commit: 81befa1208eed1da45b7a12153560ab1c0c184ce Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Jan 6 23:11:42 2017 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Jan 6 23:11:42 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=81befa12
Linux patch 4.8.15 0000_README | 4 + 1015_linux-4.8.16.patch | 3559 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3563 insertions(+) diff --git a/0000_README b/0000_README index 37d0ff1..e7fac7c 100644 --- a/0000_README +++ b/0000_README @@ -103,6 +103,10 @@ Patch: 1014_linux-4.8.15.patch From: http://www.kernel.org Desc: Linux 4.8.15 +Patch: 1015_linux-4.8.16.patch +From: http://www.kernel.org +Desc: Linux 4.8.16 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1015_linux-4.8.16.patch b/1015_linux-4.8.16.patch new file mode 100644 index 0000000..9977d7a --- /dev/null +++ b/1015_linux-4.8.16.patch @@ -0,0 +1,3559 @@ +diff --git a/Makefile b/Makefile +index c7f0e798ca34..50f68648a79a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 8 +-SUBLEVEL = 15 ++SUBLEVEL = 16 + EXTRAVERSION = + NAME = Psychotic Stoned Sheep + +diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c +index f193414d0f6f..4986dc0c1dff 100644 +--- a/arch/arm/xen/enlighten.c ++++ b/arch/arm/xen/enlighten.c +@@ -372,8 +372,7 @@ static int __init xen_guest_init(void) + * for secondary CPUs as they are brought up. + * For uniformity we use VCPUOP_register_vcpu_info even on cpu0. + */ +- xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info), +- sizeof(struct vcpu_info)); ++ xen_vcpu_info = alloc_percpu(struct vcpu_info); + if (xen_vcpu_info == NULL) + return -ENOMEM; + +diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h +index 5420cb0fcb3e..e517088d635f 100644 +--- a/arch/arm64/include/asm/acpi.h ++++ b/arch/arm64/include/asm/acpi.h +@@ -12,7 +12,7 @@ + #ifndef _ASM_ACPI_H + #define _ASM_ACPI_H + +-#include <linux/mm.h> ++#include <linux/memblock.h> + #include <linux/psci.h> + + #include <asm/cputype.h> +@@ -32,7 +32,11 @@ + static inline void __iomem *acpi_os_ioremap(acpi_physical_address phys, + acpi_size size) + { +- if (!page_is_ram(phys >> PAGE_SHIFT)) ++ /* ++ * EFI's reserve_regions() call adds memory with the WB attribute ++ * to memblock via early_init_dt_add_memory_arch(). ++ */ ++ if (!memblock_is_memory(phys)) + return ioremap(phys, size); + + return ioremap_cache(phys, size); +diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c +index 536dce22fe76..514b4e3ba029 100644 +--- a/arch/arm64/kernel/setup.c ++++ b/arch/arm64/kernel/setup.c +@@ -206,10 +206,15 @@ static void __init request_standard_resources(void) + + for_each_memblock(memory, region) { + res = alloc_bootmem_low(sizeof(*res)); +- res->name = "System RAM"; ++ if (memblock_is_nomap(region)) { ++ res->name = "reserved"; ++ res->flags = IORESOURCE_MEM | IORESOURCE_BUSY; ++ } else { ++ res->name = "System RAM"; ++ res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; ++ } + res->start = __pfn_to_phys(memblock_region_memory_base_pfn(region)); + res->end = __pfn_to_phys(memblock_region_memory_end_pfn(region)) - 1; +- res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; + + request_resource(&iomem_resource, res); + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index c207fa9870eb..494e0d800976 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1371,9 +1371,9 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + blk_mq_put_ctx(data.ctx); + if (!old_rq) + goto done; +- if (!blk_mq_direct_issue_request(old_rq, &cookie)) +- goto done; +- blk_mq_insert_request(old_rq, false, true, true); ++ if (test_bit(BLK_MQ_S_STOPPED, &data.hctx->state) || ++ blk_mq_direct_issue_request(old_rq, &cookie) != 0) ++ blk_mq_insert_request(old_rq, false, true, true); + goto done; + } + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 0a8bdade53f2..88df65d1e6f6 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -836,11 +836,29 @@ static struct kobject *get_device_parent(struct device *dev, + return NULL; + } + ++static inline bool live_in_glue_dir(struct kobject *kobj, ++ struct device *dev) ++{ ++ if (!kobj || !dev->class || ++ kobj->kset != &dev->class->p->glue_dirs) ++ return false; ++ return true; ++} ++ ++static inline struct kobject *get_glue_dir(struct device *dev) ++{ ++ return dev->kobj.parent; ++} ++ ++/* ++ * make sure cleaning up dir as the last step, we need to make ++ * sure .release handler of kobject is run with holding the ++ * global lock ++ */ + static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) + { + /* see if we live in a "glue" directory */ +- if (!glue_dir || !dev->class || +- glue_dir->kset != &dev->class->p->glue_dirs) ++ if (!live_in_glue_dir(glue_dir, dev)) + return; + + mutex_lock(&gdp_mutex); +@@ -848,11 +866,6 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) + mutex_unlock(&gdp_mutex); + } + +-static void cleanup_device_parent(struct device *dev) +-{ +- cleanup_glue_dir(dev, dev->kobj.parent); +-} +- + static int device_add_class_symlinks(struct device *dev) + { + struct device_node *of_node = dev_of_node(dev); +@@ -1028,6 +1041,7 @@ int device_add(struct device *dev) + struct kobject *kobj; + struct class_interface *class_intf; + int error = -EINVAL; ++ struct kobject *glue_dir = NULL; + + dev = get_device(dev); + if (!dev) +@@ -1072,8 +1086,10 @@ int device_add(struct device *dev) + /* first, register with generic layer. */ + /* we require the name to be set before, and pass NULL */ + error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); +- if (error) ++ if (error) { ++ glue_dir = get_glue_dir(dev); + goto Error; ++ } + + /* notify platform of device entry */ + if (platform_notify) +@@ -1154,9 +1170,10 @@ done: + device_remove_file(dev, &dev_attr_uevent); + attrError: + kobject_uevent(&dev->kobj, KOBJ_REMOVE); ++ glue_dir = get_glue_dir(dev); + kobject_del(&dev->kobj); + Error: +- cleanup_device_parent(dev); ++ cleanup_glue_dir(dev, glue_dir); + put_device(parent); + name_error: + kfree(dev->p); +@@ -1232,6 +1249,7 @@ EXPORT_SYMBOL_GPL(put_device); + void device_del(struct device *dev) + { + struct device *parent = dev->parent; ++ struct kobject *glue_dir = NULL; + struct class_interface *class_intf; + + /* Notify clients of device removal. This call must come +@@ -1276,8 +1294,9 @@ void device_del(struct device *dev) + blocking_notifier_call_chain(&dev->bus->p->bus_notifier, + BUS_NOTIFY_REMOVED_DEVICE, dev); + kobject_uevent(&dev->kobj, KOBJ_REMOVE); +- cleanup_device_parent(dev); ++ glue_dir = get_glue_dir(dev); + kobject_del(&dev->kobj); ++ cleanup_glue_dir(dev, glue_dir); + put_device(parent); + } + EXPORT_SYMBOL_GPL(device_del); +diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c +index df0c70963d9e..94b33ce96be7 100644 +--- a/drivers/base/power/opp/core.c ++++ b/drivers/base/power/opp/core.c +@@ -1320,7 +1320,7 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_put_prop_name); + * that this function is *NOT* called under RCU protection or in contexts where + * mutex cannot be locked. + */ +-int dev_pm_opp_set_regulator(struct device *dev, const char *name) ++struct opp_table *dev_pm_opp_set_regulator(struct device *dev, const char *name) + { + struct opp_table *opp_table; + struct regulator *reg; +@@ -1358,20 +1358,20 @@ int dev_pm_opp_set_regulator(struct device *dev, const char *name) + opp_table->regulator = reg; + + mutex_unlock(&opp_table_lock); +- return 0; ++ return opp_table; + + err: + _remove_opp_table(opp_table); + unlock: + mutex_unlock(&opp_table_lock); + +- return ret; ++ return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(dev_pm_opp_set_regulator); + + /** + * dev_pm_opp_put_regulator() - Releases resources blocked for regulator +- * @dev: Device for which regulator was set. ++ * @opp_table: OPP table returned from dev_pm_opp_set_regulator(). + * + * Locking: The internal opp_table and opp structures are RCU protected. + * Hence this function internally uses RCU updater strategy with mutex locks +@@ -1379,22 +1379,12 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_set_regulator); + * that this function is *NOT* called under RCU protection or in contexts where + * mutex cannot be locked. + */ +-void dev_pm_opp_put_regulator(struct device *dev) ++void dev_pm_opp_put_regulator(struct opp_table *opp_table) + { +- struct opp_table *opp_table; +- + mutex_lock(&opp_table_lock); + +- /* Check for existing table for 'dev' first */ +- opp_table = _find_opp_table(dev); +- if (IS_ERR(opp_table)) { +- dev_err(dev, "Failed to find opp_table: %ld\n", +- PTR_ERR(opp_table)); +- goto unlock; +- } +- + if (IS_ERR(opp_table->regulator)) { +- dev_err(dev, "%s: Doesn't have regulator set\n", __func__); ++ pr_err("%s: Doesn't have regulator set\n", __func__); + goto unlock; + } + +diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c +index ab19adb07a12..3c606c09fd5a 100644 +--- a/drivers/block/aoe/aoecmd.c ++++ b/drivers/block/aoe/aoecmd.c +@@ -853,45 +853,6 @@ rqbiocnt(struct request *r) + return n; + } + +-/* This can be removed if we are certain that no users of the block +- * layer will ever use zero-count pages in bios. Otherwise we have to +- * protect against the put_page sometimes done by the network layer. +- * +- * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for +- * discussion. +- * +- * We cannot use get_page in the workaround, because it insists on a +- * positive page count as a precondition. So we use _refcount directly. +- */ +-static void +-bio_pageinc(struct bio *bio) +-{ +- struct bio_vec bv; +- struct page *page; +- struct bvec_iter iter; +- +- bio_for_each_segment(bv, bio, iter) { +- /* Non-zero page count for non-head members of +- * compound pages is no longer allowed by the kernel. +- */ +- page = compound_head(bv.bv_page); +- page_ref_inc(page); +- } +-} +- +-static void +-bio_pagedec(struct bio *bio) +-{ +- struct page *page; +- struct bio_vec bv; +- struct bvec_iter iter; +- +- bio_for_each_segment(bv, bio, iter) { +- page = compound_head(bv.bv_page); +- page_ref_dec(page); +- } +-} +- + static void + bufinit(struct buf *buf, struct request *rq, struct bio *bio) + { +@@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request *rq, struct bio *bio) + buf->rq = rq; + buf->bio = bio; + buf->iter = bio->bi_iter; +- bio_pageinc(bio); + } + + static struct buf * +@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf *buf) + if (buf == d->ip.buf) + d->ip.buf = NULL; + rq = buf->rq; +- bio_pagedec(buf->bio); + mempool_free(buf, d->bufpool); + n = (unsigned long) rq->special; + rq->special = (void *) --n; +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index c9f2107f7095..b314a57e3c86 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1646,7 +1646,7 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx, + blk_mq_start_request(bd->rq); + + if (lo->lo_state != Lo_bound) +- return -EIO; ++ return BLK_MQ_RQ_QUEUE_ERROR; + + switch (req_op(cmd->rq)) { + case REQ_OP_FLUSH: +diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c +index 62028f483bba..a2ab00831df1 100644 +--- a/drivers/char/tpm/xen-tpmfront.c ++++ b/drivers/char/tpm/xen-tpmfront.c +@@ -307,7 +307,6 @@ static int tpmfront_probe(struct xenbus_device *dev, + rv = setup_ring(dev, priv); + if (rv) { + chip = dev_get_drvdata(&dev->dev); +- tpm_chip_unregister(chip); + ring_free(priv); + return rv; + } +diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c +index 8831e1a05367..11d8aa3ec186 100644 +--- a/drivers/clk/ti/clk-3xxx.c ++++ b/drivers/clk/ti/clk-3xxx.c +@@ -22,13 +22,6 @@ + + #include "clock.h" + +-/* +- * DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks +- * that are sourced by DPLL5, and both of these require this clock +- * to be at 120 MHz for proper operation. +- */ +-#define DPLL5_FREQ_FOR_USBHOST 120000000 +- + #define OMAP3430ES2_ST_DSS_IDLE_SHIFT 1 + #define OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT 5 + #define OMAP3430ES2_ST_SSI_IDLE_SHIFT 8 +@@ -546,14 +539,21 @@ void __init omap3_clk_lock_dpll5(void) + struct clk *dpll5_clk; + struct clk *dpll5_m2_clk; + ++ /* ++ * Errata sprz319f advisory 2.1 documents a USB host clock drift issue ++ * that can be worked around using specially crafted dpll5 settings ++ * with a dpll5_m2 divider set to 8. Set the dpll5 rate to 8x the USB ++ * host clock rate, its .set_rate handler() will detect that frequency ++ * and use the errata settings. ++ */ + dpll5_clk = clk_get(NULL, "dpll5_ck"); +- clk_set_rate(dpll5_clk, DPLL5_FREQ_FOR_USBHOST); ++ clk_set_rate(dpll5_clk, OMAP3_DPLL5_FREQ_FOR_USBHOST * 8); + clk_prepare_enable(dpll5_clk); + +- /* Program dpll5_m2_clk divider for no division */ ++ /* Program dpll5_m2_clk divider */ + dpll5_m2_clk = clk_get(NULL, "dpll5_m2_ck"); + clk_prepare_enable(dpll5_m2_clk); +- clk_set_rate(dpll5_m2_clk, DPLL5_FREQ_FOR_USBHOST); ++ clk_set_rate(dpll5_m2_clk, OMAP3_DPLL5_FREQ_FOR_USBHOST); + + clk_disable_unprepare(dpll5_m2_clk); + clk_disable_unprepare(dpll5_clk); +diff --git a/drivers/clk/ti/clock.h b/drivers/clk/ti/clock.h +index 90f3f472ae1c..13c37f48d9d6 100644 +--- a/drivers/clk/ti/clock.h ++++ b/drivers/clk/ti/clock.h +@@ -257,11 +257,20 @@ long omap2_dpll_round_rate(struct clk_hw *hw, unsigned long target_rate, + unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw, + unsigned long parent_rate); + ++/* ++ * OMAP3_DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks ++ * that are sourced by DPLL5, and both of these require this clock ++ * to be at 120 MHz for proper operation. ++ */ ++#define OMAP3_DPLL5_FREQ_FOR_USBHOST 120000000 ++ + unsigned long omap3_dpll_recalc(struct clk_hw *hw, unsigned long parent_rate); + int omap3_dpll4_set_rate(struct clk_hw *clk, unsigned long rate, + unsigned long parent_rate); + int omap3_dpll4_set_rate_and_parent(struct clk_hw *hw, unsigned long rate, + unsigned long parent_rate, u8 index); ++int omap3_dpll5_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate); + void omap3_clk_lock_dpll5(void); + + unsigned long omap4_dpll_regm4xen_recalc(struct clk_hw *hw, +diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c +index 9fc8754a6e61..4b9a419d8e14 100644 +--- a/drivers/clk/ti/dpll.c ++++ b/drivers/clk/ti/dpll.c +@@ -114,6 +114,18 @@ static const struct clk_ops omap3_dpll_ck_ops = { + .round_rate = &omap2_dpll_round_rate, + }; + ++static const struct clk_ops omap3_dpll5_ck_ops = { ++ .enable = &omap3_noncore_dpll_enable, ++ .disable = &omap3_noncore_dpll_disable, ++ .get_parent = &omap2_init_dpll_parent, ++ .recalc_rate = &omap3_dpll_recalc, ++ .set_rate = &omap3_dpll5_set_rate, ++ .set_parent = &omap3_noncore_dpll_set_parent, ++ .set_rate_and_parent = &omap3_noncore_dpll_set_rate_and_parent, ++ .determine_rate = &omap3_noncore_dpll_determine_rate, ++ .round_rate = &omap2_dpll_round_rate, ++}; ++ + static const struct clk_ops omap3_dpll_per_ck_ops = { + .enable = &omap3_noncore_dpll_enable, + .disable = &omap3_noncore_dpll_disable, +@@ -474,7 +486,12 @@ static void __init of_ti_omap3_dpll_setup(struct device_node *node) + .modes = (1 << DPLL_LOW_POWER_BYPASS) | (1 << DPLL_LOCKED), + }; + +- of_ti_dpll_setup(node, &omap3_dpll_ck_ops, &dd); ++ if ((of_machine_is_compatible("ti,omap3630") || ++ of_machine_is_compatible("ti,omap36xx")) && ++ !strcmp(node->name, "dpll5_ck")) ++ of_ti_dpll_setup(node, &omap3_dpll5_ck_ops, &dd); ++ else ++ of_ti_dpll_setup(node, &omap3_dpll_ck_ops, &dd); + } + CLK_OF_DECLARE(ti_omap3_dpll_clock, "ti,omap3-dpll-clock", + of_ti_omap3_dpll_setup); +diff --git a/drivers/clk/ti/dpll3xxx.c b/drivers/clk/ti/dpll3xxx.c +index 88f2ce81ba55..4cdd28a25584 100644 +--- a/drivers/clk/ti/dpll3xxx.c ++++ b/drivers/clk/ti/dpll3xxx.c +@@ -838,3 +838,70 @@ int omap3_dpll4_set_rate_and_parent(struct clk_hw *hw, unsigned long rate, + return omap3_noncore_dpll_set_rate_and_parent(hw, rate, parent_rate, + index); + } ++ ++/* Apply DM3730 errata sprz319 advisory 2.1. */ ++static bool omap3_dpll5_apply_errata(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct omap3_dpll5_settings { ++ unsigned int rate, m, n; ++ }; ++ ++ static const struct omap3_dpll5_settings precomputed[] = { ++ /* ++ * From DM3730 errata advisory 2.1, table 35 and 36. ++ * The N value is increased by 1 compared to the tables as the ++ * errata lists register values while last_rounded_field is the ++ * real divider value. ++ */ ++ { 12000000, 80, 0 + 1 }, ++ { 13000000, 443, 5 + 1 }, ++ { 19200000, 50, 0 + 1 }, ++ { 26000000, 443, 11 + 1 }, ++ { 38400000, 25, 0 + 1 } ++ }; ++ ++ const struct omap3_dpll5_settings *d; ++ struct clk_hw_omap *clk = to_clk_hw_omap(hw); ++ struct dpll_data *dd; ++ unsigned int i; ++ ++ for (i = 0; i < ARRAY_SIZE(precomputed); ++i) { ++ if (parent_rate == precomputed[i].rate) ++ break; ++ } ++ ++ if (i == ARRAY_SIZE(precomputed)) ++ return false; ++ ++ d = &precomputed[i]; ++ ++ /* Update the M, N and rounded rate values and program the DPLL. */ ++ dd = clk->dpll_data; ++ dd->last_rounded_m = d->m; ++ dd->last_rounded_n = d->n; ++ dd->last_rounded_rate = div_u64((u64)parent_rate * d->m, d->n); ++ omap3_noncore_dpll_program(clk, 0); ++ ++ return true; ++} ++ ++/** ++ * omap3_dpll5_set_rate - set rate for omap3 dpll5 ++ * @hw: clock to change ++ * @rate: target rate for clock ++ * @parent_rate: rate of the parent clock ++ * ++ * Set rate for the DPLL5 clock. Apply the sprz319 advisory 2.1 on OMAP36xx if ++ * the DPLL is used for USB host (detected through the requested rate). ++ */ ++int omap3_dpll5_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ if (rate == OMAP3_DPLL5_FREQ_FOR_USBHOST * 8) { ++ if (omap3_dpll5_apply_errata(hw, parent_rate)) ++ return 0; ++ } ++ ++ return omap3_noncore_dpll_set_rate(hw, rate, parent_rate); ++} +diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c +index 3957de801ae8..204cd527ff34 100644 +--- a/drivers/cpufreq/cpufreq-dt.c ++++ b/drivers/cpufreq/cpufreq-dt.c +@@ -26,6 +26,7 @@ + #include <linux/thermal.h> + + struct private_data { ++ struct opp_table *opp_table; + struct device *cpu_dev; + struct thermal_cooling_device *cdev; + const char *reg_name; +@@ -141,6 +142,7 @@ static int resources_available(void) + static int cpufreq_init(struct cpufreq_policy *policy) + { + struct cpufreq_frequency_table *freq_table; ++ struct opp_table *opp_table = NULL; + struct private_data *priv; + struct device *cpu_dev; + struct clk *cpu_clk; +@@ -184,8 +186,9 @@ static int cpufreq_init(struct cpufreq_policy *policy) + */ + name = find_supply_name(cpu_dev); + if (name) { +- ret = dev_pm_opp_set_regulator(cpu_dev, name); +- if (ret) { ++ opp_table = dev_pm_opp_set_regulator(cpu_dev, name); ++ if (IS_ERR(opp_table)) { ++ ret = PTR_ERR(opp_table); + dev_err(cpu_dev, "Failed to set regulator for cpu%d: %d\n", + policy->cpu, ret); + goto out_put_clk; +@@ -235,6 +238,7 @@ static int cpufreq_init(struct cpufreq_policy *policy) + } + + priv->reg_name = name; ++ priv->opp_table = opp_table; + + ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table); + if (ret) { +@@ -283,7 +287,7 @@ out_free_priv: + out_free_opp: + dev_pm_opp_of_cpumask_remove_table(policy->cpus); + if (name) +- dev_pm_opp_put_regulator(cpu_dev); ++ dev_pm_opp_put_regulator(opp_table); + out_put_clk: + clk_put(cpu_clk); + +@@ -298,7 +302,7 @@ static int cpufreq_exit(struct cpufreq_policy *policy) + dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table); + dev_pm_opp_of_cpumask_remove_table(policy->related_cpus); + if (priv->reg_name) +- dev_pm_opp_put_regulator(priv->cpu_dev); ++ dev_pm_opp_put_regulator(priv->opp_table); + + clk_put(policy->clk); + kfree(priv); +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 2cde3796cb82..f3307fc38e79 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -702,7 +702,9 @@ copy_iv: + + /* Will read cryptlen */ + append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ); +- aead_append_src_dst(desc, FIFOLD_TYPE_MSG1OUT2); ++ append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF | ++ FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH); ++ append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF); + + /* Write ICV */ + append_seq_store(desc, ctx->authsize, LDST_CLASS_2_CCB | +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 6fc8923bd92a..bd56a3ecb29c 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1503,12 +1503,15 @@ static int crypt_set_key(struct crypt_config *cc, char *key) + if (!cc->key_size && strcmp(key, "-")) + goto out; + ++ /* clear the flag since following operations may invalidate previously valid key */ ++ clear_bit(DM_CRYPT_KEY_VALID, &cc->flags); ++ + if (cc->key_size && crypt_decode_key(cc->key, key, cc->key_size) < 0) + goto out; + +- set_bit(DM_CRYPT_KEY_VALID, &cc->flags); +- + r = crypt_setkey_allcpus(cc); ++ if (!r) ++ set_bit(DM_CRYPT_KEY_VALID, &cc->flags); + + out: + /* Hex key string not needed after here, so wipe it. */ +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 6a2e8dd44a1b..3643cba71351 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -200,11 +200,13 @@ static int flakey_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!(fc->up_interval + fc->down_interval)) { + ti->error = "Total (up + down) interval is zero"; ++ r = -EINVAL; + goto bad; + } + + if (fc->up_interval + fc->down_interval < fc->up_interval) { + ti->error = "Interval overflow"; ++ r = -EINVAL; + goto bad; + } + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 6d53810963f7..af2d79b52484 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -2994,6 +2994,9 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + } + } + ++ /* Disable/enable discard support on raid set. */ ++ configure_discard_support(rs); ++ + mddev_unlock(&rs->md); + return 0; + +@@ -3580,12 +3583,6 @@ static int raid_preresume(struct dm_target *ti) + if (test_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags)) + rs_update_sbs(rs); + +- /* +- * Disable/enable discard support on raid set after any +- * conversion, because devices can have been added +- */ +- configure_discard_support(rs); +- + /* Load the bitmap from disk unless raid0 */ + r = __load_dirty_region_bitmap(rs); + if (r) +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 2154596eedf3..b6af2860cbc6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -218,6 +218,9 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig) + */ + static void rq_completed(struct mapped_device *md, int rw, bool run_queue) + { ++ struct request_queue *q = md->queue; ++ unsigned long flags; ++ + atomic_dec(&md->pending[rw]); + + /* nudge anyone waiting on suspend queue */ +@@ -230,8 +233,11 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue) + * back into ->request_fn() could deadlock attempting to grab the + * queue lock again. + */ +- if (!md->queue->mq_ops && run_queue) +- blk_run_queue_async(md->queue); ++ if (!q->mq_ops && run_queue) { ++ spin_lock_irqsave(q->queue_lock, flags); ++ blk_run_queue_async(q); ++ spin_unlock_irqrestore(q->queue_lock, flags); ++ } + + /* + * dm_put() must be at the end of this function. See the comment above +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index c4b53b332607..5ac239d0f787 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -924,12 +924,6 @@ static int dm_table_determine_type(struct dm_table *t) + + BUG_ON(!request_based); /* No targets in this table */ + +- if (list_empty(devices) && __table_type_request_based(live_md_type)) { +- /* inherit live MD type */ +- t->type = live_md_type; +- return 0; +- } +- + /* + * The only way to establish DM_TYPE_MQ_REQUEST_BASED is by + * having a compatible target use dm_table_set_type. +@@ -948,6 +942,19 @@ verify_rq_based: + return -EINVAL; + } + ++ if (list_empty(devices)) { ++ int srcu_idx; ++ struct dm_table *live_table = dm_get_live_table(t->md, &srcu_idx); ++ ++ /* inherit live table's type and all_blk_mq */ ++ if (live_table) { ++ t->type = live_table->type; ++ t->all_blk_mq = live_table->all_blk_mq; ++ } ++ dm_put_live_table(t->md, srcu_idx); ++ return 0; ++ } ++ + /* Non-request-stackable devices can't be used for request-based dm */ + list_for_each_entry(dd, devices, list) { + struct request_queue *q = bdev_get_queue(dd->dm_dev->bdev); +@@ -974,6 +981,11 @@ verify_rq_based: + t->all_blk_mq = true; + } + ++ if (t->type == DM_TYPE_MQ_REQUEST_BASED && !t->all_blk_mq) { ++ DMERR("table load rejected: all devices are not blk-mq request-stackable"); ++ return -EINVAL; ++ } ++ + return 0; + } + +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index 7e44005595c1..20557e2c60c6 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -775,17 +775,15 @@ int dm_sm_metadata_create(struct dm_space_map *sm, + memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm)); + + r = sm_ll_new_metadata(&smm->ll, tm); ++ if (!r) { ++ if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS) ++ nr_blocks = DM_SM_METADATA_MAX_BLOCKS; ++ r = sm_ll_extend(&smm->ll, nr_blocks); ++ } ++ memcpy(&smm->sm, &ops, sizeof(smm->sm)); + if (r) + return r; + +- if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS) +- nr_blocks = DM_SM_METADATA_MAX_BLOCKS; +- r = sm_ll_extend(&smm->ll, nr_blocks); +- if (r) +- return r; +- +- memcpy(&smm->sm, &ops, sizeof(smm->sm)); +- + /* + * Now we need to update the newly created data structures with the + * allocated blocks that they were built from. +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index af5e2dc4a3d5..011f88e5663e 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -271,7 +271,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item, + + mutex_lock(&subsys->lock); + ret = -EBUSY; +- if (nvmet_ns_enabled(ns)) ++ if (ns->enabled) + goto out_unlock; + + kfree(ns->device_path); +@@ -307,7 +307,7 @@ static ssize_t nvmet_ns_device_nguid_store(struct config_item *item, + int ret = 0; + + mutex_lock(&subsys->lock); +- if (nvmet_ns_enabled(ns)) { ++ if (ns->enabled) { + ret = -EBUSY; + goto out_unlock; + } +@@ -339,7 +339,7 @@ CONFIGFS_ATTR(nvmet_ns_, device_nguid); + + static ssize_t nvmet_ns_enable_show(struct config_item *item, char *page) + { +- return sprintf(page, "%d\n", nvmet_ns_enabled(to_nvmet_ns(item))); ++ return sprintf(page, "%d\n", to_nvmet_ns(item)->enabled); + } + + static ssize_t nvmet_ns_enable_store(struct config_item *item, +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 6559d5afa7bf..e9500d41b943 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -264,7 +264,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns) + int ret = 0; + + mutex_lock(&subsys->lock); +- if (!list_empty(&ns->dev_link)) ++ if (ns->enabled) + goto out_unlock; + + ns->bdev = blkdev_get_by_path(ns->device_path, FMODE_READ | FMODE_WRITE, +@@ -309,6 +309,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns) + list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry) + nvmet_add_async_event(ctrl, NVME_AER_TYPE_NOTICE, 0, 0); + ++ ns->enabled = true; + ret = 0; + out_unlock: + mutex_unlock(&subsys->lock); +@@ -325,11 +326,11 @@ void nvmet_ns_disable(struct nvmet_ns *ns) + struct nvmet_ctrl *ctrl; + + mutex_lock(&subsys->lock); +- if (list_empty(&ns->dev_link)) { +- mutex_unlock(&subsys->lock); +- return; +- } +- list_del_init(&ns->dev_link); ++ if (!ns->enabled) ++ goto out_unlock; ++ ++ ns->enabled = false; ++ list_del_rcu(&ns->dev_link); + mutex_unlock(&subsys->lock); + + /* +@@ -351,6 +352,7 @@ void nvmet_ns_disable(struct nvmet_ns *ns) + + if (ns->bdev) + blkdev_put(ns->bdev, FMODE_WRITE|FMODE_READ); ++out_unlock: + mutex_unlock(&subsys->lock); + } + +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index 76b6eedccaf9..7655a351320f 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -47,6 +47,7 @@ struct nvmet_ns { + loff_t size; + u8 nguid[16]; + ++ bool enabled; + struct nvmet_subsys *subsys; + const char *device_path; + +@@ -61,11 +62,6 @@ static inline struct nvmet_ns *to_nvmet_ns(struct config_item *item) + return container_of(to_config_group(item), struct nvmet_ns, group); + } + +-static inline bool nvmet_ns_enabled(struct nvmet_ns *ns) +-{ +- return !list_empty_careful(&ns->dev_link); +-} +- + struct nvmet_cq { + u16 qid; + u16 size; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 3ca9fdb0a271..3f9ac8be77e1 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1732,6 +1732,7 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ + .driver_info = QUIRK_CONTROL_LINE_STATE, }, + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ ++ { USB_DEVICE(0x2184, 0x0036) }, /* GW Instek AFG-125 */ + { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ + }, + /* Motorola H24 HSPA module: */ +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 1d5fc32d06d0..f3a7408d6417 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem); + + static void hub_release(struct kref *kref); + static int usb_reset_and_verify_device(struct usb_device *udev); ++static void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev); + + static inline char *portspeed(struct usb_hub *hub, int portstatus) + { +@@ -899,82 +901,28 @@ static int hub_set_port_link_state(struct usb_hub *hub, int port1, + } + + /* +- * If USB 3.0 ports are placed into the Disabled state, they will no longer +- * detect any device connects or disconnects. This is generally not what the +- * USB core wants, since it expects a disabled port to produce a port status +- * change event when a new device connects. +- * +- * Instead, set the link state to Disabled, wait for the link to settle into +- * that state, clear any change bits, and then put the port into the RxDetect +- * state. ++ * USB-3 does not have a similar link state as USB-2 that will avoid negotiating ++ * a connection with a plugged-in cable but will signal the host when the cable ++ * is unplugged. Disable remote wake and set link state to U3 for USB-3 devices + */ +-static int hub_usb3_port_disable(struct usb_hub *hub, int port1) +-{ +- int ret; +- int total_time; +- u16 portchange, portstatus; +- +- if (!hub_is_superspeed(hub->hdev)) +- return -EINVAL; +- +- ret = hub_port_status(hub, port1, &portstatus, &portchange); +- if (ret < 0) +- return ret; +- +- /* +- * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI +- * Controller [1022:7814] will have spurious result making the following +- * usb 3.0 device hotplugging route to the 2.0 root hub and recognized +- * as high-speed device if we set the usb 3.0 port link state to +- * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we +- * check the state here to avoid the bug. +- */ +- if ((portstatus & USB_PORT_STAT_LINK_STATE) == +- USB_SS_PORT_LS_RX_DETECT) { +- dev_dbg(&hub->ports[port1 - 1]->dev, +- "Not disabling port; link state is RxDetect\n"); +- return ret; +- } +- +- ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED); +- if (ret) +- return ret; +- +- /* Wait for the link to enter the disabled state. */ +- for (total_time = 0; ; total_time += HUB_DEBOUNCE_STEP) { +- ret = hub_port_status(hub, port1, &portstatus, &portchange); +- if (ret < 0) +- return ret; +- +- if ((portstatus & USB_PORT_STAT_LINK_STATE) == +- USB_SS_PORT_LS_SS_DISABLED) +- break; +- if (total_time >= HUB_DEBOUNCE_TIMEOUT) +- break; +- msleep(HUB_DEBOUNCE_STEP); +- } +- if (total_time >= HUB_DEBOUNCE_TIMEOUT) +- dev_warn(&hub->ports[port1 - 1]->dev, +- "Could not disable after %d ms\n", total_time); +- +- return hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_RX_DETECT); +-} +- + static int hub_port_disable(struct usb_hub *hub, int port1, int set_state) + { + struct usb_port *port_dev = hub->ports[port1 - 1]; + struct usb_device *hdev = hub->hdev; + int ret = 0; + +- if (port_dev->child && set_state) +- usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED); + if (!hub->error) { +- if (hub_is_superspeed(hub->hdev)) +- ret = hub_usb3_port_disable(hub, port1); +- else ++ if (hub_is_superspeed(hub->hdev)) { ++ hub_usb3_port_prepare_disable(hub, port_dev); ++ ret = hub_set_port_link_state(hub, port_dev->portnum, ++ USB_SS_PORT_LS_U3); ++ } else { + ret = usb_clear_port_feature(hdev, port1, + USB_PORT_FEAT_ENABLE); ++ } + } ++ if (port_dev->child && set_state) ++ usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED); + if (ret && ret != -ENODEV) + dev_err(&port_dev->dev, "cannot disable (err = %d)\n", ret); + return ret; +@@ -4142,6 +4090,26 @@ void usb_unlocked_enable_lpm(struct usb_device *udev) + } + EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm); + ++/* usb3 devices use U3 for disabled, make sure remote wakeup is disabled */ ++static void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev) ++{ ++ struct usb_device *udev = port_dev->child; ++ int ret; ++ ++ if (udev && udev->port_is_suspended && udev->do_remote_wakeup) { ++ ret = hub_set_port_link_state(hub, port_dev->portnum, ++ USB_SS_PORT_LS_U0); ++ if (!ret) { ++ msleep(USB_RESUME_TIMEOUT); ++ ret = usb_disable_remote_wakeup(udev); ++ } ++ if (ret) ++ dev_warn(&udev->dev, ++ "Port disable: can't disable remote wake\n"); ++ udev->do_remote_wakeup = 0; ++ } ++} + + #else /* CONFIG_PM */ + +@@ -4149,6 +4117,9 @@ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm); + #define hub_resume NULL + #define hub_reset_resume NULL + ++static inline void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev) { } ++ + int usb_disable_lpm(struct usb_device *udev) + { + return 0; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index dc3b5962d087..717d5f6d3e7c 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -775,6 +775,9 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, + unsigned length, unsigned last, unsigned chain, unsigned node) + { + struct dwc3_trb *trb; ++ struct dwc3 *dwc = dep->dwc; ++ struct usb_gadget *gadget = &dwc->gadget; ++ enum usb_device_speed speed = gadget->speed; + + dwc3_trace(trace_dwc3_gadget, "%s: req %p dma %08llx length %d%s%s", + dep->name, req, (unsigned long long) dma, +@@ -804,10 +807,16 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, + break; + + case USB_ENDPOINT_XFER_ISOC: +- if (!node) ++ if (!node) { + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS_FIRST; +- else ++ ++ if (speed == USB_SPEED_HIGH) { ++ struct usb_ep *ep = &dep->endpoint; ++ trb->size |= DWC3_TRB_SIZE_PCM1(ep->mult - 1); ++ } ++ } else { + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; ++ } + + /* always enable Interrupt on Missed ISOC */ + trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 5ebe6af7976e..e2abaa7943d9 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -197,11 +197,16 @@ int config_ep_by_speed(struct usb_gadget *g, + + ep_found: + /* commit results */ +- _ep->maxpacket = usb_endpoint_maxp(chosen_desc); ++ _ep->maxpacket = usb_endpoint_maxp(chosen_desc) & 0x7ff; + _ep->desc = chosen_desc; + _ep->comp_desc = NULL; + _ep->maxburst = 0; +- _ep->mult = 0; ++ _ep->mult = 1; ++ ++ if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) || ++ usb_endpoint_xfer_int(_ep->desc))) ++ _ep->mult = usb_endpoint_maxp(_ep->desc) & 0x7ff; ++ + if (!want_comp_desc) + return 0; + +@@ -218,7 +223,7 @@ ep_found: + switch (usb_endpoint_type(_ep->desc)) { + case USB_ENDPOINT_XFER_ISOC: + /* mult: bits 1:0 of bmAttributes */ +- _ep->mult = comp_desc->bmAttributes & 0x3; ++ _ep->mult = (comp_desc->bmAttributes & 0x3) + 1; + case USB_ENDPOINT_XFER_BULK: + case USB_ENDPOINT_XFER_INT: + _ep->maxburst = comp_desc->bMaxBurst + 1; +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index cd214ec8a601..969cfe741380 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -1067,13 +1067,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc); + if (!agdev->out_ep) { + dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); +- goto err; ++ return ret; + } + + agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc); + if (!agdev->in_ep) { + dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); +- goto err; ++ return ret; + } + + uac2->p_prm.uac2 = uac2; +@@ -1091,7 +1091,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL, + NULL); + if (ret) +- goto err; ++ return ret; + + prm = &agdev->uac2.c_prm; + prm->max_psize = hs_epout_desc.wMaxPacketSize; +@@ -1106,19 +1106,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL); + if (!prm->rbuf) { + prm->max_psize = 0; +- goto err_free_descs; ++ goto err; + } + + ret = alsa_uac2_init(agdev); + if (ret) +- goto err_free_descs; ++ goto err; + return 0; + +-err_free_descs: +- usb_free_all_descriptors(fn); + err: + kfree(agdev->uac2.p_prm.rbuf); + kfree(agdev->uac2.c_prm.rbuf); ++err_free_descs: ++ usb_free_all_descriptors(fn); + return -EINVAL; + } + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 3d0d5d94a62f..0f01c04d7cbd 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -243,7 +243,7 @@ uvc_video_alloc_requests(struct uvc_video *video) + + req_size = video->ep->maxpacket + * max_t(unsigned int, video->ep->maxburst, 1) +- * (video->ep->mult + 1); ++ * (video->ep->mult); + + for (i = 0; i < UVC_NUM_REQUESTS; ++i) { + video->req_buffer[i] = kmalloc(req_size, GFP_KERNEL); +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 940304c33224..02260cfdedb1 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -129,6 +129,10 @@ static int uhci_pci_init(struct usb_hcd *hcd) + if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_HP) + uhci->wait_for_hp = 1; + ++ /* Intel controllers use non-PME wakeup signalling */ ++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_INTEL) ++ device_set_run_wake(uhci_dev(uhci), 1); ++ + /* Set up pointers to PCI-specific functions */ + uhci->reset_hc = uhci_pci_reset_hc; + uhci->check_and_reset_hc = uhci_pci_check_and_reset_hc; +diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c +index fc5d3a791e08..6f29bfadbe33 100644 +--- a/drivers/usb/serial/kl5kusb105.c ++++ b/drivers/usb/serial/kl5kusb105.c +@@ -296,7 +296,7 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) + rc = usb_serial_generic_open(tty, port); + if (rc) { + retval = rc; +- goto exit; ++ goto err_free_cfg; + } + + rc = usb_control_msg(port->serial->dev, +@@ -315,17 +315,32 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) + dev_dbg(&port->dev, "%s - enabled reading\n", __func__); + + rc = klsi_105_get_line_state(port, &line_state); +- if (rc >= 0) { +- spin_lock_irqsave(&priv->lock, flags); +- priv->line_state = line_state; +- spin_unlock_irqrestore(&priv->lock, flags); +- dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__, line_state); +- retval = 0; +- } else ++ if (rc < 0) { + retval = rc; ++ goto err_disable_read; ++ } ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ priv->line_state = line_state; ++ spin_unlock_irqrestore(&priv->lock, flags); ++ dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__, ++ line_state); ++ ++ return 0; + +-exit: ++err_disable_read: ++ usb_control_msg(port->serial->dev, ++ usb_sndctrlpipe(port->serial->dev, 0), ++ KL5KUSB105A_SIO_CONFIGURE, ++ USB_TYPE_VENDOR | USB_DIR_OUT, ++ KL5KUSB105A_SIO_CONFIGURE_READ_OFF, ++ 0, /* index */ ++ NULL, 0, ++ KLSI_TIMEOUT); ++ usb_serial_generic_close(port); ++err_free_cfg: + kfree(cfg); ++ + return retval; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 9894e341c6ac..7ce31a4c7e7f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -268,6 +268,8 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_CC864_SINGLE 0x1006 + #define TELIT_PRODUCT_DE910_DUAL 0x1010 + #define TELIT_PRODUCT_UE910_V2 0x1012 ++#define TELIT_PRODUCT_LE922_USBCFG1 0x1040 ++#define TELIT_PRODUCT_LE922_USBCFG2 0x1041 + #define TELIT_PRODUCT_LE922_USBCFG0 0x1042 + #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 + #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 +@@ -1210,6 +1212,10 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), ++ .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), +@@ -1989,6 +1995,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ +diff --git a/drivers/usb/usbip/vudc_transfer.c b/drivers/usb/usbip/vudc_transfer.c +index aba6bd478045..bc0296d937d0 100644 +--- a/drivers/usb/usbip/vudc_transfer.c ++++ b/drivers/usb/usbip/vudc_transfer.c +@@ -339,6 +339,8 @@ static void v_timer(unsigned long _vudc) + total = timer->frame_limit; + } + ++ /* We have to clear ep0 flags separately as it's not on the list */ ++ udc->ep[0].already_seen = 0; + list_for_each_entry(_ep, &udc->gadget.ep_list, ep_list) { + ep = to_vep(_ep); + ep->already_seen = 0; +diff --git a/drivers/watchdog/mei_wdt.c b/drivers/watchdog/mei_wdt.c +index 630bd189f167..2a9d5cdedea2 100644 +--- a/drivers/watchdog/mei_wdt.c ++++ b/drivers/watchdog/mei_wdt.c +@@ -389,6 +389,8 @@ static int mei_wdt_register(struct mei_wdt *wdt) + wdt->wdd.max_timeout = MEI_WDT_MAX_TIMEOUT; + + watchdog_set_drvdata(&wdt->wdd, wdt); ++ watchdog_stop_on_reboot(&wdt->wdd); ++ + ret = watchdog_register_device(&wdt->wdd); + if (ret) { + dev_err(dev, "unable to register watchdog device = %d.