commit: a3730ed4142f4394f432aa12a5f8371eadd992a9 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun Sep 18 12:43:17 2016 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun Sep 18 12:43:17 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a3730ed4
Linux patch 3.18.41 and 3.18.42. 0000_README | 8 + 1040_linux-3.18.41.patch | 1139 ++++++++++++++++++++++++++++++++++++++++++++++ 1041_linux-3.18.42.patch | 611 +++++++++++++++++++++++++ 3 files changed, 1758 insertions(+) diff --git a/0000_README b/0000_README index c85b470..7228605 100644 --- a/0000_README +++ b/0000_README @@ -203,6 +203,14 @@ Patch: 1039_linux-3.18.40.patch From: http://www.kernel.org Desc: Linux 3.18.40 +Patch: 1040_linux-3.18.41.patch +From: http://www.kernel.org +Desc: Linux 3.18.41 + +Patch: 1041_linux-3.18.42.patch +From: http://www.kernel.org +Desc: Linux 3.18.42 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1040_linux-3.18.41.patch b/1040_linux-3.18.41.patch new file mode 100644 index 0000000..ca98c36 --- /dev/null +++ b/1040_linux-3.18.41.patch @@ -0,0 +1,1139 @@ +diff --git a/Makefile b/Makefile +index 39e8b5638789..e31123a1d511 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 18 +-SUBLEVEL = 40 ++SUBLEVEL = 41 + EXTRAVERSION = + NAME = Diseased Newt + +diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h +index 884081099f80..81cdbc36699b 100644 +--- a/arch/arc/include/asm/entry.h ++++ b/arch/arc/include/asm/entry.h +@@ -143,8 +143,6 @@ + POP r13 + .endm + +-#define OFF_USER_R25_FROM_R24 (SZ_CALLEE_REGS + SZ_PT_REGS - 8)/4 +- + /*-------------------------------------------------------------- + * Collect User Mode callee regs as struct callee_regs - needed by + * fork/do_signal/unaligned-access-emulation. +@@ -157,12 +155,13 @@ + *-------------------------------------------------------------*/ + .macro SAVE_CALLEE_SAVED_USER + ++ mov r12, sp ; save SP as ref to pt_regs + SAVE_R13_TO_R24 + + #ifdef CONFIG_ARC_CURR_IN_REG +- ; Retrieve orig r25 and save it on stack +- ld.as r12, [sp, OFF_USER_R25_FROM_R24] +- st.a r12, [sp, -4] ++ ; Retrieve orig r25 and save it with rest of callee_regs ++ ld r12, [r12, PT_user_r25] ++ PUSH r12 + #else + PUSH r25 + #endif +@@ -209,12 +208,16 @@ + .macro RESTORE_CALLEE_SAVED_USER + + #ifdef CONFIG_ARC_CURR_IN_REG +- ld.ab r12, [sp, 4] +- st.as r12, [sp, OFF_USER_R25_FROM_R24] ++ POP r12 + #else + POP r25 + #endif + RESTORE_R24_TO_R13 ++ ++ ; SP is back to start of pt_regs ++#ifdef CONFIG_ARC_CURR_IN_REG ++ st r12, [sp, PT_user_r25] ++#endif + .endm + + /*-------------------------------------------------------------- +diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h +index 742816f1b210..ec8276de345e 100644 +--- a/arch/arc/include/asm/irqflags.h ++++ b/arch/arc/include/asm/irqflags.h +@@ -159,10 +159,10 @@ static inline int arch_irqs_disabled(void) + .endm + + .macro IRQ_ENABLE scratch ++ TRACE_ASM_IRQ_ENABLE + lr \scratch, [status32] + or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) + flag \scratch +- TRACE_ASM_IRQ_ENABLE + .endm + + #endif /* __ASSEMBLY__ */ +diff --git a/arch/arc/include/uapi/asm/elf.h b/arch/arc/include/uapi/asm/elf.h +index 0f99ac8fcbb2..0037a587320d 100644 +--- a/arch/arc/include/uapi/asm/elf.h ++++ b/arch/arc/include/uapi/asm/elf.h +@@ -13,8 +13,15 @@ + + /* Machine specific ELF Hdr flags */ + #define EF_ARC_OSABI_MSK 0x00000f00 +-#define EF_ARC_OSABI_ORIG 0x00000000 /* MUST be zero for back-compat */ +-#define EF_ARC_OSABI_CURRENT 0x00000300 /* v3 (no legacy syscalls) */ ++ ++#define EF_ARC_OSABI_V3 0x00000300 /* v3 (no legacy syscalls) */ ++#define EF_ARC_OSABI_V4 0x00000400 /* v4 (64bit data any reg align) */ ++ ++#if __GNUC__ < 6 ++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V3 ++#else ++#define EF_ARC_OSABI_CURRENT EF_ARC_OSABI_V4 ++#endif + + typedef unsigned long elf_greg_t; + typedef unsigned long elf_fpregset_t; +diff --git a/arch/arc/kernel/arcksyms.c b/arch/arc/kernel/arcksyms.c +index 4d9e77724bed..000dd041ab42 100644 +--- a/arch/arc/kernel/arcksyms.c ++++ b/arch/arc/kernel/arcksyms.c +@@ -28,6 +28,7 @@ extern void __muldf3(void); + extern void __divdf3(void); + extern void __floatunsidf(void); + extern void __floatunsisf(void); ++extern void __udivdi3(void); + + EXPORT_SYMBOL(__ashldi3); + EXPORT_SYMBOL(__ashrdi3); +@@ -45,6 +46,7 @@ EXPORT_SYMBOL(__muldf3); + EXPORT_SYMBOL(__divdf3); + EXPORT_SYMBOL(__floatunsidf); + EXPORT_SYMBOL(__floatunsisf); ++EXPORT_SYMBOL(__udivdi3); + + /* ARC optimised assembler routines */ + EXPORT_SYMBOL(memset); +diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c +index 6c3aa0edb9b5..5f14311ce59e 100644 +--- a/arch/arc/kernel/asm-offsets.c ++++ b/arch/arc/kernel/asm-offsets.c +@@ -59,5 +59,7 @@ int main(void) + + DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs)); + DEFINE(SZ_PT_REGS, sizeof(struct pt_regs)); ++ DEFINE(PT_user_r25, offsetof(struct pt_regs, user_r25)); ++ + return 0; + } +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index fdd89715d2d3..f45b98781116 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -223,7 +223,7 @@ int elf_check_arch(const struct elf32_hdr *x) + return 0; + + eflags = x->e_flags; +- if ((eflags & EF_ARC_OSABI_MSK) < EF_ARC_OSABI_CURRENT) { ++ if ((eflags & EF_ARC_OSABI_MSK) != EF_ARC_OSABI_CURRENT) { + pr_err("ABI mismatch - you need newer toolchain\n"); + force_sigsegv(SIGSEGV, current); + return 0; +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index 252bf603db9c..e5ec4789c31e 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -234,8 +234,10 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len) + cpu->dccm.base_addr, TO_KB(cpu->dccm.sz), + cpu->iccm.base_addr, TO_KB(cpu->iccm.sz)); + +- n += scnprintf(buf + n, len - n, +- "OS ABI [v3]\t: no-legacy-syscalls\n"); ++ n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n", ++ EF_ARC_OSABI_CURRENT >> 8, ++ EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ? ++ "no-legacy-syscalls" : "64-bit data any register aligned"); + + return buf; + } +diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c +index 8c3a3e02ba92..2147ca2bc131 100644 +--- a/arch/arc/mm/cache_arc700.c ++++ b/arch/arc/mm/cache_arc700.c +@@ -155,6 +155,15 @@ void arc_cache_init(void) + + printk(arc_cache_mumbojumbo(0, str, sizeof(str))); + ++ /* ++ * Only master CPU needs to execute rest of function: ++ * - Assume SMP so all cores will have same cache config so ++ * any geomtry checks will be same for all ++ * - IOC setup / dma callbacks only need to be setup once ++ */ ++ if (cpu) ++ return; ++ + if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) { + struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache; + +diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h +index c0ae62520d15..274d5bc6ecce 100644 +--- a/arch/parisc/include/uapi/asm/errno.h ++++ b/arch/parisc/include/uapi/asm/errno.h +@@ -97,10 +97,10 @@ + #define ENOTCONN 235 /* Transport endpoint is not connected */ + #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */ + #define ETOOMANYREFS 237 /* Too many references: cannot splice */ +-#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ + #define ETIMEDOUT 238 /* Connection timed out */ + #define ECONNREFUSED 239 /* Connection refused */ +-#define EREMOTERELEASE 240 /* Remote peer released connection */ ++#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */ ++#define EREMOTERELEASE 240 /* Remote peer released connection */ + #define EHOSTDOWN 241 /* Host is down */ + #define EHOSTUNREACH 242 /* No route to host */ + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 2248a1999c64..f8402e17ef89 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -646,7 +646,7 @@ int eeh_pci_enable(struct eeh_pe *pe, int function) + /* Check if the request is finished successfully */ + if (active_flag) { + rc = eeh_ops->wait_state(pe, PCI_BUS_RESET_WAIT_MSEC); +- if (rc <= 0) ++ if (rc < 0) + return rc; + + if (rc & active_flag) +diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c +index f4a9c0058b4d..501c95941882 100644 +--- a/drivers/clocksource/sun4i_timer.c ++++ b/drivers/clocksource/sun4i_timer.c +@@ -120,12 +120,16 @@ static struct clock_event_device sun4i_clockevent = { + .set_next_event = sun4i_clkevt_next_event, + }; + ++static void sun4i_timer_clear_interrupt(void) ++{ ++ writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG); ++} + + static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id) + { + struct clock_event_device *evt = (struct clock_event_device *)dev_id; + +- writel(0x1, timer_base + TIMER_IRQ_ST_REG); ++ sun4i_timer_clear_interrupt(); + evt->event_handler(evt); + + return IRQ_HANDLED; +@@ -182,6 +186,9 @@ static void __init sun4i_timer_init(struct device_node *node) + /* Make sure timer is stopped before playing with interrupts */ + sun4i_clkevt_time_stop(0); + ++ /* clear timer0 interrupt */ ++ sun4i_timer_clear_interrupt(); ++ + sun4i_clockevent.cpumask = cpu_possible_mask; + sun4i_clockevent.irq = irq; + +diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c +index 5408450204b0..e3920af78621 100644 +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -1861,6 +1861,7 @@ caam_hash_alloc(struct caam_hash_template *template, + template->name); + snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", + template->driver_name); ++ t_alg->ahash_alg.setkey = NULL; + } + alg->cra_module = THIS_MODULE; + alg->cra_init = caam_hash_cra_init; +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index 0959ca9b6b27..929b680d4b29 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -50,6 +50,7 @@ config GPIO_DEVRES + config OF_GPIO + def_bool y + depends on OF ++ depends on HAS_IOMEM + + config GPIO_ACPI + def_bool y +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 0cd6e0d7dd1a..18dd03bb7af0 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -4583,6 +4583,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, + unsigned long flags; + int ret = -EINVAL; + ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return -EINVAL; ++ + if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || + page_flip->reserved != 0) + return -EINVAL; +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index 728938f02341..b92844ae5b27 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -1745,6 +1745,7 @@ void i915_global_gtt_cleanup(struct drm_device *dev) + struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt; + + ppgtt->base.cleanup(&ppgtt->base); ++ kfree(ppgtt); + } + + if (drm_mm_initialized(&vm->mm)) { +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 2f2e50a0feb4..e0780bf1138f 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -586,7 +586,8 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev) || ASIC_IS_DCE8(rdev)) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + /* use frac fb div on RS780/RS880 */ +- if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880)) ++ if (((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880)) ++ && !radeon_crtc->ss_enabled) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + if (ASIC_IS_DCE32(rdev) && mode->clock > 165000) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; +@@ -616,7 +617,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + if (radeon_crtc->ss.refdiv) { + radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV; + radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv; +- if (ASIC_IS_AVIVO(rdev)) ++ if (ASIC_IS_AVIVO(rdev) && ++ rdev->family != CHIP_RS780 && ++ rdev->family != CHIP_RS880) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + } + } +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index fdea9d07cca7..f361af72c548 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -240,8 +240,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo, + + rdev = radeon_get_rdev(bo->bdev); + ridx = radeon_copy_ring_index(rdev); +- old_start = old_mem->start << PAGE_SHIFT; +- new_start = new_mem->start << PAGE_SHIFT; ++ old_start = (u64)old_mem->start << PAGE_SHIFT; ++ new_start = (u64)new_mem->start << PAGE_SHIFT; + + switch (old_mem->mem_type) { + case TTM_PL_VRAM: +diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c +index 9757a58bc897..5d39b966dd28 100644 +--- a/drivers/input/keyboard/tegra-kbc.c ++++ b/drivers/input/keyboard/tegra-kbc.c +@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc) + /* Reset the KBC controller to clear all previous status.*/ + reset_control_assert(kbc->rst); + udelay(100); +- reset_control_assert(kbc->rst); ++ reset_control_deassert(kbc->rst); + udelay(100); + + tegra_kbc_config_pins(kbc); +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 1889f0a6c4ca..1e25a0616ca0 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1258,6 +1258,7 @@ static int __init i8042_create_aux_port(int idx) + serio->write = i8042_aux_write; + serio->start = i8042_start; + serio->stop = i8042_stop; ++ serio->ps2_cmd_mutex = &i8042_mutex; + serio->port_data = port; + serio->dev.parent = &i8042_platform_device->dev; + if (idx < 0) { +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 2a102834c2ee..a7a03a21d78a 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1851,7 +1851,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; + + if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || +- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || ++ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || + !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) || +@@ -1876,7 +1876,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + struct block_device *bdev, struct cache *ca) + { + char name[BDEVNAME_SIZE]; +- const char *err = NULL; ++ const char *err = NULL; /* must be set for any error case */ + int ret = 0; + + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); +@@ -1893,8 +1893,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + ca->discard = CACHE_DISCARD(&ca->sb); + + ret = cache_alloc(sb, ca); +- if (ret != 0) ++ if (ret != 0) { ++ if (ret == -ENOMEM) ++ err = "cache_alloc(): -ENOMEM"; ++ else ++ err = "cache_alloc(): unknown error"; + goto err; ++ } + + if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { + err = "error calling kobject_add"; +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 0f5e1820c92d..768c9fdf0df8 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -287,15 +287,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) + pb->bio_submitted = true; + + /* +- * Map reads as normal only if corrupt_bio_byte set. ++ * Error reads if neither corrupt_bio_byte or drop_writes are set. ++ * Otherwise, flakey_end_io() will decide if the reads should be modified. + */ + if (bio_data_dir(bio) == READ) { +- /* If flags were specified, only corrupt those that match. */ +- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && +- all_corrupt_bio_flags_match(bio, fc)) +- goto map_bio; +- else ++ if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags)) + return -EIO; ++ goto map_bio; + } + + /* +@@ -332,14 +330,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error) + struct flakey_c *fc = ti->private; + struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data)); + +- /* +- * Corrupt successful READs while in down state. +- */ + if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { +- if (fc->corrupt_bio_byte) ++ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && ++ all_corrupt_bio_flags_match(bio, fc)) { ++ /* ++ * Corrupt successful matching READs while in down state. ++ */ + corrupt_bio_data(bio, fc); +- else ++ ++ } else if (!test_bit(DROP_WRITES, &fc->flags)) { ++ /* ++ * Error read during the down_interval if drop_writes ++ * wasn't configured. ++ */ + return -EIO; ++ } + } + + return error; +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 2ee3c9537772..51f65299094b 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3166,6 +3166,7 @@ fec_probe(struct platform_device *pdev) + /* setup board info structure */ + fep = netdev_priv(ndev); + ++ fep->netdev = ndev; + fep->num_rx_queues = num_rx_qs; + fep->num_tx_queues = num_tx_qs; + +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index eb1543841e39..795d800deef2 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -1363,10 +1363,10 @@ int __must_check pci_create_sysfs_dev_files(struct pci_dev *pdev) + if (!sysfs_initialized) + return -EACCES; + +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + retval = sysfs_create_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ retval = sysfs_create_bin_file(&pdev->dev.kobj, &pci_config_attr); + if (retval) + goto err; + +@@ -1418,10 +1418,10 @@ err_rom_file: + err_resource_files: + pci_remove_resource_files(pdev); + err_config_file: +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); + err: + return retval; + } +@@ -1455,10 +1455,10 @@ void pci_remove_sysfs_dev_files(struct pci_dev *pdev) + + pci_remove_capabilities_sysfs(pdev); + +- if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE) +- sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); +- else ++ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE) + sysfs_remove_bin_file(&pdev->dev.kobj, &pcie_config_attr); ++ else ++ sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr); + + pci_remove_resource_files(pdev); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index d89d4dac2c09..b3e63f567c56 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -288,6 +288,18 @@ static void quirk_citrine(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine); + ++/* ++ * This chip can cause bus lockups if config addresses above 0x600 ++ * are read or written. ++ */ ++static void quirk_nfp6000(struct pci_dev *dev) ++{ ++ dev->cfg_size = 0x600; ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP4000, quirk_nfp6000); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000, quirk_nfp6000); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETRONOME, PCI_DEVICE_ID_NETRONOME_NFP6000_VF, quirk_nfp6000); ++ + /* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */ + static void quirk_extend_bar_to_page(struct pci_dev *dev) + { +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index 329db997ee66..35672b081254 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1621,9 +1621,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, + unsigned long long now; + int expires; + ++ cqr = (struct dasd_ccw_req *) intparm; + if (IS_ERR(irb)) { + switch (PTR_ERR(irb)) { + case -EIO: ++ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) { ++ device = (struct dasd_device *) cqr->startdev; ++ cqr->status = DASD_CQR_CLEARED; ++ dasd_device_clear_timer(device); ++ wake_up(&dasd_flush_wq); ++ dasd_schedule_device_bh(device); ++ return; ++ } + break; + case -ETIMEDOUT: + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: " +@@ -1639,7 +1648,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, + } + + now = get_tod_clock(); +- cqr = (struct dasd_ccw_req *) intparm; + /* check for conditions that should be handled immediately */ + if (!cqr || + !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) && +diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c +index fbcd48d0bfc3..16b2db3cd9f1 100644 +--- a/drivers/scsi/aacraid/commctrl.c ++++ b/drivers/scsi/aacraid/commctrl.c +@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + struct fib *fibptr; + struct hw_fib * hw_fib = (struct hw_fib *)0; + dma_addr_t hw_fib_pa = (dma_addr_t)0LL; +- unsigned size; ++ unsigned int size, osize; + int retval; + + if (dev->in_reset) { +@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + * will not overrun the buffer when we copy the memory. Return + * an error if we would. + */ +- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); ++ osize = size = le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr); + if (size < le16_to_cpu(kfib->header.SenderSize)) + size = le16_to_cpu(kfib->header.SenderSize); + if (size > dev->max_fib_size) { +@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + goto cleanup; + } + ++ /* Sanity check the second copy */ ++ if ((osize != le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr)) ++ || (size < le16_to_cpu(kfib->header.SenderSize))) { ++ retval = -EINVAL; ++ goto cleanup; ++ } ++ + if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { + aac_adapter_interrupt(dev); + /* +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0dd514e86fdc..f88ee8f3373d 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1342,7 +1342,6 @@ made_compressed_probe: + spin_lock_init(&acm->write_lock); + spin_lock_init(&acm->read_lock); + mutex_init(&acm->mutex); +- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress); + acm->is_int_ep = usb_endpoint_xfer_int(epread); + if (acm->is_int_ep) + acm->bInterval = epread->bInterval; +@@ -1392,14 +1391,14 @@ made_compressed_probe: + urb->transfer_dma = rb->dma; + if (acm->is_int_ep) { + usb_fill_int_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvintpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb, + acm->bInterval); + } else { + usb_fill_bulk_urb(urb, acm->dev, +- acm->rx_endpoint, ++ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress), + rb->base, + acm->readsize, + acm_read_bulk_callback, rb); +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index 70d24d7e9dc5..6050d8e92c5e 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -95,7 +95,6 @@ struct acm { + struct urb *read_urbs[ACM_NR]; + struct acm_rb read_buffers[ACM_NR]; + int rx_buflimit; +- int rx_endpoint; + spinlock_t read_lock; + int write_used; /* number of non-empty write buffers */ + int transmitting; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index ea9475fe20df..464542a046c7 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1298,8 +1298,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) + struct usb_device *hdev = hub->hdev; + int i; + +- cancel_delayed_work_sync(&hub->init_work); +- + /* hub_wq and related activity won't re-trigger */ + hub->quiescing = 1; + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 37da0e8bac33..2d49d66113ee 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1802,7 +1802,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc) + + static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + struct dwc3_request *req, struct dwc3_trb *trb, +- const struct dwc3_event_depevt *event, int status) ++ const struct dwc3_event_depevt *event, int status, ++ int chain) + { + unsigned int count; + unsigned int s_pkt = 0; +@@ -1810,6 +1811,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + + trace_dwc3_complete_trb(dep, trb); + ++ /* ++ * If we're in the middle of series of chained TRBs and we ++ * receive a short transfer along the way, DWC3 will skip ++ * through all TRBs including the last TRB in the chain (the ++ * where CHN bit is zero. DWC3 will also avoid clearing HWO ++ * bit and SW has to do it manually. ++ * ++ * We're going to do that here to avoid problems of HW trying ++ * to use bogus TRBs for transfers. ++ */ ++ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO)) ++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN) + /* + * We continue despite the error. There is not much we +@@ -1821,6 +1835,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + */ + dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", + dep->name, trb); ++ + count = trb->size & DWC3_TRB_SIZE_MASK; + + if (dep->direction) { +@@ -1858,15 +1873,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + s_pkt = 1; + } + +- /* +- * We assume here we will always receive the entire data block +- * which we should receive. Meaning, if we program RX to +- * receive 4K but we receive only 2K, we assume that's all we +- * should receive and we simply bounce the request back to the +- * gadget driver for further processing. +- */ +- req->request.actual += req->request.length - count; +- if (s_pkt) ++ if (s_pkt && !chain) + return 1; + if ((event->status & DEPEVT_STATUS_LST) && + (trb->ctrl & (DWC3_TRB_CTRL_LST | +@@ -1885,14 +1892,19 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + struct dwc3_trb *trb; + unsigned int slot; + unsigned int i; ++ int count = 0; + int ret; + + do { ++ int chain; ++ + req = next_request(&dep->req_queued); + if (!req) { + WARN_ON_ONCE(1); + return 1; + } ++ ++ chain = req->request.num_mapped_sgs > 0; + i = 0; + do { + slot = req->start_slot + i; +@@ -1901,13 +1913,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + slot++; + slot %= DWC3_TRB_NUM; + trb = &dep->trb_pool[slot]; ++ count += trb->size & DWC3_TRB_SIZE_MASK; + + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, +- event, status); ++ event, status, chain); + if (ret) + break; + }while (++i < req->request.num_mapped_sgs); + ++ /* ++ * We assume here we will always receive the entire data block ++ * which we should receive. Meaning, if we program RX to ++ * receive 4K but we receive only 2K, we assume that's all we ++ * should receive and we simply bounce the request back to the ++ * gadget driver for further processing. ++ */ ++ req->request.actual += req->request.length - count; + dwc3_gadget_giveback(dep, req, status); + + if (ret) +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 8bdfb38782f8..dfe835d21b15 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) + + ret = 0; + virt_dev = xhci->devs[slot_id]; ++ if (!virt_dev) ++ return -ENODEV; ++ + cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO); + if (!cmd) { + xhci_dbg(xhci, "Couldn't allocate command structure.\n"); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 69464630be54..51ff57497b91 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1324,12 +1324,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + + cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list); + +- if (cmd->command_trb != xhci->cmd_ring->dequeue) { +- xhci_err(xhci, +- "Command completion event does not match command\n"); +- return; +- } +- + del_timer(&xhci->cmd_timer); + + trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event); +@@ -1341,6 +1335,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, + xhci_handle_stopped_cmd_ring(xhci, cmd); + return; + } ++ ++ if (cmd->command_trb != xhci->cmd_ring->dequeue) { ++ xhci_err(xhci, ++ "Command completion event does not match command\n"); ++ return; ++ } ++ + /* + * Host aborted the command ring, check if the current command was + * supposed to be aborted, otherwise continue normally. +diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c +index bbddc44ce8bc..c33ad2181b33 100644 +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -545,7 +545,6 @@ static void sg_timeout(unsigned long _req) + { + struct usb_sg_request *req = (struct usb_sg_request *) _req; + +- req->status = -ETIMEDOUT; + usb_sg_cancel(req); + } + +@@ -576,8 +575,10 @@ static int perform_sglist( + mod_timer(&sg_timer, jiffies + + msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); + usb_sg_wait(req); +- del_timer_sync(&sg_timer); +- retval = req->status; ++ if (!del_timer_sync(&sg_timer)) ++ retval = -ETIMEDOUT; ++ else ++ retval = req->status; + + /* FIXME check resulting data pattern */ + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b61f12160d37..8c48c9d83d48 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) }, + { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) }, + { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) }, + { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) }, +@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, ++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 334bc600282d..48db84f25cc9 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -406,6 +406,12 @@ + #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* ++ * Ivium Technologies product IDs ++ */ ++#define FTDI_PALMSENS_PID 0xf440 ++#define FTDI_IVIUM_XSTAT_PID 0xf441 ++ ++/* + * Linx Technologies product ids + */ + #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */ +@@ -673,6 +679,12 @@ + #define INTREPID_NEOVI_PID 0x0701 + + /* ++ * WICED USB UART ++ */ ++#define WICED_VID 0x0A5C ++#define WICED_USB20706V2_PID 0x6422 ++ ++/* + * Definitions for ID TECH (www.idt-net.com) devices + */ + #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2477bf19a3b4..023ed532e7b3 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -276,6 +276,12 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 ++#define TELIT_PRODUCT_LE920A4_1207 0x1207 ++#define TELIT_PRODUCT_LE920A4_1208 0x1208 ++#define TELIT_PRODUCT_LE920A4_1211 0x1211 ++#define TELIT_PRODUCT_LE920A4_1212 0x1212 ++#define TELIT_PRODUCT_LE920A4_1213 0x1213 ++#define TELIT_PRODUCT_LE920A4_1214 0x1214 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -637,6 +643,11 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = { + .reserved = BIT(8) | BIT(10) | BIT(11), + }; + ++static const struct option_blacklist_info telit_le920a4_blacklist_1 = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(1), ++}; ++ + static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup = BIT(2), + .reserved = BIT(0) | BIT(1) | BIT(3), +@@ -1215,6 +1226,16 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, +@@ -1975,6 +1996,7 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index 6fbfc8fc2f5d..d3bf8348e638 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1416,7 +1416,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] + + rc = usb_register(udriver); + if (rc) +- return rc; ++ goto failed_usb_register; + + for (sd = serial_drivers; *sd; ++sd) { + (*sd)->usb_driver = udriver; +@@ -1434,6 +1434,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[] + while (sd-- > serial_drivers) + usb_serial_deregister(*sd); + usb_deregister(udriver); ++failed_usb_register: ++ kfree(udriver); + return rc; + } + EXPORT_SYMBOL_GPL(usb_serial_register_drivers); +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 531e76474983..0e0eb10f82a0 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type, + rc = -ENOMEM; + goto out; + } +- } else { ++ } else if (msg_type == XS_TRANSACTION_END) { + list_for_each_entry(trans, &u->transactions, list) + if (trans->handle.id == u->u.msg.tx_id) + break; +diff --git a/fs/seq_file.c b/fs/seq_file.c +index 3857b720cb1b..fbb1688bff87 100644 +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -219,8 +219,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) + size -= n; + buf += n; + copied += n; +- if (!m->count) ++ if (!m->count) { ++ m->from = 0; + m->index++; ++ } + if (!size) + goto Done; + } +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index 7a205e046776..9bece329a12c 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + + p = c->gap_lebs; + do { +- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs); ++ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs); + written = layout_leb_in_gaps(c, p); + if (written < 0) { + err = written; +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 1fa99a301817..1ce77d9b29ab 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2478,6 +2478,13 @@ + #define PCI_DEVICE_ID_KORENIX_JETCARDF2 0x1700 + #define PCI_DEVICE_ID_KORENIX_JETCARDF3 0x17ff + ++#define PCI_VENDOR_ID_NETRONOME 0x19ee ++#define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200 ++#define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240 ++#define PCI_DEVICE_ID_NETRONOME_NFP4000 0x4000 ++#define PCI_DEVICE_ID_NETRONOME_NFP6000 0x6000 ++#define PCI_DEVICE_ID_NETRONOME_NFP6000_VF 0x6003 ++ + #define PCI_VENDOR_ID_QMI 0x1a32 + + #define PCI_VENDOR_ID_AZWAVE 0x1a3b +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index ed8f2cde34c5..4e10bb0b1704 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -179,8 +179,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, + mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); + err = -EAGAIN; + ptep = page_check_address(page, mm, addr, &ptl, 0); +- if (!ptep) ++ if (!ptep) { ++ mem_cgroup_cancel_charge(kpage, memcg); + goto unlock; ++ } + + get_page(kpage); + page_add_new_anon_rmap(kpage, vma, addr); +@@ -207,7 +209,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, + + err = 0; + unlock: +- mem_cgroup_cancel_charge(kpage, memcg); + mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); + unlock_page(page); + return err; +diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c +index f6bd65236712..107310a6f36f 100644 +--- a/kernel/time/timekeeping_debug.c ++++ b/kernel/time/timekeeping_debug.c +@@ -23,7 +23,9 @@ + + #include "timekeeping_internal.h" + +-static unsigned int sleep_time_bin[32] = {0}; ++#define NUM_BINS 32 ++ ++static unsigned int sleep_time_bin[NUM_BINS] = {0}; + + static int tk_debug_show_sleep_time(struct seq_file *s, void *data) + { +@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init); + + void tk_debug_account_sleep_time(struct timespec64 *t) + { +- sleep_time_bin[fls(t->tv_sec)]++; ++ /* Cap bin index so we don't overflow the array */ ++ int bin = min(fls(t->tv_sec), NUM_BINS-1); ++ ++ sleep_time_bin[bin]++; + } + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 0c96055b2382..067baa738001 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -88,7 +88,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1; + EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); + + /* rfc5961 challenge ack rate limiting */ +-int sysctl_tcp_challenge_ack_limit = 100; ++int sysctl_tcp_challenge_ack_limit = 1000; + + int sysctl_tcp_stdurg __read_mostly; + int sysctl_tcp_rfc1337 __read_mostly; +@@ -3324,13 +3324,18 @@ static void tcp_send_challenge_ack(struct sock *sk) + /* unprotected vars, we dont care of overwrites */ + static u32 challenge_timestamp; + static