commit: 50b5973dba7e280fdff49b75c5e01b25f78ec68e Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Jan 16 23:33:48 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Jan 16 23:33:48 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=50b5973d
proj/linux-patches: Linux patch 4.20.3 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1002_linux-4.20.3.patch | 1927 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1931 insertions(+) diff --git a/0000_README b/0000_README index 0e0dc28..d6c119a 100644 --- a/0000_README +++ b/0000_README @@ -51,6 +51,10 @@ Patch: 1001_linux-4.20.2.patch From: http://www.kernel.org Desc: Linux 4.20.2 +Patch: 1002_linux-4.20.3.patch +From: http://www.kernel.org +Desc: Linux 4.20.3 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1002_linux-4.20.3.patch b/1002_linux-4.20.3.patch new file mode 100644 index 0000000..268cb43 --- /dev/null +++ b/1002_linux-4.20.3.patch @@ -0,0 +1,1927 @@ +diff --git a/Makefile b/Makefile +index 4ba3dd0bf35d..3b9e4658d31f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 20 +-SUBLEVEL = 2 ++SUBLEVEL = 3 + EXTRAVERSION = + NAME = Shy Crocodile + +diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c +index 7d8ab36ff83d..b3a3f5a59b5c 100644 +--- a/arch/arm/mach-davinci/board-da830-evm.c ++++ b/arch/arm/mach-davinci/board-da830-evm.c +@@ -207,9 +207,9 @@ static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 1 contains gpio range 32-63 */ +- GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_CD_PIN, "cd", ++ GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_CD_PIN, "cd", + GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_WP_PIN, "wp", ++ GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_WP_PIN, "wp", + GPIO_ACTIVE_LOW), + }, + }; +diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c +index e1a949b47306..bf2549e1894b 100644 +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -780,9 +780,9 @@ static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 2 contains gpio range 64-95 */ +- GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd", ++ GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_CD_PIN, "cd", + GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp", ++ GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_WP_PIN, "wp", + GPIO_ACTIVE_HIGH), + }, + }; +diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c +index f53a461a606f..f7fa960c23e3 100644 +--- a/arch/arm/mach-davinci/board-dm355-evm.c ++++ b/arch/arm/mach-davinci/board-dm355-evm.c +@@ -117,9 +117,9 @@ static struct platform_device davinci_nand_device = { + static struct gpiod_lookup_table i2c_recovery_gpiod_table = { + .dev_id = "i2c_davinci.1", + .table = { +- GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SDA_PIN, "sda", ++ GPIO_LOOKUP("davinci_gpio", DM355_I2C_SDA_PIN, "sda", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), +- GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SCL_PIN, "scl", ++ GPIO_LOOKUP("davinci_gpio", DM355_I2C_SCL_PIN, "scl", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), + }, + }; +diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c +index e4a8f9225d16..f752d828e42f 100644 +--- a/arch/arm/mach-davinci/board-dm644x-evm.c ++++ b/arch/arm/mach-davinci/board-dm644x-evm.c +@@ -638,9 +638,9 @@ static struct i2c_board_info __initdata i2c_info[] = { + static struct gpiod_lookup_table i2c_recovery_gpiod_table = { + .dev_id = "i2c_davinci.1", + .table = { +- GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SDA_PIN, "sda", ++ GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SDA_PIN, "sda", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), +- GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SCL_PIN, "scl", ++ GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SCL_PIN, "scl", + GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), + }, + }; +diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c +index 8e8d51f4a276..94c4f126ef86 100644 +--- a/arch/arm/mach-davinci/board-omapl138-hawk.c ++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c +@@ -134,9 +134,9 @@ static const short hawk_mmcsd0_pins[] = { + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { +- GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd", ++ GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_CD_PIN, "cd", + GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp", ++ GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_WP_PIN, "wp", + GPIO_ACTIVE_LOW), + }, + }; +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index fd59fef9931b..1355fab5f676 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn) + { + struct rt_sigframe __user *rt_sf; + struct pt_regs *regs = current_pt_regs(); ++ int tm_restore = 0; + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM + struct ucontext __user *uc_transact; + unsigned long msr_hi; + unsigned long tmp; +- int tm_restore = 0; + #endif + /* Always make any pending restarted system calls return -EINTR */ + current->restart_block.fn = do_no_restart_syscall; +@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn) + goto bad; + } + } +- if (!tm_restore) +- /* Fall through, for non-TM restore */ ++ if (!tm_restore) { ++ /* ++ * Unset regs->msr because ucontext MSR TS is not ++ * set, and recheckpoint was not called. This avoid ++ * hitting a TM Bad thing at RFID ++ */ ++ regs->msr &= ~MSR_TS_MASK; ++ } ++ /* Fall through, for non-TM restore */ + #endif +- if (do_setcontext(&rt_sf->uc, regs, 1)) +- goto bad; ++ if (!tm_restore) ++ if (do_setcontext(&rt_sf->uc, regs, 1)) ++ goto bad; + + /* + * It's not clear whether or why it is desirable to save the +diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c +index bbd1c73243d7..6f70d1b4bf36 100644 +--- a/arch/powerpc/kernel/signal_64.c ++++ b/arch/powerpc/kernel/signal_64.c +@@ -756,11 +756,23 @@ SYSCALL_DEFINE0(rt_sigreturn) + &uc_transact->uc_mcontext)) + goto badframe; + } +- else +- /* Fall through, for non-TM restore */ + #endif +- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext)) +- goto badframe; ++ /* Fall through, for non-TM restore */ ++ if (!MSR_TM_ACTIVE(msr)) { ++ /* ++ * Unset MSR[TS] on the thread regs since MSR from user ++ * context does not have MSR active, and recheckpoint was ++ * not called since restore_tm_sigcontexts() was not called ++ * also. ++ * ++ * If not unsetting it, the code can RFID to userspace with ++ * MSR[TS] set, but without CPU in the proper state, ++ * causing a TM bad thing. ++ */ ++ current->thread.regs->msr &= ~MSR_TS_MASK; ++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext)) ++ goto badframe; ++ } + + if (restore_altstack(&uc->uc_stack)) + goto badframe; +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 362f3cde6a31..7b135796813f 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -213,7 +213,7 @@ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init = + static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init = + SPECTRE_V2_USER_NONE; + +-#ifdef RETPOLINE ++#ifdef CONFIG_RETPOLINE + static bool spectre_v2_bad_module; + + bool retpoline_module_ok(bool has_retpoline) +diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c +index 70f4e80b9246..a1a22e9c0328 100644 +--- a/drivers/acpi/arm64/iort.c ++++ b/drivers/acpi/arm64/iort.c +@@ -951,9 +951,10 @@ static int rc_dma_get_range(struct device *dev, u64 *size) + { + struct acpi_iort_node *node; + struct acpi_iort_root_complex *rc; ++ struct pci_bus *pbus = to_pci_dev(dev)->bus; + + node = iort_scan_node(ACPI_IORT_NODE_PCI_ROOT_COMPLEX, +- iort_match_node_callback, dev); ++ iort_match_node_callback, &pbus->dev); + if (!node || node->revision < 1) + return -ENODEV; + +diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c +index 2579675b7082..e7c0006e6602 100644 +--- a/drivers/acpi/pmic/intel_pmic_xpower.c ++++ b/drivers/acpi/pmic/intel_pmic_xpower.c +@@ -20,8 +20,11 @@ + #define GPI1_LDO_ON (3 << 0) + #define GPI1_LDO_OFF (4 << 0) + +-#define AXP288_ADC_TS_PIN_GPADC 0xf2 +-#define AXP288_ADC_TS_PIN_ON 0xf3 ++#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0) ++#define AXP288_ADC_TS_CURRENT_OFF (0 << 0) ++#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0) ++#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0) ++#define AXP288_ADC_TS_CURRENT_ON (3 << 0) + + static struct pmic_table power_table[] = { + { +@@ -212,22 +215,44 @@ out: + */ + static int intel_xpower_pmic_get_raw_temp(struct regmap *regmap, int reg) + { ++ int ret, adc_ts_pin_ctrl; + u8 buf[2]; +- int ret; + +- ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, +- AXP288_ADC_TS_PIN_GPADC); ++ /* ++ * The current-source used for the battery temp-sensor (TS) is shared ++ * with the GPADC. For proper fuel-gauge and charger operation the TS ++ * current-source needs to be permanently on. But to read the GPADC we ++ * need to temporary switch the TS current-source to ondemand, so that ++ * the GPADC can use it, otherwise we will always read an all 0 value. ++ * ++ * Note that the switching from on to on-ondemand is not necessary ++ * when the TS current-source is off (this happens on devices which ++ * do not use the TS-pin). ++ */ ++ ret = regmap_read(regmap, AXP288_ADC_TS_PIN_CTRL, &adc_ts_pin_ctrl); + if (ret) + return ret; + +- /* After switching to the GPADC pin give things some time to settle */ +- usleep_range(6000, 10000); ++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) { ++ ret = regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL, ++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK, ++ AXP288_ADC_TS_CURRENT_ON_ONDEMAND); ++ if (ret) ++ return ret; ++ ++ /* Wait a bit after switching the current-source */ ++ usleep_range(6000, 10000); ++ } + + ret = regmap_bulk_read(regmap, AXP288_GP_ADC_H, buf, 2); + if (ret == 0) + ret = (buf[0] << 4) + ((buf[1] >> 4) & 0x0f); + +- regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON); ++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) { ++ regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL, ++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK, ++ AXP288_ADC_TS_CURRENT_ON); ++ } + + return ret; + } +diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c +index 1b475bc1ae16..665e93ca0b40 100644 +--- a/drivers/acpi/power.c ++++ b/drivers/acpi/power.c +@@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list) + } + } + ++static bool acpi_power_resource_is_dup(union acpi_object *package, ++ unsigned int start, unsigned int i) ++{ ++ acpi_handle rhandle, dup; ++ unsigned int j; ++ ++ /* The caller is expected to check the package element types */ ++ rhandle = package->package.elements[i].reference.handle; ++ for (j = start; j < i; j++) { ++ dup = package->package.elements[j].reference.handle; ++ if (dup == rhandle) ++ return true; ++ } ++ ++ return false; ++} ++ + int acpi_extract_power_resources(union acpi_object *package, unsigned int start, + struct list_head *list) + { +@@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start, + err = -ENODEV; + break; + } ++ ++ /* Some ACPI tables contain duplicate power resource references */ ++ if (acpi_power_resource_is_dup(package, start, i)) ++ continue; ++ + err = acpi_add_power_resource(rhandle); + if (err) + break; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 8e5140bbf241..1e92b61d0bd5 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5986,7 +5986,6 @@ static ssize_t do_rbd_remove(struct bus_type *bus, + struct list_head *tmp; + int dev_id; + char opt_buf[6]; +- bool already = false; + bool force = false; + int ret; + +@@ -6019,13 +6018,13 @@ static ssize_t do_rbd_remove(struct bus_type *bus, + spin_lock_irq(&rbd_dev->lock); + if (rbd_dev->open_count && !force) + ret = -EBUSY; +- else +- already = test_and_set_bit(RBD_DEV_FLAG_REMOVING, +- &rbd_dev->flags); ++ else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING, ++ &rbd_dev->flags)) ++ ret = -EINPROGRESS; + spin_unlock_irq(&rbd_dev->lock); + } + spin_unlock(&rbd_dev_list_lock); +- if (ret < 0 || already) ++ if (ret) + return ret; + + if (force) { +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 50b1551ba894..242c3370544e 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -52,9 +52,9 @@ scmi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index) + int ret; + struct scmi_data *priv = policy->driver_data; + struct scmi_perf_ops *perf_ops = handle->perf_ops; +- u64 freq = policy->freq_table[index].frequency * 1000; ++ u64 freq = policy->freq_table[index].frequency; + +- ret = perf_ops->freq_set(handle, priv->domain_id, freq, false); ++ ret = perf_ops->freq_set(handle, priv->domain_id, freq * 1000, false); + if (!ret) + arch_set_freq_scale(policy->related_cpus, freq, + policy->cpuinfo.max_freq); +@@ -176,7 +176,7 @@ static int scmi_cpufreq_init(struct cpufreq_policy *policy) + out_free_priv: + kfree(priv); + out_free_opp: +- dev_pm_opp_cpumask_remove_table(policy->cpus); ++ dev_pm_opp_remove_all_dynamic(cpu_dev); + + return ret; + } +@@ -188,7 +188,7 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy) + cpufreq_cooling_unregister(priv->cdev); + dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table); + kfree(priv); +- dev_pm_opp_cpumask_remove_table(policy->related_cpus); ++ dev_pm_opp_remove_all_dynamic(priv->cpu_dev); + + return 0; + } +diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c +index 87a98ec77773..99449738faa4 100644 +--- a/drivers/cpufreq/scpi-cpufreq.c ++++ b/drivers/cpufreq/scpi-cpufreq.c +@@ -177,7 +177,7 @@ out_free_cpufreq_table: + out_free_priv: + kfree(priv); + out_free_opp: +- dev_pm_opp_cpumask_remove_table(policy->cpus); ++ dev_pm_opp_remove_all_dynamic(cpu_dev); + + return ret; + } +@@ -190,7 +190,7 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy) + clk_put(priv->clk); + dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table); + kfree(priv); +- dev_pm_opp_cpumask_remove_table(policy->related_cpus); ++ dev_pm_opp_remove_all_dynamic(priv->cpu_dev); + + return 0; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 74b611e8a1b1..c79517dc8804 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -864,6 +864,7 @@ static const struct pci_device_id pciidlist[] = { + /* VEGAM */ + {0x1002, 0x694C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, + {0x1002, 0x694E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, ++ {0x1002, 0x694F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, + /* Vega 10 */ + {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10}, + {0x1002, 0x6861, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10}, +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 5a6edf65c9ea..3118ae0e7a87 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -645,22 +645,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend) + { + struct amdgpu_dm_connector *aconnector; + struct drm_connector *connector; ++ struct drm_dp_mst_topology_mgr *mgr; ++ int ret; ++ bool need_hotplug = false; + + drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); + +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { +- aconnector = to_amdgpu_dm_connector(connector); +- if (aconnector->dc_link->type == dc_connection_mst_branch && +- !aconnector->mst_port) { ++ list_for_each_entry(connector, &dev->mode_config.connector_list, ++ head) { ++ aconnector = to_amdgpu_dm_connector(connector); ++ if (aconnector->dc_link->type != dc_connection_mst_branch || ++ aconnector->mst_port) ++ continue; + +- if (suspend) +- drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr); +- else +- drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr); +- } ++ mgr = &aconnector->mst_mgr; ++ ++ if (suspend) { ++ drm_dp_mst_topology_mgr_suspend(mgr); ++ } else { ++ ret = drm_dp_mst_topology_mgr_resume(mgr); ++ if (ret < 0) { ++ drm_dp_mst_topology_mgr_set_mst(mgr, false); ++ need_hotplug = true; ++ } ++ } + } + + drm_modeset_unlock(&dev->mode_config.connection_mutex); ++ ++ if (need_hotplug) ++ drm_kms_helper_hotplug_event(dev); + } + + static int dm_hw_init(void *handle) +@@ -816,7 +830,6 @@ static int dm_resume(void *handle) + struct drm_plane_state *new_plane_state; + struct dm_plane_state *dm_new_plane_state; + enum dc_connection_type new_connection_type = dc_connection_none; +- int ret; + int i; + + /* power on hardware */ +@@ -889,13 +902,13 @@ static int dm_resume(void *handle) + } + } + +- ret = drm_atomic_helper_resume(ddev, dm->cached_state); ++ drm_atomic_helper_resume(ddev, dm->cached_state); + + dm->cached_state = NULL; + + amdgpu_dm_irq_resume_late(adev); + +- return ret; ++ return 0; + } + + static const struct amd_ip_funcs amdgpu_dm_funcs = { +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 5da2186b3615..5141c1401889 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2617,11 +2617,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option) + { + struct dc *core_dc = pipe_ctx->stream->ctx->dc; + ++ core_dc->hwss.blank_stream(pipe_ctx); ++ + if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) + deallocate_mst_payload(pipe_ctx); + +- core_dc->hwss.blank_stream(pipe_ctx); +- + core_dc->hwss.disable_stream(pipe_ctx, option); + + disable_link(pipe_ctx->stream->sink->link, pipe_ctx->stream->signal); +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index 9d64f874f965..b10ed61526a5 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1621,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1, + var_1->transp.msb_right == var_2->transp.msb_right; + } + ++static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var, ++ u8 depth) ++{ ++ switch (depth) { ++ case 8: ++ var->red.offset = 0; ++ var->green.offset = 0; ++ var->blue.offset = 0; ++ var->red.length = 8; /* 8bit DAC */ ++ var->green.length = 8; ++ var->blue.length = 8; ++ var->transp.offset = 0; ++ var->transp.length = 0; ++ break; ++ case 15: ++ var->red.offset = 10; ++ var->green.offset = 5; ++ var->blue.offset = 0; ++ var->red.length = 5; ++ var->green.length = 5; ++ var->blue.length = 5; ++ var->transp.offset = 15; ++ var->transp.length = 1; ++ break; ++ case 16: ++ var->red.offset = 11; ++ var->green.offset = 5; ++ var->blue.offset = 0; ++ var->red.length = 5; ++ var->green.length = 6; ++ var->blue.length = 5; ++ var->transp.offset = 0; ++ break; ++ case 24: ++ var->red.offset = 16; ++ var->green.offset = 8; ++ var->blue.offset = 0; ++ var->red.length = 8; ++ var->green.length = 8; ++ var->blue.length = 8; ++ var->transp.offset = 0; ++ var->transp.length = 0; ++ break; ++ case 32: ++ var->red.offset = 16; ++ var->green.offset = 8; ++ var->blue.offset = 0; ++ var->red.length = 8; ++ var->green.length = 8; ++ var->blue.length = 8; ++ var->transp.offset = 24; ++ var->transp.length = 8; ++ break; ++ default: ++ break; ++ } ++} ++ + /** + * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var + * @var: screeninfo to check +@@ -1650,6 +1708,20 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, + return -EINVAL; + } + ++ /* ++ * Workaround for SDL 1.2, which is known to be setting all pixel format ++ * fields values to zero in some cases. We treat this situation as a ++ * kind of "use some reasonable autodetected values". ++ */ ++ if (!var->red.offset && !var->green.offset && ++ !var->blue.offset && !var->transp.offset && ++ !var->red.length && !var->green.length && ++ !var->blue.length && !var->transp.length && ++ !var->red.msb_right && !var->green.msb_right && ++ !var->blue.msb_right && !var->transp.msb_right) { ++ drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); ++ } ++ + /* + * drm fbdev emulation doesn't support changing the pixel format at all, + * so reject all pixel format changing requests. +@@ -1961,59 +2033,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe + info->var.yoffset = 0; + info->var.activate = FB_ACTIVATE_NOW; + +- switch (fb->format->depth) { +- case 8: +- info->var.red.offset = 0; +- info->var.green.offset = 0; +- info->var.blue.offset = 0; +- info->var.red.length = 8; /* 8bit DAC */ +- info->var.green.length = 8; +- info->var.blue.length = 8; +- info->var.transp.offset = 0; +- info->var.transp.length = 0; +- break; +- case 15: +- info->var.red.offset = 10; +- info->var.green.offset = 5; +- info->var.blue.offset = 0; +- info->var.red.length = 5; +- info->var.green.length = 5; +- info->var.blue.length = 5; +- info->var.transp.offset = 15; +- info->var.transp.length = 1; +- break; +- case 16: +- info->var.red.offset = 11; +- info->var.green.offset = 5; +- info->var.blue.offset = 0; +- info->var.red.length = 5; +- info->var.green.length = 6; +- info->var.blue.length = 5; +- info->var.transp.offset = 0; +- break; +- case 24: +- info->var.red.offset = 16; +- info->var.green.offset = 8; +- info->var.blue.offset = 0; +- info->var.red.length = 8; +- info->var.green.length = 8; +- info->var.blue.length = 8; +- info->var.transp.offset = 0; +- info->var.transp.length = 0; +- break; +- case 32: +- info->var.red.offset = 16; +- info->var.green.offset = 8; +- info->var.blue.offset = 0; +- info->var.red.length = 8; +- info->var.green.length = 8; +- info->var.blue.length = 8; +- info->var.transp.offset = 24; +- info->var.transp.length = 8; +- break; +- default: +- break; +- } ++ drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth); + + info->var.xres = fb_width; + info->var.yres = fb_height; +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index 07999fe09ad2..4fa1d2b146b1 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -2117,6 +2117,7 @@ static struct i915_vma *pd_vma_create(struct gen6_hw_ppgtt *ppgtt, int size) + int gen6_ppgtt_pin(struct i915_hw_ppgtt *base) + { + struct gen6_hw_ppgtt *ppgtt = to_gen6_ppgtt(base); ++ int err; + + /* + * Workaround the limited maximum vma->pin_count and the aliasing_ppgtt +@@ -2132,9 +2133,17 @@ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base) + * allocator works in address space sizes, so it's multiplied by page + * size. We allocate at the top of the GTT to avoid fragmentation. + */ +- return i915_vma_pin(ppgtt->vma, +- 0, GEN6_PD_ALIGN, +- PIN_GLOBAL | PIN_HIGH); ++ err = i915_vma_pin(ppgtt->vma, ++ 0, GEN6_PD_ALIGN, ++ PIN_GLOBAL | PIN_HIGH); ++ if (err) ++ goto unpin; ++ ++ return 0; ++ ++unpin: ++ ppgtt->pin_count = 0; ++ return err; + } + + void gen6_ppgtt_unpin(struct i915_hw_ppgtt *base) +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index 1aca742fde4a..ccd76c71af09 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + data_arg.data); + } + case I2C_RETRIES: ++ if (arg > INT_MAX) ++ return -EINVAL; ++ + client->adapter->retries = arg; + break; + case I2C_TIMEOUT: ++ if (arg > INT_MAX) ++ return -EINVAL; ++ + /* For historical reasons, user-space sets the timeout + * value in units of 10 ms. + */ +diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c +index 699d3cf49c6d..7c42a57aca1f 100644 +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -2833,6 +2833,16 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc, + if (ret) + return