diff options
author | Mike Pagano <mpagano@gentoo.org> | 2019-05-04 14:26:52 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2019-05-04 14:26:52 -0400 |
commit | 02b66ae02c48faebac4ae52351c19b630ee72b1c (patch) | |
tree | 7298ee5348ddfb2ac385b36cf8c03d9f136ff74d | |
parent | Linux patch 4.14.115 (diff) | |
download | linux-patches-02b66ae0.tar.gz linux-patches-02b66ae0.tar.bz2 linux-patches-02b66ae0.zip |
Linux patch 4.14.116
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1115_linux-4.14.116.patch | 1645 |
2 files changed, 1649 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 937317e9..b8d93d42 100644 --- a/0000_README +++ b/0000_README @@ -503,6 +503,10 @@ Patch: 1114_4.14.115.patch From: http://www.kernel.org Desc: Linux 4.14.115 +Patch: 1115_4.14.116.patch +From: http://www.kernel.org +Desc: Linux 4.14.116 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1115_linux-4.14.116.patch b/1115_linux-4.14.116.patch new file mode 100644 index 00000000..90f357fa --- /dev/null +++ b/1115_linux-4.14.116.patch @@ -0,0 +1,1645 @@ +diff --git a/Makefile b/Makefile +index b27ffc1814e8..7dcaffff08a3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 115 ++SUBLEVEL = 116 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts +index 4bc70efe43d6..3178a5664942 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts +@@ -93,7 +93,7 @@ + }; + + &hdmi { +- hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>; + }; + + &uart0 { +diff --git a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi +index 7ca291e9dbdb..80f1b3fb6abc 100644 +--- a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi +@@ -222,7 +222,7 @@ + pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + vmcc-supply = <®_sd3_vmmc>; + cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; +- bus-witdh = <4>; ++ bus-width = <4>; + no-1-8-v; + status = "okay"; + }; +@@ -233,7 +233,7 @@ + pinctrl-1 = <&pinctrl_usdhc4_100mhz>; + pinctrl-2 = <&pinctrl_usdhc4_200mhz>; + vmcc-supply = <®_sd4_vmmc>; +- bus-witdh = <8>; ++ bus-width = <8>; + no-1-8-v; + non-removable; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +index d81b0078a100..25b0704c6054 100644 +--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +@@ -89,6 +89,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; ++ phy-reset-duration = <10>; /* in msecs */ + phy-reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>; + phy-supply = <&vdd_eth_io_reg>; + status = "disabled"; +diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h +index 1a61b1b997f2..3055c030f765 100644 +--- a/arch/s390/include/asm/elf.h ++++ b/arch/s390/include/asm/elf.h +@@ -252,11 +252,14 @@ do { \ + + /* + * Cache aliasing on the latest machines calls for a mapping granularity +- * of 512KB. For 64-bit processes use a 512KB alignment and a randomization +- * of up to 1GB. For 31-bit processes the virtual address space is limited, +- * use no alignment and limit the randomization to 8MB. ++ * of 512KB for the anonymous mapping base. For 64-bit processes use a ++ * 512KB alignment and a randomization of up to 1GB. For 31-bit processes ++ * the virtual address space is limited, use no alignment and limit the ++ * randomization to 8MB. ++ * For the additional randomization of the program break use 32MB for ++ * 64-bit and 8MB for 31-bit. + */ +-#define BRK_RND_MASK (is_compat_task() ? 0x7ffUL : 0x3ffffUL) ++#define BRK_RND_MASK (is_compat_task() ? 0x7ffUL : 0x1fffUL) + #define MMAP_RND_MASK (is_compat_task() ? 0x7ffUL : 0x3ff80UL) + #define MMAP_ALIGN_MASK (is_compat_task() ? 0 : 0x7fUL) + #define STACK_RND_MASK MMAP_RND_MASK +diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c +index b3ed8f9953a8..173e6f2dd9af 100644 +--- a/drivers/ata/libata-zpodd.c ++++ b/drivers/ata/libata-zpodd.c +@@ -52,38 +52,52 @@ static int eject_tray(struct ata_device *dev) + /* Per the spec, only slot type and drawer type ODD can be supported */ + static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev) + { +- char buf[16]; ++ char *buf; + unsigned int ret; +- struct rm_feature_desc *desc = (void *)(buf + 8); ++ struct rm_feature_desc *desc; + struct ata_taskfile tf; + static const char cdb[] = { GPCMD_GET_CONFIGURATION, + 2, /* only 1 feature descriptor requested */ + 0, 3, /* 3, removable medium feature */ + 0, 0, 0,/* reserved */ +- 0, sizeof(buf), ++ 0, 16, + 0, 0, 0, + }; + ++ buf = kzalloc(16, GFP_KERNEL); ++ if (!buf) ++ return ODD_MECH_TYPE_UNSUPPORTED; ++ desc = (void *)(buf + 8); ++ + ata_tf_init(dev, &tf); + tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; + tf.command = ATA_CMD_PACKET; + tf.protocol = ATAPI_PROT_PIO; +- tf.lbam = sizeof(buf); ++ tf.lbam = 16; + + ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE, +- buf, sizeof(buf), 0); +- if (ret) ++ buf, 16, 0); ++ if (ret) { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + +- if (be16_to_cpu(desc->feature_code) != 3) ++ if (be16_to_cpu(desc->feature_code) != 3) { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + +- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) ++ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) { ++ kfree(buf); + return ODD_MECH_TYPE_SLOT; +- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1) ++ } else if (desc->mech_type == 1 && desc->load == 0 && ++ desc->eject == 1) { ++ kfree(buf); + return ODD_MECH_TYPE_DRAWER; +- else ++ } else { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + } + + /* Test if ODD is zero power ready by sense code */ +diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c +index f03fe916eb9d..f6d1bda8a802 100644 +--- a/drivers/gpio/gpio-aspeed.c ++++ b/drivers/gpio/gpio-aspeed.c +@@ -861,6 +861,8 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev) + + gpio->offset_timer = + devm_kzalloc(&pdev->dev, gpio->chip.ngpio, GFP_KERNEL); ++ if (!gpio->offset_timer) ++ return -ENOMEM; + + return aspeed_gpio_setup_irqs(gpio, pdev); + } +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index ee8c046cab62..d6ed4e891b34 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -499,7 +499,13 @@ int of_gpiochip_add(struct gpio_chip *chip) + + of_node_get(chip->of_node); + +- return of_gpiochip_scan_gpios(chip); ++ status = of_gpiochip_scan_gpios(chip); ++ if (status) { ++ of_node_put(chip->of_node); ++ gpiochip_remove_pin_ranges(chip); ++ } ++ ++ return status; + } + + void of_gpiochip_remove(struct gpio_chip *chip) +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 5deb44ac6791..0608243c3387 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -277,10 +277,12 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + ret = drm_dev_register(drm, 0); + if (ret) +- goto free_drm; ++ goto uninstall_irq; + + return 0; + ++uninstall_irq: ++ drm_irq_uninstall(drm); + free_drm: + drm_dev_unref(drm); + +@@ -294,10 +296,11 @@ static int meson_drv_bind(struct device *dev) + + static void meson_drv_unbind(struct device *dev) + { +- struct drm_device *drm = dev_get_drvdata(dev); +- struct meson_drm *priv = drm->dev_private; ++ struct meson_drm *priv = dev_get_drvdata(dev); ++ struct drm_device *drm = priv->drm; + + drm_dev_unregister(drm); ++ drm_irq_uninstall(drm); + drm_kms_helper_poll_fini(drm); + drm_fbdev_cma_fini(priv->fbdev); + drm_mode_config_cleanup(drm); +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index bd339bfe0d15..684f7cdd814b 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -3127,21 +3127,24 @@ static void amd_iommu_get_resv_regions(struct device *dev, + return; + + list_for_each_entry(entry, &amd_iommu_unity_map, list) { ++ int type, prot = 0; + size_t length; +- int prot = 0; + + if (devid < entry->devid_start || devid > entry->devid_end) + continue; + ++ type = IOMMU_RESV_DIRECT; + length = entry->address_end - entry->address_start; + if (entry->prot & IOMMU_PROT_IR) + prot |= IOMMU_READ; + if (entry->prot & IOMMU_PROT_IW) + prot |= IOMMU_WRITE; ++ if (entry->prot & IOMMU_UNITY_MAP_FLAG_EXCL_RANGE) ++ /* Exclusion range */ ++ type = IOMMU_RESV_RESERVED; + + region = iommu_alloc_resv_region(entry->address_start, +- length, prot, +- IOMMU_RESV_DIRECT); ++ length, prot, type); + if (!region) { + pr_err("Out of memory allocating dm-regions for %s\n", + dev_name(dev)); +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index b97984a5ddad..91d7718625a6 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -1980,6 +1980,9 @@ static int __init init_unity_map_range(struct ivmd_header *m) + if (e == NULL) + return -ENOMEM; + ++ if (m->flags & IVMD_FLAG_EXCL_RANGE) ++ init_exclusion_range(m); ++ + switch (m->type) { + default: + kfree(e); +@@ -2026,9 +2029,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table) + + while (p < end) { + m = (struct ivmd_header *)p; +- if (m->flags & IVMD_FLAG_EXCL_RANGE) +- init_exclusion_range(m); +- else if (m->flags & IVMD_FLAG_UNITY_MAP) ++ if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE)) + init_unity_map_range(m); + + p += m->length; +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index f6b24c7d8b70..3054c0971759 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -369,6 +369,8 @@ + #define IOMMU_PROT_IR 0x01 + #define IOMMU_PROT_IW 0x02 + ++#define IOMMU_UNITY_MAP_FLAG_EXCL_RANGE (1 << 2) ++ + /* IOMMU capabilities */ + #define IOMMU_CAP_IOTLB 24 + #define IOMMU_CAP_NPCACHE 26 +diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c +index 7fea18b0c15d..7cb4d685a1f1 100644 +--- a/drivers/leds/leds-pca9532.c ++++ b/drivers/leds/leds-pca9532.c +@@ -513,6 +513,7 @@ static int pca9532_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { + int devid; ++ const struct of_device_id *of_id; + struct pca9532_data *data = i2c_get_clientdata(client); + struct pca9532_platform_data *pca9532_pdata = + dev_get_platdata(&client->dev); +@@ -528,8 +529,11 @@ static int pca9532_probe(struct i2c_client *client, + dev_err(&client->dev, "no platform data\n"); + return -EINVAL; + } +- devid = (int)(uintptr_t)of_match_device( +- of_pca9532_leds_match, &client->dev)->data; ++ of_id = of_match_device(of_pca9532_leds_match, ++ &client->dev); ++ if (unlikely(!of_id)) ++ return -EINVAL; ++ devid = (int)(uintptr_t) of_id->data; + } else { + devid = id->driver_data; + } +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 9046993947cc..2287749de087 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2817,14 +2817,20 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, + *hclk = devm_clk_get(&pdev->dev, "hclk"); + } + +- if (IS_ERR(*pclk)) { ++ if (IS_ERR_OR_NULL(*pclk)) { + err = PTR_ERR(*pclk); ++ if (!err) ++ err = -ENODEV; ++ + dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err); + return err; + } + +- if (IS_ERR(*hclk)) { ++ if (IS_ERR_OR_NULL(*hclk)) { + err = PTR_ERR(*hclk); ++ if (!err) ++ err = -ENODEV; ++ + dev_err(&pdev->dev, "failed to get hclk (%u)\n", err); + return err; + } +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 4878b7169e0f..30cbdf0fed59 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -3176,6 +3176,7 @@ static ssize_t ehea_probe_port(struct device *dev, + + if (ehea_add_adapter_mr(adapter)) { + pr_err("creating MR failed\n"); ++ of_node_put(eth_dn); + return -EIO; + } + +diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c +index 2fe96f1f3fe5..7ddaa7d88f1d 100644 +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -526,9 +526,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) + /* set dma read address */ + ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00); + +- /* start the packet dma process, and set auto-dequeue rx */ +- ks8851_wrreg16(ks, KS_RXQCR, +- ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE); ++ /* start DMA access */ ++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); + + if (rxlen > 4) { + unsigned int rxalign; +@@ -559,7 +558,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) + } + } + +- ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr); ++ /* end DMA access and dequeue packet */ ++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_RRXEF); + } + } + +@@ -776,6 +776,15 @@ static void ks8851_tx_work(struct work_struct *work) + static int ks8851_net_open(struct net_device *dev) + { + struct ks8851_net *ks = netdev_priv(dev); ++ int ret; ++ ++ ret = request_threaded_irq(dev->irq, NULL, ks8851_irq, ++ IRQF_TRIGGER_LOW | IRQF_ONESHOT, ++ dev->name, ks); ++ if (ret < 0) { ++ netdev_err(dev, "failed to get irq\n"); ++ return ret; ++ } + + /* lock the card, even if we may not actually be doing anything + * else at the moment */ +@@ -840,6 +849,7 @@ static int ks8851_net_open(struct net_device *dev) + netif_dbg(ks, ifup, ks->netdev, "network device