commit: bd4e6547ab45aff74520e9fb76a8ac57fe859205 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Mar 5 17:59:13 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Mar 5 17:59:13 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bd4e6547
proj/linux-patches: Linux patch 4.9.162 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1161_linux-4.9.162.patch | 853 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 857 insertions(+) diff --git a/0000_README b/0000_README index b5f7603..b012cfe 100644 --- a/0000_README +++ b/0000_README @@ -687,6 +687,10 @@ Patch: 1160_linux-4.9.161.patch From: http://www.kernel.org Desc: Linux 4.9.161 +Patch: 1161_linux-4.9.162.patch +From: http://www.kernel.org +Desc: Linux 4.9.162 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1161_linux-4.9.162.patch b/1161_linux-4.9.162.patch new file mode 100644 index 0000000..fc1b786 --- /dev/null +++ b/1161_linux-4.9.162.patch @@ -0,0 +1,853 @@ +diff --git a/Makefile b/Makefile +index 239b74a7147b5..fce163d091393 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 161 ++SUBLEVEL = 162 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h +index 8da87feec59aa..99e6d8948f4ac 100644 +--- a/arch/arc/include/asm/bitops.h ++++ b/arch/arc/include/asm/bitops.h +@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long word) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word) + { + if (!word) + return word; +@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long x) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x) + { +- int n; ++ unsigned long n; + + asm volatile( + " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */ +diff --git a/arch/powerpc/include/asm/epapr_hcalls.h b/arch/powerpc/include/asm/epapr_hcalls.h +index 334459ad145b4..90863245df53b 100644 +--- a/arch/powerpc/include/asm/epapr_hcalls.h ++++ b/arch/powerpc/include/asm/epapr_hcalls.h +@@ -508,7 +508,7 @@ static unsigned long epapr_hypercall(unsigned long *in, + + static inline long epapr_hypercall0_1(unsigned int nr, unsigned long *r2) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + unsigned long r; + +@@ -520,7 +520,7 @@ static inline long epapr_hypercall0_1(unsigned int nr, unsigned long *r2) + + static inline long epapr_hypercall0(unsigned int nr) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + + return epapr_hypercall(in, out, nr); +@@ -528,7 +528,7 @@ static inline long epapr_hypercall0(unsigned int nr) + + static inline long epapr_hypercall1(unsigned int nr, unsigned long p1) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + + in[0] = p1; +@@ -538,7 +538,7 @@ static inline long epapr_hypercall1(unsigned int nr, unsigned long p1) + static inline long epapr_hypercall2(unsigned int nr, unsigned long p1, + unsigned long p2) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + + in[0] = p1; +@@ -549,7 +549,7 @@ static inline long epapr_hypercall2(unsigned int nr, unsigned long p1, + static inline long epapr_hypercall3(unsigned int nr, unsigned long p1, + unsigned long p2, unsigned long p3) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + + in[0] = p1; +@@ -562,7 +562,7 @@ static inline long epapr_hypercall4(unsigned int nr, unsigned long p1, + unsigned long p2, unsigned long p3, + unsigned long p4) + { +- unsigned long in[8]; ++ unsigned long in[8] = {0}; + unsigned long out[8]; + + in[0] = p1; +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index a8d85a687cf46..2177c7551ff77 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -292,8 +292,7 @@ do { \ + __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \ + break; \ + case 8: \ +- __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \ +- errret); \ ++ __put_user_asm_u64(x, ptr, retval, errret); \ + break; \ + default: \ + __put_user_bad(); \ +@@ -427,8 +426,10 @@ do { \ + #define __put_user_nocheck(x, ptr, size) \ + ({ \ + int __pu_err; \ ++ __typeof__(*(ptr)) __pu_val; \ ++ __pu_val = x; \ + __uaccess_begin(); \ +- __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \ ++ __put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT);\ + __uaccess_end(); \ + __builtin_expect(__pu_err, 0); \ + }) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index c8efacf2e65f1..01eb0451b96d3 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -2862,6 +2862,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) + kvm_mmu_reset_context(&svm->vcpu); + kvm_mmu_load(&svm->vcpu); + ++ /* ++ * Drop what we picked up for L2 via svm_complete_interrupts() so it ++ * doesn't end up in L1. ++ */ ++ svm->vcpu.arch.nmi_injected = false; ++ kvm_clear_exception_queue(&svm->vcpu); ++ kvm_clear_interrupt_queue(&svm->vcpu); ++ + return 0; + } + +@@ -3932,25 +3940,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) + kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: { +- int i; +- struct kvm_vcpu *vcpu; +- struct kvm *kvm = svm->vcpu.kvm; + struct kvm_lapic *apic = svm->vcpu.arch.apic; + + /* +- * At this point, we expect that the AVIC HW has already +- * set the appropriate IRR bits on the valid target +- * vcpus. So, we just need to kick the appropriate vcpu. ++ * Update ICR high and low, then emulate sending IPI, ++ * which is handled when writing APIC_ICR. + */ +- kvm_for_each_vcpu(i, vcpu, kvm) { +- bool m = kvm_apic_match_dest(vcpu, apic, +- icrl & KVM_APIC_SHORT_MASK, +- GET_APIC_DEST_FIELD(icrh), +- icrl & KVM_APIC_DEST_MASK); +- +- if (m && !avic_vcpu_is_running(vcpu)) +- kvm_vcpu_wake_up(vcpu); +- } ++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh); ++ kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + } + case AVIC_IPI_FAILURE_INVALID_TARGET: +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 344f34746c103..28ce17405aab4 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -81,6 +81,7 @@ + #include <asm/uaccess.h> + + static DEFINE_IDR(loop_index_idr); ++static DEFINE_MUTEX(loop_index_mutex); + static DEFINE_MUTEX(loop_ctl_mutex); + + static int max_part; +@@ -1559,11 +1560,9 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, + static int lo_open(struct block_device *bdev, fmode_t mode) + { + struct loop_device *lo; +- int err; ++ int err = 0; + +- err = mutex_lock_killable(&loop_ctl_mutex); +- if (err) +- return err; ++ mutex_lock(&loop_index_mutex); + lo = bdev->bd_disk->private_data; + if (!lo) { + err = -ENXIO; +@@ -1572,20 +1571,18 @@ static int lo_open(struct block_device *bdev, fmode_t mode) + + atomic_inc(&lo->lo_refcnt); + out: +- mutex_unlock(&loop_ctl_mutex); ++ mutex_unlock(&loop_index_mutex); + return err; + } + +-static void lo_release(struct gendisk *disk, fmode_t mode) ++static void __lo_release(struct loop_device *lo) + { +- struct loop_device *lo; + int err; + +- mutex_lock(&loop_ctl_mutex); +- lo = disk->private_data; + if (atomic_dec_return(&lo->lo_refcnt)) +- goto out_unlock; ++ return; + ++ mutex_lock(&loop_ctl_mutex); + if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { + /* + * In autoclear mode, stop the loop thread +@@ -1602,10 +1599,16 @@ static void lo_release(struct gendisk *disk, fmode_t mode) + loop_flush(lo); + } + +-out_unlock: + mutex_unlock(&loop_ctl_mutex); + } + ++static void lo_release(struct gendisk *disk, fmode_t mode) ++{ ++ mutex_lock(&loop_index_mutex); ++ __lo_release(disk->private_data); ++ mutex_unlock(&loop_index_mutex); ++} ++ + static const struct block_device_operations lo_fops = { + .owner = THIS_MODULE, + .open = lo_open, +@@ -1889,7 +1892,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) + struct kobject *kobj; + int err; + +- mutex_lock(&loop_ctl_mutex); ++ mutex_lock(&loop_index_mutex); + err = loop_lookup(&lo, MINOR(dev) >> part_shift); + if (err < 0) + err = loop_add(&lo, MINOR(dev) >> part_shift); +@@ -1897,7 +1900,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) + kobj = NULL; + else + kobj = get_disk(lo->lo_disk); +- mutex_unlock(&loop_ctl_mutex); ++ mutex_unlock(&loop_index_mutex); + + *part = 0; + return kobj; +@@ -1907,13 +1910,9 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, + unsigned long parm) + { + struct loop_device *lo; +- int ret; +- +- ret = mutex_lock_killable(&loop_ctl_mutex); +- if (ret) +- return ret; ++ int ret = -ENOSYS; + +- ret = -ENOSYS; ++ mutex_lock(&loop_index_mutex); + switch (cmd) { + case LOOP_CTL_ADD: + ret = loop_lookup(&lo, parm); +@@ -1927,15 +1926,19 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, + ret = loop_lookup(&lo, parm); + if (ret < 0) + break; ++ mutex_lock(&loop_ctl_mutex); + if (lo->lo_state != Lo_unbound) { + ret = -EBUSY; ++ mutex_unlock(&loop_ctl_mutex); + break; + } + if (atomic_read(&lo->lo_refcnt) > 0) { + ret = -EBUSY; ++ mutex_unlock(&loop_ctl_mutex); + break; + } + lo->lo_disk->private_data = NULL; ++ mutex_unlock(&loop_ctl_mutex); + idr_remove(&loop_index_idr, lo->lo_number); + loop_remove(lo); + break; +@@ -1945,7 +1948,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, + break; + ret = loop_add(&lo, -1); + } +- mutex_unlock(&loop_ctl_mutex); ++ mutex_unlock(&loop_index_mutex); + + return ret; + } +@@ -2028,10 +2031,10 @@ static int __init loop_init(void) + THIS_MODULE, loop_probe, NULL, NULL); + + /* pre-create number of devices given by config or max_loop */ +- mutex_lock(&loop_ctl_mutex); ++ mutex_lock(&loop_index_mutex); + for (i = 0; i < nr; i++) + loop_add(&lo, i); +- mutex_unlock(&loop_ctl_mutex); ++ mutex_unlock(&loop_index_mutex); + + printk(KERN_INFO "loop: module loaded\n"); + return 0; +diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c +index 8487f461f05f3..4823019eb422b 100644 +--- a/drivers/gpu/drm/msm/msm_rd.c ++++ b/drivers/gpu/drm/msm/msm_rd.c +@@ -112,7 +112,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz) + char *fptr = &fifo->buf[fifo->head]; + int