commit: 6d65370fd7b73bf99fdca1fc3e3875940de649f5 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Oct 12 12:22:14 2017 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Oct 12 12:22:14 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6d65370f
Linux patch 4.4.92 0000_README | 4 + 1091_linux-4.4.92.patch | 1905 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1909 insertions(+) diff --git a/0000_README b/0000_README index dc17474..a7ddd0f 100644 --- a/0000_README +++ b/0000_README @@ -407,6 +407,10 @@ Patch: 1090_linux-4.4.91.patch From: http://www.kernel.org Desc: Linux 4.4.91 +Patch: 1091_linux-4.4.92.patch +From: http://www.kernel.org +Desc: Linux 4.4.92 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1091_linux-4.4.92.patch b/1091_linux-4.4.92.patch new file mode 100644 index 0000000..2e76456 --- /dev/null +++ b/1091_linux-4.4.92.patch @@ -0,0 +1,1905 @@ +diff --git a/Makefile b/Makefile +index c1db50ef7fb5..fab2d640a27e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 91 ++SUBLEVEL = 92 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index cb4ad6e98b28..065fcc4be263 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -809,7 +809,8 @@ static ssize_t driver_override_store(struct device *dev, + struct platform_device *pdev = to_platform_device(dev); + char *driver_override, *old, *cp; + +- if (count > PATH_MAX) ++ /* We need to keep extra room for a newline */ ++ if (count >= (PAGE_SIZE - 1)) + return -EINVAL; + + driver_override = kstrndup(buf, count, GFP_KERNEL); +diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c +index d14bdc537587..0a2ac3efd04e 100644 +--- a/drivers/gpu/drm/i915/intel_bios.c ++++ b/drivers/gpu/drm/i915/intel_bios.c +@@ -957,6 +957,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, + is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0; + is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR); + ++ if (port == PORT_A && is_dvi) { ++ DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n", ++ is_hdmi ? "/HDMI" : ""); ++ is_dvi = false; ++ is_hdmi = false; ++ } ++ + info->supports_dvi = is_dvi; + info->supports_hdmi = is_hdmi; + info->supports_dp = is_dp; +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index d4d655a10df1..312aa1e33fb2 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -540,7 +540,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) + { + /* the worst case is computed from the set_report command with a + * reportID > 15 and the maximum report length */ +- int args_len = sizeof(__u8) + /* optional ReportID byte */ ++ int args_len = sizeof(__u8) + /* ReportID */ ++ sizeof(__u8) + /* optional ReportID byte */ + sizeof(__u16) + /* data register */ + sizeof(__u16) + /* size of the report */ + report_size; /* report */ +diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c +index 1fb02dcbc500..12dcbd8226f2 100644 +--- a/drivers/hv/hv_fcopy.c ++++ b/drivers/hv/hv_fcopy.c +@@ -155,6 +155,10 @@ static void fcopy_send_data(struct work_struct *dummy) + out_src = smsg_out; + break; + ++ case WRITE_TO_FILE: ++ out_src = fcopy_transaction.fcopy_msg; ++ out_len = sizeof(struct hv_do_fcopy); ++ break; + default: + out_src = fcopy_transaction.fcopy_msg; + out_len = fcopy_transaction.recv_len; +diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c +index b6445d9e5453..d2dff159a471 100644 +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -952,7 +952,7 @@ void stm_source_unregister_device(struct stm_source_data *data) + + stm_source_link_drop(src); + +- device_destroy(&stm_source_class, src->dev.devt); ++ device_unregister(&src->dev); + } + EXPORT_SYMBOL_GPL(stm_source_unregister_device); + +diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c +index 4d960d3b93c0..91d34ed756ea 100644 +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, + unsigned int vref_mv) + { + struct ad7793_state *st = iio_priv(indio_dev); +- int i, ret = -1; ++ int i, ret; + unsigned long long scale_uv; + u32 id; + +@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, + return ret; + + /* reset the serial interface */ +- ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret)); ++ ret = ad_sd_reset(&st->sd, 32); + if (ret < 0) + goto out; + usleep_range(500, 2000); /* Wait for at least 500us */ +diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c +index d10bd0c97233..22c4c17cd996 100644 +--- a/drivers/iio/adc/ad_sigma_delta.c ++++ b/drivers/iio/adc/ad_sigma_delta.c +@@ -177,6 +177,34 @@ out: + } + EXPORT_SYMBOL_GPL(ad_sd_read_reg); + ++/** ++ * ad_sd_reset() - Reset the serial interface ++ * ++ * @sigma_delta: The sigma delta device ++ * @reset_length: Number of SCLKs with DIN = 1 ++ * ++ * Returns 0 on success, an error code otherwise. ++ **/ ++int ad_sd_reset(struct ad_sigma_delta *sigma_delta, ++ unsigned int reset_length) ++{ ++ uint8_t *buf; ++ unsigned int size; ++ int ret; ++ ++ size = DIV_ROUND_UP(reset_length, 8); ++ buf = kcalloc(size, sizeof(*buf), GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ memset(buf, 0xff, size); ++ ret = spi_write(sigma_delta->spi, buf, size); ++ kfree(buf); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(ad_sd_reset); ++ + static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, + unsigned int mode, unsigned int channel) + { +diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c +index 8569c8e1f4b2..ad2681acce9a 100644 +--- a/drivers/iio/adc/mcp320x.c ++++ b/drivers/iio/adc/mcp320x.c +@@ -17,6 +17,8 @@ + * MCP3204 + * MCP3208 + * ------------ ++ * 13 bit converter ++ * MCP3301 + * + * Datasheet can be found here: + * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001 +@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index, + } + + static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, +- bool differential, int device_index) ++ bool differential, int device_index, int *val) + { + int ret; + +@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, + + switch (device_index) { + case mcp3001: +- return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); ++ *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); ++ return 0; + case mcp3002: + case mcp3004: + case mcp3008: +- return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); ++ *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); ++ return 0; + case mcp3201: +- return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); ++ *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); ++ return 0; + case mcp3202: + case mcp3204: + case mcp3208: +- return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); ++ *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); ++ return 0; + case mcp3301: +- return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12); ++ *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8 ++ | adc->rx_buf[1], 12); ++ return 0; + default: + return -EINVAL; + } +@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev, + switch (mask) { + case IIO_CHAN_INFO_RAW: + ret = mcp320x_adc_conversion(adc, channel->address, +- channel->differential, device_index); +- ++ channel->differential, device_index, val); + if (ret < 0) + goto out; + +- *val = ret; + ret = IIO_VAL_INT; + break; + +@@ -304,6 +310,7 @@ static int mcp320x_probe(struct spi_device *spi) + indio_dev->name = spi_get_device_id(spi)->name; + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->info = &mcp320x_info; ++ spi_set_drvdata(spi, indio_dev); + + chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data]; + indio_dev->channels = chip_info->channels; +diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c +index 0c74869a540a..7ffc5db4d7ee 100644 +--- a/drivers/iio/adc/twl4030-madc.c ++++ b/drivers/iio/adc/twl4030-madc.c +@@ -866,8 +866,10 @@ static int twl4030_madc_probe(struct platform_device *pdev) + + /* Enable 3v1 bias regulator for MADC[3:6] */ + madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1"); +- if (IS_ERR(madc->usb3v1)) +- return -ENODEV; ++ if (IS_ERR(madc->usb3v1)) { ++ ret = -ENODEV; ++ goto err_i2c; ++ } + + ret = regulator_enable(madc->usb3v1); + if (ret) +@@ -876,11 +878,13 @@ static int twl4030_madc_probe(struct platform_device *pdev) + ret = iio_device_register(iio_dev); + if (ret) { + dev_err(&pdev->dev, "could not register iio device\n"); +- goto err_i2c; ++ goto err_usb3v1; + } + + return 0; + ++err_usb3v1: ++ regulator_disable(madc->usb3v1); + err_i2c: + twl4030_madc_set_current_generator(madc, 0, 0); + err_current_generator: +diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c +index 131b434af994..e08a3c794120 100644 +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -221,8 +221,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf, + ret = indio_dev->info->debugfs_reg_access(indio_dev, + indio_dev->cached_reg_addr, + 0, &val); +- if (ret) ++ if (ret) { + dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__); ++ return ret; ++ } + + len = snprintf(buf, sizeof(buf), "0x%X\n", val); + +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index c2ea4e5666fb..9710cf71054a 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1990,6 +1990,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, + elength = 1; + goto next_desc; + } ++ if ((buflen < elength) || (elength < 3)) { ++ dev_err(&intf->dev, "invalid descriptor buffer length\n"); ++ break; ++ } + if (buffer[1] != USB_DT_CS_INTERFACE) { + dev_err(&intf->dev, "skipping garbage\n"); + goto next_desc; +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c +index da5826d788d6..f18491cf793c 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c +@@ -876,7 +876,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, + + eth_broadcast_addr(params_le->bssid); + params_le->bss_type = DOT11_BSSTYPE_ANY; +- params_le->scan_type = 0; ++ params_le->scan_type = BRCMF_SCANTYPE_ACTIVE; + params_le->channel_num = 0; + params_le->nprobes = cpu_to_le32(-1); + params_le->active_time = cpu_to_le32(-1); +@@ -884,12 +884,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, + params_le->home_time = cpu_to_le32(-1); + memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le)); + +- /* if request is null exit so it will be all channel broadcast scan */ +- if (!request) +- return; +- + n_ssids = request->n_ssids; + n_channels = request->n_channels; ++ + /* Copy channel array if applicable */ + brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n", + n_channels); +@@ -926,16 +923,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, + ptr += sizeof(ssid_le); + } + } else { +- brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids); +- if ((request->ssids) && request->ssids->ssid_len) { +- brcmf_dbg(SCAN, "SSID %s len=%d\n", +- params_le->ssid_le.SSID, +- request->ssids->ssid_len); +- params_le->ssid_le.SSID_len = +- cpu_to_le32(request->ssids->ssid_len); +- memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid, +- request->ssids->ssid_len); +- } ++ brcmf_dbg(SCAN, "Performing passive scan\n"); ++ params_le->scan_type = BRCMF_SCANTYPE_PASSIVE; + } + /* Adding mask to channel numbers */ + params_le->channel_num = +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h +index daa427b46712..4320c4cae53e 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h +@@ -45,6 +45,11 @@ + #define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff + #define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 + ++/* scan type definitions */ ++#define BRCMF_SCANTYPE_DEFAULT 0xFF ++#define BRCMF_SCANTYPE_ACTIVE 0 ++#define BRCMF_SCANTYPE_PASSIVE 1 ++ + /* primary (ie tx) key */ + #define BRCMF_PRIMARY_KEY (1 << 1) + #define DOT11_BSSTYPE_ANY 2 +diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +index d82984912e04..95b82cc132e6 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +@@ -73,6 +73,7 @@ + /* NVM offsets (in words) definitions */ + enum wkp_nvm_offsets { + /* NVM HW-Section offset (in words) definitions */ ++ SUBSYSTEM_ID = 0x0A, + HW_ADDR = 0x15, + + /* NVM SW-Section offset (in words) definitions */ +@@ -257,13 +258,12 @@ static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz, + static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + struct iwl_nvm_data *data, + const __le16 * const nvm_ch_flags, +- bool lar_supported) ++ bool lar_supported, bool no_wide_in_5ghz) + { + int ch_idx; + int n_channels = 0; + struct ieee80211_channel *channel; + u16 ch_flags; +- bool is_5ghz; + int num_of_ch, num_2ghz_channels; + const u8 *nvm_chan; + +@@ -278,12 +278,20 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + } + + for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) { ++ bool is_5ghz = (ch_idx >= num_2ghz_channels); ++ + ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx); + +- if (ch_idx >= num_2ghz_channels && +- !data->sku_cap_band_52GHz_enable) ++ if (is_5ghz && !data->sku_cap_band_52GHz_enable) + continue; + ++ /* workaround to disable wide channels in 5GHz */ ++ if (no_wide_in_5ghz && is_5ghz) { ++ ch_flags &= ~(NVM_CHANNEL_40MHZ | ++ NVM_CHANNEL_80MHZ | ++ NVM_CHANNEL_160MHZ); ++ } ++ + if (!lar_supported && !(ch_flags & NVM_CHANNEL_VALID)) { + /* + * Channels might become valid later if lar is +@@ -303,8 +311,8 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + n_channels++; + + channel->hw_value = nvm_chan[ch_idx]; +- channel->band = (ch_idx < num_2ghz_channels) ? +- IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; ++ channel->band = is_5ghz ? ++ IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ; + channel->center_freq = + ieee80211_channel_to_frequency( + channel->hw_value, channel->band); +@@ -316,7 +324,6 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + * is not used in mvm, and is used for backwards compatibility + */ + channel->max_power = IWL_DEFAULT_MAX_TX_POWER; +- is_5ghz = channel->band == IEEE80211_BAND_5GHZ; + + /* don't put limitations in case we're using LAR */ + if (!lar_supported) +@@ -405,7 +412,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg, + static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, + struct iwl_nvm_data *data, + const __le16 *ch_section, +- u8 tx_chains, u8 rx_chains, bool lar_supported) ++ u8 tx_chains, u8 rx_chains, bool lar_supported, ++ bool no_wide_in_5ghz) + { + int n_channels; + int n_used = 0; +@@ -414,12 +422,14 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, + if (cfg->device_family != IWL_DEVICE_FAMILY_8000) + n_channels = iwl_init_channel_map( + dev, cfg, data, +- &ch_section[NVM_CHANNELS], lar_supported); ++ &ch_section[NVM_CHANNELS], lar_supported, ++ no_wide_in_5ghz); + else + n_channels = iwl_init_channel_map( + dev, cfg, data, + &ch_section[NVM_CHANNELS_FAMILY_8000], +- lar_supported); ++ lar_supported, ++ no_wide_in_5ghz); + + sband = &data->bands[IEEE80211_BAND_2GHZ]; + sband->band = IEEE80211_BAND_2GHZ; +@@ -582,6 +592,39 @@ static void iwl_set_hw_address_family_8000(struct device *dev, + + #define IWL_4165_DEVICE_ID 0x5501 + ++static bool ++iwl_nvm_no_wide_in_5ghz(struct device *dev, const struct iwl_cfg *cfg, ++ const __le16 *nvm_hw) ++{ ++ /* ++ * Workaround a bug in Indonesia SKUs where the regulatory in ++ * some 7000-family OTPs erroneously allow wide channels in ++ * 5GHz. To check for Indonesia, we take the SKU value from ++ * bits 1-4 in the subsystem ID and check if it is either 5 or ++ * 9. In those cases, we need to force-disable wide channels ++ * in 5GHz otherwise the FW will throw a sysassert when we try ++ * to use them. ++ */ ++ if (cfg->device_family == IWL_DEVICE_FAMILY_7000) { ++ /* ++ * Unlike the other sections in the NVM, the hw ++ * section uses big-endian. ++ */ ++ u16 subsystem_id = be16_to_cpup((const __be16 *)nvm_hw ++ + SUBSYSTEM_ID); ++ u8 sku = (subsystem_id & 0x1e) >> 1; ++ ++ if (sku == 5 || sku == 9) { ++ IWL_DEBUG_EEPROM(dev, ++ "disabling wide channels in 5GHz (0x%0x %d)\n", ++ subsystem_id, sku); ++ return true; ++ } ++ } ++ ++ return false; ++} ++ + struct iwl_nvm_data * + iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, + const __le16 *nvm_hw, const __le16 *nvm_sw, +@@ -591,6 +634,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, + u32 mac_addr0, u32 mac_addr1, u32 hw_id) + { + struct iwl_nvm_data *data; ++ bool no_wide_in_5ghz = iwl_nvm_no_wide_in_5ghz(dev, cfg, nvm_hw); + u32 sku; + u32 radio_cfg; + u16 lar_config; +@@ -657,7 +701,8 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, + iwl_set_hw_address(cfg, data, nvm_hw); + + iwl_init_sbands(dev, cfg, data, nvm_sw, +- tx_chains, rx_chains, lar_fw_supported); ++ tx_chains, rx_chains, lar_fw_supported, ++ no_wide_in_5ghz); + } else { + u16 lar_offset = data->nvm_version < 0xE39 ? + NVM_LAR_OFFSET_FAMILY_8000_OLD : +@@ -673,7 +718,8 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, + + iwl_init_sbands(dev, cfg, data, regulatory, + tx_chains, rx_chains, +- lar_fw_supported && data->lar_enabled); ++ lar_fw_supported && data->lar_enabled, ++ no_wide_in_5ghz); + } + + data->calib_version = 255; +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index b8a5a8e8f57d..88cf4f5025b0 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -14,6 +14,7 @@ + #ifndef _NVME_H + #define _NVME_H + ++#include <linux/mutex.h> + #include <linux/nvme.h> + #include <linux/pci.h> + #include <linux/kref.h> +@@ -62,6 +63,7 @@ struct nvme_dev { + struct work_struct reset_work; + struct work_struct probe_work; + struct work_struct scan_work; ++ struct mutex shutdown_lock; + char name[12]; + char serial[20]; + char model[40]; +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 4c673d45f1bd..669edbd47602 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2954,6 +2954,7 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) + + nvme_dev_list_remove(dev); + ++ mutex_lock(&dev->shutdown_lock); + if (pci_is_enabled(to_pci_dev(dev->dev))) { + nvme_freeze_queues(dev); + csts = readl(&dev->bar->csts); +@@ -2972,6 +2973,7 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) + + for (i = dev->queue_count - 1; i >= 0; i--) + nvme_clear_queue(dev->queues[i]); ++ mutex_unlock(&dev->shutdown_lock); + } + + static void nvme_dev_remove(struct nvme_dev *dev) +@@ -3328,6 +3330,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + INIT_LIST_HEAD(&dev->namespaces); + INIT_WORK(&dev->reset_work, nvme_reset_work); ++ mutex_init(&dev->shutdown_lock); + dev->dev = get_device(&pdev->dev); + pci_set_drvdata(pdev, dev); + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 8750c86f95f9..7e1681cf287c 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2878,8 +2878,6 @@ static int sd_revalidate_disk(struct gendisk *disk) + sd_read_write_same(sdkp, buffer); + } + +- sdkp->first_scan = 0; +- + /* + * We now have all cache related info, determine how we deal + * with flush requests. +@@ -2894,7 +2892,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); + + /* +- * Use the device's preferred I/O size for reads and writes ++ * Determine the device's preferred I/O size for reads and writes + * unless the reported value is unreasonably small, large, or + * garbage. + */ +@@ -2908,8 +2906,19 @@ static int sd_revalidate_disk(struct gendisk *disk) + rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), + (sector_t)BLK_DEF_MAX_SECTORS); + +- /* Combine with controller limits */ +- q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); ++ /* Do not exceed controller limit */ ++ rw_max = min(rw_max, queue_max_hw_sectors(q)); ++ ++ /* ++ * Only update max_sectors if previously unset or if the current value ++ * exceeds the capabilities of the hardware. ++ */ ++ if (sdkp->first_scan || ++ q->limits.max_sectors > q->limits.max_dev_sectors || ++ q->limits.max_sectors > q->limits.max_hw_sectors) ++ q->limits.max_sectors = rw_max; ++ ++ sdkp->first_scan = 0; + + set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); + sd_config_write_same(sdkp); +diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c +index 20314ff08be0..abc66908681d 100644 +--- a/drivers/staging/iio/adc/ad7192.c ++++ b/drivers/staging/iio/adc/ad7192.c +@@ -205,11 +205,9 @@ static int ad7192_setup(struct ad7192_state *st, + struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); + unsigned long long scale_uv; + int i, ret, id; +- u8 ones[6]; + + /* reset the serial interface */ +- memset(&ones, 0xFF, 6); +- ret = spi_write(st->sd.spi, &ones, 6); ++ ret = ad_sd_reset(&st->sd, 48); + if (ret < 0) + goto out; + usleep_range(500, 1000); /* Wait for at least 500us */ +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 325cbc9c35d8..d9d048fc9082 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -609,15 +609,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, + + } else if (header->bDescriptorType == + USB_DT_INTERFACE_ASSOCIATION) { ++ struct usb_interface_assoc_descriptor *d; ++ ++ d = (struct usb_interface_assoc_descriptor *)header; ++ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { ++ dev_warn(ddev, ++ "config %d has an invalid interface association descriptor of length %d, skipping\n", ++ cfgno, d->bLength); ++ continue; ++ } ++ + if (iad_num == USB_MAXIADS) { + dev_warn(ddev, "found more Interface " + "Association Descriptors " + "than allocated for in " + "configuration %d\n", cfgno); + } else { +- config->intf_assoc[iad_num] = +- (struct usb_interface_assoc_descriptor +- *)header; ++ config->intf_assoc[iad_num] = d; + iad_num++; + } + +@@ -818,7 +826,7 @@ int usb_get_configuration(struct usb_device *dev) + } + + if (dev->quirks & USB_QUIRK_DELAY_INIT) +- msleep(100); ++ msleep(200); + + result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, + bigbuffer, length); +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 873ba02d59e6..bd9419213d06 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1417,7 +1417,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + totlen += isopkt[u].length; + } + u *= sizeof(struct usb_iso_packet_descriptor); +- uurb->buffer_length = totlen; ++ if (totlen <= uurb->buffer_length) ++ uurb->buffer_length = totlen; ++ else ++ WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", ++ totlen, uurb->buffer_length); + break; + + default: +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index