commit: 4aa114cd276dd123c94009cd717bc72fc4d9ef66 Author: Arisu Tachibana <alicef <AT> gentoo <DOT> org> AuthorDate: Thu Aug 21 06:55:21 2025 +0000 Commit: Arisu Tachibana <alicef <AT> gentoo <DOT> org> CommitDate: Thu Aug 21 06:55:21 2025 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4aa114cd
Linux patch 5.4.289 Signed-off-by: Arisu Tachibana <alicef <AT> gentoo.org> 0000_README | 4 + 1288_linux-5.4.289.patch | 2496 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2500 insertions(+) diff --git a/0000_README b/0000_README index af6975d4..6e06cdf1 100644 --- a/0000_README +++ b/0000_README @@ -1195,6 +1195,10 @@ Patch: 1287_linux-5.4.288.patch From: https://www.kernel.org Desc: Linux 5.4.288 +Patch: 1288_linux-5.4.289.patch +From: https://www.kernel.org +Desc: Linux 5.4.289 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1288_linux-5.4.289.patch b/1288_linux-5.4.289.patch new file mode 100644 index 00000000..f4a653b8 --- /dev/null +++ b/1288_linux-5.4.289.patch @@ -0,0 +1,2496 @@ +diff --git a/Makefile b/Makefile +index 0495e9f7c8e80c..e983a36fa88b52 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 288 ++SUBLEVEL = 289 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arc/Makefile b/arch/arc/Makefile +index 6f05e509889f63..d72d9f4dfc3dde 100644 +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -6,7 +6,7 @@ + KBUILD_DEFCONFIG := nsim_hs_defconfig + + ifeq ($(CROSS_COMPILE),) +-CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-) ++CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-) + endif + + cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 9ff2c70763a0ca..e2a2e5df4fde51 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -272,7 +272,7 @@ drivers-$(CONFIG_PCI) += arch/mips/pci/ + ifdef CONFIG_64BIT + ifndef KBUILD_SYM32 + ifeq ($(shell expr $(load-y) \< 0xffffffff80000000), 0) +- KBUILD_SYM32 = y ++ KBUILD_SYM32 = $(call cc-option-yn, -msym32) + endif + endif + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index c83e3dcac6dfc7..c453c24afeb8af 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1075,13 +1075,13 @@ struct regmap *__regmap_init(struct device *dev, + + /* Sanity check */ + if (range_cfg->range_max < range_cfg->range_min) { +- dev_err(map->dev, "Invalid range %d: %d < %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u < %u\n", i, + range_cfg->range_max, range_cfg->range_min); + goto err_range; + } + + if (range_cfg->range_max > map->max_register) { +- dev_err(map->dev, "Invalid range %d: %d > %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u > %u\n", i, + range_cfg->range_max, map->max_register); + goto err_range; + } +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 3afc07b59477bb..b1c5bcae9b318a 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1062,9 +1062,12 @@ static void virtblk_remove(struct virtio_device *vdev) + static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; ++ struct request_queue *q = vblk->disk->queue; + + /* Ensure no requests in virtqueues before deleting vqs. */ +- blk_mq_freeze_queue(vblk->disk->queue); ++ blk_mq_freeze_queue(q); ++ blk_mq_quiesce_queue_nowait(q); ++ blk_mq_unfreeze_queue(q); + + /* Ensure we don't receive any more interrupts */ + vdev->config->reset(vdev); +@@ -1088,8 +1091,8 @@ static int virtblk_restore(struct virtio_device *vdev) + return ret; + + virtio_device_ready(vdev); ++ blk_mq_unquiesce_queue(vblk->disk->queue); + +- blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 1cc9b67e9bcaaf..724873516923e0 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -495,6 +495,12 @@ static ssize_t backing_dev_store(struct device *dev, + } + + nr_pages = i_size_read(inode) >> PAGE_SHIFT; ++ /* Refuse to use zero sized device (also prevents self reference) */ ++ if (!nr_pages) { ++ err = -EINVAL; ++ goto out; ++ } ++ + bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long); + bitmap = kvzalloc(bitmap_sz, GFP_KERNEL); + if (!bitmap) { +diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c +index e6df5b95ed47b5..4971c2ecb82f1f 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_main.c ++++ b/drivers/crypto/chelsio/chtls/chtls_main.c +@@ -339,8 +339,9 @@ static struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl, + * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go + * through the regular cpl_pass_accept_req processing in TOM. + */ +- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) +- - pktshift, GFP_ATOMIC); ++ skb = alloc_skb(size_add(gl->tot_len, ++ sizeof(struct cpl_pass_accept_req)) - ++ pktshift, GFP_ATOMIC); + if (unlikely(!skb)) + return NULL; + __skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req) +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index 80ccdf96093ff0..ae42e98cf8350c 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -120,7 +120,7 @@ static const struct dma_buf_ops udmabuf_ops = { + }; + + #define SEALS_WANTED (F_SEAL_SHRINK) +-#define SEALS_DENIED (F_SEAL_WRITE) ++#define SEALS_DENIED (F_SEAL_WRITE|F_SEAL_FUTURE_WRITE) + + static long udmabuf_create(const struct udmabuf_create_list *head, + const struct udmabuf_create_item *list) +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index fdf3b5be2d50d4..c3a2fa52830c9f 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1214,6 +1214,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, + return NULL; + + desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); ++ if (!desc) ++ return NULL; + list_add_tail(&desc->desc_node, &desc->descs_list); + + desc->tx_dma_desc.cookie = -EBUSY; +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index 0ac8e7b34e128e..e96032096042b3 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -1394,6 +1394,7 @@ static int mv_xor_probe(struct platform_device *pdev) + irq = irq_of_parse_and_map(np, 0); + if (!irq) { + ret = -ENODEV; ++ of_node_put(np); + goto err_channel_add; + } + +@@ -1402,6 +1403,7 @@ static int mv_xor_probe(struct platform_device *pdev) + if (IS_ERR(chan)) { + ret = PTR_ERR(chan); + irq_dispose_mapping(irq); ++ of_node_put(np); + goto err_channel_add; + } + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +index d05b3033b5107c..0a1ac11e2e4f62 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +@@ -121,6 +121,9 @@ int adv7511_hdmi_hw_params(struct device *dev, void *data, + audio_source = ADV7511_AUDIO_SOURCE_I2S; + i2s_format = ADV7511_I2S_FORMAT_LEFT_J; + break; ++ case HDMI_SPDIF: ++ audio_source = ADV7511_AUDIO_SOURCE_SPDIF; ++ break; + default: + return -EINVAL; + } +@@ -144,7 +147,16 @@ int adv7511_hdmi_hw_params(struct device *dev, void *data, + ADV7511_AUDIO_CFG3_LEN_MASK, len); + regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG, + ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4); +- regmap_write(adv7511->regmap, 0x73, 0x1); ++ ++ /* send current Audio infoframe values while updating */ ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, ++ BIT(5), BIT(5)); ++ ++ regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1); ++ ++ /* use Audio infoframe updated info */ ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, ++ BIT(5), 0); + + return 0; + } +@@ -175,13 +187,24 @@ static int audio_startup(struct device *dev, void *data) + regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0), + BIT(7) | BIT(6), BIT(7)); + /* use Audio infoframe updated info */ +- regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1), ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, + BIT(5), 0); ++ ++ /* enable SPDIF receiver */ ++ if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF) ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG, ++ BIT(7), BIT(7)); ++ + return 0; + } + + static void audio_shutdown(struct device *dev, void *data) + { ++ struct adv7511 *adv7511 = dev_get_drvdata(dev); ++ ++ if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF) ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG, ++ BIT(7), 0); + } + + static int adv7511_hdmi_i2s_get_dai_id(struct snd_soc_component *component, +@@ -215,6 +238,7 @@ static const struct hdmi_codec_pdata codec_data = { + .ops = &adv7511_codec_ops, + .max_i2s_channels = 2, + .i2s = 1, ++ .spdif = 1, + }; + + int adv7511_audio_init(struct device *dev, struct adv7511 *adv7511) +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index aa19d5a40e319e..af0391dbefef31 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -193,7 +193,7 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) + + of_property_read_u32(np, "adi,dsi-lanes", &num_lanes); + +- if (num_lanes < 1 || num_lanes > 4) ++ if (num_lanes < 2 || num_lanes > 4) + return -EINVAL; + + adv->num_dsi_lanes = num_lanes; +diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c +index 0ef205fe5e2987..7ef068dcc48bb2 100644 +--- a/drivers/gpu/drm/i915/i915_scheduler.c ++++ b/drivers/gpu/drm/i915/i915_scheduler.c +@@ -533,6 +533,6 @@ int __init i915_global_scheduler_init(void) + return 0; + + err_priorities: +- kmem_cache_destroy(global.slab_priorities); ++ kmem_cache_destroy(global.slab_dependencies); + return -ENOMEM; + } +diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c +index 5054d1105236e1..5b7dbf7b6f839e 100644 +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -749,6 +749,12 @@ hv_kvp_init(struct hv_util_service *srv) + */ + kvp_transaction.state = HVUTIL_DEVICE_INIT; + ++ return 0; ++} ++ ++int ++hv_kvp_init_transport(void) ++{ + hvt = hvutil_transport_init(kvp_devname, CN_KVP_IDX, CN_KVP_VAL, + kvp_on_msg, kvp_on_reset); + if (!hvt) +diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c +index 20ba95b75a946d..9882e0b28a027f 100644 +--- a/drivers/hv/hv_snapshot.c ++++ b/drivers/hv/hv_snapshot.c +@@ -368,6 +368,12 @@ hv_vss_init(struct hv_util_service *srv) + */ + vss_transaction.state = HVUTIL_DEVICE_INIT; + ++ return 0; ++} ++ ++int ++hv_vss_init_transport(void) ++{ + hvt = hvutil_transport_init(vss_devname, CN_VSS_IDX, CN_VSS_VAL, + vss_on_msg, vss_on_reset); + if (!hvt) { +diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c +index 48f9b1fbcbda2e..34bbccf2450efb 100644 +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -98,12 +98,14 @@ static struct hv_util_service util_heartbeat = { + static struct hv_util_service util_kvp = { + .util_cb = hv_kvp_onchannelcallback, + .util_init = hv_kvp_init, ++ .util_init_transport = hv_kvp_init_transport, + .util_deinit = hv_kvp_deinit, + }; + + static struct hv_util_service util_vss = { + .util_cb = hv_vss_onchannelcallback, + .util_init = hv_vss_init, ++ .util_init_transport = hv_vss_init_transport, + .util_deinit = hv_vss_deinit, + }; + +@@ -431,6 +433,13 @@ static int util_probe(struct hv_device *dev, + if (ret) + goto error; + ++ if (srv->util_init_transport) { ++ ret = srv->util_init_transport(); ++ if (ret) { ++ vmbus_close(dev->channel); ++ goto error; ++ } ++ } + return 0; + + error: +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 356382a340b2c6..0ddf482c6a53c1 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -353,10 +353,12 @@ void vmbus_on_event(unsigned long data); + void vmbus_on_msg_dpc(unsigned long data); + + int hv_kvp_init(struct hv_util_service *srv); ++int hv_kvp_init_transport(void); + void hv_kvp_deinit(void); + void hv_kvp_onchannelcallback(void *context); + + int hv_vss_init(struct hv_util_service *srv); ++int hv_vss_init_transport(void); + void hv_vss_deinit(void); + void hv_vss_onchannelcallback(void *context); + +diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c +index 4d09665a72e59b..6ba534c983de90 100644 +--- a/drivers/i2c/busses/i2c-pnx.c ++++ b/drivers/i2c/busses/i2c-pnx.c +@@ -95,7 +95,7 @@ enum { + + static inline int wait_timeout(struct i2c_pnx_algo_data *data) + { +- long timeout = data->timeout; ++ long timeout = jiffies_to_msecs(data->timeout); + while (timeout > 0 && + (ioread32(I2C_REG_STS(data)) & mstatus_active)) { + mdelay(1); +@@ -106,7 +106,7 @@ static inline int wait_timeout(struct i2c_pnx_algo_data *data) + + static inline int wait_reset(struct i2c_pnx_algo_data *data) + { +- long timeout = data->timeout; ++ long timeout = jiffies_to_msecs(data->timeout); + while (timeout > 0 && + (ioread32(I2C_REG_CTL(data)) & mcntrl_reset)) { + mdelay(1); +diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c +index 588a3efb09c26e..a17fe33a0ca99e 100644 +--- a/drivers/i2c/busses/i2c-riic.c ++++ b/drivers/i2c/busses/i2c-riic.c +@@ -323,7 +323,7 @@ static int riic_init_hw(struct riic_dev *riic, struct i2c_timings *t) + if (brl <= (0x1F + 3)) + break; + +- total_ticks /= 2; ++ total_ticks = DIV_ROUND_UP(total_ticks, 2); + rate /= 2; + } + +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 80c76b62b12b66..6015a77ab4a932 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -161,7 +161,7 @@ static const void __user *uverbs_request_next_ptr(struct uverbs_req_iter *iter, + { + const void __user *res = iter->cur; + +- if (iter->cur + len > iter->end) ++ if (len > iter->end - iter->cur) + return (void __force __user *)ERR_PTR(-ENOSPC); + iter->cur += len; + return res; +@@ -2024,11 +2024,13 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs) + ret = uverbs_request_start(attrs, &iter, &cmd, sizeof(cmd)); + if (ret) + return ret; +- wqes = uverbs_request_next_ptr(&iter, cmd.wqe_size * cmd.wr_count); ++ wqes = uverbs_request_next_ptr(&iter, size_mul(cmd.wqe_size, ++ cmd.wr_count)); + if (IS_ERR(wqes)) + return PTR_ERR(wqes); +- sgls = uverbs_request_next_ptr( +- &iter, cmd.sge_count * sizeof(struct ib_uverbs_sge)); ++ sgls = uverbs_request_next_ptr(&iter, ++ size_mul(cmd.sge_count, ++ sizeof(struct ib_uverbs_sge))); + if (IS_ERR(sgls)) + return PTR_ERR(sgls); + ret = uverbs_request_finish(&iter); +@@ -2213,11 +2215,11 @@ ib_uverbs_unmarshall_recv(struct uverbs_req_iter *iter, u32 wr_count, + if (wqe_size < sizeof (struct ib_uverbs_recv_wr)) + return ERR_PTR(-EINVAL); + +- wqes = uverbs_request_next_ptr(iter, wqe_size * wr_count); ++ wqes = uverbs_request_next_ptr(iter, size_mul(wqe_size, wr_count)); + if (IS_ERR(wqes)) + return ERR_CAST(wqes); +- sgls = uverbs_request_next_ptr( +- iter, sge_count * sizeof(struct ib_uverbs_sge)); ++ sgls = uverbs_request_next_ptr(iter, size_mul(sge_count, ++ sizeof(struct ib_uverbs_sge))); + if (IS_ERR(sgls)) + return ERR_CAST(sgls); + ret = uverbs_request_finish(iter); +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index eca36da7f9d4b2..563a0f37810de4 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -137,7 +137,7 @@ int bnxt_re_query_device(struct ib_device *ibdev, + + ib_attr->vendor_id = rdev->en_dev->pdev->vendor; + ib_attr->vendor_part_id = rdev->en_dev->pdev->device; +- ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device; ++ ib_attr->hw_ver = rdev->en_dev->pdev->revision; + ib_attr->max_qp = dev_attr->max_qp; + ib_attr->max_qp_wr = dev_attr->max_qp_wqes; + ib_attr->device_cap_flags = +@@ -1852,18 +1852,20 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + } + } + +- if (qp_attr_mask & IB_QP_PATH_MTU) { +- qp->qplib_qp.modify_flags |= +- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; +- qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu); +- qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu); +- } else if (qp_attr->qp_state == IB_QPS_RTR) { +- qp->qplib_qp.modify_flags |= +- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; +- qp->qplib_qp.path_mtu = +- __from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu)); +- qp->qplib_qp.mtu = +- ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu)); ++ if (qp_attr->qp_state == IB_QPS_RTR) { ++ enum ib_mtu qpmtu; ++ ++ qpmtu = iboe_get_mtu(rdev->netdev->mtu); ++ if (qp_attr_mask & IB_QP_PATH_MTU) { ++ if (ib_mtu_enum_to_int(qp_attr->path_mtu) > ++ ib_mtu_enum_to_int(qpmtu)) ++ return -EINVAL; ++ qpmtu = qp_attr->path_mtu; ++ } ++ ++ qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; ++ qp->qplib_qp.path_mtu = __from_ib_mtu(qpmtu); ++ qp->qplib_qp.mtu = ib_mtu_enum_to_int(qpmtu); + } + + if (qp_attr_mask & IB_QP_TIMEOUT) { +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +index 079aaaaffec7a6..f623f881a95b10 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +@@ -118,7 +118,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, + * 128 WQEs needs to be reserved for the HW (8916). Prevent + * reporting the max number + */ +- attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS; ++ attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS + 1; + attr->max_qp_sges = bnxt_qplib_is_chip_gen_p5(rcfw->res->cctx) ? + 6 : sb->max_sge; + attr->max_cq = le32_to_cpu(sb->max_cq); +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 6698032af87d80..fb5a1b4abcbcea 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1034,7 +1034,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, + if (MLX5_CAP_GEN(mdev, cd)) + props->device_cap_flags |= IB_DEVICE_CROSS_CHANNEL; + +- if (!mlx5_core_is_pf(mdev)) ++ if (mlx5_core_is_vf(mdev)) + props->device_cap_flags |= IB_DEVICE_VIRTUAL_FUNCTION; + + if (mlx5_ib_port_link_layer(ibdev, 1) == +@@ -5980,7 +5980,8 @@ static int mlx5_ib_init_multiport_master(struct mlx5_ib_dev *dev) + list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list, + list) { + if (dev->sys_image_guid == mpi->sys_image_guid && +- (mlx5_core_native_port_num(mpi->mdev) - 1) == i) { ++ (mlx5_core_native_port_num(mpi->mdev) - 1) == i && ++ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) { + bound = mlx5_ib_bind_slave_port(dev, mpi); + } + +@@ -6874,7 +6875,8 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev) + + mutex_lock(&mlx5_ib_multiport_mutex); + list_for_each_entry(dev, &mlx5_ib_dev_list, ib_dev_list) { +- if (dev->sys_image_guid == mpi->sys_image_guid) ++ if (dev->sys_image_guid == mpi->sys_image_guid && ++ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) + bound = mlx5_ib_bind_slave_port(dev, mpi); + + if (bound) { +diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c +index 882204d1ef4fe2..5937f3cd288b51 100644 +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -62,7 +62,7 @@ static void gic_check_cpu_features(void) + + union gic_base { + void __iomem *common_base; +- void __percpu * __iomem *percpu_base; ++ void __iomem * __percpu *percpu_base; + }; + + struct gic_chip_data { +diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c +index 282cdcf9f21bba..b7c729a5ab9e74 100644 +--- a/drivers/media/dvb-frontends/dib3000mb.c ++++ b/drivers/media/dvb-frontends/dib3000mb.c +@@ -51,7 +51,7 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,2=xfer,4=setfe,8=getfe (|-a + static int dib3000_read_reg(struct dib3000_state *state, u16 reg) + { + u8 wb[] = { ((reg >> 8) | 0x80) & 0xff, reg & 0xff }; +- u8 rb[2]; ++ u8 rb[2] = {}; + struct i2c_msg msg[] = { + { .addr = state->config.demod_address, .flags = 0, .buf = wb, .len = 2 }, + { .addr = state->config.demod_address, .flags = I2C_M_RD, .buf = rb, .len = 2 }, +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index d58383767a6eb4..b3114da1c66e69 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -1300,7 +1300,6 @@ static const struct sdhci_pltfm_data sdhci_tegra30_pdata = { + SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | + SDHCI_QUIRK_SINGLE_POWER_WRITE | + SDHCI_QUIRK_NO_HISPD_BIT | +- SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | + SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, + .