diff options
author | Mike Pagano <mpagano@gentoo.org> | 2018-11-10 16:29:26 -0500 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2018-11-10 16:29:26 -0500 |
commit | b2246e19ca92b5515294db57c20db401ec571730 (patch) | |
tree | ff7e60dcf5e44b95e77ce78c8960830a7d0ab7f3 | |
parent | Linux patch 4.9.135 (diff) | |
download | linux-patches-b2246e19ca92b5515294db57c20db401ec571730.tar.gz linux-patches-b2246e19ca92b5515294db57c20db401ec571730.tar.bz2 linux-patches-b2246e19ca92b5515294db57c20db401ec571730.zip |
Linux patch 4.9.136
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1135_linux-4.9.136.patch | 5423 |
2 files changed, 5427 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 0a80b161..6287efb3 100644 --- a/0000_README +++ b/0000_README @@ -583,6 +583,10 @@ Patch: 1134_linux-4.9.135.patch From: http://www.kernel.org Desc: Linux 4.9.134 +Patch: 1135_linux-4.9.136.patch +From: http://www.kernel.org +Desc: Linux 4.9.136 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1135_linux-4.9.136.patch b/1135_linux-4.9.136.patch new file mode 100644 index 00000000..c392bba5 --- /dev/null +++ b/1135_linux-4.9.136.patch @@ -0,0 +1,5423 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index f9f67be8d3c3..c708a50b060e 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -313,7 +313,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + This facility can be used to prevent such uncontrolled + GPE floodings. + Format: <int> +- Support masking of GPEs numbered from 0x00 to 0x7f. + + acpi_no_auto_serialize [HW,ACPI] + Disable auto-serialization of AML methods +diff --git a/Makefile b/Makefile +index 3678e4d19ebc..79b8f3a44f74 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 135 ++SUBLEVEL = 136 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S +index 9d5dc4fda3c1..3f7d1b74c5e0 100644 +--- a/arch/arm/boot/compressed/efi-header.S ++++ b/arch/arm/boot/compressed/efi-header.S +@@ -17,14 +17,12 @@ + @ there. + .inst 'M' | ('Z' << 8) | (0x1310 << 16) @ tstne r0, #0x4d000 + #else +- mov r0, r0 ++ W(mov) r0, r0 + #endif + .endm + + .macro __EFI_HEADER + #ifdef CONFIG_EFI_STUB +- b __efi_start +- + .set start_offset, __efi_start - start + .org start + 0x3c + @ +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index fc6d541549a2..2d7f2bb0d66a 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -130,19 +130,22 @@ start: + .rept 7 + __nop + .endr +- ARM( mov r0, r0 ) +- ARM( b 1f ) +- THUMB( badr r12, 1f ) +- THUMB( bx r12 ) ++#ifndef CONFIG_THUMB2_KERNEL ++ mov r0, r0 ++#else ++ AR_CLASS( sub pc, pc, #3 ) @ A/R: switch to Thumb2 mode ++ M_CLASS( nop.w ) @ M: already in Thumb2 mode ++ .thumb ++#endif ++ W(b) 1f + + .word _magic_sig @ Magic numbers to help the loader + .word _magic_start @ absolute load/run zImage address + .word _magic_end @ zImage end address + .word 0x04030201 @ endianness flag + +- THUMB( .thumb ) +-1: __EFI_HEADER +- ++ __EFI_HEADER ++1: + ARM_BE8( setend be ) @ go BE8 if compiled for BE8 + AR_CLASS( mrs r9, cpsr ) + #ifdef CONFIG_ARM_VIRT_EXT +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index c51b88ee3cec..31563007772c 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -3,6 +3,11 @@ + #include <dt-bindings/clock/bcm2835-aux.h> + #include <dt-bindings/gpio/gpio.h> + ++/* firmware-provided startup stubs live here, where the secondary CPUs are ++ * spinning. ++ */ ++/memreserve/ 0x00000000 0x00001000; ++ + /* This include file covers the common peripherals and configuration between + * bcm2835 and bcm2836 implementations, leaving the CPU configuration to + * bcm2835.dtsi and bcm2836.dtsi. +diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi +index d0560e8cd6de..547369c69e96 100644 +--- a/arch/arm/boot/dts/bcm63138.dtsi ++++ b/arch/arm/boot/dts/bcm63138.dtsi +@@ -105,21 +105,23 @@ + global_timer: timer@1e200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0x1e200 0x20>; +- interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>; + clocks = <&axi_clk>; + }; + + local_timer: local-timer@1e600 { + compatible = "arm,cortex-a9-twd-timer"; + reg = <0x1e600 0x20>; +- interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | ++ IRQ_TYPE_EDGE_RISING)>; + clocks = <&axi_clk>; + }; + + twd_watchdog: watchdog@1e620 { + compatible = "arm,cortex-a9-twd-wdt"; + reg = <0x1e620 0x20>; +- interrupts = <GIC_PPI 14 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | ++ IRQ_TYPE_LEVEL_HIGH)>; + }; + + armpll: armpll { +@@ -157,7 +159,7 @@ + serial0: serial@600 { + compatible = "brcm,bcm6345-uart"; + reg = <0x600 0x1b>; +- interrupts = <GIC_SPI 32 0>; ++ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&periph_clk>; + clock-names = "periph"; + status = "disabled"; +@@ -166,7 +168,7 @@ + serial1: serial@620 { + compatible = "brcm,bcm6345-uart"; + reg = <0x620 0x1b>; +- interrupts = <GIC_SPI 33 0>; ++ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&periph_clk>; + clock-names = "periph"; + status = "disabled"; +@@ -179,7 +181,7 @@ + reg = <0x2000 0x600>, <0xf0 0x10>; + reg-names = "nand", "nand-int-base"; + status = "disabled"; +- interrupts = <GIC_SPI 38 0>; ++ interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "nand"; + }; + +diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi +index c05e7cfd0cbc..c8a6a6868c46 100644 +--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi ++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi +@@ -130,6 +130,17 @@ + }; + }; + ++&cpu0 { ++ /* CPU rated to 1GHz, not 1.2GHz as per the default settings */ ++ operating-points = < ++ /* kHz uV */ ++ 166666 850000 ++ 400000 900000 ++ 800000 1050000 ++ 1000000 1200000 ++ >; ++}; ++ + &esdhc1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_esdhc1>; +diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c +index ff0eed23ddf1..66e5d8765601 100644 +--- a/arch/arm/mm/ioremap.c ++++ b/arch/arm/mm/ioremap.c +@@ -473,7 +473,7 @@ void pci_ioremap_set_mem_type(int mem_type) + + int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr) + { +- BUG_ON(offset + SZ_64K > IO_SPACE_LIMIT); ++ BUG_ON(offset + SZ_64K - 1 > IO_SPACE_LIMIT); + + return ioremap_page_range(PCI_IO_VIRT_BASE + offset, + PCI_IO_VIRT_BASE + offset + SZ_64K, +diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h +index 77429d1622b3..711d9b8465b8 100644 +--- a/arch/mips/include/uapi/asm/inst.h ++++ b/arch/mips/include/uapi/asm/inst.h +@@ -964,7 +964,7 @@ struct mm16_r3_format { /* Load from global pointer format */ + struct mm16_r5_format { /* Load/store from stack pointer format */ + __BITFIELD_FIELD(unsigned int opcode : 6, + __BITFIELD_FIELD(unsigned int rt : 5, +- __BITFIELD_FIELD(signed int simmediate : 5, ++ __BITFIELD_FIELD(unsigned int imm : 5, + __BITFIELD_FIELD(unsigned int : 16, /* Ignored */ + ;)))) + }; +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index ba315e523b33..1cc133e7026f 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -212,7 +212,7 @@ static inline int is_ra_save_ins(union mips_instruction *ip, int *poff) + if (ip->mm16_r5_format.rt != 31) + return 0; + +- *poff = ip->mm16_r5_format.simmediate; ++ *poff = ip->mm16_r5_format.imm; + *poff = (*poff << 2) / sizeof(ulong); + return 1; + +@@ -346,6 +346,7 @@ static int get_frame_info(struct mips_frame_info *info) + bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); + union mips_instruction insn, *ip, *ip_end; + const unsigned int max_insns = 128; ++ unsigned int last_insn_size = 0; + unsigned int i; + + info->pc_offset = -1; +@@ -357,15 +358,19 @@ static int get_frame_info(struct mips_frame_info *info) + + ip_end = (void *)ip + info->func_size; + +- for (i = 0; i < max_insns && ip < ip_end; i++, ip++) { ++ for (i = 0; i < max_insns && ip < ip_end; i++) { ++ ip = (void *)ip + last_insn_size; + if (is_mmips && mm_insn_16bit(ip->halfword[0])) { + insn.halfword[0] = 0; + insn.halfword[1] = ip->halfword[0]; ++ last_insn_size = 2; + } else if (is_mmips) { + insn.halfword[0] = ip->halfword[1]; + insn.halfword[1] = ip->halfword[0]; ++ last_insn_size = 4; + } else { + insn.word = ip->word; ++ last_insn_size = 4; + } + + if (is_jump_ins(&insn)) +@@ -387,8 +392,6 @@ static int get_frame_info(struct mips_frame_info *info) + tmp = (ip->halfword[0] >> 1); + info->frame_size = -(signed short)(tmp & 0xf); + } +- ip = (void *) &ip->halfword[1]; +- ip--; + } else + #endif + info->frame_size = - ip->i_format.simmediate; +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index 8b4152f3a764..cef42d4be292 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -290,9 +290,13 @@ config NUMA + depends on SPARC64 && SMP + + config NODES_SHIFT +- int +- default "4" ++ int "Maximum NUMA Nodes (as a power of 2)" ++ range 4 5 if SPARC64 ++ default "5" + depends on NEED_MULTIPLE_NODES ++ help ++ Specify the maximum number of NUMA Nodes available on the target ++ system. Increases memory reserved to accommodate various tables. + + # Some NUMA nodes have memory ranges that span + # other nodes. Even though a pfn is valid and +diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c +index b2722ed31053..349cb83f7b5f 100644 +--- a/arch/sparc/mm/tlb.c ++++ b/arch/sparc/mm/tlb.c +@@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr, + pte_unmap(pte); + } + +-void set_pmd_at(struct mm_struct *mm, unsigned long addr, +- pmd_t *pmdp, pmd_t pmd) +-{ +- pmd_t orig = *pmdp; +- +- *pmdp = pmd; + ++static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr, ++ pmd_t orig, pmd_t pmd) ++{ + if (mm == &init_mm) + return; + +@@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, + } + } + ++void set_pmd_at(struct mm_struct *mm, unsigned long addr, ++ pmd_t *pmdp, pmd_t pmd) ++{ ++ pmd_t orig = *pmdp; ++ ++ *pmdp = pmd; ++ __set_pmd_acct(mm, addr, orig, pmd); ++} ++ + static inline pmd_t pmdp_establish(struct vm_area_struct *vma, + unsigned long address, pmd_t *pmdp, pmd_t pmd) + { +@@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, + do { + old = *pmdp; + } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd); ++ __set_pmd_acct(vma->vm_mm, address, old, pmd); + + return old; + } +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 6bc36944a8c1..8c2a9fa0caf3 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3767,16 +3767,16 @@ static const struct pci_device_id skx_uncore_pci_ids[] = { + .driver_data = UNCORE_PCI_DEV_FULL_DATA(21, 5, SKX_PCI_UNCORE_M2PCIE, 3), + }, + { /* M3UPI0 Link 0 */ +- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204C), +- .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 0, SKX_PCI_UNCORE_M3UPI, 0), ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D), ++ .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 1, SKX_PCI_UNCORE_M3UPI, 0), + }, + { /* M3UPI0 Link 1 */ +- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D), +- .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 1, SKX_PCI_UNCORE_M3UPI, 1), ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204E), ++ .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 2, SKX_PCI_UNCORE_M3UPI, 1), + }, + { /* M3UPI1 Link 2 */ +- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204C), +- .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 4, SKX_PCI_UNCORE_M3UPI, 2), ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D), ++ .driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 5, SKX_PCI_UNCORE_M3UPI, 2), + }, + { /* end: all zeroes */ } + }; +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 25152843dd1f..8554f960e21b 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -14,16 +14,6 @@ + #ifndef _ASM_X86_FIXMAP_H + #define _ASM_X86_FIXMAP_H + +-/* +- * Exposed to assembly code for setting up initial page tables. Cannot be +- * calculated in assembly code (fixmap entries are an enum), but is sanity +- * checked in the actual fixmap C code to make sure that the fixmap is +- * covered fully. +- */ +-#define FIXMAP_PMD_NUM 2 +-/* fixmap starts downwards from the 507th entry in level2_fixmap_pgt */ +-#define FIXMAP_PMD_TOP 507 +- + #ifndef __ASSEMBLY__ + #include <linux/kernel.h> + #include <asm/acpi.h> +diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h +index 84f58de08c2b..2cb5d0f13641 100644 +--- a/arch/x86/include/asm/percpu.h ++++ b/arch/x86/include/asm/percpu.h +@@ -184,22 +184,22 @@ do { \ + typeof(var) pfo_ret__; \ + switch (sizeof(var)) { \ + case 1: \ +- asm(op "b "__percpu_arg(1)",%0" \ ++ asm volatile(op "b "__percpu_arg(1)",%0"\ + : "=q" (pfo_ret__) \ + : "m" (var)); \ + break; \ + case 2: \ +- asm(op "w "__percpu_arg(1)",%0" \ ++ asm volatile(op "w "__percpu_arg(1)",%0"\ + : "=r" (pfo_ret__) \ + : "m" (var)); \ + break; \ + case 4: \ +- asm(op "l "__percpu_arg(1)",%0" \ ++ asm volatile(op "l "__percpu_arg(1)",%0"\ + : "=r" (pfo_ret__) \ + : "m" (var)); \ + break; \ + case 8: \ +- asm(op "q "__percpu_arg(1)",%0" \ ++ asm volatile(op "q "__percpu_arg(1)",%0"\ + : "=r" (pfo_ret__) \ + : "m" (var)); \ + break; \ +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index d5c4df98aac3..221a32ed1372 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -13,14 +13,13 @@ + #include <asm/processor.h> + #include <linux/bitops.h> + #include <linux/threads.h> +-#include <asm/fixmap.h> + + extern pud_t level3_kernel_pgt[512]; + extern pud_t level3_ident_pgt[512]; + extern pmd_t level2_kernel_pgt[512]; + extern pmd_t level2_fixmap_pgt[512]; + extern pmd_t level2_ident_pgt[512]; +-extern pte_t level1_fixmap_pgt[512 * FIXMAP_PMD_NUM]; ++extern pte_t level1_fixmap_pgt[512]; + extern pgd_t init_level4_pgt[]; + + #define swapper_pg_dir init_level4_pgt +diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c +index 455d8ada9b9a..d39cfb2c6b63 100644 +--- a/arch/x86/kernel/cpu/cyrix.c ++++ b/arch/x86/kernel/cpu/cyrix.c +@@ -253,6 +253,7 @@ static void init_cyrix(struct cpuinfo_x86 *c) + break; + + case 4: /* MediaGX/GXm or Geode GXM/GXLV/GX1 */ ++ case 11: /* GX1 with inverted Device ID */ + #ifdef CONFIG_PCI + { + u32 vendor, device; +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index b0d6697ab153..9d72cf547c88 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -23,7 +23,6 @@ + #include "../entry/calling.h" + #include <asm/export.h> + #include <asm/nospec-branch.h> +-#include <asm/fixmap.h> + + #ifdef CONFIG_PARAVIRT + #include <asm/asm-offsets.h> +@@ -494,20 +493,13 @@ NEXT_PAGE(level2_kernel_pgt) + KERNEL_IMAGE_SIZE/PMD_SIZE) + + NEXT_PAGE(level2_fixmap_pgt) +- .fill (512 - 4 - FIXMAP_PMD_NUM),8,0 +- pgtno = 0 +- .rept (FIXMAP_PMD_NUM) +- .quad level1_fixmap_pgt + (pgtno << PAGE_SHIFT) - __START_KERNEL_map \ +- + _PAGE_TABLE; +- pgtno = pgtno + 1 +- .endr +- /* 6 MB reserved space + a 2MB hole */ +- .fill 4,8,0 ++ .fill 506,8,0 ++ .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE ++ /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */ ++ .fill 5,8,0 + + NEXT_PAGE(level1_fixmap_pgt) +- .rept (FIXMAP_PMD_NUM) + .fill 512,8,0 +- .endr + + #undef PMDS + +diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c +index 29d465627919..bf9552bebb3c 100644 +--- a/arch/x86/kernel/paravirt.c ++++ b/arch/x86/kernel/paravirt.c +@@ -90,7 +90,7 @@ unsigned paravirt_patch_call(void *insnbuf, + + if (len < 5) { + #ifdef CONFIG_RETPOLINE +- WARN_ONCE("Failing to patch indirect CALL in %ps\n", (void *)addr); ++ WARN_ONCE(1, "Failing to patch indirect CALL in %ps\n", (void *)addr); + #endif + return len; /* call too long for patch site */ + } +@@ -110,7 +110,7 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target, + + if (len < 5) { + #ifdef CONFIG_RETPOLINE +- WARN_ONCE("Failing to patch indirect JMP in %ps\n", (void *)addr); ++ WARN_ONCE(1, "Failing to patch indirect JMP in %ps\n", (void *)addr); + #endif + return len; /* call too long for patch site */ + } +diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c +index f8a0518d2810..89d1190b9d94 100644 +--- a/arch/x86/kernel/time.c ++++ b/arch/x86/kernel/time.c +@@ -24,7 +24,7 @@ + #include <asm/time.h> + + #ifdef CONFIG_X86_64 +-__visible volatile unsigned long jiffies __cacheline_aligned = INITIAL_JIFFIES; ++__visible volatile unsigned long jiffies __cacheline_aligned_in_smp = INITIAL_JIFFIES; + #endif + + unsigned long profile_pc(struct pt_regs *regs) +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 8cbed30feb67..e30baa8ad94f 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -536,15 +536,6 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + { + unsigned long address = __fix_to_virt(idx); + +-#ifdef CONFIG_X86_64 +- /* +- * Ensure that the static initial page tables are covering the +- * fixmap completely. +- */ +- BUILD_BUG_ON(__end_of_permanent_fixed_addresses > +- (FIXMAP_PMD_NUM * PTRS_PER_PTE)); +-#endif +- + if (idx >= __end_of_fixed_addresses) { + BUG(); + return; +diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c +index ebceaba20ad1..c92f75f7ae33 100644 +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -1936,7 +1936,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + * L3_k[511] -> level2_fixmap_pgt */ + convert_pfn_mfn(level3_kernel_pgt); + +- /* L3_k[511][508-FIXMAP_PMD_NUM ... 507] -> level1_fixmap_pgt */ ++ /* L3_k[511][506] -> level1_fixmap_pgt */ + convert_pfn_mfn(level2_fixmap_pgt); + } + /* We get [511][511] and have Xen's version of level2_kernel_pgt */ +@@ -1970,11 +1970,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO); + set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO); + set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO); +- +- for (i = 0; i < FIXMAP_PMD_NUM; i++) { +- set_page_prot(level1_fixmap_pgt + i * PTRS_PER_PTE, +- PAGE_KERNEL_RO); +- } ++ set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO); + + /* Pin down new L4 */ + pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE, +diff --git a/crypto/shash.c b/crypto/shash.c +index d5bd2f05d036..4f047c7eeca7 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + int err; + + absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); +- buffer = kmalloc(absize, GFP_KERNEL); ++ buffer = kmalloc(absize, GFP_ATOMIC); + if (!buffer) + return -ENOMEM; + +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index cf05ae973381..a36d0739dbfe 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -724,14 +724,8 @@ end: + * interface: + * echo unmask > /sys/firmware/acpi/interrupts/gpe00 + */ +- +-/* +- * Currently, the GPE flooding prevention only supports to mask the GPEs +- * numbered from 00 to 7f. +- */ +-#define ACPI_MASKABLE_GPE_MAX 0x80 +- +-static u64 __initdata acpi_masked_gpes; ++#define ACPI_MASKABLE_GPE_MAX 0xFF ++static DECLARE_BITMAP(acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) __initdata; + + static int __init acpi_gpe_set_masked_gpes(char *val) + { +@@ -739,7 +733,7 @@ static int __init acpi_gpe_set_masked_gpes(char *val) + + if (kstrtou8(val, 0, &gpe) || gpe > ACPI_MASKABLE_GPE_MAX) + return -EINVAL; +- acpi_masked_gpes |= ((u64)1<<gpe); ++ set_bit(gpe, acpi_masked_gpes_map); + + return 1; + } +@@ -751,15 +745,11 @@ void __init acpi_gpe_apply_masked_gpes(void) + acpi_status status; + u8 gpe; + +- for (gpe = 0; +- gpe < min_t(u8, ACPI_MASKABLE_GPE_MAX, acpi_current_gpe_count); +- gpe++) { +- if (acpi_masked_gpes & ((u64)1<<gpe)) { +- status = acpi_get_gpe_device(gpe, &handle); +- if (ACPI_SUCCESS(status)) { +- pr_info("Masking GPE 0x%x.\n", gpe); +- (void)acpi_mask_gpe(handle, gpe, TRUE); +- } ++ for_each_set_bit(gpe, acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) { ++ status = acpi_get_gpe_device(gpe, &handle); ++ if (ACPI_SUCCESS(status)) { ++ pr_info("Masking GPE 0x%x.\n", gpe); ++ (void)acpi_mask_gpe(handle, gpe, TRUE); + } + } + } +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index faa91f8a17a5..5408a292078b 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -624,8 +624,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev, + static int ahci_pci_reset_controller(struct ata_host *host) + { + struct pci_dev *pdev = to_pci_dev(host->dev); ++ int rc; + +- ahci_reset_controller(host); ++ rc = ahci_reset_controller(host); ++ if (rc) ++ return rc; + + if (pdev->vendor == PCI_VENDOR_ID_INTEL) { + struct ahci_host_priv *hpriv = host->private_data; +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 73d636d35961..a166359ad5d4 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6781,7 +6781,7 @@ static int __init ata_parse_force_one(char **cur, + } + + force_ent->port = simple_strtoul(id, &endp, 10); +- if (p == endp || *endp != '\0') { ++ if (id == endp || *endp != '\0') { + *reason = "invalid port/link"; + return -EINVAL; + } +diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c +index f72d601e300a..e83a3d3421b9 100644 +--- a/drivers/ata/sata_rcar.c ++++ b/drivers/ata/sata_rcar.c +@@ -890,7 +890,10 @@ static int sata_rcar_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "failed to get access to sata clock\n"); + return PTR_ERR(priv->clk); + } +- clk_prepare_enable(priv->clk); ++ ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) ++ return ret; + + host = ata_host_alloc(&pdev->dev, 1); + if (!host) { +@@ -970,8 +973,11 @@ static int sata_rcar_resume(struct device *dev) + struct ata_host *host = dev_get_drvdata(dev); + struct sata_rcar_priv *priv = host->private_data; + void __iomem *base = priv->base; ++ int ret; + +- clk_prepare_enable(priv->clk); ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) ++ return ret; + + /* ack and mask */ + iowrite32(0, base + SATAINTSTAT_REG); +@@ -988,8 +994,11 @@ static int sata_rcar_restore(struct device *dev) + { + struct ata_host *host = dev_get_drvdata(dev); + struct sata_rcar_priv *priv = host->private_data; ++ int ret; + +- clk_prepare_enable(priv->clk); ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) ++ return ret; + + sata_rcar_setup_port(host); + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 4d30da269060..42a53956aefe 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -269,7 +269,7 @@ static inline int sock_send_bvec(struct nbd_device *nbd, struct bio_vec *bvec, + static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd) + { + struct request *req = blk_mq_rq_from_pdu(cmd); +- int result, flags; ++ int result; + struct nbd_request request; + unsigned long size = blk_rq_bytes(req); + struct bio *bio; +@@ -309,7 +309,6 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd) + if (type != NBD_CMD_WRITE) + return 0; + +- flags = 0; + bio = req->bio; + while (bio) { + struct bio *next = bio->bi_next; +@@ -318,9 +317,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd) + + bio_for_each_segment(bvec, bio, iter) { + bool is_last = !next && bio_iter_last(bvec, iter); ++ int flags = is_last ? 