ret; + ++ if (nandc->props->is_bam) { ++ free_bam_transaction(nandc); ++ nandc->bam_txn = alloc_bam_transaction(nandc); ++ if (!nandc->bam_txn) { ++ dev_err(nandc->dev, ++ "failed to allocate bam transaction\n"); ++ return -ENOMEM; ++ } ++ } ++ + ret = mtd_device_register(mtd, NULL, 0); + if (ret) + nand_cleanup(chip); +@@ -2847,16 +2857,6 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) + struct qcom_nand_host *host; + int ret; + +- if (nandc->props->is_bam) { +- free_bam_transaction(nandc); +- nandc->bam_txn = alloc_bam_transaction(nandc); +- if (!nandc->bam_txn) { +- dev_err(nandc->dev, +- "failed to allocate bam transaction\n"); +- return -ENOMEM; +- } +- } +- + for_each_available_child_of_node(dn, child) { + host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL); + if (!host) { +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 2c2df4e4fc14..9280f51f1ce6 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -951,11 +951,9 @@ void _opp_free(struct dev_pm_opp *opp) + kfree(opp); + } + +-static void _opp_kref_release(struct kref *kref) ++static void _opp_kref_release(struct dev_pm_opp *opp, ++ struct opp_table *opp_table) + { +- struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref); +- struct opp_table *opp_table = opp->opp_table; +- + /* + * Notify the changes in the availability of the operable + * frequency/voltage list. +@@ -964,7 +962,22 @@ static void _opp_kref_release(struct kref *kref) + opp_debug_remove_one(opp); + list_del(&opp->node); + kfree(opp); ++} + ++static void _opp_kref_release_unlocked(struct kref *kref) ++{ ++ struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref); ++ struct opp_table *opp_table = opp->opp_table; ++ ++ _opp_kref_release(opp, opp_table); ++} ++ ++static void _opp_kref_release_locked(struct kref *kref) ++{ ++ struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref); ++ struct opp_table *opp_table = opp->opp_table; ++ ++ _opp_kref_release(opp, opp_table); + mutex_unlock(&opp_table->lock); + } + +@@ -975,10 +988,16 @@ void dev_pm_opp_get(struct dev_pm_opp *opp) + + void dev_pm_opp_put(struct dev_pm_opp *opp) + { +- kref_put_mutex(&opp->kref, _opp_kref_release, &opp->opp_table->lock); ++ kref_put_mutex(&opp->kref, _opp_kref_release_locked, ++ &opp->opp_table->lock); + } + EXPORT_SYMBOL_GPL(dev_pm_opp_put); + ++static void dev_pm_opp_put_unlocked(struct dev_pm_opp *opp) ++{ ++ kref_put(&opp->kref, _opp_kref_release_unlocked); ++} ++ + /** + * dev_pm_opp_remove() - Remove an OPP from OPP table + * @dev: device for which we do this operation +@@ -1022,6 +1041,40 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) + } + EXPORT_SYMBOL_GPL(dev_pm_opp_remove); + ++/** ++ * dev_pm_opp_remove_all_dynamic() - Remove all dynamically created OPPs ++ * @dev: device for which we do this operation ++ * ++ * This function removes all dynamically created OPPs from the opp table. ++ */ ++void dev_pm_opp_remove_all_dynamic(struct device *dev) ++{ ++ struct opp_table *opp_table; ++ struct dev_pm_opp *opp, *temp; ++ int count = 0; ++ ++ opp_table = _find_opp_table(dev); ++ if (IS_ERR(opp_table)) ++ return; ++ ++ mutex_lock(&opp_table->lock); ++ list_for_each_entry_safe(opp, temp, &opp_table->opp_list, node) { ++ if (opp->dynamic) { ++ dev_pm_opp_put_unlocked(opp); ++ count++; ++ } ++ } ++ mutex_unlock(&opp_table->lock); ++ ++ /* Drop the references taken by dev_pm_opp_add() */ ++ while (count--) ++ dev_pm_opp_put_opp_table(opp_table); ++ ++ /* Drop the reference taken by _find_opp_table() */ ++ dev_pm_opp_put_opp_table(opp_table); ++} ++EXPORT_SYMBOL_GPL(dev_pm_opp_remove_all_dynamic); ++ + struct dev_pm_opp *_opp_allocate(struct opp_table *table) + { + struct dev_pm_opp *opp; +diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c +index 29a05759a294..0fa9e8fdce66 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -99,9 +99,6 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp) + (i * MAX_MSI_IRQS_PER_CTRL) + + pos); + generic_handle_irq(irq); +- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + +- (i * MSI_REG_CTRL_BLOCK_SIZE), +- 4, 1 << pos); + pos++; + } + } +@@ -168,8 +165,8 @@ static void dw_pci_bottom_mask(struct irq_data *data) + bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL; + + pp->irq_status[ctrl] &= ~(1 << bit); +- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4, +- pp->irq_status[ctrl]); ++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4, ++ ~pp->irq_status[ctrl]); + } + + raw_spin_unlock_irqrestore(&pp->lock, flags); +@@ -191,8 +188,8 @@ static void dw_pci_bottom_unmask(struct irq_data *data) + bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL; + + pp->irq_status[ctrl] |= 1 << bit; +- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4, +- pp->irq_status[ctrl]); ++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4, ++ ~pp->irq_status[ctrl]); + } + + raw_spin_unlock_irqrestore(&pp->lock, flags); +@@ -200,13 +197,22 @@ static void dw_pci_bottom_unmask(struct irq_data *data) + + static void dw_pci_bottom_ack(struct irq_data *d) + { +- struct msi_desc *msi = irq_data_get_msi_desc(d); +- struct pcie_port *pp; ++ struct pcie_port *pp = irq_data_get_irq_chip_data(d); ++ unsigned int res, bit, ctrl; ++ unsigned long flags; ++ ++ ctrl = d->hwirq / MAX_MSI_IRQS_PER_CTRL; ++ res = ctrl * MSI_REG_CTRL_BLOCK_SIZE; ++ bit = d->hwirq % MAX_MSI_IRQS_PER_CTRL; ++ ++ raw_spin_lock_irqsave(&pp->lock, flags); + +- pp = msi_desc_to_pci_sysdata(msi); ++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + res, 4, 1 << bit); + + if (pp->ops->msi_irq_ack) + pp->ops->msi_irq_ack(d->hwirq, pp); ++ ++ raw_spin_unlock_irqrestore(&pp->lock, flags); + } + + static struct irq_chip dw_pci_msi_bottom_irq_chip = { +@@ -658,10 +664,15 @@ void dw_pcie_setup_rc(struct pcie_port *pp) + num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL; + + /* Initialize IRQ Status array */ +- for (ctrl = 0; ctrl < num_ctrls; ctrl++) +- dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_ENABLE + ++ for (ctrl = 0; ctrl < num_ctrls; ctrl++) { ++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + + (ctrl * MSI_REG_CTRL_BLOCK_SIZE), +- 4, &pp->irq_status[ctrl]); ++ 4, ~0); ++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + ++ (ctrl * MSI_REG_CTRL_BLOCK_SIZE), ++ 4, ~0); ++ pp->irq_status[ctrl] = 0; ++ } + + /* Setup RC BARs */ + dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 0x00000004); +diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c +index f7407632e80b..bab96c870042 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_security.c ++++ b/drivers/staging/rtl8188eu/core/rtw_security.c +@@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe) + + pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset; + +- crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep"); ++ crypto_ops = lib80211_get_crypto_ops("WEP"); + + if (!crypto_ops) + return; +@@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) + void *crypto_private = NULL; + int status = _SUCCESS; + const int keyindex = prxattrib->key_index; +- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep"); ++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP"); + char iv[4], icv[4]; + + if (!crypto_ops) { +@@ -1291,7 +1291,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe) + struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt; + void *crypto_private = NULL; + u8 *key, *pframe = skb->data; +- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp"); ++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP"); + struct security_priv *psecuritypriv = &padapter->securitypriv; + char