commit: 97eea0ce5538c750b7327d4e5d8175afc8012e97 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun Nov 17 18:19:00 2024 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun Nov 17 18:19:00 2024 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=97eea0ce
Linux patch 5.10.230 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1229_linux-5.10.230.patch | 2365 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2369 insertions(+) diff --git a/0000_README b/0000_README index 3cfa7e81..737b6a84 100644 --- a/0000_README +++ b/0000_README @@ -959,6 +959,10 @@ Patch: 1228_linux-5.10.229.patch From: https://www.kernel.org Desc: Linux 5.10.229 +Patch: 1229_linux-5.10.230.patch +From: https://www.kernel.org +Desc: Linux 5.10.230 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1229_linux-5.10.230.patch b/1229_linux-5.10.230.patch new file mode 100644 index 00000000..e55247fd --- /dev/null +++ b/1229_linux-5.10.230.patch @@ -0,0 +1,2365 @@ +diff --git a/Makefile b/Makefile +index ebeab12f249aff..0cc6cad1c8d022 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 229 ++SUBLEVEL = 230 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/boot/dts/rk3036-kylin.dts b/arch/arm/boot/dts/rk3036-kylin.dts +index e817eba8c622ba..0c8cd25d0ba5c6 100644 +--- a/arch/arm/boot/dts/rk3036-kylin.dts ++++ b/arch/arm/boot/dts/rk3036-kylin.dts +@@ -300,8 +300,8 @@ regulator-state-mem { + &i2c2 { + status = "okay"; + +- rt5616: rt5616@1b { +- compatible = "rt5616"; ++ rt5616: audio-codec@1b { ++ compatible = "realtek,rt5616"; + reg = <0x1b>; + clocks = <&cru SCLK_I2S_OUT>; + clock-names = "mclk"; +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index 5f47b638f53274..5cd640ac0d1a47 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -316,12 +316,13 @@ reboot-mode { + }; + }; + +- acodec: acodec-ana@20030000 { +- compatible = "rk3036-codec"; ++ acodec: audio-codec@20030000 { ++ compatible = "rockchip,rk3036-codec"; + reg = <0x20030000 0x4000>; +- rockchip,grf = <&grf>; + clock-names = "acodec_pclk"; + clocks = <&cru PCLK_ACODEC>; ++ rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + }; + +@@ -331,7 +332,6 @@ hdmi: hdmi@20034000 { + interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&cru PCLK_HDMI>; + clock-names = "pclk"; +- rockchip,grf = <&grf>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_ctl>; + status = "disabled"; +@@ -488,11 +488,11 @@ i2c0: i2c@20072000 { + }; + + spi: spi@20074000 { +- compatible = "rockchip,rockchip-spi"; ++ compatible = "rockchip,rk3036-spi"; + reg = <0x20074000 0x1000>; + interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>; +- clock-names = "apb-pclk","spi_pclk"; ++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>; ++ clock-names = "spiclk", "apb_pclk"; + dmas = <&pdma 8>, <&pdma 9>; + dma-names = "tx", "rx"; + pinctrl-names = "default"; +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index acee71ca32d83e..0186b3992b95f4 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -659,7 +659,7 @@ usdhc1: mmc@30b40000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b40000 0x10000>; + interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC1_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -673,7 +673,7 @@ usdhc2: mmc@30b50000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b50000 0x10000>; + interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC2_ROOT>; + clock-names = "ipg", "ahb", "per"; +@@ -687,7 +687,7 @@ usdhc3: mmc@30b60000 { + compatible = "fsl,imx8mp-usdhc", "fsl,imx7d-usdhc"; + reg = <0x30b60000 0x10000>; + interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk IMX8MP_CLK_DUMMY>, ++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>, + <&clk IMX8MP_CLK_NAND_USDHC_BUS>, + <&clk IMX8MP_CLK_USDHC3_ROOT>; + clock-names = "ipg", "ahb", "per"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +index 213c0759c4b852..bf09b2818e20d7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +@@ -30,14 +30,14 @@ leds { + + power_led: led-0 { + label = "firefly:red:power"; +- linux,default-trigger = "ir-power-click"; ++ linux,default-trigger = "default-on"; + default-state = "on"; + gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>; + }; + + user_led: led-1 { + label = "firefly:blue:user"; +- linux,default-trigger = "ir-user-click"; ++ linux,default-trigger = "rc-feedback"; + default-state = "off"; + gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 3c6398e98f7670..9e1701f4218418 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -715,8 +715,7 @@ hdmi: hdmi@ff3c0000 { + compatible = "rockchip,rk3328-dw-hdmi"; + reg = <0x0 0xff3c0000 0x0 0x20000>; + reg-io-width = <4>; +- interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&cru PCLK_HDMI>, + <&cru SCLK_HDMI_SFC>, + <&cru SCLK_RTC32K>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +index 24d28be4736cf8..843988ecaf91de 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +@@ -56,7 +56,6 @@ i2c@0 { + fan: fan@18 { + compatible = "ti,amc6821"; + reg = <0x18>; +- #cooling-cells = <2>; + }; + + rtc_twi: rtc@6f { +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +index 5e3ac589bc54a6..6fa94cb4d5f799 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi +@@ -568,7 +568,7 @@ &uart0 { + bluetooth { + compatible = "brcm,bcm43438-bt"; + clocks = <&rk808 1>; +- clock-names = "ext_clock"; ++ clock-names = "txco"; + device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index 73e269a8ae0cc7..bcc4f31982e119 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -159,7 +159,7 @@ &i2c1 { + status = "okay"; + + rt5651: rt5651@1a { +- compatible = "rockchip,rt5651"; ++ compatible = "realtek,rt5651"; + reg = <0x1a>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; +diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c +index dcec0f760c8f80..522bda391179a3 100644 +--- a/arch/powerpc/platforms/powernv/opal-irqchip.c ++++ b/arch/powerpc/platforms/powernv/opal-irqchip.c +@@ -285,6 +285,7 @@ int __init opal_event_init(void) + name, NULL); + if (rc) { + pr_warn("Error %d requesting OPAL irq %d\n", rc, (int)r->start); ++ kfree(name); + continue; + } + } +diff --git a/drivers/crypto/marvell/cesa/hash.c b/drivers/crypto/marvell/cesa/hash.c +index add7ea011c9870..8441c3198d460c 100644 +--- a/drivers/crypto/marvell/cesa/hash.c ++++ b/drivers/crypto/marvell/cesa/hash.c +@@ -923,7 +923,7 @@ struct ahash_alg mv_md5_alg = { + .base = { + .cra_name = "md5", + .cra_driver_name = "mv-md5", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -994,7 +994,7 @@ struct ahash_alg mv_sha1_alg = { + .base = { + .cra_name = "sha1", + .cra_driver_name = "mv-sha1", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1068,7 +1068,7 @@ struct ahash_alg mv_sha256_alg = { + .base = { + .cra_name = "sha256", + .cra_driver_name = "mv-sha256", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1303,7 +1303,7 @@ struct ahash_alg mv_ahmac_md5_alg = { + .base = { + .cra_name = "hmac(md5)", + .cra_driver_name = "mv-hmac-md5", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1374,7 +1374,7 @@ struct ahash_alg mv_ahmac_sha1_alg = { + .base = { + .cra_name = "hmac(sha1)", + .cra_driver_name = "mv-hmac-sha1", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1445,7 +1445,7 @@ struct ahash_alg mv_ahmac_sha256_alg = { + .base = { + .cra_name = "hmac(sha256)", + .cra_driver_name = "mv-hmac-sha256", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 77886e79d75db1..0a9f00a3e2ebbd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -112,8 +112,8 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, + &buffer); + obj = (union acpi_object *)buffer.pointer; + +- /* Fail if calling the method fails and ATIF is supported */ +- if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { ++ /* Fail if calling the method fails */ ++ if (ACPI_FAILURE(status)) { + DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n", + acpi_format_exception(status)); + kfree(obj); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 8a1cb1de2b13ae..3cca007a0cd079 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -396,7 +396,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user + ssize_t result = 0; + int r; + +- if (size & 0x3 || *pos & 0x3) ++ if (size > 4096 || size & 0x3 || *pos & 0x3) + return -EINVAL; + + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 5281d693b32d2d..0fef4bdb90f14a 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1664,7 +1664,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) + + u32 len = hid_report_len(report) + 7; + +- return kmalloc(len, flags); ++ return kzalloc(len, flags); + } + EXPORT_SYMBOL_GPL(hid_alloc_report_buf); + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index e7b047421f3d9a..f36ddcb4e2ef2c 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1967,6 +1967,11 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + 0x347d, 0x7853) }, + ++ /* HONOR MagicBook Art 14 touchpad */ ++ { .driver_data = MT_CLS_VTL, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ 0x35cc, 0x0104) }, ++ + /* Ilitek dual touch panel */ + { .driver_data = MT_CLS_NSMU, + MT_USB_DEVICE(USB_VENDOR_ID_ILITEK, +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index c1f8c1be848561..a47ddd05761875 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -429,6 +429,13 @@ static int gic_irq_set_irqchip_state(struct irq_data *d, + } + + gic_poke_irq(d, reg); ++ ++ /* ++ * Force read-back to guarantee that the active state has taken ++ * effect, and won't race with a guest-driven deactivation. ++ */ ++ if (reg == GICD_ISACTIVER) ++ gic_peek_irq(d, reg); + return 0; + } + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index f98ad4366301b5..63eac25ec8819b 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2058,7 +2058,6 @@ struct cache_args { + sector_t cache_sectors; + + struct dm_dev *origin_dev; +- sector_t origin_sectors; + + uint32_t block_size; + +@@ -2140,6 +2139,7 @@ static int parse_cache_dev(struct cache_args *ca, struct dm_arg_set *as, + static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as, + char **error) + { ++ sector_t origin_sectors; + int r; + + if (!at_least_one_arg(as, error)) +@@ -2152,8 +2152,8 @@ static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as, + return r; + } + +- ca->origin_sectors = get_dev_size(ca->origin_dev); +- if (ca->ti->len > ca->origin_sectors) { ++ origin_sectors = get_dev_size(ca->origin_dev); ++ if (ca->ti->len > origin_sectors) { + *error = "Device size larger than cached device"; + return -EINVAL; + } +@@ -2462,7 +2462,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) + + ca->metadata_dev = ca->origin_dev = ca->cache_dev = NULL; + +- origin_blocks = cache->origin_sectors = ca->origin_sectors; ++ origin_blocks = cache->origin_sectors = ti->len; + origin_blocks = block_div(origin_blocks, ca->block_size); + cache->origin_blocks = to_oblock(origin_blocks); + +@@ -2955,19 +2955,19 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) + static bool can_resize(struct cache *cache, dm_cblock_t new_size) + { + if (from_cblock(new_size) > from_cblock(cache->cache_size)) { +- if (cache->sized) { +- DMERR("%s: unable to extend cache due to missing cache table reload", +- cache_device_name(cache)); +- return false; +- } ++ DMERR("%s: unable to extend cache due to missing cache table reload", ++ cache_device_name(cache)); ++ return false; + } + + /* + * We can't drop a dirty block when shrinking the cache. + */ +- while (from_cblock(new_size) < from_cblock(cache->cache_size)) { +- new_size = to_cblock(from_cblock(new_size) + 1); +- if (is_dirty(cache, new_size)) { ++ if (cache->loaded_mappings) { ++ new_size = to_cblock(find_next_bit(cache->dirty_bitset, ++ from_cblock(cache->cache_size), ++ from_cblock(new_size))); ++ if (new_size != cache->cache_size) { + DMERR("%s: unable to shrink cache; cache block %llu is dirty", + cache_device_name(cache), + (unsigned long long) from_cblock(new_size)); +@@ -3003,20 +3003,15 @@ static int cache_preresume(struct dm_target *ti) + /* + * Check to see if the cache has resized. + */ +- if (!cache->sized) { +- r = resize_cache_dev(cache, csize); +- if (r) +- return r; +- +- cache->sized = true; +- +- } else if (csize != cache->cache_size) { ++ if (!cache->sized || csize != cache->cache_size) { + if (!can_resize(cache, csize)) + return -EINVAL; + + r = resize_cache_dev(cache, csize); + if (r) + return r; ++ ++ cache->sized = true; + } + + if (!cache->loaded_mappings) { +diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c +index e673dacf641819..e18106e99426d7 100644 +--- a/drivers/md/dm-unstripe.c ++++ b/drivers/md/dm-unstripe.c +@@ -84,8 +84,8 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv) + } + uc->physical_start = start; + +- uc->unstripe_offset = uc->unstripe * uc->chunk_size; +- uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size; ++ uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size; ++ uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size; + uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0; + + tmp_len = ti->len; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 55144f7d930373..177cfc9f45d0c9 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3052,7 +3052,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + sector_t sect; + int must_sync; + int any_working; +- int need_recover = 0; + struct raid10_info *mirror = &conf->mirrors[i]; + struct md_rdev *mrdev, *mreplace; + +@@ -3060,14 +3059,13 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + mrdev = rcu_dereference(mirror->rdev); + mreplace = rcu_dereference(mirror->replacement); + +- if (mrdev != NULL && +- !test_bit(Faulty, &mrdev->flags) && +- !test_bit(In_sync, &mrdev->flags)) +- need_recover = 1; ++ if (mrdev && (test_bit(Faulty, &mrdev->flags) || ++ test_bit(In_sync, &mrdev->flags))) ++ mrdev = NULL; + if (mreplace && test_bit(Faulty, &mreplace->flags)) + mreplace = NULL; + +- if (!need_recover && !mreplace) { ++ if (!mrdev && !mreplace) { + rcu_read_unlock(); + continue; + } +@@ -3101,7 +3099,8 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + rcu_read_unlock(); + continue; + } +- atomic_inc(&mrdev->nr_pending); ++ if (mrdev) ++ atomic_inc(&mrdev->nr_pending); + if (mreplace) + atomic_inc(&mreplace->nr_pending); + rcu_read_unlock(); +@@ -3188,7 +3187,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + r10_bio->devs[1].devnum = i; + r10_bio->devs[1].addr = to_addr; + +- if (need_recover) { ++ if (mrdev) { + bio = r10_bio->devs[1].bio; + bio->bi_next = biolist; + biolist = bio; +@@ -3233,7 +3232,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + for (k = 0; k < conf->copies; k++) + if (r10_bio->devs[k].devnum == i) + break; +- if (!test_bit(In_sync, ++ if (mrdev && !test_bit(In_sync, + &mrdev->flags) + && !rdev_set_badblocks( + mrdev, +@@ -3259,12 +3258,14 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + if (rb2) + atomic_dec(&rb2->remaining); + r10_bio = rb2; +- rdev_dec_pending(mrdev, mddev); ++ if (mrdev) ++ rdev_dec_pending(mrdev, mddev); + if (mreplace) + rdev_dec_pending(mreplace, mddev); + break; + } +- rdev_dec_pending(mrdev, mddev); ++ if (mrdev) ++ rdev_dec_pending(mrdev, mddev); + if (mreplace) + rdev_dec_pending(mreplace, mddev); + if (r10_bio->devs[0].bio->bi_opf & MD_FAILFAST) { +diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/usb/pulse8/pulse8-cec.c +index ba67587bd43ec0..171366fe35443b 100644 +--- a/drivers/media/cec/usb/pulse8/pulse8-cec.c ++++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c +@@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio, + err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4); + if (err) + return err; +- date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; ++ date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; + dev_info(pulse8->dev, "Firmware build date %ptT\n", &date); + + dev_dbg(pulse8->dev, "Persistent config:\n"); +diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +index 68968bfa2edc18..533c8bb8fd886d 100644 +--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c ++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +@@ -1789,6 +1789,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg) + unsigned p; + unsigned x; + ++ if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width)) ++ return; ++ + switch (tpg->pattern) { + case TPG_PAT_GREEN: + contrast = TPG_COLOR_100_RED; +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index ad3e42a4eaf73a..01efb4bd260d90 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -442,8 +442,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra + + default: + fepriv->auto_step++; +- fepriv->auto_sub_step = -1; /* it'll be incremented to 0 in a moment */ +- break; ++ fepriv->auto_sub_step = 0; ++ continue; + } + + if (!ready) fepriv->auto_sub_step++; +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 661588fc64f6a8..71344ae26fea73 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -96,10 +96,15 @@ static DECLARE_RWSEM(minor_rwsem); + static int dvb_device_open(struct inode *inode, struct file *file) + { + struct dvb_device *dvbdev; ++ unsigned int minor = iminor(inode); ++ ++ if (minor >= MAX_DVB_MINORS) ++ return -ENODEV; + + mutex_lock(&dvbdev_mutex); + down_read(&minor_rwsem); +- dvbdev = dvb_minors[iminor(inode)]; ++ ++ dvbdev = dvb_minors[minor]; + + if (dvbdev && dvbdev->fops) { + int err = 0; +@@ -539,7 +544,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + for (minor = 0; minor < MAX_DVB_MINORS; minor++) + if (dvb_minors[minor] == NULL) + break; +- if (minor == MAX_DVB_MINORS) { ++ if (minor >= MAX_DVB_MINORS) { + if (new_node) { + list_del (&new_node->list_head); + kfree(dvbdevfops); +@@ -554,6 +559,14 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + } + #else + minor = nums2minor(adap->num, type, id); ++ if (minor >= MAX_DVB_MINORS) { ++ dvb_media_device_free(dvbdev); ++ list_del(&dvbdev->list_head); ++ kfree(dvbdev); ++ *pdvbdev = NULL; ++ mutex_unlock(&dvbdev_register_lock); ++ return ret; ++ } + #endif + dvbdev->minor = minor; + dvb_minors[minor] = dvb_device_get(dvbdev); +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index 8b978a9f74a4e5..f5dd3a81725a72 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -741,6 +741,7 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr) + { + struct cx24116_state *state = fe->demodulator_priv; + u8 snr_reading; ++ int ret; + static const u32 snr_tab[] = { /* 10 x Table (rounded up) */ + 0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667, + 0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667, +@@ -749,7 +750,11 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr) + + dprintk("%s()\n", __func__); + +- snr_reading = cx24116_readreg(state, CX24116_REG_QUALITY0); ++ ret = cx24116_readreg(state, CX24116_REG_QUALITY0); ++ if (ret < 0) ++ return ret; ++ ++ snr_reading = ret; + + if (snr_reading >= 0xa0 /* 100% */) + *snr = 0xffff; +diff --git a/drivers/media/dvb-frontends/stb0899_algo.c b/drivers/media/dvb-frontends/stb0899_algo.c +index df89c33dac23c5..40537c4ccb0d75 100644 +--- a/drivers/media/dvb-frontends/stb0899_algo.c ++++ b/drivers/media/dvb-frontends/stb0899_algo.c +@@ -269,7 +269,7 @@ static enum stb0899_status stb0899_search_carrier(struct stb0899_state *state) + + short int derot_freq = 0, last_derot_freq = 0, derot_limit, next_loop = 3; + int index = 0; +- u8 cfr[2]; ++ u8 cfr[2] = {0}; + u8 reg; + + internal->status = NOCARRIER; +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 8cf1704308bf5a..32c223b3334869 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2487,10 +2487,10 @@ static int adv76xx_log_status(struct v4l2_subdev *sd) + const struct adv76xx_chip_info *info = state->info; + struct v4l2_dv_timings timings; + struct stdi_readback stdi; +- u8 reg_io_0x02 = io_read(sd, 0x02); ++ int ret; ++ u8 reg_io_0x02; + u8 edid_enabled; + u8 cable_det; +- + static const char * const csc_coeff_sel_rb[16] = { + "bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB", + "reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709", +@@ -2589,13 +2589,21 @@ static int adv76xx_log_status(struct v4l2_subdev *sd) + v4l2_info(sd, "-----Color space-----\n"); + v4l2_info(sd, "RGB quantization range ctrl: %s\n", + rgb_quantization_range_txt[state->rgb_quantization_range]); +- v4l2_info(sd, "Input color space: %s\n", +- input_color_space_txt[reg_io_0x02 >> 4]); +- v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", +- (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", +- (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? +- "(16-235)" : "(0-255)", +- (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); ++ ++ ret = io_read(sd, 0x02); ++ if (ret < 0) { ++ v4l2_info(sd, "Can't read Input/Output color space\n"); ++ } else { ++ reg_io_0x02 = ret; ++ ++ v4l2_info(sd, "Input color space: %s\n", ++ input_color_space_txt[reg_io_0x02 >> 4]); ++ v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", ++ (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", ++ (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? ++ "(16-235)" : "(0-255)", ++ (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); ++ } + v4l2_info(sd, "Color space conversion: %s\n", + csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]); + +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c +index d515eb08c3ee47..55d0ba45a970ce 100644 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c +@@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; + jpeg_buffer.curr = 0; + +- word = 0; +- + if (get_word_be(&jpeg_buffer, &word)) + return; +- jpeg_buffer.size = (long)word - 2; ++ ++ if (word < 2) ++ jpeg_buffer.size = 0; ++ else ++ jpeg_buffer.size = (long)word - 2; ++ + jpeg_buffer.data += 2; + jpeg_buffer.curr = 0; + +@@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) + if (byte == -1) + return -1; + *word = (unsigned int)byte | temp; ++ + return 0; + } + +@@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + sof = jpeg_buffer.curr; /* after 0xffc0 */ + sof_len = length; +@@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + if (n_dqt >= S5P_JPEG_MAX_MARKER) + return false; +@@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; +- if (!length) ++ if (length <= 0) + return false; + if (n_dht >= S5P_JPEG_MAX_MARKER) + return false; +@@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, + if (get_word_be(&jpeg_buffer, &word)) + break; + length = (long)word - 2; ++ /* No need to check underflows as skip() does it */ + skip(&jpeg_buffer, length); + break; + } +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index cfbc7595cd0b87..519fd648f26cbe 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -661,7 +661,7 @@ static int uvc_parse_format(struct uvc_device *dev, + /* Parse the frame descriptors. Only uncompressed, MJPEG and frame + * based formats have frame descriptors. + */ +- while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && ++ while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && + buffer[2] == ftype) { + frame = &format->frame[format->nframes]; + if (ftype != UVC_VS_FRAME_FRAME_BASED) +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 6c75e5897620d8..6cdb28f1f2e233 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -992,7 +992,6 @@ static int c_can_handle_bus_err(struct net_device *dev, + + /* common for all type of bus errors */ + priv->can.can_stats.bus_error++; +- stats->rx_errors++; + + /* propagate the error condition to the CAN stack */ + skb = alloc_can_err_skb(dev, &cf); +@@ -1009,26 +1008,32 @@ static int c_can_handle_bus_err(struct net_device *dev, + case LEC_STUFF_ERROR: + netdev_dbg(dev, "stuff error\n"); + cf->data[2] |= CAN_ERR_PROT_STUFF; ++ stats->rx_errors++; + break; + case LEC_FORM_ERROR: + netdev_dbg(dev, "form error\n"); + cf->data[2] |= CAN_ERR_PROT_FORM; ++ stats->rx_errors++; + break; + case LEC_ACK_ERROR: + netdev_dbg(dev, "ack error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_ACK; ++ stats->tx_errors++; + break; + case LEC_BIT1_ERROR: + netdev_dbg(dev, "bit1 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT1; ++ stats->tx_errors++; + break; + case LEC_BIT0_ERROR: + netdev_dbg(dev, "bit0 error\n"); + cf->data[2] |= CAN_ERR_PROT_BIT0; ++ stats->tx_errors++; + break; + case LEC_CRC_ERROR: + netdev_dbg(dev, "CRC error\n"); + cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ; ++ stats->rx_errors++; + break; + default: + break; +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index b56a9e2aecd932..61d076e09571c6 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -111,6 +111,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -140,7 +141,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + stats->tx_bytes += skb->len; + } + +- dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), DMA_TO_DEVICE); + + /* return the sk_buff to system */ +@@ -174,6 +175,7 @@ static void arc_emac_tx_clean(struct net_device *ndev) + static int arc_emac_rx(struct net_device *ndev, int budget) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int work_done; + + for (work_done = 0; work_done < budget; work_done++) { +@@ -223,9 +225,9 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, ++ addr = dma_map_single(dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + if (net_ratelimit()) + netdev_err(ndev, "cannot map dma buffer\n"); + dev_kfree_skb(skb); +@@ -237,7 +239,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + } + + /* unmap previosly mapped skb */ +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); + + pktlen = info & LEN_MASK; +@@ -423,6 +425,7 @@ static int arc_emac_open(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); + struct phy_device *phy_dev = ndev->phydev; ++ struct device *dev = ndev->dev.parent; + int i; + + phy_dev->autoneg = AUTONEG_ENABLE; +@@ -445,9 +448,9 @@ static int arc_emac_open(struct net_device *ndev) + if (unlikely(!rx_buff->skb)) + return -ENOMEM; + +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(dev, (void *)rx_buff->skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, addr)) { ++ if (dma_mapping_error(dev, addr)) { + netdev_err(ndev, "cannot dma map\n"); + dev_kfree_skb(rx_buff->skb); + return -ENOMEM; +@@ -548,6 +551,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev) + static void arc_free_tx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < TX_BD_NUM; i++) { +@@ -555,7 +559,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + struct buffer_state *tx_buff = &priv->tx_buff[i]; + + if (tx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(tx_buff, addr), + dma_unmap_len(tx_buff, len), + DMA_TO_DEVICE); +@@ -579,6 +583,7 @@ static void arc_free_tx_queue(struct net_device *ndev) + static void arc_free_rx_queue(struct net_device *ndev) + { + struct arc_emac_priv *priv = netdev_priv(ndev); ++ struct device *dev = ndev->dev.parent; + unsigned int i; + + for (i = 0; i < RX_BD_NUM; i++) { +@@ -586,7 +591,7 @@ static void arc_free_rx_queue(struct net_device *ndev) + struct buffer_state *rx_buff = &priv->rx_buff[i]; + + if (rx_buff->skb) { +- dma_unmap_single(&ndev->dev, ++ dma_unmap_single(dev, + dma_unmap_addr(rx_buff, addr), + dma_unmap_len(rx_buff, len), + DMA_FROM_DEVICE); +@@ -679,6 +684,7 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + unsigned int len, *txbd_curr = &priv->txbd_curr; + struct net_device_stats *stats = &ndev->stats; + __le32 *info = &priv->txbd[*txbd_curr].info; ++ struct device *dev = ndev->dev.parent; + dma_addr_t addr; + + if (skb_padto(skb, ETH_ZLEN)) +@@ -692,10 +698,9 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) + return NETDEV_TX_BUSY; + } + +- addr = dma_map_single(&ndev->dev, (void *)skb->data, len, +- DMA_TO_DEVICE); ++ addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(&ndev->dev, addr))) { ++ if (unlikely(dma_mapping_error(dev, addr))) { + stats->tx_dropped++; + stats->tx_errors++; + dev_kfree_skb_any(skb); +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index 5ce3e2593bddee..1b0d0ef20562bc 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -78,11 +78,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct sockaddr *saddr = addr; ++ int err; + + if (!is_valid_ether_addr(saddr->sa_data)) + return -EADDRNOTAVAIL; + +- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr); ++ if (err) ++ return err; ++ ++ eth_hw_addr_set(ndev, saddr->sa_data); ++ ++ return 0; + } + + static int enetc_vf_set_features(struct net_device *ndev, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 67b0bf310daaaf..9a63fbc6940831 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo) + pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev); + if (!pci_id) + continue; +- if (IS_ENABLED(CONFIG_PCI_IOV)) ++ if (IS_ENABLED(CONFIG_PCI_IOV)) { ++ device_lock(&ae_dev->pdev->dev); + pci_disable_sriov(ae_dev->pdev); ++ device_unlock(&ae_dev->pdev->dev); ++ } + } + } + EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index f2caccaf4408fc..89577f1d357669 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -50,6 +50,14 @@ + #define MII_DP83640_MISR_LINK_INT_EN 0x20 + #define MII_DP83640_MISR_ED_INT_EN 0x40 + #define MII_DP83640_MISR_LQ_INT_EN 0x80 ++#define MII_DP83640_MISR_ANC_INT 0x400 ++#define MII_DP83640_MISR_DUP_INT 0x800 ++#define MII_DP83640_MISR_SPD_INT 0x1000 ++#define MII_DP83640_MISR_LINK_INT 0x2000 ++#define MII_DP83640_MISR_INT_MASK (MII_DP83640_MISR_ANC_INT |\ ++ MII_DP83640_MISR_DUP_INT |\ ++ MII_DP83640_MISR_SPD_INT |\ ++ MII_DP83640_MISR_LINK_INT) + + /* phyter seems to miss the mark by 16 ns */ + #define ADJTIME_FIX 16 +@@ -1193,6 +1201,24 @@ static int dp83640_config_intr(struct phy_device *phydev) + } + } + ++static irqreturn_t dp83640_handle_interrupt(struct phy_device *phydev) ++{ ++ int irq_status; ++ ++ irq_status = phy_read(phydev, MII_DP83640_MISR); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ if (!(irq_status & MII_DP83640_MISR_INT_MASK)) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) + { + struct dp83640_private *dp83640 = +@@ -1517,6 +1543,7 @@ static struct phy_driver dp83640_driver = { + .config_init = dp83640_config_init, + .ack_interrupt = dp83640_ack_interrupt, + .config_intr = dp83640_config_intr, ++ .handle_interrupt = dp83640_handle_interrupt, + }; + + static int __init dp83640_init(void) +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index c3828beccbad87..10ce84943ea94e 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -303,6 +303,42 @@ static int dp83822_config_intr(struct phy_device *phydev) + return phy_write(phydev, MII_DP83822_PHYSCR, physcr_status); + } + ++static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev) ++{ ++ bool trigger_machine = false; ++ int irq_status; ++ ++ /* The MISR1 and MISR2 registers are holding the interrupt status in ++ * the upper half (15:8), while the lower half (7:0) is used for ++ * controlling the interrupt enable state of those individual interrupt ++ * sources. To determine the possible interrupt sources, just read the ++ * MISR* register and use it directly to know which interrupts have ++ * been enabled previously or not. ++ */ ++ irq_status = phy_read(phydev, MII_DP83822_MISR1); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) ++ trigger_machine = true; ++ ++ irq_status = phy_read(phydev, MII_DP83822_MISR2); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) ++ trigger_machine = true; ++ ++ if (!trigger_machine) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp8382x_disable_wol(struct phy_device *phydev) + { + return phy_clear_bits_mmd(phydev, DP83822_DEVADDR, MII_DP83822_WOL_CFG, +@@ -586,6 +622,7 @@ static int dp83822_resume(struct phy_device *phydev) + .set_wol = dp83822_set_wol, \ + .ack_interrupt = dp83822_ack_interrupt, \ + .config_intr = dp83822_config_intr, \ ++ .handle_interrupt = dp83822_handle_interrupt, \ + .suspend = dp83822_suspend, \ + .resume = dp83822_resume, \ + } +@@ -601,6 +638,7 @@ static int dp83822_resume(struct phy_device *phydev) + .set_wol = dp83822_set_wol, \ + .ack_interrupt = dp83822_ack_interrupt, \ + .config_intr = dp83822_config_intr, \ ++ .handle_interrupt = dp83822_handle_interrupt, \ + .suspend = dp83822_suspend, \ + .resume = dp83822_resume, \ + } +diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c +index 54c7c1b44e4d0f..406538ba50445d 100644 +--- a/drivers/net/phy/dp83848.c ++++ b/drivers/net/phy/dp83848.c +@@ -37,6 +37,20 @@ + DP83848_MISR_SPD_INT_EN | \ + DP83848_MISR_LINK_INT_EN) + ++#define DP83848_MISR_RHF_INT BIT(8) ++#define DP83848_MISR_FHF_INT BIT(9) ++#define DP83848_MISR_ANC_INT BIT(10) ++#define DP83848_MISR_DUP_INT BIT(11) ++#define DP83848_MISR_SPD_INT BIT(12) ++#define DP83848_MISR_LINK_INT BIT(13) ++#define DP83848_MISR_ED_INT BIT(14) ++ ++#define DP83848_INT_MASK \ ++ (DP83848_MISR_ANC_INT | \ ++ DP83848_MISR_DUP_INT | \ ++ DP83848_MISR_SPD_INT | \ ++ DP83848_MISR_LINK_INT) ++ + static int dp83848_ack_interrupt(struct phy_device *phydev) + { + int err = phy_read(phydev, DP83848_MISR); +@@ -66,6 +80,24 @@ static int dp83848_config_intr(struct phy_device *phydev) + return phy_write(phydev, DP83848_MICR, control); + } + ++static irqreturn_t dp83848_handle_interrupt(struct phy_device *phydev) ++{ ++ int irq_status; ++ ++ irq_status = phy_read(phydev, DP83848_MISR); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ if (!