0 : MSG_MORE; + +- if (is_last) +- flags = MSG_MORE; + dev_dbg(nbd_to_dev(nbd), "request %p: sending %d bytes data\n", + cmd, bvec.bv_len); + result = sock_send_bvec(nbd, &bvec, flags); +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index cdc092a1d9ef..07fb667e258f 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -987,7 +987,7 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = { + GATE(0, "aclk400_isp", "mout_user_aclk400_isp", + GATE_BUS_TOP, 16, 0, 0), + GATE(0, "aclk400_mscl", "mout_user_aclk400_mscl", +- GATE_BUS_TOP, 17, 0, 0), ++ GATE_BUS_TOP, 17, CLK_IS_CRITICAL, 0), + GATE(0, "aclk200_disp1", "mout_user_aclk200_disp1", + GATE_BUS_TOP, 18, CLK_IS_CRITICAL, 0), + GATE(CLK_SCLK_MPHY_IXTAL24, "sclk_mphy_ixtal24", "mphy_refclk_ixtal24", +diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c +index ee1724806f46..ab8dcfea0680 100644 +--- a/drivers/gpio/gpio-mxs.c ++++ b/drivers/gpio/gpio-mxs.c +@@ -32,8 +32,6 @@ + #include <linux/platform_device.h> + #include <linux/slab.h> + #include <linux/gpio/driver.h> +-/* FIXME: for gpio_get_value(), replace this by direct register read */ +-#include <linux/gpio.h> + #include <linux/module.h> + + #define MXS_SET 0x4 +@@ -94,7 +92,7 @@ static int mxs_gpio_set_irq_type(struct irq_data *d, unsigned int type) + port->both_edges &= ~pin_mask; + switch (type) { + case IRQ_TYPE_EDGE_BOTH: +- val = gpio_get_value(port->gc.base + d->hwirq); ++ val = port->gc.get(&port->gc, d->hwirq); + if (val) + edge = GPIO_INT_FALL_EDGE; + else +diff --git a/drivers/gpu/drm/bochs/bochs_fbdev.c b/drivers/gpu/drm/bochs/bochs_fbdev.c +index e1ec498a6b6e..35f40255644d 100644 +--- a/drivers/gpu/drm/bochs/bochs_fbdev.c ++++ b/drivers/gpu/drm/bochs/bochs_fbdev.c +@@ -138,6 +138,7 @@ static int bochsfb_create(struct drm_fb_helper *helper, + info->fix.smem_start = 0; + info->fix.smem_len = size; + ++ bochs->fb.initialized = true; + return 0; + } + +@@ -155,7 +156,6 @@ static int bochs_fbdev_destroy(struct bochs_device *bochs) + gfb->obj = NULL; + } + +- drm_fb_helper_fini(&bochs->fb.helper); + drm_framebuffer_unregister_private(&gfb->base); + drm_framebuffer_cleanup(&gfb->base); + +@@ -188,7 +188,6 @@ int bochs_fbdev_init(struct bochs_device *bochs) + if (ret) + goto fini; + +- bochs->fb.initialized = true; + return 0; + + fini: +@@ -198,9 +197,9 @@ fini: + + void bochs_fbdev_fini(struct bochs_device *bochs) + { +- if (!bochs->fb.initialized) +- return; ++ if (bochs->fb.initialized) ++ bochs_fbdev_destroy(bochs); + +- bochs_fbdev_destroy(bochs); ++ drm_fb_helper_fini(&bochs->fb.helper); + bochs->fb.initialized = false; + } +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 37ba5f51378e..83d2f43b5a2f 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -107,6 +107,9 @@ static const struct edid_quirk { + /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */ + { "AEO", 0, EDID_QUIRK_FORCE_6BPC }, + ++ /* BOE model on HP Pavilion 15-n233sl reports 8 bpc, but is a 6 bpc panel */ ++ { "BOE", 0x78b, EDID_QUIRK_FORCE_6BPC }, ++ + /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */ + { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC }, + +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 7145127513c4..795660e29b2c 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -118,17 +118,19 @@ static void put_pages(struct drm_gem_object *obj) + struct msm_gem_object *msm_obj = to_msm_bo(obj); + + if (msm_obj->pages) { +- /* For non-cached buffers, ensure the new pages are clean +- * because display controller, GPU, etc. are not coherent: +- */ +- if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) +- dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, +- msm_obj->sgt->nents, DMA_BIDIRECTIONAL); ++ if (msm_obj->sgt) { ++ /* For non-cached buffers, ensure the new ++ * pages are clean because display controller, ++ * GPU, etc. are not coherent: ++ */ ++ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) ++ dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, ++ msm_obj->sgt->nents, ++ DMA_BIDIRECTIONAL); + +- if (msm_obj->sgt) + sg_free_table(msm_obj->sgt); +- +- kfree(msm_obj->sgt); ++ kfree(msm_obj->sgt); ++ } + + if (use_pages(obj)) + drm_gem_put_pages(obj, msm_obj->pages, true, false); +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index b9539f7c5e9a..99c813a4ec1f 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -715,15 +715,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi) + spin_lock_irqsave(&ipu->lock, flags); + + val = ipu_cm_read(ipu, IPU_CONF); +- if (vdi) { ++ if (vdi) + val |= IPU_CONF_IC_INPUT; +- } else { ++ else + val &= ~IPU_CONF_IC_INPUT; +- if (csi_id == 1) +- val |= IPU_CONF_CSI_SEL; +- else +- val &= ~IPU_CONF_CSI_SEL; +- } ++ ++ if (csi_id == 1) ++ val |= IPU_CONF_CSI_SEL; ++ else ++ val &= ~IPU_CONF_CSI_SEL; ++ + ipu_cm_write(ipu, val, IPU_CONF); + + spin_unlock_irqrestore(&ipu->lock, flags); +diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c +index f283b714aa79..7ed09865cb4b 100644 +--- a/drivers/i2c/busses/i2c-bcm2835.c ++++ b/drivers/i2c/busses/i2c-bcm2835.c +@@ -128,7 +128,9 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data) + } + + if (val & BCM2835_I2C_S_DONE) { +- if (i2c_dev->curr_msg->flags & I2C_M_RD) { ++ if (!i2c_dev->curr_msg) { ++ dev_err(i2c_dev->dev, "Got unexpected interrupt (from firmware?)\n"); ++ } else if (i2c_dev->curr_msg->flags & I2C_M_RD) { + bcm2835_drain_rxfifo(i2c_dev); + val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S); + } +diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c +index 64799ad7ebad..7fd24949c0c1 100644 +--- a/drivers/iio/adc/axp288_adc.c ++++ b/drivers/iio/adc/axp288_adc.c +@@ -28,6 +28,8 @@ + #include <linux/iio/driver.h> + + #define AXP288_ADC_EN_MASK 0xF1 ++#define AXP288_ADC_TS_PIN_GPADC 0xF2 ++#define AXP288_ADC_TS_PIN_ON 0xF3 + + enum axp288_adc_id { + AXP288_ADC_TS, +@@ -121,6 +123,16 @@ static int axp288_adc_read_channel(int *val, unsigned long address, + return IIO_VAL_INT; + } + ++static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode, ++ unsigned long address) ++{ ++ /* channels other than GPADC do not need to switch TS pin */ ++ if (address != AXP288_GP_ADC_H) ++ return 0; ++ ++ return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode); ++} ++ + static int axp288_adc_read_raw(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, + int *val, int *val2, long mask) +@@ -131,7 +143,16 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev, + mutex_lock(&indio_dev->mlock); + switch (mask) { + case IIO_CHAN_INFO_RAW: ++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC, ++ chan->address)) { ++ dev_err(&indio_dev->dev, "GPADC mode\n"); ++ ret = -EINVAL; ++ break; ++ } + ret = axp288_adc_read_channel(val, chan->address, info->regmap); ++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON, ++ chan->address)) ++ dev_err(&indio_dev->dev, "TS pin restore\n"); + break; + default: + ret = -EINVAL; +@@ -141,6 +162,15 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev, + return ret; + } + ++static int axp288_adc_set_state(struct regmap *regmap) ++{ ++ /* ADC should be always enabled for internal FG to function */ ++ if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON)) ++ return -EIO; ++ ++ return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); ++} ++ + static const struct iio_info axp288_adc_iio_info = { + .read_raw = &axp288_adc_read_raw, + .driver_module = THIS_MODULE, +@@ -169,7 +199,7 @@ static int axp288_adc_probe(struct platform_device *pdev) + * Set ADC to enabled state at all time, including system suspend. + * otherwise internal fuel gauge functionality may be affected. + */ +- ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); ++ ret = axp288_adc_set_state(axp20x->regmap); + if (ret) { + dev_err(&pdev->dev, "unable to enable ADC device\n"); + return ret; +diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c +index 2a4a62ebfd8d..cc002b958f7e 100644 +--- a/drivers/iio/pressure/zpa2326.c ++++ b/drivers/iio/pressure/zpa2326.c +@@ -869,7 +869,6 @@ complete: + static int zpa2326_wait_oneshot_completion(const struct iio_dev *indio_dev, + struct zpa2326_private *private) + { +- int ret; + unsigned int val; + long timeout; + +@@ -891,14 +890,11 @@ static int zpa2326_wait_oneshot_completion(const struct iio_dev *indio_dev, + /* Timed out. */ + zpa2326_warn(indio_dev, "no one shot interrupt occurred (%ld)", + timeout); +- ret = -ETIME; +- } else if (timeout < 0) { +- zpa2326_warn(indio_dev, +- "wait for one shot interrupt cancelled"); +- ret = -ERESTARTSYS; ++ return -ETIME; + } + +- return ret; ++ zpa2326_warn(indio_dev, "wait for one shot interrupt cancelled"); ++ return -ERESTARTSYS; + } + + static int zpa2326_init_managed_irq(struct device *parent, +diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c +index 7713ef089c3c..85be45e75710 100644 +--- a/drivers/infiniband/core/ucm.c ++++ b/drivers/infiniband/core/ucm.c +@@ -46,6 +46,8 @@ + #include <linux/mutex.h> + #include <linux/slab.h> + ++#include <linux/nospec.h> ++ + #include <asm/uaccess.h> + + #include <rdma/ib.h> +@@ -1115,6 +1117,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, + + if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) + return -EINVAL; ++ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucm_cmd_table)); + + if (hdr.in + sizeof(hdr) > len) + return -EINVAL; +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index fa9ef8ed5712..a4f4cd493265 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -44,6 +44,8 @@ + #include <linux/module.h> + #include <linux/nsproxy.h> + ++#include <linux/nospec.h> ++ + #include <rdma/rdma_user_cm.h> + #include <rdma/ib_marshall.h> + #include <rdma/rdma_cm.h> +@@ -1637,6 +1639,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, + + if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) + return -EINVAL; ++ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucma_cmd_table)); + + if (hdr.in + sizeof(hdr) > len) + return -EINVAL; +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 0e64b52af5b2..d28c4cf7c1ee 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1510,6 +1510,44 @@ EXPORT_SYMBOL(ib_dealloc_fmr); + + /* Multicast groups */ + ++static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid) ++{ ++ struct ib_qp_init_attr init_attr = {}; ++ struct ib_qp_attr attr = {}; ++ int num_eth_ports = 0; ++ int port; ++ ++ /* If QP state >= init, it is assigned to a port and we can check this ++ * port only. ++ */ ++ if (!ib_query_qp(qp, &attr, IB_QP_STATE | IB_QP_PORT, &init_attr)) { ++ if (attr.qp_state >= IB_QPS_INIT) { ++ if (qp->device->get_link_layer(qp->device, attr.port_num) != ++ IB_LINK_LAYER_INFINIBAND) ++ return true; ++ goto lid_check; ++ } ++ } ++ ++ /* Can't get a quick answer, iterate over all ports */ ++ for (port = 0; port < qp->device->phys_port_cnt; port++) ++ if (qp->device->get_link_layer(qp->device, port) != ++ IB_LINK_LAYER_INFINIBAND) ++ num_eth_ports++; ++ ++ /* If we have at lease one Ethernet port, RoCE annex declares that ++ * multicast LID should be ignored. We can't tell at this step if the ++ * QP belongs to an IB or Ethernet port. ++ */ ++ if (num_eth_ports) ++ return true; ++ ++ /* If all the ports are IB, we can check according to IB spec. */ ++lid_check: ++ return !(lid < be16_to_cpu(IB_MULTICAST_LID_BASE) || ++ lid == be16_to_cpu(IB_LID_PERMISSIVE)); ++} ++ + int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid) + { + int ret; +@@ -1517,8 +1555,7 @@ int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid) + if (!qp->device->attach_mcast) + return -ENOSYS; + if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD || +- lid < be16_to_cpu(IB_MULTICAST_LID_BASE) || +- lid == be16_to_cpu(IB_LID_PERMISSIVE)) ++ !is_valid_mcast_lid(qp, lid)) + return -EINVAL; + + ret = qp->device->attach_mcast(qp, gid, lid); +@@ -1535,8 +1572,7 @@ int ib_detach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid) + if (!qp->device->detach_mcast) + return -ENOSYS; + if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD || +- lid < be16_to_cpu(IB_MULTICAST_LID_BASE) || +- lid == be16_to_cpu(IB_LID_PERMISSIVE)) ++ !is_valid_mcast_lid(qp, lid)) + return -EINVAL; + + ret = qp->device->detach_mcast(qp, gid, lid); +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 0d4878efd643..ddd3182138ac 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -247,8 +247,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, + } + + if (flags & IB_MR_REREG_ACCESS) { +- if (ib_access_writable(mr_access_flags) && !mmr->umem->writable) +- return -EPERM; ++ if (ib_access_writable(mr_access_flags) && ++ !mmr->umem->writable) { ++ err = -EPERM; ++ goto release_mpt_entry; ++ } + + err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry, + convert_access(mr_access_flags)); +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index abb47e780070..f8f7a2191b98 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -1523,6 +1523,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + u32 uidx = MLX5_IB_DEFAULT_UIDX; + struct mlx5_ib_create_qp ucmd; + struct mlx5_ib_qp_base *base; ++ int mlx5_st; + void *qpc; + u32 *in; + int err; +@@ -1538,6 +1539,10 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + spin_lock_init(&qp->sq.lock); + spin_lock_init(&qp->rq.lock); + ++ mlx5_st = to_mlx5_st(init_attr->qp_type); ++ if (mlx5_st < 0) ++ return -EINVAL; ++ + if (init_attr->rwq_ind_tbl) { + if (!udata) + return -ENOSYS; +@@ -1665,7 +1670,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + + qpc = MLX5_ADDR_OF(create_qp_in, in, qpc); + +- MLX5_SET(qpc, qpc, st, to_mlx5_st(init_attr->qp_type)); ++ MLX5_SET(qpc, qpc, st, mlx5_st); + MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED); + + if (init_attr->qp_type != MLX5_IB_QPT_REG_UMR) +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c +index 1c4e5b2e6835..527ca662da69 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.c ++++ b/drivers/infiniband/sw/rxe/rxe_pool.c +@@ -402,23 +402,25 @@ void *rxe_alloc(struct rxe_pool *pool) + + kref_get(&pool->rxe->ref_cnt); + +- if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { +- atomic_dec(&pool->num_elem); +- rxe_dev_put(pool->rxe); +- rxe_pool_put(pool); +- return NULL; +- } ++ if (atomic_inc_return(&pool->num_elem) > pool->max_elem) ++ goto out_put_pool; + + elem = kmem_cache_zalloc(pool_cache(pool), + (pool->flags & RXE_POOL_ATOMIC) ? + GFP_ATOMIC : GFP_KERNEL); + if (!elem) +- return NULL; ++ goto out_put_pool; + + elem->pool = pool; + kref_init(&elem->ref_cnt); + + return elem; ++ ++out_put_pool: ++ atomic_dec(&pool->num_elem); ++ rxe_dev_put(pool->rxe); ++ rxe_pool_put(pool); ++ return NULL; + } + + void rxe_elem_release(struct kref *kref) +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index ced416f5dffb..ef13082d6ca1 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -729,13 +729,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr, + + sge = ibwr->sg_list; + for (i = 0; i < num_sge; i++, sge++) { +- if (qp->is_user && copy_from_user(p, (__user void *) +- (uintptr_t)sge->addr, sge->length)) +- return -EFAULT; +- +- else if (!qp->is_user) +- memcpy(p, (void *)(uintptr_t)sge->addr, +- sge->length); ++ memcpy(p, (void *)(uintptr_t)sge->addr, ++ sge->length); + + p += sge->length; + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c +index 09396bd7b02d..63be3bcdc0e3 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c +@@ -281,8 +281,6 @@ void ipoib_delete_debug_files(struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + +- WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n"); +- WARN_ONCE(!priv->path_dentry, "null path debug file\n"); + debugfs_remove(priv->mcg_dentry); + debugfs_remove(priv->path_dentry); + priv->mcg_dentry = priv->path_dentry = NULL; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 34122c96522b..ad3089c23e18 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -974,19 +974,6 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv) + */ + priv->dev->broadcast[8] = priv->pkey >> 8; + priv->dev->broadcast[9] = priv->pkey & 0xff; +- +- /* +- * Update the broadcast address in the priv->broadcast object, +- * in case it already exists, otherwise no one will do that. +- */ +- if (priv->broadcast) { +- spin_lock_irq(&priv->lock); +- memcpy(priv->broadcast->mcmember.mgid.raw, +- priv->dev->broadcast + 4, +- sizeof(union ib_gid)); +- spin_unlock_irq(&priv->lock); +- } +- + return 0; + } + +@@ -1190,13 +1177,10 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_ib_dev_down(dev); + + if (level == IPOIB_FLUSH_HEAVY) { +- rtnl_lock(); + if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) + ipoib_ib_dev_stop(dev); + +- result = ipoib_ib_dev_open(dev); +- rtnl_unlock(); +- if (result) ++ if (ipoib_ib_dev_open(dev)) + return; + + if (netif_queue_stopped(dev)) +@@ -1236,7 +1220,9 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work) + struct ipoib_dev_priv *priv = + container_of(work, struct ipoib_dev_priv, flush_heavy); + ++ rtnl_lock(); + __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY, 0); ++ rtnl_unlock(); + } + + void ipoib_ib_dev_cleanup(struct net_device *dev) +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index a716482774db..b3119589a444 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1251,6 +1251,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0611", 0 }, + { "ELAN0612", 0 }, + { "ELAN0618", 0 }, ++ { "ELAN061C", 0 }, + { "ELAN061D", 0 }, + { "ELAN0622", 0 }, + { "ELAN1000", 0 }, +diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c +index 21dde5249085..c42523b7d5ed 100644 +--- a/drivers/mtd/spi-nor/spi-nor.c ++++ b/drivers/mtd/spi-nor/spi-nor.c +@@ -858,6 +858,12 @@ static const struct flash_info spi_nor_ids[] = { + + /* ISSI */ + { "is25cd512", INFO(0x7f9d20, 0, 32 * 1024, 2, SECT_4K) }, ++ { "is25wp032", INFO(0x9d7016, 0, 64 * 1024, 64, ++ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, ++ { "is25wp064", INFO(0x9d7017, 0, 64 * 1024, 128, ++ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, ++ { "is25wp128", INFO(0x9d7018, 0, 64 * 1024, 256, ++ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, + + /* Macronix */ + { "mx25l512e", INFO(0xc22010, 0, 64 * 1024, 1, SECT_4K) }, +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b1ea29d8ad1a..389d1db69a32 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2132,9 +2132,10 @@ static void bond_miimon_commit(struct bonding *bond) + if (bond_update_speed_duplex(slave) && + bond_needs_speed_duplex(bond)) { + slave->link = BOND_LINK_DOWN; +- netdev_warn(bond->dev, +- "failed to get link speed/duplex for %s\n", +- slave->dev->name); ++ if (net_ratelimit()) ++ netdev_warn(bond->dev, ++ "failed to get link speed/duplex for %s\n", ++ slave->dev->name); + continue; + } + bond_set_slave_link_state(slave, BOND_LINK_UP, +diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c +index b8df0f5e8c25..3f320f470345 100644 +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -628,8 +628,7 @@ static int bond_fill_info(struct sk_buff *skb, + goto nla_put_failure; + + if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM, +- sizeof(bond->params.ad_actor_system), +- &bond->params.ad_actor_system)) ++ ETH_ALEN, &bond->params.ad_actor_system)) + goto nla_put_failure; + } + if (!bond_3ad_get_active_agg_info(bond, &info)) { +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 1d92e034febc..0c298878bf46 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1482,8 +1482,6 @@ static int ena_up_complete(struct ena_adapter *adapter) + if (rc) + return rc; + +- ena_init_napi(adapter); +- + ena_change_mtu(adapter->netdev, adapter->netdev->mtu); + + ena_refill_all_rx_bufs(adapter); +@@ -1643,6 +1641,13 @@ static int ena_up(struct ena_adapter *adapter) + + ena_setup_io_intr(adapter); + ++ /* napi poll functions should be initialized before running ++ * request_irq(), to handle a rare condition where there is a pending ++ * interrupt, causing the ISR to fire immediately while the poll ++ * function wasn't set yet, causing a null dereference ++ */ ++ ena_init_napi(adapter); ++ + rc = ena_request_io_irq(adapter); + if (rc) + goto err_req_irq; +diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c +index