unsigned int challenge_count; +- u32 now = jiffies / HZ; ++ u32 count, now = jiffies / HZ; + + if (now != challenge_timestamp) { ++ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1; ++ + challenge_timestamp = now; +- challenge_count = 0; ++ WRITE_ONCE(challenge_count, half + ++ prandom_u32_max(sysctl_tcp_challenge_ack_limit)); + } +- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) { ++ count = READ_ONCE(challenge_count); ++ if (count > 0) { ++ WRITE_ONCE(challenge_count, count - 1); + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK); + tcp_send_ack(sk); + } +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 343da1e35025..095e3958d83c 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -865,7 +865,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev) + + /* free all potentially still buffered bcast frames */ + local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf); +- skb_queue_purge(&sdata->u.ap.ps.bc_buf); ++ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf); + + mutex_lock(&local->mtx); + ieee80211_vif_copy_chanctx_to_vlans(sdata, true); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 45e782825567..655abb9aa597 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -353,7 +353,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local) + skb = skb_dequeue(&ps->bc_buf); + if (skb) { + purged++; +- dev_kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + total += skb_queue_len(&ps->bc_buf); + } +@@ -436,7 +436,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) + if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) { + ps_dbg(tx->sdata, + "BC TX buffer full - dropping the oldest frame\n"); +- dev_kfree_skb(skb_dequeue(&ps->bc_buf)); ++ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf)); + } else + tx->local->total_ps_buffered++; + +@@ -2999,7 +2999,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw, + sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); + if (!ieee80211_tx_prepare(sdata, &tx, skb)) + break; +- dev_kfree_skb_any(skb); ++ ieee80211_free_txskb(hw, skb); + } + + info = IEEE80211_SKB_CB(skb); diff --git a/1041_linux-3.18.42.patch b/1041_linux-3.18.42.patch new file mode 100644 index 0000000..669a531 --- /dev/null +++ b/1041_linux-3.18.42.patch @@ -0,0 +1,611 @@ +diff --git a/Makefile b/Makefile +index e31123a1d511..dafc1eade47e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 18 +-SUBLEVEL = 41 ++SUBLEVEL = 42 + EXTRAVERSION = + NAME = Diseased Newt + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index b556b4ef9775..7670f33b9ce2 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -98,7 +98,7 @@ + #define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) + + /* Set of bits not changed in pte_modify */ +-#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_SPECIAL) ++#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED) + + /* More Abbrevaited helpers */ + #define PAGE_U_NONE __pgprot(___DEF) +diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c +index e90a3148f385..eb821e7b80f9 100644 +--- a/arch/arm/kernel/sys_oabi-compat.c ++++ b/arch/arm/kernel/sys_oabi-compat.c +@@ -193,15 +193,44 @@ struct oabi_flock64 { + pid_t l_pid; + } __attribute__ ((packed,aligned(4))); + +-asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, ++static long do_locks(unsigned int fd, unsigned int cmd, + unsigned long arg) + { +- struct oabi_flock64 user; + struct flock64 kernel; +- mm_segment_t fs = USER_DS; /* initialized to kill a warning */ +- unsigned long local_arg = arg; +- int ret; ++ struct oabi_flock64 user; ++ mm_segment_t fs; ++ long ret; ++ ++ if (copy_from_user(&user, (struct oabi_flock64 __user *)arg, ++ sizeof(user))) ++ return -EFAULT; ++ kernel.l_type = user.l_type; ++ kernel.l_whence = user.l_whence; ++ kernel.l_start = user.l_start; ++ kernel.l_len = user.l_len; ++ kernel.l_pid = user.l_pid; ++ ++ fs = get_fs(); ++ set_fs(KERNEL_DS); ++ ret = sys_fcntl64(fd, cmd, (unsigned long)&kernel); ++ set_fs(fs); ++ ++ if (!ret && (cmd == F_GETLK64 || cmd == F_OFD_GETLK)) { ++ user.l_type = kernel.l_type; ++ user.l_whence = kernel.l_whence; ++ user.l_start = kernel.l_start; ++ user.l_len = kernel.l_len; ++ user.l_pid = kernel.l_pid; ++ if (copy_to_user((struct oabi_flock64 __user *)arg, ++ &user, sizeof(user))) ++ ret = -EFAULT; ++ } ++ return ret; ++} + ++asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, ++ unsigned long arg) ++{ + switch (cmd) { + case F_OFD_GETLK: + case F_OFD_SETLK: +@@ -209,39 +238,11 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd, + case F_GETLK64: + case F_SETLK64: + case F_SETLKW64: +- if (copy_from_user(&user, (struct oabi_flock64 __user *)arg, +- sizeof(user))) +- return -EFAULT; +- kernel.l_type = user.l_type; +- kernel.l_whence = user.l_whence; +- kernel.l_start = user.l_start; +- kernel.l_len = user.l_len; +- kernel.l_pid = user.l_pid; +- local_arg = (unsigned long)&kernel; +- fs = get_fs(); +- set_fs(KERNEL_DS); +- } +- +- ret = sys_fcntl64(fd, cmd, local_arg); ++ return do_locks(fd, cmd, arg); + +- switch (cmd) { +- case F_GETLK64: +- if (!ret) { +- user.l_type = kernel.l_type; +- user.l_whence = kernel.l_whence; +- user.l_start = kernel.l_start; +- user.l_len = kernel.l_len; +- user.l_pid = kernel.l_pid; +- if (copy_to_user((struct oabi_flock64 __user *)arg, +- &user, sizeof(user))) +- ret = -EFAULT; +- } +- case F_SETLK64: +- case F_SETLKW64: +- set_fs(fs); ++ default: ++ return sys_fcntl64(fd, cmd, arg); + } +- +- return ret; + } + + struct oabi_epoll_event { +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 813d29d00a17..a86afc3741dc 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -603,6 +603,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c) + set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH); + } + ++#define MSR_AMD64_DE_CFG 0xC0011029 ++ ++static void init_amd_ln(struct cpuinfo_x86 *c) ++{ ++ /* ++ * Apply erratum 665 fix unconditionally so machines without a BIOS ++ * fix work. ++ */ ++ msr_set_bit(MSR_AMD64_DE_CFG, 31); ++} ++ + static void init_amd_bd(struct cpuinfo_x86 *c) + { + u64 value; +@@ -672,6 +683,7 @@ static void init_amd(struct cpuinfo_x86 *c) + case 6: init_amd_k7(c); break; + case 0xf: init_amd_k8(c); break; + case 0x10: init_amd_gh(c); break; ++ case 0x12: init_amd_ln(c); break; + case 0x15: init_amd_bd(c); break; + } + +diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c +index 8d12f0546dfc..8819ec730be4 100644 +--- a/arch/x86/kernel/paravirt.c ++++ b/arch/x86/kernel/paravirt.c +@@ -55,12 +55,12 @@ asm (".pushsection .entry.text, \"ax\"\n" + ".popsection"); + + /* identity function, which can be inlined */ +-u32 _paravirt_ident_32(u32 x) ++u32 notrace _paravirt_ident_32(u32 