up\n"); + + mutex_unlock(&ks->lock); ++ mii_check_link(&ks->mii); + return 0; + } + +@@ -890,6 +900,8 @@ static int ks8851_net_stop(struct net_device *dev) + dev_kfree_skb(txb); + } + ++ free_irq(dev->irq, ks); ++ + return 0; + } + +@@ -1499,6 +1511,7 @@ static int ks8851_probe(struct spi_device *spi) + + spi_set_drvdata(spi, ks); + ++ netif_carrier_off(ks->netdev); + ndev->if_port = IF_PORT_100BASET; + ndev->netdev_ops = &ks8851_netdev_ops; + ndev->irq = spi->irq; +@@ -1520,14 +1533,6 @@ static int ks8851_probe(struct spi_device *spi) + ks8851_read_selftest(ks); + ks8851_init_mac(ks); + +- ret = request_threaded_irq(spi->irq, NULL, ks8851_irq, +- IRQF_TRIGGER_LOW | IRQF_ONESHOT, +- ndev->name, ks); +- if (ret < 0) { +- dev_err(&spi->dev, "failed to get irq\n"); +- goto err_irq; +- } +- + ret = register_netdev(ndev); + if (ret) { + dev_err(&spi->dev, "failed to register network device\n"); +@@ -1540,14 +1545,10 @@ static int ks8851_probe(struct spi_device *spi) + + return 0; + +- + err_netdev: +- free_irq(ndev->irq, ks); +- +-err_irq: ++err_id: + if (gpio_is_valid(gpio)) + gpio_set_value(gpio, 0); +-err_id: + regulator_disable(ks->vdd_reg); + err_reg: + regulator_disable(ks->vdd_io); +@@ -1565,7 +1566,6 @@ static int ks8851_remove(struct spi_device *spi) + dev_info(&spi->dev, "remove\n"); + + unregister_netdev(priv->netdev); +- free_irq(spi->irq, priv); + if (gpio_is_valid(priv->gpio)) + gpio_set_value(priv->gpio, 0); + regulator_disable(priv->vdd_reg); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index 7f7deeaf1cf0..da042bc520d4 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1047,6 +1047,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); ++ if (!skb) ++ break; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c +index 28cb38af1a34..ff7a71ca0b13 100644 +--- a/drivers/net/ethernet/ti/netcp_ethss.c ++++ b/drivers/net/ethernet/ti/netcp_ethss.c +@@ -3538,12 +3538,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev, + + ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device, + gbe_dev->dma_chan_name, gbe_dev->tx_queue_id); +- if (ret) ++ if (ret) { ++ of_node_put(interfaces); + return ret; ++ } + + ret = netcp_txpipe_open(&gbe_dev->tx_pipe); +- if (ret) ++ if (ret) { ++ of_node_put(interfaces); + return ret; ++ } + + /* Create network interfaces */ + INIT_LIST_HEAD(&gbe_dev->gbe_intf_head); +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index e74e1e897864..d46dc8cd1670 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1575,12 +1575,14 @@ static int axienet_probe(struct platform_device *pdev) + ret = of_address_to_resource(np, 0, &dmares); + if (ret) { + dev_err(&pdev->dev, "unable to get DMA resource\n"); ++ of_node_put(np); + goto free_netdev; + } + lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares); + if (IS_ERR(lp->dma_regs)) { + dev_err(&pdev->dev, "could not map DMA regs\n"); + ret = PTR_ERR(lp->dma_regs); ++ of_node_put(np); + goto free_netdev; + } + lp->rx_irq = irq_of_parse_and_map(np, 1); +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index aabbcfb6e6da..3d8a70d3ea9b 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -148,6 +148,7 @@ struct ipheth_device { + u8 bulk_in; + u8 bulk_out; + struct delayed_work carrier_work; ++ bool confirmed_pairing; + }; + + static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags); +@@ -259,7 +260,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + + dev->net->stats.rx_packets++; + dev->net->stats.rx_bytes += len; +- ++ dev->confirmed_pairing = true; + netif_rx(skb); + ipheth_rx_submit(dev, GFP_ATOMIC); + } +@@ -280,14 +281,24 @@ static void ipheth_sndbulk_callback(struct urb *urb) + dev_err(&dev->intf->dev, "%s: urb status: %d\n", + __func__, status); + +- netif_wake_queue(dev->net); ++ if (status == 0) ++ netif_wake_queue(dev->net); ++ else ++ // on URB error, trigger immediate poll ++ schedule_delayed_work(&dev->carrier_work, 0); + } + + static int ipheth_carrier_set(struct ipheth_device *dev) + { +- struct usb_device *udev = dev->udev; ++ struct usb_device *udev; + int retval; + ++ if (!dev) ++ return 0; ++ if (!dev->confirmed_pairing) ++ return 0; ++ ++ udev = dev->udev; + retval = usb_control_msg(udev, + usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP), + IPHETH_CMD_CARRIER_CHECK, /* request */ +@@ -302,11 +313,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev) + return retval; + } + +- if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ++ if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) { + netif_carrier_on(dev->net); +- else ++ if (dev->tx_urb->status != -EINPROGRESS) ++ netif_wake_queue(dev->net); ++ } else { + netif_carrier_off(dev->net); +- ++ netif_stop_queue(dev->net); ++ } + return 0; + } + +@@ -386,7 +400,6 @@ static int ipheth_open(struct net_device *net) + return retval; + + schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT); +- netif_start_queue(net); + return retval; + } + +@@ -489,7 +502,7 @@ static int ipheth_probe(struct usb_interface *intf, + dev->udev = udev; + dev->net = netdev; + dev->intf = intf; +- ++ dev->confirmed_pairing = false; + /* Set up endpoints */ + hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM); + if (hintf == NULL) { +@@ -540,7 +553,9 @@ static int ipheth_probe(struct usb_interface *intf, + retval = -EIO; + goto err_register_netdev; + } +- ++ // carrier down and transmit queues stopped until packet from device ++ netif_carrier_off(netdev); ++ netif_tx_stop_all_queues(netdev); + dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n"); + return 0; + +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index a19f2dc69e8a..d9830c86d0c1 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3022,12 +3022,14 @@ static int qeth_l3_probe_device(struct ccwgroup_device *gdev) + struct qeth_card *card = dev_get_drvdata(&gdev->dev); + int rc; + ++ hash_init(card->ip_htable); ++ + if (gdev->dev.type == &qeth_generic_devtype) { + rc = qeth_l3_create_device_attributes(&gdev->dev); + if (rc) + return rc; + } +- hash_init(card->ip_htable); ++ + hash_init(card->ip_mc_htable); + card->options.layer2 = 0; + card->info.hwtrap = 0; +diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c +index ca218c82321f..0c5fd722a72d 100644 +--- a/drivers/s390/scsi/zfcp_fc.c ++++ b/drivers/s390/scsi/zfcp_fc.c +@@ -240,10 +240,6 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, + list_for_each_entry(port, &adapter->port_list, list) { + if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range)) + zfcp_fc_test_link(port); +- if (!port->d_id) +- zfcp_erp_port_reopen(port, +- ZFCP_STATUS_COMMON_ERP_FAILED, +- "fcrscn1"); + } + read_unlock_irqrestore(&adapter->port_list_lock, flags); + } +@@ -251,6 +247,7 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, + static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) + { + struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data; ++ struct zfcp_adapter *adapter = fsf_req->adapter; + struct fc_els_rscn *head; + struct fc_els_rscn_page *page; + u16 i; +@@ -264,6 +261,22 @@ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) + no_entries = be16_to_cpu(head->rscn_plen) / + sizeof(struct fc_els_rscn_page); + ++ if (no_entries > 1) { ++ /* handle failed ports */ ++ unsigned long flags; ++ struct zfcp_port *port; ++ ++ read_lock_irqsave(&adapter->port_list_lock, flags); ++ list_for_each_entry(port, &adapter->port_list, list) { ++ if (port->d_id) ++ continue; ++ zfcp_erp_port_reopen(port, ++ ZFCP_STATUS_COMMON_ERP_FAILED, ++ "fcrscn1"); ++ } ++ read_unlock_irqrestore(&adapter->port_list_lock, flags); ++ } ++ + for (i = 1; i < no_entries; i++) { + /* skip head and start with 1st element */ + page++; +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 22dc70a2138e..630b7404843d 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -3207,6 +3207,8 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session, + if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) + return -EINVAL; + ep = iscsi_lookup_endpoint(transport_fd); ++ if (!ep) ++ return -EINVAL; + conn = cls_conn->dd_data; + qla_conn = conn->dd_data; + qla_conn->qla_ep = ep->dd_data; +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index be2f46eb9f78..904b988ecc4e 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -188,7 +188,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) + + pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf; + +- rtw_alloc_hwxmits(padapter); ++ res = rtw_alloc_hwxmits(padapter); ++ if (res == _FAIL) ++ goto exit; + rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry); + + for (i = 0; i < 4; i++) +@@ -1573,7 +1575,7 @@ exit: + return res; + } + +-void rtw_alloc_hwxmits(struct adapter *padapter) ++s32 rtw_alloc_hwxmits(struct adapter *padapter) + { + struct hw_xmit *hwxmits; + struct xmit_priv *pxmitpriv = &padapter->xmitpriv; +@@ -1582,6 +1584,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) + + pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry, + sizeof(struct hw_xmit), GFP_KERNEL); ++ if (!pxmitpriv->hwxmits) ++ return _FAIL; + + hwxmits = pxmitpriv->hwxmits; + +@@ -1589,6 +1593,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter) + hwxmits[1] .sta_queue = &pxmitpriv->vi_pending; + hwxmits[2] .sta_queue = &pxmitpriv->be_pending; + hwxmits[3] .sta_queue = &pxmitpriv->bk_pending; ++ return _SUCCESS; + } + + void rtw_free_hwxmits(struct adapter *padapter) +diff --git a/drivers/staging/rtl8188eu/include/rtw_xmit.h b/drivers/staging/rtl8188eu/include/rtw_xmit.h +index dd6b7a9a8d4a..1be4b478475a 100644 +--- a/drivers/staging/rtl8188eu/include/rtw_xmit.h ++++ b/drivers/staging/rtl8188eu/include/rtw_xmit.h +@@ -342,7 +342,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter, + void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry); + s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter); + void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv); +-void rtw_alloc_hwxmits(struct adapter *padapter); ++s32 rtw_alloc_hwxmits(struct adapter *padapter); + void rtw_free_hwxmits(struct adapter *padapter); + s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt); + +diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c +index 0104aced113e..ccda04e916c5 100644 +--- a/drivers/staging/rtl8712/rtl8712_cmd.c ++++ b/drivers/staging/rtl8712/rtl8712_cmd.c +@@ -159,17 +159,9 @@ static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) + + static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) + { +- u32 val; +- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); + struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; + +- if (pcmd->rsp && pcmd->rspsz > 0) +- memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz); +- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; +- if (!pcmd_callback) +- r8712_free_cmd_obj(pcmd); +- else +- pcmd_callback(padapter, pcmd); ++ r8712_free_cmd_obj(pcmd); + return H2C_SUCCESS; + } + +diff --git a/drivers/staging/rtl8712/rtl8712_cmd.h b/drivers/staging/rtl8712/rtl8712_cmd.h +index 67e9e910aef9..d10a59d4a550 100644 +--- a/drivers/staging/rtl8712/rtl8712_cmd.h ++++ b/drivers/staging/rtl8712/rtl8712_cmd.h +@@ -152,7 +152,7 @@ enum rtl8712_h2c_cmd { + static struct _cmd_callback cmd_callback[] = { + {GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/ + {GEN_CMD_CODE(_Write_MACREG), NULL}, +- {GEN_CMD_CODE(_Read_BBREG), &r8712_getbbrfreg_cmdrsp_callback}, ++ {GEN_CMD_CODE(_Read_BBREG), NULL}, + {GEN_CMD_CODE(_Write_BBREG), NULL}, + {GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback}, + {GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/ +diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rtl8723bs/core/rtw_xmit.c +index 022f654419e4..91dab7f8a739 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c ++++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c +@@ -271,7 +271,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) + } + } + +- rtw_alloc_hwxmits(padapter); ++ res = rtw_alloc_hwxmits(padapter); ++ if (res == _FAIL) ++ goto exit; + rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry); + + for (i = 0; i < 4; i++) { +@@ -2157,7 +2159,7 @@ exit: + return res; + } + +-void rtw_alloc_hwxmits(struct adapter *padapter) ++s32 rtw_alloc_hwxmits(struct adapter *padapter) + { + struct hw_xmit *hwxmits; + struct xmit_priv *pxmitpriv = &padapter->xmitpriv; +@@ -2168,10 +2170,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) + + pxmitpriv->hwxmits = (struct hw_xmit *)rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry); + +- if (pxmitpriv->hwxmits == NULL) { +- DBG_871X("alloc hwxmits fail!...