b799c7ac899b..9e80a76c3dfe 100644 +--- a/drivers/net/ethernet/amd/declance.c ++++ b/drivers/net/ethernet/amd/declance.c +@@ -1030,6 +1030,7 @@ static int dec_lance_probe(struct device *bdev, const int type) + int i, ret; + unsigned long esar_base; + unsigned char *esar; ++ const char *desc; + + if (dec_lance_debug && version_printed++ == 0) + printk(version); +@@ -1215,19 +1216,20 @@ static int dec_lance_probe(struct device *bdev, const int type) + */ + switch (type) { + case ASIC_LANCE: +- printk("%s: IOASIC onboard LANCE", name); ++ desc = "IOASIC onboard LANCE"; + break; + case PMAD_LANCE: +- printk("%s: PMAD-AA", name); ++ desc = "PMAD-AA"; + break; + case PMAX_LANCE: +- printk("%s: PMAX onboard LANCE", name); ++ desc = "PMAX onboard LANCE"; + break; + } + for (i = 0; i < 6; i++) + dev->dev_addr[i] = esar[i * 4]; + +- printk(", addr = %pM, irq = %d\n", dev->dev_addr, dev->irq); ++ printk("%s: %s, addr = %pM, irq = %d\n", ++ name, desc, dev->dev_addr, dev->irq); + + dev->netdev_ops = &lance_netdev_ops; + dev->watchdog_timeo = 5*HZ; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 208e9dacfd34..a036f7039d76 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5580,7 +5580,9 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + } + + if (link_re_init) { ++ mutex_lock(&bp->link_lock); + rc = bnxt_update_phy_setting(bp); ++ mutex_unlock(&bp->link_lock); + if (rc) + netdev_warn(bp->dev, "failed to update phy settings\n"); + } +@@ -6230,30 +6232,28 @@ static void bnxt_sp_task(struct work_struct *work) + if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event)) + bnxt_hwrm_port_qstats(bp); + +- /* These functions below will clear BNXT_STATE_IN_SP_TASK. They +- * must be the last functions to be called before exiting. +- */ + if (test_and_clear_bit(BNXT_LINK_CHNG_SP_EVENT, &bp->sp_event)) { +- int rc = 0; ++ int rc; + ++ mutex_lock(&bp->link_lock); + if (test_and_clear_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, + &bp->sp_event)) + bnxt_hwrm_phy_qcaps(bp); + +- bnxt_rtnl_lock_sp(bp); +- if (test_bit(BNXT_STATE_OPEN, &bp->state)) +- rc = bnxt_update_link(bp, true); +- bnxt_rtnl_unlock_sp(bp); ++ rc = bnxt_update_link(bp, true); ++ mutex_unlock(&bp->link_lock); + if (rc) + netdev_err(bp->dev, "SP task can't update link (rc: %x)\n", + rc); + } + if (test_and_clear_bit(BNXT_HWRM_PORT_MODULE_SP_EVENT, &bp->sp_event)) { +- bnxt_rtnl_lock_sp(bp); +- if (test_bit(BNXT_STATE_OPEN, &bp->state)) +- bnxt_get_port_module_status(bp); +- bnxt_rtnl_unlock_sp(bp); ++ mutex_lock(&bp->link_lock); ++ bnxt_get_port_module_status(bp); ++ mutex_unlock(&bp->link_lock); + } ++ /* These functions below will clear BNXT_STATE_IN_SP_TASK. They ++ * must be the last functions to be called before exiting. ++ */ + if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event)) + bnxt_reset(bp, false); + +@@ -6788,6 +6788,7 @@ static int bnxt_probe_phy(struct bnxt *bp) + rc); + return rc; + } ++ mutex_init(&bp->link_lock); + + rc = bnxt_update_link(bp, false); + if (rc) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 666bc0608ed7..017c10c53715 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1109,6 +1109,10 @@ struct bnxt { + unsigned long *ntp_fltr_bmap; + int ntp_fltr_count; + ++ /* To protect link related settings during link changes and ++ * ethtool settings changes. ++ */ ++ struct mutex link_lock; + struct bnxt_link_info link_info; + struct ethtool_eee eee; + u32 lpi_tmr_lo; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index cde4b96f3153..3a352f76e633 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -793,6 +793,7 @@ static int bnxt_get_link_ksettings(struct net_device *dev, + u32 ethtool_speed; + + ethtool_link_ksettings_zero_link_mode(lk_ksettings, supported); ++ mutex_lock(&bp->link_lock); + bnxt_fw_to_ethtool_support_spds(link_info, lk_ksettings); + + ethtool_link_ksettings_zero_link_mode(lk_ksettings, advertising); +@@ -840,6 +841,7 @@ static int bnxt_get_link_ksettings(struct net_device *dev, + base->port = PORT_FIBRE; + } + base->phy_address = link_info->phy_addr; ++ mutex_unlock(&bp->link_lock); + + return 0; + } +@@ -926,6 +928,7 @@ static int bnxt_set_link_ksettings(struct net_device *dev, + if (!BNXT_SINGLE_PF(bp)) + return -EOPNOTSUPP; + ++ mutex_lock(&bp->link_lock); + if (base->autoneg == AUTONEG_ENABLE) { + BNXT_ETHTOOL_TO_FW_SPDS(fw_advertising, lk_ksettings, + advertising); +@@ -970,6 +973,7 @@ static int bnxt_set_link_ksettings(struct net_device *dev, + rc = bnxt_hwrm_set_link_setting(bp, set_pause, false); + + set_setting_exit: ++ mutex_unlock(&bp->link_lock); + return rc; + } + +diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c +index 8f55c23e9821..a0d640243df2 100644 +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -1737,6 +1737,7 @@ static void macb_configure_dma(struct macb *bp) + else + dmacfg &= ~GEM_BIT(TXCOEN); + ++ dmacfg &= ~GEM_BIT(ADDR64); + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT + dmacfg |= GEM_BIT(ADDR64); + #endif +diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +index dc0efbd91c32..ddd1ec8f7bd0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +@@ -2150,6 +2150,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EPERM; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_SET_QSET_PARAMS) ++ return -EINVAL; + if (t.qset_idx >= SGE_QSETS) + return -EINVAL; + if (!in_range(t.intr_lat, 0, M_NEWTIMER) || +@@ -2249,6 +2251,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; + ++ if (t.cmd != CHELSIO_GET_QSET_PARAMS) ++ return -EINVAL; ++ + /* Display qsets for all ports when offload enabled */ + if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) { + q1 = 0; +@@ -2294,6 +2299,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&edata, useraddr, sizeof(edata))) + return -EFAULT; ++ if (edata.cmd != CHELSIO_SET_QSET_NUM) ++ return -EINVAL; + if (edata.val < 1 || + (edata.val > 1 && !(adapter->flags & USING_MSIX))) + return -EINVAL; +@@ -2334,6 +2341,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EPERM; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_LOAD_FW) ++ return -EINVAL; + /* Check t.len sanity ? */ + fw_data = memdup_user(useraddr + sizeof(t), t.len); + if (IS_ERR(fw_data)) +@@ -2357,6 +2366,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&m, useraddr, sizeof(m))) + return -EFAULT; ++ if (m.cmd != CHELSIO_SETMTUTAB) ++ return -EINVAL; + if (m.nmtus != NMTUS) + return -EINVAL; + if (m.mtus[0] < 81) /* accommodate SACK */ +@@ -2398,6 +2409,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&m, useraddr, sizeof(m))) + return -EFAULT; ++ if (m.cmd != CHELSIO_SET_PM) ++ return -EINVAL; + if (!is_power_of_2(m.rx_pg_sz) || + !is_power_of_2(m.tx_pg_sz)) + return -EINVAL; /* not power of 2 */ +@@ -2431,6 +2444,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EIO; /* need the memory controllers */ + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_GET_MEM) ++ return -EINVAL; + if ((t.addr & 7) || (t.len & 7)) + return -EINVAL; + if (t.mem_id == MEM_CM) +@@ -2483,6 +2498,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EAGAIN; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_SET_TRACE_FILTER) ++ return -EINVAL; + + tp = (const struct trace_params *)&t.sip; + if (t.config_tx) +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index f314be07ec58..07282eb76867 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1708,7 +1708,7 @@ static int enic_open(struct net_device *netdev) + { + struct enic *enic = netdev_priv(netdev); + unsigned int i; +- int err; ++ int err, ret; + + err = enic_request_intr(enic); + if (err) { +@@ -1766,10 +1766,9 @@ static int enic_open(struct net_device *netdev) + + err_out_free_rq: + for (i = 0; i < enic->rq_count; i++) { +- err = vnic_rq_disable(&enic->rq[i]); +- if (err) +- return err; +- vnic_rq_clean(&enic->rq[i], enic_free_rq_buf); ++ ret = vnic_rq_disable(&enic->rq[i]); ++ if (!ret) ++ vnic_rq_clean(&enic->rq[i], enic_free_rq_buf); + } + enic_dev_notify_unset(enic); + err_out_free_intr: +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index fe00f71bc6b4..051ecc76a7ef 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1152,7 +1152,7 @@ static void fec_enet_timeout_work(struct work_struct *work) + napi_disable(&fep->napi); + netif_tx_lock_bh(ndev); + fec_restart(ndev); +- netif_wake_queue(ndev); ++ netif_tx_wake_all_queues(ndev); + netif_tx_unlock_bh(ndev); + napi_enable(&fep->napi); + } +@@ -1267,7 +1267,7 @@ skb_done: + + /* Since we have freed up a buffer, the ring is no longer full + */ +- if (netif_queue_stopped(ndev)) { ++ if (netif_tx_queue_stopped(nq)) { + entries_free = fec_enet_get_free_txdesc_num(txq); + if (entries_free >= txq->tx_wake_threshold) + netif_tx_wake_queue(nq); +@@ -1744,7 +1744,7 @@ static void fec_enet_adjust_link(struct net_device *ndev) + napi_disable(&fep->napi); + netif_tx_lock_bh(ndev); + fec_restart(ndev); +- netif_wake_queue(ndev); ++ netif_tx_wake_all_queues(ndev); + netif_tx_unlock_bh(ndev); + napi_enable(&fep->napi); + } +@@ -2247,7 +2247,7 @@ static int fec_enet_set_pauseparam(struct net_device *ndev, + napi_disable(&fep->napi); + netif_tx_lock_bh(ndev); + fec_restart(ndev); +- netif_wake_queue(ndev); ++ netif_tx_wake_all_queues(ndev); + netif_tx_unlock_bh(ndev); + napi_enable(&fep->napi); + } +diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +index 4b86260584a0..8b66551511f5 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c ++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +@@ -613,9 +613,11 @@ static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + +-static void fs_timeout(struct net_device *dev) ++static void fs_timeout_work(struct work_struct *work) + { +- struct fs_enet_private *fep = netdev_priv(dev); ++ struct fs_enet_private *fep = container_of(work, struct fs_enet_private, ++ timeout_work); ++ struct net_device *dev = fep->ndev; + unsigned long flags; + int wake = 0; + +@@ -627,7 +629,6 @@ static void fs_timeout(struct net_device *dev) + phy_stop(dev->phydev); + (*fep->ops->stop)(dev); + (*fep->ops->restart)(dev); +- phy_start(dev->phydev); + } + + phy_start(dev->phydev); +@@ -639,6 +640,13 @@ static void fs_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + ++static void fs_timeout(struct net_device *dev) ++{ ++ struct fs_enet_private *fep = netdev_priv(dev); ++ ++ schedule_work(&fep->timeout_work); ++} ++ + /*----------------------------------------------------------------------------- + * generic link-change handler - should be sufficient for most cases + *-----------------------------------------------------------------------------*/ +@@ -759,6 +767,7 @@ static int fs_enet_close(struct net_device *dev) + netif_stop_queue(dev); + netif_carrier_off(dev); + napi_disable(&fep->napi); ++ cancel_work_sync(&fep->timeout_work); + phy_stop(dev->phydev); + + spin_lock_irqsave(&fep->lock, flags); +@@ -1033,6 +1042,7 @@ static int fs_enet_probe(struct platform_device *ofdev) + + ndev->netdev_ops = &fs_enet_netdev_ops; + ndev->watchdog_timeo = 2 * HZ; ++ INIT_WORK(&fep->timeout_work, fs_timeout_work); + netif_napi_add(ndev, &fep->napi, fs_enet_napi, fpi->napi_weight); + + ndev->ethtool_ops = &fs_ethtool_ops; +diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h +index fee24c822fad..0e4e024449ec 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h ++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h +@@ -124,6 +124,7 @@ struct fs_enet_private { + spinlock_t lock; /* during all ops except TX pckt processing */ + spinlock_t tx_lock; /* during fs_start_xmit and fs_tx */ + struct fs_platform_info *fpi; ++ struct work_struct timeout_work; + const struct fs_ops *ops; + int rx_ring, tx_ring; + dma_addr_t ring_mem_addr; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +index abe290bfc638..8408682efd86 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +@@ -266,7 +266,7 @@ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw, u8 module_pointer, + * @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF) + * @data: word read from the Shadow RAM + * +- * Reads one 16 bit word from the Shadow RAM using the GLNVM_SRCTL register. ++ * Reads one 16 bit word from the Shadow RAM using the AdminQ + **/ + static i40e_status i40e_read_nvm_word_aq(struct i40e_hw *hw, u16 offset, + u16 *data) +@@ -280,27 +280,49 @@ static i40e_status i40e_read_nvm_word_aq(struct i40e_hw *hw, u16 offset, + } + + /** +- * i40e_read_nvm_word - Reads Shadow RAM ++ * __i40e_read_nvm_word - Reads nvm word, assumes called does the locking + * @hw: pointer to the HW structure + * @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF) + * @data: word read from the Shadow RAM + * +- * Reads one 16 bit word from the Shadow RAM using the GLNVM_SRCTL register. ++ * Reads one 16 bit word from the Shadow RAM. ++ * ++ * Do not use this function except in cases where the nvm lock is already ++ * taken via i40e_acquire_nvm(). ++ **/ ++static i40e_status __i40e_read_nvm_word(struct i40e_hw *hw, ++ u16 offset, u16 *data) ++{ ++ i40e_status ret_code = 0; ++ ++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) ++ ret_code = i40e_read_nvm_word_aq(hw, offset, data); ++ else ++ ret_code = i40e_read_nvm_word_srctl(hw, offset, data); ++ return ret_code; ++} ++ ++/** ++ * i40e_read_nvm_word - Reads nvm word and acquire lock if necessary ++ * @hw: pointer to the HW structure ++ * @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF) ++ * @data: word read from the Shadow RAM ++ * ++ * Reads one 16 bit word from the Shadow RAM. + **/ + i40e_status i40e_read_nvm_word(struct i40e_hw *hw, u16 offset, + u16 *data) + { +- enum i40e_status_code ret_code = 0; ++ i40e_status ret_code = 0; + + ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); +- if (!ret_code) { +- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { +- ret_code = i40e_read_nvm_word_aq(hw, offset, data); +- } else { +- ret_code = i40e_read_nvm_word_srctl(hw, offset, data); +- } +- i40e_release_nvm(hw); +- } ++ if (ret_code) ++ return ret_code; ++ ++ ret_code = __i40e_read_nvm_word(hw, offset, data); ++ ++ i40e_release_nvm(hw); ++ + return ret_code; + } + +@@ -393,31 +415,25 @@ read_nvm_buffer_aq_exit: + } + + /** +- * i40e_read_nvm_buffer - Reads Shadow RAM buffer ++ * __i40e_read_nvm_buffer - Reads nvm buffer, caller must acquire lock + * @hw: pointer to the HW structure + * @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF). + * @words: (in) number of words to read; (out) number of words actually read + * @data: words read from the Shadow RAM + * + * Reads 16 bit words (data buffer) from the SR using the i40e_read_nvm_srrd() +- * method. The buffer read is preceded by the NVM ownership take +- * and followed by the release. ++ * method. + **/ +-i40e_status i40e_read_nvm_buffer(struct i40e_hw *hw, u16 offset, +- u16 *words, u16 *data) ++static i40e_status __i40e_read_nvm_buffer(struct i40e_hw *hw, ++ u16 offset, u16 *words, ++ u16 *data) + { +- enum i40e_status_code ret_code = 0; ++ i40e_status ret_code = 0; + +- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { +- ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); +- if (!ret_code) { +- ret_code = i40e_read_nvm_buffer_aq(hw, offset, words, +- data); +- i40e_release_nvm(hw); +- } +- } else { ++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) ++ ret_code = i40e_read_nvm_buffer_aq(hw, offset, words, data); ++ else + ret_code = i40e_read_nvm_buffer_srctl(hw, offset, words, data); +- } + return ret_code; + } + +@@ -499,15 +515,15 @@ static i40e_status i40e_calc_nvm_checksum(struct i40e_hw *hw, + data = (u16 *)vmem.va; + + /* read pointer to VPD area */ +- ret_code = i40e_read_nvm_word(hw, I40E_SR_VPD_PTR, &vpd_module); ++ ret_code = __i40e_read_nvm_word(hw, I40E_SR_VPD_PTR, &vpd_module); + if (ret_code) { + ret_code = I40E_ERR_NVM_CHECKSUM; + goto i40e_calc_nvm_checksum_exit; + } + + /* read pointer to PCIe Alt Auto-load module */ +- ret_code = i40e_read_nvm_word(hw, I40E_SR_PCIE_ALT_AUTO_LOAD_PTR, +- &pcie_alt_module); ++ ret_code = __i40e_read_nvm_word(hw, I40E_SR_PCIE_ALT_AUTO_LOAD_PTR, ++ &pcie_alt_module); + if (ret_code) { + ret_code = I40E_ERR_NVM_CHECKSUM; + goto i40e_calc_nvm_checksum_exit; +@@ -521,7 +537,7 @@ static i40e_status i40e_calc_nvm_checksum(struct i40e_hw *hw, + if ((i % I40E_SR_SECTOR_SIZE_IN_WORDS) == 0) { + u16 words = I40E_SR_SECTOR_SIZE_IN_WORDS; + +- ret_code = i40e_read_nvm_buffer(hw, i, &words, data); ++ ret_code = __i40e_read_nvm_buffer(hw, i, &words, data); + if (ret_code) { + ret_code = I40E_ERR_NVM_CHECKSUM; + goto i40e_calc_nvm_checksum_exit; +@@ -593,14 +609,19 @@ i40e_status i40e_validate_nvm_checksum(struct i40e_hw *hw, + u16 checksum_sr = 0; + u16 checksum_local = 0; + ++ /* We must acquire the NVM lock in order to correctly synchronize the ++ * NVM accesses across multiple PFs. Without doing so it is possible ++ * for one of the PFs to read invalid data potentially indicating that ++ * the checksum is invalid. ++ */ ++ ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); ++ if (ret_code) ++ return ret_code; + ret_code = i40e_calc_nvm_checksum(hw, &checksum_local); ++ __i40e_read_nvm_word(hw, I40E_SR_SW_CHECKSUM_WORD, &checksum_sr); ++ i40e_release_nvm(hw); + if (ret_code) +- goto i40e_validate_nvm_checksum_exit; +- +- /* Do not use i40e_read_nvm_word() because we do not want to take +- * the synchronization semaphores twice here. +- */ +- i40e_read_nvm_word(hw, I40E_SR_SW_CHECKSUM_WORD, &checksum_sr); ++ return ret_code; + + /* Verify read checksum from EEPROM is the same as + * calculated checksum +@@ -612,7 +633,6 @@ i40e_status i40e_validate_nvm_checksum(struct i40e_hw *hw, + if (checksum) + *checksum = checksum_local; + +-i40e_validate_nvm_checksum_exit: + return ret_code; + } + +@@ -986,6 +1006,7 @@ retry: + break; + + case I40E_NVMUPD_CSUM_CON: ++ /* Assumes the caller has acquired the nvm */ + status = i40e_update_nvm_checksum(hw); + if (status) { + *perrno = hw->aq.asq_last_status ? +@@ -1000,6 +1021,7 @@ retry: + break; + + case I40E_NVMUPD_CSUM_LCB: ++ /* Assumes the caller has acquired the nvm */ + status = i40e_update_nvm_checksum(hw); + if (status) { + *perrno = hw->aq.asq_last_status ? +diff --git a/drivers/net/ethernet/intel/i40e/i40e_prototype.h b/drivers/net/ethernet/intel/i40e/i40e_prototype.h +index 4660c5abc855..6b364118badd 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_prototype.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_prototype.h +@@ -311,8 +311,6 @@ i40e_status i40e_acquire_nvm(struct i40e_hw *hw, + void i40e_release_nvm(struct i40e_hw *hw); + i40e_status i40e_read_nvm_word(struct i40e_hw *hw, u16 offset, + u16 *data); +-i40e_status i40e_read_nvm_buffer(struct i40e_hw *hw, u16 offset, +- u16 *words, u16 *data); + i40e_status i40e_update_nvm_checksum(struct i40e_hw *hw); + i40e_status i40e_validate_nvm_checksum(struct i40e_hw *hw, + u16 *checksum); +diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c +index 4a50870e0fa7..a61447fd778e 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_82575.c ++++ b/drivers/net/ethernet/intel/igb/e1000_82575.c +@@ -245,19 +245,7 @@ static s32 igb_init_phy_params_82575(struct e1000_hw *hw) + hw->bus.func = (rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) >> + E1000_STATUS_FUNC_SHIFT; + +- /* Make sure the PHY is in a good state. Several people have reported +- * firmware leaving the PHY's page select register set to something +- * other than the default of zero, which causes the PHY ID read to +- * access something other than the intended register. +- */ +- ret_val = hw->phy.ops.reset(hw); +- if (ret_val) { +- hw_dbg("Error resetting the PHY.\n"); +- goto out; +- } +- + /* Set phy->phy_addr and phy->id. */ +- igb_write_phy_reg_82580(hw, I347AT4_PAGE_SELECT, 0); + ret_val = igb_get_phy_id_82575(hw); + if (ret_val) + return ret_val; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 9680c8805178..1d5263c46eee 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -965,7 +965,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, + + err = wait_func(dev, ent); + if (err == -ETIMEDOUT) +- goto out_free; ++ goto out; + + ds = ent->ts2 - ent->ts1; + op = MLX5_GET(mbox_in, in->first.data, opcode); +@@ -1428,6 +1428,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) + mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n", + ent->idx); + free_ent(cmd, ent->idx); ++ free_cmd(ent); + } + continue; + } +@@ -1486,7 +1487,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced) + free_msg(dev, ent->in); + + err = err ? err : ent->status; +- free_cmd(ent); ++ if (!forced) ++ free_cmd(ent); + callback(err, context); + } else { + complete(&ent->done); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c +index 23ccec4cb7f5..a1f3556307c7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c +@@ -197,9 +197,15 @@ static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr, + return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER : + MLX5E_AM_STATS_WORSE; + ++ if (!prev->ppms) ++ return curr->ppms ? MLX5E_AM_STATS_BETTER : ++ MLX5E_AM_STATS_SAME; ++ + if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms)) + return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER : + MLX5E_AM_STATS_WORSE; ++ if (!prev->epms) ++ return MLX5E_AM_STATS_SAME; + + if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms)) + return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER : +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index 448e71e07668..264f51b3409d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -369,10 +369,11 @@ void mlx5_drain_health_wq(struct mlx5_core_dev *dev) + void mlx5_drain_health_recovery(struct mlx5_core_dev *dev) + { + struct mlx5_core_health *health = &dev->priv.health; ++ unsigned long flags; + +- spin_lock(&health->wq_lock); ++ spin_lock_irqsave(&health->wq_lock, flags); + set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags); +- spin_unlock(&health->wq_lock); ++ spin_unlock_irqrestore(&health->wq_lock, flags); + cancel_delayed_work_sync(&dev->priv.health.recover_work); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 6698a3a07406..d676088512cf 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -957,7 +957,7 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv, + if (err) { + dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n", + FW_PRE_INIT_TIMEOUT_MILI); +- goto out; ++ goto out_err; + } + + err = mlx5_cmd_init(dev); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_hw.c b/drivers/net/ethernet/qlogic/qed/qed_hw.c +index 6e4fae9b1430..944749cfe092 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_hw.