(irq_status & DP83848_INT_MASK)) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp83848_config_init(struct phy_device *phydev) + { + int val; +@@ -104,6 +136,9 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl); + /* IRQ related */ \ + .ack_interrupt = dp83848_ack_interrupt, \ + .config_intr = dp83848_config_intr, \ ++ .handle_interrupt = dp83848_handle_interrupt, \ ++ \ ++ .flags = PHY_RST_AFTER_CLK_EN, \ + } + + static struct phy_driver dp83848_driver[] = { +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index 834bf63dc2009c..0cb24bfbfa237a 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -312,6 +312,30 @@ static int dp83867_config_intr(struct phy_device *phydev) + return phy_write(phydev, MII_DP83867_MICR, micr_status); + } + ++static irqreturn_t dp83867_handle_interrupt(struct phy_device *phydev) ++{ ++ int irq_status, irq_enabled; ++ ++ irq_status = phy_read(phydev, MII_DP83867_ISR); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ irq_enabled = phy_read(phydev, MII_DP83867_MICR); ++ if (irq_enabled < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ if (!(irq_status & irq_enabled)) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp83867_read_status(struct phy_device *phydev) + { + int status = phy_read(phydev, MII_DP83867_PHYSTS); +@@ -878,6 +902,7 @@ static struct phy_driver dp83867_driver[] = { + /* IRQ related */ + .ack_interrupt = dp83867_ack_interrupt, + .config_intr = dp83867_config_intr, ++ .handle_interrupt = dp83867_handle_interrupt, + + .suspend = genphy_suspend, + .resume = genphy_resume, +diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c +index 01b593e0bb4a16..e2fe89c8059eaf 100644 +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -207,6 +207,30 @@ static int dp83869_config_intr(struct phy_device *phydev) + return phy_write(phydev, MII_DP83869_MICR, micr_status); + } + ++static irqreturn_t dp83869_handle_interrupt(struct phy_device *phydev) ++{ ++ int irq_status, irq_enabled; ++ ++ irq_status = phy_read(phydev, MII_DP83869_ISR); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ irq_enabled = phy_read(phydev, MII_DP83869_MICR); ++ if (irq_enabled < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ ++ if (!(irq_status & irq_enabled)) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp83869_set_wol(struct phy_device *phydev, + struct ethtool_wolinfo *wol) + { +@@ -853,6 +877,7 @@ static struct phy_driver dp83869_driver[] = { + /* IRQ related */ + .ack_interrupt = dp83869_ack_interrupt, + .config_intr = dp83869_config_intr, ++ .handle_interrupt = dp83869_handle_interrupt, + .read_status = dp83869_read_status, + + .get_tunable = dp83869_get_tunable, +diff --git a/drivers/net/phy/dp83tc811.c b/drivers/net/phy/dp83tc811.c +index d73725312c7c35..af8e76302cc231 100644 +--- a/drivers/net/phy/dp83tc811.c ++++ b/drivers/net/phy/dp83tc811.c +@@ -254,6 +254,50 @@ static int dp83811_config_intr(struct phy_device *phydev) + return err; + } + ++static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev) ++{ ++ bool trigger_machine = false; ++ int irq_status; ++ ++ /* The INT_STAT registers 1, 2 and 3 are holding the interrupt status ++ * in the upper half (15:8), while the lower half (7:0) is used for ++ * controlling the interrupt enable state of those individual interrupt ++ * sources. To determine the possible interrupt sources, just read the ++ * INT_STAT* register and use it directly to know which interrupts have ++ * been enabled previously or not. ++ */ ++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT1); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) ++ trigger_machine = true; ++ ++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT2); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) ++ trigger_machine = true; ++ ++ irq_status = phy_read(phydev, MII_DP83811_INT_STAT3); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ if (irq_status & ((irq_status & GENMASK(7, 0)) << 8)) ++ trigger_machine = true; ++ ++ if (!trigger_machine) ++ return IRQ_NONE; ++ ++ phy_trigger_machine(phydev); ++ ++ return IRQ_HANDLED; ++} ++ + static int dp83811_config_aneg(struct phy_device *phydev) + { + int value, err; +@@ -345,6 +389,7 @@ static struct phy_driver dp83811_driver[] = { + .set_wol = dp83811_set_wol, + .ack_interrupt = dp83811_ack_interrupt, + .config_intr = dp83811_config_intr, ++ .handle_interrupt = dp83811_handle_interrupt, + .suspend = dp83811_suspend, + .resume = dp83811_resume, + }, +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index f3e606b6617e94..eb0f2e11cc216e 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -461,10 +461,11 @@ EXPORT_SYMBOL(phy_queue_state_machine); + * + * @phydev: the phy_device struct + */ +-static void phy_trigger_machine(struct phy_device *phydev) ++void phy_trigger_machine(struct phy_device *phydev) + { + phy_queue_state_machine(phydev, 0); + } ++EXPORT_SYMBOL(phy_trigger_machine); + + static void phy_abort_cable_test(struct phy_device *phydev) + { +@@ -970,7 +971,7 @@ void phy_stop_machine(struct phy_device *phydev) + * Must not be called from interrupt context, or while the + * phydev->lock is held. + */ +-static void phy_error(struct phy_device *phydev) ++void phy_error(struct phy_device *phydev) + { + WARN_ON(1); + +@@ -980,6 +981,7 @@ static void phy_error(struct phy_device *phydev) + + phy_trigger_machine(phydev); + } ++EXPORT_SYMBOL(phy_error); + + /** + * phy_disable_interrupts - Disable the PHY interrupts from the PHY side +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 0a1ab8c30a0031..3b1076eea6702b 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1360,6 +1360,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ ++ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0112, 0)}, /* Fibocom FG132 */ + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ + {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index 871527b78aa462..6e8db0acf71db0 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -106,7 +106,9 @@ static int pwm_imx_tpm_round_state(struct pwm_chip *chip, + p->prescale = prescale; + + period_count = (clock_unit + ((1 << prescale) >> 1)) >> prescale; +- p->mod = period_count; ++ if (period_count == 0) ++ return -EINVAL; ++ p->mod = period_count - 1; + + /* calculate real period HW can support */ + tmp = (u64)period_count << prescale; +diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c +index 01088f333dbc4e..9b5dca0b6cf9a2 100644 +--- a/drivers/scsi/sd_zbc.c ++++ b/drivers/scsi/sd_zbc.c +@@ -169,8 +169,7 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp, + bufsize = min_t(size_t, bufsize, queue_max_segments(q) << PAGE_SHIFT); + + while (bufsize >= SECTOR_SIZE) { +- buf = __vmalloc(bufsize, +- GFP_KERNEL | __GFP_ZERO | __GFP_NORETRY); ++ buf = kvzalloc(bufsize, GFP_KERNEL | __GFP_NORETRY); + if (buf) { + *buflen = bufsize; + return buf; +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index e84494eed1c11c..e3980668c286bd 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -472,12 +472,6 @@ static LIST_HEAD(spi_controller_list); + */ + static DEFINE_MUTEX(board_lock); + +-/* +- * Prevents addition of devices with same chip select and +- * addition of devices below an unregistering controller. +- */ +-static DEFINE_MUTEX(spi_add_lock); +- + /** + * spi_alloc_device - Allocate a new SPI device + * @ctlr: Controller to which device is connected +@@ -581,7 +575,7 @@ int spi_add_device(struct spi_device *spi) + * chipselect **BEFORE** we call setup(), else we'll trash + * its configuration. Lock against concurrent add() calls. + */ +- mutex_lock(&spi_add_lock); ++ mutex_lock(&ctlr->add_lock); + + status = bus_for_each_dev(&spi_bus_type, NULL, spi, spi_dev_check); + if (status) { +@@ -625,7 +619,7 @@ int spi_add_device(struct spi_device *spi) + } + + done: +- mutex_unlock(&spi_add_lock); ++ mutex_unlock(&ctlr->add_lock); + return status; + } + EXPORT_SYMBOL_GPL(spi_add_device); +@@ -2734,6 +2728,7 @@ int spi_register_controller(struct spi_controller *ctlr) + spin_lock_init(&ctlr->bus_lock_spinlock); + mutex_init(&ctlr->bus_lock_mutex); + mutex_init(&ctlr->io_mutex); ++ mutex_init(&ctlr->add_lock); + ctlr->bus_lock_flag = 0; + init_completion(&ctlr->xfer_completion); + if (!ctlr->max_dma_len) +@@ -2879,7 +2874,7 @@ void spi_unregister_controller(struct spi_controller *ctlr) + + /* Prevent addition of new devices, unregister existing ones */ + if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) +- mutex_lock(&spi_add_lock); ++ mutex_lock(&ctlr->add_lock); + + device_for_each_child(&ctlr->dev, NULL, __unregister); + +@@ -2897,12 +2892,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) + + device_del(&ctlr->dev); + +- /* Release the last reference on the controller if its driver +- * has not yet been converted to devm_spi_alloc_master/slave(). +- */ +- if (!ctlr->devm_allocated) +- put_device(&ctlr->dev); +- + /* free bus id */ + mutex_lock(&board_lock); + if (found == ctlr) +@@ -2910,7 +2899,13 @@ void spi_unregister_controller(struct spi_controller *ctlr) + mutex_unlock(&board_lock); + + if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) +- mutex_unlock(&spi_add_lock); ++ mutex_unlock(&ctlr->add_lock); ++ ++ /* Release the last reference on the controller if its driver ++ * has not yet been converted to devm_spi_alloc_master/slave(). ++ */ ++ if (!ctlr->devm_allocated) ++ put_device(&ctlr->dev); + } + EXPORT_SYMBOL_GPL(spi_unregister_controller); + +diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c +index f3f76f2ac63f9b..5bdbf58f3b35a6 100644 +--- a/drivers/usb/musb/sunxi.c ++++ b/drivers/usb/musb/sunxi.c +@@ -286,8 +286,6 @@ static int sunxi_musb_exit(struct musb *musb) + if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) + sunxi_sram_release(musb->controller->parent); + +- devm_usb_put_phy(glue->dev, glue->xceiv); +- + return 0; + } + +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 4b48ef4adbeb6f..618e2b16e20435 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -846,11 +846,12 @@ static void edge_bulk_out_data_callback(struct urb *urb) + static void edge_bulk_out_cmd_callback(struct urb *urb) + { + struct edgeport_port *edge_port = urb->context; ++ struct device *dev = &urb->dev->dev; + int status = urb->status; + + atomic_dec(&CmdUrbs); +- dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n", +- __func__, urb, atomic_read(&CmdUrbs)); ++ dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb, ++ atomic_read(&CmdUrbs)); + + + /* clean up the transfer buffer */ +@@ -860,8 +861,7 @@ static void edge_bulk_out_cmd_callback(struct urb *urb) + usb_free_urb(urb); + + if (status) { +- dev_dbg(&urb->dev->dev, +- "%s - nonzero write bulk status received: %d\n", ++ dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); + return; + } +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index a71e072722da98..7ae20070608f36 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_VENDOR_ID 0x2c7c + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 ++#define QUECTEL_PRODUCT_RG650V 0x0122 + #define QUECTEL_PRODUCT_EM061K_LTA 0x0123 + #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 +@@ -1273,6 +1274,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG916Q, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, +@@ -2320,6 +2323,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x30) }, /* Fibocom FG132 Diag */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x40) }, /* Fibocom FG132 AT */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0, 0) }, /* Fibocom FG132 NMEA */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 703a9c56355731..061ff754b307bc 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0x90e4)}, /* Sierra Wireless EM86xx QDL*/ ++ {DEVICE_SWI(0x1199, 0x90e5)}, /* Sierra Wireless EM86xx */ + {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ + {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ +diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c +index 6db7c8ddd51cd0..fb6211efb5d871 100644 +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -436,6 +436,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc, + + port = uc->orig; + new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd); ++ if (new_cam >= ARRAY_SIZE(uc->updated)) ++ return; + new_port = &uc->updated[new_cam]; + cam = new_port->linked_idx; + enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd); +diff --git a/drivers/vdpa/ifcvf/ifcvf_base.c b/drivers/vdpa/ifcvf/ifcvf_base.c +index f2a128e56de5f3..b5724b88d42bb9 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_base.c ++++ b/drivers/vdpa/ifcvf/ifcvf_base.c +@@ -105,7 +105,7 @@ int ifcvf_init_hw(struct ifcvf_hw *hw, struct pci_dev *pdev) + u32 i; + + ret = pci_read_config_byte(pdev, PCI_CAPABILITY_LIST, &pos); +- if (ret < 0) { ++ if (ret) { + IFCVF_ERR(pdev, "Failed to read PCI capability list\n"); + return -EIO; + } +diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c +index 30883b9a26d84c..e2309bc9e45d23 100644 +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -620,7 +620,7 @@ static int insert_delayed_ref(struct btrfs_trans_handle *trans, + &href->ref_add_list); + else if (ref->action == BTRFS_DROP_DELAYED_REF) { + ASSERT(!list_empty(&exist->add_list)); +- list_del(&exist->add_list); ++ list_del_init(&exist->add_list); + } else { + ASSERT(0); + } +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 0d06ec25e21e0a..d82eb1b2164f3d 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1532,6 +1532,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) + fattr->gencount = nfs_inc_attr_generation_counter(); + fattr->owner_name = NULL; + fattr->group_name = NULL; ++ fattr->mdsthreshold = NULL; + } + EXPORT_SYMBOL_GPL(nfs_fattr_init); + +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 09a62539ab74da..224ced997d64bb 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) + trace_ocfs2_setattr(inode, dentry, + (unsigned long long)OCFS2_I(inode)->ip_blkno, + dentry->d_name.len, dentry->d_name.name, +- attr->ia_valid, attr->ia_mode, +- from_kuid(&init_user_ns, attr->ia_uid), +- from_kgid(&init_user_ns, attr->ia_gid)); ++ attr->ia_valid, ++ attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, ++ attr->ia_valid & ATTR_UID ? ++ from_kuid(&init_user_ns, attr->ia_uid) : 0, ++ attr->ia_valid & ATTR_GID ? ++ from_kgid(&init_user_ns, attr->ia_gid) : 0); + + /* ensuring we don't even attempt to truncate a symlink */ + if (S_ISLNK(inode->i_mode)) +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 00ede36aeec951..051d91e230c454 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -2042,8 +2042,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, + rc = 0; + ocfs2_xa_cleanup_value_truncate(loc, "removing", + orig_clusters); +- if (rc) +- goto out; ++ goto out; + } + } + +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index 0833676da5f40b..17b320bbf5c4f4 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -446,10 +446,6 @@ static vm_fault_t mmap_vmcore_fault(struct vm_fault *vmf) + #endif + } + +-static const struct vm_operations_struct vmcore_mmap_ops = { +- .fault = mmap_vmcore_fault, +-}; +- + /** + * vmcore_alloc_buf - allocate buffer in vmalloc memory + * @sizez: size of buffer +@@ -477,6 +473,11 @@ static inline char *vmcore_alloc_buf(size_t size) + * virtually contiguous user-space in ELF layout. + */ + #ifdef CONFIG_MMU ++ ++static const struct vm_operations_struct vmcore_mmap_ops = { ++ .fault = mmap_vmcore_fault, ++}; ++ + /* + * remap_oldmem_pfn_checked - do remap_oldmem_pfn_range replacing all pages + * reported as not being ram with the zero page. +diff --git a/fs/splice.c b/fs/splice.c +index 866d5c2367b233..474fb8b5562ac6 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -662,12 +662,14 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out, + + /* build the vector */ + left = sd.total_len; +- for (n = 0; !pipe_empty(head, tail) && left && n < nbufs; tail++, n++) { ++ for (n = 0; !pipe_empty(head, tail) && left && n < nbufs; tail++) { + struct pipe_buffer *buf = &pipe->bufs[tail & mask]; + size_t this_len = buf->len; + +- if (this_len > left) +- this_len = left; ++ /* zero-length bvecs are not supported, skip them */ ++ if (!this_len) ++ continue; ++ this_len = min(this_len, left); + + ret = pipe_buf_confirm(pipe, buf); + if (unlikely(ret)) { +@@ -680,6 +682,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out, + array[n].bv_len = this_len; + array[n].bv_offset = buf->offset; + left -= this_len; ++ n++; + } + + iov_iter_bvec(&from, WRITE, array, n, sd.total_len - left); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index a7d839b1960698..4e475ded5cf58e 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1797,6 +1797,41 @@ static inline bool sb_start_intwrite_trylock(struct super_block *sb) + return __sb_start_write_trylock(sb, SB_FREEZE_FS); + } + ++/** ++ * kiocb_start_write - get write access to a superblock for async file io ++ * @iocb: the io context we want to submit the write with ++ * ++ * This is a variant of sb_start_write() for async io submission. ++ * Should be matched with a call to kiocb_end_write(). ++ */ ++static inline void kiocb_start_write(struct kiocb *iocb) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ ++ sb_start_write(inode->i_sb); ++ /* ++ * Fool lockdep by telling it the lock got released so that it ++ * doesn't complain about the held lock when we return to userspace. ++ */ ++ __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); ++} ++ ++/** ++ * kiocb_end_write - drop write access to a superblock after async file io ++ * @iocb: the io context we sumbitted the write with ++ * ++ * Should be matched with a call to kiocb_start_write(). ++ */ ++static inline void kiocb_end_write(struct kiocb *iocb) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ ++ /* ++ * Tell lockdep we inherited freeze protection from submission thread. ++ */ ++ __sb_writers_acquired(inode->i_sb, SB_FREEZE_WRITE); ++ sb_end_write(inode->i_sb); ++} + + extern bool inode_owner_or_capable(const struct inode *inode); + +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 08725a262f320e..203d53ea19d1b3 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -1542,8 +1542,10 @@ void phy_drivers_unregister(struct phy_driver *drv, int n); + int phy_driver_register(struct phy_driver *new_driver, struct module *owner); + int phy_drivers_register(struct phy_driver *new_driver, int n, + struct module *owner); ++void phy_error(struct phy_device *phydev); + void phy_state_machine(struct work_struct *work); + void phy_queue_state_machine(struct phy_device *phydev, unsigned long jiffies); ++void phy_trigger_machine(struct phy_device *phydev); + void phy_mac_interrupt(struct phy_device *phydev); + void phy_start_machine(struct phy_device *phydev); + void phy_stop_machine(struct phy_device *phydev); +diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h +index ab7747549d23f0..85fe78e14e18e6 100644 +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -528,6 +528,9 @@ struct spi_controller { + /* I/O mutex */ + struct mutex io_mutex; + ++ /* Used to avoid adding the same CS twice */ ++ struct mutex add_lock; ++ + /* lock and mutex for SPI bus locking */ + spinlock_t bus_lock_spinlock; + struct mutex bus_lock_mutex; +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index da07fba75827c9..4e86da84f38ab6 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2667,17 +2667,12 @@ static int io_iopoll_check(struct io_ring_ctx *ctx, long min) + return ret; + } + +-static void kiocb_end_write(struct io_kiocb *req) ++static void io_req_end_write(struct io_kiocb *req) + { +- /* +- * Tell lockdep we inherited freeze protection from submission +- * thread. +- */ + if (req->flags & REQ_F_ISREG) { +- struct super_block *sb = file_inode(req->file)->i_sb; ++ struct io_rw *rw = &req->rw; + +- __sb_writers_acquired(sb, SB_FREEZE_WRITE); +- sb_end_write(sb); ++ kiocb_end_write(&rw->kiocb); + } + } + +@@ -2737,7 +2732,7 @@ static void io_req_io_end(struct io_kiocb *req) + struct io_rw *rw = &req->rw; + + if (rw->kiocb.ki_flags & IOCB_WRITE) { +- kiocb_end_write(req); ++ io_req_end_write(req); + fsnotify_modify(req->file); + } else { + fsnotify_access(req->file); +@@ -2817,7 +2812,7 @@ static void io_complete_rw_iopoll(struct kiocb *kiocb, long res, long res2) + struct io_kiocb *req = container_of(kiocb, struct io_kiocb, rw.kiocb); + + if (kiocb->ki_flags & IOCB_WRITE) +- kiocb_end_write(req); ++ io_req_end_write(req); + if (unlikely(res != req->result)) { + if (res == -EAGAIN && io_rw_should_reissue(req)) { + req->flags |= REQ_F_REISSUE; +@@ -3724,6 +3719,25 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + return io_prep_rw(req, sqe, WRITE); + } + ++static bool io_kiocb_start_write(struct io_kiocb *req, struct kiocb *kiocb) ++{ ++ struct inode *inode; ++ bool ret; ++ ++ if (!(req->flags & REQ_F_ISREG)) ++ return true; ++ if (!(kiocb->ki_flags & IOCB_NOWAIT)) { ++ kiocb_start_write(kiocb); ++ return true; ++ } ++ ++ inode = file_inode(kiocb->ki_filp); ++ ret = sb_start_write_trylock(inode->i_sb); ++ if (ret) ++ __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); ++ return ret; ++} ++ + static int io_write(struct io_kiocb *req, unsigned int issue_flags) + { + struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs; +@@ -3770,18 +3784,8 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags) + if (unlikely(ret)) + goto out_free; + +- /* +- * Open-code file_start_write here to grab freeze protection, +- * which will be released by another thread in +- * io_complete_rw(). Fool lockdep by telling it the lock got +- * released so that it doesn't complain about the held lock when +- * we return to userspace. +- */ +- if (req->flags & REQ_F_ISREG) { +- sb_start_write(file_inode(req->file)->i_sb); +- __sb_writers_release(file_inode(req->file)->i_sb, +- SB_FREEZE_WRITE); +- } ++ if (unlikely(!io_kiocb_start_write(req, kiocb))) ++ goto copy_iov; + kiocb->ki_flags |= IOCB_WRITE; + + if (req->file->f_op->write_iter) +@@ -3817,7 +3821,7 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags) + ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false); + if (!ret) { + if (kiocb->ki_flags & IOCB_WRITE) +- kiocb_end_write(req); ++ io_req_end_write(req); + return -EAGAIN; + } + return ret; +@@ -10649,8 +10653,10 @@ static int io_register_iowq_max_workers(struct io_ring_ctx *ctx, + } + + if (sqd) { ++ mutex_unlock(&ctx->uring_lock); + mutex_unlock(&sqd->lock); + io_put_sq_data(sqd); ++ mutex_lock(&ctx->uring_lock); + } + + if (copy_to_user(arg, new_count, sizeof(new_count))) +@@ -10675,8 +10681,11 @@ static int io_register_iowq_max_workers(struct io_ring_ctx *ctx, + return 0; + err: + if (sqd) { ++ mutex_unlock(&ctx->uring_lock); + mutex_unlock(&sqd->lock); + io_put_sq_data(sqd); ++ mutex_lock(&ctx->uring_lock); ++ + } + return ret; + } +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 60db311480d0a9..931611d2273699 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -12564,7 +12564,7 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, + /* 'struct bpf_verifier_env' can be global, but since it's not small, + * allocate/free it every time bpf_check() is called + */ +- env = kzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL); ++ env = kvzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL); + if (!env) + return -ENOMEM; + log = &env->log; +@@ -12755,6 +12755,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, + mutex_unlock(&bpf_verifier_lock); + vfree(env->insn_aux_data); + err_free_env: +- kfree(env); ++ kvfree(env); + return ret; + } +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 2faea1ecd8116f..c034b2a3d49ef4 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -1075,7 +1075,7 @@ static __always_inline void *__do_krealloc(const void *p, size_t new_size, + /* Zero out spare memory. */ + if (want_init_on_alloc(flags)) { + kasan_disable_current(); +- memset((void *)p + new_size, 0, ks - new_size); ++ memset(kasan_reset_tag(p) + new_size, 0, ks - new_size); + kasan_enable_current(); + } + +diff --git a/net/9p/client.c b/net/9p/client.c +index 0fa324e8b24514..3e63f99db72595 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -1004,8 +1004,10 @@ static int p9_client_version(struct p9_client *c) + struct p9_client *p9_client_create(const char *dev_name, char *options) + { + int err; ++ static atomic_t seqno = ATOMIC_INIT(0); + struct p9_client *clnt; + char *client_id; ++ char *cache_name; + + err = 0; + clnt = kmalloc(sizeof(struct p9_client), GFP_KERNEL); +@@ -1058,15 +1060,23 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) + if (err) + goto close_trans; + ++ cache_name = kasprintf(GFP_KERNEL, ++ "9p-fcall-cache-%u", atomic_inc_return(&seqno)); ++ if (!cache_name) { ++ err = -ENOMEM; ++ goto close_trans; ++ } ++ + /* P9_HDRSZ + 4 is the smallest packet header we can have that is + * followed by data accessed from userspace by read + */ + clnt->fcall_cache = +- kmem_cache_create_usercopy("9p-fcall-cache", clnt->msize, ++ kmem_cache_create_usercopy(cache_name, clnt->msize, + 0, 0, P9_HDRSZ + 4, + clnt->msize - (P9_HDRSZ + 4), + NULL); + ++ kfree(cache_name); + return clnt; + + close_trans: +diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c +index d3ea9d0779fb61..84e37108c6b5e0 100644 +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -36,6 +36,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) + const unsigned char *dest; + u16 vid = 0; + ++ if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) { ++ kfree_skb(skb); ++ return NETDEV_TX_OK; ++ } ++ + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); + + rcu_read_lock(); +diff --git a/net/core/dst.c b/net/core/dst.c +index 453ec8aafc4aba..5bb1438573367d 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -109,9 +109,6 @@ struct dst_entry *dst_destroy(struct dst_entry * dst) + child = xdst->child; + } + #endif +- if (!