\n"); +- return; +- } ++ if (!pxmitpriv->hwxmits) ++ return _FAIL; + + hwxmits = pxmitpriv->hwxmits; + +@@ -2217,7 +2217,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter) + + } + +- ++ return _SUCCESS; + } + + void rtw_free_hwxmits(struct adapter *padapter) +diff --git a/drivers/staging/rtl8723bs/include/rtw_xmit.h b/drivers/staging/rtl8723bs/include/rtw_xmit.h +index 11571649cd2c..92236ca8a1ef 100644 +--- a/drivers/staging/rtl8723bs/include/rtw_xmit.h ++++ b/drivers/staging/rtl8723bs/include/rtw_xmit.h +@@ -494,7 +494,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter); + void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv); + + +-void rtw_alloc_hwxmits(struct adapter *padapter); ++s32 rtw_alloc_hwxmits(struct adapter *padapter); + void rtw_free_hwxmits(struct adapter *padapter); + + +diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c b/drivers/staging/rtlwifi/phydm/rtl_phydm.c +index 85e490d3601f..cab563fefc34 100644 +--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c ++++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c +@@ -191,6 +191,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv, + + rtlpriv->phydm.internal = + kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL); ++ if (!rtlpriv->phydm.internal) ++ return 0; + + _rtl_phydm_init_com_info(rtlpriv, ic, params); + +diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c +index acabb2470d55..02ca3157c5a5 100644 +--- a/drivers/staging/rtlwifi/rtl8822be/fw.c ++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c +@@ -752,6 +752,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished) + u1_rsvd_page_loc, 3); + + skb = dev_alloc_skb(totalpacketlen); ++ if (!skb) ++ return; + memcpy((u8 *)skb_put(skb, totalpacketlen), &reserved_page_packet, + totalpacketlen); + +diff --git a/drivers/tty/serial/ar933x_uart.c b/drivers/tty/serial/ar933x_uart.c +index decc7f3c1ab2..ed545a61413c 100644 +--- a/drivers/tty/serial/ar933x_uart.c ++++ b/drivers/tty/serial/ar933x_uart.c +@@ -52,11 +52,6 @@ struct ar933x_uart_port { + struct clk *clk; + }; + +-static inline bool ar933x_uart_console_enabled(void) +-{ +- return IS_ENABLED(CONFIG_SERIAL_AR933X_CONSOLE); +-} +- + static inline unsigned int ar933x_uart_read(struct ar933x_uart_port *up, + int offset) + { +@@ -511,6 +506,7 @@ static const struct uart_ops ar933x_uart_ops = { + .verify_port = ar933x_uart_verify_port, + }; + ++#ifdef CONFIG_SERIAL_AR933X_CONSOLE + static struct ar933x_uart_port * + ar933x_console_ports[CONFIG_SERIAL_AR933X_NR_UARTS]; + +@@ -607,14 +603,7 @@ static struct console ar933x_uart_console = { + .index = -1, + .data = &ar933x_uart_driver, + }; +- +-static void ar933x_uart_add_console_port(struct ar933x_uart_port *up) +-{ +- if (!ar933x_uart_console_enabled()) +- return; +- +- ar933x_console_ports[up->port.line] = up; +-} ++#endif /* CONFIG_SERIAL_AR933X_CONSOLE */ + + static struct uart_driver ar933x_uart_driver = { + .owner = THIS_MODULE, +@@ -703,7 +692,9 @@ static int ar933x_uart_probe(struct platform_device *pdev) + baud = ar933x_uart_get_baud(port->uartclk, 0, AR933X_UART_MAX_STEP); + up->max_baud = min_t(unsigned int, baud, AR933X_UART_MAX_BAUD); + +- ar933x_uart_add_console_port(up); ++#ifdef CONFIG_SERIAL_AR933X_CONSOLE ++ ar933x_console_ports[up->port.line] = up; ++#endif + + ret = uart_add_one_port(&ar933x_uart_driver, &up->port); + if (ret) +@@ -752,8 +743,9 @@ static int __init ar933x_uart_init(void) + { + int ret; + +- if (ar933x_uart_console_enabled()) +- ar933x_uart_driver.cons = &ar933x_uart_console; ++#ifdef CONFIG_SERIAL_AR933X_CONSOLE ++ ar933x_uart_driver.cons = &ar933x_uart_console; ++#endif + + ret = uart_register_driver(&ar933x_uart_driver); + if (ret) +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index a79f18edf2bd..e48523da47ac 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1483,7 +1483,7 @@ static int __init sc16is7xx_init(void) + ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver); + if (ret < 0) { + pr_err("failed to init sc16is7xx i2c --> %d\n", ret); +- return ret; ++ goto err_i2c; + } + #endif + +@@ -1491,10 +1491,18 @@ static int __init sc16is7xx_init(void) + ret = spi_register_driver(&sc16is7xx_spi_uart_driver); + if (ret < 0) { + pr_err("failed to init sc16is7xx spi --> %d\n", ret); +- return ret; ++ goto err_spi; + } + #endif + return ret; ++ ++err_spi: ++#ifdef CONFIG_SERIAL_SC16IS7XX_I2C ++ i2c_del_driver(&sc16is7xx_i2c_uart_driver); ++#endif ++err_i2c: ++ uart_unregister_driver(&sc16is7xx_uart); ++ return ret; + } + module_init(sc16is7xx_init); + +diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c +index e0759a826b60..7fb31a3b53e6 100644 +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -958,6 +958,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req) + break; + } + if (&req->req != _req) { ++ ep->stopped = stopped; + spin_unlock_irqrestore(&ep->dev->lock, flags); + return -EINVAL; + } +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 9cbb061582a7..170327f84ea1 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -870,9 +870,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma) + (void) readl(&ep->dev->pci->pcimstctl); + + writel(BIT(DMA_START), &dma->dmastat); +- +- if (!ep->is_in) +- stop_out_naking(ep); + } + + static void start_dma(struct net2280_ep *ep, struct net2280_request *req) +@@ -911,6 +908,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req) + writel(BIT(DMA_START), &dma->dmastat); + return; + } ++ stop_out_naking(ep); + } + + tmp = dmactl_default; +@@ -1279,9 +1277,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req) + break; + } + if (&req->req != _req) { ++ ep->stopped = stopped; + spin_unlock_irqrestore(&ep->dev->lock, flags); +- dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n", +- __func__); ++ ep_dbg(ep->dev, "%s: Request mismatch\n", __func__); + return -EINVAL; + } + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 65c0086e25ae..8d349230b2c7 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -3208,6 +3208,9 @@ static int __init u132_hcd_init(void) + printk(KERN_INFO "driver %s\n", hcd_name); + workqueue = create_singlethread_workqueue("u132"); + retval = platform_driver_register(&u132_platform_driver); ++ if (retval) ++ destroy_workqueue(workqueue); ++ + return