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_hw.c +@@ -34,6 +34,7 @@ struct qed_ptt { + struct list_head list_entry; + unsigned int idx; + struct pxp_ptt_entry pxp; ++ u8 hwfn_id; + }; + + struct qed_ptt_pool { +@@ -55,6 +56,7 @@ int qed_ptt_pool_alloc(struct qed_hwfn *p_hwfn) + p_pool->ptts[i].idx = i; + p_pool->ptts[i].pxp.offset = QED_BAR_INVALID_OFFSET; + p_pool->ptts[i].pxp.pretend.control = 0; ++ p_pool->ptts[i].hwfn_id = p_hwfn->my_id; + if (i >= RESERVED_PTT_MAX) + list_add(&p_pool->ptts[i].list_entry, + &p_pool->free_list); +@@ -169,6 +171,11 @@ static u32 qed_set_ptt(struct qed_hwfn *p_hwfn, + + offset = hw_addr - win_hw_addr; + ++ if (p_ptt->hwfn_id != p_hwfn->my_id) ++ DP_NOTICE(p_hwfn, ++ "ptt[%d] of hwfn[%02x] is used by hwfn[%02x]!\n", ++ p_ptt->idx, p_ptt->hwfn_id, p_hwfn->my_id); ++ + /* Verify the address is within the window */ + if (hw_addr < win_hw_addr || + offset >= PXP_EXTERNAL_BAR_PF_WINDOW_SINGLE_SIZE) { +diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c +index d9dcb0d1714c..07783d13df71 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c +@@ -1059,23 +1059,16 @@ static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid, + + static enum roce_flavor qed_roce_mode_to_flavor(enum roce_mode roce_mode) + { +- enum roce_flavor flavor; +- + switch (roce_mode) { + case ROCE_V1: +- flavor = PLAIN_ROCE; +- break; ++ return PLAIN_ROCE; + case ROCE_V2_IPV4: +- flavor = RROCE_IPV4; +- break; ++ return RROCE_IPV4; + case ROCE_V2_IPV6: +- flavor = ROCE_V2_IPV6; +- break; ++ return RROCE_IPV6; + default: +- flavor = MAX_ROCE_MODE; +- break; ++ return MAX_ROCE_FLAVOR; + } +- return flavor; + } + + static int qed_roce_alloc_cid(struct qed_hwfn *p_hwfn, u16 *cid) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c +index faf8215872de..9cc02b94328a 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c +@@ -295,7 +295,6 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn) + } + + if (!p_iov->b_pre_fp_hsi && +- ETH_HSI_VER_MINOR && + (resp->pfdev_info.minor_fp_hsi < ETH_HSI_VER_MINOR)) { + DP_INFO(p_hwfn, + "PF is using older fastpath HSI; %02x.%02x is configured\n", +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +index 5ddadcd0c8db..f1242ab32ca6 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +@@ -1825,22 +1825,44 @@ struct qlcnic_hardware_ops { + u32 (*get_cap_size)(void *, int); + void (*set_sys_info)(void *, int, u32); + void (*store_cap_mask)(void *, u32); ++ bool (*encap_rx_offload) (struct qlcnic_adapter *adapter); ++ bool (*encap_tx_offload) (struct qlcnic_adapter *adapter); + }; + + extern struct qlcnic_nic_template qlcnic_vf_ops; + +-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter) ++static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter) + { + return adapter->ahw->extra_capability[0] & + QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD; + } + +-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter) ++static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter) + { + return adapter->ahw->extra_capability[0] & + QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD; + } + ++static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter) ++{ ++ return false; ++} ++ ++static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter) ++{ ++ return false; ++} ++ ++static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter) ++{ ++ return adapter->ahw->hw_ops->encap_rx_offload(adapter); ++} ++ ++static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter) ++{ ++ return adapter->ahw->hw_ops->encap_tx_offload(adapter); ++} ++ + static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter) + { + return adapter->nic_ops->start_firmware(adapter); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index 05d32e86bcf7..35c5ac41c0a1 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = { + .get_cap_size = qlcnic_83xx_get_cap_size, + .set_sys_info = qlcnic_83xx_set_sys_info, + .store_cap_mask = qlcnic_83xx_store_cap_mask, ++ .encap_rx_offload = qlcnic_83xx_encap_rx_offload, ++ .encap_tx_offload = qlcnic_83xx_encap_tx_offload, + }; + + static struct qlcnic_nic_template qlcnic_83xx_ops = { +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +index 3ae3968b0edf..ebf5ead16939 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = { + .get_cap_size = qlcnic_82xx_get_cap_size, + .set_sys_info = qlcnic_82xx_set_sys_info, + .store_cap_mask = qlcnic_82xx_store_cap_mask, ++ .encap_rx_offload = qlcnic_82xx_encap_rx_offload, ++ .encap_tx_offload = qlcnic_82xx_encap_tx_offload, + }; + + static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 2f656f395f39..c58180f40844 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = { + .free_mac_list = qlcnic_sriov_vf_free_mac_list, + .enable_sds_intr = qlcnic_83xx_enable_sds_intr, + .disable_sds_intr = qlcnic_83xx_disable_sds_intr, ++ .encap_rx_offload = qlcnic_83xx_encap_rx_offload, ++ .encap_tx_offload = qlcnic_83xx_encap_tx_offload, + }; + + static struct qlcnic_nic_template qlcnic_sriov_vf_ops = { +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 20f5c0cabc89..24754d3fb0ac 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -7559,17 +7559,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget) + struct rtl8169_private *tp = container_of(napi, struct rtl8169_private, napi); + struct net_device *dev = tp->dev; + u16 enable_mask = RTL_EVENT_NAPI | tp->event_slow; +- int work_done= 0; ++ int work_done; + u16 status; + + status = rtl_get_events(tp); + rtl_ack_events(tp, status & ~tp->event_slow); + +- if (status & RTL_EVENT_NAPI_RX) +- work_done = rtl_rx(dev, tp, (u32) budget); ++ work_done = rtl_rx(dev, tp, (u32) budget); + +- if (status & RTL_EVENT_NAPI_TX) +- rtl_tx(dev, tp); ++ rtl_tx(dev, tp); + + if (status & tp->event_slow) { + enable_mask &= ~tp->event_slow; +diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +index 489ef146201e..6a9c954492f2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +@@ -37,6 +37,7 @@ + #define TSE_PCS_CONTROL_AN_EN_MASK BIT(12) + #define TSE_PCS_CONTROL_REG 0x00 + #define TSE_PCS_CONTROL_RESTART_AN_MASK BIT(9) ++#define TSE_PCS_CTRL_AUTONEG_SGMII 0x1140 + #define TSE_PCS_IF_MODE_REG 0x28 + #define TSE_PCS_LINK_TIMER_0_REG 0x24 + #define TSE_PCS_LINK_TIMER_1_REG 0x26 +@@ -65,6 +66,7 @@ + #define TSE_PCS_SW_RESET_TIMEOUT 100 + #define TSE_PCS_USE_SGMII_AN_MASK BIT(1) + #define TSE_PCS_USE_SGMII_ENA BIT(0) ++#define TSE_PCS_IF_USE_SGMII 0x03 + + #define SGMII_ADAPTER_CTRL_REG 0x00 + #define SGMII_ADAPTER_DISABLE 0x0001 +@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs) + { + int ret = 0; + +- writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG); ++ writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG); ++ ++ writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG); + + writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG); + writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 0df71865fab1..65ed02bc3ea3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -2199,7 +2199,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + unsigned int nopaged_len = skb_headlen(skb); + int i, csum_insertion = 0, is_jumbo = 0; + int nfrags = skb_shinfo(skb)->nr_frags; +- unsigned int entry, first_entry; ++ int entry; ++ unsigned int first_entry; + struct dma_desc *desc, *first; + unsigned int enh_desc; + unsigned int des; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index ec295851812b..2abeba41c0af 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -216,7 +216,7 @@ static int stmmac_mdio_write_gmac4(struct mii_bus *bus, int phyaddr, int phyreg, + */ + int stmmac_mdio_reset(struct mii_bus *bus) + { +-#if defined(CONFIG_STMMAC_PLATFORM) ++#if IS_ENABLED(CONFIG_STMMAC_PLATFORM) + struct net_device *ndev = bus->priv; + struct stmmac_priv *priv = netdev_priv(ndev); + unsigned int mii_address = priv->hw->mii.addr; +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 365a48cfcbbf..653f0b185a68 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -744,6 +744,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb, + sg_init_table(sg, ret); + ret = skb_to_sgvec(skb, sg, 0, skb->len); + if (unlikely(ret < 0)) { ++ aead_request_free(req); + macsec_txsa_put(tx_sa); + kfree_skb(skb); + return ERR_PTR(ret); +@@ -956,6 +957,7 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb, + sg_init_table(sg, ret); + ret = skb_to_sgvec(skb, sg, 0, skb->len); + if (unlikely(ret < 0)) { ++ aead_request_free(req); + kfree_skb(skb); + return ERR_PTR(ret); + } +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index c60c147708c4..520352327104 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1610,7 +1610,7 @@ static struct phy_driver marvell_drivers[] = { + .flags = PHY_HAS_INTERRUPT, + .probe = marvell_probe, + .config_init = &m88e1145_config_init, +- .config_aneg = &marvell_config_aneg, ++ .config_aneg = &m88e1101_config_aneg, + .read_status = &genphy_read_status, + .ack_interrupt = &marvell_ack_interrupt, + .config_intr = &marvell_config_intr, +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index 125cff57c759..3dbb0646b024 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -575,6 +575,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= AX_MONITOR_LINK; + if (wolinfo->wolopts & WAKE_MAGIC) +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 8a6675d92b98..559af8e6ad90 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= AX_MONITOR_MODE_RWLC; + if (wolinfo->wolopts & WAKE_MAGIC) +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 3086cae62fdc..7b158674ceed 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -772,7 +772,7 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + int err; + u8 iface_no; + struct usb_cdc_parsed_header hdr; +- u16 curr_ntb_format; ++ __le16 curr_ntb_format; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) +@@ -890,7 +890,7 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + goto error2; + } + +- if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) { ++ if (curr_ntb_format == cpu_to_le16(USB_CDC_NCM_NTB32_FORMAT)) { + dev_info(&intf->dev, "resetting NTB format to 16-bit"); + err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT, + USB_TYPE_CLASS | USB_DIR_OUT +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index c5e04d1ad73a..0cbcd3f77341 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1311,19 +1311,10 @@ static int lan78xx_set_wol(struct net_device *netdev, + if (ret < 0) + return ret; + +- pdata->wol = 0; +- if (wol->wolopts & WAKE_UCAST) +- pdata->wol |= WAKE_UCAST; +- if (wol->wolopts & WAKE_MCAST) +- pdata->wol |= WAKE_MCAST; +- if (wol->wolopts & WAKE_BCAST) +- pdata->wol |= WAKE_BCAST; +- if (wol->wolopts & WAKE_MAGIC) +- pdata->wol |= WAKE_MAGIC; +- if (wol->wolopts & WAKE_PHY) +- pdata->wol |= WAKE_PHY; +- if (wol->wolopts & WAKE_ARP) +- pdata->wol |= WAKE_ARP; ++ if (wol->wolopts & ~WAKE_ALL) ++ return -EINVAL; ++ ++ pdata->wol = wol->wolopts; + + device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts); + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 5988674818ed..02e29562d254 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3776,6 +3776,9 @@ static int rtl8152_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) + if (!rtl_can_wakeup(tp)) + return -EOPNOTSUPP; + ++ if (wol->wolopts & ~WAKE_ANY) ++ return -EINVAL; ++ + ret = usb_autopm_get_interface(tp->intf); + if (ret < 0) + goto out_set_wol; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 8d3f938c6a51..977d9c772554 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -731,6 +731,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net, + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); + int ret; + ++ if (wolinfo->wolopts & ~SUPPORTED_WAKE) ++ return -EINVAL; ++ + pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; + + ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 831aa33d078a..a167116ceeee 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -775,6 +775,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, + struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); + int ret; + ++ if (wolinfo->wolopts & ~SUPPORTED_WAKE) ++ return -EINVAL; ++ + pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; + + ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); +diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c +index a50df0d8fb9a..004c955c1fd1 100644 +--- a/drivers/net/usb/sr9800.c ++++ b/drivers/net/usb/sr9800.c +@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= SR_MONITOR_LINK; + if (wolinfo->wolopts & WAKE_MAGIC) +diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c +index 45226dbee5ce..da770af83036 100644 +--- a/drivers/net/wireless/ath/ath10k/ahb.c ++++ b/drivers/net/wireless/ath/ath10k/ahb.c +@@ -640,6 +640,7 @@ static int ath10k_ahb_hif_start(struct ath10k *ar) + { + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif start\n"); + ++ napi_enable(&ar->napi); + ath10k_ce_enable_interrupts(ar); + ath10k_pci_enable_legacy_irq(ar); + +@@ -692,7 +693,6 @@ static int ath10k_ahb_hif_power_up(struct ath10k *ar) + ath10k_err(ar, "could not wake up target CPU: %d\n", ret); + goto err_ce_deinit; + } +- napi_enable(&ar->napi); + + return 0; + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 65ad7a130ca1..1e41d6c6de36 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -698,7 +698,8 @@ static int ath10k_core_get_board_id_from_otp(struct ath10k *ar) + + if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0 || + (board_id == 0)) { +- ath10k_warn(ar, "board id is not exist in otp, ignore it\n"); ++ ath10k_dbg(ar, ATH10K_DBG_BOOT, ++ "board id does not exist in otp, ignore it\n"); + return -EOPNOTSUPP; + } + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 4bb36dc73433..cbb3e902e347 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2665,8 +2665,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, + list_add_tail(&data->list, &hwsim_radios); + spin_unlock_bh(&hwsim_radio_lock); + +- if (idx > 0) +- hwsim_mcast_new_radio(idx, info, param); ++ hwsim_mcast_new_radio(idx, info, param); + + return idx; + +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index a0ae8d8763bb..06a57c708992 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1368,6 +1368,10 @@ static int if_sdio_suspend(struct device *dev) + if (priv->wol_criteria == EHS_REMOVE_WAKEUP) { + dev_info(dev, "Suspend without wake params -- powering down card\n"); + if (priv->fw_ready) { ++ ret = lbs_suspend(priv); ++ if (ret) ++ return ret; ++ + priv->power_up_on_resume = true; + if_sdio_power_off(card); + } +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 3c1adb38412b..aceae791baf3 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1848,7 +1848,7 @@ static int talk_to_netback(struct xenbus_device *dev, + err = xen_net_read_mac(dev, info->netdev->dev_addr); + if (err) { + xenbus_dev_fatal(dev, err, "parsing %s/mac", dev->nodename); +- goto out; ++ goto out_unlocked; + } + + rtnl_lock(); +@@ -1963,6 +1963,7 @@ abort_transaction_no_dev_fatal: + xennet_destroy_queues(info); + out: + rtnl_unlock(); ++out_unlocked: + device_unregister(&dev->dev); + return err; + } +@@ -1994,10 +1995,6 @@ static int xennet_connect(struct net_device *dev) + /* talk_to_netback() sets the correct number of queues */ + num_queues = dev->real_num_tx_queues; + +- rtnl_lock(); +- netdev_update_features(dev); +- rtnl_unlock(); +- + if (dev->reg_state == NETREG_UNINITIALIZED) { + err = register_netdev(dev); + if (err) { +@@ -2007,6 +2004,10 @@ static int xennet_connect(struct net_device *dev) + } + } + ++ rtnl_lock(); ++ netdev_update_features(dev); ++ rtnl_unlock(); ++ + /* + * All public and private state should now be sane. Get + * ready to start sending and receiving packets and give the driver +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index fadf151ce830..1ac4cec5f4f7 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1393,11 +1393,9 @@ static inline void nvme_release_cmb(struct nvme_dev *dev) + if (dev->cmb) { + iounmap(dev->cmb); + dev->cmb = NULL; +- if (dev->cmbsz) { +- sysfs_remove_file_from_group(&dev->ctrl.device->kobj, +- &dev_attr_cmb.attr, NULL); +- dev->cmbsz = 0; +- } ++ sysfs_remove_file_from_group(&dev->ctrl.device->kobj, ++ &dev_attr_cmb.attr, NULL); ++ dev->cmbsz = 0; + } + } + +@@ -1632,16 +1630,14 @@ static int nvme_pci_enable(struct nvme_dev *dev) + + /* + * CMBs can currently only exist on >=1.2 PCIe devices. We only +- * populate sysfs if a CMB is implemented. Note that we add the +- * CMB attribute to the nvme_ctrl kobj which removes the need to remove +- * it on exit. Since nvme_dev_attrs_group has no name we can pass +- * NULL as final argument to sysfs_add_file_to_group. ++ * populate sysfs if a CMB is implemented. Since nvme_dev_attrs_group ++ * has no name we can pass NULL as final argument to ++ * sysfs_add_file_to_group. + */ + + if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) { + dev->cmb = nvme_map_cmb(dev); +- +- if (dev->cmbsz) { ++ if (dev->cmb) { + if (sysfs_add_file_to_group(&dev->ctrl.device->kobj, + &dev_attr_cmb.attr, NULL)) + dev_warn(dev->dev, +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 2caed285fd7b..cdb7752dcbb7 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -192,6 +192,7 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req) + id->vid = 0; + id->ssvid = 0; + ++ memset(id->sn, ' ', sizeof(id->sn)); + bin2hex(id->sn, &ctrl->subsys->serial, + min(sizeof(ctrl->subsys->serial), sizeof(id->sn) / 2)); + copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index c7a695c2303a..2250f0d33481 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1634,8 +1634,8 @@ static void quirk_pcie_mch(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7520_MCH, quirk_pcie_mch); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7320_MCH, quirk_pcie_mch); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_E7525_MCH, quirk_pcie_mch); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_HUAWEI, 0x1610, quirk_pcie_mch); + ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_HUAWEI, 0x1610, PCI_CLASS_BRIDGE_PCI, 8, quirk_pcie_mch); + + /* + * It's possible for the MSI to get corrupted if shpc and acpi +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index c29b9b611ab2..1515c9480f89 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -1856,7 +1856,7 @@ static acpi_status __init acer_wmi_get_handle_cb(acpi_handle ah, u32 level, + if (!strcmp(ctx, "SENR")) { + if (acpi_bus_get_device(ah, &dev)) + return AE_OK; +- if (!strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev))) ++ if (strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev))) + return AE_OK; + } else + return AE_OK; +@@ -1877,8 +1877,7 @@ static int __init acer_wmi_get_handle(const char *name, const char *prop, + handle = NULL; + status = acpi_get_devices(prop, acer_wmi_get_handle_cb, + (void *)name, &handle); +- +- if (ACPI_SUCCESS(status)) { ++ if (ACPI_SUCCESS(status) && handle) { + *ah = handle; + return 0; + } else { +@@ -2247,8 +2246,8 @@ static int __init acer_wmi_init(void) + if (err) + return err; + err = acer_wmi_accel_setup(); +- if (err) +- return err; ++ if (err && err != -ENODEV) ++ pr_warn("Cannot enable accelerometer\n"); + } + + err = platform_driver_register(&acer_platform_driver); +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 51364621f77c..a421d6c551b6 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -24,6 +24,8 @@ + #include <linux/slab.h> + #include <linux/timekeeping.h> + ++#include <linux/nospec.h> ++ + #include "ptp_private.h" + + static int ptp_disable_pinfunc(struct ptp_clock_info *ops, +@@ -248,6 +250,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) + err = -EINVAL; + break; + } ++ pin_index = array_index_nospec(pin_index, ops->n_pins); + if (mutex_lock_interruptible(&ptp->pincfg_mux)) + return -ERESTARTSYS; + pd = ops->pin_config[pin_index]; +@@ -266,6 +269,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) + err = -EINVAL; + break; + } ++ pin_index = array_index_nospec(pin_index, ops->n_pins); + if (mutex_lock_interruptible(&ptp->pincfg_mux)) + return -ERESTARTSYS; + err = ptp_set_pinfunc(ptp, pin_index, pd.func, pd.chan); +diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c +index 35ce53edabf9..d5e5229308f2 100644 +--- a/drivers/reset/hisilicon/hi6220_reset.c ++++ b/drivers/reset/hisilicon/hi6220_reset.c +@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void) + } + + postcore_initcall(hi6220_reset_init); ++ ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c +index 7b178d765726..c0592fda409e 100644 +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -445,7 +445,7 @@ err_out: + return -1; + + err_blink: +- return (status > 16) & 0xFF; ++ return (status >> 16) & 0xFF; + } + + /** +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5f66b6da65f2..b6d9e3104b89 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -368,8 +368,8 @@ qla24xx_abort_sp_done(void *data, void *ptr, int res) + srb_t *sp = (srb_t *)ptr; + struct srb_iocb *abt = &sp->u.iocb_cmd; + +- del_timer(&sp->u.iocb_cmd.timer); +- complete(&abt->u.abt.comp); ++ if (del_timer(&sp->u.iocb_cmd.timer)) ++ complete(&abt->u.abt.comp); + } + + static int +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 2caacd9d2526..2cc82ed6433a 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -2713,6 +2713,9 @@ static int qman_alloc_range(struct gen_pool *p, u32 *result, u32 cnt) + { + unsigned long addr; + ++ if (!p) ++ return -ENODEV; ++ + addr = gen_pool_alloc(p, cnt); + if (!addr) + return -ENOMEM; +diff --git a/drivers/soc/fsl/qe/ucc.c b/drivers/soc/fsl/qe/ucc.c +index c646d8713861..681f7d4b7724 100644 +--- a/drivers/soc/fsl/qe/ucc.c ++++ b/drivers/soc/fsl/qe/ucc.c +@@ -626,7 +626,7 @@ static u32 ucc_get_tdm_sync_shift(enum comm_dir mode, u32 tdm_num) + { + u32 shift; + +- shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : RX_SYNC_SHIFT_BASE; ++ shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : TX_SYNC_SHIFT_BASE; + shift -= tdm_num * 2; + + return shift; +diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c +index 07d6e4824a9d..2e5e3b368532 100644 +--- a/drivers/staging/wilc1000/linux_wlan.c ++++ b/drivers/staging/wilc1000/linux_wlan.c +@@ -1260,11 +1260,12 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type, + else + strcpy(ndev->name, "p2p%d"); + +- vif->idx = wl->vif_num; + vif->wilc = *wilc; + vif->ndev = ndev; + wl->vif[i] = vif; + wl->vif_num = i; ++ vif->idx = wl->vif_num; ++ + ndev->netdev_ops = &wilc_netdev_ops; + + { +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 25ae9b9895a9..dbe44e890c99 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -333,17 +333,17 @@ static void acm_ctrl_irq(struct urb *urb) + + if (difference & ACM_CTRL_DSR) + acm->iocount.dsr++; +- if (difference & ACM_CTRL_BRK) +- acm->iocount.brk++; +- if (difference & ACM_CTRL_RI) +- acm->iocount.rng++; + if (difference & ACM_CTRL_DCD) + acm->iocount.dcd++; +- if (difference & ACM_CTRL_FRAMING) ++ if (newctrl & ACM_CTRL_BRK) ++ acm->iocount.brk++; ++ if (newctrl & ACM_CTRL_RI) ++ acm->iocount.rng++; ++ if (newctrl & ACM_CTRL_FRAMING) + acm->iocount.frame++; +- if (difference & ACM_CTRL_PARITY) ++ if (newctrl & ACM_CTRL_PARITY) + acm->iocount.parity++; +- if (difference & ACM_CTRL_OVERRUN) ++ if (newctrl & ACM_CTRL_OVERRUN) + acm->iocount.overrun++; + spin_unlock(&acm->read_lock); + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 988240e3cb58..52fc2084b310 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1490,8 +1490,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + u = 0; + switch (uurb->type) { + case USBDEVFS_URB_TYPE_CONTROL: +- if (is_in) +- allow_short = true; + if (!usb_endpoint_xfer_control(&ep->desc)) + return -EINVAL; + /* min 8 byte setup packet */ +@@ -1521,6 +1519,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + is_in = 0; + uurb->endpoint &= ~USB_DIR_IN; + } ++ if (is_in) ++ allow_short = true; + snoop(&ps->dev->dev, "control urb: bRequestType=%02x " + "bRequest=%02x wValue=%04x " + "wIndex=%04x wLength=%04x\n", +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index f221cb479e14..8e69150776f5 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -512,15 +512,6 @@ static int dwc3_omap_probe(struct platform_device *pdev) + + /* check the DMA Status */ + reg = dwc3_omap_readl(omap->base, USBOTGSS_SYSCONFIG); +- irq_set_status_flags(omap->irq, IRQ_NOAUTOEN); +- ret = devm_request_threaded_irq(dev, omap->irq, dwc3_omap_interrupt, +- dwc3_omap_interrupt_thread, IRQF_SHARED, +- "dwc3-omap", omap); +- if (ret) { +- dev_err(dev, "failed to request IRQ #%d --> %d\n", +- omap->irq, ret); +- goto err1; +- } + + ret = dwc3_omap_extcon_register(omap); + if (ret < 0) +@@ -532,8 +523,15 @@ static int dwc3_omap_probe(struct platform_device *pdev) + goto err2; + } + ++ ret = devm_request_threaded_irq(dev, omap->irq, dwc3_omap_interrupt, ++ dwc3_omap_interrupt_thread, IRQF_SHARED, ++ "dwc3-omap", omap); ++ if (ret) { ++ dev_err(dev, "failed to request IRQ #%d --> %d\n", ++ omap->irq, ret); ++ goto err1; ++ } + dwc3_omap_enable_irqs(omap); +- enable_irq(omap->irq); + return 0; + + err2: +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index d2fc237cd87a..fac9424940d4 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -220,6 +220,8 @@ + #include <linux/usb/gadget.h> + #include <linux/usb/composite.h> + ++#include <linux/nospec.h> ++ + #include "configfs.h" + + +@@ -3260,6 +3262,7 @@ static struct config_group *fsg_lun_make(struct config_group *group, + fsg_opts = to_fsg_opts(&group->cg_item); + if (num >= FSG_MAX_LUNS) + return ERR_PTR(-ERANGE); ++ num = array_index_nospec(num, FSG_MAX_LUNS); + + mutex_lock(&fsg_opts->lock); + if (fsg_opts->refcnt || fsg_opts->common->luns[num]) { +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 45a03eff4db1..0f09ab5399f4 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -366,7 +366,7 @@ int xhci_find_slot_id_by_port(struct usb_hcd *hcd, struct xhci_hcd *xhci, + + slot_id = 0; + for (i = 0; i < MAX_HC_SLOTS; i++) { +- if (!xhci->devs[i]) ++ if (!xhci->devs[i] || !xhci->devs[i]->udev) + continue; + speed = xhci->devs[i]->udev->speed; + if (((speed >= USB_SPEED_SUPER) == (hcd->speed >= HCD_USB3)) +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 93fba9033b00..5984fb134cf4 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -639,14 +639,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep) + struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); + struct usbhs_pipe *pipe; + unsigned long flags; +- int ret = 0; + + spin_lock_irqsave(&uep->lock, flags); + pipe = usbhsg_uep_to_pipe(uep); +- if (!pipe) { +- ret = -EINVAL; ++ if (!pipe) + goto out; +- } + + usbhsg_pipe_disable(uep); + usbhs_pipe_free(pipe); +@@ -1085,7 +1082,6 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv) + ret = -ENOMEM; + goto usbhs_mod_gadget_probe_err_gpriv; + } +- spin_lock_init(&uep->lock); + + gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED); + dev_info(dev, "%stransceiver found\n", +@@ -1135,6 +1131,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv) + uep->ep.name = uep->ep_name; + uep->ep.ops = &usbhsg_ep_ops; + INIT_LIST_HEAD(&uep->ep.ep_list); ++ spin_lock_init(&uep->lock); + + /* init DCP */ + if (usbhsg_is_dcp(uep)) { +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index c569b6454a9d..4c5625cb540c 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -28,6 +28,7 @@ + #include <linux/module.h> + #include <linux/sort.h> + #include <linux/interval_tree_generic.h> ++#include <linux/nospec.h> + + #include "vhost.h" + +@@ -1289,6 +1290,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp) + if (idx >= d->nvqs) + return -ENOBUFS; + ++ idx = array_index_nospec(idx, d->nvqs); + vq = d->vqs[idx]; + + mutex_lock(&vq->mutex); +diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c +index 6f2e729a308f..f4b6d063a4b7 100644 +--- a/drivers/video/fbdev/efifb.c ++++ b/drivers/video/fbdev/efifb.c +@@ -375,7 +375,7 @@ static void efifb_fixup_resources(struct pci_dev *dev) + if (!base) + return; + +- for (i = 0; i < PCI_STD_RESOURCE_END; i++) { ++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) { + struct resource *res = &dev->resource[i]; + + if (!(res->flags & IORESOURCE_MEM)) +diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c +index def3a501acd6..d059d04c63ac 100644 +--- a/drivers/video/fbdev/pxa168fb.c ++++ b/drivers/video/fbdev/pxa168fb.c +@@ -712,7 +712,7 @@ static int pxa168fb_probe(struct platform_device *pdev) + /* + * enable controller clock + */ +- clk_enable(fbi->clk); ++ clk_prepare_enable(fbi->clk); + + pxa168fb_set_par(info); + +@@ -767,7 +767,7 @@ static int pxa168fb_probe(struct platform_device *pdev) + failed_free_cmap: + fb_dealloc_cmap(&info->cmap); + failed_free_clk: +- clk_disable(fbi->clk); ++ clk_disable_unprepare(fbi->clk); + failed_free_fbmem: + dma_free_coherent(fbi->dev, info->fix.smem_len, + info->screen_base, fbi->fb_start_dma); +@@ -807,7 +807,7 @@ static int pxa168fb_remove(struct platform_device *pdev) + dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len), + info->screen_base, info->fix.smem_start); + +- clk_disable(fbi->clk); ++ clk_disable_unprepare(fbi->clk); + + framebuffer_release(info); + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 2b96ca68dc10..5feaef9bcbda 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4377,6 +4377,123 @@ static struct extent_map *get_extent_skip_holes(struct inode *inode, + return NULL; + } + ++/* ++ * To cache previous fiemap extent ++ * ++ * Will be used for merging fiemap extent ++ */ ++struct fiemap_cache { ++ u64 offset; ++ u64 phys; ++ u64 len; ++ u32 flags; ++ bool cached; ++}; ++ ++/* ++ * Helper to submit fiemap extent. ++ * ++ * Will try to merge current fiemap extent specified by @offset, @phys, ++ * @len and @flags with cached one. ++ * And only when we fails to merge, cached one will be submitted as ++ * fiemap extent. ++ * ++ * Return value is the same as fiemap_fill_next_extent(). ++ */ ++static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo, ++ struct fiemap_cache *cache, ++ u64 offset, u64 phys, u64 len, u32 flags) ++{ ++ int ret = 0; ++ ++ if (!cache->cached) ++ goto assign; ++ ++ /* ++ * Sanity check, extent_fiemap() should have ensured that new ++ * fiemap extent won't overlap with cahced one. ++ * Not recoverable. ++ * ++ * NOTE: Physical address can overlap, due to compression ++ */ ++ if (cache->offset + cache->len > offset) { ++ WARN_ON(1); ++ return -EINVAL; ++ } ++ ++ /* ++ * Only merges fiemap extents if ++ * 1) Their logical addresses are continuous ++ * ++ * 2) Their physical addresses are continuous ++ * So truly compressed (physical size smaller than logical size) ++ * extents won't get merged with each other ++ * ++ * 3) Share same flags except FIEMAP_EXTENT_LAST ++ * So regular extent won't get merged with prealloc extent ++ */ ++ if (cache->offset + cache->len == offset && ++ cache->phys + cache->len == phys && ++ (cache->flags & ~FIEMAP_EXTENT_LAST) == ++ (flags & ~FIEMAP_EXTENT_LAST)) { ++ cache->len += len; ++ cache->flags |= flags; ++ goto try_submit_last; ++ } ++ ++ /* Not mergeable, need to submit cached one */ ++ ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys, ++ cache->len, cache->flags); ++ cache->cached = false; ++ if (ret) ++ return ret; ++assign: ++ cache->cached = true; ++ cache->offset = offset; ++ cache->phys = phys; ++ cache->len = len; ++ cache->flags = flags; ++try_submit_last: ++ if (cache->flags & FIEMAP_EXTENT_LAST) { ++ ret = fiemap_fill_next_extent(fieinfo, cache->offset, ++ cache->phys, cache->len, cache->flags); ++ cache->cached = false; ++ } ++ return ret; ++} ++ ++/* ++ * Sanity check for fiemap cache ++ * ++ * All fiemap cache should be submitted by emit_fiemap_extent() ++ * Iteration should be terminated either by last fiemap extent or ++ * fieinfo->fi_extents_max. ++ * So no cached fiemap should exist. ++ */ ++static int check_fiemap_cache(struct btrfs_fs_info *fs_info, ++ struct fiemap_extent_info *fieinfo, ++ struct fiemap_cache *cache) ++{ ++ int ret; ++ ++ if (!cache->cached) ++ return 0; ++ ++ /* Small and recoverbale problem, only to info developer */ ++#ifdef CONFIG_BTRFS_DEBUG ++ WARN_ON(1); ++#endif ++ btrfs_warn(fs_info, ++ "unhandled fiemap cache detected: offset=%llu phys=%llu len=%llu flags=0x%x", ++ cache->offset, cache->phys, cache->len, cache->flags); ++ ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys, ++ cache->len, cache->flags); ++ cache->cached = false; ++ if (ret > 0) ++ ret = 0; ++ return ret; ++} ++ + int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + __u64 start, __u64 len, get_extent_t *get_extent) + { +@@ -4394,6 +4511,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + struct extent_state *cached_state = NULL; + struct btrfs_path *path; + struct btrfs_root *root = BTRFS_I(inode)->root; ++ struct fiemap_cache cache = { 0 }; + int end = 0; + u64 em_start = 0; + u64 em_len = 0; +@@ -4573,8 +4691,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + flags |= FIEMAP_EXTENT_LAST; + end = 1; + } +- ret = fiemap_fill_next_extent(fieinfo, em_start, disko, +- em_len, flags); ++ ret = emit_fiemap_extent(fieinfo, &cache, em_start, disko, ++ em_len, flags); + if (ret) { + if (ret == 1) + ret = 0; +@@ -4582,6 +4700,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + } + } + out_free: ++ if (!ret) ++ ret = check_fiemap_cache(root->fs_info, fieinfo, &cache); + free_extent_map(em); + out: + btrfs_free_path(path); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index bd036557c6bc..5ebdb58079e1 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2966,7 +2966,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) + + ret = test_range_bit(io_tree, ordered_extent->file_offset, + ordered_extent->file_offset + ordered_extent->len - 1, +- EXTENT_DEFRAG, 1, cached_state); ++ EXTENT_DEFRAG, 0, cached_state); + if (ret) { + u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item); + if (0 && last_snapshot >= BTRFS_I(inode)->generation) +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index c8d2eec6596b..79dc3ee1de58 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5165,15 +5165,12 @@ static int is_extent_unchanged(struct send_ctx *sctx, + goto out; + } + +- right_disknr = btrfs_file_extent_disk_bytenr(eb, ei); + if (right_type == BTRFS_FILE_EXTENT_INLINE) { + right_len = btrfs_file_extent_inline_len(eb, slot, ei); + right_len = PAGE_ALIGN(right_len); + } else { + right_len = btrfs_file_extent_num_bytes(eb, ei); + } +- right_offset = btrfs_file_extent_offset(eb, ei); +- right_gen = btrfs_file_extent_generation(eb, ei); + + /* + * Are we at extent 8? If yes, we know the extent is changed. +@@ -5198,6 +5195,10 @@ static int is_extent_unchanged(struct send_ctx *sctx, + goto out; + } + ++ right_disknr = btrfs_file_extent_disk_bytenr(eb, ei); ++ right_offset = btrfs_file_extent_offset(eb, ei); ++ right_gen = btrfs_file_extent_generation(eb, ei); ++ + left_offset_fixed = left_offset; + if (key.offset < ekey->offset) { + /* Fix the right offset for 2a and 7. */ +diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c +index 2026885702a2..3fb95e3d20d6 100644 +--- a/fs/cachefiles/namei.c ++++ b/fs/cachefiles/namei.c +@@ -340,7 +340,7 @@ try_again: + trap = lock_rename(cache->graveyard, dir); + + /* do some checks before getting the grave dentry */ +- if (rep->d_parent != dir) { ++ if (rep->d_parent != dir || IS_DEADDIR(d_inode(rep))) { + /* the entry was probably culled when we dropped the parent dir + * lock */ + unlock_rename(cache->graveyard, dir); +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index a012f70bba5c..77a18fe10805 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -704,7 +704,7 @@ cgfi_exit: + /* Simple function to return a 64 bit hash of string. Rarely called */ + static __u64 simple_hashstr(const char *str) + { +- const __u64 hash_mult = 1125899906842597L; /* a big enough prime */ ++ const __u64 hash_mult = 1125899906842597ULL; /* a big enough prime */ + __u64 hash = 0; + + while (*str) +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 8add4e8bab99..af719d93507e 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -212,13 +212,9 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, + f2fs_put_page(dentry_page, 0); + } + +- /* This is to increase the speed of f2fs_create */ +- if (!de && room) { +- F2FS_I(dir)->task = current; +- if (F2FS_I(dir)->chash != namehash) { +- F2FS_I(dir)->chash = namehash; +- F2FS_I(dir)->clevel = level; +- } ++ if (!de && room && F2FS_I(dir)->chash != namehash) { ++ F2FS_I(dir)->chash = namehash; ++ F2FS_I(dir)->clevel = level; + } + + return de; +@@ -259,6 +255,9 @@ struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir, + break; + } + out: ++ /* This is to increase the speed of f2fs_create */ ++ if (!de) ++ F2FS_I(dir)->task = current; + return de; + } + +diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c +index 3b7644e43796..a9cad9b60790 100644 +--- a/fs/fat/fatent.c ++++ b/fs/fat/fatent.c +@@ -681,6 +681,7 @@ int fat_count_free_clusters(struct super_block *sb) + if (ops->ent_get(&fatent) == FAT_ENT_FREE) + free++; + } while (fat_ent_next(sbi, &fatent)); ++ cond_resched(); + } + sbi->free_clusters = free; + sbi->free_clus_valid = 1; +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 785fcc29d85d..5729d55da67d 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -2599,6 +2599,10 @@ void ocfs2_inode_unlock_tracker(struct inode *inode, + struct ocfs2_lock_res *lockres; + + lockres = &OCFS2_I(inode)->ip_inode_lockres; ++ /* had_lock means that the currect process already takes the cluster ++ * lock previously. If had_lock is 1, we have nothing to do here, and ++ * it will get unlocked where we got the lock. ++ */ + if (!had_lock) { + ocfs2_remove_holder(lockres, oh); + ocfs2_inode_unlock(inode, ex); +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 03f6ff249edb..01932763b4d1 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1330,20 +1330,21 @@ static int ocfs2_xattr_get(struct inode *inode, + void *buffer, + size_t buffer_size) + { +- int ret; ++ int ret, had_lock; + struct buffer_head *di_bh = NULL; ++ struct ocfs2_lock_holder oh; + +- ret = ocfs2_inode_lock(inode, &di_bh, 0); +- if (ret < 0) { +- mlog_errno(ret); +- return ret; ++ had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh); ++ if (had_lock < 0) { ++ mlog_errno(had_lock); ++ return had_lock; + } + down_read(&OCFS2_I(inode)->ip_xattr_sem); + ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index, + name, buffer, buffer_size); + up_read(&OCFS2_I(inode)->ip_xattr_sem); + +- ocfs2_inode_unlock(inode, 0); ++ ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); + + brelse(di_bh); + +@@ -3539,11 +3540,12 @@ int ocfs2_xattr_set(struct inode *inode, + { + struct buffer_head *di_bh = NULL; + struct ocfs2_dinode *di; +- int ret, credits, ref_meta = 0, ref_credits = 0; ++ int ret, credits, had_lock, ref_meta = 0, ref_credits = 0; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + struct inode *tl_inode = osb->osb_tl_inode; + struct ocfs2_xattr_set_ctxt ctxt = { NULL, NULL, NULL, }; + struct ocfs2_refcount_tree *ref_tree = NULL; ++ struct ocfs2_lock_holder oh; + + struct ocfs2_xattr_info xi = { + .xi_name_index = name_index, +@@ -3574,8 +3576,9 @@ int ocfs2_xattr_set(struct inode *inode, + return -ENOMEM; + } + +- ret = ocfs2_inode_lock(inode, &di_bh, 1); +- if (ret < 0) { ++ had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 1, &oh); ++ if (had_lock < 0) { ++ ret = had_lock; + mlog_errno(ret); + goto cleanup_nolock; + } +@@ -3672,7 +3675,7 @@ cleanup: + if (ret) + mlog_errno(ret); + } +- ocfs2_inode_unlock(inode, 1); ++ ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock); + cleanup_nolock: + brelse(di_bh); + brelse(xbs.xattr_bh); +diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c +index 237c9c04dc3b..a34b25be39c5 100644 +--- a/fs/orangefs/xattr.c ++++ b/fs/orangefs/xattr.c +@@ -76,7 +76,7 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, + if (S_ISLNK(inode->i_mode)) + return -EOPNOTSUPP; + +- if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) ++ if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) + return -EINVAL; + + fsuid = from_kuid(&init_user_ns, current_fsuid()); +@@ -169,7 +169,7 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name, + struct orangefs_kernel_op_s *new_op = NULL; + int ret = -ENOMEM; + +- if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) ++ if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) + return -EINVAL; + + down_write(&orangefs_inode->xattr_sem); +@@ -233,7 +233,7 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name, + + if (size > ORANGEFS_MAX_XATTR_VALUELEN) + return -EINVAL; +- if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) ++ if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) + return -EINVAL; + + internal_flag = convert_to_internal_xattr_flags(flags); +diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c +index a2760a2869f4..0f22c036699a 100644 +--- a/fs/ufs/inode.c ++++ b/fs/ufs/inode.c +@@ -846,6 +846,7 @@ void ufs_evict_inode(struct inode * inode) + inode->i_size = 0; + if (inode->i_blocks) + ufs_truncate_blocks(inode); ++ ufs_update_inode(inode, inode_needs_sync(inode)); + } + + invalidate_inode_buffers(inode); +diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c +index b456cca1bfb2..c0ecdec8e0a9 100644 +--- a/fs/xfs/libxfs/xfs_trans_resv.c ++++ b/fs/xfs/libxfs/xfs_trans_resv.c +@@ -232,8 +232,6 @@ xfs_calc_write_reservation( + * the super block to reflect the freed blocks: sector size + * worst case split in allocation btrees per extent assuming 4 extents: + * 4 exts * 2 trees * (2 * max depth - 1) * block size +- * the inode btree: max depth * blocksize +- * the allocation btrees: 2 trees * (max depth - 1) * block size + */ + STATIC uint + xfs_calc_itruncate_reservation( +@@ -245,12 +243,7 @@ xfs_calc_itruncate_reservation( + XFS_FSB_TO_B(mp, 1))), + (xfs_calc_buf_res(9, mp->m_sb.sb_sectsize) + + xfs_calc_buf_res(xfs_allocfree_log_count(mp, 4), +- XFS_FSB_TO_B(mp, 1)) + +- xfs_calc_buf_res(5, 0) + +- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1), +- XFS_FSB_TO_B(mp, 1)) + +- xfs_calc_buf_res(2 + mp->m_ialloc_blks + +- mp->m_in_maxlevels, 0))); ++ XFS_FSB_TO_B(mp, 1)))); + } + + /* +diff --git a/include/linux/elevator.h b/include/linux/elevator.h +index e7f358d2e5fc..eaa58c0f894b 100644 +--- a/include/linux/elevator.h ++++ b/include/linux/elevator.h +@@ -102,7 +102,7 @@ struct elevator_type + struct module *elevator_owner; + + /* managed by elevator core */ +- char icq_cache_name[ELV_NAME_MAX + 5]; /* elvname + "_io_cq" */ ++ char icq_cache_name[ELV_NAME_MAX + 6]; /* elvname + "_io_cq" */ + struct list_head list; + }; + +diff --git a/include/linux/iio/buffer-dma.h b/include/linux/iio/buffer-dma.h +index 767467d886de..67c75372b691 100644 +--- a/include/linux/iio/buffer-dma.h ++++ b/include/linux/iio/buffer-dma.h +@@ -141,7 +141,7 @@ int iio_dma_buffer_read(struct iio_buffer *buffer, size_t n, + char __user *user_buffer); + size_t iio_dma_buffer_data_available(struct iio_buffer *buffer); + int iio_dma_buffer_set_bytes_per_datum(struct iio_buffer *buffer, size_t bpd); +-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length); ++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length); + int iio_dma_buffer_request_update(struct iio_buffer *buffer); + + int iio_dma_buffer_init(struct iio_dma_buffer_queue *queue, +diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h +index 62d44c176071..e4b8678183f5 100644 +--- a/include/linux/posix-timers.h ++++ b/include/linux/posix-timers.h +@@ -65,8 +65,8 @@ struct k_itimer { + spinlock_t it_lock; + clockid_t it_clock; /* which timer type */ + timer_t it_id; /* timer id */ +- int it_overrun; /* overrun on pending signal */ +- int it_overrun_last; /* overrun on last delivered signal */ ++ s64 it_overrun; /* overrun on pending signal */ ++ s64 it_overrun_last; /* overrun on last delivered signal */ + int it_requeue_pending; /* waiting to requeue this timer */ + #define REQUEUE_PENDING 1 + int it_sigev_notify; /* notify word of sigevent struct */ +diff --git a/init/main.c b/init/main.c +index 4313772d634a..3c7f71d8e704 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -915,7 +915,7 @@ static int try_to_run_init_process(const char *init_filename) + + static noinline void __init kernel_init_freeable(void); + +-#if defined(CONFIG_DEBUG_RODATA) || defined(CONFIG_SET_MODULE_RONX) ++#if defined(CONFIG_DEBUG_RODATA) || defined(CONFIG_DEBUG_SET_MODULE_RONX) + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 95bd00d9f2c3..1af0bbf20984 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4331,7 +4331,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value); + static int __perf_read_group_add(struct perf_event *leader, + u64 read_format, u64 *values) + { ++ struct perf_event_context *ctx = leader->ctx; + struct perf_event *sub; ++ unsigned long flags; + int n = 1; /* skip @nr */ + int ret; + +@@ -4361,12 +4363,15 @@ static int __perf_read_group_add(struct perf_event *leader, + if (read_format & PERF_FORMAT_ID) + values[n++] = primary_event_id(leader); + ++ raw_spin_lock_irqsave(&ctx->lock, flags); ++ + list_for_each_entry(sub, &leader->sibling_list, group_entry) { + values[n++] += perf_event_count(sub); + if (read_format & PERF_FORMAT_ID) + values[n++] = primary_event_id(sub); + } + ++ raw_spin_unlock_irqrestore(&ctx->lock, flags); + return 0; + } + +@@ -7737,6 +7742,8 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, + goto unlock; + + list_for_each_entry_rcu(event, &ctx->event_list, event_entry) { ++ if (event->cpu != smp_processor_id()) ++ continue; + if (event->attr.type != PERF_TYPE_TRACEPOINT) + continue; + if (event->attr.config != entry->type) +diff --git a/kernel/futex.c b/kernel/futex.c +index c3ea6f2a6997..053d7be08be5 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1467,8 +1467,16 @@ static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr) + int oldval, ret; + + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) { +- if (oparg < 0 || oparg > 31) +- return -EINVAL; ++ if (oparg < 0 || oparg > 31) { ++ char comm[sizeof(current->comm)]; ++ /* ++ * kill this print and return -EINVAL when userspace ++ * is sane again ++ */ ++ pr_info_ratelimited("futex_wake_op: %s tries to shift op by %d; fix this program\n", ++ get_task_comm(comm, current), oparg); ++ oparg &= 31; ++ } + oparg = 1 << oparg; + } + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index f81adb476c03..5ad109ccec35 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3976,9 +3976,13 @@ static void throttle_cfs_rq(struct cfs_rq *cfs_rq) + + /* + * Add to the _head_ of the list, so that an already-started +- * distribute_cfs_runtime will not see us ++ * distribute_cfs_runtime will not see us. If disribute_cfs_runtime is ++ * not running add to the tail so that later runqueues don't get starved. + */ +- list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); ++ if (cfs_b->distribute_running) ++ list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); ++ else ++ list_add_tail_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); + + /* + * If we're the first throttled task, make sure the bandwidth +@@ -4121,14 +4125,16 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun) + * in us over-using our runtime if it is all used during this loop, but + * only by limited amounts in that extreme case. + */ +- while (throttled && cfs_b->runtime > 0) { ++ while (throttled && cfs_b->runtime > 0 && !cfs_b->distribute_running) { + runtime = cfs_b->runtime; ++ cfs_b->distribute_running = 1; + raw_spin_unlock(&cfs_b->lock); + /* we can't nest cfs_b->lock while distributing bandwidth */ + runtime = distribute_cfs_runtime(cfs_b, runtime, + runtime_expires); + raw_spin_lock(&cfs_b->lock); + ++ cfs_b->distribute_running = 0; + throttled = !list_empty(&cfs_b->throttled_cfs_rq); + + cfs_b->runtime -= min(runtime, cfs_b->runtime); +@@ -4239,6 +4245,11 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) + + /* confirm we're still not at a refresh boundary */ + raw_spin_lock(&cfs_b->lock); ++ if (cfs_b->distribute_running) { ++ raw_spin_unlock(&cfs_b->lock); ++ return; ++ } ++ + if (runtime_refresh_within(cfs_b, min_bandwidth_expiration)) { + raw_spin_unlock(&cfs_b->lock); + return; +@@ -4248,6 +4259,9 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) + runtime = cfs_b->runtime; + + expires = cfs_b->runtime_expires; ++ if (runtime) ++ cfs_b->distribute_running = 1; ++ + raw_spin_unlock(&cfs_b->lock); + + if (!runtime) +@@ -4258,6 +4272,7 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) + raw_spin_lock(&cfs_b->lock); + if (expires == cfs_b->runtime_expires) + cfs_b->runtime -= min(runtime, cfs_b->runtime); ++ cfs_b->distribute_running = 0; + raw_spin_unlock(&cfs_b->lock); + } + +@@ -4366,6 +4381,7 @@ void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) + cfs_b->period_timer.function = sched_cfs_period_timer; + hrtimer_init(&cfs_b->slack_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + cfs_b->slack_timer.function = sched_cfs_slack_timer; ++ cfs_b->distribute_running = 0; + } + + static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 923cc35e8490..ec6e838e991a 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -255,6 +255,8 @@ struct cfs_bandwidth { + /* statistics */ + int nr_periods, nr_throttled; + u64 throttled_time; ++ ++ bool distribute_running; + #endif + }; + +diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c +index 39008d78927a..21a27bb73587 100644 +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -103,7 +103,7 @@ static void bump_cpu_timer(struct k_itimer *timer, + continue; + + timer->it.cpu.expires += incr; +- timer->it_overrun += 1 << i; ++ timer->it_overrun += 1LL << i; + delta -= incr; + } + } +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index fc7c37ad90a0..0e6ed2e7d066 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -355,6 +355,17 @@ static __init int init_posix_timers(void) + + __initcall(init_posix_timers); + ++/* ++ * The siginfo si_overrun field and the return value of timer_getoverrun(2) ++ * are of type int. Clamp the overrun value to INT_MAX ++ */ ++static inline int timer_overrun_to_int(struct k_itimer *timr, int baseval) ++{ ++ s64 sum = timr->it_overrun_last + (s64)baseval; ++ ++ return sum > (s64)INT_MAX ? INT_MAX : (int)sum; ++} ++ + static void schedule_next_timer(struct k_itimer *timr) + { + struct hrtimer *timer = &timr->it.real.timer; +@@ -362,12 +373,11 @@ static void schedule_next_timer(struct k_itimer *timr) + if (timr->it.real.interval.tv64 == 0) + return; + +- timr->it_overrun += (unsigned int) hrtimer_forward(timer, +- timer->base->get_time(), +- timr->it.real.interval); ++ timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(), ++ timr->it.real.interval); + + timr->it_overrun_last = timr->it_overrun; +- timr->it_overrun = -1; ++ timr->it_overrun = -1LL; + ++timr->it_requeue_pending; + hrtimer_restart(timer); + } +@@ -396,7 +406,7 @@ void do_schedule_next_timer(struct siginfo *info) + else + schedule_next_timer(timr); + +- info->si_overrun += timr->it_overrun_last; ++ info->si_overrun = timer_overrun_to_int(timr, info->si_overrun); + } + + if (timr) +@@ -491,8 +501,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer) + now = ktime_add(now, kj); + } + #endif +- timr->it_overrun += (unsigned int) +- hrtimer_forward(timer, now, ++ timr->it_overrun += hrtimer_forward(timer, now, + timr->it.real.interval); + ret = HRTIMER_RESTART; + ++timr->it_requeue_pending; +@@ -633,7 +642,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, + it_id_set = IT_ID_SET; + new_timer->it_id = (timer_t) new_timer_id; + new_timer->it_clock = which_clock; +- new_timer->it_overrun = -1; ++ new_timer->it_overrun = -1LL; + + if (timer_event_spec) { + if (copy_from_user(&event, timer_event_spec, sizeof (event))) { +@@ -762,7 +771,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) + */ + if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING || + timr->it_sigev_notify == SIGEV_NONE)) +- timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv); ++ timr->it_overrun += hrtimer_forward(timer, now, iv); + + remaining = __hrtimer_expires_remaining_adjusted(timer, now); + /* Return 0 only, when the timer is expired and not pending */ +@@ -824,7 +833,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id) + if (!timr) + return -EINVAL; + +- overrun = timr->it_overrun_last; ++ overrun = timer_overrun_to_int(timr, 0); + unlock_timer(timr, flags); + + return overrun; +diff --git a/lib/test_bpf.c b/lib/test_bpf.c +index 1586dfdea809..960d4d627361 100644 +--- a/lib/test_bpf.c ++++ b/lib/test_bpf.c +@@ -4874,7 +4874,7 @@ static struct bpf_test tests[] = { + { + "BPF_MAXINSNS: Jump, gap, jump, ...", + { }, +-#ifdef CONFIG_BPF_JIT_ALWAYS_ON ++#if defined(CONFIG_BPF_JIT_ALWAYS_ON) && defined(CONFIG_X86) + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + #else + CLASSIC | FLAG_NO_DATA, +diff --git a/mm/frame_vector.c b/mm/frame_vector.c +index 375a103d7a56..d73eed0443f6 100644 +--- a/mm/frame_vector.c ++++ b/mm/frame_vector.c +@@ -61,8 +61,10 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, + * get_user_pages_longterm() and disallow it for filesystem-dax + * mappings. + */ +- if (vma_is_fsdax(vma)) +- return -EOPNOTSUPP; ++ if (vma_is_fsdax(vma)) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } + + if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) { + vec->got_ref = true; +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index c9f715b2917f..0f962cc3f1bf 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1508,7 +1508,7 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, + while ((i < MAX_ORDER_NR_PAGES) && + !pfn_valid_within(pfn + i)) + i++; +- if (i == MAX_ORDER_NR_PAGES) ++ if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn) + continue; + page = pfn_to_page(pfn + i); + if (zone && page_zone(page) != zone) +@@ -1522,7 +1522,7 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, + + if (zone) { + *valid_start = start; +- *valid_end = end; ++ *valid_end = min(end, end_pfn); + return 1; + } else { + return 0; +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 1fba2a03f8ae..ba24f613c0fc 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2298,9 +2298,8 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, + /* LE address type */ + addr_type = le_addr_type(cp->addr.type); + +- hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type); +- +- err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type); ++ /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ ++ err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); + if (err < 0) { + err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, + MGMT_STATUS_NOT_PAIRED, &rp, +@@ -2314,8 +2313,6 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, + goto done; + } + +- /* Abort any ongoing SMP pairing */ +- smp_cancel_pairing(conn); + + /* Defer clearing up the connection parameters until closing to + * give a chance of keeping them if a repairing happens. +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index ead4d1baeaa6..1abfbcd8090a 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2353,30 +2353,51 @@ unlock: + return ret; + } + +-void smp_cancel_pairing(struct hci_conn *hcon) ++int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, ++ u8 addr_type) + { +- struct l2cap_conn *conn = hcon->l2cap_data; ++ struct hci_conn *hcon; ++ struct l2cap_conn *conn; + struct l2cap_chan *chan; + struct smp_chan *smp; ++ int err; ++ ++ err = hci_remove_ltk(hdev, bdaddr, addr_type); ++ hci_remove_irk(hdev, bdaddr, addr_type); ++ ++ hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type); ++ if (!hcon) ++ goto done; + ++ conn = hcon->l2cap_data; + if (!conn) +- return; ++ goto done; + + chan = conn->smp; + if (!chan) +- return; ++ goto done; + + l2cap_chan_lock(chan); + + smp = chan->data; + if (smp) { ++ /* Set keys to NULL to make sure smp_failure() does not try to ++ * remove and free already invalidated rcu list entries. */ ++ smp->ltk = NULL; ++ smp->slave_ltk = NULL; ++ smp->remote_irk = NULL; ++ + if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) + smp_failure(conn, 0); + else + smp_failure(conn, SMP_UNSPECIFIED); ++ err = 0; + } + + l2cap_chan_unlock(chan); ++ ++done: ++ return err; + } + + static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb) +diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h +index ffcc70b6b199..993cbd7bcfe7 100644 +--- a/net/bluetooth/smp.h ++++ b/net/bluetooth/smp.h +@@ -180,7 +180,8 @@ enum smp_key_pref { + }; + + /* SMP Commands */ +-void smp_cancel_pairing(struct hci_conn *hcon); ++int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, ++ u8 addr_type); + bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level, + enum smp_key_pref key_pref); + int smp_conn_security(struct hci_conn *hcon, __u8 sec_level); +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 2136e45f5277..4bd57507b9a4 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1287,7 +1287,14 @@ static void br_multicast_query_received(struct net_bridge *br, + return; + + br_multicast_update_query_timer(br, query, max_delay); +- br_multicast_mark_router(br, port); ++ ++ /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, ++ * the arrival port for IGMP Queries where the source address ++ * is 0.0.0.0 should not be added to router port list. ++ */ ++ if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) || ++ saddr->proto == htons(ETH_P_IPV6)) ++ br_multicast_mark_router(br, port); + } + + static int br_ip4_multicast_query(struct net_bridge *br, +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 4fa4011feec1..146502f310ce 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -754,8 +754,9 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb, + return -EINVAL; + } + +- if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) +- netdev_rx_csum_fault(skb->dev); ++ if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE) && ++ !skb->csum_complete_sw) ++ netdev_rx_csum_fault(NULL); + } + return 0; + fault: +diff --git a/net/core/ethtool.c b/net/core/ethtool.c +index 7913771ec474..a8a9938aeceb 100644 +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -2397,13 +2397,17 @@ roll_back: + return ret; + } + +-static int ethtool_set_per_queue(struct net_device *dev, void __user *useraddr) ++static int ethtool_set_per_queue(struct net_device *dev, ++ void __user *useraddr, u32 sub_cmd) + { + struct ethtool_per_queue_op per_queue_opt; + + if (copy_from_user(&per_queue_opt, useraddr, sizeof(per_queue_opt))) + return -EFAULT; + ++ if (per_queue_opt.sub_command != sub_cmd) ++ return -EINVAL; ++ + switch (per_queue_opt.sub_command) { + case ETHTOOL_GCOALESCE: + return ethtool_get_per_queue_coalesce(dev, useraddr, &per_queue_opt); +@@ -2669,7 +2673,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr) + rc = ethtool_get_phy_stats(dev, useraddr); + break; + case ETHTOOL_PERQUEUE: +- rc = ethtool_set_per_queue(dev, useraddr); ++ rc = ethtool_set_per_queue(dev, useraddr, sub_cmd); + break; + case ETHTOOL_GLINKSETTINGS: + rc = ethtool_get_link_ksettings(dev, useraddr); +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 189082dc288d..928a0b84469d 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2987,6 +2987,11 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh) + return -EINVAL; + } + ++ if (dev->type != ARPHRD_ETHER) { ++ pr_info("PF_BRIDGE: FDB add only supported for Ethernet devices"); ++ return -EINVAL; ++ } ++ + addr = nla_data(tb[NDA_LLADDR]); + + err = fdb_vid_parse(tb[NDA_VLAN], &vid); +@@ -3090,6 +3095,11 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh) + return -EINVAL; + } + ++ if (dev->type != ARPHRD_ETHER) { ++ pr_info("PF_BRIDGE: FDB delete only supported for Ethernet devices"); ++ return -EINVAL; ++ } ++ + addr = nla_data(tb[NDA_LLADDR]); + + err = fdb_vid_parse(tb[NDA_VLAN], &vid); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 038ec74fa131..68ecb7d71c2b 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -1585,8 +1585,9 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) + if (skb->ip_summed == CHECKSUM_COMPLETE) { + int delta = skb->len - len; + +- skb->csum = csum_sub(skb->csum, +- skb_checksum(skb, len, delta, 0)); ++ skb->csum = csum_block_sub(skb->csum, ++ skb_checksum(skb, len, delta, 0), ++ len); + } + return __pskb_trim(skb, len); + } +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index cc8c6ac84d08..80e48f40c3a8 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -718,10 +718,14 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) + if (ip_is_fragment(&iph)) { + skb = skb_share_check(skb, GFP_ATOMIC); + if (skb) { +- if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) +- return skb; +- if (pskb_trim_rcsum(skb, netoff + len)) +- return skb; ++ if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) { ++ kfree_skb(skb); ++ return NULL; ++ } ++ if (pskb_trim_rcsum(skb, netoff + len)) { ++ kfree_skb(skb); ++ return NULL; ++ } + memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); + if (ip_defrag(net, skb, user)) + return NULL; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index b9b2a9828d98..5d4b5e0f6b5e 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1726,8 +1726,24 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, + /* Note, we are only interested in != 0 or == 0, thus the + * force to int. + */ +- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check, +- inet_compute_pseudo); ++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check, ++ inet_compute_pseudo); ++ if (err) ++ return err; ++ ++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) { ++ /* If SW calculated the value, we know it's bad */ ++ if (skb->csum_complete_sw) ++ return 1; ++ ++ /* HW says the value is bad. Let's validate that. ++ * skb->csum is no longer the full packet checksum, ++ * so don't treat it as such. ++ */ ++ skb_checksum_complete_unset(skb); ++ } ++ ++ return 0; + } + + /* wrapper for udp_queue_rcv_skb tacking care of csum conversion and +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index bc532206077f..8f79f0414bc3 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4721,8 +4721,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb, + + /* unicast address incl. temp addr */ + list_for_each_entry(ifa, &idev->addr_list, if_list) { +- if (++ip_idx < s_ip_idx) +- continue; ++ if (ip_idx < s_ip_idx) ++ goto next; + err = inet6_fill_ifaddr(skb, ifa, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, +@@ -4731,6 +4731,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb, + if (err < 0) + break; + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); ++next: ++ ip_idx++; + } + break; + } +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 