commit: 24cf9478a62681cd1a01f2b4b4954ad318dad479 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Mar 27 10:23:20 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Mar 27 10:23:20 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=24cf9478
Linux patch 5.0.5 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1004_linux-5.0.5.patch | 2012 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2016 insertions(+) diff --git a/0000_README b/0000_README index 1974ef5..f452eee 100644 --- a/0000_README +++ b/0000_README @@ -59,6 +59,10 @@ Patch: 1003_linux-5.0.4.patch From: http://www.kernel.org Desc: Linux 5.0.4 +Patch: 1004_linux-5.0.5.patch +From: http://www.kernel.org +Desc: Linux 5.0.5 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1004_linux-5.0.5.patch b/1004_linux-5.0.5.patch new file mode 100644 index 0000000..37a532b --- /dev/null +++ b/1004_linux-5.0.5.patch @@ -0,0 +1,2012 @@ +diff --git a/Makefile b/Makefile +index 06fda21614bc..63152c5ca136 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 0 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Shy Crocodile + +diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h +index e77672539e8e..e4456e450f94 100644 +--- a/arch/mips/include/asm/jump_label.h ++++ b/arch/mips/include/asm/jump_label.h +@@ -21,15 +21,15 @@ + #endif + + #ifdef CONFIG_CPU_MICROMIPS +-#define NOP_INSN "nop32" ++#define B_INSN "b32" + #else +-#define NOP_INSN "nop" ++#define B_INSN "b" + #endif + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm_volatile_goto("1:\t" NOP_INSN "\n\t" +- "nop\n\t" ++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t" ++ "2:\tnop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + WORD_INSN " 1b, %l[l_yes], %0\n\t" + ".popsection\n\t" +diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S +index cb7e9ed7a453..33ee0d18fb0a 100644 +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -140,6 +140,13 @@ SECTIONS + PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT) + #endif + ++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB ++ .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { ++ *(.appended_dtb) ++ KEEP(*(.appended_dtb)) ++ } ++#endif ++ + #ifdef CONFIG_RELOCATABLE + . = ALIGN(4); + +@@ -164,11 +171,6 @@ SECTIONS + __appended_dtb = .; + /* leave space for appended DTB */ + . += 0x100000; +-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB) +- .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { +- *(.appended_dtb) +- KEEP(*(.appended_dtb)) +- } + #endif + /* + * Align to 64K in attempt to eliminate holes before the +diff --git a/arch/mips/loongson64/lemote-2f/irq.c b/arch/mips/loongson64/lemote-2f/irq.c +index 9e33e45aa17c..b213cecb8e3a 100644 +--- a/arch/mips/loongson64/lemote-2f/irq.c ++++ b/arch/mips/loongson64/lemote-2f/irq.c +@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = { + static struct irqaction cascade_irqaction = { + .handler = no_action, + .name = "cascade", +- .flags = IRQF_NO_THREAD, ++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND, + }; + + void __init mach_init_irq(void) +diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h +index 1afe90ade595..bbc06bd72b1f 100644 +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -82,10 +82,10 @@ struct vdso_data { + __u32 icache_block_size; /* L1 i-cache block size */ + __u32 dcache_log_block_size; /* L1 d-cache log block size */ + __u32 icache_log_block_size; /* L1 i-cache log block size */ +- __s32 wtom_clock_sec; /* Wall to monotonic clock */ +- __s32 wtom_clock_nsec; +- struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ +- __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */ ++ __s64 wtom_clock_sec; /* Wall to monotonic clock sec */ ++ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c +index 9b8631533e02..b33bafb8fcea 100644 +--- a/arch/powerpc/kernel/security.c ++++ b/arch/powerpc/kernel/security.c +@@ -190,29 +190,22 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c + bcs = security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED); + ccd = security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED); + +- if (bcs || ccd || count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) { +- bool comma = false; ++ if (bcs || ccd) { + seq_buf_printf(&s, "Mitigation: "); + +- if (bcs) { ++ if (bcs) + seq_buf_printf(&s, "Indirect branch serialisation (kernel only)"); +- comma = true; +- } + +- if (ccd) { +- if (comma) +- seq_buf_printf(&s, ", "); +- seq_buf_printf(&s, "Indirect branch cache disabled"); +- comma = true; +- } +- +- if (comma) ++ if (bcs && ccd) + seq_buf_printf(&s, ", "); + +- seq_buf_printf(&s, "Software count cache flush"); ++ if (ccd) ++ seq_buf_printf(&s, "Indirect branch cache disabled"); ++ } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) { ++ seq_buf_printf(&s, "Mitigation: Software count cache flush"); + + if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW) +- seq_buf_printf(&s, "(hardware accelerated)"); ++ seq_buf_printf(&s, " (hardware accelerated)"); + } else if (btb_flush_enabled) { + seq_buf_printf(&s, "Mitigation: Branch predictor state flush"); + } else { +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index a4ed9edfd5f0..1f324c28705b 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -92,7 +92,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + * At this point, r4,r5 contain our sec/nsec values. + */ + +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* We now have our result in r6,r9. We create a fake dependency +@@ -125,7 +125,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + bne cr6,75f + + /* CLOCK_MONOTONIC_COARSE */ +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* check if counter has updated */ +diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h +index 1f86e1b0a5cd..499578f7e6d7 100644 +--- a/arch/x86/include/asm/unwind.h ++++ b/arch/x86/include/asm/unwind.h +@@ -23,6 +23,12 @@ struct unwind_state { + #elif defined(CONFIG_UNWINDER_FRAME_POINTER) + bool got_irq; + unsigned long *bp, *orig_sp, ip; ++ /* ++ * If non-NULL: The current frame is incomplete and doesn't contain a ++ * valid BP. When looking for the next frame, use this instead of the ++ * non-existent saved BP. ++ */ ++ unsigned long *next_bp; + struct pt_regs *regs; + #else + unsigned long *sp; +diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c +index 3dc26f95d46e..9b9fd4826e7a 100644 +--- a/arch/x86/kernel/unwind_frame.c ++++ b/arch/x86/kernel/unwind_frame.c +@@ -320,10 +320,14 @@ bool unwind_next_frame(struct unwind_state *state) + } + + /* Get the next frame pointer: */ +- if (state->regs) ++ if (state->next_bp) { ++ next_bp = state->next_bp; ++ state->next_bp = NULL; ++ } else if (state->regs) { + next_bp = (unsigned long *)state->regs->bp; +- else ++ } else { + next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task, *state->bp); ++ } + + /* Move to the next frame if it's safe: */ + if (!update_stack_state(state, next_bp)) +@@ -398,6 +402,21 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + + bp = get_frame_pointer(task, regs); + ++ /* ++ * If we crash with IP==0, the last successfully executed instruction ++ * was probably an indirect function call with a NULL function pointer. ++ * That means that SP points into the middle of an incomplete frame: ++ * *SP is a return pointer, and *(SP-sizeof(unsigned long)) is where we ++ * would have written a frame pointer if we hadn't crashed. ++ * Pretend that the frame is complete and that BP points to it, but save ++ * the real BP so that we can use it when looking for the next frame. ++ */ ++ if (regs && regs->ip == 0 && ++ (unsigned long *)kernel_stack_pointer(regs) >= first_frame) { ++ state->next_bp = bp; ++ bp = ((unsigned long *)kernel_stack_pointer(regs)) - 1; ++ } ++ + /* Initialize stack info and make sure the frame data is accessible: */ + get_stack_info(bp, state->task, &state->stack_info, + &state->stack_mask); +@@ -410,7 +429,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + */ + while (!unwind_done(state) && + (!on_stack(&state->stack_info, first_frame, sizeof(long)) || +- state->bp < first_frame)) ++ (state->next_bp == NULL && state->bp < first_frame))) + unwind_next_frame(state); + } + EXPORT_SYMBOL_GPL(__unwind_start); +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index 26038eacf74a..89be1be1790c 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -113,6 +113,20 @@ static struct orc_entry *orc_ftrace_find(unsigned long ip) + } + #endif + ++/* ++ * If we crash with IP==0, the last successfully executed instruction ++ * was probably an indirect function call with a NULL function pointer, ++ * and we don't have unwind information for NULL. ++ * This hardcoded ORC entry for IP==0 allows us to unwind from a NULL function ++ * pointer into its parent and then continue normally from there. ++ */ ++static struct orc_entry null_orc_entry = { ++ .sp_offset = sizeof(long), ++ .sp_reg = ORC_REG_SP, ++ .bp_reg = ORC_REG_UNDEFINED, ++ .type = ORC_TYPE_CALL ++}; ++ + static struct orc_entry *orc_find(unsigned long ip) + { + static struct orc_entry *orc; +@@ -120,6 +134,9 @@ static struct orc_entry *orc_find(unsigned long ip) + if (!orc_init) + return NULL; + ++ if (ip == 0) ++ return &null_orc_entry; ++ + /* For non-init vmlinux addresses, use the fast lookup table: */ + if (ip >= LOOKUP_START_IP && ip < LOOKUP_STOP_IP) { + unsigned int idx, start, stop; +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index cf5538942834..2faefdd6f420 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -656,7 +656,7 @@ static int loop_validate_file(struct file *file, struct block_device *bdev) + return -EBADF; + + l = f->f_mapping->host->i_bdev->bd_disk->private_data; +- if (l->lo_state == Lo_unbound) { ++ if (l->lo_state != Lo_bound) { + return -EINVAL; + } + f = l->lo_backing_file; +diff --git a/drivers/bluetooth/h4_recv.h b/drivers/bluetooth/h4_recv.h +index b432651f8236..307d82166f48 100644 +--- a/drivers/bluetooth/h4_recv.h ++++ b/drivers/bluetooth/h4_recv.h +@@ -60,6 +60,10 @@ static inline struct sk_buff *h4_recv_buf(struct hci_dev *hdev, + const struct h4_recv_pkt *pkts, + int pkts_count) + { ++ /* Check for error from previous call */ ++ if (IS_ERR(skb)) ++ skb = NULL; ++ + while (count) { + int i, len; + +diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c +index fb97a3bf069b..5d97d77627c1 100644 +--- a/drivers/bluetooth/hci_h4.c ++++ b/drivers/bluetooth/hci_h4.c +@@ -174,6 +174,10 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, + struct hci_uart *hu = hci_get_drvdata(hdev); + u8 alignment = hu->alignment ? hu->alignment : 1; + ++ /* Check for error from previous call */ ++ if (IS_ERR(skb)) ++ skb = NULL; ++ + while (count) { + int i, len; + +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index fbf7b4df23ab..9562e72c1ae5 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -207,11 +207,11 @@ void hci_uart_init_work(struct work_struct *work) + err = hci_register_dev(hu->hdev); + if (err < 0) { + BT_ERR("Can't register HCI device"); ++ clear_bit(HCI_UART_PROTO_READY, &hu->flags); ++ hu->proto->close(hu); + hdev = hu->hdev; + hu->hdev = NULL; + hci_free_dev(hdev); +- clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- hu->proto->close(hu); + return; + } + +@@ -616,6 +616,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, + static int hci_uart_register_dev(struct hci_uart *hu) + { + struct hci_dev *hdev; ++ int err; + + BT_DBG(""); + +@@ -659,11 +660,22 @@ static int hci_uart_register_dev(struct hci_uart *hu) + else + hdev->dev_type = HCI_PRIMARY; + ++ /* Only call open() for the protocol after hdev is fully initialized as ++ * open() (or a timer/workqueue it starts) may attempt to reference it. ++ */ ++ err = hu->proto->open(hu); ++ if (err) { ++ hu->hdev = NULL; ++ hci_free_dev(hdev); ++ return err; ++ } ++ + if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags)) + return 0; + + if (hci_register_dev(hdev) < 0) { + BT_ERR("Can't register HCI device"); ++ hu->proto->close(hu); + hu->hdev = NULL; + hci_free_dev(hdev); + return -ENODEV; +@@ -683,20 +695,14 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) + if (!p) + return -EPROTONOSUPPORT; + +- err = p->open(hu); +- if (err) +- return err; +- + hu->proto = p; +- set_bit(HCI_UART_PROTO_READY, &hu->flags); + + err = hci_uart_register_dev(hu); + if (err) { +- clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- p->close(hu); + return err; + } + ++ set_bit(HCI_UART_PROTO_READY, &hu->flags); + return 0; + } + +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index 431892200a08..ead71bfac689 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -58,7 +58,7 @@ static u64 riscv_sched_clock(void) + static DEFINE_PER_CPU(struct clocksource, riscv_clocksource) = { + .name = "riscv_clocksource", + .rating = 300, +- .mask = CLOCKSOURCE_MASK(BITS_PER_LONG), ++ .mask = CLOCKSOURCE_MASK(64), + .flags = CLOCK_SOURCE_IS_CONTINUOUS, + .read = riscv_clocksource_rdtime, + }; +@@ -103,8 +103,7 @@ static int __init riscv_timer_init_dt(struct device_node *n) + cs = per_cpu_ptr(&riscv_clocksource, cpuid); + clocksource_register_hz(cs, riscv_timebase); + +- sched_clock_register(riscv_sched_clock, +- BITS_PER_LONG, riscv_timebase); ++ sched_clock_register(riscv_sched_clock, 64, riscv_timebase); + + error = cpuhp_setup_state(CPUHP_AP_RISCV_TIMER_STARTING, + "clockevents/riscv/timer:starting", +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index bacdaef77b6c..278dd55ff476 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -738,7 +738,7 @@ static int gmc_v9_0_allocate_vm_inv_eng(struct amdgpu_device *adev) + } + + ring->vm_inv_eng = inv_eng - 1; +- change_bit(inv_eng - 1, (unsigned long *)(&vm_inv_engs[vmhub])); ++ vm_inv_engs[vmhub] &= ~(1 << ring->vm_inv_eng); + + dev_info(adev->dev, "ring %s uses VM inv eng %u on hub %u\n", + ring->name, ring->vm_inv_eng, ring->funcs->vmhub); +diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c +index eb56ee893761..e747a7d16739 100644 +--- a/drivers/gpu/drm/vkms/vkms_crtc.c ++++ b/drivers/gpu/drm/vkms/vkms_crtc.c +@@ -98,6 +98,7 @@ static void vkms_atomic_crtc_reset(struct drm_crtc *crtc) + vkms_state = kzalloc(sizeof(*vkms_state), GFP_KERNEL); + if (!vkms_state) + return; ++ INIT_WORK(&vkms_state->crc_work, vkms_crc_work_handle); + + crtc->state = &vkms_state->base; + crtc->state->crtc = crtc; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index b913a56f3426..2a9112515f46 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -564,11 +564,9 @@ static int vmw_fb_set_par(struct fb_info *info) + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; +- struct drm_display_mode *old_mode; + struct drm_display_mode *mode; + int ret; + +- old_mode = par->set_mode; + mode = drm_mode_duplicate(vmw_priv->dev, &new_mode); + if (!mode) { + DRM_ERROR("Could not create new fb mode.\n"); +@@ -579,11 +577,7 @@ static int vmw_fb_set_par(struct fb_info *info) + mode->vdisplay = var->yres; + vmw_guess_mode_timing(mode); + +- if (old_mode && drm_mode_equal(old_mode, mode)) { +- drm_mode_destroy(vmw_priv->dev, mode); +- mode = old_mode; +- old_mode = NULL; +- } else if (!vmw_kms_validate_mode_vram(vmw_priv, ++ if (!vmw_kms_validate_mode_vram(vmw_priv, + mode->hdisplay * + DIV_ROUND_UP(var->bits_per_pixel, 8), + mode->vdisplay)) { +@@ -620,8 +614,8 @@ static int vmw_fb_set_par(struct fb_info *info) + schedule_delayed_work(&par->local_work, 0); + + out_unlock: +- if (old_mode) +- drm_mode_destroy(vmw_priv->dev, old_mode); ++ if (par->set_mode) ++ drm_mode_destroy(vmw_priv->dev, par->set_mode); + par->set_mode = mode; + + mutex_unlock(&par->bo_mutex); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c +index b93c558dd86e..7da752ca1c34 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c +@@ -57,7 +57,7 @@ static int vmw_gmrid_man_get_node(struct ttm_mem_type_manager *man, + + id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL); + if (id < 0) +- return id; ++ return (id != -ENOMEM ? 