if (HAVE_IP(6, 0)) { + state = next; + COPY4(op, ip); + op += next; +@@ -172,7 +192,7 @@ copy_literal_run: + continue; + } + } else { +- NEED_OP(t); ++ NEED_OP(t, 0); + do { + *op++ = *m_pos++; + } while (op < oe); +@@ -181,7 +201,7 @@ copy_literal_run: + #endif + { + unsigned char *oe = op + t; +- NEED_OP(t); ++ NEED_OP(t, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -194,15 +214,15 @@ match_next: + state = next; + t = next; + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(6) && HAVE_OP(4))) { ++ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) { + COPY4(op, ip); + op += t; + ip += t; + } else + #endif + { +- NEED_IP(t + 3); +- NEED_OP(t); ++ NEED_IP(t, 3); ++ NEED_OP(t, 0); + while (t > 0) { + *op++ = *ip++; + t--; +diff --git a/mm/shmem.c b/mm/shmem.c +index 9f70e02111c6..a2801ba8ae2d 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1728,6 +1728,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + pgoff_t start, index, end; + int error; + ++ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) ++ return -EOPNOTSUPP; ++ + mutex_lock(&inode->i_mutex); + + if (mode & FALLOC_FL_PUNCH_HOLE) { +diff --git a/mm/slab.c b/mm/slab.c +index 19d92181ce24..9432556ab912 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -386,6 +386,39 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp) + + #endif + ++#define OBJECT_FREE (0) ++#define OBJECT_ACTIVE (1) ++ ++#ifdef CONFIG_DEBUG_SLAB_LEAK ++ ++static void set_obj_status(struct page *page, int idx, int val) ++{ ++ int freelist_size; ++ char *status; ++ struct kmem_cache *cachep = page->slab_cache; ++ ++ freelist_size = cachep->num * sizeof(freelist_idx_t); ++ status = (char *)page->freelist + freelist_size; ++ status[idx] = val; ++} ++ ++static inline unsigned int get_obj_status(struct page *page, int idx) ++{ ++ int freelist_size; ++ char *status; ++ struct kmem_cache *cachep = page->slab_cache; ++ ++ freelist_size = cachep->num * sizeof(freelist_idx_t); ++ status = (char *)page->freelist + freelist_size; ++ ++ return status[idx]; ++} ++ ++#else ++static inline void set_obj_status(struct page *page, int idx, int val) {} ++ ++#endif ++ + /* + * Do not go above this order unless 0 objects fit into the slab or + * overridden on the command line. +@@ -576,12 +609,30 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep) + return cachep->array[smp_processor_id()]; + } + ++static size_t calculate_freelist_size(int nr_objs, size_t align) ++{ ++ size_t freelist_size; ++ ++ freelist_size = nr_objs * sizeof(freelist_idx_t); ++ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) ++ freelist_size += nr_objs * sizeof(char); ++ ++ if (align) ++ freelist_size = ALIGN(freelist_size, align); ++ ++ return freelist_size; ++} ++ + static int calculate_nr_objs(size_t slab_size, size_t buffer_size, + size_t idx_size, size_t align) + { + int nr_objs; ++ size_t remained_size; + size_t freelist_size; ++ int extra_space = 0; + ++ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) ++ extra_space = sizeof(char); + /* + * Ignore padding for the initial guess. The padding + * is at most @align-1 bytes, and @buffer_size is at +@@ -590,14 +641,15 @@ static int calculate_nr_objs(size_t slab_size, size_t buffer_size, + * into the memory allocation when taking the padding + * into account. + */ +- nr_objs = slab_size / (buffer_size + idx_size); ++ nr_objs = slab_size / (buffer_size + idx_size + extra_space); + + /* + * This calculated number will be either the right + * amount, or one greater than what we want. + */ +- freelist_size = slab_size - nr_objs * buffer_size; +- if (freelist_size < ALIGN(nr_objs * idx_size, align)) ++ remained_size = slab_size - nr_objs * buffer_size; ++ freelist_size = calculate_freelist_size(nr_objs, align); ++ if (remained_size < freelist_size) + nr_objs--; + + return nr_objs; +@@ -635,7 +687,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size, + } else { + nr_objs = calculate_nr_objs(slab_size, buffer_size, + sizeof(freelist_idx_t), align); +- mgmt_size = ALIGN(nr_objs * sizeof(freelist_idx_t), align); ++ mgmt_size = calculate_freelist_size(nr_objs, align); + } + *num = nr_objs; + *left_over = slab_size - nr_objs*buffer_size - mgmt_size; +@@ -2032,13 +2084,16 @@ static size_t calculate_slab_order(struct kmem_cache *cachep, + break; + + if (flags & CFLGS_OFF_SLAB) { ++ size_t freelist_size_per_obj = sizeof(freelist_idx_t); + /* + * Max number of objs-per-slab for caches which + * use off-slab slabs. Needed to avoid a possible + * looping condition in cache_grow(). + */ ++ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK)) ++ freelist_size_per_obj += sizeof(char); + offslab_limit = size; +- offslab_limit /= sizeof(freelist_idx_t); ++ offslab_limit /= freelist_size_per_obj; + + if (num > offslab_limit) + break; +@@ -2285,8 +2340,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) + if (!cachep->num) + return -E2BIG; + +- freelist_size = +- ALIGN(cachep->num * sizeof(freelist_idx_t), cachep->align); ++ freelist_size = calculate_freelist_size(cachep->num, cachep->align); + + /* + * If the slab has been placed off-slab, and we have enough space then +@@ -2299,7 +2353,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) + + if (flags & CFLGS_OFF_SLAB) { + /* really off slab. No need for manual alignment */ +- freelist_size = cachep->num * sizeof(freelist_idx_t); ++ freelist_size = calculate_freelist_size(cachep->num, 0); + + #ifdef CONFIG_PAGE_POISONING + /* If we're going to use the generic kernel_map_pages() +@@ -2625,6 +2679,7 @@ static void cache_init_objs(struct kmem_cache *cachep, + if (cachep->ctor) + cachep->ctor(objp); + #endif ++ set_obj_status(page, i, OBJECT_FREE); + set_free_obj(page, i, i); + } + } +@@ -2833,6 +2888,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, + BUG_ON(objnr >= cachep->num); + BUG_ON(objp != index_to_obj(cachep, page, objnr)); + ++ set_obj_status(page, objnr, OBJECT_FREE); + if (cachep->flags & SLAB_POISON) { + #ifdef CONFIG_DEBUG_PAGEALLOC + if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) { +@@ -2966,6 +3022,8 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep, + static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep, + gfp_t flags, void *objp, unsigned long caller) + { ++ struct page *page; ++ + if (!objp) + return objp; + if (cachep->flags & SLAB_POISON) { +@@ -2996,6 +3054,9 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep, + *dbg_redzone1(cachep, objp) = RED_ACTIVE; + *dbg_redzone2(cachep, objp) = RED_ACTIVE; + } ++ ++ page = virt_to_head_page(objp); ++ set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE); + objp += obj_offset(cachep); + if (cachep->ctor && cachep->flags & SLAB_POISON) + cachep->ctor(objp); +@@ -4232,21 +4293,12 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c, + struct page *page) + { + void *p; +- int i, j; ++ int i; + + if (n[0] == n[1]) + return; + for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) { +- bool active = true; +- +- for (j = page->active; j < c->num; j++) { +- /* Skip freed item */ +- if (get_free_obj(page, j) == i) { +- active = false; +- break; +- } +- } +- if (!active) ++ if (get_obj_status(page, i) != OBJECT_ACTIVE) + continue; + + if (!add_caller(n, (unsigned long)*dbg_userword(c, p))) +diff --git a/net/core/dev.c b/net/core/dev.c +index fb8b0546485b..a30bef1882f5 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue); + /** + * unregister_netdevice_many - unregister many devices + * @head: list of devices ++ * ++ * Note: As most callers use a stack allocated list_head, ++ * we force a list_del() to make sure stack wont be corrupted later. + */ + void unregister_netdevice_many(struct list_head *head) + { +@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct list_head *head) + rollback_registered_many(head); + list_for_each_entry(dev, head, unreg_list) + net_set_todo(dev); ++ list_del(head); + } + } + EXPORT_SYMBOL(unregister_netdevice_many); +@@ -7077,7 +7081,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) + } + } + unregister_netdevice_many(&dev_kill_list); +- list_del(&dev_kill_list); + rtnl_unlock(); + } + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 2d8d8fcfa060..1999ed832267 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1234,6 +1234,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + int err; ++ int hdrlen; + + s_h = cb->args[0]; + s_idx = cb->args[1]; +@@ -1241,8 +1242,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + rcu_read_lock(); + cb->seq = net->dev_base_seq; + +- if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ /* A hack to preserve kernel<->userspace interface. ++ * The correct header is ifinfomsg. It is consistent with rtnl_getlink. ++ * However, before Linux v3.9 the code here assumed rtgenmsg and that's ++ * what iproute2 < v3.9.0 used. ++ * We can detect the old iproute2. Even including the IFLA_EXT_MASK ++ * attribute, its netlink message is shorter than struct ifinfomsg. ++ */ ++ hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); ++ ++ if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); +@@ -1744,7 +1754,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) + + ops->dellink(dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + return 0; + } + +@@ -2095,9 +2104,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + u16 min_ifinfo_dump_size = 0; ++ int hdrlen; ++ ++ /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ ++ hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); + +- if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); + } +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index 8b5134c582f1..a3095fdefbed 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -86,18 +86,26 @@ out: + } + EXPORT_SYMBOL(ip4_datagram_connect); + ++/* Because UDP xmit path can manipulate sk_dst_cache without holding ++ * socket lock, we need to use sk_dst_set() here, ++ * even if we own the socket lock. ++ */ + void ip4_datagram_release_cb(struct sock *sk) + { + const struct inet_sock *inet = inet_sk(sk); + const struct ip_options_rcu *inet_opt; + __be32 daddr = inet->inet_daddr; ++ struct dst_entry *dst; + struct flowi4 fl4; + struct rtable *rt; + +- if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0)) +- return; +- + rcu_read_lock(); ++ ++ dst = __sk_dst_get(sk); ++ if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) { ++ rcu_read_unlock(); ++ return; ++ } + inet_opt = rcu_dereference(inet->inet_opt); + if (inet_opt && inet_opt->opt.srr) + daddr = inet_opt->opt.faddr; +@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk) + inet->inet_saddr, inet->inet_dport, + inet->inet_sport, sk->sk_protocol, + RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); +- if (!IS_ERR(rt)) +- __sk_dst_set(sk, &rt->dst); ++ ++ dst = !IS_ERR(rt) ? &rt->dst : NULL; ++ sk_dst_set(sk, dst); ++ + rcu_read_unlock(); + } + EXPORT_SYMBOL_GPL(ip4_datagram_release_cb); +diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c +index 812b18351462..62eaa005e146 100644 +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPIP, 0); ++ t->parms.link, 0, IPPROTO_IPIP, 0); + err = 0; + goto out; + } + + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPIP, 0); + err = 0; + goto out; +@@ -486,4 +486,5 @@ static void __exit ipip_fini(void) + module_init(ipip_init); + module_exit(ipip_fini); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ipip"); + MODULE_ALIAS_NETDEV("tunl0"); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 4468e1adc094..54a5fe92de5a 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1834,6 +1834,10 @@ static struct sock *__udp4_lib_mcast_demux_lookup(struct net *net, + unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask); + struct udp_hslot *hslot = &udp_table.hash[slot]; + ++ /* Do not bother scanning a too big list */ ++ if (hslot->count > 10) ++ return NULL; ++ + rcu_read_lock(); + begin: + count = 0; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index f6a66bb4114d..afa082458360 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -61,6 +61,7 @@ + MODULE_AUTHOR("Ville Nuorvala"); + MODULE_DESCRIPTION("IPv6 tunneling device"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ip6tnl"); + MODULE_ALIAS_NETDEV("ip6tnl0"); + + #ifdef IP6_TNL_DEBUG +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index e5a453ca302e..4f408176dc64 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPV6, 0); ++ t->parms.link, 0, IPPROTO_IPV6, 0); + err = 0; + goto out; + } + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPV6, 0); + err = 0; + goto out; +@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed: + module_init(sit_init); + module_exit(sit_cleanup); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("sit"); + MODULE_ALIAS_NETDEV("sit0"); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 1e586d92260e..20b63d2ab70f 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk, + if (inet->inet_dport != rmt_port) + continue; + } +- if (!ipv6_addr_any(&sk->sk_v6_daddr) && +- !