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | + SDHCI_QUIRK2_BROKEN_HS200 | +diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c +index 09848d13802d88..d1ed5878b3b1f3 100644 +--- a/drivers/mtd/nand/raw/atmel/pmecc.c ++++ b/drivers/mtd/nand/raw/atmel/pmecc.c +@@ -380,10 +380,8 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, + user->delta = user->dmu + req->ecc.strength + 1; + + gf_tables = atmel_pmecc_get_gf_tables(req); +- if (IS_ERR(gf_tables)) { +- kfree(user); ++ if (IS_ERR(gf_tables)) + return ERR_CAST(gf_tables); +- } + + user->gf_tables = gf_tables; + +diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c +index 8cbce39a33d9b7..79bea68e3c34b2 100644 +--- a/drivers/mtd/nand/raw/diskonchip.c ++++ b/drivers/mtd/nand/raw/diskonchip.c +@@ -1221,7 +1221,7 @@ static inline int __init inftl_partscan(struct mtd_info *mtd, struct mtd_partiti + (i == 0) && (ip->firstUnit > 0)) { + parts[0].name = " DiskOnChip IPL / Media Header partition"; + parts[0].offset = 0; +- parts[0].size = mtd->erasesize * ip->firstUnit; ++ parts[0].size = (uint64_t)mtd->erasesize * ip->firstUnit; + numparts = 1; + } + +diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c +index c46c1b1416f790..cdbd9ef8598168 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-platform.c ++++ b/drivers/net/ethernet/broadcom/bgmac-platform.c +@@ -171,6 +171,7 @@ static int platform_phy_connect(struct bgmac *bgmac) + static int bgmac_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; ++ struct device_node *phy_node; + struct bgmac *bgmac; + struct resource *regs; + const u8 *mac_addr; +@@ -237,7 +238,9 @@ static int bgmac_probe(struct platform_device *pdev) + bgmac->cco_ctl_maskset = platform_bgmac_cco_ctl_maskset; + bgmac->get_bus_clock = platform_bgmac_get_bus_clock; + bgmac->cmn_maskset32 = platform_bgmac_cmn_maskset32; +- if (of_parse_phandle(np, "phy-handle", 0)) { ++ phy_node = of_parse_phandle(np, "phy-handle", 0); ++ if (phy_node) { ++ of_node_put(phy_node); + bgmac->phy_connect = platform_phy_connect; + } else { + bgmac->phy_connect = bgmac_phy_connect_direct; +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index 3f739ce402015d..4361e56d7dd386 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -161,6 +161,7 @@ static int create_txqs(struct hinic_dev *nic_dev) + hinic_clean_txq(&nic_dev->txqs[j]); + + devm_kfree(&netdev->dev, nic_dev->txqs); ++ nic_dev->txqs = NULL; + return err; + } + +@@ -221,6 +222,7 @@ static int create_rxqs(struct hinic_dev *nic_dev) + hinic_clean_rxq(&nic_dev->rxqs[j]); + + devm_kfree(&netdev->dev, nic_dev->rxqs); ++ nic_dev->rxqs = NULL; + return err; + } + +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index df7c23cd33600a..afc6ba43469a00 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -130,6 +130,7 @@ static const struct pci_device_id sky2_id_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436C) }, /* 88E8072 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436D) }, /* 88E8055 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4370) }, /* 88E8075 */ ++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4373) }, /* 88E8075 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4380) }, /* 88E8057 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4381) }, /* 88E8059 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4382) }, /* 88E8079 */ +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index c53d2271d8abcc..dd4b89c90d6789 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -711,8 +711,8 @@ static int ionic_get_module_eeprom(struct net_device *netdev, + len = min_t(u32, sizeof(xcvr->sprom), ee->len); + + do { +- memcpy(data, xcvr->sprom, len); +- memcpy(tbuf, xcvr->sprom, len); ++ memcpy(data, &xcvr->sprom[ee->offset], len); ++ memcpy(tbuf, &xcvr->sprom[ee->offset], len); + + /* Let's make sure we got a consistent copy */ + if (!memcmp(data, tbuf, len)) +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index af787088f1aea4..347521ec52c3df 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1328,6 +1328,9 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 5abb056b2b515e..a00233ff5efe61 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -692,7 +692,7 @@ static struct device_node *__of_get_dma_parent(const struct device_node *np) + if (ret < 0) + return of_get_parent(np); + +- return of_node_get(args.np); ++ return args.np; + } + + u64 of_translate_dma_address(struct device_node *dev, const __be32 *in_addr) +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 6fa209b3557b05..424f51b029fc2a 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -1695,8 +1695,10 @@ int of_parse_phandle_with_args_map(const struct device_node *np, + map_len--; + + /* Check if not found */ +- if (!new) ++ if (!new) { ++ ret = -EINVAL; + goto put; ++ } + + if (!of_device_is_available(new)) + match = 0; +@@ -1706,17 +1708,20 @@ int of_parse_phandle_with_args_map(const struct device_node *np, + goto put; + + /* Check for malformed properties */ +- if (WARN_ON(new_size > MAX_PHANDLE_ARGS)) +- goto put; +- if (map_len < new_size) ++ if (WARN_ON(new_size > MAX_PHANDLE_ARGS) || ++ map_len < new_size) { ++ ret = -EINVAL; + goto put; ++ } + + /* Move forward by new node's #<list>-cells amount */ + map += new_size; + map_len -= new_size; + } +- if (!match) ++ if (!match) { ++ ret = -ENOENT; + goto put; ++ } + + /* Get the <list>-map-pass-thru property (optional) */ + pass = of_get_property(cur, pass_name, NULL); +diff --git a/drivers/of/irq.c b/drivers/of/irq.c +index f59bbcc94430c2..ddb3ed0483d94e 100644 +--- a/drivers/of/irq.c ++++ b/drivers/of/irq.c +@@ -298,6 +298,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar + return of_irq_parse_oldworld(device, index, out_irq); + + /* Get the reg property (if any) */ ++ addr_len = 0; + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 6b5c9f7916fac9..ee38ca162a7c8d 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1407,6 +1407,22 @@ static int aer_probe(struct pcie_device *dev) + return 0; + } + ++static int aer_suspend(struct pcie_device *dev) ++{ ++ struct aer_rpc *rpc = get_service_data(dev); ++ ++ aer_disable_rootport(rpc); ++ return 0; ++} ++ ++static int aer_resume(struct pcie_device *dev) ++{ ++ struct aer_rpc *rpc = get_service_data(dev); ++ ++ aer_enable_rootport(rpc); ++ return 0; ++} ++ + /** + * aer_root_reset - reset link on Root Port + * @dev: pointer to Root Port's pci_dev data structure +@@ -1447,6 +1463,8 @@ static struct pcie_port_service_driver aerdriver = { + .service = PCIE_PORT_SERVICE_AER, + + .probe = aer_probe, ++ .suspend = aer_suspend, ++ .resume = aer_resume, + .remove = aer_remove, + .reset_link = aer_root_reset, + }; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 6a2d64d050c04f..080d5077c64544 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4997,6 +4997,10 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1760, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1761, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + /* Amazon Annapurna Labs */ + { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, +diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c +index b04f4fe85ac2d7..c801fe727f09ac 100644 +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -138,8 +138,10 @@ static struct phy_provider *of_phy_provider_lookup(struct device_node *node) + return phy_provider; + + for_each_child_of_node(phy_provider->children, child) +- if (child == node) ++ if (child == node) { ++ of_node_put(child); + return phy_provider; ++ } + } + + return ERR_PTR(-EPROBE_DEFER); +@@ -507,8 +509,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index) + return ERR_PTR(-ENODEV); + + /* This phy type handled by the usb-phy subsystem for now */ +- if (of_device_is_compatible(args.np, "usb-nop-xceiv")) +- return ERR_PTR(-ENODEV); ++ if (of_device_is_compatible(args.np, "usb-nop-xceiv")) { ++ phy = ERR_PTR(-ENODEV); ++ goto out_put_node; ++ } + + mutex_lock(&phy_provider_mutex); + phy_provider = of_phy_provider_lookup(args.np); +@@ -530,6 +534,7 @@ static struct phy *_of_phy_get(struct device_node *np, int index) + + out_unlock: + mutex_unlock(&phy_provider_mutex); ++out_put_node: + of_node_put(args.np); + + return phy; +@@ -601,7 +606,7 @@ void devm_phy_put(struct device *dev, struct phy *phy) + if (!phy) + return; + +- r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy); ++ r = devres_release(dev, devm_phy_release, devm_phy_match, phy); + dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); + } + EXPORT_SYMBOL_GPL(devm_phy_put); +@@ -953,7 +958,7 @@ void devm_phy_destroy(struct device *dev, struct phy *phy) + { + int r; + +- r = devres_destroy(dev, devm_phy_consume, devm_phy_match, phy); ++ r = devres_release(dev, devm_phy_consume, devm_phy_match, phy); + dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); + } + EXPORT_SYMBOL_GPL(devm_phy_destroy); +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 70fe9476d0cf1a..d60025b6db8ae7 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -120,6 +120,7 @@ static const struct regmap_config mcp23x08_regmap = { + .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), + .cache_type = REGCACHE_FLAT, + .max_register = MCP_OLAT, ++ .disable_locking = true, /* mcp->lock protects the regmap */ + }; + + static const struct reg_default mcp23x17_defaults[] = { +@@ -165,6 +166,7 @@ static const struct regmap_config mcp23x17_regmap = { + .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), + .cache_type = REGCACHE_FLAT, + .val_format_endian = REGMAP_ENDIAN_LITTLE, ++ .disable_locking = true, /* mcp->lock protects the regmap */ + }; + + static int mcp_read(struct mcp23s08 *mcp, unsigned int reg, unsigned int *val) +@@ -261,7 +263,9 @@ static int mcp_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, + + switch (param) { + case PIN_CONFIG_BIAS_PULL_UP: ++ mutex_lock(&mcp->lock); + ret = mcp_read(mcp, MCP_GPPU, &data); ++ mutex_unlock(&mcp->lock); + if (ret < 0) + return ret; + status = (data & BIT(pin)) ? 