cdf4be3939f5..51bba58c0c3b 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4761,7 +4761,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + goto loop; + + if (udev->quirks & USB_QUIRK_DELAY_INIT) +- msleep(1000); ++ msleep(2000); + + /* consecutive bus-powered hubs aren't reliable; they can + * violate the voltage drop budget. if the new child has +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index a069726da72a..4dd3c7672247 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -306,8 +306,6 @@ struct fsg_common { + struct completion thread_notifier; + struct task_struct *thread_task; + +- /* Callback functions. */ +- const struct fsg_operations *ops; + /* Gadget's private data. */ + void *private_data; + +@@ -2504,6 +2502,7 @@ static void handle_exception(struct fsg_common *common) + static int fsg_main_thread(void *common_) + { + struct fsg_common *common = common_; ++ int i; + + /* + * Allow the thread to be killed by a signal, but set the signal mask +@@ -2565,21 +2564,16 @@ static int fsg_main_thread(void *common_) + common->thread_task = NULL; + spin_unlock_irq(&common->lock); + +- if (!common->ops || !common->ops->thread_exits +- || common->ops->thread_exits(common) < 0) { +- int i; ++ /* Eject media from all LUNs */ + +- down_write(&common->filesem); +- for (i = 0; i < ARRAY_SIZE(common->luns); --i) { +- struct fsg_lun *curlun = common->luns[i]; +- if (!curlun || !fsg_lun_is_open(curlun)) +- continue; ++ down_write(&common->filesem); ++ for (i = 0; i < ARRAY_SIZE(common->luns); i++) { ++ struct fsg_lun *curlun = common->luns[i]; + ++ if (curlun && fsg_lun_is_open(curlun)) + fsg_lun_close(curlun); +- curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT; +- } +- up_write(&common->filesem); + } ++ up_write(&common->filesem); + + /* Let fsg_unbind() know the thread has exited */ + complete_and_exit(&common->thread_notifier, 0); +@@ -2785,13 +2779,6 @@ void fsg_common_remove_luns(struct fsg_common *common) + } + EXPORT_SYMBOL_GPL(fsg_common_remove_luns); + +-void fsg_common_set_ops(struct fsg_common *common, +- const struct fsg_operations *ops) +-{ +- common->ops = ops; +-} +-EXPORT_SYMBOL_GPL(fsg_common_set_ops); +- + void fsg_common_free_buffers(struct fsg_common *common) + { + _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); +diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h +index b6a9918eaefb..dfa2176f43c2 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.h ++++ b/drivers/usb/gadget/function/f_mass_storage.h +@@ -60,17 +60,6 @@ struct fsg_module_parameters { + struct fsg_common; + + /* FSF callback functions */ +-struct fsg_operations { +- /* +- * Callback function to call when thread exits. If no +- * callback is set or it returns value lower then zero MSF +- * will force eject all LUNs it operates on (including those +- * marked as non-removable or with prevent_medium_removal flag +- * set). +- */ +- int (*thread_exits)(struct fsg_common *common); +-}; +- + struct fsg_lun_opts { + struct config_group group; + struct fsg_lun *lun; +@@ -141,9 +130,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun); + + void fsg_common_remove_luns(struct fsg_common *common); + +-void fsg_common_set_ops(struct fsg_common *common, +- const struct fsg_operations *ops); +- + int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg, + unsigned int id, const char *name, + const char **name_pfx); +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 43ce2cfcdb4d..b6df47aa25af 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -27,7 +27,7 @@ + #include <linux/mmu_context.h> + #include <linux/aio.h> + #include <linux/uio.h> +- ++#include <linux/delay.h> + #include <linux/device.h> + #include <linux/moduleparam.h> + +@@ -116,6 +116,7 @@ enum ep0_state { + struct dev_data { + spinlock_t lock; + atomic_t count; ++ int udc_usage; + enum ep0_state state; /* P: lock */ + struct usb_gadgetfs_event event [N_EVENT]; + unsigned ev_next; +@@ -512,9 +513,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) + INIT_WORK(&priv->work, ep_user_copy_worker); + schedule_work(&priv->work); + } +- spin_unlock(&epdata->dev->lock); + + usb_ep_free_request(ep, req); ++ spin_unlock(&epdata->dev->lock); + put_ep(epdata); + } + +@@ -938,9 +939,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) + struct usb_request *req = dev->req; + + if ((retval = setup_req (ep, req, 0)) == 0) { ++ ++dev->udc_usage; + spin_unlock_irq (&dev->lock); + retval = usb_ep_queue (ep, req, GFP_KERNEL); + spin_lock_irq (&dev->lock); ++ --dev->udc_usage; + } + dev->state = STATE_DEV_CONNECTED; + +@@ -982,11 +985,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) + retval = -EIO; + else { + len = min (len, (size_t)dev->req->actual); +-// FIXME don't call this with the spinlock held ... ++ ++dev->udc_usage; ++ spin_unlock_irq(&dev->lock); + if (copy_to_user (buf, dev->req->buf, len)) + retval = -EFAULT; + else + retval = len; ++ spin_lock_irq(&dev->lock); ++ --dev->udc_usage; + clean_req (dev->gadget->ep0, dev->req); + /* NOTE userspace can't yet choose to stall */ + } +@@ -1130,6 +1136,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + retval = setup_req (dev->gadget->ep0, dev->req, len); + if (retval == 0) { + dev->state = STATE_DEV_CONNECTED; ++ ++dev->udc_usage; + spin_unlock_irq (&dev->lock); + if (copy_from_user (dev->req->buf, buf, len)) + retval = -EFAULT; +@@ -1140,10 +1147,10 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + dev->gadget->ep0, dev->req, + GFP_KERNEL); + } ++ spin_lock_irq(&dev->lock); ++ --dev->udc_usage; + if (retval < 0) { +- spin_lock_irq (&dev->lock); + clean_req (dev->gadget->ep0, dev->req); +- spin_unlock_irq (&dev->lock); + } else + retval = len; + +@@ -1240,9 +1247,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) + struct usb_gadget *gadget = dev->gadget; + long ret = -ENOTTY; + +- if (gadget->ops->ioctl) ++ spin_lock_irq(&dev->lock); ++ if (dev->state == STATE_DEV_OPENED || ++ dev->state == STATE_DEV_UNBOUND) { ++ /* Not bound to a UDC */ ++ } else if (gadget->ops->ioctl) { ++ ++dev->udc_usage; ++ spin_unlock_irq(&dev->lock); ++ + ret = gadget->ops->ioctl (gadget, code, value); + ++ spin_lock_irq(&dev->lock); ++ --dev->udc_usage; ++ } ++ spin_unlock_irq(&dev->lock); ++ + return ret; + } + +@@ -1460,10 +1479,12 @@ delegate: + if (value < 0) + break; + ++ ++dev->udc_usage; + spin_unlock (&dev->lock); + value = usb_ep_queue (gadget->ep0, dev->req, + GFP_KERNEL); + spin_lock (&dev->lock); ++ --dev->udc_usage; + if (value < 0) { + clean_req (gadget->ep0, dev->req); + break; +@@ -1487,8 +1508,12 @@ delegate: + req->length = value; + req->zero = value < w_length; + ++ ++dev->udc_usage; + spin_unlock (&dev->lock); + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); ++ spin_lock(&dev->lock); ++ --dev->udc_usage; ++ spin_unlock(&dev->lock); + if (value < 0) { + DBG (dev, "ep_queue --> %d\n", value); + req->status = 0; +@@ -1515,21 +1540,24 @@ static void destroy_ep_files (struct dev_data *dev) + /* break link to FS */ + ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); + list_del_init (&ep->epfiles); ++ spin_unlock_irq (&dev->lock); ++ + dentry = ep->dentry; + ep->dentry = NULL; + parent = d_inode(dentry->d_parent); + + /* break link to controller */ ++ mutex_lock(&ep->lock); + if (ep->state == STATE_EP_ENABLED) + (void) usb_ep_disable (ep->ep); + ep->state = STATE_EP_UNBOUND; + usb_ep_free_request (ep->ep, ep->req); + ep->ep = NULL; ++ mutex_unlock(&ep->lock); ++ + wake_up (&ep->wait); + put_ep (ep); + +- spin_unlock_irq (&dev->lock); +- + /* break link to dcache */ + mutex_lock (&parent->i_mutex); + d_delete (dentry); +@@ -1600,6 +1628,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) + + spin_lock_irq (&dev->lock); + dev->state = STATE_DEV_UNBOUND; ++ while (dev->udc_usage > 0) { ++ spin_unlock_irq(&dev->lock); ++ usleep_range(1000, 2000); ++ spin_lock_irq(&dev->lock); ++ } + spin_unlock_irq (&dev->lock); + + destroy_ep_files (dev); +diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c +index 99aa22c81770..b0099d7c3886 100644 +--- a/drivers/usb/gadget/legacy/mass_storage.c ++++ b/drivers/usb/gadget/legacy/mass_storage.c +@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS; + + FSG_MODULE_PARAMETERS(/* no prefix */, mod_data); + +-static unsigned long msg_registered; +-static void msg_cleanup(void); +- +-static int msg_thread_exits(struct fsg_common *common) +-{ +- msg_cleanup(); +- return 0; +-} +- + static int msg_do_config(struct usb_configuration *c) + { + struct fsg_opts *opts; +@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = { + + static int msg_bind(struct usb_composite_dev *cdev) + { +- static const struct fsg_operations ops = { +- .thread_exits = msg_thread_exits, +- }; + struct fsg_opts *opts; + struct fsg_config config; + int status; +@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev) + if (status) + goto fail; + +- fsg_common_set_ops(opts->common, &ops); +- + status = fsg_common_set_cdev(opts->common, cdev, config.can_stall); + if (status) + goto fail_set_cdev; +@@ -210,7 +196,6 @@ static int msg_bind(struct usb_composite_dev *cdev) + usb_composite_overwrite_options(cdev, &coverwrite); + dev_info(&cdev->gadget->dev, + DRIVER_DESC ", version: " DRIVER_VERSION "\n"); +- set_bit(0, &msg_registered); + return 0; + + fail_otg_desc: +@@ -261,9 +246,8 @@ static int __init msg_init(void) + } + module_init(msg_init); + +-static void msg_cleanup(void) ++static void __exit msg_cleanup(void) + { +- if (test_and_clear_bit(0, &msg_registered)) +- usb_composite_unregister(&msg_driver); ++ usb_composite_unregister(&msg_driver); + } + module_exit(msg_cleanup); +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index f92f5aff0dd5..585cb8734f50 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -28,6 +28,8 @@ + #include <asm/gpio.h> + + #include "atmel_usba_udc.h" ++#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ ++ | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING) + + #ifdef CONFIG_USB_GADGET_DEBUG_FS + #include <linux/debugfs.h> +@@ -2185,7 +2187,7 @@ static int usba_udc_probe(struct platform_device *pdev) + IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(&pdev->dev, + gpio_to_irq(udc->vbus_pin), NULL, +- usba_vbus_irq_thread, IRQF_ONESHOT, ++ usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, + "atmel_usba_udc", udc); + if (ret) { + udc->vbus_pin = -ENODEV; +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 64f404a1a072..db645c38055d 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -237,6 +237,8 @@ struct dummy_hcd { + + struct usb_device *udev; + struct list_head urbp_list; ++ struct urbp *next_frame_urbp; ++ + u32 stream_en_ep; + u8 num_stream[30 / 2]; + +@@ -253,11 +255,13 @@ struct dummy { + */ + struct dummy_ep ep[DUMMY_ENDPOINTS]; + int address; ++ int callback_usage; + struct usb_gadget gadget; + struct usb_gadget_driver *driver; + struct dummy_request fifo_req; + u8 fifo_buf[FIFO_SIZE]; + u16 devstatus; ++ unsigned ints_enabled:1; + unsigned udc_suspended:1; + unsigned pullup:1; + +@@ -440,18 +444,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) + (~dum_hcd->old_status) & dum_hcd->port_status; + + /* Report reset and disconnect events to the driver */ +- if (dum->driver && (disconnect || reset)) { ++ if (dum->ints_enabled && (disconnect || reset)) { + stop_activity(dum); ++ ++dum->callback_usage; ++ spin_unlock(&dum->lock); + if (reset) + usb_gadget_udc_reset(&dum->gadget, dum->driver); + else + dum->driver->disconnect(&dum->gadget); ++ spin_lock(&dum->lock); ++ --dum->callback_usage; + } +- } else if (dum_hcd->active != dum_hcd->old_active) { ++ } else if (dum_hcd->active != dum_hcd->old_active && ++ dum->ints_enabled) { ++ ++dum->callback_usage; ++ spin_unlock(&dum->lock); + if (dum_hcd->old_active && dum->driver->suspend) + dum->driver->suspend(&dum->gadget); + else if (!dum_hcd->old_active && dum->driver->resume) + dum->driver->resume(&dum->gadget); ++ spin_lock(&dum->lock); ++ --dum->callback_usage; + } + + dum_hcd->old_status = dum_hcd->port_status; +@@ -967,8 +980,11 @@ static int dummy_udc_start(struct usb_gadget *g, + * can't enumerate without help from the driver we're binding. + */ + ++ spin_lock_irq(&dum->lock); + dum->devstatus = 0; + dum->driver = driver; ++ dum->ints_enabled = 1; ++ spin_unlock_irq(&dum->lock); + + return 0; + } +@@ -979,6 +995,16 @@ static int dummy_udc_stop(struct usb_gadget *g) + struct dummy *dum = dum_hcd->dum; + + spin_lock_irq(&dum->lock); ++ dum->ints_enabled = 0; ++ stop_activity(dum); ++ ++ /* emulate synchronize_irq(): wait for callbacks to finish */ ++ while (dum->callback_usage > 0) { ++ spin_unlock_irq(&dum->lock); ++ usleep_range(1000, 2000); ++ spin_lock_irq(&dum->lock); ++ } ++ + dum->driver = NULL; + spin_unlock_irq(&dum->lock); + +@@ -1032,7 +1058,12 @@ static int dummy_udc_probe(struct platform_device *pdev) + memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); + dum->gadget.name = gadget_name; + dum->gadget.ops = &dummy_ops; +- dum->gadget.max_speed = USB_SPEED_SUPER; ++ if (mod_data.is_super_speed) ++ dum->gadget.max_speed = USB_SPEED_SUPER; ++ else if (mod_data.is_high_speed) ++ dum->gadget.max_speed = USB_SPEED_HIGH; ++ else ++ dum->gadget.max_speed = USB_SPEED_FULL; + + dum->gadget.dev.parent = &pdev->dev; + init_dummy_udc_hw(dum); +@@ -1241,6 +1272,8 @@ static int dummy_urb_enqueue( + + list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list); + urb->hcpriv = urbp; ++ if (!dum_hcd->next_frame_urbp) ++ dum_hcd->next_frame_urbp = urbp; + if (usb_pipetype(urb->pipe) == PIPE_CONTROL) + urb->error_count = 1; /* mark as a new urb */ + +@@ -1517,6 +1550,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) + if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ? + dum->ss_hcd : dum->hs_hcd))) + return NULL; ++ if (!dum->ints_enabled) ++ return NULL; + if ((address & ~USB_DIR_IN) == 0) + return &dum->ep[0]; + for (i = 1; i < DUMMY_ENDPOINTS; i++) { +@@ -1758,6 +1793,7 @@ static void dummy_timer(unsigned long _dum_hcd) + spin_unlock_irqrestore(&dum->lock, flags); + return; + } ++ dum_hcd->next_frame_urbp = NULL; + + for (i = 0; i < DUMMY_ENDPOINTS; i++) { + if (!ep_info[i].name) +@@ -1774,6 +1810,10 @@ restart: + int type; + int status = -EINPROGRESS; + ++ /* stop when we reach URBs queued after the timer interrupt */ ++ if (urbp == dum_hcd->next_frame_urbp) ++ break; ++ + urb = urbp->urb; + if (urb->unlinked) + goto return_urb; +@@ -1853,10 +1893,12 @@ restart: + * until setup() returns; no reentrancy issues etc. + */ + if (value > 0) { ++ ++dum->callback_usage; + spin_unlock(&dum->lock); + value = dum->driver->setup(&dum->gadget, + &setup); + spin_lock(&dum->lock); ++ --dum->callback_usage; + + if (value >= 0) { + /* no delays (max 64KB data stage) */ +@@ -2564,8 +2606,6 @@ static struct hc_driver dummy_hcd = { + .product_desc = "Dummy host controller", + .hcd_priv_size = sizeof(struct dummy_hcd), + +- .flags = HCD_USB3 | HCD_SHARED, +- + .reset = dummy_setup, + .start = dummy_start, + .stop = dummy_stop, +@@ -2594,8 +2634,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) + dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc); + dum = *((void **)dev_get_platdata(&pdev->dev)); + +- if (!mod_data.is_super_speed) ++ if (mod_data.is_super_speed) ++ dummy_hcd.flags = HCD_USB3 | HCD_SHARED; ++ else if (mod_data.is_high_speed) + dummy_hcd.flags = HCD_USB2; ++ else ++ dummy_hcd.flags = HCD_USB11; + hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev)); + if (!hs_hcd) + return -ENOMEM; +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 1fc6f478a02c..89e9494c3245 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -969,7 +969,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); + * + * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. + * It signals to the BIOS that the OS wants control of the host controller, +- * and then waits 5 seconds for the BIOS to hand over control. ++ * and then waits 1 second for the BIOS to hand over control. + * If we timeout, assume the BIOS is broken and take control anyway. + */ + static void quirk_usb_handoff_xhci(struct pci_dev *pdev) +@@ -1015,9 +1015,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) + if (val & XHCI_HC_BIOS_OWNED) { + writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); + +- /* Wait for 5 seconds with 10 microsecond polling interval */ ++ /* Wait for 1 second with 10 microsecond polling interval */ + timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, +- 0, 5000, 10); ++ 0, 1000000, 10); + + /* Assume a buggy BIOS and take HC ownership anyway */ + if (timeout) { +@@ -1046,7 +1046,7 @@ hc_init: + * operational or runtime registers. Wait 5 seconds and no more. + */ + timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0, +- 5000, 10); ++ 5000000, 10); + /* Assume a buggy HC and start HC initialization anyway */ + if (timeout) { + val = readl(op_reg_base + XHCI_STS_OFFSET); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index fc2ee6c272c4..1715705acc59 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1490,7 +1490,7 @@ struct xhci_bus_state { + + static inline unsigned int hcd_index(struct usb_hcd *hcd) + { +- if (hcd->speed == HCD_USB3) ++ if (hcd->speed >= HCD_USB3) + return 0; + else + return 1; +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index 36e5b5c530bd..d95cd1a72b66 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -285,11 +285,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, + struct usbhs_fifo *fifo) + { + struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); ++ int ret = 0; + +- if (!usbhs_pipe_is_dcp(pipe)) +- usbhsf_fifo_barrier(priv, fifo); ++ if (!usbhs_pipe_is_dcp(pipe)) { ++ /* ++ * This driver checks the pipe condition first to avoid -EBUSY ++ * from usbhsf_fifo_barrier() with about 10 msec delay in ++ * the interrupt handler if the pipe is RX direction and empty. ++ */ ++ if (usbhs_pipe_is_dir_in(pipe)) ++ ret = usbhs_pipe_is_accessible(pipe); ++ if (!ret) ++ ret = usbhsf_fifo_barrier(priv, fifo); ++ } + +- usbhs_write(priv, fifo->ctr, BCLR); ++ /* ++ * if non-DCP pipe, this driver should set BCLR when ++ * usbhsf_fifo_barrier() returns 0. ++ */ ++ if (!ret) ++ usbhs_write(priv, fifo->ctr, BCLR); + } + + static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv, +diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h +index f58caa9e6a27..a155cd02bce2 100644 +--- a/drivers/usb/storage/uas-detect.h ++++ b/drivers/usb/storage/uas-detect.h +@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) + intf->desc.bInterfaceProtocol == USB_PR_UAS); + } + +-static int uas_find_uas_alt_setting(struct usb_interface *intf) ++static struct usb_host_interface *uas_find_uas_alt_setting( ++ struct usb_interface *intf) + { + int i; + +@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) + struct usb_host_interface *alt = &intf->altsetting[i]; + + if (uas_is_interface(alt)) +- return alt->desc.bAlternateSetting; ++ return alt; + } + +- return -ENODEV; ++ return NULL; + } + + static int uas_find_endpoints(struct usb_host_interface *alt, +@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, + struct usb_device *udev = interface_to_usbdev(intf); + struct usb_hcd *hcd = bus_to_hcd(udev->bus); + unsigned long flags = id->driver_info; +- int r, alt; +- ++ struct usb_host_interface *alt; ++ int r; + + alt = uas_find_uas_alt_setting(intf); +- if (alt < 0) ++ if (!alt) + return 0; + +- r = uas_find_endpoints(&intf->altsetting[alt], eps); ++ r = uas_find_endpoints(alt, eps); + if (r < 0) + return 0; + +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index e26e32169a36..f952635ebe5f 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -849,14 +849,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); + static int uas_switch_interface(struct usb_device *udev, + struct usb_interface *intf) + { +- int alt; ++ struct usb_host_interface *alt; + + alt = uas_find_uas_alt_setting(intf); +- if (alt < 0) +- return alt; ++ if (!alt) ++ return -ENODEV; + +- return usb_set_interface(udev, +- intf->altsetting[0].desc.bInterfaceNumber, alt); ++ return usb_set_interface(udev, alt->desc.bInterfaceNumber, ++ alt->desc.bAlternateSetting); + } + + static int uas_configure_endpoints(struct uas_dev_info *devinfo) +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 640a2e2ec04d..fb96755550ec 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1379,6 +1379,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_SANE_SENSE ), + ++/* Reported by Kris Lindgren <kris.lindg...@gmail.com> */ ++UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, ++ "Seagate", ++ "External", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, + "Maxtor", + "USB to SATA", +diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c +index e75bbe5a10cd..1212b4b3c5a9 100644 +--- a/drivers/uwb/hwa-rc.c ++++ b/drivers/uwb/hwa-rc.c +@@ -827,6 +827,8 @@ static int hwarc_probe(struct usb_interface *iface, + + if (iface->cur_altsetting->desc.bNumEndpoints < 1) + return -ENODEV; ++ if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc)) ++ return -ENODEV; + + result = -ENOMEM; + uwb_rc = uwb_rc_alloc(); +diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c +index bdcb13cc1d54..5c9828370217 100644 +--- a/drivers/uwb/uwbd.c ++++ b/drivers/uwb/uwbd.c +@@ -303,18 +303,22 @@ static int uwbd(void *param) + /** Start the UWB daemon */ + void uwbd_start(struct uwb_rc *rc) + { +- rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); +- if (rc->uwbd.task == NULL) ++ struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); ++ if (IS_ERR(task)) { ++ rc->uwbd.task = NULL; + printk(KERN_ERR "UWB: Cannot start management daemon; " + "UWB won't work\n"); +- else ++ } else { ++ rc->uwbd.task = task; + rc->uwbd.pid = rc->uwbd.task->pid; ++ } + } + + /* Stop the UWB daemon and free any unprocessed events */ + void uwbd_stop(struct uwb_rc *rc) + { +- kthread_stop(rc->uwbd.task); ++ if (rc->uwbd.task) ++ kthread_stop(rc->uwbd.task); + uwbd_flush(rc); + } + +diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c +index