0 : id); + + spin_lock(&gman->lock); + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 84f077b2b90a..81bded0d37d1 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2966,13 +2966,22 @@ static void addr_handler(int status, struct sockaddr *src_addr, + { + struct rdma_id_private *id_priv = context; + struct rdma_cm_event event = {}; ++ struct sockaddr *addr; ++ struct sockaddr_storage old_addr; + + mutex_lock(&id_priv->handler_mutex); + if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_QUERY, + RDMA_CM_ADDR_RESOLVED)) + goto out; + +- memcpy(cma_src_addr(id_priv), src_addr, rdma_addr_size(src_addr)); ++ /* ++ * Store the previous src address, so that if we fail to acquire ++ * matching rdma device, old address can be restored back, which helps ++ * to cancel the cma listen operation correctly. ++ */ ++ addr = cma_src_addr(id_priv); ++ memcpy(&old_addr, addr, rdma_addr_size(addr)); ++ memcpy(addr, src_addr, rdma_addr_size(src_addr)); + if (!status && !id_priv->cma_dev) { + status = cma_acquire_dev_by_src_ip(id_priv); + if (status) +@@ -2983,6 +2992,8 @@ static void addr_handler(int status, struct sockaddr *src_addr, + } + + if (status) { ++ memcpy(addr, &old_addr, ++ rdma_addr_size((struct sockaddr *)&old_addr)); + if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_RESOLVED, + RDMA_CM_ADDR_BOUND)) + goto out; +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 2a7b78bb98b4..e628ef23418f 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2605,7 +2605,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, + + /* Everything is mapped - write the right values into s->dma_address */ + for_each_sg(sglist, s, nelems, i) { +- s->dma_address += address + s->offset; ++ /* ++ * Add in the remaining piece of the scatter-gather offset that ++ * was masked out when we were determining the physical address ++ * via (sg_phys(s) & PAGE_MASK) earlier. ++ */ ++ s->dma_address += address + (s->offset & ~PAGE_MASK); + s->dma_length = s->length; + } + +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index f8d3ba247523..2de8122e218f 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -207,8 +207,10 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad, + curr_iova = rb_entry(curr, struct iova, node); + } while (curr && new_pfn <= curr_iova->pfn_hi); + +- if (limit_pfn < size || new_pfn < iovad->start_pfn) ++ if (limit_pfn < size || new_pfn < iovad->start_pfn) { ++ iovad->max32_alloc_size = size; + goto iova32_full; ++ } + + /* pfn_lo will point to size aligned address if size_aligned is set */ + new->pfn_lo = new_pfn; +@@ -222,7 +224,6 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad, + return 0; + + iova32_full: +- iovad->max32_alloc_size = size; + spin_unlock_irqrestore(&iovad->iova_rbtree_lock, flags); + return -ENOMEM; + } +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index f867d41b0aa1..93e32a59640c 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1482,7 +1482,7 @@ static int lpi_range_cmp(void *priv, struct list_head *a, struct list_head *b) + ra = container_of(a, struct lpi_range, entry); + rb = container_of(b, struct lpi_range, entry); + +- return rb->base_id - ra->base_id; ++ return ra->base_id - rb->base_id; + } + + static void merge_lpi_ranges(void) +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index d45415cbe6e7..14cff91b7aea 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1212,7 +1212,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain *chain, + + __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl); + +- memset(ev->reserved, 0, sizeof(ev->reserved)); ++ memset(ev, 0, sizeof(*ev)); + ev->type = V4L2_EVENT_CTRL; + ev->id = v4l2_ctrl.id; + ev->u.ctrl.value = value; +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 5e3806feb5d7..8a82427c4d54 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -1387,7 +1387,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl) + + static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes) + { +- memset(ev->reserved, 0, sizeof(ev->reserved)); ++ memset(ev, 0, sizeof(*ev)); + ev->type = V4L2_EVENT_CTRL; + ev->id = ctrl->id; + ev->u.ctrl.changes = changes; +diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c +index c712b7deb3a9..82a97866e0cf 100644 +--- a/drivers/mmc/host/alcor.c ++++ b/drivers/mmc/host/alcor.c +@@ -1044,14 +1044,27 @@ static void alcor_init_mmc(struct alcor_sdmmc_host *host) + mmc->caps2 = MMC_CAP2_NO_SDIO; + mmc->ops = &alcor_sdc_ops; + +- /* Hardware cannot do scatter lists */ ++ /* The hardware does DMA data transfer of 4096 bytes to/from a single ++ * buffer address. Scatterlists are not supported, but upon DMA ++ * completion (signalled via IRQ), the original vendor driver does ++ * then immediately set up another DMA transfer of the next 4096 ++ * bytes. ++ * ++ * This means that we need to handle the I/O in 4096 byte chunks. ++ * Lacking a way to limit the sglist entries to 4096 bytes, we instead ++ * impose that only one segment is provided, with maximum size 4096, ++ * which also happens to be the minimum size. This means that the ++ * single-entry sglist handled by this driver can be handed directly ++ * to the hardware, nice and simple. ++ * ++ * Unfortunately though, that means we only do 4096 bytes I/O per ++ * MMC command. A future improvement would be to make the driver ++ * accept sg lists and entries of any size, and simply iterate ++ * through them 4096 bytes at a time. ++ */ + mmc->max_segs = AU6601_MAX_DMA_SEGMENTS; + mmc->max_seg_size = AU6601_MAX_DMA_BLOCK_SIZE; +- +- mmc->max_blk_size = mmc->max_seg_size; +- mmc->max_blk_count = mmc->max_segs; +- +- mmc->max_req_size = mmc->max_seg_size * mmc->max_segs; ++ mmc->max_req_size = mmc->max_seg_size; + } + + static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev) +diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c +index 4d17032d15ee..7b530e5a86da 100644 +--- a/drivers/mmc/host/mxcmmc.c ++++ b/drivers/mmc/host/mxcmmc.c +@@ -292,11 +292,8 @@ static void mxcmci_swap_buffers(struct mmc_data *data) + struct scatterlist *sg; + int i; + +- for_each_sg(data->sg, sg, data->sg_len, i) { +- void *buf = kmap_atomic(sg_page(sg) + sg->offset); +- buffer_swap32(buf, sg->length); +- kunmap_atomic(buf); +- } ++ for_each_sg(data->sg, sg, data->sg_len, i) ++ buffer_swap32(sg_virt(sg), sg->length); + } + #else + static inline void mxcmci_swap_buffers(struct mmc_data *data) {} +@@ -613,7 +610,6 @@ static int mxcmci_transfer_data(struct mxcmci_host *host) + { + struct mmc_data *data = host->req->data; + struct scatterlist *sg; +- void *buf; + int stat, i; + + host->data = data; +@@ -621,18 +617,14 @@ static int mxcmci_transfer_data(struct mxcmci_host *host) + + if (data->flags & MMC_DATA_READ) { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_pull(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_pull(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; + } + } else { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_push(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_push(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index 8779bbaa6b69..194a81888792 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -162,7 +162,7 @@ static void pxamci_dma_irq(void *param); + static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) + { + struct dma_async_tx_descriptor *tx; +- enum dma_data_direction direction; ++ enum dma_transfer_direction direction; + struct dma_slave_config config; + struct dma_chan *chan; + unsigned int nob = data->blocks; +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 7e2a75c4f36f..d9be22b310e6 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -634,6 +634,7 @@ int renesas_sdhi_probe(struct platform_device *pdev, + struct renesas_sdhi *priv; + struct resource *res; + int