1 : 0; +@@ -290,7 +294,9 @@ static int mcp_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, + + switch (param) { + case PIN_CONFIG_BIAS_PULL_UP: ++ mutex_lock(&mcp->lock); + ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg); ++ mutex_unlock(&mcp->lock); + break; + default: + dev_dbg(mcp->dev, "Invalid config param %04x\n", param); +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 78d357de2f0405..18d963916b7f81 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -585,6 +585,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_IGNORE, 0xCF, }, /* AC mode */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_END, 0}, + }; +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 603c99fcb74e6f..7f2d12c5dc4b00 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -8802,8 +8802,11 @@ megasas_aen_polling(struct work_struct *work) + (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), + (ld_target_id - MEGASAS_MAX_DEV_PER_CHANNEL), + 0); +- if (sdev1) ++ if (sdev1) { ++ mutex_unlock(&instance->reset_mutex); + megasas_remove_scsi_device(sdev1); ++ mutex_lock(&instance->reset_mutex); ++ } + + event_type = SCAN_VD_CHANNEL; + break; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 1bc23e8ee748a8..69023ddceb59fa 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5695,11 +5695,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + int i; + u8 failed; + __le32 *mfp; ++ int ret_val; + + /* make sure doorbell is not in use */ + if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); +- return -EFAULT; ++ goto doorbell_diag_reset; + } + + /* clear pending doorbell interrupts from previous state changes */ +@@ -5789,6 +5790,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + le32_to_cpu(mfp[i])); + } + return 0; ++ ++doorbell_diag_reset: ++ ret_val = _base_diag_reset(ioc); ++ return ret_val; + } + + /** +diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h +index a1a8aefc7cc39f..9d4c997c3c8201 100644 +--- a/drivers/scsi/qla1280.h ++++ b/drivers/scsi/qla1280.h +@@ -117,12 +117,12 @@ struct device_reg { + uint16_t id_h; /* ID high */ + uint16_t cfg_0; /* Configuration 0 */ + #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */ +-#define ISP_CFG0_1020 BIT_0 /* ISP1020 */ +-#define ISP_CFG0_1020A BIT_1 /* ISP1020A */ +-#define ISP_CFG0_1040 BIT_2 /* ISP1040 */ +-#define ISP_CFG0_1040A BIT_3 /* ISP1040A */ +-#define ISP_CFG0_1040B BIT_4 /* ISP1040B */ +-#define ISP_CFG0_1040C BIT_5 /* ISP1040C */ ++#define ISP_CFG0_1020 1 /* ISP1020 */ ++#define ISP_CFG0_1020A 2 /* ISP1020A */ ++#define ISP_CFG0_1040 3 /* ISP1040 */ ++#define ISP_CFG0_1040A 4 /* ISP1040A */ ++#define ISP_CFG0_1040B 5 /* ISP1040B */ ++#define ISP_CFG0_1040C 6 /* ISP1040C */ + uint16_t cfg_1; /* Configuration 1 */ + #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */ + #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */ +diff --git a/drivers/sh/clk/core.c b/drivers/sh/clk/core.c +index 9475353f49d6c5..0b775d701ca855 100644 +--- a/drivers/sh/clk/core.c ++++ b/drivers/sh/clk/core.c +@@ -295,7 +295,7 @@ int clk_enable(struct clk *clk) + int ret; + + if (!clk) +- return -EINVAL; ++ return 0; + + spin_lock_irqsave(&clock_lock, flags); + ret = __clk_enable(clk); +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index b341bbc9f1dad5..abc2271799e0ad 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -885,10 +885,10 @@ static void dwc2_gadget_config_nonisoc_xfer_ddma(struct dwc2_hsotg_ep *hs_ep, + } + + /* DMA sg buffer */ +- for_each_sg(ureq->sg, sg, ureq->num_sgs, i) { ++ for_each_sg(ureq->sg, sg, ureq->num_mapped_sgs, i) { + dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc, + sg_dma_address(sg) + sg->offset, sg_dma_len(sg), +- sg_is_last(sg)); ++ (i == (ureq->num_mapped_sgs - 1))); + desc_count += hs_ep->desc_count; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 4b77994d7a4de7..3ae4ac4d985783 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -625,6 +625,8 @@ static void option_instat_callback(struct urb *urb); + #define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 ++/* MeiG Smart SLM770A based on ASR1803 */ ++#define MEIGSMART_PRODUCT_SLM770A 0x4d57 + + /* Device flags */ + +@@ -1395,6 +1397,12 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +@@ -2247,6 +2255,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(2) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7129, 0xff, 0x00, 0x00), /* MediaTek T7XX */ ++ .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), + .driver_info = RSVD(1) | RSVD(4) }, +@@ -2375,6 +2385,18 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, +@@ -2382,9 +2404,14 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ ++ .driver_info = NCTRL(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ ++ .driver_info = NCTRL(3) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index cd72409ccc943c..d9a581f46f1366 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -7679,6 +7679,8 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, + ret = -EAGAIN; + goto out; + } ++ ++ cond_resched(); + } + + btrfs_release_path(path); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 597362eaf3007b..482af5fbc9d7f2 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1197,6 +1197,11 @@ static int check_extent_item(struct extent_buffer *leaf, + dref_offset, fs_info->sectorsize); + return -EUCLEAN; + } ++ if (unlikely(btrfs_extent_data_ref_count(leaf, dref) == 0)) { ++ extent_err(leaf, slot, ++ "invalid data ref count, should have non-zero value"); ++ return -EUCLEAN; ++ } + inline_refs += btrfs_extent_data_ref_count(leaf, dref); + break; + /* Contains parent bytenr and ref count */ +@@ -1208,6 +1213,11 @@ static int check_extent_item(struct extent_buffer *leaf, + inline_offset, fs_info->sectorsize); + return -EUCLEAN; + } ++ if (unlikely(btrfs_shared_data_ref_count(leaf, sref) == 0)) { ++ extent_err(leaf, slot, ++ "invalid shared data ref count, should have non-zero value"); ++ return -EUCLEAN; ++ } + inline_refs += btrfs_shared_data_ref_count(leaf, sref); + break; + default: +@@ -1259,8 +1269,18 @@ static int check_simple_keyed_refs(struct extent_buffer *leaf, + { + u32 expect_item_size = 0; + +- if (key->type == BTRFS_SHARED_DATA_REF_KEY) ++ if (key->type == BTRFS_SHARED_DATA_REF_KEY) { ++ struct btrfs_shared_data_ref *sref; ++ ++ sref = btrfs_item_ptr(leaf, slot, struct btrfs_shared_data_ref); ++ if (unlikely(btrfs_shared_data_ref_count(leaf, sref) == 0)) { ++ extent_err(leaf, slot, ++ "invalid shared data backref count, should have non-zero value"); ++ return -EUCLEAN; ++ } ++ + expect_item_size = sizeof(struct btrfs_shared_data_ref); ++ } + + if (btrfs_item_size_nr(leaf, slot) != expect_item_size) { + generic_err(leaf, slot, +@@ -1320,6 +1340,11 @@ static int check_extent_data_ref(struct extent_buffer *leaf, + offset, leaf->fs_info->sectorsize); + return -EUCLEAN; + } ++ if (unlikely(btrfs_extent_data_ref_count(leaf, dref) == 0)) { ++ extent_err(leaf, slot, ++ "invalid extent data backref count, should have non-zero value"); ++ return -EUCLEAN; ++ } + } + return 0; + } +diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c +index 0297ad95eb5cc0..d022de1ce2c279 100644 +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -43,7 +43,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb, + * + * VariableName-12345678-1234-1234-1234-1234567891bc + */ +-bool efivarfs_valid_name(const char *str, int len) ++static bool efivarfs_valid_name(const char *str, int len) + { + const char *s = str + len - EFI_VARIABLE_GUID_LEN; + +diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h +index 30ae44cb74531d..16cbc73b6f3773 100644 +--- a/fs/efivarfs/internal.h ++++ b/fs/efivarfs/internal.h +@@ -10,7 +10,6 @@ + + extern const struct file_operations efivarfs_file_operations; + extern const struct inode_operations efivarfs_dir_inode_operations; +-extern bool efivarfs_valid_name(const char *str, int len); + extern struct inode *efivarfs_get_inode(struct super_block *sb, + const struct inode *dir, int mode, dev_t dev, + bool is_removable); +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index 9760a52800b420..d12a21b2dd9d06 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -63,9 +63,6 @@ static int efivarfs_d_hash(const struct dentry *dentry, struct qstr *qstr) + const unsigned char *s = qstr->name; + unsigned int len = qstr->len; + +- if (!efivarfs_valid_name(s, len)) +- return -EINVAL; +- + while (len-- > EFI_VARIABLE_GUID_LEN) + hash = partial_name_hash(*s++, hash); + +diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c +index 0dbeaf68e1d6e0..af90d3d70a08ca 100644 +--- a/fs/erofs/inode.c ++++ b/fs/erofs/inode.c +@@ -198,11 +198,14 @@ static int erofs_fill_symlink(struct inode *inode, void *data, + unsigned int m_pofs) + { + struct erofs_inode *vi = EROFS_I(inode); ++ loff_t off; + char *lnk; + +- /* if it cannot be handled with fast symlink scheme */ +- if (vi->datalayout != EROFS_INODE_FLAT_INLINE || +- inode->i_size >= PAGE_SIZE) { ++ m_pofs += vi->xattr_isize; ++ /* check if it cannot be handled with fast symlink scheme */ ++ if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 || ++ check_add_overflow((loff_t)m_pofs, inode->i_size, &off) || ++ off > i_blocksize(inode)) { + inode->i_op = &erofs_symlink_iops; + return 0; + } +@@ -211,17 +214,6 @@ static int erofs_fill_symlink(struct inode *inode, void *data, + if (!lnk) + return -ENOMEM; + +- m_pofs += vi->xattr_isize; +- /* inline symlink data shouldn't cross page boundary as well */ +- if (m_pofs + inode->i_size > PAGE_SIZE) { +- kfree(lnk); +- erofs_err(inode->i_sb, +- "inline data cross block boundary @ nid %llu", +- vi->nid); +- DBG_BUGON(1); +- return -EFSCORRUPTED; +- } +- + memcpy(lnk, data + m_pofs, inode->i_size); + lnk[inode->i_size] = '\0'; + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 8c0e94183186f7..569bfff280e4c4 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1273,7 +1273,10 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v + break; + } + } +- wake_up(&ep->wq); ++ if (sync) ++ wake_up_sync(&ep->wq); ++ else ++ wake_up(&ep->wq); + } + if (waitqueue_active(&ep->poll_wait)) + pwake++; +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 3f7d905d7528da..90961dae4dc3bb 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1165,7 +1165,7 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo, + enum pnfs_iomode *iomode) + { + /* Serialise LAYOUTGET/LAYOUTRETURN */ +- if (atomic_read(&lo->plh_outstanding) != 0) ++ if (atomic_read(&lo->plh_outstanding) != 0 && lo->plh_return_seq == 0) + return false; + if (test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) + return false; +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 55128de1a89da6..d490f28aa7f6c6 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -878,7 +878,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c + args.authflavor = clp->cl_cred.cr_flavor; + clp->cl_cb_ident = conn->cb_ident; + } else { +- if (!conn->cb_xprt) ++ if (!conn->cb_xprt || !ses) + return -EINVAL; + clp->cl_cb_session = ses; + args.bc_xprt = conn->cb_xprt; +@@ -1229,8 +1229,6 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) + ses = c->cn_session; + } + spin_unlock(&clp->cl_lock); +- if (!c) +- return; + + err = setup_callback_client(clp, &conn, ses); + if (err) { +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 530edb813add8a..6b2f580c9672c8 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -626,8 +626,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, + inode = nilfs_iget_locked(sb, root, ino); + if (unlikely(!inode)) + return ERR_PTR(-ENOMEM); +- if (!