x) + { + return x; + } + +-u64 _paravirt_ident_64(u64 x) ++u64 notrace _paravirt_ident_64(u64 x) + { + return x; + } +diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c +index 98ba761cbb9c..6dfce7e722cb 100644 +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -160,6 +160,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev, + if (ret < 0) + goto error_ret; + *val = ret; ++ ret = IIO_VAL_INT; + break; + case IIO_CHAN_INFO_SCALE: + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 08981be7baa1..b1c2bef46f8d 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1401,7 +1401,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) + unsigned i; + int err; + +- cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), ++ cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), + GFP_KERNEL); + if (!cc->tfms) + return -ENOMEM; +@@ -1842,6 +1842,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio) + return DM_MAPIO_REMAPPED; + } + ++ /* ++ * Check if bio is too large, split as needed. ++ */ ++ if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) && ++ bio_data_dir(bio) == WRITE) ++ dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT)); ++ + io = dm_per_bio_data(bio, cc->per_bio_data_size); + crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector)); + io->ctx.req = (struct ablkcipher_request *)(io + 1); +diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c +index e5b5a8133b34..55cfc34bd187 100644 +--- a/drivers/staging/comedi/drivers/daqboard2000.c ++++ b/drivers/staging/comedi/drivers/daqboard2000.c +@@ -637,7 +637,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev, + const struct daq200_boardtype *board; + int i; + +- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH) ++ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH) + return NULL; + + for (i = 0; i < ARRAY_SIZE(boardtypes); i++) { +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index b7588e4e3644..8400f2fa76bd 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -3015,7 +3015,15 @@ static int ni_ao_inttrig(struct comedi_device *dev, + int i; + static const int timeout = 1000; + +- if (trig_num != cmd->start_arg) ++ /* ++ * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT. ++ * For backwards compatibility, also allow trig_num == 0 when ++ * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT); ++ * in that case, the internal trigger is being used as a pre-trigger ++ * before the external trigger. ++ */ ++ if (!(trig_num == cmd->start_arg || ++ (trig_num == 0 && cmd->start_src != TRIG_INT))) + return -EINVAL; + + /* Null trig at beginning prevent ao start trigger from executing more than +@@ -5674,7 +5682,7 @@ static int ni_E_init(struct comedi_device *dev, + s->maxdata = (devpriv->is_m_series) ? 0xffffffff + : 0x00ffffff; + s->insn_read = ni_tio_insn_read; +- s->insn_write = ni_tio_insn_read; ++ s->insn_write = ni_tio_insn_write; + s->insn_config = ni_tio_insn_config; + #ifdef PCIDMA + if (dev->irq && devpriv->mite) { +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index a85eadff6bea..ea8ec9ceab68 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1526,11 +1526,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + as->urb->start_frame = uurb->start_frame; + as->urb->number_of_packets = number_of_packets; + as->urb->stream_id = stream_id; +- if (uurb->type == USBDEVFS_URB_TYPE_ISO || +- ps->dev->speed == USB_SPEED_HIGH) +- as->urb->interval = 1 << min(15, ep->desc.bInterval - 1); +- else +- as->urb->interval = ep->desc.bInterval; ++ ++ if (ep->desc.bInterval) { ++ if (uurb->type == USBDEVFS_URB_TYPE_ISO || ++ ps->dev->speed == USB_SPEED_HIGH || ++ ps->dev->speed >= USB_SPEED_SUPER) ++ as->urb->interval = 1 << ++ min(15, ep->desc.bInterval - 1); ++ else ++ as->urb->interval = ep->desc.bInterval; ++ } ++ + as->urb->context = as; + as->urb->complete = async_completed; + for (totlen = u = 0; u < number_of_packets; u++) { +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c +index dfd728a263d2..c3b8ae360424 100644 +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1239,7 +1239,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port, + + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + } +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index 3d88eefdf1d1..0b547d9e2aeb 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1369,8 +1369,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port, + } + + if (urb->transfer_buffer == NULL) { +- urb->transfer_buffer = +- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL); ++ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, ++ GFP_ATOMIC); + if (!urb->transfer_buffer) + goto exit; + } +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 023ed532e7b3..3814b7bd7d9f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -534,6 +534,13 @@ enum option_blacklist_reason { + }; + + #define MAX_BL_NUM 11 ++ ++/* WeTelecom products */ ++#define WETELECOM_VENDOR_ID 0x22de ++#define WETELECOM_PRODUCT_WMD200 0x6801 ++#define WETELECOM_PRODUCT_6802 0x6802 ++#define WETELECOM_PRODUCT_WMD300 0x6803 ++ + struct option_blacklist_info { + /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */ + const unsigned long sendsetup; +@@ -2000,6 +2007,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 02711ffbb398..60964b7d7ffe 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2057,6 +2057,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group, + + /* Called at mount-time, super-block is locked */ + static int ext4_check_descriptors(struct super_block *sb, ++ ext4_fsblk_t sb_block, + ext4_group_t *first_not_zeroed) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); +@@ -2087,6 +2088,11 @@ static int ext4_check_descriptors(struct super_block *sb, + grp = i; + + block_bitmap = ext4_block_bitmap(sb, gdp); ++ if (block_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Block bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (block_bitmap < first_block || block_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Block bitmap for group %u not in group " +@@ -2094,6 +2100,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_bitmap = ext4_inode_bitmap(sb, gdp); ++ if (inode_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (inode_bitmap < first_block || inode_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode bitmap for group %u not in group " +@@ -2101,6 +2112,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_table = ext4_inode_table(sb, gdp); ++ if (inode_table == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode table for group %u overlaps " ++ "superblock", i); ++ } + if (inode_table < first_block || + inode_table + sbi->s_itb_per_group - 1 > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -3926,7 +3942,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount2; + } + } +- if (!ext4_check_descriptors(sb, &first_not_zeroed)) { ++ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { + ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); + goto failed_mount2; + } +diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c +index 4429d6d9217f..efb1f7b5883e 100644 +--- a/fs/kernfs/file.c ++++ b/fs/kernfs/file.c +@@ -828,21 +828,35 @@ repeat: + mutex_lock(&kernfs_mutex); + + list_for_each_entry(info, &kernfs_root(kn)->supers, node) { ++ struct kernfs_node *parent; + struct inode *inode; +- struct dentry *dentry; + ++ /* ++ * We want fsnotify_modify() on @kn but as the ++ * modifications aren't originating from userland don't ++ * have the matching @file available. Look up the inodes ++ * and generate the events manually. ++ */ + inode = ilookup(info->sb, kn->ino); + if (!inode) + continue; + +- dentry = d_find_any_alias(inode); +- if (dentry) { +- fsnotify_parent(NULL, dentry, FS_MODIFY); +- fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, +- NULL, 0); +- dput(dentry); ++ parent = kernfs_get_parent(kn); ++ if (parent) { ++ struct inode *p_inode; ++ ++ p_inode = ilookup(info->sb, parent->ino); ++ if (p_inode) { ++ fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD, ++ inode, FSNOTIFY_EVENT_INODE, kn->name, 0); ++ iput(p_inode); ++ } ++ ++ kernfs_put(parent); + } + ++ fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, ++ kn->name, 0); + iput(inode); + } + +diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c +index 351be9205bf8..3b8cdb8298c4 100644 +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -303,6 +303,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, struct n + err_socks: + svc_rpcb_cleanup(serv, net); + err_bind: ++ nn->cb_users[minorversion]--; + dprintk("NFS: Couldn't create callback socket: err = %d; " + "net = %p\n", ret, net); + return ret; +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 54d62bd95e92..4cb1c10c7706 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -48,6 +48,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) + } + + for (name = buf; name < (buf + list_size); name += strlen(name) + 1) { ++ if (ovl_is_private_xattr(name)) ++ continue; + retry: + size = vfs_getxattr(old, name, value, value_size); + if (size == -ERANGE) +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index fefce48e0f31..6d52041d13cf 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -208,8 +208,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz) + return realinode->i_op->readlink(realpath.dentry, buf, bufsiz); + } + +- +-static bool ovl_is_private_xattr(const char *name) ++bool ovl_is_private_xattr(const char *name) + { + return strncmp(name, "trusted.overlay.", 14) == 0; + } +@@ -264,7 +263,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + struct path realpath; + enum ovl_path_type type = ovl_path_real(dentry, &realpath); + ssize_t res; +- int off; ++ size_t len; ++ char *s; + + res = vfs_listxattr(realpath.dentry, list, size); + if (res <= 0 || size == 0) +@@ -274,17 +274,19 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + return res; + + /* filter out private xattrs */ +- for (off = 0; off < res;) { +- char *s = list + off; +- size_t slen = strlen(s) + 1; ++ for (s = list, len = res; len;) { ++ size_t slen = strnlen(s, len) + 1; + +- BUG_ON(off + slen > res); ++ /* underlying fs providing us with an broken xattr list? */ ++ if (WARN_ON(slen > len)) ++ return -EIO; + ++ len -= slen; + if (ovl_is_private_xattr(s)) { + res -= slen; +- memmove(s, s + slen, res - off); ++ memmove(s, s + slen, len); + } else { +- off += slen; ++ s += slen; + } + } + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 00eb848faad8..f13557f411ae 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -166,6 +166,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, const char *name, + ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size); + int ovl_removexattr(struct dentry *dentry, const char *name); + struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags); ++bool ovl_is_private_xattr(const char *name); + + struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, + struct ovl_entry *oe); +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index b2361a1b50f2..963dba388243 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -545,6 +545,10 @@ retry: + struct kstat stat = { + .mode = S_IFDIR | 0, + }; ++ struct iattr attr = { ++ .ia_valid = ATTR_MODE, ++ .ia_mode = stat.mode, ++ }; + + if (work->d_inode) { + err = -EEXIST; +@@ -560,6 +564,21 @@ retry: + err = ovl_create_real(dir, work, &stat, NULL, NULL, true); + if (err) + goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); ++ if (err && err != -ENODATA) ++ goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); ++ if (err && err != -ENODATA) ++ goto out_dput; ++ ++ /* Clear any inherited mode bits */ ++ mutex_lock(&work->d_inode->i_mutex); ++ err = notify_change(work, &attr, NULL); ++ mutex_unlock(&work->d_inode->i_mutex); ++ if (err) ++ goto out_dput; + } + out_unlock: + mutex_unlock(&dir->i_mutex); +diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c +index acfcdc625aca..0c95d77bd8e1 100644 +--- a/fs/xfs/libxfs/xfs_sb.c ++++ b/fs/xfs/libxfs/xfs_sb.c +@@ -606,7 +606,8 @@ xfs_sb_verify( + * Only check the in progress field for the primary superblock as + * mkfs.xfs doesn't clear it from secondary superblocks. + */ +- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR, ++ return xfs_mount_validate_sb(mp, &sb, ++ bp->b_maps[0].bm_bn == XFS_SB_DADDR, + check_version); + } + +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 71b52dd957de..56dc7c1b6300 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2045,6 +2045,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css) + mutex_unlock(&cpuset_mutex); + } + ++/* ++ * Make sure the new task conform to the current state of its parent, ++ * which could have been changed by cpuset just after it inherits the ++ * state from the parent and before it sits on the cgroup's task list. ++ */ ++void cpuset_fork(struct task_struct *task) ++{ ++ if (task_css_is_root(task, cpuset_cgrp_id)) ++ return; ++ ++ set_cpus_allowed_ptr(task, ¤t->cpus_allowed); ++ task->mems_allowed = current->mems_allowed; ++} ++ + struct cgroup_subsys cpuset_cgrp_subsys = { + .css_alloc = cpuset_css_alloc, + .css_online = cpuset_css_online, +@@ -2054,6 +2068,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = { + .cancel_attach = cpuset_cancel_attach, + .attach = cpuset_attach, + .bind = cpuset_bind, ++ .fork = cpuset_fork, + .legacy_cftypes = files, + .early_init = 1, + };