retval; + } + +diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c +index 135c91c434bf..ba8fcdb377e8 100644 +--- a/drivers/usb/misc/usb251xb.c ++++ b/drivers/usb/misc/usb251xb.c +@@ -530,7 +530,7 @@ static int usb251xb_probe(struct usb251xb *hub) + dev); + int err; + +- if (np) { ++ if (np && of_id) { + err = usb251xb_get_ofdata(hub, + (struct usb251xb_data *)of_id->data); + if (err) { +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index a1492bdc6d03..f2b722f0df5d 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -520,6 +520,7 @@ static void ceph_i_callback(struct rcu_head *head) + struct inode *inode = container_of(head, struct inode, i_rcu); + struct ceph_inode_info *ci = ceph_inode(inode); + ++ kfree(ci->i_symlink); + kmem_cache_free(ceph_inode_cachep, ci); + } + +@@ -551,7 +552,6 @@ void ceph_destroy_inode(struct inode *inode) + ceph_put_snap_realm(mdsc, realm); + } + +- kfree(ci->i_symlink); + while ((n = rb_first(&ci->i_fragtree)) != NULL) { + frag = rb_entry(n, struct ceph_inode_frag, node); + rb_erase(n, &ci->i_fragtree); +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 63fd33383413..770733106d6d 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -1981,10 +1981,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, + rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len; + + ret = -EINVAL; +- if (rem < len) { +- pipe_unlock(pipe); +- goto out; +- } ++ if (rem < len) ++ goto out_free; + + rem = len; + while (rem) { +@@ -2002,7 +2000,9 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, + pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1); + pipe->nrbufs--; + } else { +- pipe_buf_get(pipe, ibuf); ++ if (!pipe_buf_get(pipe, ibuf)) ++ goto out_free; ++ + *obuf = *ibuf; + obuf->flags &= ~PIPE_BUF_FLAG_GIFT; + obuf->len = rem; +@@ -2025,11 +2025,11 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, + ret = fuse_dev_do_write(fud, &cs, len); + + pipe_lock(pipe); ++out_free: + for (idx = 0; idx < nbuf; idx++) + pipe_buf_release(pipe, &bufs[idx]); + pipe_unlock(pipe); + +-out: + kfree(bufs); + return ret; + } +diff --git a/fs/nfs/client.c b/fs/nfs/client.c +index 7d6ddfd60271..a98d64a6eda5 100644 +--- a/fs/nfs/client.c ++++ b/fs/nfs/client.c +@@ -459,7 +459,7 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto, + case XPRT_TRANSPORT_RDMA: + if (retrans == NFS_UNSPEC_RETRANS) + to->to_retries = NFS_DEF_TCP_RETRANS; +- if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0) ++ if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0) + to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10; + if (to->to_initval > NFS_MAX_TCP_TIMEOUT) + to->to_initval = NFS_MAX_TCP_TIMEOUT; +diff --git a/fs/pipe.c b/fs/pipe.c +index 8f9628494981..fa3c2c25cec5 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -194,9 +194,9 @@ EXPORT_SYMBOL(generic_pipe_buf_steal); + * in the tee() system call, when we duplicate the buffers in one + * pipe into another. + */ +-void generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf) ++bool generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf) + { +- get_page(buf->page); ++ return try_get_page(buf->page); + } + EXPORT_SYMBOL(generic_pipe_buf_get); + +diff --git a/fs/splice.c b/fs/splice.c +index a598d444abe1..c84ac7e97e21 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -1571,7 +1571,11 @@ retry: + * Get a reference to this pipe buffer, + * so we can copy the contents over. + */ +- pipe_buf_get(ipipe, ibuf); ++ if (!pipe_buf_get(ipipe, ibuf)) { ++ if (ret == 0) ++ ret = -EFAULT; ++ break; ++ } + *obuf = *ibuf; + + /* +@@ -1645,7 +1649,11 @@ static int link_pipe(struct pipe_inode_info *ipipe, + * Get a reference to this pipe buffer, + * so we can copy the contents over. + */ +- pipe_buf_get(ipipe, ibuf); ++ if (!pipe_buf_get(ipipe, ibuf)) { ++ if (ret == 0) ++ ret = -EFAULT; ++ break; ++ } + + obuf = opipe->bufs + nbuf; + *obuf = *ibuf; +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 58f2263de4de..ee0eae215210 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -824,6 +824,10 @@ static inline bool is_device_public_page(const struct page *page) + #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */ + + ++/* 127: arbitrary random number, small enough to assemble well */ ++#define page_ref_zero_or_close_to_overflow(page) \ ++ ((unsigned int) page_ref_count(page) + 127u <= 127u) ++ + static inline void get_page(struct page *page) + { + page = compound_head(page); +@@ -831,8 +835,17 @@ static inline void get_page(struct page *page) + * Getting a normal page or the head of a compound page + * requires to already have an elevated page->_refcount. + */ +- VM_BUG_ON_PAGE(page_ref_count(page) <= 0, page); ++ VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page); ++ page_ref_inc(page); ++} ++ ++static inline __must_check bool try_get_page(struct page *page) ++{ ++ page = compound_head(page); ++ if (WARN_ON_ONCE(page_ref_count(page) <= 0)) ++ return false; + page_ref_inc(page); ++ return true; + } + + static inline void put_page(struct page *page) +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 2dcf6e81b2e2..c251ad717345 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -108,18 +108,20 @@ struct pipe_buf_operations { + /* + * Get a reference to the pipe buffer. + */ +- void (*get)(struct pipe_inode_info *, struct pipe_buffer *); ++ bool (*get)(struct pipe_inode_info *, struct pipe_buffer *); + }; + + /** + * pipe_buf_get - get a reference to a pipe_buffer + * @pipe: the pipe that the buffer belongs to + * @buf: the buffer to get a reference to ++ * ++ * Return: %true if the reference was successfully obtained. + */ +-static inline void pipe_buf_get(struct pipe_inode_info *pipe, ++static inline __must_check bool pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) + { +- buf->ops->get(pipe, buf); ++ return buf->ops->get(pipe, buf); + } + + /** +@@ -179,7 +181,7 @@ struct pipe_inode_info *alloc_pipe_info(void); + void free_pipe_info(struct pipe_inode_info *); + + /* Generic pipe buffer ops functions */ +-void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *); ++bool generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_nosteal(struct pipe_inode_info *, struct pipe_buffer *); +diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h +index fbf86ecd149d..bcaba7e8ca6e 100644 +--- a/include/linux/sched/signal.h ++++ b/include/linux/sched/signal.h +@@ -377,10 +377,20 @@ static inline void set_restore_sigmask(void) + set_thread_flag(TIF_RESTORE_SIGMASK); + WARN_ON(!test_thread_flag(TIF_SIGPENDING)); + } ++ ++static inline void clear_tsk_restore_sigmask(struct task_struct *tsk) ++{ ++ clear_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK); ++} ++ + static inline void clear_restore_sigmask(void) + { + clear_thread_flag(TIF_RESTORE_SIGMASK); + } ++static inline bool test_tsk_restore_sigmask(struct task_struct *tsk) ++{ ++ return test_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK); ++} + static inline bool test_restore_sigmask(void) + { + return test_thread_flag(TIF_RESTORE_SIGMASK); +@@ -398,6 +408,10 @@ static inline void set_restore_sigmask(void) + current->restore_sigmask = true; + WARN_ON(!test_thread_flag(TIF_SIGPENDING)); + } ++static inline void clear_tsk_restore_sigmask(struct task_struct *tsk) ++{ ++ tsk->restore_sigmask = false; ++} + static inline void clear_restore_sigmask(void) + { + current->restore_sigmask = false; +@@ -406,6 +420,10 @@ static inline bool test_restore_sigmask(void) + { + return current->restore_sigmask; + } ++static inline bool test_tsk_restore_sigmask(struct task_struct *tsk) ++{ ++ return tsk->restore_sigmask; ++} + static inline bool test_and_clear_restore_sigmask(void) + { + if (!current->restore_sigmask) +diff --git a/include/net/tc_act/tc_gact.h b/include/net/tc_act/tc_gact.h +index e82d93346b63..bb74ea83d57d 100644 +--- a/include/net/tc_act/tc_gact.h ++++ b/include/net/tc_act/tc_gact.h +@@ -51,7 +51,7 @@ static inline bool is_tcf_gact_goto_chain(const struct tc_action *a) + + static inline u32 tcf_gact_goto_chain_index(const struct tc_action *a) + { +- return a->goto_chain->index; ++ return READ_ONCE(a->tcfa_action) & TC_ACT_EXT_VAL_MASK; + } + + #endif /* __NET_TC_GACT_H */ +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 84b1367935e4..f1c85b6c39ae 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -29,6 +29,7 @@ + #include <linux/hw_breakpoint.h> + #include <linux/cn_proc.h> + #include <linux/compat.h> ++#include <linux/sched/signal.h> + + /* + * Access another process' address space via ptrace. +@@ -925,18 +926,26 @@ int ptrace_request(struct task_struct *child, long request, + ret = ptrace_setsiginfo(child, &siginfo); + break; + +- case PTRACE_GETSIGMASK: ++ case PTRACE_GETSIGMASK: { ++ sigset_t *mask; ++ + if (addr != sizeof(sigset_t)) { + ret = -EINVAL; + break; + } + +- if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t))) ++ if (test_tsk_restore_sigmask(child)) ++ mask = &child->saved_sigmask; ++ else ++ mask = &child->blocked; ++ ++ if (copy_to_user(datavp, mask, sizeof(sigset_t))) + ret = -EFAULT; + else + ret = 0; + + break; ++ } + + case PTRACE_SETSIGMASK: { + sigset_t new_set; +@@ -962,6 +971,8 @@ int ptrace_request(struct task_struct *child, long request, + child->blocked = new_set; + spin_unlock_irq(&child->sighand->siglock); + ++ clear_tsk_restore_sigmask(child); ++ + ret = 0; + break; + } +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 591be15404a1..ace0e8f6f2b4 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6739,12 +6739,16 @@ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe, + buf->private = 0; + } + +-static void buffer_pipe_buf_get(struct pipe_inode_info *pipe, ++static bool buffer_pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) + { + struct buffer_ref *ref = (struct buffer_ref *)buf->private; + ++ if (refcount_read(&ref->refcount) > INT_MAX/2) ++ return false; ++ + refcount_inc(&ref->refcount); ++ return true; + } + + /* Pipe buffer operations for a buffer. */ +diff --git a/mm/gup.c b/mm/gup.c +index 7c0e5b1bbcd4..babcbd6d99c3 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -153,7 +153,10 @@ retry: + } + + if (flags & FOLL_GET) { +- get_page(page); ++ if (unlikely(!try_get_page(page))) { ++ page = ERR_PTR(-ENOMEM); ++ goto out; ++ } + + /* drop the pgmap reference now that we hold the page */ + if (pgmap) { +@@ -280,7 +283,10 @@ retry_locked: + if (pmd_trans_unstable(pmd)) + ret = -EBUSY; + } else { +- get_page(page); ++ if (unlikely(!try_get_page(page))) { ++ spin_unlock(ptl); ++ return ERR_PTR(-ENOMEM); ++ } + spin_unlock(ptl); + lock_page(page); + ret = split_huge_page(page); +@@ -464,7 +470,10 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address, + if (is_device_public_page(*page)) + goto unmap; + } +- get_page(*page); ++ if (unlikely(!try_get_page(*page))) { ++ ret = -ENOMEM; ++ goto unmap; ++ } + out: + ret = 0; + unmap: +@@ -1365,6 +1374,20 @@ static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages) + } + } + ++/* ++ * Return the compund head page with ref appropriately incremented, ++ * or NULL if that failed. ++ */ ++static inline struct page *try_get_compound_head(struct page *page, int refs) ++{ ++ struct page *head = compound_head(page); ++ if (WARN_ON_ONCE(page_ref_count(head) < 0)) ++ return NULL; ++ if (unlikely(!page_cache_add_speculative(head, refs))) ++ return NULL; ++ return head; ++} ++ + #ifdef __HAVE_ARCH_PTE_SPECIAL + static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, + int write, struct page **pages, int *nr) +@@ -1399,9 +1422,9 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, + + VM_BUG_ON(!pfn_valid(pte_pfn(pte))); + page = pte_page(pte); +- head = compound_head(page); + +- if (!page_cache_get_speculative(head)) ++ head = try_get_compound_head(page, 1); ++ if (!head) + goto pte_unmap; + + if (unlikely(pte_val(pte) != pte_val(*ptep))) { +@@ -1537,8 +1560,8 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, + refs++; + } while (addr += PAGE_SIZE, addr != end); + +- head = compound_head(pmd_page(orig)); +- if (!page_cache_add_speculative(head, refs)) { ++ head = try_get_compound_head(pmd_page(orig), refs); ++ if (!head) { + *nr -= refs; + return 0; + } +@@ -1575,8 +1598,8 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, + refs++; + } while (addr += PAGE_SIZE, addr != end); + +- head = compound_head(pud_page(orig)); +- if (!page_cache_add_speculative(head, refs)) { ++ head = try_get_compound_head(pud_page(orig), refs); ++ if (!head) { + *nr -= refs; + return 0; + } +@@ -1612,8 +1635,8 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr, + refs++; + } while (addr += PAGE_SIZE, addr != end); + +- head = compound_head(pgd_page(orig)); +- if (!page_cache_add_speculative(head, refs)) { ++ head = try_get_compound_head(pgd_page(orig), refs); ++ if (!head) { + *nr -= refs; + return 0; + } +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 7f75bd2fb8a7..64a62584290c 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4255,6 +4255,19 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma, + + pfn_offset = (vaddr & ~huge_page_mask(h)) >> PAGE_SHIFT; + page = pte_page(huge_ptep_get(pte)); ++ ++ /* ++ * Instead of doing 'try_get_page()' below in the same_page ++ * loop, just check the count once here. ++ */ ++ if (unlikely(page_count(page) <= 0)) { ++ if (pages) { ++ spin_unlock(ptl); ++ remainder = 0; ++ err = -ENOMEM; ++ break; ++ } ++ } + same_page: + if (pages) { + pages[i] = mem_map_offset(page, pfn_offset); +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 5fd283d9929e..89936e0d55c9 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -512,6 +512,7 @@ static unsigned int br_nf_pre_routing(void *priv, + nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr; + + skb->protocol = htons(ETH_P_IP); ++ skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4; + + NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb, + skb->dev, NULL, +diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c +index 5811208863b7..09d5e0c7b3ba 100644 +--- a/net/bridge/br_netfilter_ipv6.c ++++ b/net/bridge/br_netfilter_ipv6.c +@@ -235,6 +235,8 @@ unsigned int br_nf_pre_routing_ipv6(void *priv, + nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; + + skb->protocol = htons(ETH_P_IPV6); ++ skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); ++ + NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, + skb->dev, NULL, + br_nf_pre_routing_finish_ipv6); +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index d83a4ec5900d..6f3205de887f 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -224,10 +224,6 @@ static void *nft_rbtree_deactivate(const struct net *net, + else if (d > 0) + parent = parent->rb_right; + else { +- if (!nft_set_elem_active(&rbe->ext, genmask)) { +- parent = parent->rb_left; +- continue; +- } + if (nft_rbtree_interval_end(rbe) && + !nft_rbtree_interval_end(this)) { + parent = parent->rb_left; +@@ -236,6 +232,9 @@ static void *nft_rbtree_deactivate(const struct net *net, + nft_rbtree_interval_end(this)) { + parent = parent->rb_right; + continue; ++ } else if (!nft_set_elem_active(&rbe->ext, genmask)) { ++ parent = parent->rb_left; ++ continue; + } + nft_rbtree_flush(net, set, rbe); + return rbe; +diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c +index d58de1dc5360..510049a7bd1d 100644 +--- a/scripts/kconfig/lxdialog/inputbox.c ++++ b/scripts/kconfig/lxdialog/inputbox.c +@@ -126,7 +126,8 @@ do_resize: + case KEY_DOWN: + break; + case KEY_BACKSPACE: +- case 127: ++ case 8: /* ^H */ ++ case 127: /* ^? */ + if (pos) { + wattrset(dialog, dlg.inputbox.atr); + if (input_x == 0) { +diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c +index 003114779815..e8e1944fa09b 100644 +--- a/scripts/kconfig/nconf.c ++++ b/scripts/kconfig/nconf.c +@@ -1048,7 +1048,7 @@ static int do_match(int key, struct match_state *state, int *ans) + state->match_direction = FIND_NEXT_MATCH_UP; + *ans = get_mext_match(state->pattern, + state->match_direction); +- } else if (key == KEY_BACKSPACE || key == 127) { ++ } else if (key == KEY_BACKSPACE || key == 8 || key == 127) { + state->pattern[strlen(state->pattern)-1] = '\0'; + adj_match_dir(&state->match_direction); + } else +diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c +index a64b1c31253e..0b63357f1d33 100644 +--- a/scripts/kconfig/nconf.gui.c ++++ b/scripts/kconfig/nconf.gui.c +@@ -439,7 +439,8 @@ int dialog_inputbox(WINDOW *main_window, + case KEY_F(F_EXIT): + case KEY_F(F_BACK): + break; +- case 127: ++ case 8: /* ^H */ ++ case 127: /* ^? */ + case KEY_BACKSPACE: + if (cursor_position > 0) { + memmove(&result[cursor_position-1], +diff --git a/scripts/selinux/genheaders/genheaders.c b/scripts/selinux/genheaders/genheaders.c +index fa48fabcb330..3cc4893d98cc 100644 +--- a/scripts/selinux/genheaders/genheaders.c ++++ b/scripts/selinux/genheaders/genheaders.c +@@ -9,7 +9,6 @@ + #include <string.h> + #include <errno.h> + #include <ctype.h> +-#include <sys/socket.h> + + struct security_class_mapping { + const char *name; +diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c +index ffe8179f5d41..c29fa4a6228d 100644 +--- a/scripts/selinux/mdp/mdp.c ++++ b/scripts/selinux/mdp/mdp.c +@@ -32,7 +32,6 @@ + #include <stdlib.h> + #include <unistd.h> + #include <string.h> +-#include <sys/socket.h> + + static void usage(char *name) + { +diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h +index cc35695d97b4..45ef6a0c17cc 100644 +--- a/security/selinux/include/classmap.h ++++ b/security/selinux/include/classmap.h +@@ -1,5 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + #include <linux/capability.h> ++#include <linux/socket.h> + + #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ + "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map" +diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c +index d72b8481f250..dc06f5e40041 100644 +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -704,8 +704,9 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id, + int l1_tbl_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; + u64 indirect_ptr, type = GITS_BASER_TYPE(baser); + int esz = GITS_BASER_ENTRY_SIZE(baser); +- int index; ++ int index, idx; + gfn_t gfn; ++ bool ret; + + switch (type) { + case GITS_BASER_TYPE_DEVICE: +@@ -732,7 +733,8 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id, + + if (eaddr) + *eaddr = addr; +- return kvm_is_visible_gfn(its->dev->kvm, gfn); ++ ++ goto out; + } + + /* calculate and check the index into the 1st level */ +@@ -766,7 +768,12 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id, + + if (eaddr) + *eaddr = indirect_ptr; +- return kvm_is_visible_gfn(its->dev->kvm, gfn); ++ ++out: ++ idx = srcu_read_lock(&its->dev->kvm->srcu); ++ ret = kvm_is_visible_gfn(its->dev->kvm, gfn); ++ srcu_read_unlock(&its->dev->kvm->srcu, idx); ++ return ret; + } + + static int vgic_its_alloc_collection(struct vgic_its *its, |