\n", ret); +diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c +index 5796b5d1b3f2..4f47b5e90956 100644 +--- a/drivers/watchdog/qcom-wdt.c ++++ b/drivers/watchdog/qcom-wdt.c +@@ -209,7 +209,7 @@ static int qcom_wdt_probe(struct platform_device *pdev) + wdt->wdd.parent = &pdev->dev; + wdt->layout = regs; + +- if (readl(wdt->base + WDT_STS) & 1) ++ if (readl(wdt_addr(wdt, WDT_STS)) & 1) + wdt->wdd.bootstatus = WDIOF_CARDRESET; + + /* +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index bb952121ea94..2ef2b61b69df 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -1007,7 +1007,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + + vma->vm_ops = &gntdev_vmops; + +- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO; ++ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_MIXEDMAP; + + if (use_ptemod) + vma->vm_flags |= VM_DONTCOPY; +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 08ae99343d92..b010242bab32 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -837,7 +837,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, + return true; /* already a holder */ + else if (bdev->bd_holder != NULL) + return false; /* held by someone else */ +- else if (bdev->bd_contains == bdev) ++ else if (whole == bdev) + return true; /* is a whole device which isn't held */ + + else if (whole->bd_holder == bd_may_claim) +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index e0f071f6b5a7..63d197724519 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -86,6 +86,20 @@ btrfs_work_owner(struct btrfs_work *work) + return work->wq->fs_info; + } + ++bool btrfs_workqueue_normal_congested(struct btrfs_workqueue *wq) ++{ ++ /* ++ * We could compare wq->normal->pending with num_online_cpus() ++ * to support "thresh == NO_THRESHOLD" case, but it requires ++ * moving up atomic_inc/dec in thresh_queue/exec_hook. Let's ++ * postpone it until someone needs the support of that case. ++ */ ++ if (wq->normal->thresh == NO_THRESHOLD) ++ return false; ++ ++ return atomic_read(&wq->normal->pending) > wq->normal->thresh * 2; ++} ++ + BTRFS_WORK_HELPER(worker_helper); + BTRFS_WORK_HELPER(delalloc_helper); + BTRFS_WORK_HELPER(flush_delalloc_helper); +diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h +index 8e52484cd461..1f9597355c9d 100644 +--- a/fs/btrfs/async-thread.h ++++ b/fs/btrfs/async-thread.h +@@ -84,4 +84,5 @@ void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max); + void btrfs_set_work_high_priority(struct btrfs_work *work); + struct btrfs_fs_info *btrfs_work_owner(struct btrfs_work *work); + struct btrfs_fs_info *btrfs_workqueue_owner(struct __btrfs_workqueue *wq); ++bool btrfs_workqueue_normal_congested(struct btrfs_workqueue *wq); + #endif +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 791e47ce9d27..469fa3268d9b 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2210,6 +2210,8 @@ btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu, + cpu->target = le64_to_cpu(disk->target); + cpu->flags = le64_to_cpu(disk->flags); + cpu->limit = le64_to_cpu(disk->limit); ++ cpu->stripes_min = le32_to_cpu(disk->stripes_min); ++ cpu->stripes_max = le32_to_cpu(disk->stripes_max); + } + + static inline void +@@ -2228,6 +2230,8 @@ btrfs_cpu_balance_args_to_disk(struct btrfs_disk_balance_args *disk, + disk->target = cpu_to_le64(cpu->target); + disk->flags = cpu_to_le64(cpu->flags); + disk->limit = cpu_to_le64(cpu->limit); ++ disk->stripes_min = cpu_to_le32(cpu->stripes_min); ++ disk->stripes_max = cpu_to_le32(cpu->stripes_max); + } + + /* struct btrfs_super_block */ +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 3eeb9cd8cfa5..de946dd743b7 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1356,7 +1356,8 @@ release_path: + total_done++; + + btrfs_release_prepared_delayed_node(delayed_node); +- if (async_work->nr == 0 || total_done < async_work->nr) ++ if ((async_work->nr == 0 && total_done < BTRFS_DELAYED_WRITEBACK) || ++ total_done < async_work->nr) + goto again; + + free_path: +@@ -1372,7 +1373,8 @@ static int btrfs_wq_run_delayed_node(struct btrfs_delayed_root *delayed_root, + { + struct btrfs_async_delayed_work *async_work; + +- if (atomic_read(&delayed_root->items) < BTRFS_DELAYED_BACKGROUND) ++ if (atomic_read(&delayed_root->items) < BTRFS_DELAYED_BACKGROUND || ++ btrfs_workqueue_normal_congested(fs_info->delayed_workers)) + return 0; + + async_work = kmalloc(sizeof(*async_work), GFP_NOFS); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 3dede6d53bad..dafcfd017d37 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -559,7 +559,15 @@ static noinline int check_leaf(struct btrfs_root *root, + u32 nritems = btrfs_header_nritems(leaf); + int slot; + +- if (nritems == 0) { ++ /* ++ * Extent buffers from a relocation tree have a owner field that ++ * corresponds to the subvolume tree they are based on. So just from an ++ * extent buffer alone we can not find out what is the id of the ++ * corresponding subvolume tree, so we can not figure out if the extent ++ * buffer corresponds to the root of the relocation tree or not. So skip ++ * this check for relocation trees. ++ */ ++ if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { + struct btrfs_root *check_root; + + key.objectid = btrfs_header_owner(leaf); +@@ -572,17 +580,24 @@ static noinline int check_leaf(struct btrfs_root *root, + * open_ctree() some roots has not yet been set up. + */ + if (!IS_ERR_OR_NULL(check_root)) { ++ struct extent_buffer *eb; ++ ++ eb = btrfs_root_node(check_root); + /* if leaf is the root, then it's fine */ +- if (leaf->start != +- btrfs_root_bytenr(&check_root->root_item)) { ++ if (leaf != eb) { + CORRUPT("non-root leaf's nritems is 0", +- leaf, root, 0); ++ leaf, check_root, 0); ++ free_extent_buffer(eb); + return -EIO; + } ++ free_extent_buffer(eb); + } + return 0; + } + ++ if (nritems == 0) ++ return 0; ++ + /* Check the 0 item */ + if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) != + BTRFS_LEAF_DATA_SIZE(root)) { +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 665da8f66ff1..a1b40ab5770a 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -8884,14 +8884,13 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, + ret = btrfs_lookup_extent_info(trans, root, bytenr, level - 1, 1, + &wc->refs[level - 1], + &wc->flags[level - 1]); +- if (ret < 0) { +- btrfs_tree_unlock(next); +- return ret; +- } ++ if (ret < 0) ++ goto out_unlock; + + if (unlikely(wc->refs[level - 1] == 0)) { + btrfs_err(root->fs_info, "Missing references."); +- BUG(); ++ ret = -EIO; ++ goto out_unlock; + } + *lookup_info = 0; + +@@ -8943,7 +8942,12 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, + } + + level--; +- BUG_ON(level != btrfs_header_level(next)); ++ ASSERT(level == btrfs_header_level(next)); ++ if (level != btrfs_header_level(next)) { ++ btrfs_err(root->fs_info, "mismatched level"); ++ ret = -EIO; ++ goto out_unlock; ++ } + path->nodes[level] = next; + path->slots[level] = 0; + path->locks[level] = BTRFS_WRITE_LOCK_BLOCKING; +@@ -8958,8 +8962,15 @@ skip: + if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) { + parent = path->nodes[level]->start; + } else { +- BUG_ON(root->root_key.objectid != ++ ASSERT(root->root_key.objectid == + btrfs_header_owner(path->nodes[level])); ++ if (root->root_key.objectid != ++ btrfs_header_owner(path->nodes[level])) { ++ btrfs_err(root->fs_info, ++ "mismatched block owner"); ++ ret = -EIO; ++ goto out_unlock; ++ } + parent = 0; + } + +@@ -8976,12 +8987,18 @@ skip: + } + ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent, + root->root_key.objectid, level - 1, 0); +- BUG_ON(ret); /* -ENOMEM */ ++ if (ret) ++ goto out_unlock; + } ++ ++ *lookup_info = 1; ++ ret = 1; ++ ++out_unlock: + btrfs_tree_unlock(next); + free_extent_buffer(next); +- *lookup_info = 1; +- return 1; ++ ++ return ret; + } + + /* +@@ -10127,6 +10144,11 @@ int btrfs_read_block_groups(struct btrfs_root *root) + struct extent_buffer *leaf; + int need_clear = 0; + u64 cache_gen; ++ u64 feature; ++ int mixed; ++ ++ feature = btrfs_super_incompat_flags(info->super_copy); ++ mixed = !!(feature & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS); + + root = info->extent_root; + key.objectid = 0; +@@ -10180,6 +10202,15 @@ int btrfs_read_block_groups(struct btrfs_root *root) + btrfs_item_ptr_offset(leaf, path->slots[0]), + sizeof(cache->item)); + cache->flags = btrfs_block_group_flags(&cache->item); ++ if (!mixed && ++ ((cache->flags & BTRFS_BLOCK_GROUP_METADATA) && ++ (cache->flags & BTRFS_BLOCK_GROUP_DATA))) { ++ btrfs_err(info, ++"bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups", ++ cache->key.objectid); ++ ret = -EINVAL; ++ goto error; ++ } + + key.objectid = found_key.objectid + found_key.offset; + btrfs_release_path(path); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index c3ec30dea9a5..3f9a6b40fbbd 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5209,11 +5209,20 @@ int read_extent_buffer_pages(struct extent_io_tree *tree, + lock_page(page); + } + locked_pages++; ++ } ++ /* ++ * We need to firstly lock all pages to make sure that ++ * the uptodate bit of our pages won't be affected by ++ * clear_extent_buffer_uptodate(). ++ */ ++ for (i = start_i; i < num_pages; i++) { ++ page = eb->pages[i]; + if (!PageUptodate(page)) { + num_reads++; + all_uptodate = 0; + } + } ++ + if (all_uptodate) { + if (start_i == 0) + set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 7fd939bfbd99..fcd2b3be21bf 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3813,6 +3813,11 @@ process_slot: + } + btrfs_release_path(path); + key.offset = next_key_min_offset; ++ ++ if (fatal_signal_pending(current)) { ++ ret = -EINTR; ++ goto out; ++ } + } + ret = 0; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 8db2e29fdcf4..9cf03ebb27cc 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2332,10 +2332,6 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work) + int err = -ENOMEM; + int ret = 0; + +- mutex_lock(&fs_info->qgroup_rescan_lock); +- fs_info->qgroup_rescan_running = true; +- mutex_unlock(&fs_info->qgroup_rescan_lock); +- + path = btrfs_alloc_path(); + if (!path) + goto out; +@@ -2446,6 +2442,7 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + sizeof(fs_info->qgroup_rescan_progress)); + fs_info->qgroup_rescan_progress.objectid = progress_objectid; + init_completion(&fs_info->qgroup_rescan_completion); ++ fs_info->qgroup_rescan_running = true; + + spin_unlock(&fs_info->qgroup_lock); + mutex_unlock(&fs_info->qgroup_rescan_lock); +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index c0c13dc6fe12..d08a79dbf323 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -923,9 +923,16 @@ again: + path2->slots[level]--; + + eb = path2->nodes[level]; +- WARN_ON(btrfs_node_blockptr(eb, path2->slots[level]) != +- cur->bytenr); +- ++ if (btrfs_node_blockptr(eb, path2->slots[level]) != ++ cur->bytenr) { ++ btrfs_err(root->fs_info, ++ "couldn't find block (%llu) (level %d) in tree (%llu) with key (%llu %u %llu)", ++ cur->bytenr, level - 1, root->objectid, ++ node_key->objectid, node_key->type, ++ node_key->offset); ++ err = -ENOENT; ++ goto out; ++ } + lower = cur; + need_check = true; + for (; level < BTRFS_MAX_LEVEL; level++) { +@@ -1387,14 +1394,23 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, + root_key.offset = objectid; + + if (root->root_key.objectid == objectid) { ++ u64 commit_root_gen; ++ + /* called by btrfs_init_reloc_root */ + ret = btrfs_copy_root(trans, root, root->commit_root, &eb, + BTRFS_TREE_RELOC_OBJECTID); + BUG_ON(ret); +- + last_snap = btrfs_root_last_snapshot(&root->root_item); +- btrfs_set_root_last_snapshot(&root->root_item, +- trans->transid - 1); ++ /* ++ * Set the last_snapshot field to the generation of the commit ++ * root - like this ctree.c:btrfs_block_can_be_shared() behaves ++ * correctly (returns true) when the relocation root is created ++ * either inside the critical section of a transaction commit ++ * (through transaction.c:qgroup_account_snapshot()) and when ++ * it's created before the transaction commit is started. ++ */ ++ commit_root_gen = btrfs_header_generation(root->commit_root); ++ btrfs_set_root_last_snapshot(&root->root_item, commit_root_gen); + } else { + /* + * called by btrfs_reloc_post_snapshot_hook. +@@ -2350,6 +2366,10 @@ void free_reloc_roots(struct list_head *list) + while (!list_empty(list)) { + reloc_root = list_entry(list->next, struct btrfs_root, + root_list); ++ free_extent_buffer(reloc_root->node); ++ free_extent_buffer(reloc_root->commit_root); ++ reloc_root->node = NULL; ++ reloc_root->commit_root = NULL; + __del_reloc_root(reloc_root); + } + } +@@ -2686,11 +2706,15 @@ static int do_relocation(struct btrfs_trans_handle *trans, + + if (!upper->eb) { + ret = btrfs_search_slot(trans, root, key, path, 0, 1); +- if (ret < 0) { +- err = ret; ++ if (ret) { ++ if (ret < 0) ++ err = ret; ++ else ++ err = -ENOENT; ++ ++ btrfs_release_path(path); + break; + } +- BUG_ON(ret > 0); + + if (!upper->eb) { + upper->eb = path->nodes[upper->level]; +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index a87675ffd02b..563878a141a3 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5802,6 +5802,64 @@ static int changed_extent(struct send_ctx *sctx, + int ret = 0; + + if (sctx->cur_ino != sctx->cmp_key->objectid) { ++ ++ if (result == BTRFS_COMPARE_TREE_CHANGED) { ++ struct extent_buffer *leaf_l; ++ struct extent_buffer *leaf_r; ++ struct btrfs_file_extent_item *ei_l; ++ struct btrfs_file_extent_item *ei_r; ++ ++ leaf_l = sctx->left_path->nodes[0]; ++ leaf_r = sctx->right_path->nodes[0]; ++ ei_l = btrfs_item_ptr(leaf_l, ++ sctx->left_path->slots[0], ++ struct btrfs_file_extent_item); ++ ei_r = btrfs_item_ptr(leaf_r, ++ sctx->right_path->slots[0], ++ struct btrfs_file_extent_item); ++ ++ /* ++ * We may have found an extent item that has changed ++ * only its disk_bytenr field and the corresponding ++ * inode item was not updated. This case happens due to ++ * very specific timings during relocation when a leaf ++ * that contains file extent items is COWed while ++ * relocation is ongoing and its in the stage where it ++ * updates data pointers. So when this happens we can ++ * safely ignore it since we know it's the same extent, ++ * but just at different logical and physical locations ++ * (when an extent is fully replaced with a new one, we ++ * know the generation number must have changed too, ++ * since snapshot creation implies committing the current ++ * transaction, and the inode item must have been updated ++ * as well). ++ * This replacement of the disk_bytenr happens at ++ * relocation.c:replace_file_extents() through ++ * relocation.c:btrfs_reloc_cow_block(). ++ */ ++ if (btrfs_file_extent_generation(leaf_l, ei_l) == ++ btrfs_file_extent_generation(leaf_r, ei_r) && ++ btrfs_file_extent_ram_bytes(leaf_l, ei_l) == ++ btrfs_file_extent_ram_bytes(leaf_r, ei_r) && ++ btrfs_file_extent_compression(leaf_l, ei_l) == ++ btrfs_file_extent_compression(leaf_r, ei_r) && ++ btrfs_file_extent_encryption(leaf_l, ei_l) == ++ btrfs_file_extent_encryption(leaf_r, ei_r) && ++ btrfs_file_extent_other_encoding(leaf_l, ei_l) == ++ btrfs_file_extent_other_encoding(leaf_r, ei_r) && ++ btrfs_file_extent_type(leaf_l, ei_l) == ++ btrfs_file_extent_type(leaf_r, ei_r) && ++ btrfs_file_extent_disk_bytenr(leaf_l, ei_l) != ++ btrfs_file_extent_disk_bytenr(leaf_r, ei_r) && ++ btrfs_file_extent_disk_num_bytes(leaf_l, ei_l) == ++ btrfs_file_extent_disk_num_bytes(leaf_r, ei_r) && ++ btrfs_file_extent_offset(leaf_l, ei_l) == ++ btrfs_file_extent_offset(leaf_r, ei_r) && ++ btrfs_file_extent_num_bytes(leaf_l, ei_l) == ++ btrfs_file_extent_num_bytes(leaf_r, ei_r)) ++ return 0; ++ } ++ + inconsistent_snapshot_error(sctx, result, "extent"); + return -EIO; + } +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 90e1198bc63d..e63c96ca0e96 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1940,12 +1940,11 @@ static noinline int find_dir_range(struct btrfs_root *root, + next: + /* check the next slot in the tree to see if it is a valid item */ + nritems = btrfs_header_nritems(path->nodes[0]); ++ path->slots[0]++; + if (path->slots[0] >= nritems) { + ret = btrfs_next_leaf(root, path); + if (ret) + goto out; +- } else { +- path->slots[0]++; + } + + btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]); +@@ -5205,6 +5204,7 @@ process_leaf: + if (di_key.type == BTRFS_ROOT_ITEM_KEY) + continue; + ++ btrfs_release_path(path); + di_inode = btrfs_iget(root->fs_info->sb, &di_key, + root, NULL); + if (IS_ERR(di_inode)) { +@@ -5214,13 +5214,12 @@ process_leaf: + + if (btrfs_inode_in_log(di_inode, trans->transid)) { + iput(di_inode); +- continue; ++ break; + } + + ctx->log_new_dentries = false; + if (type == BTRFS_FT_DIR || type == BTRFS_FT_SYMLINK) + log_mode = LOG_INODE_ALL; +- btrfs_release_path(path); + ret = btrfs_log_inode(trans, root, di_inode, + log_mode, 0, LLONG_MAX, ctx); + if (!ret && +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 035efce603a9..7c9c6a4be4fd 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -859,7 +859,7 @@ static void btrfs_close_bdev(struct btrfs_device *device) + blkdev_put(device->bdev, device->mode); + } + +-static void btrfs_close_one_device(struct btrfs_device *device) ++static void btrfs_prepare_close_one_device(struct btrfs_device *device) + { + struct btrfs_fs_devices *fs_devices = device->fs_devices; + struct btrfs_device *new_device; +@@ -877,8 +877,6 @@ static void btrfs_close_one_device(struct btrfs_device *device) + if (device->missing) + fs_devices->missing_devices--; + +- btrfs_close_bdev(device); +- + new_device = btrfs_alloc_device(NULL, &device->devid, + device->uuid); + BUG_ON(IS_ERR(new_device)); /* -ENOMEM */ +@@ -892,23 +890,39 @@ static void btrfs_close_one_device(struct btrfs_device *device) + + list_replace_rcu(&device->dev_list, &new_device->dev_list); + new_device->fs_devices = device->fs_devices; +- +- call_rcu(&device->rcu, free_device); + } + + static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices) + { + struct btrfs_device *device, *tmp; ++ struct list_head pending_put; ++ ++ INIT_LIST_HEAD(&pending_put); + + if (--fs_devices->opened > 0) + return 0; + + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry_safe(device, tmp, &fs_devices->devices, dev_list) { +- btrfs_close_one_device(device); ++ btrfs_prepare_close_one_device(device); ++ list_add(&device->dev_list, &pending_put); + } + mutex_unlock(&fs_devices->device_list_mutex); + ++ /* ++ * btrfs_show_devname() is using the device_list_mutex, ++ * sometimes call to blkdev_put() leads vfs calling ++ * into this func. So do put outside of device_list_mutex, ++ * as of now. ++ */ ++ while (!list_empty(&pending_put)) { ++ device = list_first_entry(&pending_put, ++ struct btrfs_device, dev_list); ++ list_del(&device->dev_list); ++ btrfs_close_bdev(device); ++ call_rcu(&device->rcu, free_device); ++ } ++ + WARN_ON(fs_devices->open_devices); + WARN_ON(fs_devices->rw_devices); + fs_devices->opened = 0; +@@ -1846,7 +1860,6 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid) + u64 num_devices; + int ret = 0; + bool clear_super = false; +- char *dev_name = NULL; + + mutex_lock(&uuid_mutex); + +@@ -1882,11 +1895,6 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid) + list_del_init(&device->dev_alloc_list); + device->fs_devices->rw_devices--; + unlock_chunks(root); +- dev_name = kstrdup(device->name->str, GFP_KERNEL); +- if (!dev_name) { +- ret = -ENOMEM; +- goto error_undo; +- } + clear_super = true; + } + +@@ -1936,14 +1944,21 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid) + btrfs_sysfs_rm_device_link(root->fs_info->fs_devices, device); + } + +- btrfs_close_bdev(device); +- +- call_rcu(&device->rcu, free_device); +- + num_devices = btrfs_super_num_devices(root->fs_info->super_copy) - 1; + btrfs_set_super_num_devices(root->fs_info->super_copy, num_devices); + mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); + ++ /* ++ * at this point, the device is zero sized and detached from ++ * the devices list. All that's left is to zero out the old ++ * supers and free the device. ++ */ ++ if (device->writeable) ++ btrfs_scratch_superblocks(device->bdev, device->name->str); ++ ++ btrfs_close_bdev(device); ++ call_rcu(&device->rcu, free_device); ++ + if (cur_devices->open_devices == 0) { + struct btrfs_fs_devices *fs_devices; + fs_devices = root->fs_info->fs_devices; +@@ -1962,24 +1977,7 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid) + root->fs_info->num_tolerated_disk_barrier_failures = + btrfs_calc_num_tolerated_disk_barrier_failures(root->fs_info); + +- /* +- * at this point, the device is zero sized. We want to +- * remove it from the devices list and zero out the old super +- */ +- if (clear_super) { +- struct block_device *bdev; +- +- bdev = blkdev_get_by_path(dev_name, FMODE_READ | FMODE_EXCL, +- root->fs_info->bdev_holder); +- if (!IS_ERR(bdev)) { +- btrfs_scratch_superblocks(bdev, dev_name); +- blkdev_put(bdev, FMODE_READ | FMODE_EXCL); +- } +- } +- + out: +- kfree(dev_name); +- + mutex_unlock(&uuid_mutex); + return ret; + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 65f78b7a9062..24184cae83d2 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -629,6 +629,8 @@ struct TCP_Server_Info { + unsigned int max_read; + unsigned int max_write; + __u8 preauth_hash[512]; ++ struct delayed_work reconnect; /* reconnect workqueue job */ ++ struct mutex reconnect_mutex; /* prevent simultaneous reconnects */ + #endif /* CONFIG_CIFS_SMB2 */ + unsigned long echo_interval; + }; +@@ -832,6 +834,7 @@ cap_unix(struct cifs_ses *ses) + struct cifs_tcon { + struct list_head tcon_list; + int tc_count; ++ struct list_head rlist; /* reconnect list */ + struct list_head openFileList; + spinlock_t open_file_lock; /* protects list above */ + struct cifs_ses *ses; /* pointer to session associated with */ +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 95dab43646f0..ca76f8a7267f 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -204,6 +204,9 @@ extern void cifs_add_pending_open_locked(struct cifs_fid *fid, + struct tcon_link *tlink, + struct cifs_pending_open *open); + extern void cifs_del_pending_open(struct cifs_pending_open *open); ++extern void cifs_put_tcp_session(struct TCP_Server_Info *server, ++ int from_reconnect); ++extern void cifs_put_tcon(struct cifs_tcon *tcon); + + #if IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) + extern void cifs_dfs_release_automount_timer(void); +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 7b67179521cf..a178f3a5b052 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -52,6 +52,9 @@ + #include "nterr.h" + #include "rfc1002pdu.h" + #include "fscache.h" ++#ifdef CONFIG_CIFS_SMB2 ++#include "smb2proto.h" ++#endif + + #define CIFS_PORT 445 + #define RFC1001_PORT 139 +@@ -2076,8 +2079,8 @@ cifs_find_tcp_session(struct smb_vol *vol) + return NULL; + } + +-static void +-cifs_put_tcp_session(struct TCP_Server_Info *server) ++void ++cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) + { + struct task_struct *task; + +@@ -2094,6 +2097,19 @@ cifs_put_tcp_session(struct TCP_Server_Info *server) + + cancel_delayed_work_sync(&server->echo); + ++#ifdef CONFIG_CIFS_SMB2 ++ if (from_reconnect) ++ /* ++ * Avoid deadlock here: reconnect work calls ++ * cifs_put_tcp_session() at its end. Need to be sure ++ * that reconnect work does nothing with server pointer after ++ * that step. ++ */ ++ cancel_delayed_work(&server->reconnect); ++ else ++ cancel_delayed_work_sync(&server->reconnect); ++#endif ++ + spin_lock(&GlobalMid_Lock); + server->tcpStatus = CifsExiting; + spin_unlock(&GlobalMid_Lock); +@@ -2158,6 +2174,10 @@ cifs_get_tcp_session(struct smb_vol *volume_info) + INIT_LIST_HEAD(&tcp_ses->tcp_ses_list); + INIT_LIST_HEAD(&tcp_ses->smb_ses_list); + INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request); ++#ifdef CONFIG_CIFS_SMB2 ++ INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server); ++ mutex_init(&tcp_ses->reconnect_mutex); ++#endif + memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr, + sizeof(tcp_ses->srcaddr)); + memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr, +@@ -2316,7 +2336,7 @@ cifs_put_smb_ses(struct cifs_ses *ses) + spin_unlock(&cifs_tcp_ses_lock); + + sesInfoFree(ses); +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + } + + #ifdef CONFIG_KEYS +@@ -2490,7 +2510,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info) + mutex_unlock(&ses->session_mutex); + + /* existing SMB ses has a server reference already */ +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + free_xid(xid); + return ses; + } +@@ -2580,7 +2600,7 @@ cifs_find_tcon(struct cifs_ses *ses, const char *unc) + return NULL; + } + +-static void ++void + cifs_put_tcon(struct cifs_tcon *tcon) + { + unsigned int xid; +@@ -3762,7 +3782,7 @@ mount_fail_check: + else if (ses) + cifs_put_smb_ses(ses); + else +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + bdi_destroy(&cifs_sb->bdi); + } + +@@ -4073,7 +4093,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) + ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info); + if (IS_ERR(ses)) { + tcon = (struct cifs_tcon *)ses; +- cifs_put_tcp_session(master_tcon->ses->server); ++ cifs_put_tcp_session(master_tcon->ses->server, 0); + goto out; + } + +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index f9e766f464be..b2aff0c6f22c 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile) + * and check it for zero before using. + */ + max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf; +- if (!max_buf) { ++ if (max_buf < sizeof(struct smb2_lock_element)) { + free_xid(xid); + return -EINVAL; + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 3eec96ca87d9..32e0e06f972c 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -275,7 +275,7 @@ out: + case SMB2_CHANGE_NOTIFY: + case SMB2_QUERY_INFO: + case SMB2_SET_INFO: +- return -EAGAIN; ++ rc = -EAGAIN; + } + unload_nls(nls_codepage); + return rc; +@@ -1820,6 +1820,54 @@ smb2_echo_callback(struct mid_q_entry *mid) + add_credits(server, credits_received, CIFS_ECHO_OP); + } + ++void smb2_reconnect_server(struct work_struct *work) ++{ ++ struct TCP_Server_Info *server = container_of(work, ++ struct TCP_Server_Info, reconnect.work); ++ struct cifs_ses *ses; ++ struct cifs_tcon *tcon, *tcon2; ++ struct list_head tmp_list; ++ int tcon_exist = false; ++ ++ /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ ++ mutex_lock(&server->reconnect_mutex); ++ ++ INIT_LIST_HEAD(&tmp_list); ++ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); ++ ++ spin_lock(&cifs_tcp_ses_lock); ++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { ++ if (tcon->need_reconnect) { ++ tcon->tc_count++; ++ list_add_tail(&tcon->rlist, &tmp_list); ++ tcon_exist = true; ++ } ++ } ++ } ++ /* ++ * Get the reference to server struct to be sure that the last call of ++ * cifs_put_tcon() in the loop below won't release the server pointer. ++ */ ++ if (tcon_exist) ++ server->srv_count++; ++ ++ spin_unlock(&cifs_tcp_ses_lock); ++ ++ list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { ++ smb2_reconnect(SMB2_ECHO, tcon); ++ list_del_init(&tcon->rlist); ++ cifs_put_tcon(tcon); ++ } ++ ++ cifs_dbg(FYI, "Reconnecting tcons finished\n"); ++ mutex_unlock(&server->reconnect_mutex); ++ ++ /* now we can safely release srv struct */ ++ if (tcon_exist) ++ cifs_put_tcp_session(server, 1); ++} ++ + int + SMB2_echo(struct TCP_Server_Info *server) + { +@@ -1832,32 +1880,11 @@ SMB2_echo(struct TCP_Server_Info *server) + cifs_dbg(FYI, "In echo request\n"); + + if (server->tcpStatus == CifsNeedNegotiate) { +- struct list_head *tmp, *tmp2; +- struct cifs_ses *ses; +- struct cifs_tcon *tcon; +- +- cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); +- spin_lock(&cifs_tcp_ses_lock); +- list_for_each(tmp, &server->smb_ses_list) { +- ses = list_entry(tmp, struct cifs_ses, smb_ses_list); +- list_for_each(tmp2, &ses->tcon_list) { +- tcon = list_entry(tmp2, struct cifs_tcon, +- tcon_list); +- /* add check for persistent handle reconnect */ +- if (tcon && tcon->need_reconnect) { +- spin_unlock(&cifs_tcp_ses_lock); +- rc = smb2_reconnect(SMB2_ECHO, tcon); +- spin_lock(&cifs_tcp_ses_lock); +- } +- } +- } +- spin_unlock(&cifs_tcp_ses_lock); ++ /* No need to send echo on newly established connections */ ++ queue_delayed_work(cifsiod_wq, &server->reconnect, 0); ++ return rc; + } + +- /* if no session, renegotiate failed above */ +- if (server->tcpStatus == CifsNeedNegotiate) +- return -EIO; +- + rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req); + if (rc) + return rc; +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index eb2cde2f64ba..f2d511a6971b 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -96,6 +96,7 @@ extern int smb2_open_file(const unsigned int xid, + extern int smb2_unlock_range(struct cifsFileInfo *cfile, + struct file_lock *flock, const unsigned int xid); + extern int smb2_push_mandatory_locks(struct cifsFileInfo *cfile); ++extern void smb2_reconnect_server(struct work_struct *work); + + /* + * SMB2 Worker functions - most of protocol specific implementation details +diff --git a/fs/exec.c b/fs/exec.c +index 6fcfb3f7b137..eebe8be7a29d 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -19,7 +19,7 @@ + * current->executable is only used by the procfs. This allows a dispatch + * table to check for several different types of binary formats. We keep + * trying until we recognize the file or we run out of supported binary +- * formats. ++ * formats. + */ + + #include <linux/slab.h> +@@ -1261,6 +1261,13 @@ int flush_old_exec(struct linux_binprm * bprm) + flush_thread(); + current->personality &= ~bprm->per_clear; + ++ /* ++ * We have to apply CLOEXEC before we change whether the process is ++ * dumpable (in setup_new_exec) to avoid a race with a process in userspace ++ * trying to access the should-be-closed file descriptors of a process ++ * undergoing exec(2). ++ */ ++ do_close_on_exec(current->files); + return 0; + + out: +@@ -1270,8 +1277,22 @@ EXPORT_SYMBOL(flush_old_exec); + + void