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) ++ if (!ipv6_addr_any(&s->sk_v6_daddr) && ++ !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr)) + continue; + + if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif) + continue; + +- if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) { +- if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)) ++ if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) { ++ if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr)) + continue; + } + if (!inet6_mc_check(s, loc_addr, rmt_addr)) +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index b8d331e7d883..34799e06ee01 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) + } + mutex_unlock(&local->iflist_mtx); + unregister_netdevice_many(&unreg_list); +- list_del(&unreg_list); + + list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { + list_del(&sdata->list); +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 39579c3e0d14..0b999987b658 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc) + /* Only real associations count against the endpoint, so + * don't bother for if this is a temporary association. + */ +- if (!asoc->temp) { ++ if (!list_empty(&asoc->asocs)) { + list_del(&asoc->asocs); + + /* Decrement the backlog value for a TCP-style listening +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 6e0bd933b6a9..3b312ed51618 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -287,12 +287,20 @@ out: + * @xattr_value: pointer to the new extended attribute value + * @xattr_value_len: pointer to the new extended attribute value length + * +- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that +- * the current value is valid. ++ * Before allowing the 'security.evm' protected xattr to be updated, ++ * verify the existing value is valid. As only the kernel should have ++ * access to the EVM encrypted key needed to calculate the HMAC, prevent ++ * userspace from writing HMAC value. Writing 'security.evm' requires ++ * requires CAP_SYS_ADMIN privileges. + */ + int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, + const void *xattr_value, size_t xattr_value_len) + { ++ const struct evm_ima_xattr_data *xattr_data = xattr_value; ++ ++ if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) ++ && (xattr_data->type == EVM_XATTR_HMAC)) ++ return -EPERM; + return evm_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + } +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index ba9e4d792dd5..d9cd5ce14d2b 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -199,6 +199,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + struct evm_ima_xattr_data **xattr_value, + int *xattr_len) + { ++ const char *audit_cause = "failed"; + struct inode *inode = file_inode(file); + const char *filename = file->f_dentry->d_name.name; + int result = 0; +@@ -213,6 +214,12 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + if (!(iint->flags & IMA_COLLECTED)) { + u64 i_version = file_inode(file)->i_version; + ++ if (file->f_flags & O_DIRECT) { ++ audit_cause = "failed(directio)"; ++ result = -EACCES; ++ goto out; ++ } ++ + /* use default hash algorithm */ + hash.hdr.algo = ima_hash_algo; + +@@ -233,9 +240,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + result = -ENOMEM; + } + } ++out: + if (result) + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, +- filename, "collect_data", "failed", ++ filename, "collect_data", audit_cause, + result, 0); + return result; + } +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index 1bde8e627766..ccd0ac8fa9a0 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -27,6 +27,36 @@ + + static struct crypto_shash *ima_shash_tfm; + ++/** ++ * ima_kernel_read - read file content ++ * ++ * This is a function for reading file content instead of kernel_read(). ++ * It does not perform locking checks to ensure it cannot be blocked. ++ * It does not perform security checks because it is irrelevant for IMA. ++ * ++ */ ++static int ima_kernel_read(struct file *file, loff_t offset, ++ char *addr, unsigned long count) ++{ ++ mm_segment_t old_fs; ++ char __user *buf = addr; ++ ssize_t ret; ++ ++ if (!