irq, ret, i; ++ u16 ver; + + of_data = of_device_get_match_data(&pdev->dev); + +@@ -766,12 +767,17 @@ int renesas_sdhi_probe(struct platform_device *pdev, + if (ret) + goto efree; + ++ ver = sd_ctrl_read16(host, CTL_VERSION); ++ /* GEN2_SDR104 is first known SDHI to use 32bit block count */ ++ if (ver < SDHI_VER_GEN2_SDR104 && mmc_data->max_blk_count > U16_MAX) ++ mmc_data->max_blk_count = U16_MAX; ++ + ret = tmio_mmc_host_probe(host); + if (ret < 0) + goto edisclk; + + /* One Gen2 SDHI incarnation does NOT have a CBSY bit */ +- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN2_SDR50) ++ if (ver == SDHI_VER_GEN2_SDR50) + mmc_data->flags &= ~TMIO_MMC_HAVE_CBSY; + + /* Enable tuning iff we have an SCC and a supported mode */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index 370ca94b6775..c7c2920c05c4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -40,6 +40,9 @@ + #include "mlx5_core.h" + #include "lib/eq.h" + ++static int mlx5_core_drain_dct(struct mlx5_core_dev *dev, ++ struct mlx5_core_dct *dct); ++ + static struct mlx5_core_rsc_common * + mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn) + { +@@ -227,13 +230,42 @@ static void destroy_resource_common(struct mlx5_core_dev *dev, + wait_for_completion(&qp->common.free); + } + ++static int _mlx5_core_destroy_dct(struct mlx5_core_dev *dev, ++ struct mlx5_core_dct *dct, bool need_cleanup) ++{ ++ u32 out[MLX5_ST_SZ_DW(destroy_dct_out)] = {0}; ++ u32 in[MLX5_ST_SZ_DW(destroy_dct_in)] = {0}; ++ struct mlx5_core_qp *qp = &dct->mqp; ++ int err; ++ ++ err = mlx5_core_drain_dct(dev, dct); ++ if (err) { ++ if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { ++ goto destroy; ++ } else { ++ mlx5_core_warn( ++ dev, "failed drain DCT 0x%x with error 0x%x\n", ++ qp->qpn, err); ++ return err; ++ } ++ } ++ wait_for_completion(&dct->drained); ++destroy: ++ if (need_cleanup) ++ destroy_resource_common(dev, &dct->mqp); ++ MLX5_SET(destroy_dct_in, in, opcode, MLX5_CMD_OP_DESTROY_DCT); ++ MLX5_SET(destroy_dct_in, in, dctn, qp->qpn); ++ MLX5_SET(destroy_dct_in, in, uid, qp->uid); ++ err = mlx5_cmd_exec(dev, (void *)&in, sizeof(in), ++ (void *)&out, sizeof(out)); ++ return err; ++} ++ + int mlx5_core_create_dct(struct mlx5_core_dev *dev, + struct mlx5_core_dct *dct, + u32 *in, int inlen) + { + u32 out[MLX5_ST_SZ_DW(create_dct_out)] = {0}; +- u32 din[MLX5_ST_SZ_DW(destroy_dct_in)] = {0}; +- u32 dout[MLX5_ST_SZ_DW(destroy_dct_out)] = {0}; + struct mlx5_core_qp *qp = &dct->mqp; + int err; + +@@ -254,11 +286,7 @@ int mlx5_core_create_dct(struct mlx5_core_dev *dev, + + return 0; + err_cmd: +- MLX5_SET(destroy_dct_in, din, opcode, MLX5_CMD_OP_DESTROY_DCT); +- MLX5_SET(destroy_dct_in, din, dctn, qp->qpn); +- MLX5_SET(destroy_dct_in, din, uid, qp->uid); +- mlx5_cmd_exec(dev, (void *)&in, sizeof(din), +- (void *)&out, sizeof(dout)); ++ _mlx5_core_destroy_dct(dev, dct, false); + return err; + } + EXPORT_SYMBOL_GPL(mlx5_core_create_dct); +@@ -323,29 +351,7 @@ static int mlx5_core_drain_dct(struct mlx5_core_dev *dev, + int mlx5_core_destroy_dct(struct mlx5_core_dev *dev, + struct mlx5_core_dct *dct) + { +- u32 out[MLX5_ST_SZ_DW(destroy_dct_out)] = {0}; +- u32 in[MLX5_ST_SZ_DW(destroy_dct_in)] = {0}; +- struct mlx5_core_qp *qp = &dct->mqp; +- int err; +- +- err = mlx5_core_drain_dct(dev, dct); +- if (err) { +- if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { +- goto destroy; +- } else { +- mlx5_core_warn(dev, "failed drain DCT 0x%x with error 0x%x\n", qp->qpn, err); +- return err; +- } +- } +- wait_for_completion(&dct->drained); +-destroy: +- destroy_resource_common(dev, &dct->mqp); +- MLX5_SET(destroy_dct_in, in, opcode, MLX5_CMD_OP_DESTROY_DCT); +- MLX5_SET(destroy_dct_in, in, dctn, qp->qpn); +- MLX5_SET(destroy_dct_in, in, uid, qp->uid); +- err = mlx5_cmd_exec(dev, (void *)&in, sizeof(in), +- (void *)&out, sizeof(out)); +- return err; ++ return _mlx5_core_destroy_dct(dev, dct, true); + } + EXPORT_SYMBOL_GPL(mlx5_core_destroy_dct); + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index 1135e74646e2..8cec5230fe31 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -96,6 +96,7 @@ static int client_reserve = 1; + static char partition_name[96] = "UNKNOWN"; + static unsigned int partition_number = -1; + static LIST_HEAD(ibmvscsi_head); ++static DEFINE_SPINLOCK(ibmvscsi_driver_lock); + + static struct scsi_transport_template *ibmvscsi_transport_template; + +@@ -2270,7 +2271,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + } + + dev_set_drvdata(&vdev->dev, hostdata); ++ spin_lock(&ibmvscsi_driver_lock); + list_add_tail(&hostdata->host_list, &ibmvscsi_head); ++ spin_unlock(&ibmvscsi_driver_lock); + return 0; + + add_srp_port_failed: +@@ -2292,15 +2295,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + static int ibmvscsi_remove(struct vio_dev *vdev) + { + struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev); +- list_del(&hostdata->host_list); +- unmap_persist_bufs(hostdata); ++ unsigned long flags; ++ ++ srp_remove_host(hostdata->host); ++ scsi_remove_host(hostdata->host); ++ ++ purge_requests(hostdata, DID_ERROR); ++ ++ spin_lock_irqsave(hostdata->host->host_lock, flags); + release_event_pool(&hostdata->pool, hostdata); ++ spin_unlock_irqrestore(hostdata->host->host_lock, flags); ++ + ibmvscsi_release_crq_queue(&hostdata->queue, hostdata, + max_events); + + kthread_stop(hostdata->work_thread); +- srp_remove_host(hostdata->host); +- scsi_remove_host(hostdata->host); ++ unmap_persist_bufs(hostdata); ++ ++ spin_lock(&ibmvscsi_driver_lock); ++ list_del(&hostdata->host_list); ++ spin_unlock(&ibmvscsi_driver_lock); ++ + scsi_host_put(hostdata->host); + + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index f44e640229e7..7f8946844a5e 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4968,6 +4968,13 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha) + (area != vha->d_id.b.area || domain != vha->d_id.b.domain)) + continue; + ++ /* Bypass if not same domain and area of adapter. */ ++ if (area && domain && ((area != vha->d_id.b.area) || ++ (domain != vha->d_id.b.domain)) && ++ (ha->current_topology == ISP_CFG_NL)) ++ continue; ++ ++ + /* Bypass invalid local loop ID. */ + if (loop_id > LAST_LOCAL_LOOP_ID) + continue; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index a6828391d6b3..5a6e8e12701a 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -2598,8 +2598,10 @@ void scsi_device_resume(struct scsi_device *sdev) + * device deleted during suspend) + */ + mutex_lock(&sdev->state_mutex); +- sdev->quiesced_by = NULL; +- blk_clear_pm_only(sdev->request_queue); ++ if (sdev->quiesced_by) { ++ sdev->quiesced_by = NULL; ++ blk_clear_pm_only(sdev->request_queue); ++ } + if (sdev->sdev_state == SDEV_QUIESCE) + scsi_device_set_state(sdev, SDEV_RUNNING); + mutex_unlock(&sdev->state_mutex); +diff --git a/fs/aio.c b/fs/aio.c +index 528d03680526..3d9669d011b9 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -167,9 +167,13 @@ struct kioctx { + unsigned id; + }; + ++/* ++ * First field must be the file pointer in all the ++ * iocb unions! See also 'struct kiocb' in <linux/fs.h> ++ */ + struct fsync_iocb { +- struct work_struct work; + struct file *file; ++ struct work_struct work; + bool datasync; + }; + +@@ -183,8 +187,15 @@ struct poll_iocb { + struct work_struct work; + }; + ++/* ++ * NOTE! Each of the iocb union members has the file pointer ++ * as the first entry in their struct definition. So you can ++ * access the file pointer through any of the sub-structs, ++ * or directly as just 'ki_filp' in this struct. ++ */ + struct aio_kiocb { + union { ++ struct file *ki_filp; + struct kiocb rw; + struct fsync_iocb fsync; + struct poll_iocb poll; +@@ -1060,6 +1071,8 @@ static inline void iocb_put(struct aio_kiocb *iocb) + { + if (refcount_read(&iocb->ki_refcnt) == 0 || + refcount_dec_and_test(&iocb->ki_refcnt)) { ++ if (iocb->ki_filp) ++ fput(iocb->ki_filp); + percpu_ref_put(&iocb->ki_ctx->reqs); + kmem_cache_free(kiocb_cachep, iocb); + } +@@ -1424,7 +1437,6 @@ static void aio_complete_rw(struct kiocb *kiocb, long res, long res2) + file_end_write(kiocb->ki_filp); + } + +- fput(kiocb->ki_filp); + aio_complete(iocb, res, res2); + } + +@@ -1432,9 +1444,6 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb) + { + int ret; + +- req->ki_filp = fget(iocb->aio_fildes); +- if (unlikely(!req->ki_filp)) +- return -EBADF; + req->ki_complete = aio_complete_rw; + req->private = NULL; + req->ki_pos = iocb->aio_offset; +@@ -1451,7 +1460,7 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb) + ret = ioprio_check_cap(iocb->aio_reqprio); + if (ret) { + pr_debug("aio ioprio check cap error: %d\n", ret); +- goto out_fput; ++ return ret; + } + + req->ki_ioprio = iocb->aio_reqprio; +@@ -1460,14 +1469,10 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb) + + ret = kiocb_set_rw_flags(req, iocb->aio_rw_flags); + if (unlikely(ret)) +- goto out_fput; ++ return ret; + + req->ki_flags &= ~IOCB_HIPRI; /* no one is going to poll for this I/O */ + return 0; +- +-out_fput: +- fput(req->ki_filp); +- return ret; + } + + static int aio_setup_rw(int rw, const struct iocb *iocb, struct iovec **iovec, +@@ -1521,24 +1526,19 @@ static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb, + if (ret) + return ret; + file = req->ki_filp; +- +- ret = -EBADF; + if (unlikely(!(file->f_mode & FMODE_READ))) +- goto out_fput; ++ return -EBADF; + ret = -EINVAL; + if (unlikely(!file->f_op->read_iter)) +- goto out_fput; ++ return -EINVAL; + + ret = aio_setup_rw(READ, iocb, &iovec, vectored, compat, &iter); + if (ret) +- goto out_fput; ++ return ret; + ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter)); + if (!ret) + aio_rw_done(req, call_read_iter(file, req, &iter)); + kfree(iovec); +-out_fput: +- if (unlikely(ret)) +- fput(file); + return ret; + } + +@@ -1555,16 +1555,14 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb, + return ret; + file = req->ki_filp; + +- ret = -EBADF; + if (unlikely(!(file->f_mode & FMODE_WRITE))) +- goto out_fput; +- ret = -EINVAL; ++ return -EBADF; + if (unlikely(!file->f_op->write_iter)) +- goto out_fput; ++ return -EINVAL; + + ret = aio_setup_rw(WRITE, iocb, &iovec, vectored, compat, &iter); + if (ret) +- goto out_fput; ++ return ret; + ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter)); + if (!ret) { + /* +@@ -1582,9 +1580,6 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb, + aio_rw_done(req, call_write_iter(file, req, &iter)); + } + kfree(iovec); +-out_fput: +- if (unlikely(ret)) +- fput(file); + return ret; + } + +@@ -1594,7 +1589,6 @@ static void aio_fsync_work(struct work_struct *work) + int ret; + + ret = vfs_fsync(req->file, req->datasync); +- fput(req->file); + aio_complete(container_of(req, struct aio_kiocb, fsync), ret, 0); + } + +@@ -1605,13 +1599,8 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb, + iocb->aio_rw_flags)) + return -EINVAL; + +- req->file = fget(iocb->aio_fildes); +- if (unlikely(!req->file)) +- return -EBADF; +- if (unlikely(!req->file->f_op->fsync)) { +- fput(req->file); ++ if (unlikely(!req->file->f_op->fsync)) + return -EINVAL; +- } + + req->datasync = datasync; + INIT_WORK(&req->work, aio_fsync_work); +@@ -1621,10 +1610,7 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb, + + static inline void aio_poll_complete(struct aio_kiocb *iocb, __poll_t mask) + { +- struct file *file = iocb->poll.file; +- + aio_complete(iocb, mangle_poll(mask), 0); +- fput(file); + } + + static void aio_poll_complete_work(struct work_struct *work) +@@ -1749,9 +1735,6 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb) + + INIT_WORK(&req->work, aio_poll_complete_work); + req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP; +- req->file = fget(iocb->aio_fildes); +- if (unlikely(!req->file)) +- return -EBADF; + + req->head = NULL; + req->woken = false; +@@ -1794,10 +1777,8 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb) + spin_unlock_irq(&ctx->ctx_lock); + + out: +- if (unlikely(apt.error)) { +- fput(req->file); ++ if (unlikely(apt.error)) + return apt.error; +- } + + if (mask) + aio_poll_complete(aiocb, mask); +@@ -1835,6 +1816,11 @@ static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb, + if (unlikely(!req)) + goto out_put_reqs_available; + ++ req->ki_filp = fget(iocb->aio_fildes); ++ ret = -EBADF; ++ if (unlikely(!req->ki_filp)) ++ goto out_put_req; ++ + if (iocb->aio_flags & IOCB_FLAG_RESFD) { + /* + * If the IOCB_FLAG_RESFD flag of aio_flags is set, get an +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 77b3aaa39b35..104905732fbe 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1605,9 +1605,16 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + iov[1].iov_base = unc_path; + iov[1].iov_len = unc_path_len; + +- /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */ ++ /* ++ * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 ++ * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 ++ * (Samba servers don't always set the flag so also check if null user) ++ */ + if ((ses->server->dialect == SMB311_PROT_ID) && +- !smb3_encryption_required(tcon)) ++ !smb3_encryption_required(tcon) && ++ !(ses->session_flags & ++ (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && ++ ((ses->user_name != NULL) || (ses->sectype == Kerberos))) + req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED; + + memset(&rqst, 0, sizeof(struct smb_rqst)); +diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h +index 15b6dd733780..df908ef79cce 100644 +--- a/fs/ext4/ext4_jbd2.h ++++ b/fs/ext4/ext4_jbd2.h +@@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle, + { + struct ext4_inode_info *ei = EXT4_I(inode); + +- if (ext4_handle_valid(handle)) { ++ if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) { + ei->i_sync_tid = handle->h_transaction->t_tid; + if (datasync) + ei->i_datasync_tid = handle->h_transaction->t_tid; +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 69d65d49837b..98ec11f69cd4 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -125,7 +125,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter *from, loff_t pos) + struct super_block *sb = inode->i_sb; + int blockmask = sb->s_blocksize - 1; + +- if (pos >= i_size_read(inode)) ++ if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize)) + return 0; + + if ((pos | iov_iter_alignment(from)) & blockmask) +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index bf7fa1507e81..9e96a0bd08d9 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -1387,10 +1387,14 @@ end_range: + partial->p + 1, + partial2->p, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); ++ while (partial > chain) { ++ BUFFER_TRACE(partial->bh, "call brelse"); ++ brelse(partial->bh); ++ } ++ while (partial2 > chain2) { ++ BUFFER_TRACE(partial2->bh, "call brelse"); ++ brelse(partial2->bh); ++ } + return 0; + } + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 9b79056d705d..e1b1d390b329 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -215,7 +215,8 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page) + } + + static int __revoke_inmem_pages(struct inode *inode, +- struct list_head *head, bool drop, bool recover) ++ struct list_head *head, bool drop, bool recover, ++ bool trylock) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct inmem_pages *cur, *tmp; +@@ -227,7 +228,16 @@ static int __revoke_inmem_pages(struct inode *inode, + if (drop) + trace_f2fs_commit_inmem_page(page, INMEM_DROP); + +- lock_page(page); ++ if (trylock) { ++ /* ++ * to avoid deadlock in between page lock and ++ * inmem_lock. ++ */ ++ if (!trylock_page(page)) ++ continue; ++ } else { ++ lock_page(page); ++ } + + f2fs_wait_on_page_writeback(page, DATA, true, true); + +@@ -318,13 +328,19 @@ void f2fs_drop_inmem_pages(struct inode *inode) + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct f2fs_inode_info *fi = F2FS_I(inode); + +- mutex_lock(&fi->inmem_lock); +- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false); +- spin_lock(&sbi->inode_lock[ATOMIC_FILE]); +- if (!list_empty(&fi->inmem_ilist)) +- list_del_init(&fi->inmem_ilist); +- spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); +- mutex_unlock(&fi->inmem_lock); ++ while (!list_empty(&fi->inmem_pages)) { ++ mutex_lock(&fi->inmem_lock); ++ __revoke_inmem_pages(inode, &fi->inmem_pages, ++ true, false, true); ++ ++ if (list_empty(&fi->inmem_pages)) { ++ spin_lock(&sbi->inode_lock[ATOMIC_FILE]); ++ if (!list_empty(&fi->inmem_ilist)) ++ list_del_init(&fi->inmem_ilist); ++ spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); ++ } ++ mutex_unlock(&fi->inmem_lock); ++ } + + clear_inode_flag(inode, FI_ATOMIC_FILE); + fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0; +@@ -429,12 +445,15 @@ retry: + * recovery or rewrite & commit last transaction. For other + * error number, revoking was done by filesystem itself. + */ +- err = __revoke_inmem_pages(inode, &revoke_list, false, true); ++ err = __revoke_inmem_pages(inode, &revoke_list, ++ false, true, false); + + /* drop all uncommitted pages */ +- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false); ++ __revoke_inmem_pages(inode, &fi->inmem_pages, ++ true, false, false); + } else { +- __revoke_inmem_pages(inode, &revoke_list, false, false); ++ __revoke_inmem_pages(inode, &revoke_list, ++ false, false, false); + } + + return err; +diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c +index b647f0bd150c..94220ba85628 100644 +--- a/fs/udf/truncate.c ++++ b/fs/udf/truncate.c +@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode) + epos.block = eloc; + epos.bh = udf_tread(sb, + udf_get_lb_pblock(sb, &eloc, 0)); ++ /* Error reading indirect block? */ ++ if (!epos.bh) ++ return; + if (elen) + indirect_ext_len = + (elen + sb->s_blocksize - 1) >> +diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h +index a420c07904bc..337d5049ff93 100644 +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -294,6 +294,8 @@ extern void ceph_destroy_client(struct ceph_client *client); + extern int __ceph_open_session(struct ceph_client *client, + unsigned long started); + extern int ceph_open_session(struct ceph_client *client); ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout); + + /* pagevec.c */ + extern void ceph_release_page_vector(struct page **pages, int num_pages); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 29d8e2cfed0e..fd423fec8d83 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -304,13 +304,19 @@ enum rw_hint { + + struct kiocb { + struct file *ki_filp; ++ ++ /* The 'ki_filp' pointer is shared in a union for aio */ ++ randomized_struct_fields_start ++ + loff_t ki_pos; + void (*ki_complete)(struct kiocb *iocb, long ret, long ret2); + void *private; + int ki_flags; + u16 ki_hint; + u16 ki_ioprio; /* See linux/ioprio.h */ +-} __randomize_layout; ++ ++ randomized_struct_fields_end ++}; + + static inline bool is_sync_kiocb(struct kiocb *kiocb) + { +diff --git a/kernel/futex.c b/kernel/futex.c +index a0514e01c3eb..52668d44e07b 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3440,6 +3440,10 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int p + { + u32 uval, uninitialized_var(nval), mval; + ++ /* Futex address must be 32bit aligned */ ++ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0) ++ return -1; ++ + retry: + if (get_user(uval, uaddr)) + return -1; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 95932333a48b..e805fe3bf87f 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3535,6 +3535,9 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip) + unsigned int depth; + int i; + ++ if (unlikely(!debug_locks)) ++ return 0; ++ + depth = curr->lockdep_depth; + /* + * This function is about (re)setting the class of a held lock, +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 1506e1632394..d4e2a166ae17 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -831,8 +831,6 @@ static int hci_sock_release(struct socket *sock) + if (!sk) + return 0; + +- hdev = hci_pi(sk)->hdev; +- + switch (hci_pi(sk)->channel) { + case HCI_CHANNEL_MONITOR: + atomic_dec(&monitor_promisc); +@@ -854,6 +852,7 @@ static int hci_sock_release(struct socket *sock) + + bt_sock_unlink(&hci_sk_list, sk); + ++ hdev = hci_pi(sk)->hdev; + if (hdev) { + if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { + /* When releasing a user channel exclusive access, +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 6693e209efe8..f77888ec93f1 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -31,10 +31,6 @@ + /* needed for logical [in,out]-dev filtering */ + #include "../br_private.h" + +-#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\ +- "report to author: "format, ## args) +-/* #define BUGPRINT(format, args...) */ +- + /* Each cpu has its own set of counters, so there is no need for write_lock in + * the softirq + * For reading or updating the counters, the user context needs to +@@ -466,8 +462,6 @@ static int ebt_verify_pointers(const struct ebt_replace *repl, + /* we make userspace set this right, + * so there is no misunderstanding + */ +- BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set " +- "in distinguisher\n"); + return -EINVAL; + } + if (i != NF_BR_NUMHOOKS) +@@ -485,18 +479,14 @@ static int ebt_verify_pointers(const struct ebt_replace *repl, + offset += e->next_offset; + } + } +- if (offset != limit) { +- BUGPRINT("entries_size too small\n"); ++ if (offset != limit) + return -EINVAL; +- } + + /* check if all valid hooks have a chain */ + for (i = 0; i < NF_BR_NUMHOOKS; i++) { + if (!newinfo->hook_entry[i] && +- (valid_hooks & (1 << i))) { +- BUGPRINT("Valid hook without chain\n"); ++ (valid_hooks & (1 << i))) + return -EINVAL; +- } + } + return 0; + } +@@ -523,26 +513,20 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e, + /* this checks if the previous chain has as many entries + * as it said it has + */ +- if (*n != *cnt) { +- BUGPRINT("nentries does not equal the nr of entries " +- "in the chain\n"); ++ if (*n != *cnt) + return -EINVAL; +- } ++ + if (((struct ebt_entries *)e)->policy != EBT_DROP && + ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { + /* only RETURN from udc */ + if (i != NF_BR_NUMHOOKS || +- ((struct ebt_entries *)e)->policy != EBT_RETURN) { +- BUGPRINT("bad policy\n"); ++ ((struct ebt_entries *)e)->policy != EBT_RETURN) + return -EINVAL; +- } + } + if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ + (*udc_cnt)++; +- if (((struct ebt_entries *)e)->counter_offset != *totalcnt) { +- BUGPRINT("counter_offset != totalcnt"); ++ if (((struct ebt_entries *)e)->counter_offset != *totalcnt) + return -EINVAL; +- } + *n = ((struct ebt_entries *)e)->nentries; + *cnt = 0; + return 0; +@@ -550,15 +534,13 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e, + /* a plain old entry, heh */ + if (sizeof(struct ebt_entry) > e->watchers_offset || + e->watchers_offset > e->target_offset || +- e->target_offset >= e->next_offset) { +- BUGPRINT("entry offsets not in right order\n"); ++ e->target_offset >= e->next_offset) + return -EINVAL; +- } ++ + /* this is not checked anywhere else */ +- if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) { +- BUGPRINT("target size too small\n"); ++ if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) + return -EINVAL; +- } ++ + (*cnt)++; + (*totalcnt)++; + return 0; +@@ -678,18 +660,15 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + if (e->bitmask == 0) + return 0; + +- if (e->bitmask & ~EBT_F_MASK) { +- BUGPRINT("Unknown flag for bitmask\n"); ++ if (e->bitmask & ~EBT_F_MASK) + return -EINVAL; +- } +- if (e->invflags & ~EBT_INV_MASK) { +- BUGPRINT("Unknown flag for inv bitmask\n"); ++ ++ if (e->invflags & ~EBT_INV_MASK) + return -EINVAL; +- } +- if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) { +- BUGPRINT("NOPROTO & 802_3 not