n; + +- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0); ++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open); ++ if (!rd->open) ++ return; + + n = min(sz, circ_space_to_end(&rd->fifo)); + memcpy(fptr, ptr, n); +@@ -202,7 +204,10 @@ out: + static int rd_release(struct inode *inode, struct file *file) + { + struct msm_rd_state *rd = inode->i_private; ++ + rd->open = false; ++ wake_up_all(&rd->fifo_event); ++ + return 0; + } + +diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c +index e77d79c8cd9f2..6224ad37fd80b 100644 +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -1450,6 +1450,7 @@ static int mmc_spi_probe(struct spi_device *spi) + mmc->caps &= ~MMC_CAP_NEEDS_POLL; + mmc_gpiod_request_cd_irq(mmc); + } ++ mmc_detect_change(mmc, 0); + + if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) { + has_ro = true; +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index a0eee72186957..e306342506f1f 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -692,8 +692,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) + + phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link, + priv->phy_iface); +- if (IS_ERR(phydev)) ++ if (IS_ERR(phydev)) { + netdev_err(dev, "Could not attach to PHY\n"); ++ phydev = NULL; ++ } + + } else { + int ret; +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 4996228fd7e61..955f658f3b65f 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1240,7 +1240,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + struct iphdr *iph; + u16 mss = 0; + +-restart_poll: + while (frames_processed < budget) { + if (!ibmveth_rxq_pending_buffer(adapter)) + break; +@@ -1338,7 +1337,6 @@ restart_poll: + napi_reschedule(napi)) { + lpar_rc = h_vio_signal(adapter->vdev->unit_address, + VIO_IRQ_DISABLE); +- goto restart_poll; + } + } + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index 5be6b67492d52..393fd3ed6b94c 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -729,8 +729,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); + chipcode &= AX_CHIPCODE_MASK; + +- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : +- ax88772a_hw_reset(dev, 0); ++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : ++ ax88772a_hw_reset(dev, 0); ++ ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret); ++ return ret; ++ } + + /* Read PHYID register *AFTER* the PHY was reset properly */ + phyid = asix_get_phyid(dev); +diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c +index 2d1c4ebd40f91..6587f20cff1a1 100644 +--- a/drivers/scsi/csiostor/csio_attr.c ++++ b/drivers/scsi/csiostor/csio_attr.c +@@ -582,12 +582,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) + } + + fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); ++ ln->fc_vport = fc_vport; + + if (csio_fcoe_alloc_vnp(hw, ln)) + goto error; + + *(struct csio_lnode **)fc_vport->dd_data = ln; +- ln->fc_vport = fc_vport; + if (!fc_vport->node_name) + fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); + if (!fc_vport->port_name) +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 12886f96b2860..7be581f7c35d1 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -818,6 +818,7 @@ static struct domain_device *sas_ex_discover_end_dev( + rphy = sas_end_device_alloc(phy->port); + if (!rphy) + goto out_free; ++ rphy->identify.phy_identifier = phy_id; + + child->rphy = rphy; + get_device(&rphy->dev); +@@ -845,6 +846,7 @@ static struct domain_device *sas_ex_discover_end_dev( + + child->rphy = rphy; + get_device(&rphy->dev); ++ rphy->identify.phy_identifier = phy_id; + sas_fill_in_rphy(child, rphy); + + list_add_tail(&child->disco_list_node, &parent->port->disco_list); +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index ff3b36f339e34..1fdf6fd24cdff 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -77,7 +77,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \ + struct pci_dev *pci_dev; \ + struct platform_device *pdev; \ + struct proc_thermal_device *proc_dev; \ +-\ ++ \ ++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \ ++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \ ++ return 0; \ ++ } \ ++ \ + if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \ + pdev = to_platform_device(dev); \ + proc_dev = platform_get_drvdata(pdev); \ +@@ -291,11 +296,6 @@ static int proc_thermal_add(struct device *dev, + *priv = proc_priv; + + ret = proc_thermal_read_ppcc(proc_priv); +- if (!ret) { +- ret = sysfs_create_group(&dev->kobj, +- &power_limit_attribute_group); +- +- } + if (ret) + return ret; + +@@ -309,8 +309,7 @@ static int proc_thermal_add(struct device *dev, + + proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops); + if (IS_ERR(proc_priv->int340x_zone)) { +- ret = PTR_ERR(proc_priv->int340x_zone); +- goto remove_group; ++ return PTR_ERR(proc_priv->int340x_zone); + } else + ret = 0; + +@@ -324,9 +323,6 @@ static int proc_thermal_add(struct device *dev, + + remove_zone: + int340x_thermal_zone_remove(proc_priv->int340x_zone); +-remove_group: +- sysfs_remove_group(&proc_priv->dev->kobj, +- &power_limit_attribute_group); + + return ret; + } +@@ -357,7 +353,10 @@ static int int3401_add(struct platform_device *pdev) + platform_set_drvdata(pdev, proc_priv); + proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV; + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static int int3401_remove(struct platform_device *pdev) +@@ -416,7 +415,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + proc_priv->soc_dts = intel_soc_dts_iosf_init( + INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0); + +- if (proc_priv->soc_dts && pdev->irq) { ++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) { + ret = pci_enable_msi(pdev); + if (!ret) { + ret = request_threaded_irq(pdev->irq, NULL, +@@ -434,7 +433,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "No auxiliary DTSs enabled\n"); + } + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static void proc_thermal_pci_remove(struct pci_dev *pdev) +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 5c471c3481bdf..800996522fdc2 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1494,7 +1494,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + } + + /* ask the core to calculate the divisor */ +- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16); ++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4); + + spin_lock_irqsave(&sport->port.lock, flags); + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index ed6b9bfe37595..712bd450f8573 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1705,6 +1705,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) + + /* begin to receive SETUP packets */ + dwc->ep0state = EP0_SETUP_PHASE; ++ dwc->link_state = DWC3_LINK_STATE_SS_DIS; + dwc3_ep0_out_start(dwc); + + dwc3_gadget_enable_irq(dwc); +@@ -3096,6 +3097,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + ++ synchronize_irq(dwc->irq_gadget); ++ + return 0; + } + +diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c +index 8784fa12ea2c6..6e9d958004a0d 100644 +--- a/drivers/usb/gadget/function/f_sourcesink.c ++++ b/drivers/usb/gadget/function/f_sourcesink.c +@@ -842,7 +842,7 @@ static struct usb_function *source_sink_alloc_func( + + ss = kzalloc(sizeof(*ss), GFP_KERNEL); + if (!ss) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + ss_opts = container_of(fi, struct f_ss_opts, func_inst); + +diff --git a/fs/direct-io.c b/fs/direct-io.c +index 07cc38ec66ca6..fc90f0c33cbe4 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -616,6 +616,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + unsigned long fs_count; /* Number of filesystem-sized blocks */ + int create; + unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor; ++ loff_t i_size; + + /* + * If there was a memory error and we've overwritten all the +@@ -645,8 +646,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + */ + create = dio->op == REQ_OP_WRITE; + if (dio->flags & DIO_SKIP_HOLES) { +- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >> +- i_blkbits)) ++ i_size = i_size_read(dio->inode); ++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits) + create = 0; + } + +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index a4112dfcd0fb1..be06c45cbe4f9 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -195,15 +195,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, + woken++; + tsk = waiter->task; + +- wake_q_add(wake_q, tsk); ++ get_task_struct(tsk); + list_del(&waiter->list); + /* +- * Ensure that the last operation is setting the reader ++ * Ensure calling get_task_struct() before setting the reader + * waiter to nil such that rwsem_down_read_failed() cannot + * race with do_exit() by always holding a reference count + * to the task to wakeup. + */ + smp_store_release(&waiter->task, NULL); ++ /* ++ * Ensure issuing the wakeup (either by us or someone else) ++ * after setting the reader waiter to nil. ++ */ ++ wake_q_add(wake_q, tsk); ++ /* wake_q_add() already take the task ref */ ++ put_task_struct(tsk); + } + + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; +diff --git a/mm/mmap.c b/mm/mmap.c +index 283755645d17e..3f2314ad6acd8 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2345,12 +2345,11 @@ int expand_downwards(struct vm_area_struct *vma, + struct mm_struct *mm = vma->vm_mm; + struct vm_area_struct *prev; + unsigned long gap_addr; +- int error; ++ int error = 0; + + address &= PAGE_MASK; +- error = security_mmap_addr(address); +- if (error) +- return error; ++ if (address < mmap_min_addr) ++ return -EPERM; + + /* Enforce stack_guard_gap */ + gap_addr = address - stack_guard_gap; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 6ef9d32c34f1e..954315e1661df 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1425,6 +1425,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, + if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) + sta->sta.tdls = true; + ++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && ++ !sdata->u.mgd.associated) ++ return -EINVAL; ++ + err = sta_apply_parameters(local, sta, params); + if (err) { + sta_info_free(local, sta); +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index af02d2136a066..23f6c8baae951 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -217,7 +217,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; +- } __packed action; ++ } __packed __aligned(2) action; + + if (!sdata) + return; +@@ -2510,7 +2510,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + skb_set_queue_mapping(skb, q); + + if (!