(inode->i_state & I_NEW)) ++ ++ if (!(inode->i_state & I_NEW)) { ++ if (!inode->i_nlink) { ++ iput(inode); ++ return ERR_PTR(-ESTALE); ++ } + return inode; ++ } + + err = __nilfs_read_inode(sb, root, ino, inode); + if (unlikely(err)) { +diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c +index eeccd69cd79743..446af9c21a2930 100644 +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) + inode = NULL; + } else { + inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); ++ if (inode == ERR_PTR(-ESTALE)) { ++ nilfs_error(dir->i_sb, ++ "deleted inode referenced: %lu", ino); ++ return ERR_PTR(-EIO); ++ } + } + + return d_splice_alias(inode, dentry); +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index 67d9b5a374600d..1d9df8d22a063f 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -1413,6 +1413,7 @@ struct hv_util_service { + void *channel; + void (*util_cb)(void *); + int (*util_init)(struct hv_util_service *); ++ int (*util_init_transport)(void); + void (*util_deinit)(void); + }; + +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 4e7e72f3da5bd7..b3dae069bcd94b 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -574,13 +574,16 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) + * vlan_get_protocol - get protocol EtherType. + * @skb: skbuff to query + * @type: first vlan protocol ++ * @mac_offset: MAC offset + * @depth: buffer to store length of eth and vlan tags in bytes + * + * Returns the EtherType of the packet, regardless of whether it is + * vlan encapsulated (normal or hardware accelerated) or not. + */ +-static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, +- int *depth) ++static inline __be16 __vlan_get_protocol_offset(const struct sk_buff *skb, ++ __be16 type, ++ int mac_offset, ++ int *depth) + { + unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH; + +@@ -599,7 +602,8 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, + do { + struct vlan_hdr vhdr, *vh; + +- vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr); ++ vh = skb_header_pointer(skb, mac_offset + vlan_depth, ++ sizeof(vhdr), &vhdr); + if (unlikely(!vh || !--parse_depth)) + return 0; + +@@ -614,6 +618,12 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, + return type; + } + ++static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, ++ int *depth) ++{ ++ return __vlan_get_protocol_offset(skb, type, 0, depth); ++} ++ + /** + * vlan_get_protocol - get protocol EtherType. + * @skb: skbuff to query +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 18fd0a030584c4..ddcbc910d90910 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1132,7 +1132,18 @@ static inline bool mlx5_core_is_pf(const struct mlx5_core_dev *dev) + return dev->coredev_type == MLX5_COREDEV_PF; + } + +-static inline bool mlx5_core_is_ecpf(struct mlx5_core_dev *dev) ++static inline bool mlx5_core_is_vf(const struct mlx5_core_dev *dev) ++{ ++ return dev->coredev_type == MLX5_COREDEV_VF; ++} ++ ++static inline bool mlx5_core_same_coredev_type(const struct mlx5_core_dev *dev1, ++ const struct mlx5_core_dev *dev2) ++{ ++ return dev1->coredev_type == dev2->coredev_type; ++} ++ ++static inline bool mlx5_core_is_ecpf(const struct mlx5_core_dev *dev) + { + return dev->caps.embedded_cpu; + } +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h +index 35342fb488661c..ef6a9d082c2cf6 100644 +--- a/include/linux/netfilter/ipset/ip_set.h ++++ b/include/linux/netfilter/ipset/ip_set.h +@@ -98,7 +98,7 @@ struct ip_set_counter { + + struct ip_set_comment_rcu { + struct rcu_head rcu; +- char str[0]; ++ char str[]; + }; + + struct ip_set_comment { +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 04e7f5630509c5..e66ef9bf6ff36c 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -264,7 +264,7 @@ struct xt_table_info { + unsigned int stacksize; + void ***jumpstack; + +- unsigned char entries[0] __aligned(8); ++ unsigned char entries[] __aligned(8); + }; + + int xt_register_target(struct xt_target *target); +@@ -464,7 +464,7 @@ struct compat_xt_entry_match { + } kernel; + u_int16_t match_size; + } u; +- unsigned char data[0]; ++ unsigned char data[]; + }; + + struct compat_xt_entry_target { +@@ -480,7 +480,7 @@ struct compat_xt_entry_target { + } kernel; + u_int16_t target_size; + } u; +- unsigned char data[0]; ++ unsigned char data[]; + }; + + /* FIXME: this works only on 32 bit tasks +@@ -494,7 +494,7 @@ struct compat_xt_counters { + struct compat_xt_counters_info { + char name[XT_TABLE_MAXNAMELEN]; + compat_uint_t num_counters; +- struct compat_xt_counters counters[0]; ++ struct compat_xt_counters counters[]; + }; + + struct _compat_xt_align { +diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h +index 6988cf9ffe3ae6..26a13294318cf7 100644 +--- a/include/linux/netfilter_arp/arp_tables.h ++++ b/include/linux/netfilter_arp/arp_tables.h +@@ -68,7 +68,7 @@ struct compat_arpt_entry { + __u16 next_offset; + compat_uint_t comefrom; + struct compat_xt_counters counters; +- unsigned char elems[0]; ++ unsigned char elems[]; + }; + + static inline struct xt_entry_target * +diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h +index f0d846df3a4246..a18fb73a2b772a 100644 +--- a/include/linux/netfilter_bridge/ebtables.h ++++ b/include/linux/netfilter_bridge/ebtables.h +@@ -85,7 +85,7 @@ struct ebt_table_info { + /* room to maintain the stack used for jumping from and into udc */ + struct ebt_chainstack **chainstack; + char *entries; +- struct ebt_counter counters[0] ____cacheline_aligned; ++ struct ebt_counter counters[] ____cacheline_aligned; + }; + + struct ebt_table { +diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h +index e9e1ed74cdf1ec..b394bd4f68a34f 100644 +--- a/include/linux/netfilter_ipv4/ip_tables.h ++++ b/include/linux/netfilter_ipv4/ip_tables.h +@@ -76,7 +76,7 @@ struct compat_ipt_entry { + __u16 next_offset; + compat_uint_t comefrom; + struct compat_xt_counters counters; +- unsigned char elems[0]; ++ unsigned char elems[]; + }; + + /* Helper functions */ +diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h +index 78ab959c457544..8225f7821a29fb 100644 +--- a/include/linux/netfilter_ipv6/ip6_tables.h ++++ b/include/linux/netfilter_ipv6/ip6_tables.h +@@ -43,7 +43,7 @@ struct compat_ip6t_entry { + __u16 next_offset; + compat_uint_t comefrom; + struct compat_xt_counters counters; +- unsigned char elems[0]; ++ unsigned char elems[]; + }; + + static inline struct xt_entry_target * +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 3191d0ffc6e9a3..4edce28fb45425 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1118,6 +1118,7 @@ static inline struct sk_buff *__pskb_copy(struct sk_buff *skb, int headroom, + int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, gfp_t gfp_mask); + struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, + unsigned int headroom); ++struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom); + struct sk_buff *skb_copy_expand(const struct sk_buff *skb, int newheadroom, + int newtailroom, gfp_t priority); + int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index d88622a9db7bce..b32764a04a4c98 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -255,7 +255,7 @@ struct trace_event_call { + struct list_head list; + struct trace_event_class *class; + union { +- char *name; ++ const char *name; + /* Set TRACE_EVENT_FL_TRACEPOINT flag when using "tp" */ + struct tracepoint *tp; + }; +diff --git a/include/linux/wait.h b/include/linux/wait.h +index 03bff85e365f4c..5b65f720261a94 100644 +--- a/include/linux/wait.h ++++ b/include/linux/wait.h +@@ -213,6 +213,7 @@ void __wake_up_pollfree(struct wait_queue_head *wq_head); + #define wake_up_all(x) __wake_up(x, TASK_NORMAL, 0, NULL) + #define wake_up_locked(x) __wake_up_locked((x), TASK_NORMAL, 1) + #define wake_up_all_locked(x) __wake_up_locked((x), TASK_NORMAL, 0) ++#define wake_up_sync(x) __wake_up_sync(x, TASK_NORMAL, 1) + + #define wake_up_interruptible(x) __wake_up(x, TASK_INTERRUPTIBLE, 1, NULL) + #define wake_up_interruptible_nr(x, nr) __wake_up(x, TASK_INTERRUPTIBLE, nr, NULL) +diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h +index 112a6f40dfaf87..d0e87120d2f48e 100644 +--- a/include/net/netfilter/nf_conntrack_extend.h ++++ b/include/net/netfilter/nf_conntrack_extend.h +@@ -46,7 +46,7 @@ struct nf_ct_ext { + struct rcu_head rcu; + u8 offset[NF_CT_EXT_NUM]; + u8 len; +- char data[0]; ++ char data[]; + }; + + static inline bool __nf_ct_ext_exist(const struct nf_ct_ext *ext, u8 id) +diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h +index 6dd72396f5344d..659b0ea25b4d42 100644 +--- a/include/net/netfilter/nf_conntrack_timeout.h ++++ b/include/net/netfilter/nf_conntrack_timeout.h +@@ -14,7 +14,7 @@ + struct nf_ct_timeout { + __u16 l3num; + const struct nf_conntrack_l4proto *l4proto; +- char data[0]; ++ char data[]; + }; + + struct ctnl_timeout { +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 648aac42dfecee..92551a765a4468 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -226,7 +226,7 @@ int nft_parse_register_store(const