421379014995..f7b425615c12 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -1045,11 +1045,11 @@ netfilter_fail: + igmp_fail: + ndisc_cleanup(); + ndisc_fail: +- ip6_mr_cleanup(); ++ icmpv6_cleanup(); + icmp_fail: +- unregister_pernet_subsys(&inet6_net_ops); ++ ip6_mr_cleanup(); + ipmr_fail: +- icmpv6_cleanup(); ++ unregister_pernet_subsys(&inet6_net_ops); + register_pernet_fail: + sock_unregister(PF_INET6); + rtnl_unregister_all(PF_INET6); +diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c +index 1dc023ca98fd..9d9a16e219d6 100644 +--- a/net/ipv6/ip6_checksum.c ++++ b/net/ipv6/ip6_checksum.c +@@ -87,8 +87,24 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto) + * Note, we are only interested in != 0 or == 0, thus the + * force to int. + */ +- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check, +- ip6_compute_pseudo); ++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check, ++ ip6_compute_pseudo); ++ if (err) ++ return err; ++ ++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) { ++ /* If SW calculated the value, we know it's bad */ ++ if (skb->csum_complete_sw) ++ return 1; ++ ++ /* HW says the value is bad. Let's validate that. ++ * skb->csum is no longer the full packet checksum, ++ * so don't treat is as such. ++ */ ++ skb_checksum_complete_unset(skb); ++ } ++ ++ return 0; + } + EXPORT_SYMBOL(udp6_csum_init); + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index fd081a14064e..9c5afa5153ce 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1185,11 +1185,6 @@ route_lookup: + } + skb_dst_set(skb, dst); + +- if (encap_limit >= 0) { +- init_tel_txopt(&opt, encap_limit); +- ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL); +- } +- + /* Calculate max headroom for all the headers and adjust + * needed_headroom if necessary. + */ +@@ -1202,6 +1197,11 @@ route_lookup: + if (err) + return err; + ++ if (encap_limit >= 0) { ++ init_tel_txopt(&opt, encap_limit); ++ ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL); ++ } ++ + skb_push(skb, sizeof(struct ipv6hdr)); + skb_reset_network_header(skb); + ipv6h = ipv6_hdr(skb); +@@ -1258,7 +1258,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + fl6.flowi6_proto = IPPROTO_IPIP; + fl6.daddr = key->u.ipv6.dst; + fl6.flowlabel = key->label; +- dsfield = ip6_tclass(key->label); ++ dsfield = key->tos; + } else { + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) + encap_limit = t->parms.encap_limit; +@@ -1329,7 +1329,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + fl6.flowi6_proto = IPPROTO_IPV6; + fl6.daddr = key->u.ipv6.dst; + fl6.flowlabel = key->label; +- dsfield = ip6_tclass(key->label); ++ dsfield = key->tos; + } else { + offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb)); + /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */ +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 6c54c76847bf..40262abb15db 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2413,17 +2413,17 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml, + { + int err; + +- /* callers have the socket lock and rtnl lock +- * so no other readers or writers of iml or its sflist +- */ ++ write_lock_bh(&iml->sflock); + if (!iml->sflist) { + /* any-source empty exclude case */ +- return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); ++ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); ++ } else { ++ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, ++ iml->sflist->sl_count, iml->sflist->sl_addr, 0); ++ sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); ++ iml->sflist = NULL; + } +- err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, +- iml->sflist->sl_count, iml->sflist->sl_addr, 0); +- sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); +- iml->sflist = NULL; ++ write_unlock_bh(&iml->sflock); + return err; + } + +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 21f3bf2125f4..505d048ffff5 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1692,10 +1692,9 @@ int ndisc_rcv(struct sk_buff *skb) + return 0; + } + +- memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); +- + switch (msg->icmph.icmp6_type) { + case NDISC_NEIGHBOUR_SOLICITATION: ++ memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); + ndisc_recv_ns(skb); + break; + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index b9147558a8f2..e46185377981 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -597,8 +597,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + fq->q.meat == fq->q.len && + nf_ct_frag6_reasm(fq, skb, dev)) + ret = 0; +- else +- skb_dst_drop(skb); + + out_unlock: + spin_unlock_bh(&fq->q.lock); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 70fa31e37360..4cc12eeca7ab 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2289,6 +2289,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu + if (on_link) + nrt->rt6i_flags &= ~RTF_GATEWAY; + ++ nrt->rt6i_protocol = RTPROT_REDIRECT; + nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key; + + if (ip6_ins_rt(nrt)) +@@ -2393,6 +2394,7 @@ static struct rt6_info *rt6_add_route_info(struct net *net, + .fc_dst_len = prefixlen, + .fc_flags = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO | + RTF_UP | RTF_PREF(pref), ++ .fc_protocol = RTPROT_RA, + .fc_nlinfo.portid = 0, + .fc_nlinfo.nlh = NULL, + .fc_nlinfo.nl_net = net, +@@ -2445,6 +2447,7 @@ struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr, + .fc_ifindex = dev->ifindex, + .fc_flags = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT | + RTF_UP | RTF_EXPIRES | RTF_PREF(pref), ++ .fc_protocol = RTPROT_RA, + .fc_nlinfo.portid = 0, + .fc_nlinfo.nlh = NULL, + .fc_nlinfo.nl_net = dev_net(dev), +@@ -3241,14 +3244,6 @@ static int rt6_fill_node(struct net *net, + } + rtm->rtm_scope = RT_SCOPE_UNIVERSE; + rtm->rtm_protocol = rt->rt6i_protocol; +- if (rt->rt6i_flags & RTF_DYNAMIC) +- rtm->rtm_protocol = RTPROT_REDIRECT; +- else if (rt->rt6i_flags & RTF_ADDRCONF) { +- if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ROUTEINFO)) +- rtm->rtm_protocol = RTPROT_RA; +- else +- rtm->rtm_protocol = RTPROT_KERNEL; +- } + + if (rt->rt6i_flags & RTF_CACHE) + rtm->rtm_flags |= RTM_F_CLONED; +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index 4d09ce6fa90e..64862c5084ee 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -165,9 +165,11 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + + if (toobig && xfrm6_local_dontfrag(skb)) { + xfrm6_local_rxpmtu(skb, mtu); ++ kfree_skb(skb); + return -EMSGSIZE; + } else if (!skb->ignore_df && toobig && skb->sk) { + xfrm_local_error(skb, mtu); ++ kfree_skb(skb); + return -EMSGSIZE; + } + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index a5333f6cb65a..b96dbe38ecad 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -845,10 +845,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, + } + } + +- /* Session data offset is handled differently for L2TPv2 and +- * L2TPv3. For L2TPv2, there is an optional 16-bit value in +- * the header. For L2TPv3, the offset is negotiated using AVPs +- * in the session setup control protocol. ++ /* Session data offset is defined only for L2TPv2 and is ++ * indicated by an optional 16-bit value in the header. + */ + if (tunnel->version == L2TP_HDR_VER_2) { + /* If offset bit set, skip it. */ +@@ -856,8 +854,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, + offset = ntohs(*(__be16 *)ptr); + ptr += 2 + offset; + } +- } else +- ptr += session->offset; ++ } + + offset = ptr - optr; + if (!pskb_may_pull(skb, offset)) +@@ -1141,8 +1138,6 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) + } + bufp += session->l2specific_len; + } +- if (session->offset) +- bufp += session->offset; + + return bufp - optr; + } +@@ -1827,7 +1822,7 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version) + if (session->send_seq) + session->hdr_len += 4; + } else { +- session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset; ++ session->hdr_len = 4 + session->cookie_len + session->l2specific_len; + if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP) + session->hdr_len += 4; + } +@@ -1878,7 +1873,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn + session->recv_seq = cfg->recv_seq; + session->lns_mode = cfg->lns_mode; + session->reorder_timeout = cfg->reorder_timeout; +- session->offset = cfg->offset; + session->l2specific_type = cfg->l2specific_type; + session->l2specific_len = cfg->l2specific_len; + session->cookie_len = cfg->cookie_len; +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 42419f1c24cf..86356a23a0a7 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -68,7 +68,6 @@ struct l2tp_session_cfg { + int debug; /* bitmask of debug message + * categories */ + u16 vlan_id; /* VLAN pseudowire only */ +- u16 offset; /* offset to payload */ + u16 l2specific_len; /* Layer 2 specific length */ + u16 l2specific_type; /* Layer 2 specific type */ + u8 cookie[8]; /* optional cookie */ +@@ -94,8 +93,6 @@ struct l2tp_session { + int cookie_len; + u8 peer_cookie[8]; + int peer_cookie_len; +- u16 offset; /* offset from end of L2TP header +- to beginning of data */ + u16 l2specific_len; + u16 l2specific_type; + u16 hdr_len; +diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c +index d100aed3d06f..2d2a73280ec2 100644 +--- a/net/l2tp/l2tp_debugfs.c ++++ b/net/l2tp/l2tp_debugfs.c +@@ -181,8 +181,8 @@ static void l2tp_dfs_seq_session_show(struct seq_file *m, void *v) + session->lns_mode ? "LNS" : "LAC", + session->debug, + jiffies_to_msecs(session->reorder_timeout)); +- seq_printf(m, " offset %hu l2specific %hu/%hu\n", +- session->offset, session->l2specific_type, session->l2specific_len); ++ seq_printf(m, " offset 0 l2specific %hu/%hu\n", ++ session->l2specific_type, session->l2specific_len); + if (session->cookie_len) { + seq_printf(m, " cookie %02x%02x%02x%02x", + session->cookie[0], session->cookie[1], +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index ee03bc866d1b..d6fccfdca201 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -536,9 +536,6 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf + } + + if (tunnel->version > 2) { +- if (info->attrs[L2TP_ATTR_OFFSET]) +- cfg.offset = nla_get_u16(info->attrs[L2TP_ATTR_OFFSET]); +- + if (info->attrs[L2TP_ATTR_DATA_SEQ]) + cfg.data_seq = nla_get_u8(info->attrs[L2TP_ATTR_DATA_SEQ]); + +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 79c346fd859b..b9290a183a2f 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -734,6 +734,7 @@ void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk) + llc_sk(sk)->sap = sap; + + spin_lock_bh(&sap->sk_lock); ++ sock_set_flag(sk, SOCK_RCU_FREE); + sap->sk_count++; + sk_nulls_add_node_rcu(sk, laddr_hb); + hlist_add_head(&llc->dev_hash_node, dev_hb); +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index 45319cc01121..80c45567ee3a 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -7,7 +7,7 @@ + * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> + * Copyright 2007, Michael Wu <flamingice@sourmilk.net> + * Copyright 2007-2010, Intel Corporation +- * Copyright(c) 2015 Intel Deutschland GmbH ++ * Copyright(c) 2015-2017 Intel Deutschland GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local, + ieee80211_agg_start_txq(sta, tid, true); + } + +-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid) ++void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid, ++ struct tid_ampdu_tx *tid_tx) + { +- struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); ++ struct ieee80211_sub_if_data *sdata = sta->sdata; + struct ieee80211_local *local = sdata->local; +- struct sta_info *sta; +- struct tid_ampdu_tx *tid_tx; + +- trace_api_start_tx_ba_cb(sdata, ra, tid); ++ if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))) ++ return; ++ ++ if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) ++ ieee80211_agg_tx_operational(local, sta, tid); ++} ++ ++static struct tid_ampdu_tx * ++ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata, ++ const u8 *ra, u16 tid, struct sta_info **sta) ++{ ++ struct tid_ampdu_tx *tid_tx; + + if (tid >= IEEE80211_NUM_TIDS) { + ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n", + tid, IEEE80211_NUM_TIDS); +- return; ++ return NULL; + } + +- mutex_lock(&local->sta_mtx); +- sta = sta_info_get_bss(sdata, ra); +- if (!sta) { +- mutex_unlock(&local->sta_mtx); ++ *sta = sta_info_get_bss(sdata, ra); ++ if (!*sta) { + ht_dbg(sdata, "Could not find station: %pM\n", ra); +- return; ++ return NULL; + } + +- mutex_lock(&sta->ampdu_mlme.mtx); +- tid_tx = rcu_dereference_protected_tid_tx(sta, tid); ++ tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]); + +- if (WARN_ON(!tid_tx)) { ++ if (WARN_ON(!tid_tx)) + ht_dbg(sdata, "addBA was not requested!\n"); +- goto unlock; +- } + +- if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))) +- goto unlock; +- +- if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) +- ieee80211_agg_tx_operational(local, sta, tid); +- +- unlock: +- mutex_unlock(&sta->ampdu_mlme.mtx); +- mutex_unlock(&local->sta_mtx); ++ return tid_tx; + } + + void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, +@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, + { + struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); + struct ieee80211_local *local = sdata->local; +- struct ieee80211_ra_tid *ra_tid; +- struct sk_buff *skb = dev_alloc_skb(0); ++ struct sta_info *sta; ++ struct tid_ampdu_tx *tid_tx; + +- if (unlikely(!skb)) +- return; ++ trace_api_start_tx_ba_cb(sdata, ra, tid); + +- ra_tid = (struct ieee80211_ra_tid *) &skb->cb; +- memcpy(&ra_tid->ra, ra, ETH_ALEN); +- ra_tid->tid = tid; ++ rcu_read_lock(); ++ tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta); ++ if (!tid_tx) ++ goto out; + +- skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START; +- skb_queue_tail(&sdata->skb_queue, skb); +- ieee80211_queue_work(&local->hw, &sdata->work); ++ set_bit(HT_AGG_STATE_START_CB, &tid_tx->state); ++ ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work); ++ out: ++ rcu_read_unlock(); + } + EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe); + +@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid) + } + EXPORT_SYMBOL(ieee80211_stop_tx_ba_session); + +-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid) ++void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid, ++ struct tid_ampdu_tx *tid_tx) + { +- struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); +- struct ieee80211_local *local = sdata->local; +- struct sta_info *sta; +- struct tid_ampdu_tx *tid_tx; ++ struct ieee80211_sub_if_data *sdata = sta->sdata; + bool send_delba = false; + +- trace_api_stop_tx_ba_cb(sdata, ra, tid); +- +- if (tid >= IEEE80211_NUM_TIDS) { +- ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n", +- tid, IEEE80211_NUM_TIDS); +- return; +- } +- +- ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid); +- +- mutex_lock(&local->sta_mtx); +- +- sta = sta_info_get_bss(sdata, ra); +- if (!sta) { +- ht_dbg(sdata, "Could not find station: %pM\n", ra); +- goto unlock; +- } ++ ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ++ sta->sta.addr, tid); + +- mutex_lock(&sta->ampdu_mlme.mtx); + spin_lock_bh(&sta->lock); +- tid_tx = rcu_dereference_protected_tid_tx(sta, tid); + +- if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { ++ if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) { + ht_dbg(sdata, + "unexpected callback to A-MPDU stop for %pM tid %d\n", + sta->sta.addr, tid); +@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid) + spin_unlock_bh(&sta->lock); + + if (send_delba) +- ieee80211_send_delba(sdata, ra, tid, ++ ieee80211_send_delba(sdata, sta->sta.addr, tid, + WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE); +- +- mutex_unlock(&sta->ampdu_mlme.mtx); +- unlock: +- mutex_unlock(&local->sta_mtx); + } + + void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, +@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, + { + struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); + struct ieee80211_local *local = sdata->local; +- struct ieee80211_ra_tid *ra_tid; +- struct sk_buff *skb = dev_alloc_skb(0); ++ struct sta_info *sta; ++ struct tid_ampdu_tx *tid_tx; + +- if (unlikely(!skb)) +- return; ++ trace_api_stop_tx_ba_cb(sdata, ra, tid); + +- ra_tid = (struct ieee80211_ra_tid *) &skb->cb; +- memcpy(&ra_tid->ra, ra, ETH_ALEN); +- ra_tid->tid = tid; ++ rcu_read_lock(); ++ tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta); ++ if (!tid_tx) ++ goto out; + +- skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP; +- skb_queue_tail(&sdata->skb_queue, skb); +- ieee80211_queue_work(&local->hw, &sdata->work); ++ set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state); ++ ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work); ++ out: ++ rcu_read_unlock(); + } + EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe); + +diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c +index f4a528773563..6ca5442b1e03 100644 +--- a/net/mac80211/ht.c ++++ b/net/mac80211/ht.c +@@ -7,6 +7,7 @@ + * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> + * Copyright 2007, Michael Wu <flamingice@sourmilk.net> + * Copyright 2007-2010, Intel Corporation ++ * Copyright 2017 Intel Deutschland GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, + { + int i; + +- cancel_work_sync(&sta->ampdu_mlme.work); +- + for (i = 0; i < IEEE80211_NUM_TIDS; i++) { + __ieee80211_stop_tx_ba_session(sta, i, reason); + __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT, +@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, + reason != AGG_STOP_DESTROY_STA && + reason != AGG_STOP_PEER_REQUEST); + } ++ ++ /* stopping might queue the work again - so cancel only afterwards */ ++ cancel_work_sync(&sta->ampdu_mlme.work); + } + + void ieee80211_ba_session_work(struct work_struct *work) +@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work) + spin_unlock_bh(&sta->lock); + + tid_tx = rcu_dereference_protected_tid_tx(sta, tid); +- if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP, +- &tid_tx->state)) ++ if (!tid_tx) ++ continue; ++ ++ if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state)) ++ ieee80211_start_tx_ba_cb(sta, tid, tid_tx); ++ if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state)) + ___ieee80211_stop_tx_ba_session(sta, tid, + AGG_STOP_LOCAL_REQUEST); ++ if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state)) ++ ieee80211_stop_tx_ba_cb(sta, tid, tid_tx); + } + mutex_unlock(&sta->ampdu_mlme.mtx); + } +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 7fd544d970d9..8a690ebd7374 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1026,8 +1026,6 @@ struct ieee80211_rx_agg { + + enum sdata_queue_type { + IEEE80211_SDATA_QUEUE_TYPE_FRAME = 0, +- IEEE80211_SDATA_QUEUE_AGG_START = 1, +- IEEE80211_SDATA_QUEUE_AGG_STOP = 2, + IEEE80211_SDATA_QUEUE_RX_AGG_START = 3, + IEEE80211_SDATA_QUEUE_RX_AGG_STOP = 4, + }; +@@ -1416,12 +1414,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata) + return local->hw.wiphy->bands[band]; + } + +-/* this struct represents 802.11n's RA/TID combination */ +-struct ieee80211_ra_tid { +- u8 ra[ETH_ALEN]; +- u16 tid; +-}; +- + /* this struct holds the value parsing from channel switch IE */ + struct ieee80211_csa_ie { + struct cfg80211_chan_def chandef; +@@ -1765,8 +1757,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_agg_stop_reason reason); + int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_agg_stop_reason reason); +-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid); +-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid); ++void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid, ++ struct tid_ampdu_tx *tid_tx); ++void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid, ++ struct tid_ampdu_tx *tid_tx); + void ieee80211_ba_session_work(struct work_struct *work); + void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid); + void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid); +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index fa7d757fef95..760ba8ec2944 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1248,7 +1248,6 @@ static void ieee80211_iface_work(struct work_struct *work) + struct ieee80211_local *local = sdata->local; + struct sk_buff *skb; + struct sta_info *sta; +- struct ieee80211_ra_tid *ra_tid; + struct ieee80211_rx_agg *rx_agg; + + if (!ieee80211_sdata_running(sdata)) +@@ -1264,15 +1263,7 @@ static void ieee80211_iface_work(struct work_struct *work) + while ((skb = skb_dequeue(&sdata->skb_queue))) { + struct ieee80211_mgmt *mgmt = (void *)skb->data; + +- if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) { +- ra_tid = (void *)&skb->cb; +- ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra, +- ra_tid->tid); +- } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) { +- ra_tid = (void *)&skb->cb; +- ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra, +- ra_tid->tid); +- } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) { ++ if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) { + rx_agg = (void *)&skb->cb; + mutex_lock(&local->sta_mtx); + sta = sta_info_get_bss(sdata, rx_agg->addr); +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index 15599c70a38f..cc808ac783e5 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -115,6 +115,8 @@ enum ieee80211_sta_info_flags { + #define HT_AGG_STATE_STOPPING 