--mesh_hdr->ttl) { +- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); ++ if (!is_multicast_ether_addr(hdr->addr1)) ++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, ++ dropped_frames_ttl); + goto out; + } + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 36d1d25082e32..7c19d0d2549b1 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -773,7 +773,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range, + * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), + * however it is safe for now to assume that a frequency rule should not be + * part of a frequency's band if the start freq or end freq are off by more +- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the ++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the + * 60 GHz band. + * This resolution can be lowered and should be considered as we add + * regulatory rule support for other "bands". +@@ -788,7 +788,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range, + * with the Channel starting frequency above 45 GHz. + */ + u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ? +- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; ++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; + if (abs(freq_khz - freq_range->start_freq_khz) <= limit) + return true; + if (abs(freq_khz - freq_range->end_freq_khz) <= limit) +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 4490a699030b1..555df64d46ffc 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size) ++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments == 0) + return -EINVAL; + + /* now codec parameters */ +diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c +index fc57da341d610..136df38c4536c 100644 +--- a/sound/soc/fsl/imx-audmux.c ++++ b/sound/soc/fsl/imx-audmux.c +@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, + if (!buf) + return -ENOMEM; + +- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", ++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", + pdcr, ptcr); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS output from %s, ", + audmux_port_string((ptcr >> 27) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk output from %s", + audmux_port_string((ptcr >> 22) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk input"); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "Port is symmetric"); + } else { + if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS output from %s, ", + audmux_port_string((ptcr >> 17) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk output from %s", + audmux_port_string((ptcr >> 12) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk input"); + } + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "\nData received from %s\n", + audmux_port_string((pdcr >> 13) & 0x7)); + +diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c +index 7486a0022fdea..993d2c105ae14 100644 +--- a/sound/soc/intel/boards/broadwell.c ++++ b/sound/soc/intel/boards/broadwell.c +@@ -191,7 +191,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index 863f1d5e2a2c9..11d0cc2b0e390 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -145,7 +145,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 8bfc534e3b342..ab647f1fe11bd 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -1976,19 +1976,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + out = is_connected_output_ep(w, NULL, NULL); + } + +- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", ++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", + w->name, w->power ? "On" : "Off", + w->force ? " (forced)" : "", in, out); + + if (w->reg >= 0) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " - R%d(0x%x) mask 0x%x", + w->reg, w->reg, w->mask << w->shift); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (w->sname) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", + w->sname, + w->active ? "active" : "inactive"); + +@@ -2001,7 +2001,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + if (!p->connect) + continue; + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " %s \"%s\" \"%s\"\n", + (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", + p->name ? p->name : "static",