iv[8], icv[8]; + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index ed8c62b2d9d1..739f8960811a 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1865,6 +1865,13 @@ static const struct usb_device_id acm_ids[] = { + .driver_info = IGNORE_DEVICE, + }, + ++ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ ++ .driver_info = SEND_ZERO_PACKET, ++ }, ++ { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */ ++ .driver_info = SEND_ZERO_PACKET, ++ }, ++ + /* control interfaces without any protocol set */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, + USB_CDC_PROTO_NONE) }, +diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c +index 356b05c82dbc..f713cecc1f41 100644 +--- a/drivers/usb/core/generic.c ++++ b/drivers/usb/core/generic.c +@@ -143,9 +143,12 @@ int usb_choose_configuration(struct usb_device *udev) + continue; + } + +- if (i > 0 && desc && is_audio(desc) && is_uac3_config(desc)) { +- best = c; +- break; ++ if (i > 0 && desc && is_audio(desc)) { ++ if (is_uac3_config(desc)) { ++ best = c; ++ break; ++ } ++ continue; + } + + /* From the remaining configs, choose the first one whose +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 514c5214ddb2..8bc35d53408b 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET }, + + /* Corsair K70 RGB */ +- { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, + + /* Corsair Strafe */ + { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT | +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index e227bb5b794f..101ebac43c87 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev) + if (!(us->fflags & US_FL_NEEDS_CAP16)) + sdev->try_rc_10_first = 1; + +- /* assume SPC3 or latter devices support sense size > 18 */ +- if (sdev->scsi_level > SCSI_SPC_2) ++ /* ++ * assume SPC3 or latter devices support sense size > 18 ++ * unless US_FL_BAD_SENSE quirk is specified. ++ */ ++ if (sdev->scsi_level > SCSI_SPC_2 && ++ !(us->fflags & US_FL_BAD_SENSE)) + us->fflags |= US_FL_SANE_SENSE; + + /* +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index f7f83b21dc74..ea0d27a94afe 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* ++ * Reported by Icenowy Zheng <icen...@aosc.io> ++ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state ++ * that do not process read/write command if a long sense is requested, ++ * so force to use 18-byte sense. ++ */ ++UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff, ++ "SMI", ++ "SM3350 UFS-to-USB-Mass-Storage bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BAD_SENSE ), ++ + /* + * Reported by Paul Hartman <paul.hartman+li...@gmail.com> + * This card reader returns "Illegal Request, Logical Block Address +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index d9fd3188615d..64cbc2d007c9 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu, + return -EINVAL; + if (!unmap->size || unmap->size & mask) + return -EINVAL; +- if (unmap->iova + unmap->size < unmap->iova || ++ if (unmap->iova + unmap->size - 1 < unmap->iova || + unmap->size > SIZE_MAX) + return -EINVAL; + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 99e7645ad94e..47f1183b3dbe 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1015,19 +1015,21 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, + parent_start = parent->start; + + /* +- * If we are COWing a node/leaf from the extent, chunk or device trees, +- * make sure that we do not finish block group creation of pending block +- * groups. We do this to avoid a deadlock. ++ * If we are COWing a node/leaf from the extent, chunk, device or free ++ * space trees, make sure that we do not finish block group creation of ++ * pending block groups. We do this to avoid a deadlock. + * COWing can result in allocation of a new chunk, and flushing pending + * block groups (btrfs_create_pending_block_groups()) can be triggered + * when finishing allocation of a new chunk. Creation of a pending block +- * group modifies the extent, chunk and device trees, therefore we could +- * deadlock with ourselves since we are holding a lock on an extent +- * buffer that btrfs_create_pending_block_groups() may try to COW later. ++ * group modifies the extent, chunk, device and free space trees, ++ * therefore we could deadlock with ourselves since we are holding a ++ * lock on an extent buffer that btrfs_create_pending_block_groups() may ++ * try to COW later. + */ + if (root == fs_info->extent_root || + root == fs_info->chunk_root || +- root == fs_info->dev_root) ++ root == fs_info->dev_root || ++ root == fs_info->free_space_root) + trans->can_flush_pending_bgs = false; + + cow = btrfs_alloc_tree_block(trans, root, parent_start, +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index f70825af6438..9e419f6878c5 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1013,16 +1013,22 @@ out_add_root: + btrfs_abort_transaction(trans, ret); + goto out_free_path; + } +- spin_lock(&fs_info->qgroup_lock); +- fs_info->quota_root = quota_root; +- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); +- spin_unlock(&fs_info->qgroup_lock); + + ret = btrfs_commit_transaction(trans); + trans = NULL; + if (ret) + goto out_free_path; + ++ /* ++ * Set quota enabled flag after committing the transaction, to avoid ++ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot ++ * creation. ++ */ ++ spin_lock(&fs_info->qgroup_lock); ++ fs_info->quota_root = quota_root; ++ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); ++ spin_unlock(&fs_info->qgroup_lock); ++ + ret = qgroup_rescan_init(fs_info, 0, 1); + if (!ret) { + qgroup_rescan_zero_tracking(fs_info); +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index f435d397019e..c872adfc939e 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3724,6 +3724,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, + int ret; + u64 num_devices; + unsigned seq; ++ bool reducing_integrity; + + if (btrfs_fs_closing(fs_info) || + atomic_read(&fs_info->balance_pause_req) || +@@ -3803,24 +3804,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, + !(bctl->sys.target & allowed)) || + ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) && + (fs_info->avail_metadata_alloc_bits & allowed) && +- !(bctl->meta.target & allowed))) { +- if (bctl->flags & BTRFS_BALANCE_FORCE) { +- btrfs_info(fs_info, +- "balance: force reducing metadata integrity"); +- } else { +- btrfs_err(fs_info, +- "balance: reduces metadata integrity, use --force if you want this"); +- ret = -EINVAL; +- goto out; +- } +- } ++ !(bctl->meta.target & allowed))) ++ reducing_integrity = true; ++ else ++ reducing_integrity = false; ++ ++ /* if we're not converting, the target field is uninitialized */ ++ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ? ++ bctl->meta.target : fs_info->avail_metadata_alloc_bits; ++ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ? ++ bctl->data.target : fs_info->avail_data_alloc_bits; + } while (read_seqretry(&fs_info->profiles_lock, seq)); + +- /* if we're not converting, the target field is uninitialized */ +- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ? +- bctl->meta.target : fs_info->avail_metadata_alloc_bits; +- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ? +- bctl->data.target : fs_info->avail_data_alloc_bits; ++ if (reducing_integrity) { ++ if (bctl->flags & BTRFS_BALANCE_FORCE) { ++ btrfs_info(fs_info, ++ "balance: force reducing metadata integrity"); ++ } else { ++ btrfs_err(fs_info, ++ "balance: reduces metadata integrity, use --force if you want this"); ++ ret = -EINVAL; ++ goto out; ++ } ++ } ++ + if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) < + btrfs_get_num_tolerated_disk_barrier_failures(data_target)) { + int