allowed\n"); ++ ++ if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) + return -EINVAL; +- } ++ + /* what hook do we belong to? */ + for (i = 0; i < NF_BR_NUMHOOKS; i++) { + if (!newinfo->hook_entry[i]) +@@ -748,13 +727,11 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + t->u.target = target; + if (t->u.target == &ebt_standard_target) { + if (gap < sizeof(struct ebt_standard_target)) { +- BUGPRINT("Standard target size too big\n"); + ret = -EFAULT; + goto cleanup_watchers; + } + if (((struct ebt_standard_target *)t)->verdict < + -NUM_STANDARD_TARGETS) { +- BUGPRINT("Invalid standard target\n"); + ret = -EFAULT; + goto cleanup_watchers; + } +@@ -813,10 +790,9 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack + if (strcmp(t->u.name, EBT_STANDARD_TARGET)) + goto letscontinue; + if (e->target_offset + sizeof(struct ebt_standard_target) > +- e->next_offset) { +- BUGPRINT("Standard target size too big\n"); ++ e->next_offset) + return -1; +- } ++ + verdict = ((struct ebt_standard_target *)t)->verdict; + if (verdict >= 0) { /* jump to another chain */ + struct ebt_entries *hlp2 = +@@ -825,14 +801,12 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack + if (hlp2 == cl_s[i].cs.chaininfo) + break; + /* bad destination or loop */ +- if (i == udc_cnt) { +- BUGPRINT("bad destination\n"); ++ if (i == udc_cnt) + return -1; +- } +- if (cl_s[i].cs.n) { +- BUGPRINT("loop\n"); ++ ++ if (cl_s[i].cs.n) + return -1; +- } ++ + if (cl_s[i].hookmask & (1 << hooknr)) + goto letscontinue; + /* this can't be 0, so the loop test is correct */ +@@ -865,24 +839,21 @@ static int translate_table(struct net *net, const char *name, + i = 0; + while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) + i++; +- if (i == NF_BR_NUMHOOKS) { +- BUGPRINT("No valid hooks specified\n"); ++ if (i == NF_BR_NUMHOOKS) + return -EINVAL; +- } +- if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) { +- BUGPRINT("Chains don't start at beginning\n"); ++ ++ if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) + return -EINVAL; +- } ++ + /* make sure chains are ordered after each other in same order + * as their corresponding hooks + */ + for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { + if (!newinfo->hook_entry[j]) + continue; +- if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) { +- BUGPRINT("Hook order must be followed\n"); ++ if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) + return -EINVAL; +- } ++ + i = j; + } + +@@ -900,15 +871,11 @@ static int translate_table(struct net *net, const char *name, + if (ret != 0) + return ret; + +- if (i != j) { +- BUGPRINT("nentries does not equal the nr of entries in the " +- "(last) chain\n"); ++ if (i != j) + return -EINVAL; +- } +- if (k != newinfo->nentries) { +- BUGPRINT("Total nentries is wrong\n"); ++ ++ if (k != newinfo->nentries) + return -EINVAL; +- } + + /* get the location of the udc, put them in an array + * while we're at it, allocate the chainstack +@@ -942,7 +909,6 @@ static int translate_table(struct net *net, const char *name, + ebt_get_udc_positions, newinfo, &i, cl_s); + /* sanity check */ + if (i != udc_cnt) { +- BUGPRINT("i != udc_cnt\n"); + vfree(cl_s); + return -EFAULT; + } +@@ -1042,7 +1008,6 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, + goto free_unlock; + + if (repl->num_counters && repl->num_counters != t->private->nentries) { +- BUGPRINT("Wrong nr. of counters requested\n"); + ret = -EINVAL; + goto free_unlock; + } +@@ -1118,15 +1083,12 @@ static int do_replace(struct net *net, const void __user *user, + if (copy_from_user(&tmp, user, sizeof(tmp)) != 0) + return -EFAULT; + +- if (len != sizeof(tmp) + tmp.entries_size) { +- BUGPRINT("Wrong len argument\n"); ++ if (len != sizeof(tmp) + tmp.entries_size) + return -EINVAL; +- } + +- if (tmp.entries_size == 0) { +- BUGPRINT("Entries_size never zero\n"); ++ if (tmp.entries_size == 0) + return -EINVAL; +- } ++ + /* overflow check */ + if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / + NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) +@@ -1153,7 +1115,6 @@ static int do_replace(struct net *net, const void __user *user, + } + if (copy_from_user( + newinfo->entries, tmp.entries, tmp.entries_size) != 0) { +- BUGPRINT("Couldn't copy entries from userspace\n"); + ret = -EFAULT; + goto free_entries; + } +@@ -1194,10 +1155,8 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + + if (input_table == NULL || (repl = input_table->table) == NULL || + repl->entries == NULL || repl->entries_size == 0 || +- repl->counters != NULL || input_table->private != NULL) { +- BUGPRINT("Bad table data for ebt_register_table!!!\n"); ++ repl->counters != NULL || input_table->private != NULL) + return -EINVAL; +- } + + /* Don't add one table to multiple lists. */ + table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL); +@@ -1235,13 +1194,10 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + ((char *)repl->hook_entry[i] - repl->entries); + } + ret = translate_table(net, repl->name, newinfo); +- if (ret != 0) { +- BUGPRINT("Translate_table failed\n"); ++ if (ret != 0) + goto free_chainstack; +- } + + if (table->check && table->check(newinfo, table->valid_hooks)) { +- BUGPRINT("The table doesn't like its own initial data, lol\n"); + ret = -EINVAL; + goto free_chainstack; + } +@@ -1252,7 +1208,6 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table, + list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) { + if (strcmp(t->name, table->name) == 0) { + ret = -EEXIST; +- BUGPRINT("Table name already exists\n"); + goto free_unlock; + } + } +@@ -1320,7 +1275,6 @@ static int do_update_counters(struct net *net, const char *name, + goto free_tmp; + + if (num_counters != t->private->nentries) { +- BUGPRINT("Wrong nr of counters\n"); + ret = -EINVAL; + goto unlock_mutex; + } +@@ -1447,10 +1401,8 @@ static int copy_counters_to_user(struct ebt_table *t, + if (num_counters == 0) + return 0; + +- if (num_counters != nentries) { +- BUGPRINT("Num_counters wrong\n"); ++ if (num_counters != nentries) + return -EINVAL; +- } + + counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); + if (!counterstmp) +@@ -1496,15 +1448,11 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user, + (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0)) + return -EINVAL; + +- if (tmp.nentries != nentries) { +- BUGPRINT("Nentries wrong\n"); ++ if (tmp.nentries != nentries) + return -EINVAL; +- } + +- if (tmp.entries_size != entries_size) { +- BUGPRINT("Wrong size\n"); ++ if (tmp.entries_size != entries_size) + return -EINVAL; +- } + + ret = copy_counters_to_user(t, oldcounters, tmp.counters, + tmp.num_counters, nentries); +@@ -1576,7 +1524,6 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) + } + mutex_unlock(&ebt_mutex); + if (copy_to_user(user, &tmp, *len) != 0) { +- BUGPRINT("c2u Didn't work\n"); + ret = -EFAULT; + break; + } +diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c +index 9cab80207ced..79eac465ec65 100644 +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -738,7 +738,6 @@ int __ceph_open_session(struct ceph_client *client, unsigned long started) + } + EXPORT_SYMBOL(__ceph_open_session); + +- + int ceph_open_session(struct ceph_client *client) + { + int ret; +@@ -754,6 +753,23 @@ int ceph_open_session(struct ceph_client *client) + } + EXPORT_SYMBOL(ceph_open_session); + ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout) ++{ ++ u64 newest_epoch; ++ int ret; ++ ++ ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch); ++ if (ret) ++ return ret; ++ ++ if (client->osdc.osdmap->epoch >= newest_epoch) ++ return 0; ++ ++ ceph_osdc_maybe_request_map(&client->osdc); ++ return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout); ++} ++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap); + + static int __init init_ceph_lib(void) + { +diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c +index 