would_dump(struct linux_binprm *bprm, struct file *file) + { +- if (inode_permission(file_inode(file), MAY_READ) < 0) ++ struct inode *inode = file_inode(file); ++ if (inode_permission(inode, MAY_READ) < 0) { ++ struct user_namespace *old, *user_ns; + bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP; ++ ++ /* Ensure mm->user_ns contains the executable */ ++ user_ns = old = bprm->mm->user_ns; ++ while ((user_ns != &init_user_ns) && ++ !privileged_wrt_inode_uidgid(user_ns, inode)) ++ user_ns = user_ns->parent; ++ ++ if (old != user_ns) { ++ bprm->mm->user_ns = get_user_ns(user_ns); ++ put_user_ns(old); ++ } ++ } + } + EXPORT_SYMBOL(would_dump); + +@@ -1301,7 +1322,6 @@ void setup_new_exec(struct linux_binprm * bprm) + !gid_eq(bprm->cred->gid, current_egid())) { + current->pdeath_signal = 0; + } else { +- would_dump(bprm, bprm->file); + if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP) + set_dumpable(current->mm, suid_dumpable); + } +@@ -1310,7 +1330,6 @@ void setup_new_exec(struct linux_binprm * bprm) + group */ + current->self_exec_id++; + flush_signal_handlers(current, 0); +- do_close_on_exec(current->files); + } + EXPORT_SYMBOL(setup_new_exec); + +@@ -1401,7 +1420,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm) + unsigned n_fs; + + if (p->ptrace) { +- if (p->ptrace & PT_PTRACE_CAP) ++ if (ptracer_capable(p, current_user_ns())) + bprm->unsafe |= LSM_UNSAFE_PTRACE_CAP; + else + bprm->unsafe |= LSM_UNSAFE_PTRACE; +@@ -1736,6 +1755,8 @@ static int do_execveat_common(int fd, struct filename *filename, + if (retval < 0) + goto out; + ++ would_dump(bprm, bprm->file); ++ + retval = exec_binprm(bprm); + if (retval < 0) + goto out; +diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h +index b1d52c14098e..f97611171023 100644 +--- a/fs/ext4/ext4_jbd2.h ++++ b/fs/ext4/ext4_jbd2.h +@@ -414,17 +414,19 @@ static inline int ext4_inode_journal_mode(struct inode *inode) + return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ + /* We do not support data journalling with delayed allocation */ + if (!S_ISREG(inode->i_mode) || +- test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +- return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */ +- if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && +- !test_opt(inode->i_sb, DELALLOC)) ++ test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || ++ (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && ++ !test_opt(inode->i_sb, DELALLOC))) { ++ /* We do not support data journalling for encrypted data */ ++ if (S_ISREG(inode->i_mode) && ext4_encrypted_inode(inode)) ++ return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ + return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */ ++ } + if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) + return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ + if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA) + return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ +- else +- BUG(); ++ BUG(); + } + + static inline int ext4_should_journal_data(struct inode *inode) +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index f74d5ee2cdec..d8ca4b9f9dd6 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -336,8 +336,10 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, + + len -= EXT4_MIN_INLINE_DATA_SIZE; + value = kzalloc(len, GFP_NOFS); +- if (!value) ++ if (!value) { ++ error = -ENOMEM; + goto out; ++ } + + error = ext4_xattr_ibody_get(inode, i.name_index, i.name, + value, len); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index f4cdc647ecfc..27e4348efc4e 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4438,6 +4438,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + struct inode *inode; + journal_t *journal = EXT4_SB(sb)->s_journal; + long ret; ++ loff_t size; + int block; + uid_t i_uid; + gid_t i_gid; +@@ -4538,6 +4539,11 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + ei->i_file_acl |= + ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32; + inode->i_size = ext4_isize(raw_inode); ++ if ((size = i_size_read(inode)) < 0) { ++ EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size); ++ ret = -EFSCORRUPTED; ++ goto bad_inode; ++ } + ei->i_disksize = inode->i_size; + #ifdef CONFIG_QUOTA + ei->i_reserved_quota = 0; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index f418f55c2bbe..7ae43c59bc79 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -669,7 +669,7 @@ static void ext4_mb_mark_free_simple(struct super_block *sb, + ext4_grpblk_t min; + ext4_grpblk_t max; + ext4_grpblk_t chunk; +- unsigned short border; ++ unsigned int border; + + BUG_ON(len > EXT4_CLUSTERS_PER_GROUP(sb)); + +@@ -2287,7 +2287,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v) + struct ext4_group_info *grinfo; + struct sg { + struct ext4_group_info info; +- ext4_grpblk_t counters[16]; ++ ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2]; + } sg; + + group--; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ec89f5005c2d..d0d4377680c7 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3161,10 +3161,15 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp, + ext4_set_bit(s++, buf); + count++; + } +- for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { +- ext4_set_bit(EXT4_B2C(sbi, s++), buf); +- count++; ++ j = ext4_bg_num_gdb(sb, grp); ++ if (s + j > EXT4_BLOCKS_PER_GROUP(sb)) { ++ ext4_error(sb, "Invalid number of block group " ++ "descriptor blocks: %d", j); ++ j = EXT4_BLOCKS_PER_GROUP(sb) - s; + } ++ count += j; ++ for (; j > 0; j--) ++ ext4_set_bit(EXT4_B2C(sbi, s++), buf); + } + if (!count) + return 0; +@@ -3254,7 +3259,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + char *orig_data = kstrdup(data, GFP_KERNEL); + struct buffer_head *bh; + struct ext4_super_block *es = NULL; +- struct ext4_sb_info *sbi; ++ struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); + ext4_fsblk_t block; + ext4_fsblk_t sb_block = get_sb_block(&data); + ext4_fsblk_t logical_sb_block; +@@ -3273,16 +3278,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO; + ext4_group_t first_not_zeroed; + +- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); +- if (!sbi) +- goto out_free_orig; ++ if ((data && !orig_data) || !sbi) ++ goto out_free_base; + + sbi->s_blockgroup_lock = + kzalloc(sizeof(struct blockgroup_lock), GFP_KERNEL); +- if (!sbi->s_blockgroup_lock) { +- kfree(sbi); +- goto out_free_orig; +- } ++ if (!sbi->s_blockgroup_lock) ++ goto out_free_base; ++ + sb->s_fs_info = sbi; + sbi->s_sb = sb; + sbi->s_inode_readahead_blks = EXT4_DEF_INODE_READAHEAD_BLKS; +@@ -3428,11 +3431,19 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + */ + sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + +- if (!parse_options((char *) sbi->s_es->s_mount_opts, sb, +- &journal_devnum, &journal_ioprio, 0)) { +- ext4_msg(sb, KERN_WARNING, +- "failed to parse options in superblock: %s", +- sbi->s_es->s_mount_opts); ++ if (sbi->s_es->s_mount_opts[0]) { ++ char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, ++ sizeof(sbi->s_es->s_mount_opts), ++ GFP_KERNEL); ++ if (!s_mount_opts) ++ goto failed_mount; ++ if (!parse_options(s_mount_opts, sb, &journal_devnum, ++ &journal_ioprio, 0)) { ++ ext4_msg(sb, KERN_WARNING, ++ "failed to parse options in superblock: %s", ++ s_mount_opts); ++ } ++ kfree(s_mount_opts); + } + sbi->s_def_mount_opt = sbi->s_mount_opt; + if (!parse_options((char *) data, sb, &journal_devnum, +@@ -3458,6 +3469,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + "both data=journal and dax"); + goto failed_mount; + } ++ if (ext4_has_feature_encrypt(sb)) { ++ ext4_msg(sb, KERN_WARNING, ++ "encrypted files will use data=ordered " ++ "instead of data journaling mode"); ++ } + if (test_opt(sb, DELALLOC)) + clear_opt(sb, DELALLOC); + } else { +@@ -3613,12 +3629,16 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + + sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group); + sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group); +- if (EXT4_INODE_SIZE(sb) == 0 || EXT4_INODES_PER_GROUP(sb) == 0) +- goto cantfind_ext4; + + sbi->s_inodes_per_block = blocksize / EXT4_INODE_SIZE(sb); + if (sbi->s_inodes_per_block == 0) + goto cantfind_ext4; ++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || ++ sbi->s_inodes_per_group > blocksize * 8) { ++ ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n", ++ sbi->s_blocks_per_group); ++ goto failed_mount; ++ } + sbi->s_itb_per_group = sbi->s_inodes_per_group / + sbi->s_inodes_per_block; + sbi->s_desc_per_block = blocksize / EXT4_DESC_SIZE(sb); +@@ -3701,13 +3721,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } + sbi->s_cluster_ratio = clustersize / blocksize; + +- if (sbi->s_inodes_per_group > blocksize * 8) { +- ext4_msg(sb, KERN_ERR, +- "#inodes per group too big: %lu", +- sbi->s_inodes_per_group); +- goto failed_mount; +- } +- + /* Do we have standard group size of clustersize * 8 blocks ? */ + if (sbi->s_blocks_per_group == clustersize << 3) + set_opt2(sb, STD_GROUP_SIZE); +@@ -4113,7 +4126,9 @@ no_journal: + + if (___ratelimit(&ext4_mount_msg_ratelimit, "EXT4-fs mount")) + ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. " +- "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts, ++ "Opts: %.*s%s%s", descr, ++ (int) sizeof(sbi->s_es->s_mount_opts), ++ sbi->s_es->s_mount_opts, + *sbi->s_es->s_mount_opts ? "; " : "", orig_data); + + if (es->s_error_count) +@@ -4192,8 +4207,8 @@ failed_mount: + out_fail: + sb->s_fs_info = NULL; + kfree(sbi->s_blockgroup_lock); ++out_free_base: + kfree(sbi); +-out_free_orig: + kfree(orig_data); + return err ? err : ret; + } +diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c +index badd407bb622..c05d66d98871 100644 +--- a/fs/f2fs/debug.c ++++ b/fs/f2fs/debug.c +@@ -362,6 +362,7 @@ static int stat_open(struct inode *inode, struct file *file) + } + + static const struct file_operations stat_fops = { ++ .owner = THIS_MODULE, + .open = stat_open, + .read = seq_read, + .llseek = seq_lseek, +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 14f5fe2b841e..8467f4221f57 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -451,7 +451,7 @@ struct f2fs_inode_info { + /* Use below internally in f2fs*/ + unsigned long flags; /* use to pass per-file flags */ + struct rw_semaphore i_sem; /* protect fi info */ +- struct percpu_counter dirty_pages; /* # of dirty pages */ ++ atomic_t dirty_pages; /* # of dirty pages */ + f2fs_hash_t chash; /* hash value of given file name */ + unsigned int clevel; /* maximum level of given file name */ + nid_t i_xattr_nid; /* node id that contains xattrs */ +@@ -1198,7 +1198,7 @@ static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type) + + static inline void inode_inc_dirty_pages(struct inode *inode) + { +- percpu_counter_inc(&F2FS_I(inode)->dirty_pages); ++ atomic_inc(&F2FS_I(inode)->dirty_pages); + inc_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ? + F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA); + } +@@ -1214,7 +1214,7 @@ static inline void inode_dec_dirty_pages(struct inode *inode) + !S_ISLNK(inode->i_mode)) + return; + +- percpu_counter_dec(&F2FS_I(inode)->dirty_pages); ++ atomic_dec(&F2FS_I(inode)->dirty_pages); + dec_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ? + F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA); + } +@@ -1224,9 +1224,9 @@ static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type) + return percpu_counter_sum_positive(&sbi->nr_pages[count_type]); + } + +-static inline s64 get_dirty_pages(struct inode *inode) ++static inline int get_dirty_pages(struct inode *inode) + { +- return percpu_counter_sum_positive(&F2FS_I(inode)->dirty_pages); ++ return atomic_read(&F2FS_I(inode)->dirty_pages); + } + + static inline int get_blocktype_secs(struct f2fs_sb_info *sbi, int block_type) +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 28f4f4cbb8d8..06f39db65923 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -970,7 +970,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode, + new_size = (dst + i) << PAGE_SHIFT; + if (dst_inode->i_size < new_size) + f2fs_i_size_write(dst_inode, new_size); +- } while ((do_replace[i] || blkaddr[i] == NULL_ADDR) && --ilen); ++ } while (--ilen && (do_replace[i] || blkaddr[i] == NULL_ADDR)); + + f2fs_put_dnode(&dn); + } else { +@@ -1529,7 +1529,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + goto out; + + f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING, +- "Unexpected flush for atomic writes: ino=%lu, npages=%lld", ++ "Unexpected flush for atomic writes: ino=%lu, npages=%u", + inode->i_ino, get_dirty_pages(inode)); + ret = filemap_write_and_wait_range(inode->i_mapping, 0, LLONG_MAX); + if (ret) +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 7f863a645ab1..37edc853c66c 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -565,13 +565,9 @@ static struct inode *f2fs_alloc_inode(struct super_block *sb) + + init_once((void *) fi); + +- if (percpu_counter_init(&fi->dirty_pages, 0, GFP_NOFS)) { +- kmem_cache_free(f2fs_inode_cachep, fi); +- return NULL; +- } +- + /* Initialize f2fs-specific inode info */ + fi->vfs_inode.i_version = 1; ++ atomic_set(&fi->dirty_pages, 0); + fi->i_current_depth = 1; + fi->i_advise = 0; + init_rwsem(&fi->i_sem); +@@ -694,7 +690,6 @@ static void f2fs_i_callback(struct rcu_head *head) + + static void f2fs_destroy_inode(struct inode *inode) + { +- percpu_counter_destroy(&F2FS_I(inode)->dirty_pages); + call_rcu(&inode->i_rcu, f2fs_i_callback); + } + +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index e8638fd2c0c3..6f07b3e89ff2 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -4506,6 +4506,7 @@ xlog_recover_clear_agi_bucket( + agi->agi_unlinked[bucket] = cpu_to_be32(NULLAGINO); + offset = offsetof(xfs_agi_t, agi_unlinked) + + (sizeof(xfs_agino_t) * bucket); ++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); + xfs_trans_log_buf(tp, agibp, offset, + (offset + sizeof(xfs_agino_t) - 1)); + +diff --git a/include/linux/capability.h b/include/linux/capability.h +index dbc21c719ce6..6ffb67e10c06 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -240,8 +240,10 @@ static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) + return true; + } + #endif /* CONFIG_MULTIUSER */ ++extern bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode); + extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); + extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); ++extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); + + /* audit system wants to get cap info from files as well */ + extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 903200f4ec41..39820082ce91 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -473,6 +473,7 @@ struct mm_struct { + */ + struct task_struct __rcu *owner; + #endif ++ struct user_namespace *user_ns; + + /* store ref to file /proc/<pid>/exe symlink points to */ + struct file __rcu *exe_file; +diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h +index bca26157f5b6..f6bc76501912 100644 +--- a/include/linux/pm_opp.h ++++ b/include/linux/pm_opp.h +@@ -19,6 +19,7 @@ + + struct dev_pm_opp; + struct device; ++struct opp_table; + + enum dev_pm_opp_event { + OPP_EVENT_ADD, OPP_EVENT_REMOVE, OPP_EVENT_ENABLE, OPP_EVENT_DISABLE, +@@ -62,8 +63,8 @@ int dev_pm_opp_set_supported_hw(struct device *dev, const u32 *versions, + void dev_pm_opp_put_supported_hw(struct device *dev); + int dev_pm_opp_set_prop_name(struct device *dev, const char *name); + void dev_pm_opp_put_prop_name(struct device *dev); +-int dev_pm_opp_set_regulator(struct device *dev, const char *name); +-void dev_pm_opp_put_regulator(struct device *dev); ++struct opp_table *dev_pm_opp_set_regulator(struct device *dev, const char *name); ++void dev_pm_opp_put_regulator(struct opp_table *opp_table); + int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq); + int dev_pm_opp_set_sharing_cpus(struct device *cpu_dev, const struct cpumask *cpumask); + int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask); +@@ -170,12 +171,12 @@ static inline int dev_pm_opp_set_prop_name(struct device *dev, const char *name) + + static inline void dev_pm_opp_put_prop_name(struct device *dev) {} + +-static inline int dev_pm_opp_set_regulator(struct device *dev, const char *name) ++static inline struct opp_table *dev_pm_opp_set_regulator(struct device *dev, const char *name) + { +- return -ENOTSUPP; ++ return ERR_PTR(-ENOTSUPP); + } + +-static inline void dev_pm_opp_put_regulator(struct device *dev) {} ++static inline void dev_pm_opp_put_regulator(struct opp_table *opp_table) {} + + static inline int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq) + { +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 504c98a278d4..e13bfdf7f314 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -19,7 +19,6 @@ + #define PT_SEIZED 0x00010000 /* SEIZE used, enable new behavior */ + #define PT_PTRACED 0x00000001 + #define PT_DTRACE 0x00000002 /* delayed trace (used on m68k, i386) */ +-#define PT_PTRACE_CAP 0x00000004 /* ptracer can follow suid-exec */ + + #define PT_OPT_FLAG_SHIFT 3 + /* PT_TRACE_* event enable flags */ +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 62c68e513e39..f52d4cc97788 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1631,6 +1631,7 @@ struct task_struct { + struct list_head cpu_timers[3]; + + /* process credentials */ ++ const struct cred __rcu *ptracer_cred; /* Tracer's credentials at attach */ + const struct cred __rcu *real_cred; /* objective and real subjective task + * credentials (COW) */ + const struct cred __rcu *cred; /* effective (overridable) subjective task +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index 445b019c2078..de45666f96b4 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -17,7 +17,6 @@ + #include <linux/bitops.h> + #include <linux/compiler.h> + #include <linux/atomic.h> +-#include <linux/rhashtable.h> + + #include <linux/netfilter/nf_conntrack_tcp.h> + #include <linux/netfilter/nf_conntrack_dccp.h> +@@ -118,9 +117,6 @@ struct nf_conn { + /* Extensions */ + struct nf_ct_ext *ext; + +-#if IS_ENABLED(CONFIG_NF_NAT) +- struct rhash_head nat_bysource; +-#endif + /* Storage reserved for other modules, must be the last member */ + union nf_conntrack_proto proto; + }; +diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h +index 1c3035dda31f..b925395fa5ed 100644 +--- a/include/net/netfilter/nf_conntrack_extend.h ++++ b/include/net/netfilter/nf_conntrack_extend.h +@@ -99,6 +99,9 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id, + struct nf_ct_ext_type { + /* Destroys relationships (can be NULL). */ + void (*destroy)(struct nf_conn *ct); ++ /* Called when realloacted (can be NULL). ++ Contents has already been moved. */ ++ void (*move)(void *new, void *old); + + enum nf_ct_ext_id id; + +diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h +index c327a431a6f3..344b1ab19220 100644 +--- a/include/net/netfilter/nf_nat.h ++++ b/include/net/netfilter/nf_nat.h +@@ -1,6 +1,5 @@ + #ifndef _NF_NAT_H + #define _NF_NAT_H +-#include <linux/rhashtable.h> + #include <linux/netfilter_ipv4.h> + #include <linux/netfilter/nf_nat.h> + #include <net/netfilter/nf_conntrack_tuple.h> +@@ -30,6 +29,8 @@ struct nf_conn; + + /* The structure embedded in the conntrack structure. */ + struct nf_conn_nat { ++ struct hlist_node bysource; ++ struct nf_conn *ct; + union nf_conntrack_nat_help help; + #if IS_ENABLED(CONFIG_NF_NAT_MASQUERADE_IPV4) || \ + IS_ENABLED(CONFIG_NF_NAT_MASQUERADE_IPV6) +diff --git a/kernel/capability.c b/kernel/capability.c +index 00411c82dac5..4984e1f552eb 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -457,6 +457,19 @@ bool file_ns_capable(const struct file *file, struct user_namespace *ns, + EXPORT_SYMBOL(file_ns_capable); + + /** ++ * privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode? ++ * @ns: The user namespace in question ++ * @inode: The inode in question ++ * ++ * Return true if the inode uid and gid are within the namespace. ++ */ ++bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode) ++{ ++ return kuid_has_mapping(ns, inode->i_uid) && ++ kgid_has_mapping(ns, inode->i_gid); ++} ++ ++/** + * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped + * @inode: The inode in question + * @cap: The capability in question +@@ -469,7 +482,26 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) + { + struct user_namespace *ns = current_user_ns(); + +- return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && +- kgid_has_mapping(ns, inode->i_gid); ++ return ns_capable(ns, cap) && privileged_wrt_inode_uidgid(ns, inode); + } + EXPORT_SYMBOL(capable_wrt_inode_uidgid); ++ ++/** ++ * ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace ++ * @tsk: The task that may be ptraced ++ * @ns: The user namespace to search for CAP_SYS_PTRACE in ++ * ++ * Return true if the task that is ptracing the current task had CAP_SYS_PTRACE ++ * in the specified user namespace. ++ */ ++bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns) ++{ ++ int ret = 0; /* An absent tracer adds no restrictions */ ++ const struct cred *cred; ++ rcu_read_lock(); ++ cred = rcu_dereference(tsk->ptracer_cred); ++ if (cred) ++ ret = security_capable_noaudit(cred, ns, CAP_SYS_PTRACE); ++ rcu_read_unlock(); ++ return (ret == 0); ++} +diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c +index 0874e2edd275..79517e5549f1 100644 +--- a/kernel/debug/debug_core.c ++++ b/kernel/debug/debug_core.c +@@ -598,11 +598,11 @@ return_normal: + /* + * Wait for the other CPUs to be notified and be waiting for us: + */ +- time_left = loops_per_jiffy * HZ; ++ time_left = MSEC_PER_SEC; + while (kgdb_do_roundup && --time_left && + (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) != + online_cpus) +- cpu_relax(); ++ udelay(1000); + if (!time_left) + pr_crit("Timed out waiting for secondary CPUs.\n"); + +diff --git a/kernel/fork.c b/kernel/fork.c +index beb31725f7e2..9f8dae785f07 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -598,7 +598,8 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) + #endif + } + +-static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p) ++static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, ++ struct user_namespace *user_ns) + { + mm->mmap = NULL; + mm->mm_rb = RB_ROOT; +@@ -638,6 +639,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p) + if (init_new_context(p, mm)) + goto fail_nocontext; + ++ mm->user_ns = get_user_ns(user_ns); + return mm; + + fail_nocontext: +@@ -683,7 +685,7 @@ struct mm_struct *mm_alloc(void) + return NULL; + + memset(mm, 0, sizeof(*mm)); +- return mm_init(mm, current); ++ return mm_init(mm, current, current_user_ns()); + } + + /* +@@ -698,6 +700,7 @@ void __mmdrop(struct mm_struct *mm) + destroy_context(mm); + mmu_notifier_mm_destroy(mm); + check_mm(mm); ++ put_user_ns(mm->user_ns); + free_mm(mm); + } + EXPORT_SYMBOL_GPL(__mmdrop); +@@ -977,7 +980,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk) + + memcpy(mm, oldmm, sizeof(*mm)); + +- if (!mm_init(mm, tsk)) ++ if (!mm_init(mm, tsk, mm->user_ns)) + goto fail_nomem; + + err = dup_mmap(mm, oldmm); +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 1d3b7665d0be..7b20baea41e7 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -39,6 +39,9 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) + BUG_ON(!list_empty(&child->ptrace_entry)); + list_add(&child->ptrace_entry, &new_parent->ptraced); + child->parent = new_parent; ++ rcu_read_lock(); ++ child->ptracer_cred = get_cred(__task_cred(new_parent)); ++ rcu_read_unlock(); + } + + /** +@@ -71,10 +74,14 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) + */ + void __ptrace_unlink(struct task_struct *child) + { ++ const struct cred *old_cred; + BUG_ON(!child->ptrace); + + child->parent = child->real_parent; + list_del_init(&child->ptrace_entry); ++ old_cred = child->ptracer_cred; ++ child->ptracer_cred = NULL; ++ put_cred(old_cred); + + spin_lock(&child->sighand->siglock); + child->ptrace = 0; +@@ -218,7 +225,7 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + { + const struct cred *cred = current_cred(), *tcred; +- int dumpable = 0; ++ struct mm_struct *mm; + kuid_t caller_uid; + kgid_t caller_gid; + +@@ -269,16 +276,11 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + return -EPERM; + ok: + rcu_read_unlock(); +- smp_rmb(); +- if (task->mm) +- dumpable = get_dumpable(task->mm); +- rcu_read_lock(); +- if (dumpable != SUID_DUMP_USER && +- !ptrace_has_cap(__task_cred(task)->user_ns, mode)) { +- rcu_read_unlock(); +- return -EPERM; +- } +- rcu_read_unlock(); ++ mm = task->mm; ++ if (mm && ++ ((get_dumpable(mm) != SUID_DUMP_USER) && ++ !ptrace_has_cap(mm->user_ns, mode))) ++ return -EPERM; + + return security_ptrace_access_check(task, mode); + } +@@ -342,10 +344,6 @@ static int ptrace_attach(struct task_struct *task, long request, + + if (seize) + flags |= PT_SEIZED; +- rcu_read_lock(); +- if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) +- flags |= PT_PTRACE_CAP; +- rcu_read_unlock(); + task->ptrace = flags; + + __ptrace_link(task, current); +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 9acb29f280ec..6d1020c03d41 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -344,7 +344,6 @@ static void watchdog_overflow_callback(struct perf_event *event, + */ + if (is_hardlockup()) { + int this_cpu = smp_processor_id(); +- struct pt_regs *regs = get_irq_regs(); + + /* only print hardlockups once */ + if (__this_cpu_read(hard_watchdog_warn) == true) +diff --git a/mm/filemap.c b/mm/filemap.c +index ced9ef6c06b0..f1da48d1f95f 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -1688,7 +1688,7 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos, + int error = 0; + + if (unlikely(*ppos >= inode->i_sb->s_maxbytes)) +- return -EINVAL; ++ return 0; + iov_iter_truncate(iter, inode->i_sb->s_maxbytes); + + index = *ppos >> PAGE_SHIFT; +diff --git a/mm/init-mm.c b/mm/init-mm.c +index a56a851908d2..975e49f00f34 100644 +--- a/mm/init-mm.c ++++ b/mm/init-mm.c +@@ -6,6 +6,7 @@ + #include <linux/cpumask.h> + + #include <linux/atomic.h> ++#include <linux/user_namespace.h> + #include <asm/pgtable.h> + #include <asm/mmu.h> + +@@ -21,5 +22,6 @@ struct mm_struct init_mm = { + .mmap_sem = __RWSEM_INITIALIZER(init_mm.mmap_sem), + .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), + .mmlist = LIST_HEAD_INIT(init_mm.mmlist), ++ .user_ns = &init_user_ns, + INIT_MM_CONTEXT(init_mm) + }; +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 7401e996009a..212a017a2f02 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2173,7 +2173,7 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order, + unsigned long count, struct list_head *list, + int migratetype, bool cold) + { +- int i; ++ int i, alloced = 0; + + spin_lock(&zone->lock); + for (i = 0; i < count; ++i) { +@@ -2198,13 +2198,21 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order, + else + list_add_tail(&page->lru, list); + list = &page->lru; ++ alloced++; + if (is_migrate_cma(get_pcppage_migratetype(page))) + __mod_zone_page_state(zone, NR_FREE_CMA_PAGES, + -(1 << order)); + } ++ ++ /* ++ * i pages were removed from the buddy list even if some leak due ++ * to check_pcp_refill failing so adjust NR_FREE_PAGES based ++ * on i. Do not confuse with 'alloced' which is the number of ++ * pages added to the pcp list. ++ */ + __mod_zone_page_state(zone, NR_FREE_PAGES, -(i << order)); + spin_unlock(&zone->lock); +- return i; ++ return alloced; + } + + #ifdef CONFIG_NUMA +diff --git a/mm/vmscan.c b/mm/vmscan.c +index ba0fad78e5d4..5c313a0d1626 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -291,6 +291,7 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + int nid = shrinkctl->nid; + long batch_size = shrinker->batch ? shrinker->batch + : SHRINK_BATCH; ++ long scanned = 0, next_deferred; + + freeable = shrinker->count_objects(shrinker, shrinkctl); + if (freeable == 0) +@@ -312,7 +313,9 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n", + shrinker->scan_objects, total_scan); + total_scan = freeable; +- } ++ next_deferred = nr; ++ } else ++ next_deferred = total_scan; + + /* + * We need to avoid excessive windup on filesystem shrinkers +@@ -369,17 +372,22 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + + count_vm_events(SLABS_SCANNED, nr_to_scan); + total_scan -= nr_to_scan; ++ scanned += nr_to_scan; + + cond_resched(); + } + ++ if (next_deferred >= scanned) ++ next_deferred -= scanned; ++ else ++ next_deferred = 0; + /* + * move the unused scan count back into the shrinker in a + * manner that handles concurrent updates. If we exhausted the + * scan, there is no need to do an update. + */ +- if (total_scan > 0) +- new_nr = atomic_long_add_return(total_scan, ++ if (next_deferred > 0) ++ new_nr = atomic_long_add_return(next_deferred, + &shrinker->nr_deferred[nid]); + else + new_nr = atomic_long_read(&shrinker->nr_deferred[nid]); +diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c +index 02bcf00c2492..1a9545965c0d 100644 +--- a/net/netfilter/nf_conntrack_extend.c ++++ b/net/netfilter/nf_conntrack_extend.c +@@ -73,7 +73,7 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id, + size_t var_alloc_len, gfp_t gfp) + { + struct nf_ct_ext *old, *new; +- int newlen, newoff; ++ int i, newlen, newoff; + struct nf_ct_ext_type *t; + + /* Conntrack must not be confirmed to avoid races on reallocation. */ +@@ -99,8 +99,19 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id, + return NULL; + + if (new != old) { ++ for (i = 0; i < NF_CT_EXT_NUM; i++) { ++ if (!