(file->f_mode & FMODE_READ)) ++ return -EBADF; ++ if (!file->f_op->read && !file->f_op->aio_read) ++ return -EINVAL; ++ ++ old_fs = get_fs(); ++ set_fs(get_ds()); ++ if (file->f_op->read) ++ ret = file->f_op->read(file, buf, count, &offset); ++ else ++ ret = do_sync_read(file, buf, count, &offset); ++ set_fs(old_fs); ++ return ret; ++} ++ + int ima_init_crypto(void) + { + long rc; +@@ -104,7 +134,7 @@ static int ima_calc_file_hash_tfm(struct file *file, + while (offset < i_size) { + int rbuf_len; + +- rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); ++ rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE); + if (rbuf_len < 0) { + rc = rbuf_len; + break; +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 52ac6cf41f88..dcc98cf542d8 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -214,8 +214,11 @@ static int process_measurement(struct file *file, const char *filename, + xattr_ptr = &xattr_value; + + rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len); +- if (rc != 0) ++ if (rc != 0) { ++ if (file->f_flags & O_DIRECT) ++ rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES; + goto out_digsig; ++ } + + pathname = filename ?: ima_d_path(&file->f_path, &pathbuf); + +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 93873a450ff7..40a7488f6721 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -353,7 +353,7 @@ enum { + Opt_obj_user, Opt_obj_role, Opt_obj_type, + Opt_subj_user, Opt_subj_role, Opt_subj_type, + Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, +- Opt_appraise_type, Opt_fsuuid ++ Opt_appraise_type, Opt_fsuuid, Opt_permit_directio + }; + + static match_table_t policy_tokens = { +@@ -375,6 +375,7 @@ static match_table_t policy_tokens = { + {Opt_uid, "uid=%s"}, + {Opt_fowner, "fowner=%s"}, + {Opt_appraise_type, "appraise_type=%s"}, ++ {Opt_permit_directio, "permit_directio"}, + {Opt_err, NULL} + }; + +@@ -622,6 +623,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + else + result = -EINVAL; + break; ++ case Opt_permit_directio: ++ entry->flags |= IMA_PERMIT_DIRECTIO; ++ break; + case Opt_err: + ima_log_string(ab, "UNKNOWN", p); + result = -EINVAL; +diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h +index 2fb5e53e927f..33c0a70f6b15 100644 +--- a/security/integrity/integrity.h ++++ b/security/integrity/integrity.h +@@ -30,6 +30,7 @@ + #define IMA_ACTION_FLAGS 0xff000000 + #define IMA_DIGSIG 0x01000000 + #define IMA_DIGSIG_REQUIRED 0x02000000 ++#define IMA_PERMIT_DIRECTIO 0x04000000 + + #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ + IMA_APPRAISE_SUBMASK) +diff --git a/sound/core/control.c b/sound/core/control.c +index f038f5afafe2..f0b0e14497a5 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -288,6 +288,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card, + { + struct snd_kcontrol *kctl; + ++ /* Make sure that the ids assigned to the control do not wrap around */ ++ if (card->last_numid >= UINT_MAX - count) ++ card->last_numid = 0; ++ + list_for_each_entry(kctl, &card->controls, list) { + if (kctl->id.numid < card->last_numid + 1 + count && + kctl->id.numid + kctl->count > card->last_numid + 1) { +@@ -330,6 +334,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + { + struct snd_ctl_elem_id id; + unsigned int idx; ++ unsigned int count; + int err = -EINVAL; + + if (! kcontrol) +@@ -337,6 +342,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + if (snd_BUG_ON(!card || !kcontrol->info)) + goto error; + id = kcontrol->id; ++ if (id.index > UINT_MAX - kcontrol->count) ++ goto error; ++ + down_write(&card->controls_rwsem); + if (snd_ctl_find_id(card, &id)) { + up_write(&card->controls_rwsem); +@@ -358,8 +366,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -388,6 +397,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, + bool add_on_replace) + { + struct snd_ctl_elem_id id; ++ unsigned int count; + unsigned int idx; + struct snd_kcontrol *old; + int ret; +@@ -423,8 +433,9 @@ add: + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -897,9 +908,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, + result = kctl->put(kctl, control); + } + if (result > 0) { ++ struct snd_ctl_elem_id id = control->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, +- &control->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id); + return 0; + } + } +@@ -991,6 +1002,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file, + + struct user_element { + struct snd_ctl_elem_info info; ++ struct snd_card *card; + void *elem_data; /* element data */ + unsigned long elem_data_size; /* size of element data in bytes */ + void *tlv_data; /* TLV data */ +@@ -1034,7 +1046,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol, + { + struct user_element *ue = kcontrol->private_data; + ++ mutex_lock(&ue->card->user_ctl_lock); + memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return 0; + } + +@@ -1043,10 +1057,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol, + { + int change; + struct user_element *ue = kcontrol->private_data; +- ++ ++ mutex_lock(&ue->card->user_ctl_lock); + change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0; + if (change) + memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return change; + } + +@@ -1066,19 +1082,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, + new_data = memdup_user(tlv, size); + if (IS_ERR(new_data)) + return PTR_ERR(new_data); ++ mutex_lock(&ue->card->user_ctl_lock); + change = ue->tlv_data_size != size; + if (!change) + change = memcmp(ue->tlv_data, new_data, size); + kfree(ue->tlv_data); + ue->tlv_data = new_data; + ue->tlv_data_size = size; ++ mutex_unlock(&ue->card->user_ctl_lock); + } else { +- if (! ue->tlv_data_size || ! ue->tlv_data) +- return -ENXIO; +- if (size < ue->tlv_data_size) +- return -ENOSPC; ++ int ret = 0; ++ ++ mutex_lock(&ue->card->user_ctl_lock); ++ if (!ue->tlv_data_size || !ue->tlv_data) { ++ ret = -ENXIO; ++ goto err_unlock; ++ } ++ if (size < ue->tlv_data_size) { ++ ret = -ENOSPC; ++ goto err_unlock; ++ } + if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size)) +- return -EFAULT; ++ ret = -EFAULT; ++err_unlock: ++ mutex_unlock(&ue->card->user_ctl_lock); ++ if (ret) ++ return ret; + } + return change; + } +@@ -1136,8 +1165,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + struct user_element *ue; + int idx, err; + +- if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS) +- return -ENOMEM; + if (info->count < 1) + return -EINVAL; + access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : +@@ -1146,21 +1173,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)); + info->id.numid = 0; + memset(&kctl, 0, sizeof(kctl)); +- down_write(&card->controls_rwsem); +- _kctl = snd_ctl_find_id(card, &info->id); +- err = 0; +- if (_kctl) { +- if (replace) +- err = snd_ctl_remove(card, _kctl); +- else +- err = -EBUSY; +- } else { +- if (replace) +- err = -ENOENT; ++ ++ if (replace) { ++ err = snd_ctl_remove_user_ctl(file, &info->id); ++ if (err) ++ return err; + } +- up_write(&card->controls_rwsem); +- if (err < 0) +- return err; ++ ++ if (card->user_ctl_count >= MAX_USER_CONTROLS) ++ return -ENOMEM; ++ + memcpy(&kctl.id, &info->id, sizeof(info->id)); + kctl.count = info->owner ? info->owner : 1; + access |= SNDRV_CTL_ELEM_ACCESS_USER; +@@ -1210,6 +1232,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL); + if (ue == NULL) + return -ENOMEM; ++ ue->card = card; + ue->info = *info; + ue->info.access = 0; + ue->elem_data = (char *)ue + sizeof(*ue); +@@ -1321,8 +1344,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, + } + err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); + if (err > 0) { ++ struct snd_ctl_elem_id id = kctl->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id); + return 0; + } + } else { +diff --git a/sound/core/init.c b/sound/core/init.c +index 5ee83845c5de..7bdfd19e24a8 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -232,6 +232,7 @@ int snd_card_new(struct device *parent, int idx, const char *xid, + INIT_LIST_HEAD(&card->devices); + init_rwsem(&card->controls_rwsem); + rwlock_init(&card->ctl_files_rwlock); ++ mutex_init(&card->user_ctl_lock); + INIT_LIST_HEAD(&card->controls); + INIT_LIST_HEAD(&card->ctl_files); + spin_lock_init(&card->files_lock); +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index b4218a19df22..8867ab3a71d4 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1598,10 +1598,18 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll) + * Re-setup pin and infoframe. This is needed e.g. when + * - sink is first plugged-in (infoframe is not set up if !monitor_present) + * - transcoder can change during stream playback on Haswell ++ * and this can make HW reset converter selection on a pin. + */ +- if (eld->eld_valid && !old_eld_valid && per_pin->setup) ++ if (eld->eld_valid && !old_eld_valid && per_pin->setup) { ++ if (is_haswell_plus(codec) || is_valleyview(codec)) { ++ intel_verify_pin_cvt_connect(codec, per_pin); ++ intel_not_share_assigned_cvt(codec, pin_nid, ++ per_pin->mux_idx); ++ } ++ + hdmi_setup_audio_infoframe(codec, per_pin, + per_pin->non_pcm); ++ } + } + + if (eld_changed) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d943508a7f48..10014ed541cf 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4114,6 +4114,7 @@ enum { + ALC269_FIXUP_HEADSET_MIC, + ALC269_FIXUP_QUANTA_MUTE, + ALC269_FIXUP_LIFEBOOK, ++ ALC269_FIXUP_LIFEBOOK_EXTMIC, + ALC269_FIXUP_AMIC, + ALC269_FIXUP_DMIC, + ALC269VB_FIXUP_AMIC, +@@ -4243,6 +4244,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_QUANTA_MUTE + }, ++ [ALC269_FIXUP_LIFEBOOK_EXTMIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1903c }, /* headset mic, with jack detect */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -4633,14 +4641,24 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED), + /* ALC282 */ ++ SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), +@@ -4680,6 +4698,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +@@ -4702,6 +4724,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), +@@ -5809,6 +5832,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 }, + { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 }, + { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 }, ++ { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 }, + { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 }, + { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 }, + { .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 }, +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index f7b0b37aa858..0757e655bfe3 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[] = { + static bool max98090_volatile_register(struct device *dev, unsigned int reg) + { + switch (reg) { ++ case M98090_REG_SOFTWARE_RESET: + case M98090_REG_DEVICE_STATUS: + case M98090_REG_JACK_STATUS: + case M98090_REG_REVISION_ID: +@@ -2373,6 +2374,8 @@ static int max98090_runtime_resume(struct device *dev) + + regcache_cache_only(max98090->regmap, false); + ++ max98090_reset(max98090); ++ + regcache_sync(max98090->regmap); + + return 0; +diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c +index d7349bc89ad3..e12fafbb1e09 100644 +--- a/sound/soc/codecs/tlv320aic3x.c ++++ b/sound/soc/codecs/tlv320aic3x.c +@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(struct snd_kcontrol *kcontrol, + mask <<= shift; + val <<= shift; + +- change = snd_soc_test_bits(codec, val, mask, reg); ++ change = snd_soc_test_bits(codec, reg, mask, val); + if (change) { + update.kcontrol = kcontrol; + update.reg = reg; +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 6d6ceee447d5..ebb03a886593 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2857,22 +2857,19 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); + + change = dapm_kcontrol_set_value(kcontrol, val); +- +- if (reg != SND_SOC_NOPM) { +- mask = mask << shift; +- val = val << shift; +- +- change = snd_soc_test_bits(codec, reg, mask, val); +- } +- + if (change) { + if (reg != SND_SOC_NOPM) { +- update.kcontrol = kcontrol; +- update.reg = reg; +- update.mask = mask; +- update.val = val; ++ mask = mask << shift; ++ val = val << shift; ++ ++ if (snd_soc_test_bits(codec, reg, mask, val)) { ++ update.kcontrol = kcontrol; ++ update.reg = reg; ++ update.mask = mask; ++ update.val = val; ++ card->update = &update; ++ } + +- card->update = &update; + } + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect); |