struct nft_ctx *ctx, + */ + struct nft_userdata { + u8 len; +- unsigned char data[0]; ++ unsigned char data[]; + }; + + /** +@@ -571,15 +571,18 @@ struct nft_set_ext_tmpl { + /** + * struct nft_set_ext - set extensions + * +- * @genmask: generation mask ++ * @genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT) + * @offset: offsets of individual extension types + * @data: beginning of extension data ++ * ++ * This structure must be aligned to word size, otherwise atomic bitops ++ * on genmask field can cause alignment failure on some archs. + */ + struct nft_set_ext { + u8 genmask; + u8 offset[NFT_SET_EXT_NUM]; +- char data[0]; +-}; ++ char data[]; ++} __aligned(BITS_PER_LONG / 8); + + static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) + { +@@ -1357,7 +1360,7 @@ struct nft_trans { + int msg_type; + bool put_net; + struct nft_ctx ctx; +- char data[0]; ++ char data[]; + }; + + struct nft_trans_rule { +diff --git a/include/uapi/linux/netfilter_bridge/ebt_among.h b/include/uapi/linux/netfilter_bridge/ebt_among.h +index 9acf757bc1f793..73b26a280c4fd7 100644 +--- a/include/uapi/linux/netfilter_bridge/ebt_among.h ++++ b/include/uapi/linux/netfilter_bridge/ebt_among.h +@@ -40,7 +40,7 @@ struct ebt_mac_wormhash_tuple { + struct ebt_mac_wormhash { + int table[257]; + int poolsize; +- struct ebt_mac_wormhash_tuple pool[0]; ++ struct ebt_mac_wormhash_tuple pool[]; + }; + + #define ebt_mac_wormhash_size(x) ((x) ? sizeof(struct ebt_mac_wormhash) \ +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index dde21d23f2202e..9fb103426cf0a3 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -496,6 +496,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, + + int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt) + { ++ int err; ++ + /* Branch offsets can't overflow when program is shrinking, no need + * to call bpf_adj_branches(..., true) here + */ +@@ -503,7 +505,9 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt) + sizeof(struct bpf_insn) * (prog->len - off - cnt)); + prog->len -= cnt; + +- return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false)); ++ err = bpf_adj_branches(prog, off, off + cnt, off, false); ++ WARN_ON_ONCE(err); ++ return err; + } + + static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp) +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 380032a27f98b4..2eb1a8ec575551 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1554,7 +1554,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) + struct dyn_ftrace key; + unsigned long ip = 0; + +- rcu_read_lock(); ++ preempt_disable_notrace(); + key.ip = start; + key.flags = end; /* overload flags, as it is unsigned long */ + +@@ -1572,7 +1572,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) + break; + } + } +- rcu_read_unlock(); ++ preempt_enable_notrace(); + return ip; + } + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index c966638fb62c20..56d22752a52e31 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -703,7 +703,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb, + + static struct notifier_block trace_kprobe_module_nb = { + .notifier_call = trace_kprobe_module_callback, +- .priority = 1 /* Invoked after kprobe module callback */ ++ .priority = 2 /* Invoked after kprobe and jump_label module callback */ + }; + + /* Convert certain expected symbols into '_' when generating event names */ +diff --git a/mm/vmscan.c b/mm/vmscan.c +index cefd9cd2740578..7698d497d34a88 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -342,7 +342,14 @@ unsigned long zone_reclaimable_pages(struct zone *zone) + if (get_nr_swap_pages() > 0) + nr += zone_page_state_snapshot(zone, NR_ZONE_INACTIVE_ANON) + + zone_page_state_snapshot(zone, NR_ZONE_ACTIVE_ANON); +- ++ /* ++ * If there are no reclaimable file-backed or anonymous pages, ++ * ensure zones with sufficient free pages are not skipped. ++ * This prevents zones like DMA32 from being ignored in reclaim ++ * scenarios where they can still help alleviate memory pressure. ++ */ ++ if (nr == 0) ++ nr = zone_page_state_snapshot(zone, NR_FREE_PAGES); + return nr; + } + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index f6853fc0fcc000..9d07cf27775955 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1581,7 +1581,7 @@ struct compat_ebt_entry_mwt { + compat_uptr_t ptr; + } u; + compat_uint_t match_size; +- compat_uint_t data[0] __attribute__ ((aligned (__alignof__(struct compat_ebt_replace)))); ++ compat_uint_t data[] __aligned(__alignof__(struct compat_ebt_replace)); + }; + + /* account for possible padding between match_size and ->data */ +diff --git a/net/core/filter.c b/net/core/filter.c +index 9f67d9f20ae09b..6ba1121a9f3441 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -3252,13 +3252,22 @@ static const struct bpf_func_proto bpf_skb_adjust_room_proto = { + + static u32 __bpf_skb_min_len(const struct sk_buff *skb) + { +- u32 min_len = skb_network_offset(skb); +- +- if (skb_transport_header_was_set(skb)) +- min_len = skb_transport_offset(skb); +- if (skb->ip_summed == CHECKSUM_PARTIAL) +- min_len = skb_checksum_start_offset(skb) + +- skb->csum_offset + sizeof(__sum16); ++ int offset = skb_network_offset(skb); ++ u32 min_len = 0; ++ ++ if (offset > 0) ++ min_len = offset; ++ if (skb_transport_header_was_set(skb)) { ++ offset = skb_transport_offset(skb); ++ if (offset > 0) ++ min_len = offset; ++ } ++ if (skb->ip_summed == CHECKSUM_PARTIAL) { ++ offset = skb_checksum_start_offset(skb) + ++ skb->csum_offset + sizeof(__sum16); ++ if (offset > 0) ++ min_len = offset; ++ } + return min_len; + } + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 82be36c87eb600..da2be54f5e62a6 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -77,6 +77,7 @@ + #include <linux/indirect_call_wrapper.h> + + #include "datagram.h" ++#include "sock_destructor.h" + + struct kmem_cache *skbuff_head_cache __ro_after_init; + static struct kmem_cache *skbuff_fclone_cache __ro_after_init; +@@ -1726,6 +1727,57 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, unsigned int headroom) + } + EXPORT_SYMBOL(skb_realloc_headroom); + ++/** ++ * skb_expand_head - reallocate header of &sk_buff ++ * @skb: buffer to reallocate ++ * @headroom: needed headroom ++ * ++ * Unlike skb_realloc_headroom, this one does not allocate a new skb ++ * if possible; copies skb->sk to new skb as needed ++ * and frees original skb in case of failures. ++ * ++ * It expect increased headroom and generates warning otherwise. ++ */ ++ ++struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) ++{ ++ int delta = headroom - skb_headroom(skb); ++ int osize = skb_end_offset(skb); ++ struct sock *sk = skb->sk; ++ ++ if (WARN_ONCE(delta <= 0, ++ "%s is expecting an increase in the headroom", __func__)) ++ return skb; ++ ++ delta = SKB_DATA_ALIGN(delta); ++ /* pskb_expand_head() might crash, if skb is shared. */ ++ if (skb_shared(skb) || !is_skb_wmem(skb)) { ++ struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); ++ ++ if (unlikely(!nskb)) ++ goto fail; ++ ++ if (sk) ++ skb_set_owner_w(nskb, sk); ++ consume_skb(skb); ++ skb = nskb; ++ } ++ if (pskb_expand_head(skb, delta, 0, GFP_ATOMIC)) ++ goto fail; ++ ++ if (sk && is_skb_wmem(skb)) { ++ delta = skb_end_offset(skb) - osize; ++ refcount_add(delta, &sk->sk_wmem_alloc); ++ skb->truesize += delta; ++ } ++ return skb; ++ ++fail: ++ kfree_skb(skb); ++ return NULL; ++} ++EXPORT_SYMBOL(skb_expand_head); ++ + /** + * skb_copy_expand - copy and expand sk_buff + * @skb: buffer to copy +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index a606ad8e8be25b..dfc2e4d6a7a025 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -904,9 +904,9 @@ static void sk_psock_strp_data_ready(struct sock *sk) + if (tls_sw_has_ctx_rx(sk)) { + psock->parser.saved_data_ready(sk); + } else { +- write_lock_bh(&sk->sk_callback_lock); ++ read_lock_bh(&sk->sk_callback_lock); + strp_data_ready(&psock->parser.strp); +- write_unlock_bh(&sk->sk_callback_lock); ++ read_unlock_bh(&sk->sk_callback_lock); + } + } + rcu_read_unlock(); +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index a6f2e5bf70456a..c62c9713e7ddc1 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1057,7 +1057,7 @@ struct compat_arpt_replace { + u32 underflow[NF_ARP_NUMHOOKS]; + u32 num_counters; + compat_uptr_t counters; +- struct compat_arpt_entry entries[0]; ++ struct compat_arpt_entry entries[]; + }; + + static inline void compat_release_entry(struct compat_arpt_entry *e) +@@ -1385,7 +1385,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + struct compat_arpt_get_entries { + char name[XT_TABLE_MAXNAMELEN]; + compat_uint_t size; +- struct compat_arpt_entry entrytable[0]; ++ struct compat_arpt_entry entrytable[]; + }; + + static int compat_get_entries(struct net *net, +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 0076449eea3558..c21ba5e62fffd6 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1211,7 +1211,7 @@ struct compat_ipt_replace { + u32 underflow[NF_INET_NUMHOOKS]; + u32 num_counters; + compat_uptr_t counters; /* struct xt_counters * */ +- struct compat_ipt_entry entries[0]; ++ struct compat_ipt_entry entries[]; + }; + + static int +@@ -1564,7 +1564,7 @@ compat_do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, + struct compat_ipt_get_entries { + char name[XT_TABLE_MAXNAMELEN]; + compat_uint_t size; +- struct compat_ipt_entry entrytable[0]; ++ struct compat_ipt_entry entrytable[]; + }; + + static int +diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c +index 1a0f580da6527c..5ca527110d02aa 100644 +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -201,6 +201,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { + }, + }; + ++static DEFINE_MUTEX(ila_mutex); ++ + static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) + { + struct ila_net *ilan = net_generic(net, ila_net_id); +@@ -208,16 +210,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) + spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match); + int err = 