__nf_ct_ext_exist(old, i)) ++ continue; ++ ++ rcu_read_lock(); ++ t = rcu_dereference(nf_ct_ext_types[i]); ++ if (t && t->move) ++ t->move((void *)new + new->offset[i], ++ (void *)old + old->offset[i]); ++ rcu_read_unlock(); ++ } + kfree_rcu(old, rcu); +- rcu_assign_pointer(ct->ext, new); ++ ct->ext = new; + } + + new->offset[id] = newoff; +diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c +index ecee105bbada..4bf9b50cbb4c 100644 +--- a/net/netfilter/nf_nat_core.c ++++ b/net/netfilter/nf_nat_core.c +@@ -30,19 +30,17 @@ + #include <net/netfilter/nf_conntrack_zones.h> + #include <linux/netfilter/nf_nat.h> + ++static DEFINE_SPINLOCK(nf_nat_lock); ++ + static DEFINE_MUTEX(nf_nat_proto_mutex); + static const struct nf_nat_l3proto __rcu *nf_nat_l3protos[NFPROTO_NUMPROTO] + __read_mostly; + static const struct nf_nat_l4proto __rcu **nf_nat_l4protos[NFPROTO_NUMPROTO] + __read_mostly; + +-struct nf_nat_conn_key { +- const struct net *net; +- const struct nf_conntrack_tuple *tuple; +- const struct nf_conntrack_zone *zone; +-}; +- +-static struct rhashtable nf_nat_bysource_table; ++static struct hlist_head *nf_nat_bysource __read_mostly; ++static unsigned int nf_nat_htable_size __read_mostly; ++static unsigned int nf_nat_hash_rnd __read_mostly; + + inline const struct nf_nat_l3proto * + __nf_nat_l3proto_find(u8 family) +@@ -121,17 +119,19 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family) + EXPORT_SYMBOL(nf_xfrm_me_harder); + #endif /* CONFIG_XFRM */ + +-static u32 nf_nat_bysource_hash(const void *data, u32 len, u32 seed) ++/* We keep an extra hash for each conntrack, for fast searching. */ ++static inline unsigned int ++hash_by_src(const struct net *n, const struct nf_conntrack_tuple *tuple) + { +- const struct nf_conntrack_tuple *t; +- const struct nf_conn *ct = data; ++ unsigned int hash; ++ ++ get_random_once(&nf_nat_hash_rnd, sizeof(nf_nat_hash_rnd)); + +- t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; + /* Original src, to ensure we map it consistently if poss. */ ++ hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32), ++ tuple->dst.protonum ^ nf_nat_hash_rnd ^ net_hash_mix(n)); + +- seed ^= net_hash_mix(nf_ct_net(ct)); +- return jhash2((const u32 *)&t->src, sizeof(t->src) / sizeof(u32), +- t->dst.protonum ^ seed); ++ return reciprocal_scale(hash, nf_nat_htable_size); + } + + /* Is this tuple already taken? (not by us) */ +@@ -187,26 +187,6 @@ same_src(const struct nf_conn *ct, + t->src.u.all == tuple->src.u.all); + } + +-static int nf_nat_bysource_cmp(struct rhashtable_compare_arg *arg, +- const void *obj) +-{ +- const struct nf_nat_conn_key *key = arg->key; +- const struct nf_conn *ct = obj; +- +- return same_src(ct, key->tuple) && +- net_eq(nf_ct_net(ct), key->net) && +- nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL); +-} +- +-static struct rhashtable_params nf_nat_bysource_params = { +- .head_offset = offsetof(struct nf_conn, nat_bysource), +- .obj_hashfn = nf_nat_bysource_hash, +- .obj_cmpfn = nf_nat_bysource_cmp, +- .nelem_hint = 256, +- .min_size = 1024, +- .nulls_base = (1U << RHT_BASE_SHIFT), +-}; +- + /* Only called for SRC manip */ + static int + find_appropriate_src(struct net *net, +@@ -217,23 +197,25 @@ find_appropriate_src(struct net *net, + struct nf_conntrack_tuple *result, + const struct nf_nat_range *range) + { ++ unsigned int h = hash_by_src(net, tuple); ++ const struct nf_conn_nat *nat; + const struct nf_conn *ct; +- struct nf_nat_conn_key key = { +- .net = net, +- .tuple = tuple, +- .zone = zone +- }; + +- ct = rhashtable_lookup_fast(&nf_nat_bysource_table, &key, +- nf_nat_bysource_params); +- if (!ct) +- return 0; +- +- nf_ct_invert_tuplepr(result, +- &ct->tuplehash[IP_CT_DIR_REPLY].tuple); +- result->dst = tuple->dst; +- +- return in_range(l3proto, l4proto, result, range); ++ hlist_for_each_entry_rcu(nat, &nf_nat_bysource[h], bysource) { ++ ct = nat->ct; ++ if (same_src(ct, tuple) && ++ net_eq(net, nf_ct_net(ct)) && ++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) { ++ /* Copy source part from reply tuple. */ ++ nf_ct_invert_tuplepr(result, ++ &ct->tuplehash[IP_CT_DIR_REPLY].tuple); ++ result->dst = tuple->dst; ++ ++ if (in_range(l3proto, l4proto, result, range)) ++ return 1; ++ } ++ } ++ return 0; + } + + /* For [FUTURE] fragmentation handling, we want the least-used +@@ -405,6 +387,7 @@ nf_nat_setup_info(struct nf_conn *ct, + const struct nf_nat_range *range, + enum nf_nat_manip_type maniptype) + { ++ struct net *net = nf_ct_net(ct); + struct nf_conntrack_tuple curr_tuple, new_tuple; + struct nf_conn_nat *nat; + +@@ -446,13 +429,17 @@ nf_nat_setup_info(struct nf_conn *ct, + } + + if (maniptype == NF_NAT_MANIP_SRC) { +- int err; +- +- err = rhashtable_insert_fast(&nf_nat_bysource_table, +- &ct->nat_bysource, +- nf_nat_bysource_params); +- if (err) +- return NF_DROP; ++ unsigned int srchash; ++ ++ srchash = hash_by_src(net, ++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); ++ spin_lock_bh(&nf_nat_lock); ++ /* nf_conntrack_alter_reply might re-allocate extension aera */ ++ nat = nfct_nat(ct); ++ nat->ct = ct; ++ hlist_add_head_rcu(&nat->bysource, ++ &nf_nat_bysource[srchash]); ++ spin_unlock_bh(&nf_nat_lock); + } + + /* It's done. */ +@@ -557,7 +544,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data) + if (nf_nat_proto_remove(ct, data)) + return 1; + +- if (!nat) ++ if (!nat || !nat->ct) + return 0; + + /* This netns is being destroyed, and conntrack has nat null binding. +@@ -569,10 +556,11 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data) + if (!del_timer(&ct->timeout)) + return 1; + ++ spin_lock_bh(&nf_nat_lock); ++ hlist_del_rcu(&nat->bysource); + ct->status &= ~IPS_NAT_DONE_MASK; +- +- rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource, +- nf_nat_bysource_params); ++ nat->ct = NULL; ++ spin_unlock_bh(&nf_nat_lock); + + add_timer(&ct->timeout); + +@@ -701,17 +689,35 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct) + { + struct nf_conn_nat *nat = nf_ct_ext_find(ct, NF_CT_EXT_NAT); + +- if (!nat) ++ if (nat == NULL || nat->ct == NULL) + return; + +- rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource, +- nf_nat_bysource_params); ++ NF_CT_ASSERT(nat->ct->status & IPS_SRC_NAT_DONE); ++ ++ spin_lock_bh(&nf_nat_lock); ++ hlist_del_rcu(&nat->bysource); ++ spin_unlock_bh(&nf_nat_lock); ++} ++ ++static void nf_nat_move_storage(void *new, void *old) ++{ ++ struct nf_conn_nat *new_nat = new; ++ struct nf_conn_nat *old_nat = old; ++ struct nf_conn *ct = old_nat->ct; ++ ++ if (!ct || !(ct->status & IPS_SRC_NAT_DONE)) ++ return; ++ ++ spin_lock_bh(&nf_nat_lock); ++ hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource); ++ spin_unlock_bh(&nf_nat_lock); + } + + static struct nf_ct_ext_type nat_extend __read_mostly = { + .len = sizeof(struct nf_conn_nat), + .align = __alignof__(struct nf_conn_nat), + .destroy = nf_nat_cleanup_conntrack, ++ .move = nf_nat_move_storage, + .id = NF_CT_EXT_NAT, + .flags = NF_CT_EXT_F_PREALLOC, + }; +@@ -840,13 +846,16 @@ static int __init nf_nat_init(void) + { + int ret; + +- ret = rhashtable_init(&nf_nat_bysource_table, &nf_nat_bysource_params); +- if (ret) +- return ret; ++ /* Leave them the same for the moment. */ ++ nf_nat_htable_size = nf_conntrack_htable_size; ++ ++ nf_nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size, 0); ++ if (!nf_nat_bysource) ++ return -ENOMEM; + + ret = nf_ct_extend_register(&nat_extend); + if (ret < 0) { +- rhashtable_destroy(&nf_nat_bysource_table); ++ nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size); + printk(KERN_ERR "nf_nat_core: Unable to register extension\n"); + return ret; + } +@@ -870,7 +879,7 @@ static int __init nf_nat_init(void) + return 0; + + cleanup_extend: +- rhashtable_destroy(&nf_nat_bysource_table); ++ nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size); + nf_ct_extend_unregister(&nat_extend); + return ret; + } +@@ -888,8 +897,8 @@ static void __exit nf_nat_cleanup(void) + #endif + for (i = 0; i < NFPROTO_NUMPROTO; i++) + kfree(nf_nat_l4protos[i]); +- +- rhashtable_destroy(&nf_nat_bysource_table); ++ synchronize_net(); ++ nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size); + } + + MODULE_LICENSE("GPL"); +diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c +index 7f57a145a47e..a03cf68d0bcd 100644 +--- a/sound/pci/hda/hda_auto_parser.c ++++ b/sound/pci/hda/hda_auto_parser.c +@@ -884,6 +884,8 @@ void snd_hda_apply_fixup(struct hda_codec *codec, int action) + } + EXPORT_SYMBOL_GPL(snd_hda_apply_fixup); + ++#define IGNORE_SEQ_ASSOC (~(AC_DEFCFG_SEQUENCE | AC_DEFCFG_DEF_ASSOC)) ++ + static bool pin_config_match(struct hda_codec *codec, + const struct hda_pintbl *pins) + { +@@ -901,7 +903,7 @@ static bool pin_config_match(struct hda_codec *codec, + for (; t_pins->nid; t_pins++) { + if (t_pins->nid == nid) { + found = 1; +- if (t_pins->val == cfg) ++ if ((t_pins->val & IGNORE_SEQ_ASSOC) == (cfg & IGNORE_SEQ_ASSOC)) + break; + else if ((cfg & 0xf0000000) == 0x40000000 && (t_pins->val & 0xf0000000) == 0x40000000) + break; +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 9ceb2bc36e68..c146d0de53d8 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -780,6 +780,7 @@ static const struct hda_pintbl alienware_pincfgs[] = { + static const struct snd_pci_quirk ca0132_quirks[] = { + SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE), + SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE), ++ SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE), + {} + }; + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index ed62748a6d55..c15c51bea26d 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -262,6 +262,7 @@ enum { + CXT_FIXUP_CAP_MIX_AMP_5047, + CXT_FIXUP_MUTE_LED_EAPD, + CXT_FIXUP_HP_SPECTRE, ++ CXT_FIXUP_HP_GATE_MIC, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -633,6 +634,17 @@ static void cxt_fixup_cap_mix_amp_5047(struct hda_codec *codec, + (1 << AC_AMPCAP_MUTE_SHIFT)); + } + ++static void cxt_fixup_hp_gate_mic_jack(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ /* the mic pin (0x19) doesn't give an unsolicited event; ++ * probe the mic pin together with the headphone pin (0x16) ++ */ ++ if (action == HDA_FIXUP_ACT_PROBE) ++ snd_hda_jack_set_gating_jack(codec, 0x19, 0x16); ++} ++ + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { + { 0x16, 0x042140ff }, /* HP (seq# overridden) */ +@@ -774,6 +786,10 @@ static const struct hda_fixup cxt_fixups[] = { + { } + } + }, ++ [CXT_FIXUP_HP_GATE_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_gate_mic_jack, ++ }, + }; + + static const struct snd_pci_quirk cxt5045_fixups[] = { +@@ -824,6 +840,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), ++ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 162818058a5d..512fd83407f2 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5915,6 +5915,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60180}, + {0x14, 0x90170120}, + {0x21, 0x02211030}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x1b, 0x01011020}, ++ {0x21, 0x02211010}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60160}, + {0x14, 0x90170120}, +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 52ed434cbca6..f1223045c400 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -771,6 +771,9 @@ static int sst_soc_prepare(struct device *dev) + struct sst_data *drv = dev_get_drvdata(dev); + struct snd_soc_pcm_runtime *rtd; + ++ if (!drv->soc_card) ++ return 0; ++ + /* suspend all pcms first */ + snd_soc_suspend(drv->soc_card->dev); + snd_soc_poweroff(drv->soc_card->dev); +@@ -793,6 +796,9 @@ static void sst_soc_complete(struct device *dev) + struct sst_data *drv = dev_get_drvdata(dev); + struct snd_soc_pcm_runtime *rtd; + ++ if (!drv->soc_card) ++ return; ++ + /* restart SSPs */ + list_for_each_entry(rtd, &drv->soc_card->rtd_list, list) { + struct snd_soc_dai *dai = rtd->cpu_dai; +diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c +index 2c44139b4041..33db205dd12b 100644 +--- a/sound/usb/hiface/pcm.c ++++ b/sound/usb/hiface/pcm.c +@@ -445,6 +445,8 @@ static int hiface_pcm_prepare(struct snd_pcm_substream *alsa_sub) + + mutex_lock(&rt->stream_mutex); + ++ hiface_pcm_stream_stop(rt); ++ + sub->dma_off = 0; + sub->period_off = 0; + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 2f8c388ef84f..4703caea56b2 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -932,9 +932,10 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ + case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ + case USB_ID(0x046d, 0x0991): ++ case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */ + /* Most audio usb devices lie about volume resolution. + * Most Logitech webcams have res = 384. +- * Proboly there is some logitech magic behind this number --fishor ++ * Probably there is some logitech magic behind this number --fishor + */ + if (!strcmp(kctl->id.name, "Mic Capture Volume")) { + usb_audio_info(chip,
