commit: 72412e10d28ef50809261bc99f27714df60c120c Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Jul 27 09:16:58 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Jul 27 09:16:58 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=72412e10
Linux patch 5.10.223 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1222_linux-5.10.223.patch | 1857 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1861 insertions(+) diff --git a/0000_README b/0000_README index 4ec64a79..e3ae6e55 100644 --- a/0000_README +++ b/0000_README @@ -931,6 +931,10 @@ Patch: 1221_linux-5.10.222.patch From: https://www.kernel.org Desc: Linux 5.10.222 +Patch: 1222_linux-5.10.223.patch +From: https://www.kernel.org +Desc: Linux 5.10.223 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1222_linux-5.10.223.patch b/1222_linux-5.10.223.patch new file mode 100644 index 00000000..9d5a9a51 --- /dev/null +++ b/1222_linux-5.10.223.patch @@ -0,0 +1,1857 @@ +diff --git a/Makefile b/Makefile +index 5b6dae61250c4..91c79c64f5a39 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 222 ++SUBLEVEL = 223 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index d9db752c51fe2..effcf14e0d477 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -147,16 +147,6 @@ extern int __get_user_64t_1(void *); + extern int __get_user_64t_2(void *); + extern int __get_user_64t_4(void *); + +-#define __GUP_CLOBBER_1 "lr", "cc" +-#ifdef CONFIG_CPU_USE_DOMAINS +-#define __GUP_CLOBBER_2 "ip", "lr", "cc" +-#else +-#define __GUP_CLOBBER_2 "lr", "cc" +-#endif +-#define __GUP_CLOBBER_4 "lr", "cc" +-#define __GUP_CLOBBER_32t_8 "lr", "cc" +-#define __GUP_CLOBBER_8 "lr", "cc" +- + #define __get_user_x(__r2, __p, __e, __l, __s) \ + __asm__ __volatile__ ( \ + __asmeq("%0", "r0") __asmeq("%1", "r2") \ +@@ -164,7 +154,7 @@ extern int __get_user_64t_4(void *); + "bl __get_user_" #__s \ + : "=&r" (__e), "=r" (__r2) \ + : "0" (__p), "r" (__l) \ +- : __GUP_CLOBBER_##__s) ++ : "ip", "lr", "cc") + + /* narrowing a double-word get into a single 32bit word register: */ + #ifdef __ARMEB__ +@@ -186,7 +176,7 @@ extern int __get_user_64t_4(void *); + "bl __get_user_64t_" #__s \ + : "=&r" (__e), "=r" (__r2) \ + : "0" (__p), "r" (__l) \ +- : __GUP_CLOBBER_##__s) ++ : "ip", "lr", "cc") + #else + #define __get_user_x_64t __get_user_x + #endif +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index d766f3b5c03ec..e990e727cc0fa 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1796,6 +1796,7 @@ dwc3@6a00000 { + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; + snps,is-utmi-l1-suspend; ++ snps,parkmode-disable-ss-quirk; + tx-fifo-resize; + }; + }; +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index f0ba854f0045e..34370be75acd5 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -471,6 +471,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu) + for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) { + struct insn_emulation *insn = insn_emulations[i]; + bool enable = READ_ONCE(insn->current_mode) == INSN_HW; ++ if (insn->status == INSN_UNAVAILABLE) ++ continue; ++ + if (insn->set_hw_mode && insn->set_hw_mode(enable)) { + pr_warn("CPU[%u] cannot support the emulation of %s", + cpu, insn->name); +diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl +index 6036af4f30e2d..c262975484fa4 100644 +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -27,7 +27,7 @@ + 17 o32 break sys_ni_syscall + # 18 was sys_stat + 18 o32 unused18 sys_ni_syscall +-19 o32 lseek sys_lseek ++19 o32 lseek sys_lseek compat_sys_lseek + 20 o32 getpid sys_getpid + 21 o32 mount sys_mount + 22 o32 umount sys_oldumount +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c +index 845e024321d47..a856d9ba42d20 100644 +--- a/arch/powerpc/kernel/eeh_pe.c ++++ b/arch/powerpc/kernel/eeh_pe.c +@@ -849,6 +849,7 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + { + struct eeh_dev *edev; + struct pci_dev *pdev; ++ struct pci_bus *bus = NULL; + + if (pe->type & EEH_PE_PHB) + return pe->phb->bus; +@@ -859,9 +860,11 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + + /* Retrieve the parent PCI bus of first (top) PCI device */ + edev = list_first_entry_or_null(&pe->edevs, struct eeh_dev, entry); ++ pci_lock_rescan_remove(); + pdev = eeh_dev_to_pci_dev(edev); + if (pdev) +- return pdev->bus; ++ bus = pdev->bus; ++ pci_unlock_rescan_remove(); + +- return NULL; ++ return bus; + } +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index c640053ab03f2..2686ba59873dd 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -117,14 +117,16 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + } + rcu_read_unlock(); + +- fdput(f); +- +- if (!found) ++ if (!found) { ++ fdput(f); + return -EINVAL; ++ } + + table_group = iommu_group_get_iommudata(grp); +- if (WARN_ON(!table_group)) ++ if (WARN_ON(!table_group)) { ++ fdput(f); + return -EFAULT; ++ } + + for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) { + struct iommu_table *tbltmp = table_group->tables[i]; +@@ -145,8 +147,10 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + break; + } + } +- if (!tbl) ++ if (!tbl) { ++ fdput(f); + return -EINVAL; ++ } + + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { +@@ -157,6 +161,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + /* stit is being destroyed */ + iommu_tce_table_put(tbl); + rcu_read_unlock(); ++ fdput(f); + return -ENOTTY; + } + /* +@@ -164,6 +169,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + * its KVM reference counter and can return. + */ + rcu_read_unlock(); ++ fdput(f); + return 0; + } + rcu_read_unlock(); +@@ -171,6 +177,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + stit = kzalloc(sizeof(*stit), GFP_KERNEL); + if (!stit) { + iommu_tce_table_put(tbl); ++ fdput(f); + return -ENOMEM; + } + +@@ -179,6 +186,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + + list_add_rcu(&stit->next, &stt->iommu_tables); + ++ fdput(f); + return 0; + } + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 822be2680b792..8e4a2e8aee114 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -312,8 +312,8 @@ static int alloc_dispatch_log_kmem_cache(void) + { + void (*ctor)(void *) = get_dtl_cache_ctor(); + +- dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, +- DISPATCH_LOG_BYTES, 0, ctor); ++ dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, ++ DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); + if (!dtl_cache) { + pr_warn("Failed to create dispatch trace log buffer cache\n"); + pr_warn("Stolen time statistics will be unreliable\n"); +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 487884420fb0d..01a6400c32349 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1316,10 +1316,13 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + if (ec->busy_polling || bits > 8) + acpi_ec_burst_enable(ec); + +- for (i = 0; i < bytes; ++i, ++address, ++value) ++ for (i = 0; i < bytes; ++i, ++address, ++value) { + result = (function == ACPI_READ) ? + acpi_ec_read(ec, address, value) : + acpi_ec_write(ec, address, *value); ++ if (result < 0) ++ break; ++ } + + if (ec->busy_polling || bits > 8) + acpi_ec_burst_disable(ec); +@@ -1331,8 +1334,10 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + return AE_NOT_FOUND; + case -ETIME: + return AE_TIME; +- default: ++ case 0: + return AE_OK; ++ default: ++ return AE_ERROR; + } + } + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 3deeabb273940..ae07927910ca0 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -16,7 +16,6 @@ + #include <linux/acpi.h> + #include <linux/dmi.h> + #include <linux/sched.h> /* need_resched() */ +-#include <linux/sort.h> + #include <linux/tick.h> + #include <linux/cpuidle.h> + #include <linux/cpu.h> +@@ -390,28 +389,24 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr, + return; + } + +-static int acpi_cst_latency_cmp(const void *a, const void *b) ++static void acpi_cst_latency_sort(struct acpi_processor_cx *states, size_t length) + { +- const struct acpi_processor_cx *x = a, *y = b; ++ int i, j, k; + +- if (!