meta_index = btrfs_bg_flags_to_raid_index(meta_target); +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index ea78c3d6dcfc..f141b45ce349 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -11,6 +11,7 @@ + #include <linux/security.h> + #include <linux/posix_acl_xattr.h> + #include <linux/iversion.h> ++#include <linux/sched/mm.h> + #include "ctree.h" + #include "btrfs_inode.h" + #include "transaction.h" +@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode, + { + const struct xattr *xattr; + struct btrfs_trans_handle *trans = fs_info; ++ unsigned int nofs_flag; + char *name; + int err = 0; + ++ /* ++ * We're holding a transaction handle, so use a NOFS memory allocation ++ * context to avoid deadlock if reclaim happens. ++ */ ++ nofs_flag = memalloc_nofs_save(); + for (xattr = xattr_array; xattr->name != NULL; xattr++) { + name = kmalloc(XATTR_SECURITY_PREFIX_LEN + + strlen(xattr->name) + 1, GFP_KERNEL); +@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode, + if (err < 0) + break; + } ++ memalloc_nofs_restore(nofs_flag); + return err; + } + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index c23bf9da93d2..d5c3e0725849 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1131,10 +1131,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) + + /* + * Accessing maxBuf is racy with cifs_reconnect - need to store value +- * and check it for zero before using. ++ * and check it before using. + */ + max_buf = tcon->ses->server->maxBuf; +- if (!max_buf) { ++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) { + free_xid(xid); + return -EINVAL; + } +@@ -1471,10 +1471,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + + /* + * Accessing maxBuf is racy with cifs_reconnect - need to store value +- * and check it for zero before using. ++ * and check it before using. + */ + max_buf = tcon->ses->server->maxBuf; +- if (!max_buf) ++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) + return -EINVAL; + + max_num = (max_buf - sizeof(struct smb_hdr)) / +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 8a41f4eba726..6f33253938cd 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -111,21 +111,27 @@ struct cifs_tcon * + tconInfoAlloc(void) + { + struct cifs_tcon *ret_buf; +- ret_buf = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL); +- if (ret_buf) { +- atomic_inc(&tconInfoAllocCount); +- ret_buf->tidStatus = CifsNew; +- ++ret_buf->tc_count; +- INIT_LIST_HEAD(&ret_buf->openFileList); +- INIT_LIST_HEAD(&ret_buf->tcon_list); +- spin_lock_init(&ret_buf->open_file_lock); +- mutex_init(&ret_buf->crfid.fid_mutex); +- ret_buf->crfid.fid = kzalloc(sizeof(struct cifs_fid), +- GFP_KERNEL); +- spin_lock_init(&ret_buf->stat_lock); +- atomic_set(&ret_buf->num_local_opens, 0); +- atomic_set(&ret_buf->num_remote_opens, 0); ++ ++ ret_buf = kzalloc(sizeof(*ret_buf), GFP_KERNEL); ++ if (!ret_buf) ++ return NULL; ++ ret_buf->crfid.fid = kzalloc(sizeof(*ret_buf->crfid.fid), GFP_KERNEL); ++ if (!ret_buf->crfid.fid) { ++ kfree(ret_buf); ++ return NULL; + } ++ ++ atomic_inc(&tconInfoAllocCount); ++ ret_buf->tidStatus = CifsNew; ++ ++ret_buf->tc_count; ++ INIT_LIST_HEAD(&ret_buf->openFileList); ++ INIT_LIST_HEAD(&ret_buf->tcon_list); ++ spin_lock_init(&ret_buf->open_file_lock); ++ mutex_init(&ret_buf->crfid.fid_mutex); ++ spin_lock_init(&ret_buf->stat_lock); ++ atomic_set(&ret_buf->num_local_opens, 0); ++ atomic_set(&ret_buf->num_remote_opens, 0); ++ + return ret_buf; + } + +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index 4ed10dd086e6..2fc3d31967ee 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -122,10 +122,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + + /* + * Accessing maxBuf is racy with cifs_reconnect - need to store value +- * and check it for zero before using. ++ * and check it before using. + */ + max_buf = tcon->ses->server->maxBuf; +- if (!max_buf) ++ if (max_buf < sizeof(struct smb2_lock_element)) + return -EINVAL; + + max_num = max_buf / sizeof(struct smb2_lock_element); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 27f86537a5d1..836c59fca049 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3197,12 +3197,14 @@ smb2_async_readv(struct cifs_readdata *rdata) + if (rdata->credits) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = shdr->CreditCharge; ++ shdr->CreditRequest = ++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); + spin_lock(&server->req_lock); + server->credits += rdata->credits - + le16_to_cpu(shdr->CreditCharge); + spin_unlock(&server->req_lock); + wake_up(&server->request_q); ++ rdata->credits = le16_to_cpu(shdr->CreditCharge); + flags |= CIFS_HAS_CREDITS; + } + +@@ -3474,12 +3476,14 @@ smb2_async_writev(struct cifs_writedata *wdata, + if (wdata->credits) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = shdr->CreditCharge; ++ shdr->CreditRequest = ++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); + spin_lock(&server->req_lock); + server->credits += wdata->credits - + le16_to_cpu(shdr->CreditCharge); + spin_unlock(&server->req_lock); + wake_up(&server->request_q); ++ wdata->credits = le16_to_cpu(shdr->CreditCharge); + flags |= CIFS_HAS_CREDITS; + } + +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 83ff0c25710d..d51064c1ba42 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -385,7 +385,7 @@ smbd_done: + if (rc < 0 && rc != -EINTR) + cifs_dbg(VFS, "Error %d sending data on socket to server\n", + rc); +- else ++ else if (rc > 0) + rc = 0; + + return rc; +@@ -793,7 +793,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + int i, j, rc = 0; + int timeout, optype; + struct mid_q_entry *midQ[MAX_COMPOUND]; +- unsigned int credits = 0; ++ bool cancelled_mid[MAX_COMPOUND] = {false}; ++ unsigned int credits[MAX_COMPOUND] = {0}; + char *buf; + + timeout = flags & CIFS_TIMEOUT_MASK; +@@ -811,13 +812,31 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + return -ENOENT; + + /* +- * Ensure that we do not send more than 50 overlapping requests +- * to the same server. We may make this configurable later or +- * use ses->maxReq. ++ * Ensure we obtain 1 credit per request in the compound chain. ++ * It can be optimized further by waiting for all the credits ++ * at once but this can wait long enough if we don't have enough ++ * credits due to some heavy operations in progress or the server ++ * not granting us much, so a fallback to the current approach is ++ * needed anyway. + */ +- rc = wait_for_free_request(ses->server, timeout, optype); +- if (rc) +- return rc; ++ for (i = 0; i < num_rqst; i++) { ++ rc = wait_for_free_request(ses->server, timeout, optype); ++ if (rc) { ++ /* ++ * We haven't sent an SMB packet to the server yet but ++ * we already obtained credits for i requests in the ++ * compound chain - need to return those credits back ++ * for future use. Note that we need to call add_credits ++ * multiple times to match the way we obtained credits ++ * in the first place and to account for in flight ++ * requests correctly. ++ */ ++ for (j = 0; j < i; j++) ++ add_credits(ses->server, 1, optype); ++ return rc; ++ } ++ credits[i] = 1; ++ } + + /* + * Make sure that we sign in the same order that we send on this socket +@@ -833,8 +852,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + for (j = 0; j < i; j++) + cifs_delete_mid(midQ[j]); + mutex_unlock(&ses->server->srv_mutex); ++ + /* Update # of requests on wire to server */ +- add_credits(ses->server, 1, optype); ++ for (j = 0; j < num_rqst; j++) ++ add_credits(ses->server, credits[j], optype); + return PTR_ERR(midQ[i]); + } + +@@ -881,19 +902,16 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + midQ[i]->mid_flags |= MID_WAIT_CANCELLED; + midQ[i]->callback = DeleteMidQEntry; +- spin_unlock(&GlobalMid_Lock); +- add_credits(ses->server, 1, optype); +- return rc; ++ cancelled_mid[i] = true; + } + spin_unlock(&GlobalMid_Lock); + } + } + + for (i = 0; i < num_rqst; i++) +- if (midQ[i]->resp_buf) +- credits += ses->server->ops->get_credits(midQ[i]); +- if (!credits) +- credits = 1; ++ if (!cancelled_mid[i] && midQ[i]->resp_buf ++ && (midQ[i]->mid_state == MID_RESPONSE_RECEIVED)) ++ credits[i] = ses->server->ops->get_credits(midQ[i]); + + for (i = 0; i < num_rqst; i++) { + if (rc < 0) +@@ -901,8 +919,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + + rc = cifs_sync_mid_result(midQ[i], ses->server); + if (rc != 0) { +- add_credits(ses->server, credits, optype); +- return rc; ++ /* mark this mid as cancelled to not free it below */ ++ cancelled_mid[i] = true; ++ goto out; + } + + if (!midQ[i]->resp_buf || +@@ -949,9 +968,11 @@ out: + * This is prevented above by using a noop callback that will not + * wake this thread except for the very last PDU. + */ +- for (i = 0; i < num_rqst; i++) +- cifs_delete_mid(midQ[i]); +- add_credits(ses->server, credits, optype); ++ for (i = 0; i < num_rqst; i++) { ++ if (!cancelled_mid[i]) ++ cifs_delete_mid(midQ[i]); ++ add_credits(ses->server, credits[i], optype); ++ } + + return rc; + } +diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c +index 26a7fe5c4fd3..712f00995390 100644 +--- a/fs/ext4/fsync.c ++++ b/fs/ext4/fsync.c +@@ -116,8 +116,16 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + goto out; + } + ++ ret = file_write_and_wait_range(file, start, end); ++ if (ret) ++ return ret; ++ + if (!journal) { +- ret = __generic_file_fsync(file, start, end, datasync); ++ struct writeback_control wbc = { ++ .sync_mode = WB_SYNC_ALL ++ }; ++ ++ ret = ext4_write_inode(inode, &wbc); + if (!ret) + ret = ext4_sync_parent(inode); + if (test_opt(inode->i_sb, BARRIER)) +@@ -125,9 +133,6 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + goto out; + } + +- ret = file_write_and_wait_range(file, start, end); +- if (ret) +- return ret; + /* + * data=writeback,ordered: + * The caller's filemap_fdatawrite()/wait will sync the data. +@@ -159,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + ret = err; + } + out: ++ err = file_check_and_advance_wb_err(file); ++ if (ret == 0) ++ ret = err; + trace_ext4_sync_file_exit(inode, ret); + return ret; + } +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 27373d88b5f0..56f6e1782d5f 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -1890,12 +1890,12 @@ int ext4_inline_data_fiemap(struct inode *inode, + physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data; + physical += offsetof(struct ext4_inode, i_block); + +- if (physical) +- error = fiemap_fill_next_extent(fieinfo, start, physical, +- inline_len, flags); + brelse(iloc.bh); + out: + up_read(&EXT4_I(inode)->xattr_sem); ++ if (physical) ++ error = fiemap_fill_next_extent(fieinfo, start, physical, ++ inline_len, flags); + return (error < 0 ? error : 0); + } + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 9affabd07682..34d7e0703cc6 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2778,7 +2778,8 @@ static int ext4_writepages(struct address_space *mapping, + * We may need to convert up to one extent per block in + * the page and we may dirty the inode. + */ +- rsv_blocks = 1 + (PAGE_SIZE >> inode->i_blkbits); ++ rsv_blocks = 1 + ext4_chunk_trans_blocks(inode, ++ PAGE_SIZE >> inode->i_blkbits); + } + + /* +@@ -4833,7 +4834,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + gid_t i_gid; + projid_t i_projid; + +- if (((flags & EXT4_IGET_NORMAL) && ++ if ((!(flags & EXT4_IGET_SPECIAL) && + (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || + (ino < EXT4_ROOT_INO) || + (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 6641a1b8a6a5..521320de2017 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4905,7 +4905,7 @@ static int ext4_commit_super(struct super_block *sb, int sync) + ext4_superblock_csum_set(sb); + if (sync) + lock_buffer(sbh); +- if (buffer_write_io_error(sbh)) { ++ if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) { + /* + * Oh, dear. A previous attempt to write the + * superblock failed. This could happen because the +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 2010493e1040..977ddf2774f9 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -68,7 +68,7 @@ + */ + #define uninitialized_var(x) x = x + +-#ifdef RETPOLINE ++#ifdef CONFIG_RETPOLINE + #define __noretpoline __attribute__((__indirect_branch__("keep"))) + #endif + +diff --git a/include/linux/module.h b/include/linux/module.h +index fce6b4335e36..0c575f51fe57 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -817,7 +817,7 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr, + static inline void module_bug_cleanup(struct module *mod) {} + #endif /* CONFIG_GENERIC_BUG */ + +-#ifdef RETPOLINE ++#ifdef CONFIG_RETPOLINE + extern bool retpoline_module_ok(bool has_retpoline); + #else + static inline bool retpoline_module_ok(bool has_retpoline) +diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h +index 5d399eeef172..f4f8840eab04 100644 +--- a/include/linux/pm_opp.h ++++ b/include/linux/pm_opp.h +@@ -108,6 +108,7 @@ void dev_pm_opp_put(struct dev_pm_opp *opp); + int dev_pm_opp_add(struct device *dev, unsigned long freq, + unsigned long u_volt); + void dev_pm_opp_remove(struct device *dev, unsigned long freq); ++void dev_pm_opp_remove_all_dynamic(struct device *dev); + + int dev_pm_opp_enable(struct device *dev, unsigned long freq); + +@@ -214,6 +215,10 @@ static inline void dev_pm_opp_remove(struct device *dev, unsigned long freq) + { + } + ++static inline void dev_pm_opp_remove_all_dynamic(struct device *dev) ++{ ++} ++ + static inline int dev_pm_opp_enable(struct device *dev, unsigned long freq) + { + return 0; +diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h +index 73e130a840ce..fdb6b317d974 100644 +--- a/include/linux/sunrpc/svc.h ++++ b/include/linux/sunrpc/svc.h +@@ -295,9 +295,12 @@ struct svc_rqst { + struct svc_cacherep * rq_cacherep; /* cache info */ + struct task_struct *rq_task; /* service thread */ + spinlock_t rq_lock; /* per-request lock */ ++ struct net *rq_bc_net; /* pointer to backchannel's ++ * net namespace ++ */ + }; + +-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net) ++#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net) + + /* + * Rigorous type checking on sockaddr type conversions +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 28e384186c35..8617f4fd6b70 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process, + __field(u32, vers) + __field(u32, proc) + __string(service, name) +- __string(addr, rqst->rq_xprt->xpt_remotebuf) ++ __string(addr, rqst->rq_xprt ? ++ rqst->rq_xprt->xpt_remotebuf : "(null)") + ), + + TP_fast_assign( +@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process, + __entry->vers = rqst->rq_vers; + __entry->proc = rqst->rq_proc; + __assign_str(service, name); +- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf); ++ __assign_str(addr, rqst->rq_xprt ? ++ rqst->rq_xprt->xpt_remotebuf : "(null)"); + ), + + TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u", +diff --git a/kernel/fork.c b/kernel/fork.c +index 3c16bc490583..906cd0c13d15 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -221,6 +221,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node) + memset(s->addr, 0, THREAD_SIZE); + + tsk->stack_vm_area = s; ++ tsk->stack = s->addr; + return s->addr; + } + +diff --git a/mm/memory.c b/mm/memory.c +index 4ad2d293ddc2..59c00ae6b928 