18deb3d889c4..a53e4fbb6319 100644 +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_mon_client *monc, + mutex_unlock(&monc->mutex); + + ret = wait_generic_request(req); ++ if (!ret) ++ /* ++ * Make sure we have the osdmap that includes the blacklist ++ * entry. This is needed to ensure that the OSDs pick up the ++ * new blacklist before processing any future requests from ++ * this client. ++ */ ++ ret = ceph_wait_for_latest_osdmap(monc->client, 0); ++ + out: + put_generic_request(req); + return ret; +diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c +index 9f0c480489ef..9cbf6927abe9 100644 +--- a/sound/ac97/bus.c ++++ b/sound/ac97/bus.c +@@ -84,7 +84,7 @@ ac97_of_get_child_device(struct ac97_controller *ac97_ctrl, int idx, + if ((idx != of_property_read_u32(node, "reg", ®)) || + !of_device_is_compatible(node, compat)) + continue; +- return of_node_get(node); ++ return node; + } + + return NULL; +diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c +index 220e61926ea4..513291ba0ab0 100644 +--- a/sound/firewire/motu/motu.c ++++ b/sound/firewire/motu/motu.c +@@ -36,7 +36,7 @@ static void name_card(struct snd_motu *motu) + fw_csr_iterator_init(&it, motu->unit->directory); + while (fw_csr_iterator_next(&it, &key, &val)) { + switch (key) { +- case CSR_VERSION: ++ case CSR_MODEL: + version = val; + break; + } +@@ -46,7 +46,7 @@ static void name_card(struct snd_motu *motu) + strcpy(motu->card->shortname, motu->spec->name); + strcpy(motu->card->mixername, motu->spec->name); + snprintf(motu->card->longname, sizeof(motu->card->longname), +- "MOTU %s (version:%d), GUID %08x%08x at %s, S%d", ++ "MOTU %s (version:%06x), GUID %08x%08x at %s, S%d", + motu->spec->name, version, + fw_dev->config_rom[3], fw_dev->config_rom[4], + dev_name(&motu->unit->device), 100 << fw_dev->max_speed); +@@ -237,20 +237,20 @@ static const struct snd_motu_spec motu_audio_express = { + #define SND_MOTU_DEV_ENTRY(model, data) \ + { \ + .match_flags = IEEE1394_MATCH_VENDOR_ID | \ +- IEEE1394_MATCH_MODEL_ID | \ +- IEEE1394_MATCH_SPECIFIER_ID, \ ++ IEEE1394_MATCH_SPECIFIER_ID | \ ++ IEEE1394_MATCH_VERSION, \ + .vendor_id = OUI_MOTU, \ +- .model_id = model, \ + .specifier_id = OUI_MOTU, \ ++ .version = model, \ + .driver_data = (kernel_ulong_t)data, \ + } + + static const struct ieee1394_device_id motu_id_table[] = { +- SND_MOTU_DEV_ENTRY(0x101800, &motu_828mk2), +- SND_MOTU_DEV_ENTRY(0x107800, &snd_motu_spec_traveler), +- SND_MOTU_DEV_ENTRY(0x106800, &motu_828mk3), /* FireWire only. */ +- SND_MOTU_DEV_ENTRY(0x100800, &motu_828mk3), /* Hybrid. */ +- SND_MOTU_DEV_ENTRY(0x104800, &motu_audio_express), ++ SND_MOTU_DEV_ENTRY(0x000003, &motu_828mk2), ++ SND_MOTU_DEV_ENTRY(0x000009, &snd_motu_spec_traveler), ++ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */ ++ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */ ++ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express), + { } + }; + MODULE_DEVICE_TABLE(ieee1394, motu_id_table); +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 9f8d59e7e89f..b238e903b9d7 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2917,6 +2917,7 @@ static void hda_call_codec_resume(struct hda_codec *codec) + hda_jackpoll_work(&codec->jackpoll_work.work); + else + snd_hda_jack_report_sync(codec); ++ codec->core.dev.power.power_state = PMSG_ON; + snd_hdac_leave_pm(&codec->core); + } + +@@ -2950,10 +2951,62 @@ static int hda_codec_runtime_resume(struct device *dev) + } + #endif /* CONFIG_PM */ + ++#ifdef CONFIG_PM_SLEEP ++static int hda_codec_force_resume(struct device *dev) ++{ ++ int ret; ++ ++ /* The get/put pair below enforces the runtime resume even if the ++ * device hasn't been used at suspend time. This trick is needed to ++ * update the jack state change during the sleep. ++ */ ++ pm_runtime_get_noresume(dev); ++ ret = pm_runtime_force_resume(dev); ++ pm_runtime_put(dev); ++ return ret; ++} ++ ++static int hda_codec_pm_suspend(struct device *dev) ++{ ++ dev->power.power_state = PMSG_SUSPEND; ++ return pm_runtime_force_suspend(dev); ++} ++ ++static int hda_codec_pm_resume(struct device *dev) ++{ ++ dev->power.power_state = PMSG_RESUME; ++ return hda_codec_force_resume(dev); ++} ++ ++static int hda_codec_pm_freeze(struct device *dev) ++{ ++ dev->power.power_state = PMSG_FREEZE; ++ return pm_runtime_force_suspend(dev); ++} ++ ++static int hda_codec_pm_thaw(struct device *dev) ++{ ++ dev->power.power_state = PMSG_THAW; ++ return hda_codec_force_resume(dev); ++} ++ ++static int hda_codec_pm_restore(struct device *dev) ++{ ++ dev->power.power_state = PMSG_RESTORE; ++ return hda_codec_force_resume(dev); ++} ++#endif /* CONFIG_PM_SLEEP */ ++ + /* referred in hda_bind.c */ + const struct dev_pm_ops hda_codec_driver_pm = { +- SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, +- pm_runtime_force_resume) ++#ifdef CONFIG_PM_SLEEP ++ .suspend = hda_codec_pm_suspend, ++ .resume = hda_codec_pm_resume, ++ .freeze = hda_codec_pm_freeze, ++ .thaw = hda_codec_pm_thaw, ++ .poweroff = hda_codec_pm_suspend, ++ .restore = hda_codec_pm_restore, ++#endif /* CONFIG_PM_SLEEP */ + SET_RUNTIME_PM_OPS(hda_codec_runtime_suspend, hda_codec_runtime_resume, + NULL) + }; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index e5c49003e75f..ece256a3b48f 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -947,7 +947,7 @@ static void __azx_runtime_suspend(struct azx *chip) + display_power(chip, false); + } + +-static void __azx_runtime_resume(struct azx *chip) ++static void __azx_runtime_resume(struct azx *chip, bool from_rt) + { + struct hda_intel *hda = container_of(chip, struct hda_intel, chip); + struct hdac_bus *bus = azx_bus(chip); +@@ -964,7 +964,7 @@ static void __azx_runtime_resume(struct azx *chip) + azx_init_pci(chip); + hda_intel_init_chip(chip, true); + +- if (status) { ++ if (status && from_rt) { + list_for_each_codec(codec, &chip->bus) + if (status & (1 << codec->addr)) + schedule_delayed_work(&codec->jackpoll_work, +@@ -1016,7 +1016,7 @@ static int azx_resume(struct device *dev) + chip->msi = 0; + if (azx_acquire_irq(chip, 1) < 0) + return -EIO; +- __azx_runtime_resume(chip); ++ __azx_runtime_resume(chip, false); + snd_power_change_state(card, SNDRV_CTL_POWER_D0); + + trace_azx_resume(chip); +@@ -1081,7 +1081,7 @@ static int azx_runtime_resume(struct device *dev) + chip = card->private_data; + if (!azx_has_pm_runtime(chip)) + return 0; +- __azx_runtime_resume(chip); ++ __azx_runtime_resume(chip, true); + + /* disable controller Wake Up event*/ + azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & +@@ -2144,10 +2144,12 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */ + SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0), +- /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ +- SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ + SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */ ++ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ ++ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + {} + }; + #endif /* CONFIG_PM */ +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 0414a0d52262..5dde107083c6 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2184,9 +2184,10 @@ static void cleanup(struct objtool_file *file) + elf_close(file->elf); + } + ++static struct objtool_file file; ++ + int check(const char *_objname, bool orc) + { +- struct objtool_file file; + int ret, warnings = 0; + + objname = _objname; +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index 18a59fba97ff..cc4773157b9b 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -157,8 +157,10 @@ static struct map *kernel_get_module_map(const char *module) + if (module && strchr(module, '/')) + return dso__new_map(module); + +- if (!module) +- module = "kernel"; ++ if (!module) { ++ pos = machine__kernel_map(host_machine); ++ return map__get(pos); ++ } + + for (pos = maps__first(maps); pos; pos = map__next(pos)) { + /* short_name is "[module]" */