0, order; + +- if (!ilan->xlat.hooks_registered) { ++ if (!READ_ONCE(ilan->xlat.hooks_registered)) { + /* We defer registering net hooks in the namespace until the + * first mapping is added. + */ +- err = nf_register_net_hooks(net, ila_nf_hook_ops, +- ARRAY_SIZE(ila_nf_hook_ops)); ++ mutex_lock(&ila_mutex); ++ if (!ilan->xlat.hooks_registered) { ++ err = nf_register_net_hooks(net, ila_nf_hook_ops, ++ ARRAY_SIZE(ila_nf_hook_ops)); ++ if (!err) ++ WRITE_ONCE(ilan->xlat.hooks_registered, true); ++ } ++ mutex_unlock(&ila_mutex); + if (err) + return err; +- +- ilan->xlat.hooks_registered = true; + } + + ila = kzalloc(sizeof(*ila), GFP_KERNEL); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index a34a562b0954d1..ba9f774a9eb077 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -59,46 +59,33 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + { + struct dst_entry *dst = skb_dst(skb); + struct net_device *dev = dst->dev; ++ struct inet6_dev *idev = ip6_dst_idev(dst); + unsigned int hh_len = LL_RESERVED_SPACE(dev); +- int delta = hh_len - skb_headroom(skb); +- const struct in6_addr *nexthop; ++ const struct in6_addr *daddr, *nexthop; ++ struct ipv6hdr *hdr; + struct neighbour *neigh; + int ret; + + /* Be paranoid, rather than too clever. */ +- if (unlikely(delta > 0) && dev->header_ops) { +- /* pskb_expand_head() might crash, if skb is shared */ +- if (skb_shared(skb)) { +- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); +- +- if (likely(nskb)) { +- if (skb->sk) +- skb_set_owner_w(nskb, skb->sk); +- consume_skb(skb); +- } else { +- kfree_skb(skb); +- } +- skb = nskb; +- } +- if (skb && +- pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { +- kfree_skb(skb); +- skb = NULL; +- } ++ if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) { ++ /* Make sure idev stays alive */ ++ rcu_read_lock(); ++ skb = skb_expand_head(skb, hh_len); + if (!skb) { +- IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); ++ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); ++ rcu_read_unlock(); + return -ENOMEM; + } ++ rcu_read_unlock(); + } + +- if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { +- struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); +- ++ hdr = ipv6_hdr(skb); ++ daddr = &hdr->daddr; ++ if (ipv6_addr_is_multicast(daddr)) { + if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) && + ((mroute6_is_socket(net, skb) && + !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) || +- ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr, +- &ipv6_hdr(skb)->saddr))) { ++ ipv6_chk_mcast_addr(dev, daddr, &hdr->saddr))) { + struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC); + + /* Do not check for IFF_ALLMULTI; multicast routing +@@ -109,7 +96,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + net, sk, newskb, NULL, newskb->dev, + dev_loopback_xmit); + +- if (ipv6_hdr(skb)->hop_limit == 0) { ++ if (hdr->hop_limit == 0) { + IP6_INC_STATS(net, idev, + IPSTATS_MIB_OUTDISCARDS); + kfree_skb(skb); +@@ -118,9 +105,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + } + + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len); +- +- if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <= +- IPV6_ADDR_SCOPE_NODELOCAL && ++ if (IPV6_ADDR_MC_SCOPE(daddr) <= IPV6_ADDR_SCOPE_NODELOCAL && + !(dev->flags & IFF_LOOPBACK)) { + kfree_skb(skb); + return 0; +@@ -135,10 +120,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + } + + rcu_read_lock_bh(); +- nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr); +- neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop); ++ nexthop = rt6_nexthop((struct rt6_info *)dst, daddr); ++ neigh = __ipv6_neigh_lookup_noref(dev, nexthop); + if (unlikely(!neigh)) +- neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false); ++ neigh = __neigh_create(&nd_tbl, nexthop, dev, false); + if (!IS_ERR(neigh)) { + sock_confirm_neigh(skb, neigh); + ret = neigh_output(neigh, skb, false); +@@ -147,7 +132,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + } + rcu_read_unlock_bh(); + +- IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); ++ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTNOROUTES); + kfree_skb(skb); + return -EINVAL; + } +@@ -272,6 +257,8 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + const struct ipv6_pinfo *np = inet6_sk(sk); + struct in6_addr *first_hop = &fl6->daddr; + struct dst_entry *dst = skb_dst(skb); ++ struct net_device *dev = dst->dev; ++ struct inet6_dev *idev = ip6_dst_idev(dst); + unsigned int head_room; + struct ipv6hdr *hdr; + u8 proto = fl6->flowi6_proto; +@@ -279,22 +266,20 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + int hlimit = -1; + u32 mtu; + +- head_room = sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev); ++ head_room = sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dev); + if (opt) + head_room += opt->opt_nflen + opt->opt_flen; + +- if (unlikely(skb_headroom(skb) < head_room)) { +- struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room); +- if (!skb2) { +- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUTDISCARDS); +- kfree_skb(skb); ++ if (unlikely(head_room > skb_headroom(skb))) { ++ /* Make sure idev stays alive */ ++ rcu_read_lock(); ++ skb = skb_expand_head(skb, head_room); ++ if (!skb) { ++ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); ++ rcu_read_unlock(); + return -ENOBUFS; + } +- if (skb->sk) +- skb_set_owner_w(skb2, skb->sk); +- consume_skb(skb); +- skb = skb2; ++ rcu_read_unlock(); + } + + if (opt) { +@@ -336,8 +321,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + + mtu = dst_mtu(dst); + if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) { +- IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUT, skb->len); ++ IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); + + /* if egress device is enslaved to an L3 master device pass the + * skb to its handler for processing +@@ -350,17 +334,17 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + * we promote our socket to non const + */ + return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, +- net, (struct sock *)sk, skb, NULL, dst->dev, ++ net, (struct sock *)sk, skb, NULL, dev, + dst_output); + } + +- skb->dev = dst->dev; ++ skb->dev = dev; + /* ipv6_local_error() does not require socket lock, + * we promote our socket to non const + */ + ipv6_local_error((struct sock *)sk, EMSGSIZE, fl6, mtu); + +- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS); ++ IP6_INC_STATS(net, idev, IPSTATS_MIB_FRAGFAILS); + kfree_skb(skb); + return -EMSGSIZE; + } +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 41268612bdd4e0..010a704028281f 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1228,7 +1228,7 @@ struct compat_ip6t_replace { + u32 underflow[NF_INET_NUMHOOKS]; + u32 num_counters; + compat_uptr_t counters; /* struct xt_counters * */ +- struct compat_ip6t_entry entries[0]; ++ struct compat_ip6t_entry entries[]; + }; + + static int +@@ -1574,7 +1574,7 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, + struct compat_ip6t_get_entries { + char name[XT_TABLE_MAXNAMELEN]; + compat_uint_t size; +- struct compat_ip6t_entry entrytable[0]; ++ struct compat_ip6t_entry entrytable[]; + }; + + static int +diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c +index f4fb309185ced3..4229c349651dca 100644 +--- a/net/llc/llc_input.c ++++ b/net/llc/llc_input.c +@@ -124,8 +124,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb) + if (unlikely(!pskb_may_pull(skb, llc_len))) + return 0; + +- skb->transport_header += llc_len; + skb_pull(skb, llc_len); ++ skb_reset_transport_header(skb); + if (skb->protocol == htons(ETH_P_802_2)) { + __be16 pdulen; + s32 data_size; +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 63b66fd0a1ce6f..515fe1d539b498 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2209,6 +2209,9 @@ int ieee80211_reconfig(struct ieee80211_local *local) + WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n"); + else + WARN(1, "Hardware became unavailable during restart.\n"); ++ ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_SUSPEND, ++ false); + ieee80211_handle_reconfig_failure(local); + return res; + } +diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c +index e758b81200204b..8fb170c7327fdf 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ip.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c +@@ -46,7 +46,7 @@ struct bitmap_ip { + u8 netmask; /* subnet netmask */ + struct timer_list gc; /* garbage collection */ + struct ip_set *set; /* attached to this ip_set */ +- unsigned char extensions[0] /* data extensions */ ++ unsigned char extensions[] /* data extensions */ + __aligned(__alignof__(u64)); + }; + +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +index ae7cdc0d0f29a3..ebbcb9a16fe94b 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +@@ -49,7 +49,7 @@ struct bitmap_ipmac { + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collector */ + struct ip_set *set; /* attached to this ip_set */ +- unsigned char extensions[0] /* MAC + data extensions */ ++ unsigned char extensions[] /* MAC + data extensions */ + __aligned(__alignof__(u64)); + }; + +diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c +index d4a14750f5c42b..1993f2783774a7 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_port.c ++++ b/net/netfilter/ipset/ip_set_bitmap_port.c +@@ -37,7 +37,7 @@ struct bitmap_port { + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collection */ + struct ip_set *set; /* attached to this ip_set */ +- unsigned char extensions[0] /* data extensions */ ++ unsigned char extensions[] /* data extensions */ + __aligned(__alignof__(u64)); + }; + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 4346cae25a4a02..30b8b3fad1500d 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -76,7 +76,7 @@ struct hbucket { + DECLARE_BITMAP(used, AHASH_MAX_TUNED); + u8 size; /* size of the array */ + u8 pos; /* position of the first free entry */ +- unsigned char value[0] /* the array of