(x->valid && y->valid)) +- return 0; +- if (x->latency > y->latency) +- return 1; +- if (x->latency < y->latency) +- return -1; +- return 0; +-} +-static void acpi_cst_latency_swap(void *a, void *b, int n) +-{ +- struct acpi_processor_cx *x = a, *y = b; +- u32 tmp; ++ for (i = 1; i < length; i++) { ++ if (!states[i].valid) ++ continue; + +- if (!(x->valid && y->valid)) +- return; +- tmp = x->latency; +- x->latency = y->latency; +- y->latency = tmp; ++ for (j = i - 1, k = i; j >= 0; j--) { ++ if (!states[j].valid) ++ continue; ++ ++ if (states[j].latency > states[k].latency) ++ swap(states[j].latency, states[k].latency); ++ ++ k = j; ++ } ++ } + } + + static int acpi_processor_power_verify(struct acpi_processor *pr) +@@ -456,10 +451,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr) + + if (buggy_latency) { + pr_notice("FW issue: working around C-state latencies out of order\n"); +- sort(&pr->power.states[1], max_cstate, +- sizeof(struct acpi_processor_cx), +- acpi_cst_latency_cmp, +- acpi_cst_latency_swap); ++ acpi_cst_latency_sort(&pr->power.states[1], max_cstate); + } + + lapic_timer_propagate_broadcast(pr); +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 862a9420df526..8e24fb93324cb 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1743,8 +1743,8 @@ static int null_validate_conf(struct nullb_device *dev) + return -EINVAL; + } + +- dev->blocksize = round_down(dev->blocksize, 512); +- dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096); ++ if (blk_validate_block_size(dev->blocksize)) ++ return -EINVAL; + + if (dev->queue_mode == NULL_Q_MQ && dev->use_per_node_hctx) { + if (dev->submit_queues != nr_online_nodes) +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index c54834ed8751e..1bc3167d3a1c3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -2069,7 +2069,7 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, + struct amdgpu_irq_src *source, + struct amdgpu_iv_entry *entry) + { +- uint32_t instance; ++ int instance; + + DRM_DEBUG("IH: SDMA trap\n"); + instance = sdma_v4_0_irq_id_to_seq(entry->client_id); +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 400281feb4e8d..8246662fa60b7 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1476,16 +1476,47 @@ static void elantech_disconnect(struct psmouse *psmouse) + psmouse->private = NULL; + } + ++/* ++ * Some hw_version 4 models fail to properly activate absolute mode on ++ * resume without going through disable/enable cycle. ++ */ ++static const struct dmi_system_id elantech_needs_reenable[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Lenovo N24 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "81AF"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + /* + * Put the touchpad back into absolute mode when reconnecting + */ + static int elantech_reconnect(struct psmouse *psmouse) + { ++ int err; ++ + psmouse_reset(psmouse); + + if (elantech_detect(psmouse, 0)) + return -1; + ++ if (dmi_check_system(elantech_needs_reenable)) { ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to deactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to reactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ } ++ + if (elantech_set_absolute_mode(psmouse)) { + psmouse_err(psmouse, + "failed to put touchpad back into absolute mode.\n"); +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index 6804970d8f51a..91edfb88a218e 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -75,7 +75,7 @@ static inline void i8042_write_command(int val) + #define SERIO_QUIRK_PROBE_DEFER BIT(5) + #define SERIO_QUIRK_RESET_ALWAYS BIT(6) + #define SERIO_QUIRK_RESET_NEVER BIT(7) +-#define SERIO_QUIRK_DIECT BIT(8) ++#define SERIO_QUIRK_DIRECT BIT(8) + #define SERIO_QUIRK_DUMBKBD BIT(9) + #define SERIO_QUIRK_NOLOOP BIT(10) + #define SERIO_QUIRK_NOTIMEOUT BIT(11) +@@ -1235,6 +1235,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ /* ++ * The Ayaneo Kun is a handheld device where some the buttons ++ * are handled by an AT keyboard. The keyboard is usually ++ * detected as raw, but sometimes, usually after a cold boot, ++ * it is detected as translated. Make sure that the keyboard ++ * is always in raw mode. ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_BOARD_NAME, "KUN"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_DIRECT) ++ }, + { } + }; + +@@ -1553,7 +1567,7 @@ static void __init i8042_check_quirks(void) + if (quirks & SERIO_QUIRK_RESET_NEVER) + i8042_reset = I8042_RESET_NEVER; + } +- if (quirks & SERIO_QUIRK_DIECT) ++ if (quirks & SERIO_QUIRK_DIRECT) + i8042_direct = true; + if (quirks & SERIO_QUIRK_DUMBKBD) + i8042_dumbkbd = true; +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index e8b6c3137420b..901e28bc01645 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -70,7 +70,6 @@ struct silead_ts_data { + struct regulator_bulk_data regulators[2]; + char fw_name[64]; + struct touchscreen_properties prop; +- u32 max_fingers; + u32 chip_id; + struct input_mt_pos pos[SILEAD_MAX_FINGERS]; + int slots[SILEAD_MAX_FINGERS]; +@@ -98,7 +97,7 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data) + input_set_abs_params(data->input, ABS_MT_POSITION_Y, 0, 4095, 0, 0); + touchscreen_parse_properties(data->input, true, &data->prop); + +- input_mt_init_slots(data->input, data->max_fingers, ++ input_mt_init_slots(data->input, SILEAD_MAX_FINGERS, + INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED | + INPUT_MT_TRACK); + +@@ -145,10 +144,10 @@ static void silead_ts_read_data(struct i2c_client *client) + return; + } + +- if (buf[0] > data->max_fingers) { ++ if (buf[0] > SILEAD_MAX_FINGERS) { + dev_warn(dev, "More touches reported then supported %d > %d\n", +- buf[0], data->max_fingers); +- buf[0] = data->max_fingers; ++ buf[0], SILEAD_MAX_FINGERS); ++ buf[0] = SILEAD_MAX_FINGERS; + } + + touch_nr = 0; +@@ -200,7 +199,6 @@ static void silead_ts_read_data(struct i2c_client *client) + + static int silead_ts_init(struct i2c_client *client) + { +- struct silead_ts_data *data = i2c_get_clientdata(client); + int error; + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_RESET, +@@ -210,7 +208,7 @@ static int silead_ts_init(struct i2c_client *client) + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_TOUCH_NR, +- data->max_fingers); ++ SILEAD_MAX_FINGERS); + if (error) + goto i2c_write_err; + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); +@@ -437,13 +435,6 @@ static void silead_ts_read_props(struct i2c_client *client) + const char *str; + int error; + +- error = device_property_read_u32(dev, "silead,max-fingers", +- &data->max_fingers); +- if (error) { +- dev_dbg(dev, "Max fingers read error %d\n", error); +- data->max_fingers = 5; /* Most devices handle up-to 5 fingers */ +- } +- + error = device_property_read_string(dev, "firmware-name", &str); + if (!error) + snprintf(data->fw_name, sizeof(data->fw_name), +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index 9f6682033ed7e..d8311d41f0a7b 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -329,7 +329,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf, + } + + if (!mei_cl_is_connected(cl)) { +- cl_err(dev, cl, "is not connected"); ++ cl_dbg(dev, cl, "is not connected"); + rets = -ENODEV; + goto out; + } +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index 411b3adb1d9ea..a96b223984070 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -266,7 +266,7 @@ int kvaser_usb_send_cmd_async(struct kvaser_usb_net_priv *priv, void *cmd, + } + usb_free_urb(urb); + +- return 0; ++ return err; + } + + int kvaser_usb_can_rx_over_error(struct net_device *netdev) +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index 41ee56015a45e..16fa0e3e752ab 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1141,6 +1141,11 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) + struct sk_buff *skb; + int err, depth; + ++ if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) { ++ err = -EINVAL; ++ goto err; ++ } ++ + if (q->flags & IFF_VNET_HDR) + vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 77e63e7366e78..c34c6f0d23efe 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2472,6 +2472,9 @@ static int tun_xdp_one(struct tun_struct *tun, + bool skb_xdp = false; + struct page *page; + ++ if (unlikely(datasize < ETH_HLEN)) ++ return -EINVAL; ++ + xdp_prog = rcu_dereference(tun->xdp_prog); + if (xdp_prog) { + if (gso->gso_type) { +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 4dd1a9fb4c8a0..d2a8238e144a6 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1312,6 +1312,8 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3000, 0)}, /* Telit FN912 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3001, 0)}, /* Telit FN912 series */ + {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ +diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c +index d2ab3f07c008c..8296e6bc229ee 100644 +--- a/drivers/s390/char/sclp.c ++++ b/drivers/s390/char/sclp.c +@@ -1208,6 +1208,7 @@ sclp_init(void) + fail_unregister_reboot_notifier: + unregister_reboot_notifier(&sclp_reboot_notifier); + fail_init_state_uninitialized: ++ list_del(&sclp_state_change_event.list); + sclp_init_state = sclp_init_state_uninitialized; + free_page((unsigned long) sclp_read_sccb); + free_page((unsigned long) sclp_init_sccb); +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 297f2b412d074..17fa1cd91da61 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -182,6 +182,15 @@ void scsi_remove_host(struct Scsi_Host *shost) + scsi_proc_host_rm(shost); + scsi_proc_hostdir_rm(shost->hostt); + ++ /* ++ * New SCSI devices cannot be attached anymore because of the SCSI host ++ * state so drop the tag set refcnt. Wait until the tag set refcnt drops ++ * to zero because .exit_cmd_priv implementations may need the host ++ * pointer. ++ */ ++ kref_put(&shost->tagset_refcnt, scsi_mq_free_tags); ++ wait_for_completion(&shost->tagset_freed); ++ + spin_lock_irqsave(shost->host_lock, flags); + if (scsi_host_set_state(shost, SHOST_DEL)) + BUG_ON(scsi_host_set_state(shost, SHOST_DEL_RECOVERY)); +@@ -240,6 +249,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + + shost->dma_dev = dma_dev; + ++ kref_init(&shost->tagset_refcnt); ++ init_completion(&shost->tagset_freed); ++ + /* + * Increase usage count temporarily here so that calling + * scsi_autopm_put_host() will trigger runtime idle if there is +@@ -312,6 +324,7 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + pm_runtime_disable(&shost->shost_gendev); + pm_runtime_set_suspended(&shost->shost_gendev); + pm_runtime_put_noidle(&shost->shost_gendev); ++ kref_put(&shost->tagset_refcnt, scsi_mq_free_tags); + fail: + return error; + } +@@ -344,9 +357,6 @@ static void scsi_host_dev_release(struct device *dev) + kfree(dev_name(&shost->shost_dev)); + } + +- if (shost->tag_set.tags) +- scsi_mq_destroy_tags(shost); +- + kfree(shost->shost_data); + + ida_simple_remove(&host_index_ida, shost->host_no); +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 52e09c3e2b50d..3ef2fde28b8ed 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -114,6 +114,20 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); ++ ++ /* ++ * If the device probe failed, the expander phy attached address ++ * needs to be reset so that the phy will not be treated as flutter ++ * in the next revalidation ++ */ ++ if (dev->parent && !dev_is_expander(dev->dev_type)) { ++ struct sas_phy *phy = dev->phy; ++ struct domain_device *parent = dev->parent; ++ struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; ++ ++ memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); ++ } ++ + sas_unregister_dev(dev->port, dev); + } + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 6923862be3fbc..2536da96130ea 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3453,6 +3453,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + } + + /* Start the Slowpath-process */ ++ memset(&slowpath_params, 0, sizeof(struct qed_slowpath_params)); + slowpath_params.int_mode = QED_INT_MODE_MSIX; + slowpath_params.drv_major = QEDF_DRIVER_MAJOR_VER; + slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 14dec86ff749e..64ae7bc2de604 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1923,9 +1923,13 @@ int scsi_mq_setup_tags(struct Scsi_Host *shost) + return blk_mq_alloc_tag_set(tag_set); + } + +-void scsi_mq_destroy_tags(struct Scsi_Host *shost) ++void scsi_mq_free_tags(struct kref *kref) + { ++ struct Scsi_Host *shost = container_of(kref, typeof(*shost), ++ tagset_refcnt); ++ + blk_mq_free_tag_set(&shost->tag_set); ++ complete(&shost->tagset_freed); + } + + /** +diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h +index 1183dbed687c6..3fee9af059257 100644 +--- a/drivers/scsi/scsi_priv.h ++++ b/drivers/scsi/scsi_priv.h +@@ -93,7 +93,7 @@ extern void scsi_requeue_run_queue(struct work_struct *work); + extern struct request_queue *scsi_mq_alloc_queue(struct scsi_device *sdev); + extern void scsi_start_queue(struct scsi_device *sdev); + extern int scsi_mq_setup_tags(struct Scsi_Host *shost); +-extern void scsi_mq_destroy_tags(struct Scsi_Host *shost); ++extern void scsi_mq_free_tags(struct kref *kref); + extern void scsi_exit_queue(void); + extern void scsi_evt_thread(struct work_struct *work); + struct request_queue; +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 6f7c4d41c51de..e8703b043805e 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -273,6 +273,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + kfree(sdev); + goto out; + } ++ kref_get(&sdev->host->tagset_refcnt); + WARN_ON_ONCE(!blk_get_queue(sdev->request_queue)); + sdev->request_queue->queuedata = sdev; + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 6cc4d0792e3d0..bb37d698da1a1 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1481,6 +1481,7 @@ void __scsi_remove_device(struct scsi_device *sdev) + mutex_unlock(&sdev->state_mutex); + + blk_cleanup_queue(sdev->request_queue); ++ kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags); + cancel_work_sync(&sdev->requeue_work); + + if (sdev->host->hostt->slave_destroy) +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 21297cc62571a..8566da12d15e3 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1001,7 +1001,7 @@ static struct spi_imx_devtype_data imx35_cspi_devtype_data = { + .rx_available = mx31_rx_available, + .reset = mx31_reset, + .fifo_size = 8, +- .has_dmamode = true, ++ .has_dmamode = false, + .dynamic_burst = false, + .has_slavemode = false, + .devtype = IMX35_CSPI, +diff --git a/drivers/spi/spi-mux.c b/drivers/spi/spi-mux.c +index 9708b7827ff70..b18c5265e858c 100644 +--- a/drivers/spi/spi-mux.c ++++ b/drivers/spi/spi-mux.c +@@ -149,6 +149,7 @@ static int spi_mux_probe(struct spi_device *spi) + /* supported modes are the same as our parent's */ + ctlr->mode_bits = spi->controller->mode_bits; + ctlr->flags = spi->controller->flags; ++ ctlr->bits_per_word_mask = spi->controller->bits_per_word_mask; + ctlr->transfer_one_message = spi_mux_transfer_one_message; + ctlr->setup = spi_mux_setup; + ctlr->num_chipselect = mux_control_states(priv->mux); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 50669ff9346c6..83d17f22335b1 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1197,7 +1197,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + + int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + { +- struct btrfs_root *quota_root; ++ struct btrfs_root *quota_root = NULL; + struct btrfs_trans_handle *trans = NULL; + int ret = 0; + +@@ -1290,9 +1290,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + btrfs_tree_unlock(quota_root->node); + btrfs_free_tree_block(trans, quota_root, quota_root->node, 0, 1); + +- btrfs_put_root(quota_root); + + out: ++ btrfs_put_root(quota_root); + mutex_unlock(&fs_info->qgroup_ioctl_lock); + if (ret && trans) + btrfs_end_transaction(trans); +diff --git a/fs/dcache.c b/fs/dcache.c +index 406a71abb1b59..5febd219fdebf 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -3092,28 +3092,25 @@ EXPORT_SYMBOL(d_splice_alias); + + bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry) + { +- bool result; ++ bool subdir; + unsigned seq; + + if (new_dentry == old_dentry) + return true; + +- do { +- /* for restarting inner loop in case of seq retry */ +- seq = read_seqbegin(&rename_lock); +- /* +- * Need rcu_readlock to protect against the d_parent trashing +- * due to d_move +- */ +- rcu_read_lock(); +- if (d_ancestor(old_dentry, new_dentry)) +- result = true; +- else +- result = false; +- rcu_read_unlock(); +- } while (read_seqretry(&rename_lock, seq)); +- +- return result; ++ /* Access d_parent under rcu as d_move() may change it. */ ++ rcu_read_lock(); ++ seq = read_seqbegin(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ /* Try lockless once... */ ++ if (read_seqretry(&rename_lock, seq)) { ++ /* ...else acquire lock for progress even on deep chains. */ ++ read_seqlock_excl(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ read_sequnlock_excl(&rename_lock); ++ } ++ rcu_read_unlock(); ++ return subdir; + } + EXPORT_SYMBOL(is_subdir); + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 0149d3c2cfd78..02236f298de93 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -46,6 +46,7 @@ + #include <linux/part_stat.h> + #include <linux/kthread.h> + #include <linux/freezer.h> ++#include <linux/fsnotify.h> + + #include "ext4.h" + #include "ext4_extents.h" /* Needed for trace points definition */ +@@ -699,6 +700,7 @@ void __ext4_error(struct super_block *sb, const char *function, + sb->s_id, function, line, current->comm, &vaf); + va_end(args); + } ++ fsnotify_sb_error(sb, NULL, error ? error : EFSCORRUPTED); + save_error_info(sb, error, 0, block, function, line); + ext4_handle_error(sb); + } +@@ -730,6 +732,7 @@ void __ext4_error_inode(struct inode *inode, const char *function, + current->comm, &vaf); + va_end(args); + } ++ fsnotify_sb_error(inode->i_sb, inode, error ? error : EFSCORRUPTED); + save_error_info(inode->i_sb, error, inode->i_ino, block, + function, line); + ext4_handle_error(inode->i_sb); +@@ -769,6 +772,7 @@ void __ext4_error_file(struct file *file, const char *function, + current->comm, path, &vaf); + va_end(args); + } ++ fsnotify_sb_error(inode->i_sb, inode, EFSCORRUPTED); + save_error_info(inode->i_sb, EFSCORRUPTED, inode->i_ino, block, + function, line); + ext4_handle_error(inode->i_sb); +@@ -837,7 +841,7 @@ void __ext4_std_error(struct super_block *sb, const char *function, + printk(KERN_CRIT "EXT4-fs error (device %s) in %s:%d: %s\n", + sb->s_id, function, line, errstr); + } +- ++ fsnotify_sb_error(sb, NULL, errno ? errno : EFSCORRUPTED); + save_error_info(sb, -errno, 0, 0, function, line); + ext4_handle_error(sb); + } +@@ -861,6 +865,7 @@ void __ext4_abort(struct super_block *sb, const char *function, + if (unlikely(ext4_forced_shutdown(EXT4_SB(sb)))) + return; + ++ fsnotify_sb_error(sb, NULL, error ? error : EFSCORRUPTED); + save_error_info(sb, error, 0, 0, function, line); + va_start(args, fmt); + vaf.fmt = fmt; +@@ -5887,7 +5892,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + } + + if (ext4_test_mount_flag(sb, EXT4_MF_FS_ABORTED)) +- ext4_abort(sb, EXT4_ERR_ESHUTDOWN, "Abort forced by user"); ++ ext4_abort(sb, ESHUTDOWN, "Abort forced by user"); + + sb->s_flags = (sb->s_flags & ~SB_POSIXACL) | + (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0); +diff --git a/fs/file.c b/fs/file.c +index fdb84a64724b7..913f7d897d2fc 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -494,12 +494,12 @@ struct files_struct init_files = { + + static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) + { +- unsigned int maxfd = fdt->max_fds; ++ unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */ + unsigned int maxbit = maxfd / BITS_PER_LONG; + unsigned int bitbit = start / BITS_PER_LONG; + + bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG; +- if (bitbit > maxfd) ++ if (bitbit >= maxfd) + return maxfd; + if (bitbit > start) + start = bitbit; +diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c +index bb0b27d88e502..d91f76ef18d9b 100644 +--- a/fs/hfsplus/xattr.c ++++ b/fs/hfsplus/xattr.c +@@ -700,7 +700,7 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size) + return err; + } + +- strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + ++ strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL); + if (!strbuf) { + res = -ENOMEM; +diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c +index 7ae54f78a5b0b..aea5531559c06 100644 +--- a/fs/jfs/xattr.c ++++ b/fs/jfs/xattr.c +@@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + size_t buf_size) + { + struct jfs_ea_list *ealist; +- struct jfs_ea *ea; ++ struct jfs_ea *ea, *ealist_end; + struct ea_buffer ea_buf; + int xattr_size; + ssize_t