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2993,6 +2993,29 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) + struct vm_area_struct *vma = vmf->vma; + vm_fault_t ret; + ++ /* ++ * Preallocate pte before we take page_lock because this might lead to ++ * deadlocks for memcg reclaim which waits for pages under writeback: ++ * lock_page(A) ++ * SetPageWriteback(A) ++ * unlock_page(A) ++ * lock_page(B) ++ * lock_page(B) ++ * pte_alloc_pne ++ * shrink_page_list ++ * wait_on_page_writeback(A) ++ * SetPageWriteback(B) ++ * unlock_page(B) ++ * # flush A, B to clear the writeback ++ */ ++ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) { ++ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm, ++ vmf->address); ++ if (!vmf->prealloc_pte) ++ return VM_FAULT_OOM; ++ smp_wmb(); /* See comment in __pte_alloc() */ ++ } ++ + ret = vma->vm_ops->fault(vmf); + if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY | + VM_FAULT_DONE_COW))) +diff --git a/mm/slab.c b/mm/slab.c +index 2a5654bb3b3f..9d5de959d9d9 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -679,8 +679,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, + struct alien_cache *alc = NULL; + + alc = kmalloc_node(memsize, gfp, node); +- init_arraycache(&alc->ac, entries, batch); +- spin_lock_init(&alc->lock); ++ if (alc) { ++ init_arraycache(&alc->ac, entries, batch); ++ spin_lock_init(&alc->lock); ++ } + return alc; + } + +diff --git a/mm/usercopy.c b/mm/usercopy.c +index 852eb4e53f06..14faadcedd06 100644 +--- a/mm/usercopy.c ++++ b/mm/usercopy.c +@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks); + /* + * Validates that the given object is: + * - not bogus address +- * - known-safe heap or stack object ++ * - fully contained by stack (or stack frame, when available) ++ * - fully within SLAB object (or object whitelist area, when available) + * - not in kernel text + */ + void __check_object_size(const void *ptr, unsigned long n, bool to_user) +@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user) + /* Check for invalid addresses. */ + check_bogus_address((const unsigned long)ptr, n, to_user); + +- /* Check for bad heap object. */ +- check_heap_object(ptr, n, to_user); +- + /* Check for bad stack object. */ + switch (check_stack_object(ptr, n)) { + case NOT_STACK: +@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user) + usercopy_abort("process stack", NULL, to_user, 0, n); + } + ++ /* Check for bad heap object. */ ++ check_heap_object(ptr, n, to_user); ++ + /* Check for object in kernel to avoid text exposure. */ + check_kernel_text_object((const unsigned long)ptr, n, to_user); + } +diff --git a/mm/util.c b/mm/util.c +index 8bf08b5b5760..5c9c7359ee8a 100644 +--- a/mm/util.c ++++ b/mm/util.c +@@ -478,7 +478,7 @@ bool page_mapped(struct page *page) + return true; + if (PageHuge(page)) + return false; +- for (i = 0; i < hpage_nr_pages(page); i++) { ++ for (i = 0; i < (1 << compound_order(page)); i++) { + if (atomic_read(&page[i]._mapcount) >= 0) + return true; + } +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index d13e05f1a990..d65f8d35de87 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) + static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {} + #endif + ++extern void svc_tcp_prep_reply_hdr(struct svc_rqst *); ++ + /* + * Common routine for processing the RPC request. + */ +@@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) + clear_bit(RQ_DROPME, &rqstp->rq_flags); + + /* Setup reply header */ +- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); ++ if (rqstp->rq_prot == IPPROTO_TCP) ++ svc_tcp_prep_reply_hdr(rqstp); + + svc_putu32(resv, rqstp->rq_xid); + +@@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) + * for lower versions. RPC_PROG_MISMATCH seems to be the closest + * fit. + */ +- if (versp->vs_need_cong_ctrl && ++ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt && + !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags)) + goto err_bad_vers; + +@@ -1336,7 +1339,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) + return 0; + + close: +- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) ++ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) + svc_close_xprt(rqstp->rq_xprt); + dprintk("svc: svc_process close\n"); + return 0; +@@ -1459,10 +1462,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req, + dprintk("svc: %s(%p)\n", __func__, req); + + /* Build the svc_rqst used by the common processing routine */ +- rqstp->rq_xprt = serv->sv_bc_xprt; + rqstp->rq_xid = req->rq_xid; + rqstp->rq_prot = req->rq_xprt->prot; + rqstp->rq_server = serv; ++ rqstp->rq_bc_net = req->rq_xprt->xprt_net; + + rqstp->rq_addrlen = sizeof(req->rq_xprt->addr); + memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen); +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 51d36230b6e3..bd42da287c26 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -468,10 +468,11 @@ out: + */ + void svc_reserve(struct svc_rqst *rqstp, int space) + { ++ struct svc_xprt *xprt = rqstp->rq_xprt; ++ + space += rqstp->rq_res.head[0].iov_len; + +- if (space < rqstp->rq_reserved) { +- struct svc_xprt *xprt = rqstp->rq_xprt; ++ if (xprt && space < rqstp->rq_reserved) { + atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved); + rqstp->rq_reserved = space; + +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index b7e67310ec37..b90492c43711 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) + /* + * Setup response header. TCP has a 4B record length field. + */ +-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) ++void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) + { + struct kvec *resv = &rqstp->rq_res.head[0]; + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 0d998c54564d..5a5b3780456f 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -2157,7 +2157,7 @@ static void add_intree_flag(struct buffer *b, int is_intree) + /* Cannot check for assembler */ + static void add_retpoline(struct buffer *b) + { +- buf_printf(b, "\n#ifdef RETPOLINE\n"); ++ buf_printf(b, "\n#ifdef CONFIG_RETPOLINE\n"); + buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n"); + buf_printf(b, "#endif\n"); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 54fc9c0f07de..0d95316d6dbd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) + case 0x10ec0295: + case 0x10ec0289: + case 0x10ec0299: ++ alc_process_coef_fw(codec, alc225_pre_hsmode); + alc_process_coef_fw(codec, coef0225); + break; + case 0x10ec0867: +@@ -5380,6 +5381,13 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec, + snd_hda_override_wcaps(codec, 0x03, 0); + } + ++static void alc_fixup_disable_mic_vref(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ); ++} ++ + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + +@@ -5492,6 +5500,7 @@ enum { + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, ++ ALC225_FIXUP_DISABLE_MIC_VREF, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC295_FIXUP_DISABLE_DAC3, + ALC280_FIXUP_HP_HEADSET_MIC, +@@ -6191,6 +6200,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC225_FIXUP_DISABLE_MIC_VREF] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_disable_mic_vref, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, + [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -6200,7 +6215,7 @@ static const struct hda_fixup alc269_fixups[] = { + {} + }, + .chained = true, +- .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE ++ .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF + }, + [ALC280_FIXUP_HP_HEADSET_MIC] = { + .type = HDA_FIXUP_FUNC, +@@ -6503,6 +6518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