c3fe1e323951..ea2ef0eac0c4 100644 +--- a/fs/ext4/acl.c ++++ b/fs/ext4/acl.c +@@ -195,13 +195,6 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type, + switch (type) { + case ACL_TYPE_ACCESS: + name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS; +- if (acl) { +- error = posix_acl_update_mode(inode, &inode->i_mode, &acl); +- if (error) +- return error; +- inode->i_ctime = ext4_current_time(inode); +- ext4_mark_inode_dirty(handle, inode); +- } + break; + + case ACL_TYPE_DEFAULT: +@@ -234,6 +227,8 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) + { + handle_t *handle; + int error, retries = 0; ++ umode_t mode = inode->i_mode; ++ int update_mode = 0; + + retry: + handle = ext4_journal_start(inode, EXT4_HT_XATTR, +@@ -241,7 +236,20 @@ retry: + if (IS_ERR(handle)) + return PTR_ERR(handle); + ++ if ((type == ACL_TYPE_ACCESS) && acl) { ++ error = posix_acl_update_mode(inode, &mode, &acl); ++ if (error) ++ goto out_stop; ++ update_mode = 1; ++ } ++ + error = __ext4_set_acl(handle, inode, type, acl); ++ if (!error && update_mode) { ++ inode->i_mode = mode; ++ inode->i_ctime = ext4_current_time(inode); ++ ext4_mark_inode_dirty(handle, inode); ++ } ++out_stop: + ext4_journal_stop(handle); + if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) + goto retry; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 1796d1bd9a1d..194a6baa4283 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1946,15 +1946,29 @@ static int ext4_writepage(struct page *page, + static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) + { + int len; +- loff_t size = i_size_read(mpd->inode); ++ loff_t size; + int err; + + BUG_ON(page->index != mpd->first_page); +- if (page->index == size >> PAGE_CACHE_SHIFT) +- len = size & ~PAGE_CACHE_MASK; +- else +- len = PAGE_CACHE_SIZE; + clear_page_dirty_for_io(page); ++ /* ++ * We have to be very careful here! Nothing protects writeback path ++ * against i_size changes and the page can be writeably mapped into ++ * page tables. So an application can be growing i_size and writing ++ * data through mmap while writeback runs. clear_page_dirty_for_io() ++ * write-protects our page in page tables and the page cannot get ++ * written to again until we release page lock. So only after ++ * clear_page_dirty_for_io() we are safe to sample i_size for ++ * ext4_bio_write_page() to zero-out tail of the written page. We rely ++ * on the barrier provided by TestClearPageDirty in ++ * clear_page_dirty_for_io() to make sure i_size is really sampled only ++ * after page tables are updated. ++ */ ++ size = i_size_read(mpd->inode); ++ if (page->index == size >> PAGE_SHIFT) ++ len = size & ~PAGE_MASK; ++ else ++ len = PAGE_SIZE; + err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false); + if (!err) + mpd->wbc->nr_to_write--; +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 1d007e853f5c..6445d84266fa 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3506,6 +3506,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + int credits; + u8 old_file_type; + ++ if ((ext4_encrypted_inode(old_dir) && ++ !ext4_has_encryption_key(old_dir)) || ++ (ext4_encrypted_inode(new_dir) && ++ !ext4_has_encryption_key(new_dir))) ++ return -ENOKEY; ++ + retval = dquot_initialize(old.dir); + if (retval) + return retval; +@@ -3706,6 +3712,12 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry, + u8 new_file_type; + int retval; + ++ if ((ext4_encrypted_inode(old_dir) && ++ !ext4_has_encryption_key(old_dir)) || ++ (ext4_encrypted_inode(new_dir) && ++ !ext4_has_encryption_key(new_dir))) ++ return -ENOKEY; ++ + if ((ext4_encrypted_inode(old_dir) || + ext4_encrypted_inode(new_dir)) && + (old_dir != new_dir) && +diff --git a/fs/xattr.c b/fs/xattr.c +index f0da9d24e9ca..76f01bf4b048 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -163,7 +163,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value, + } + memcpy(value, buffer, len); + out: +- security_release_secctx(buffer, len); ++ kfree(buffer); + out_noalloc: + return len; + } +diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h +index 8397dc235e84..ad98acfbcba8 100644 +--- a/include/linux/cpuset.h ++++ b/include/linux/cpuset.h +@@ -43,7 +43,9 @@ static inline void cpuset_dec(void) + + extern int cpuset_init(void); + extern void cpuset_init_smp(void); ++extern void cpuset_force_rebuild(void); + extern void cpuset_update_active_cpus(bool cpu_online); ++extern void cpuset_wait_for_hotplug(void); + extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask); + extern void cpuset_cpus_allowed_fallback(struct task_struct *p); + extern nodemask_t cpuset_mems_allowed(struct task_struct *p); +@@ -147,11 +149,15 @@ static inline bool cpusets_enabled(void) { return false; } + static inline int cpuset_init(void) { return 0; } + static inline void cpuset_init_smp(void) {} + ++static inline void cpuset_force_rebuild(void) { } ++ + static inline void cpuset_update_active_cpus(bool cpu_online) + { + partition_sched_domains(1, NULL, NULL); + } + ++static inline void cpuset_wait_for_hotplug(void) { } ++ + static inline void cpuset_cpus_allowed(struct task_struct *p, + struct cpumask *mask) + { +diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h +index e7fdec4db9da..6cc48ac55fd2 100644 +--- a/include/linux/iio/adc/ad_sigma_delta.h ++++ b/include/linux/iio/adc/ad_sigma_delta.h +@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, + int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, + unsigned int size, unsigned int *val); + ++int ad_sd_reset(struct ad_sigma_delta *sigma_delta, ++ unsigned int reset_length); ++ + int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, int *val); + int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta, +diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h +index 779a62aafafe..91ab75c1013c 100644 +--- a/include/uapi/linux/usb/ch9.h ++++ b/include/uapi/linux/usb/ch9.h +@@ -717,6 +717,7 @@ struct usb_interface_assoc_descriptor { + __u8 iFunction; + } __attribute__ ((packed)); + ++#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 + + /*-------------------------------------------------------------------------*/ + +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 2924b6faa469..dd3ae6ee064d 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2281,6 +2281,13 @@ retry: + mutex_unlock(&cpuset_mutex); + } + ++static bool force_rebuild; ++ ++void cpuset_force_rebuild(void) ++{ ++ force_rebuild = true; ++} ++ + /** + * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset + * +@@ -2355,8 +2362,10 @@ static void cpuset_hotplug_workfn(struct work_struct *work) + } + + /* rebuild sched domains if cpus_allowed has changed */ +- if (cpus_updated) ++ if (cpus_updated || force_rebuild) { ++ force_rebuild = false; + rebuild_sched_domains(); ++ } + } + + void cpuset_update_active_cpus(bool cpu_online) +@@ -2375,6 +2384,11 @@ void cpuset_update_active_cpus(bool cpu_online) + schedule_work(&cpuset_hotplug_work); + } + ++void cpuset_wait_for_hotplug(void) ++{ ++ flush_work(&cpuset_hotplug_work); ++} ++ + /* + * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY]. + * Call this routine anytime after node_states[N_MEMORY] changes. +diff --git a/kernel/power/process.c b/kernel/power/process.c +index 564f786df470..ba2029a02259 100644 +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -18,8 +18,9 @@ + #include <linux/workqueue.h> + #include <linux/kmod.h> + #include <trace/events/power.h> ++#include <linux/cpuset.h> + +-/* ++/* + * Timeout for stopping processes + */ + unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC; +@@ -198,6 +199,8 @@ void thaw_processes(void) + __usermodehelper_set_disable_depth(UMH_FREEZING); + thaw_workqueues(); + ++ cpuset_wait_for_hotplug(); ++ + read_lock(&tasklist_lock); + for_each_process_thread(g, p) { + /* No other threads should have PF_SUSPEND_TASK set */ +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index dece705b7f8c..b5d372083624 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7286,17 +7286,16 @@ static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action, + * operation in the resume sequence, just build a single sched + * domain, ignoring cpusets. + */ +- num_cpus_frozen--; +- if (likely(num_cpus_frozen)) { +- partition_sched_domains(1, NULL, NULL); ++ partition_sched_domains(1, NULL, NULL); ++ if (--num_cpus_frozen) + break; +- } + + /* + * This is the last CPU online operation. So fall through and + * restore the original sched domains by considering the + * cpuset configurations. + */ ++ cpuset_force_rebuild(); + + case CPU_ONLINE: + cpuset_update_active_cpus(true); +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 38d73a6e2857..fc0051fd672d 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4315,9 +4315,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata; + static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata; + static int ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer); + +-static unsigned long save_global_trampoline; +-static unsigned long save_global_flags; +- + static int __init set_graph_function(char *str) + { + strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE); +@@ -5907,17 +5904,6 @@ void unregister_ftrace_graph(void) + unregister_pm_notifier(&ftrace_suspend_notifier); + unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); + +-#ifdef CONFIG_DYNAMIC_FTRACE +- /* +- * Function graph does not allocate the trampoline, but +- * other global_ops do. We need to reset the ALLOC_TRAMP flag +- * if one was used. +- */ +- global_ops.trampoline = save_global_trampoline; +- if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP) +- global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP; +-#endif +- + out: + mutex_unlock(&ftrace_lock); + } +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 7c57c7fcf5a2..735a1a9386d6 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1459,7 +1459,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) + * @inode: the object + * @name: attribute name + * @buffer: where to put the result +- * @alloc: unused ++ * @alloc: duplicate memory + * + * Returns the size of the attribute or an error code + */ +@@ -1472,43 +1472,38 @@ static int smack_inode_getsecurity(const struct inode *inode, + struct super_block *sbp; + struct inode *ip = (struct inode *)inode; + struct smack_known *isp; +- int ilen; +- int rc = 0; + +- if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { ++ if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) + isp = smk_of_inode(inode); +- ilen = strlen(isp->smk_known); +- *buffer = isp->smk_known; +- return ilen; +- } ++ else { ++ /* ++ * The rest of the Smack xattrs are only on sockets. ++ */ ++ sbp = ip->i_sb; ++ if (sbp->s_magic != SOCKFS_MAGIC) ++ return -EOPNOTSUPP; + +- /* +- * The rest of the Smack xattrs are only on sockets. +- */ +- sbp = ip->i_sb; +- if (sbp->s_magic != SOCKFS_MAGIC) +- return -EOPNOTSUPP; ++ sock = SOCKET_I(ip); ++ if (sock == NULL || sock->sk == NULL) ++ return -EOPNOTSUPP; + +- sock = SOCKET_I(ip); +- if (sock == NULL || sock->sk == NULL) +- return -EOPNOTSUPP; +- +- ssp = sock->sk->sk_security; ++ ssp = sock->sk->sk_security; + +- if (strcmp(name, XATTR_SMACK_IPIN) == 0) +- isp = ssp->smk_in; +- else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) +- isp = ssp->smk_out; +- else +- return -EOPNOTSUPP; ++ if (strcmp(name, XATTR_SMACK_IPIN) == 0) ++ isp = ssp->smk_in; ++ else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) ++ isp = ssp->smk_out; ++ else ++ return -EOPNOTSUPP; ++ } + +- ilen = strlen(isp->smk_known); +- if (rc == 0) { +- *buffer = isp->smk_known; +- rc = ilen; ++ if (alloc) { ++ *buffer = kstrdup(isp->smk_known, GFP_KERNEL); ++ if (*buffer == NULL) ++ return -ENOMEM; + } + +- return rc; ++ return strlen(isp->smk_known); + } + + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index b554d7f9e3be..6163bf3e8177 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -872,14 +872,13 @@ static const struct file_operations snd_compr_file_ops = { + static int snd_compress_dev_register(struct snd_device *device) + { + int ret = -EINVAL; +- char str[16]; + struct snd_compr *compr; + + if (snd_BUG_ON(!device || !device->device_data)) + return -EBADFD; + compr = device->device_data; + +- pr_debug("reg %s for device %s, direction %d\n", str, compr->name, ++ pr_debug("reg device %s, direction %d\n", compr->name, + compr->direction); + /* register compressed device */ + ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS, +diff --git a/sound/usb/card.c b/sound/usb/card.c +index a1cbaa5f7fc9..83336bb6333e 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -217,6 +217,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) + struct usb_interface_descriptor *altsd; + void *control_header; + int i, protocol; ++ int rest_bytes; + + /* find audiocontrol interface */ + host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; +@@ -231,6 +232,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) + return -EINVAL; + } + ++ rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - ++ control_header; ++ ++ /* just to be sure -- this shouldn't hit at all */ ++ if (rest_bytes <= 0) { ++ dev_err(&dev->dev, "invalid control header\n"); ++ return -EINVAL; ++ } ++ + switch (protocol) { + default: + dev_warn(&dev->dev, +@@ -241,11 +251,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) + case UAC_VERSION_1: { + struct uac1_ac_header_descriptor *h1 = control_header; + ++ if (rest_bytes < sizeof(*h1)) { ++ dev_err(&dev->dev, "too short v1 buffer descriptor\n"); ++ return -EINVAL; ++ } ++ + if (!h1->bInCollection) { + dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); + return -EINVAL; + } + ++ if (rest_bytes < h1->bLength) { ++ dev_err(&dev->dev, "invalid buffer length (v1)\n"); ++ return -EINVAL; ++ } ++ + if (h1->bLength < sizeof(*h1) + h1->bInCollection) { + dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); + return -EINVAL; +diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c +index bf618e1500ac..e7b934f4d837 100644 +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, + } + + pg = get_order(read_size); +- sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); ++ sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| ++ __GFP_NOWARN, pg); + if (!sk->s) { + snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); + goto out; +@@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, + pg = get_order(write_size); + + sk->write_page = +- (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); ++ (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| ++ __GFP_NOWARN, pg); + if (!sk->write_page) { + snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); + usb_stream_free(sk);