size; +@@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + goto not_found; + + ealist = (struct jfs_ea_list *) ea_buf.xattr; ++ ealist_end = END_EALIST(ealist); + + /* Find the named attribute */ +- for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) ++ for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { ++ if (unlikely(ea + 1 > ealist_end) || ++ unlikely(NEXT_EA(ea) > ealist_end)) { ++ size = -EUCLEAN; ++ goto release; ++ } ++ + if ((namelen == ea->namelen) && + memcmp(name, ea->name, namelen) == 0) { + /* Found it */ +@@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, + memcpy(data, value, size); + goto release; + } ++ } + not_found: + size = -ENODATA; + release: +@@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) + ssize_t size = 0; + int xattr_size; + struct jfs_ea_list *ealist; +- struct jfs_ea *ea; ++ struct jfs_ea *ea, *ealist_end; + struct ea_buffer ea_buf; + + down_read(&JFS_IP(inode)->xattr_sem); +@@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) + goto release; + + ealist = (struct jfs_ea_list *) ea_buf.xattr; ++ ealist_end = END_EALIST(ealist); + + /* compute required size of list */ +- for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { ++ for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { ++ if (unlikely(ea + 1 > ealist_end) || ++ unlikely(NEXT_EA(ea) > ealist_end)) { ++ size = -EUCLEAN; ++ goto release; ++ } ++ + if (can_list(ea)) + size += name_size(ea) + 1; + } +diff --git a/fs/locks.c b/fs/locks.c +index 843fa3d3375d4..ed8b3e318f97d 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -2588,8 +2588,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, + error = do_lock_file_wait(filp, cmd, file_lock); + + /* +- * Attempt to detect a close/fcntl race and recover by releasing the +- * lock that was just acquired. There is no need to do that when we're ++ * Detect close/fcntl races and recover by zapping all POSIX locks ++ * associated with this file and our files_struct, just like on ++ * filp_flush(). There is no need to do that when we're + * unlocking though, or for OFD locks. + */ + if (!error && file_lock->fl_type != F_UNLCK && +@@ -2604,9 +2605,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, + f = files_lookup_fd_locked(files, fd); + spin_unlock(&files->file_lock); + if (f != filp) { +- file_lock->fl_type = F_UNLCK; +- error = do_lock_file_wait(filp, cmd, file_lock); +- WARN_ON_ONCE(error); ++ locks_remove_posix(filp, files); + error = -EBADF; + } + } +@@ -2720,8 +2719,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, + error = do_lock_file_wait(filp, cmd, file_lock); + + /* +- * Attempt to detect a close/fcntl race and recover by releasing the +- * lock that was just acquired. There is no need to do that when we're ++ * Detect close/fcntl races and recover by zapping all POSIX locks ++ * associated with this file and our files_struct, just like on ++ * filp_flush(). There is no need to do that when we're + * unlocking though, or for OFD locks. + */ + if (!error && file_lock->fl_type != F_UNLCK && +@@ -2736,9 +2736,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, + f = files_lookup_fd_locked(files, fd); + spin_unlock(&files->file_lock); + if (f != filp) { +- file_lock->fl_type = F_UNLCK; +- error = do_lock_file_wait(filp, cmd, file_lock); +- WARN_ON_ONCE(error); ++ locks_remove_posix(filp, files); + error = -EBADF; + } + } +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index bdfba9db558ac..4cc29b808d180 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -296,13 +296,16 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len, + * bh passed here can be an inode block or a dir data block, depending + * on the inode inline data flag. + */ +-static int ocfs2_check_dir_entry(struct inode * dir, +- struct ocfs2_dir_entry * de, +- struct buffer_head * bh, ++static int ocfs2_check_dir_entry(struct inode *dir, ++ struct ocfs2_dir_entry *de, ++ struct buffer_head *bh, ++ char *buf, ++ unsigned int size, + unsigned long offset) + { + const char *error_msg = NULL; + const int rlen = le16_to_cpu(de->rec_len); ++ const unsigned long next_offset = ((char *) de - buf) + rlen; + + if (unlikely(rlen < OCFS2_DIR_REC_LEN(1))) + error_msg = "rec_len is smaller than minimal"; +@@ -310,9 +313,11 @@ static int ocfs2_check_dir_entry(struct inode * dir, + error_msg = "rec_len % 4 != 0"; + else if (unlikely(rlen < OCFS2_DIR_REC_LEN(de->name_len))) + error_msg = "rec_len is too small for name_len"; +- else if (unlikely( +- ((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize)) +- error_msg = "directory entry across blocks"; ++ else if (unlikely(next_offset > size)) ++ error_msg = "directory entry overrun"; ++ else if (unlikely(next_offset > size - OCFS2_DIR_REC_LEN(1)) && ++ next_offset != size) ++ error_msg = "directory entry too close to end"; + + if (unlikely(error_msg != NULL)) + mlog(ML_ERROR, "bad entry in directory #%llu: %s - " +@@ -354,16 +359,17 @@ static inline int ocfs2_search_dirblock(struct buffer_head *bh, + de_buf = first_de; + dlimit = de_buf + bytes; + +- while (de_buf < dlimit) { ++ while (de_buf < dlimit - OCFS2_DIR_MEMBER_LEN) { + /* this code is executed quadratically often */ + /* do minimal checking `by hand' */ + + de = (struct ocfs2_dir_entry *) de_buf; + +- if (de_buf + namelen <= dlimit && ++ if (de->name + namelen <= dlimit && + ocfs2_match(namelen, name, de)) { + /* found a match - just to be sure, do a full check */ +- if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, first_de, ++ bytes, offset)) { + ret = -1; + goto bail; + } +@@ -1140,7 +1146,7 @@ static int __ocfs2_delete_entry(handle_t *handle, struct inode *dir, + pde = NULL; + de = (struct ocfs2_dir_entry *) first_de; + while (i < bytes) { +- if (!ocfs2_check_dir_entry(dir, de, bh, i)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, first_de, bytes, i)) { + status = -EIO; + mlog_errno(status); + goto bail; +@@ -1640,7 +1646,8 @@ int __ocfs2_add_entry(handle_t *handle, + /* These checks should've already been passed by the + * prepare function, but I guess we can leave them + * here anyway. */ +- if (!ocfs2_check_dir_entry(dir, de, insert_bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, insert_bh, data_start, ++ size, offset)) { + retval = -ENOENT; + goto bail; + } +@@ -1778,7 +1785,8 @@ static int ocfs2_dir_foreach_blk_id(struct inode *inode, + } + + de = (struct ocfs2_dir_entry *) (data->id_data + ctx->pos); +- if (!ocfs2_check_dir_entry(inode, de, di_bh, ctx->pos)) { ++ if (!ocfs2_check_dir_entry(inode, de, di_bh, (char *)data->id_data, ++ i_size_read(inode), ctx->pos)) { + /* On error, skip the f_pos to the end. */ + ctx->pos = i_size_read(inode); + break; +@@ -1871,7 +1879,8 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, + while (ctx->pos < i_size_read(inode) + && offset < sb->s_blocksize) { + de = (struct ocfs2_dir_entry *) (bh->b_data + offset); +- if (!ocfs2_check_dir_entry(inode, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(inode, de, bh, bh->b_data, ++ sb->s_blocksize, offset)) { + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +@@ -3343,7 +3352,7 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, + struct super_block *sb = dir->i_sb; + struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; + struct ocfs2_dir_entry *de, *last_de = NULL; +- char *de_buf, *limit; ++ char *first_de, *de_buf, *limit; + unsigned long offset = 0; + unsigned int rec_len, new_rec_len, free_space = dir->i_sb->s_blocksize; + +@@ -3356,14 +3365,16 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, + else + free_space = dir->i_sb->s_blocksize - i_size_read(dir); + +- de_buf = di->id2.i_data.id_data; ++ first_de = di->id2.i_data.id_data; ++ de_buf = first_de; + limit = de_buf + i_size_read(dir); + rec_len = OCFS2_DIR_REC_LEN(namelen); + + while (de_buf < limit) { + de = (struct ocfs2_dir_entry *)de_buf; + +- if (!ocfs2_check_dir_entry(dir, de, di_bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, di_bh, first_de, ++ i_size_read(dir), offset)) { + ret = -ENOENT; + goto out; + } +@@ -3445,7 +3456,8 @@ static int ocfs2_find_dir_space_el(struct inode *dir, const char *name, + /* move to next block */ + de = (struct ocfs2_dir_entry *) bh->b_data; + } +- if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { ++ if (!ocfs2_check_dir_entry(dir, de, bh, bh->b_data, blocksize, ++ offset)) { + status = -ENOENT; + goto bail; + } +diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h +index e2af013ec05f4..49db90cfe375f 100644 +--- a/include/linux/skmsg.h ++++ b/include/linux/skmsg.h +@@ -407,10 +407,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock) + + static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock) + { ++ read_lock_bh(&sk->sk_callback_lock); + if (psock->parser.enabled) + psock->parser.saved_data_ready(sk); + else + sk->sk_data_ready(sk); ++ read_unlock_bh(&sk->sk_callback_lock); + } + + static inline void psock_set_prog(struct bpf_prog **pprog, +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index 4a9f1e6e3aaca..3979e946c3fd1 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -548,6 +548,8 @@ struct Scsi_Host { + struct scsi_host_template *hostt; + struct scsi_transport_template *transportt; + ++ struct kref tagset_refcnt; ++ struct completion tagset_freed; + /* Area to keep a shared tag map */ + struct blk_mq_tag_set tag_set; + +diff --git a/include/sound/dmaengine_pcm.h b/include/sound/dmaengine_pcm.h +index 8c5e38180fb04..618405da95b30 100644 +--- a/include/sound/dmaengine_pcm.h ++++ b/include/sound/dmaengine_pcm.h +@@ -34,6 +34,7 @@ snd_pcm_uframes_t snd_dmaengine_pcm_pointer_no_residue(struct snd_pcm_substream + int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream, + struct dma_chan *chan); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream); ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream); + + int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + dma_filter_fn filter_fn, void *filter_data); +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index 1e4bf23528a3d..eac0026e2fa62 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -41,9 +41,12 @@ struct bpf_ringbuf { + * mapping consumer page as r/w, but restrict producer page to r/o. + * This protects producer position from being modified by user-space + * application and ruining in-kernel position tracking. ++ * Note that the pending counter is placed in the same ++ * page as the producer, so that it shares the same cache line. + */ + unsigned long consumer_pos __aligned(PAGE_SIZE); + unsigned long producer_pos __aligned(PAGE_SIZE); ++ unsigned long pending_pos; + char data[] __aligned(PAGE_SIZE); + }; + +@@ -145,6 +148,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) + rb->mask = data_sz - 1; + rb->consumer_pos = 0; + rb->producer_pos = 0; ++ rb->pending_pos = 0; + + return rb; + } +@@ -323,9 +327,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) + + static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + { +- unsigned long cons_pos, prod_pos, new_prod_pos, flags; +- u32 len, pg_off; ++ unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; + struct bpf_ringbuf_hdr *hdr; ++ u32 len, pg_off, tmp_size, hdr_len; + + if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) + return NULL; +@@ -343,13 +347,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) + spin_lock_irqsave(&rb->spinlock, flags); + } + ++ pend_pos = rb->pending_pos; + prod_pos = rb->producer_pos; + new_prod_pos = prod_pos + len; + +- /* check for out of ringbuf space by ensuring producer position +- * doesn't advance more than (ringbuf_size - 1) ahead ++ while (pend_pos < prod_pos) { ++ hdr = (void *)rb->data + (pend_pos & rb->mask); ++ hdr_len = READ_ONCE(hdr->len); ++ if (hdr_len & BPF_RINGBUF_BUSY_BIT) ++ break; ++ tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; ++ tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); ++ pend_pos += tmp_size; ++ } ++ rb->pending_pos = pend_pos; ++ ++ /* check for out of ringbuf space: ++ * - by ensuring producer position doesn't advance more than ++ * (ringbuf_size - 1) ahead ++ * - by ensuring oldest not yet committed record until newest ++ * record does not span more than (ringbuf_size - 1) + */ +- if (new_prod_pos - cons_pos > rb->mask) { ++ if (new_prod_pos - cons_pos > rb->mask || ++ new_prod_pos - pend_pos > rb->mask) { + spin_unlock_irqrestore(&rb->spinlock, flags); + return NULL; + } +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index b9cf5bc9364c1..c8c1cd55c0eb0 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3839,7 +3839,11 @@ void hci_unregister_dev(struct hci_dev *hdev) + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); + ++ cancel_work_sync(&hdev->rx_work); ++ cancel_work_sync(&hdev->cmd_work); ++ cancel_work_sync(&hdev->tx_work); + cancel_work_sync(&hdev->power_on); ++ cancel_work_sync(&hdev->error_reset); + + if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { + hci_suspend_clear_tasks(hdev); +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 475a19db37132..ce42626663de6 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -758,7 +758,9 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags, + sock_rps_record_flow(sk2); + WARN_ON(!((1 << sk2->sk_state) & + (TCPF_ESTABLISHED | TCPF_SYN_RECV | +- TCPF_CLOSE_WAIT | TCPF_CLOSE))); ++ TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | ++ TCPF_CLOSING | TCPF_CLOSE_WAIT | ++ TCPF_CLOSE))); + + sock_graft(sk2, newsock); + +diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c +index 8c1ce78956bae..9d37f7164e732 100644 +--- a/net/ipv6/ila/ila_lwt.c ++++ b/net/ipv6/ila/ila_lwt.c +@@ -58,7 +58,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + return orig_dst->lwtstate->orig_output(net, sk, skb); + } + ++ local_bh_disable(); + dst = dst_cache_get(&ilwt->dst_cache); ++ local_bh_enable(); + if (unlikely(!dst)) { + struct ipv6hdr *ip6h = ipv6_hdr(skb); + struct flowi6 fl6; +@@ -86,8 +88,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- if (ilwt->connected) ++ if (ilwt->connected) { ++ local_bh_disable(); + dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr); ++ local_bh_enable(); ++ } + } + + skb_dst_set(skb, dst); +diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c +index 5fdf3ebb953fb..2ba605db69769 100644 +--- a/net/ipv6/rpl_iptunnel.c ++++ b/net/ipv6/rpl_iptunnel.c +@@ -217,9 +217,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + if (unlikely(err)) + goto drop; + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); ++ local_bh_enable(); + + if (unlikely(!dst)) { + struct ipv6hdr *hdr = ipv6_hdr(skb); +@@ -239,9 +239,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- preempt_disable(); ++ local_bh_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr); +- preempt_enable(); ++ local_bh_enable(); + } + + skb_dst_drop(skb); +@@ -273,9 +273,8 @@ static int rpl_input(struct sk_buff *skb) + return err; + } + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); + + skb_dst_drop(skb); + +@@ -283,14 +282,13 @@ static int rpl_input(struct sk_buff *skb) + ip6_route_input(skb); + dst = skb_dst(skb); + if (!dst->error) { +- preempt_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, + &ipv6_hdr(skb)->saddr); +- preempt_enable(); + } + } else { + skb_dst_set(skb, dst); + } ++ local_bh_enable(); + + err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); + if (unlikely(err)) +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index ce5825d6f1d1c..d3a9ce1f8e53f 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -1584,6 +1584,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata) + ifmsh->last_preq = jiffies; + ifmsh->next_perr = jiffies; + ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE; ++ ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE; + /* Allocate all mesh structures when creating the first mesh interface. */ + if (!mesh_allocated) + ieee80211s_init(); +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index b241ff8c015a9..be5d02c129e92 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -727,15 +727,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, + local->hw_scan_ies_bufsize *= n_bands; + } + +- local->hw_scan_req = kmalloc( +- sizeof(*local->hw_scan_req) + +- req->n_channels * sizeof(req->channels[0]) + +- local->hw_scan_ies_bufsize, GFP_KERNEL); ++ local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req, ++ req.channels, ++ req->n_channels) + ++ local->hw_scan_ies_bufsize, ++ GFP_KERNEL); + if (!local->hw_scan_req) + return -ENOMEM; + + local->hw_scan_req->req.ssids = req->ssids; + local->hw_scan_req->req.n_ssids = req->n_ssids; ++ /* None of the channels are actually set ++ * up but let UBSAN know the boundaries. ++ */ ++ local->hw_scan_req->req.n_channels = req->n_channels; ++ + ies = (u8 *)local->hw_scan_req + + sizeof(*local->hw_scan_req) + + req->n_channels * sizeof(req->channels[0]); +diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c +index c829e4a753256..7cea95d0b78f9 100644 +--- a/net/mac802154/tx.c ++++ b/net/mac802154/tx.c +@@ -34,8 +34,8 @@ void ieee802154_xmit_worker(struct work_struct *work) + if (res) + goto err_tx; + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, skb->len); + + ieee802154_xmit_complete(&local->hw, skb, false); + +@@ -86,8 +86,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) + goto err_tx; + } + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, len); + } else { + local->tx_skb = skb; + queue_work(local->workqueue, &local->tx_work); +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index a6c289a61d30c..76a27b6d45d28 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -2772,10 +2772,14 @@ int cfg80211_wext_siwscan(struct net_device *dev, + wiphy = &rdev->wiphy; + + /* Determine number of channels, needed to allocate creq */ +- if (wreq && wreq->num_channels) ++ if (wreq && wreq->num_channels) { ++ /* Passed from userspace so should be checked */ ++ if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES)) ++ return -EINVAL; + n_channels = wreq->num_channels; +- else ++ } else { + n_channels = ieee80211_get_num_supported_channels(wiphy); ++ } + + creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + + n_channels * sizeof(void *), +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 6d4563b8a52c6..0c037b8845308 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -980,4 +980,8 @@ static inline void debug_gimple_stmt(const_gimple s) + #define SET_DECL_MODE(decl, mode) DECL_MODE(decl) = (mode) + #endif + ++#if BUILDING_GCC_VERSION >= 14000 ++#define last_stmt(x) last_nondebug_stmt(x) ++#endif ++ + #endif +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index 81ebf8108ca74..81dfdf4470f75 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -396,35 +396,6 @@ static struct expr *expr_eliminate_yn(struct expr *e) + return e; + } + +-/* +- * bool FOO!=n => FOO +- */ +-struct expr *expr_trans_bool(struct expr *e) +-{ +- if (!e) +- return NULL; +- switch (e->type) { +- case E_AND: +- case E_OR: +- case E_NOT: +- e->left.expr = expr_trans_bool(e->left.expr); +- e->right.expr = expr_trans_bool(e->right.expr); +- break; +- case E_UNEQUAL: +- // FOO!=n -> FOO +- if (e->left.sym->type == S_TRISTATE) { +- if (e->right.sym == &symbol_no) { +- e->type = E_SYMBOL; +- e->right.sym = NULL; +- } +- } +- break; +- default: +- ; +- } +- return e; +-} +- + /* + * e1 || e2 -> ? + */ +diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h +index 5c3443692f346..385a47daa3643 100644 +--- a/scripts/kconfig/expr.h ++++ b/scripts/kconfig/expr.h +@@ -302,7 +302,6 @@ void expr_free(struct expr *e); + void expr_eliminate_eq(struct expr **ep1, struct expr **ep2); + int expr_eq(struct expr *e1, struct expr *e2); + tristate expr_calc_value(struct expr *e); +-struct expr *expr_trans_bool(struct expr *e); + struct expr *expr_eliminate_dups(struct expr *e); + struct expr *expr_transform(struct expr *e); + int expr_contains_symbol(struct expr *dep, struct symbol *sym); +diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c +index 5527482c30779..4097999127315 100644 +--- a/scripts/kconfig/gconf.c ++++ b/scripts/kconfig/gconf.c +@@ -1484,7 +1484,6 @@ int main(int ac, char *av[]) + + conf_parse(name); + fixup_rootmenu(&rootmenu); +- conf_read(NULL); + + /* Load the interface and connect signals */ + init_main_window(glade_file); +@@ -1492,6 +1491,8 @@ int main(int ac, char *av[]) + init_left_tree(); + init_right_tree(); + ++ conf_read(NULL); ++ + switch (view_mode) { + case SINGLE_VIEW: + display_tree_part(); +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index a5fbd6ccc006e..e5ad6313cfa1d 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -401,8 +401,6 @@ void menu_finalize(struct menu *parent) + dep = expr_transform(dep); + dep = expr_alloc_and(expr_copy(basedep), dep); + dep = expr_eliminate_dups(dep); +- if (menu->sym && menu->sym->type != S_TRISTATE) +- dep = expr_trans_bool(dep); + prop->visible.expr = dep; + + /* +diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c +index be58505889a36..c46c53656393e 100644 +--- a/sound/core/pcm_dmaengine.c ++++ b/sound/core/pcm_dmaengine.c +@@ -342,6 +342,20 @@ int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + } + EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan); + ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream) ++{ ++ struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status != DMA_PAUSED) ++ dmaengine_synchronize(prtd->dma_chan); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_sync_stop); ++ + /** + * snd_dmaengine_pcm_close - Close a dmaengine based PCM substream + * @substream: PCM substream +@@ -349,6 +363,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + kfree(prtd); +@@ -367,6 +387,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close); + int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + dma_release_channel(prtd->dma_chan); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 669937bae570e..28dbe8cbbffd8 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -578,10 +578,14 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: ++ case 0x10ec0257: + case 0x19e58326: + case 0x10ec0283: ++ case 0x10ec0285: + case 0x10ec0286: ++ case 0x10ec0287: + case 0x10ec0288: ++ case 0x10ec0295: + case 0x10ec0298: + alc_headset_mic_no_shutup(codec); + break; +@@ -9092,6 +9096,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f1, "HP ProBook 630 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), +@@ -9190,6 +9195,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), + SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), ++ SND_PCI_QUIRK(0x10ec, 0x119e, "Positivo SU C1400", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x10ec, 0x11bc, "VAIO VJFE-IL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x124c, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), +@@ -9202,6 +9208,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP), ++ SND_PCI_QUIRK(0x144d, 0xc1a4, "Samsung Galaxy Book Pro 360 (NT935QBD)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP), +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 1d049685e7075..47b581d99da67 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -468,6 +468,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 101 CESIUM"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_JD_NOT_INV | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 9ef80a48707eb..d65dc1acff439 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -326,6 +326,12 @@ static int dmaengine_copy_user(struct snd_soc_component *component, + return 0; + } + ++static int dmaengine_pcm_sync_stop(struct snd_soc_component *component, ++ struct snd_pcm_substream *substream) ++{ ++ return snd_dmaengine_pcm_sync_stop(substream); ++} ++ + static const struct snd_soc_component_driver dmaengine_pcm_component = { + .name = SND_DMAENGINE_PCM_DRV_NAME, + .probe_order = SND_SOC_COMP_ORDER_LATE, +@@ -335,6 +341,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component = { + .trigger = dmaengine_pcm_trigger, + .pointer = dmaengine_pcm_pointer, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const struct snd_soc_component_driver dmaengine_pcm_component_process = { +@@ -347,6 +354,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component_process = { + .pointer = dmaengine_pcm_pointer, + .copy_user = dmaengine_copy_user, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const char * const dmaengine_pcm_dma_channel_names[] = { +diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c +index a6b72ad53b434..61ea444f2018d 100644 +--- a/sound/soc/ti/davinci-mcasp.c ++++ b/sound/soc/ti/davinci-mcasp.c +@@ -1441,10 +1441,11 @@ static int davinci_mcasp_hw_rule_min_periodsize( + { + struct snd_interval *period_size = hw_param_interval(params, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE); ++ u8 numevt = *((u8 *)rule->private); + struct snd_interval frames; + + snd_interval_any(&frames); +- frames.min = 64; ++ frames.min = numevt; + frames.integer = 1; + + return snd_interval_refine(period_size, &frames); +@@ -1459,6 +1460,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + u32 max_channels = 0; + int i, dir, ret; + int tdm_slots = mcasp->tdm_slots; ++ u8 *numevt; + + /* Do not allow more then one stream per direction */ + if (mcasp->substreams[substream->stream]) +@@ -1558,9 +1560,12 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + return ret; + } + ++ numevt = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? ++ &mcasp->txnumevt : ++ &mcasp->rxnumevt; + snd_pcm_hw_rule_add(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, +- davinci_mcasp_hw_rule_min_periodsize, NULL, ++ davinci_mcasp_hw_rule_min_periodsize, numevt, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, -1); + + return 0; +diff --git a/sound/soc/ti/omap-hdmi.c b/sound/soc/ti/omap-hdmi.c +index 3328c02f93c74..1dfe439d13417 100644 +--- a/sound/soc/ti/omap-hdmi.c ++++ b/sound/soc/ti/omap-hdmi.c +@@ -353,11 +353,7 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev) + if (!card) + return -ENOMEM; + +- card->name = devm_kasprintf(dev, GFP_KERNEL, +- "HDMI %s", dev_name(ad->dssdev)); +- if (!card->name) +- return -ENOMEM; +- ++ card->name = "HDMI"; + card->owner = THIS_MODULE; + card->dai_link = + devm_kzalloc(dev, sizeof(*(card->dai_link)), GFP_KERNEL); +diff --git a/tools/testing/selftests/openat2/openat2_test.c b/tools/testing/selftests/openat2/openat2_test.c +index 453152b58e7f0..1045df1a98c07 100644 +--- a/tools/testing/selftests/openat2/openat2_test.c ++++ b/tools/testing/selftests/openat2/openat2_test.c +@@ -5,6 +5,7 @@ + */ + + #define _GNU_SOURCE ++#define __SANE_USERSPACE_TYPES__ // Use ll64 + #include <fcntl.h> + #include <sched.h> + #include <sys/stat.h> +diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c +index 413f75620a35b..4ae417372e9eb 100644 +--- a/tools/testing/selftests/vDSO/parse_vdso.c ++++ b/tools/testing/selftests/vDSO/parse_vdso.c +@@ -55,14 +55,20 @@ static struct vdso_info + ELF(Verdef) *verdef; + } vdso_info; + +-/* Straight from the ELF specification. */ +-static unsigned long elf_hash(const unsigned char *name) ++/* ++ * Straight from the ELF specification...and then tweaked slightly, in order to ++ * avoid a few clang warnings. ++ */ ++static unsigned long elf_hash(const char *name) + { + unsigned long h = 0, g; +- while (*name) ++ const unsigned char *uch_name = (const unsigned char *)name; ++ ++ while (*uch_name) + { +- h = (h << 4) + *name++; +- if (g = h & 0xf0000000) ++ h = (h << 4) + *uch_name++; ++ g = h & 0xf0000000; ++ if (g) + h ^= g >> 24; + h &= ~g; + } +diff --git a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +index 8a44ff973ee17..27f6fdf119691 100644 +--- a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c ++++ b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +@@ -18,7 +18,7 @@ + + #include "parse_vdso.h" + +-/* We need a libc functions... */ ++/* We need some libc functions... */ + int strcmp(const char *a, const char *b) + { + /* This implementation is buggy: it never returns -1. */ +@@ -34,6 +34,20 @@ int strcmp(const char *a, const char *b) + return 0; + } + ++/* ++ * The clang build needs this, although gcc does not. ++ * Stolen from lib/string.c. ++ */ ++void *memcpy(void *dest, const void *src, size_t count) ++{ ++ char *tmp = dest; ++ const char *s = src; ++ ++ while (count--) ++ *tmp++ = *s++; ++ return dest; ++} ++ + /* ...and two syscalls. This is x86-specific. */ + static inline long x86_syscall3(long nr, long a0, long a1, long a2) + { +@@ -70,7 +84,7 @@ void to_base10(char *lastdig, time_t n) + } + } + +-__attribute__((externally_visible)) void c_main(void **stack) ++void c_main(void **stack) + { + /* Parse the stack */ + long argc = (long)*stack;