the values */ ++ unsigned char value[] /* the array of the values */ + __aligned(__alignof__(u64)); + }; + +@@ -109,7 +109,7 @@ struct htable { + u8 htable_bits; /* size of hash table == 2^htable_bits */ + u32 maxelem; /* Maxelem per region */ + struct ip_set_region *hregion; /* Region locks and ext sizes */ +- struct hbucket __rcu *bucket[0]; /* hashtable buckets */ ++ struct hbucket __rcu *bucket[]; /* hashtable buckets */ + }; + + #define hbucket(h, i) ((h)->bucket[i]) +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index c4aae8c586acf8..b8b4beb2073e93 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -611,6 +611,8 @@ init_list_set(struct net *net, struct ip_set *set, u32 size) + return true; + } + ++static struct lock_class_key list_set_lockdep_key; ++ + static int + list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + u32 flags) +@@ -627,6 +629,7 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + if (size < IP_SET_LIST_MIN_SIZE) + size = IP_SET_LIST_MIN_SIZE; + ++ lockdep_set_class(&set->lock, &list_set_lockdep_key); + set->variant = &set_variant; + set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem), + __alignof__(struct set_elem)); +diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c +index 4b46421c5e17a2..ed4bde3c88506e 100644 +--- a/net/netfilter/nfnetlink_acct.c ++++ b/net/netfilter/nfnetlink_acct.c +@@ -33,7 +33,7 @@ struct nf_acct { + refcount_t refcnt; + char name[NFACCT_NAME_MAX]; + struct rcu_head rcu_head; +- char data[0]; ++ char data[]; + }; + + struct nfacct_filter { +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index 8c835ad637290e..9c5cfd74a0ee48 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -132,7 +132,7 @@ struct xt_hashlimit_htable { + const char *name; + struct net *net; + +- struct hlist_head hash[0]; /* hashtable itself */ ++ struct hlist_head hash[]; /* hashtable itself */ + }; + + static int +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index 6fc0deb11aff2a..dae284e0ed15a4 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -71,7 +71,7 @@ struct recent_entry { + u_int8_t ttl; + u_int8_t index; + u_int16_t nstamps; +- unsigned long stamps[0]; ++ unsigned long stamps[]; + }; + + struct recent_table { +@@ -82,7 +82,7 @@ struct recent_table { + unsigned int entries; + u8 nstamps_max_mask; + struct list_head lru_list; +- struct list_head iphash[0]; ++ struct list_head iphash[]; + }; + + struct recent_net { +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index 85e4637dc8ab14..e1a68269015475 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -751,6 +751,12 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) + int ret; + struct sk_buff *skbn; + ++ /* ++ * Reject malformed packets early. Check that it contains at least 2 ++ * addresses and 1 byte more for Time-To-Live ++ */ ++ if (skb->len < 2 * sizeof(ax25_address) + 1) ++ return 0; + + nr_src = (ax25_address *)(skb->data + 0); + nr_dest = (ax25_address *)(skb->data + 7); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 88bc4a21dda455..b1cf6a069e6322 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -492,10 +492,8 @@ static void *packet_current_frame(struct packet_sock *po, + return packet_lookup_frame(po, rb, rb->head, status); + } + +-static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) ++static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev) + { +- u8 *skb_orig_data = skb->data; +- int skb_orig_len = skb->len; + struct vlan_hdr vhdr, *vh; + unsigned int header_len; + +@@ -516,33 +514,21 @@ static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) + else + return 0; + +- skb_push(skb, skb->data - skb_mac_header(skb)); +- vh = skb_header_pointer(skb, header_len, sizeof(vhdr), &vhdr); +- if (skb_orig_data != skb->data) { +- skb->data = skb_orig_data; +- skb->len = skb_orig_len; +- } ++ vh = skb_header_pointer(skb, skb_mac_offset(skb) + header_len, ++ sizeof(vhdr), &vhdr); + if (unlikely(!vh)) + return 0; + + return ntohs(vh->h_vlan_TCI); + } + +-static __be16 vlan_get_protocol_dgram(struct sk_buff *skb) ++static __be16 vlan_get_protocol_dgram(const struct sk_buff *skb) + { + __be16 proto = skb->protocol; + +- if (unlikely(eth_type_vlan(proto))) { +- u8 *skb_orig_data = skb->data; +- int skb_orig_len = skb->len; +- +- skb_push(skb, skb->data - skb_mac_header(skb)); +- proto = __vlan_get_protocol(skb, proto, NULL); +- if (skb_orig_data != skb->data) { +- skb->data = skb_orig_data; +- skb->len = skb_orig_len; +- } +- } ++ if (unlikely(eth_type_vlan(proto))) ++ proto = __vlan_get_protocol_offset(skb, proto, ++ skb_mac_offset(skb), NULL); + + return proto; + } +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 9b4a9bdbeafd90..f2a49bccb5ef5c 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -1505,7 +1505,6 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free) + b->backlogs[idx] -= len; + b->tin_backlog -= len; + sch->qstats.backlog -= len; +- qdisc_tree_reduce_backlog(sch, 1, len); + + flow->dropped++; + b->tin_dropped++; +@@ -1516,6 +1515,7 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free) + + __qdisc_drop(skb, to_free); + sch->q.qlen--; ++ qdisc_tree_reduce_backlog(sch, 1, len); + + cake_heapify(q, 0); + +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index e54f6eabfa0c03..2007bc4f967092 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -124,10 +124,10 @@ static void choke_drop_by_idx(struct Qdisc *sch, unsigned int idx, + if (idx == q->tail) + choke_zap_tail_holes(q); + ++ --sch->q.qlen; + qdisc_qstats_backlog_dec(sch, skb); + qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(skb)); + qdisc_drop(skb, sch, to_free); +- --sch->q.qlen; + } + + struct choke_skb_cb { +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 2cdcb72c882602..bc9a62744feca5 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -132,7 +132,8 @@ static struct sctp_association *sctp_association_init( + = 5 * asoc->rto_max; + + asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay; +- asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ; ++ asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = ++ (unsigned long)sp->autoclose * HZ; + + /* Initializes the timers */ + for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i) +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index e070b0e2a30c57..1373a0082b5ae2 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1660,6 +1660,13 @@ static __poll_t smc_poll(struct file *file, struct socket *sock, + } else { + sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk); + set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); ++ ++ if (sk->sk_state != SMC_INIT) { ++ /* Race breaker the same way as tcp_poll(). */ ++ smp_mb__after_atomic(); ++ if (atomic_read(&smc->conn.sndbuf_space)) ++ mask |= EPOLLOUT | EPOLLWRNORM; ++ } + } + if (atomic_read(&smc->conn.bytes_to_rcv)) + mask |= EPOLLIN | EPOLLRDNORM; +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index f973010943a054..70f38e98d5fa0a 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -719,8 +719,8 @@ static void do_input(char *alias, + + for (i = min / BITS_PER_LONG; i < max / BITS_PER_LONG + 1; i++) + arr[i] = TO_NATIVE(arr[i]); +- for (i = min; i < max; i++) +- if (arr[i / BITS_PER_LONG] & (1L << (i%BITS_PER_LONG))) ++ for (i = min; i <= max; i++) ++ if (arr[i / BITS_PER_LONG] & (1ULL << (i%BITS_PER_LONG))) + sprintf(alias + strlen(alias), "%X,*", i); + } + +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index a0afe49309c884..ed9e8e23a41499 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -954,7 +954,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, + xpermd->driver)) + return; + } else { +- BUG(); ++ pr_warn_once( ++ "SELinux: unknown extended permission (%u) will be ignored\n", ++ node->datum.u.xperms->specified); ++ return; + } + + if (node->key.specified == AVTAB_XPERMS_ALLOWED) { +@@ -991,7 +994,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, + node->datum.u.xperms->perms.p[i]; + } + } else { +- BUG(); ++ pr_warn_once("SELinux: unknown specified key (%u)\n", ++ node->key.specified); + } + } + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index 11a4454c6f64c6..b29190042f3013 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -61,6 +61,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, + pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL; + /* flag potentially raw DSD capable altsettings */ + fp->dsd_raw = true; ++ /* clear special format bit to avoid "unsupported format" msg below */ ++ format &= ~UAC2_FORMAT_TYPE_I_RAW_DATA; + } + + format <<= 1; +@@ -72,8 +74,11 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, + sample_width = as->bBitResolution; + sample_bytes = as->bSubslotSize; + +- if (format & UAC3_FORMAT_TYPE_I_RAW_DATA) ++ if (format & UAC3_FORMAT_TYPE_I_RAW_DATA) { + pcm_formats |= SNDRV_PCM_FMTBIT_SPECIAL; ++ /* clear special format bit to avoid "unsupported format" msg below */ ++ format &= ~UAC3_FORMAT_TYPE_I_RAW_DATA; ++ } + + format <<= 1; + break; +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 67eb1293fa155d..1374a4e093b3ff 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1906,6 +1906,13 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, + bmaControls = ftr->bmaControls; + } + ++ if (channels > 32) { ++ usb_audio_info(state->chip, ++ "usbmixer: too many channels (%d) in unit %d\n", ++ channels, unitid); ++ return -EINVAL; ++ } ++ + /* parse the source unit */ + err = parse_audio_unit(state, hdr->bSourceID); + if (err < 0) +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index c6c834ac83aca4..eb59a59dcdbf6c 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -687,7 +687,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol, + struct usb_mixer_elem_info *elem = kcontrol->private_data; + struct snd_usb_audio *chip = elem->head.mixer->chip; + struct snd_us16x08_meter_store *store = elem->private_data; +- u8 meter_urb[64]; ++ u8 meter_urb[64] = {0}; + + switch (kcontrol->private_value) { + case 0: {