3 + #define HT_AGG_STATE_WANT_START 4 + #define HT_AGG_STATE_WANT_STOP 5 ++#define HT_AGG_STATE_START_CB 6 ++#define HT_AGG_STATE_STOP_CB 7 + + enum ieee80211_agg_stop_reason { + AGG_STOP_DECLINED, +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index 72fe9bc7a1f9..7892bac21eac 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -472,11 +472,6 @@ static void ieee80211_report_ack_skb(struct ieee80211_local *local, + if (!skb) + return; + +- if (dropped) { +- dev_kfree_skb_any(skb); +- return; +- } +- + if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) { + u64 cookie = IEEE80211_SKB_CB(skb)->ack.cookie; + struct ieee80211_sub_if_data *sdata; +@@ -497,6 +492,8 @@ static void ieee80211_report_ack_skb(struct ieee80211_local *local, + } + rcu_read_unlock(); + ++ dev_kfree_skb_any(skb); ++ } else if (dropped) { + dev_kfree_skb_any(skb); + } else { + /* consumes skb */ +diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c +index f20dcf1b1830..c64ae68ae4f8 100644 +--- a/net/mac80211/tdls.c ++++ b/net/mac80211/tdls.c +@@ -16,6 +16,7 @@ + #include "ieee80211_i.h" + #include "driver-ops.h" + #include "rate.h" ++#include "wme.h" + + /* give usermode some time for retries in setting up the TDLS session */ + #define TDLS_PEER_SETUP_TIMEOUT (15 * HZ) +@@ -1019,14 +1020,13 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev, + switch (action_code) { + case WLAN_TDLS_SETUP_REQUEST: + case WLAN_TDLS_SETUP_RESPONSE: +- skb_set_queue_mapping(skb, IEEE80211_AC_BK); +- skb->priority = 2; ++ skb->priority = 256 + 2; + break; + default: +- skb_set_queue_mapping(skb, IEEE80211_AC_VI); +- skb->priority = 5; ++ skb->priority = 256 + 5; + break; + } ++ skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb)); + + /* + * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress. +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 84582998f65f..58fba4e569e6 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1833,7 +1833,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, + sdata->vif.hw_queue[skb_get_queue_mapping(skb)]; + + if (invoke_tx_handlers_early(&tx)) +- return false; ++ return true; + + if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb)) + return true; +diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c +index 169156cfd4c8..96e61eab19bc 100644 +--- a/net/rds/ib_cm.c ++++ b/net/rds/ib_cm.c +@@ -505,7 +505,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd, + ic->i_send_cq, ic->i_recv_cq); + +- return ret; ++ goto out; + + sends_out: + vfree(ic->i_sends); +@@ -530,6 +530,7 @@ send_cq_out: + ic->i_send_cq = NULL; + rds_ibdev_out: + rds_ib_remove_conn(rds_ibdev, conn); ++out: + rds_ib_dev_put(rds_ibdev); + + return ret; +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index f3ac85a285a2..a4380e182e6c 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -216,10 +216,11 @@ static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb, + /* + * Apply a hard ACK by advancing the Tx window. + */ +-static void rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, ++static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, + struct rxrpc_ack_summary *summary) + { + struct sk_buff *skb, *list = NULL; ++ bool rot_last = false; + int ix; + u8 annotation; + +@@ -243,15 +244,17 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, + skb->next = list; + list = skb; + +- if (annotation & RXRPC_TX_ANNO_LAST) ++ if (annotation & RXRPC_TX_ANNO_LAST) { + set_bit(RXRPC_CALL_TX_LAST, &call->flags); ++ rot_last = true; ++ } + if ((annotation & RXRPC_TX_ANNO_MASK) != RXRPC_TX_ANNO_ACK) + summary->nr_rot_new_acks++; + } + + spin_unlock(&call->lock); + +- trace_rxrpc_transmit(call, (test_bit(RXRPC_CALL_TX_LAST, &call->flags) ? ++ trace_rxrpc_transmit(call, (rot_last ? + rxrpc_transmit_rotate_last : + rxrpc_transmit_rotate)); + wake_up(&call->waitq); +@@ -262,6 +265,8 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, + skb->next = NULL; + rxrpc_free_skb(skb, rxrpc_skb_tx_freed); + } ++ ++ return rot_last; + } + + /* +@@ -332,11 +337,11 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call) + ktime_get_real()); + } + +- if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) +- rxrpc_rotate_tx_window(call, top, &summary); + if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) { +- rxrpc_proto_abort("TXL", call, top); +- return false; ++ if (!rxrpc_rotate_tx_window(call, top, &summary)) { ++ rxrpc_proto_abort("TXL", call, top); ++ return false; ++ } + } + if (!rxrpc_end_tx_phase(call, true, "ETD")) + return false; +@@ -803,6 +808,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb, + rxrpc_propose_ack_respond_to_ack); + } + ++ /* Discard any out-of-order or duplicate ACKs. */ ++ if (before_eq(sp->hdr.serial, call->acks_latest)) { ++ _debug("discard ACK %d <= %d", ++ sp->hdr.serial, call->acks_latest); ++ return; ++ } ++ call->acks_latest_ts = skb->tstamp; ++ call->acks_latest = sp->hdr.serial; ++ ++ /* Parse rwind and mtu sizes if provided. */ + ioffset = offset + nr_acks + 3; + if (skb->len >= ioffset + sizeof(buf.info)) { + if (skb_copy_bits(skb, ioffset, &buf.info, sizeof(buf.info)) < 0) +@@ -824,23 +839,18 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb, + return; + } + +- /* Discard any out-of-order or duplicate ACKs. */ +- if (before_eq(sp->hdr.serial, call->acks_latest)) { +- _debug("discard ACK %d <= %d", +- sp->hdr.serial, call->acks_latest); +- return; +- } +- call->acks_latest_ts = skb->tstamp; +- call->acks_latest = sp->hdr.serial; +- + if (before(hard_ack, call->tx_hard_ack) || + after(hard_ack, call->tx_top)) + return rxrpc_proto_abort("AKW", call, 0); + if (nr_acks > call->tx_top - hard_ack) + return rxrpc_proto_abort("AKN", call, 0); + +- if (after(hard_ack, call->tx_hard_ack)) +- rxrpc_rotate_tx_window(call, hard_ack, &summary); ++ if (after(hard_ack, call->tx_hard_ack)) { ++ if (rxrpc_rotate_tx_window(call, hard_ack, &summary)) { ++ rxrpc_end_tx_phase(call, false, "ETA"); ++ return; ++ } ++ } + + if (nr_acks > 0) { + if (skb_copy_bits(skb, offset, buf.acks, nr_acks) < 0) +@@ -849,11 +859,6 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb, + &summary); + } + +- if (test_bit(RXRPC_CALL_TX_LAST, &call->flags)) { +- rxrpc_end_tx_phase(call, false, "ETA"); +- return; +- } +- + if (call->rxtx_annotations[call->tx_top & RXRPC_RXTX_BUFF_MASK] & + RXRPC_TX_ANNO_LAST && + summary.nr_acks == call->tx_top - hard_ack && +@@ -875,8 +880,7 @@ static void rxrpc_input_ackall(struct rxrpc_call *call, struct sk_buff *skb) + + _proto("Rx ACKALL %%%u", sp->hdr.serial); + +- rxrpc_rotate_tx_window(call, call->tx_top, &summary); +- if (test_bit(RXRPC_CALL_TX_LAST, &call->flags)) ++ if (rxrpc_rotate_tx_window(call, call->tx_top, &summary)) + rxrpc_end_tx_phase(call, false, "ETL"); + } + +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index 44941e25f3ad..729c0e4eca21 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -411,7 +411,7 @@ static int gred_change(struct Qdisc *sch, struct nlattr *opt) + if (tb[TCA_GRED_PARMS] == NULL && tb[TCA_GRED_STAB] == NULL) { + if (tb[TCA_GRED_LIMIT] != NULL) + sch->limit = nla_get_u32(tb[TCA_GRED_LIMIT]); +- return gred_change_table_def(sch, opt); ++ return gred_change_table_def(sch, tb[TCA_GRED_DPS]); + } + + if (tb[TCA_GRED_PARMS] == NULL || +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 64d2d9ea2f8c..9827ba4b9f74 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -185,13 +185,13 @@ static void sctp_for_each_tx_datachunk(struct sctp_association *asoc, + list_for_each_entry(chunk, &t->transmitted, transmitted_list) + cb(chunk); + +- list_for_each_entry(chunk, &q->retransmit, list) ++ list_for_each_entry(chunk, &q->retransmit, transmitted_list) + cb(chunk); + +- list_for_each_entry(chunk, &q->sacked, list) ++ list_for_each_entry(chunk, &q->sacked, transmitted_list) + cb(chunk); + +- list_for_each_entry(chunk, &q->abandoned, list) ++ list_for_each_entry(chunk, &q->abandoned, transmitted_list) + cb(chunk); + + list_for_each_entry(chunk, &q->out_chunk_list, list) +@@ -248,11 +248,10 @@ struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id) + + spin_lock_bh(&sctp_assocs_id_lock); + asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id); ++ if (asoc && (asoc->base.sk != sk || asoc->base.dead)) ++ asoc = NULL; + spin_unlock_bh(&sctp_assocs_id_lock); + +- if (!asoc || (asoc->base.sk != sk) || asoc->base.dead) +- return NULL; +- + return asoc; + } + +diff --git a/net/socket.c b/net/socket.c +index 35fa349ba274..d9e2989c10c4 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2774,9 +2774,14 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32) + copy_in_user(&rxnfc->fs.ring_cookie, + &compat_rxnfc->fs.ring_cookie, + (void __user *)(&rxnfc->fs.location + 1) - +- (void __user *)&rxnfc->fs.ring_cookie) || +- copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt, +- sizeof(rxnfc->rule_cnt))) ++ (void __user *)&rxnfc->fs.ring_cookie)) ++ return -EFAULT; ++ if (ethcmd == ETHTOOL_GRXCLSRLALL) { ++ if (put_user(rule_cnt, &rxnfc->rule_cnt)) ++ return -EFAULT; ++ } else if (copy_in_user(&rxnfc->rule_cnt, ++ &compat_rxnfc->rule_cnt, ++ sizeof(rxnfc->rule_cnt))) + return -EFAULT; + } + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 25bc5c30d7fb..9d3f047305ce 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2277,8 +2277,8 @@ void tipc_sk_reinit(struct net *net) + + do { + tsk = ERR_PTR(rhashtable_walk_start(&iter)); +- if (tsk) +- continue; ++ if (IS_ERR(tsk)) ++ goto walk_stop; + + while ((tsk = rhashtable_walk_next(&iter)) && !IS_ERR(tsk)) { + spin_lock_bh(&tsk->sk.sk_lock.slock); +@@ -2287,7 +2287,7 @@ void tipc_sk_reinit(struct net *net) + msg_set_orignode(msg, tn->own_addr); + spin_unlock_bh(&tsk->sk.sk_lock.slock); + } +- ++walk_stop: + rhashtable_walk_stop(&iter); + } while (tsk == ERR_PTR(-EAGAIN)); + } +diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c +index 271cd66e4b3b..c2646446e157 100644 +--- a/net/tipc/subscr.c ++++ b/net/tipc/subscr.c +@@ -256,7 +256,9 @@ static void tipc_subscrp_delete(struct tipc_subscription *sub) + static void tipc_subscrp_cancel(struct tipc_subscr *s, + struct tipc_subscriber *subscriber) + { ++ tipc_subscrb_get(subscriber); + tipc_subscrb_subscrp_delete(subscriber, s); ++ tipc_subscrb_put(subscriber); + } + + static struct tipc_subscription *tipc_subscrp_create(struct net *net, +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 0e91ec49d3da..549d0a4083b3 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3422,6 +3422,7 @@ static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, + return false; + + /* check availability */ ++ ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); + if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) + mcs[ridx] |= rbit; + else +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 5dbac3749738..36d1d25082e3 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2298,6 +2298,7 @@ static int regulatory_hint_core(const char *alpha2) + request->alpha2[0] = alpha2[0]; + request->alpha2[1] = alpha2[1]; + request->initiator = NL80211_REGDOM_SET_BY_CORE; ++ request->wiphy_idx = WIPHY_IDX_INVALID; + + queue_regulatory_request(request); + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 35ad69fd0838..435f904c1be5 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -978,13 +978,23 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, + return NULL; + } + ++/* ++ * Update RX channel information based on the available frame payload ++ * information. This is mainly for the 2.4 GHz band where frames can be received ++ * from neighboring channels and the Beacon frames use the DSSS Parameter Set ++ * element to indicate the current (transmitting) channel, but this might also ++ * be needed on other bands if RX frequency does not match with the actual ++ * operating channel of a BSS. ++ */ + static struct ieee80211_channel * + cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen, +- struct ieee80211_channel *channel) ++ struct ieee80211_channel *channel, ++ enum nl80211_bss_scan_width scan_width) + { + const u8 *tmp; + u32 freq; + int channel_number = -1; ++ struct ieee80211_channel *alt_channel; + + tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen); + if (tmp && tmp[1] == 1) { +@@ -998,16 +1008,45 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen, + } + } + +- if (channel_number < 0) ++ if (channel_number < 0) { ++ /* No channel information in frame payload */ + return channel; ++ } + + freq = ieee80211_channel_to_frequency(channel_number, channel->band); +- channel = ieee80211_get_channel(wiphy, freq); +- if (!channel) +- return NULL; +- if (channel->flags & IEEE80211_CHAN_DISABLED) ++ alt_channel = ieee80211_get_channel(wiphy, freq); ++ if (!alt_channel) { ++ if (channel->band == NL80211_BAND_2GHZ) { ++ /* ++ * Better not allow unexpected channels when that could ++ * be going beyond the 1-11 range (e.g., discovering ++ * BSS on channel 12 when radio is configured for ++ * channel 11. ++ */ ++ return NULL; ++ } ++ ++ /* No match for the payload channel number - ignore it */ ++ return channel; ++ } ++ ++ if (scan_width == NL80211_BSS_CHAN_WIDTH_10 || ++ scan_width == NL80211_BSS_CHAN_WIDTH_5) { ++ /* ++ * Ignore channel number in 5 and 10 MHz channels where there ++ * may not be an n:1 or 1:n mapping between frequencies and ++ * channel numbers. ++ */ ++ return channel; ++ } ++ ++ /* ++ * Use the channel determined through the payload channel number ++ * instead of the RX channel reported by the driver. ++ */ ++ if (alt_channel->flags & IEEE80211_CHAN_DISABLED) + return NULL; +- return channel; ++ return alt_channel; + } + + /* Returned bss is reference counted and must be cleaned up appropriately. */ +@@ -1032,7 +1071,8 @@ cfg80211_inform_bss_data(struct wiphy *wiphy, + (data->signal < 0 || data->signal > 100))) + return NULL; + +- channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan); ++ channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan, ++ data->scan_width); + if (!channel) + return NULL; + +@@ -1130,7 +1170,7 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy, + return NULL; + + channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable, +- ielen, data->chan); ++ ielen, data->chan, data->scan_width); + if (!channel) + return NULL; + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 6e768093d7c8..026770884d46 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, + err = -EINVAL; + switch (p->family) { + case AF_INET: ++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) ++ goto out; ++ + break; + + case AF_INET6: + #if IS_ENABLED(CONFIG_IPV6) ++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) ++ goto out; ++ + break; + #else + err = -EAFNOSUPPORT; +@@ -1316,10 +1322,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) + + switch (p->sel.family) { + case AF_INET: ++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) ++ return -EINVAL; ++ + break; + + case AF_INET6: + #if IS_ENABLED(CONFIG_IPV6) ++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) ++ return -EINVAL; ++ + break; + #else + return -EAFNOSUPPORT; +@@ -1400,6 +1412,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) + (ut[i].family != prev_family)) + return -EINVAL; + ++ if (ut[i].mode >= XFRM_MODE_MAX) ++ return -EINVAL; ++ + prev_family = ut[i].family; + + switch (ut[i].family) { +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ca2945711dbe..cc48800f95e0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3499,7 +3499,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec, + } + } + +-#if IS_REACHABLE(INPUT) ++#if IS_REACHABLE(CONFIG_INPUT) + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -6392,8 +6392,11 @@ static int patch_alc269(struct hda_codec *codec) + break; + case 0x10ec0225: + case 0x10ec0295: ++ spec->codec_variant = ALC269_TYPE_ALC225; ++ break; + case 0x10ec0299: + spec->codec_variant = ALC269_TYPE_ALC225; ++ spec->gen.mixer_nid = 0; /* no loopback on ALC299 */ + break; + case 0x10ec0234: + case 0x10ec0274: +diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c +index bef8a4546c12..b0c154d5924b 100644 +--- a/sound/soc/intel/skylake/skl-topology.c ++++ b/sound/soc/intel/skylake/skl-topology.c +@@ -2325,7 +2325,7 @@ static int skl_tplg_get_manifest_tkn(struct device *dev, + + if (ret < 0) + return ret; +- tkn_count += ret; ++ tkn_count = ret; + + tuple_size += tkn_count * + sizeof(struct snd_soc_tplg_vendor_string_elem); +diff --git a/tools/perf/Makefile b/tools/perf/Makefile +index 32a64e619028..cd86fd7b35c4 100644 +--- a/tools/perf/Makefile ++++ b/tools/perf/Makefile +@@ -83,10 +83,10 @@ endif # has_clean + endif # MAKECMDGOALS + + # +-# The clean target is not really parallel, don't print the jobs info: ++# Explicitly disable parallelism for the clean target. + # + clean: +- $(make) ++ $(make) -j1 + + # + # The build-test target is not really parallel, don't print the jobs info, +diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c +index ade7213943ad..03239956987f 100644 +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -335,7 +335,7 @@ static int test_and_print(struct test *t, bool force_skip, int subtest) + if (!t->subtest.get_nr) + pr_debug("%s:", t->desc); + else +- pr_debug("%s subtest %d:", t->desc, subtest); ++ pr_debug("%s subtest %d:", t->desc, subtest + 1); + + switch (err) { + case TEST_OK: +@@ -413,7 +413,7 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist) + for (subi = 0; subi < subn; subi++) { + pr_info("%2d.%1d: %-*s:", i, subi + 1, subw, + t->subtest.get_desc(subi)); +- err = test_and_print(t, skip, subi + 1); ++ err = test_and_print(t, skip, subi); + if (err != TEST_OK && t->subtest.skip_if_fail) + skip = true; + } +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index 01a5ba2788c6..b0d005d295a9 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -82,7 +82,7 @@ int test__task_exit(int subtest __maybe_unused) + + evsel = perf_evlist__first(evlist); + evsel->attr.task = 1; +- evsel->attr.sample_freq = 0; ++ evsel->attr.sample_freq = 1; + evsel->attr.inherit = 0; + evsel->attr.watermark = 0; + evsel->attr.wakeup_events = 1; +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index a38227eb5450..3336cbc6ec48 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -495,9 +495,19 @@ static struct ins *ins__find(const char *name) + int symbol__alloc_hist(struct symbol *sym) + { + struct annotation *notes = symbol__annotation(sym); +- const size_t size = symbol__size(sym); ++ size_t size = symbol__size(sym); + size_t sizeof_sym_hist; + ++ /* ++ * Add buffer of one element for zero length symbol. ++ * When sample is taken from first instruction of ++ * zero length symbol, perf still resolves it and ++ * shows symbol name in perf report and allows to ++ * annotate it. ++ */ ++ if (size == 0) ++ size = 1; ++ + /* Check for overflow when calculating sizeof_sym_hist */ + if (size > (SIZE_MAX - sizeof(struct sym_hist)) / sizeof(u64)) + return -1; +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 3be8c489884e..f7128c2a6386 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -263,8 +263,20 @@ struct perf_evsel *perf_evsel__new_cycles(void) + struct perf_evsel *evsel; + + event_attr_init(&attr); ++ /* ++ * Unnamed union member, not supported as struct member named ++ * initializer in older compilers such as gcc 4.4.7 ++ * ++ * Just for probing the precise_ip: ++ */ ++ attr.sample_period = 1; + + perf_event_attr__set_max_precise_ip(&attr); ++ /* ++ * Now let the usual logic to set up the perf_event_attr defaults ++ * to kick in when we return and before perf_evsel__open() is called. ++ */ ++ attr.sample_period = 0; + + evsel = perf_evsel__new(&attr); + if (evsel == NULL) +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index c93daccec755..a7452fd3b6ee 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -615,7 +615,7 @@ static int post_process_probe_trace_point(struct probe_trace_point *tp, + struct map *map, unsigned long offs) + { + struct symbol *sym; +- u64 addr = tp->address + tp->offset - offs; ++ u64 addr = tp->address - offs; + + sym = map__find_symbol(map, addr); + if (!sym) +diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c +index 635b07b4fdd3..b4a2e6af515f 100644 +--- a/tools/virtio/ringtest/ptr_ring.c ++++ b/tools/virtio/ringtest/ptr_ring.c +@@ -15,24 +15,41 @@ + #define unlikely(x) (__builtin_expect(!!(x), 0)) + #define likely(x) (__builtin_expect(!!(x), 1)) + #define ALIGN(x, a) (((x) + (a) - 1) / (a) * (a)) ++#define SIZE_MAX (~(size_t)0) ++ + typedef pthread_spinlock_t spinlock_t; + + typedef int gfp_t; +-static void *kmalloc(unsigned size, gfp_t gfp) +-{ +- return memalign(64, size); +-} ++#define __GFP_ZERO 0x1 + +-static void *kzalloc(unsigned size, gfp_t gfp) ++static void *kmalloc(unsigned size, gfp_t gfp) + { + void *p = memalign(64, size); + if (!p) + return p; +- memset(p, 0, size); + ++ if (gfp & __GFP_ZERO) ++ memset(p, 0, size); + return p; + } + ++static inline void *kzalloc(unsigned size, gfp_t flags) ++{ ++ return kmalloc(size, flags | __GFP_ZERO); ++} ++ ++static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags) ++{ ++ if (size != 0 && n > SIZE_MAX / size) ++ return NULL; ++ return kmalloc(n * size, flags); ++} ++ ++static inline void *kcalloc(size_t n, size_t size, gfp_t flags) ++{ ++ return kmalloc_array(n, size, flags | __GFP_ZERO); ++} ++ + static void kfree(void *p) + { + if (p) |