(dst->flags & DST_NOCOUNT)) +- dst_entries_add(dst->ops, -1); +- + if (dst->ops->destroy) + dst->ops->destroy(dst); + if (dst->dev) +@@ -162,6 +159,12 @@ void dst_dev_put(struct dst_entry *dst) + } + EXPORT_SYMBOL(dst_dev_put); + ++static void dst_count_dec(struct dst_entry *dst) ++{ ++ if (!(dst->flags & DST_NOCOUNT)) ++ dst_entries_add(dst->ops, -1); ++} ++ + void dst_release(struct dst_entry *dst) + { + if (dst) { +@@ -171,8 +174,10 @@ void dst_release(struct dst_entry *dst) + if (WARN_ONCE(newrefcnt < 0, "dst_release underflow")) + net_warn_ratelimited("%s: dst:%p refcnt:%d\n", + __func__, dst, newrefcnt); +- if (!newrefcnt) ++ if (!newrefcnt){ ++ dst_count_dec(dst); + call_rcu(&dst->rcu_head, dst_destroy_rcu); ++ } + } + } + EXPORT_SYMBOL(dst_release); +@@ -186,8 +191,10 @@ void dst_release_immediate(struct dst_entry *dst) + if (WARN_ONCE(newrefcnt < 0, "dst_release_immediate underflow")) + net_warn_ratelimited("%s: dst:%p refcnt:%d\n", + __func__, dst, newrefcnt); +- if (!newrefcnt) ++ if (!newrefcnt){ ++ dst_count_dec(dst); + dst_destroy(dst); ++ } + } + } + EXPORT_SYMBOL(dst_release_immediate); +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 1e82c51657a7e2..93ebd14b48ed73 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, + } + + ch = (struct sctp_chunkhdr *)ch_end; +- } while (ch_end < skb_tail_pointer(skb)); ++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); + + if (ootb_shut_ack) + return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); +diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c +index cc3bae2659e791..b4871cc1fd3935 100644 +--- a/net/vmw_vsock/hyperv_transport.c ++++ b/net/vmw_vsock/hyperv_transport.c +@@ -538,6 +538,7 @@ static void hvs_destruct(struct vsock_sock *vsk) + vmbus_hvsock_device_unregister(chan); + + kfree(hvs); ++ vsk->trans = NULL; + } + + static int hvs_dgram_bind(struct vsock_sock *vsk, struct sockaddr_vm *addr) +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 4102689b3348a1..b626c7e8e61abc 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -687,6 +687,7 @@ void virtio_transport_destruct(struct vsock_sock *vsk) + struct virtio_vsock_sock *vvs = vsk->trans; + + kfree(vvs); ++ vsk->trans = NULL; + } + EXPORT_SYMBOL_GPL(virtio_transport_destruct); + +diff --git a/security/keys/keyring.c b/security/keys/keyring.c +index 14abfe765b7e78..9f0fc81a3a7b95 100644 +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, + for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { + ptr = READ_ONCE(node->slots[slot]); + +- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) +- goto descend_to_node; ++ if (assoc_array_ptr_is_meta(ptr)) { ++ if (node->back_pointer || ++ assoc_array_ptr_is_shortcut(ptr)) ++ goto descend_to_node; ++ } + + if (!keyring_ptr_is_keyring(ptr)) + continue; +diff --git a/sound/Kconfig b/sound/Kconfig +index aaf2022ffc57d4..cb4cb0d5b9591e 100644 +--- a/sound/Kconfig ++++ b/sound/Kconfig +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + menuconfig SOUND + tristate "Sound card support" +- depends on HAS_IOMEM || UML ++ depends on HAS_IOMEM || INDIRECT_IOMEM + help + If you have a sound card in your computer, i.e. if it can say more + than an occasional beep, say Y. +diff --git a/sound/firewire/tascam/amdtp-tascam.c b/sound/firewire/tascam/amdtp-tascam.c +index f823a2ab3544bf..8ffc065b77f954 100644 +--- a/sound/firewire/tascam/amdtp-tascam.c ++++ b/sound/firewire/tascam/amdtp-tascam.c +@@ -244,7 +244,7 @@ int amdtp_tscm_init(struct amdtp_stream *s, struct fw_unit *unit, + CIP_NONBLOCKING | CIP_SKIP_DBC_ZERO_CHECK, fmt, + process_ctx_payloads, sizeof(struct amdtp_tscm)); + if (err < 0) +- return 0; ++ return err; + + if (dir == AMDTP_OUT_STREAM) { + // Use fixed value for FDF field. +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 51d97de74cad13..30025716164a0d 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -181,8 +181,6 @@ static void cx_auto_reboot_notify(struct hda_codec *codec) + { + struct conexant_spec *spec = codec->spec; + +- snd_hda_gen_shutup_speakers(codec); +- + /* Turn the problematic codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ + cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false); +diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c +index 1bfa3b2ba9744a..ef518cff84f289 100644 +--- a/sound/soc/stm/stm32_spdifrx.c ++++ b/sound/soc/stm/stm32_spdifrx.c +@@ -948,7 +948,7 @@ static int stm32_spdifrx_remove(struct platform_device *pdev) + { + struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev); + +- if (spdifrx->ctrl_chan) ++ if (!IS_ERR(spdifrx->ctrl_chan)) + dma_release_channel(spdifrx->ctrl_chan); + + if (spdifrx->dmab) +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 99f2203bf51f14..46504bf0ce3ab3 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -24,6 +24,7 @@ + #include <sound/asoundef.h> + #include <sound/core.h> + #include <sound/control.h> ++#include <sound/hda_verbs.h> + #include <sound/hwdep.h> + #include <sound/info.h> + #include <sound/tlv.h> +@@ -1793,6 +1794,169 @@ static int snd_soundblaster_e1_switch_create(struct usb_mixer_interface *mixer) + NULL); + } + ++/* ++ * Dell WD15 dock jack detection ++ * ++ * The WD15 contains an ALC4020 USB audio controller and ALC3263 audio codec ++ * from Realtek. It is a UAC 1 device, and UAC 1 does not support jack ++ * detection. Instead, jack detection works by sending HD Audio commands over ++ * vendor-type USB messages. ++ */ ++ ++#define HDA_VERB_CMD(V, N, D) (((N) << 20) | ((V) << 8) | (D)) ++ ++#define REALTEK_HDA_VALUE 0x0038 ++ ++#define REALTEK_HDA_SET 62 ++#define REALTEK_HDA_GET_OUT 88 ++#define REALTEK_HDA_GET_IN 89 ++ ++#define REALTEK_LINE1 0x1a ++#define REALTEK_VENDOR_REGISTERS 0x20 ++#define REALTEK_HP_OUT 0x21 ++ ++#define REALTEK_CBJ_CTRL2 0x50 ++ ++#define REALTEK_JACK_INTERRUPT_NODE 5 ++ ++#define REALTEK_MIC_FLAG 0x100 ++ ++static int realtek_hda_set(struct snd_usb_audio *chip, u32 cmd) ++{ ++ struct usb_device *dev = chip->dev; ++ __be32 buf = cpu_to_be32(cmd); ++ ++ return snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), REALTEK_HDA_SET, ++ USB_RECIP_DEVICE | USB_TYPE_VENDOR | USB_DIR_OUT, ++ REALTEK_HDA_VALUE, 0, &buf, sizeof(buf)); ++} ++ ++static int realtek_hda_get(struct snd_usb_audio *chip, u32 cmd, u32 *value) ++{ ++ struct usb_device *dev = chip->dev; ++ int err; ++ __be32 buf = cpu_to_be32(cmd); ++ ++ err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), REALTEK_HDA_GET_OUT, ++ USB_RECIP_DEVICE | USB_TYPE_VENDOR | USB_DIR_OUT, ++ REALTEK_HDA_VALUE, 0, &buf, sizeof(buf)); ++ if (err < 0) ++ return err; ++ err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), REALTEK_HDA_GET_IN, ++ USB_RECIP_DEVICE | USB_TYPE_VENDOR | USB_DIR_IN, ++ REALTEK_HDA_VALUE, 0, &buf, sizeof(buf)); ++ if (err < 0) ++ return err; ++ ++ *value = be32_to_cpu(buf); ++ return 0; ++} ++ ++static int realtek_ctl_connector_get(struct snd_kcontrol *kcontrol, ++ struct snd_ctl_elem_value *ucontrol) ++{ ++ struct usb_mixer_elem_info *cval = kcontrol->private_data; ++ struct snd_usb_audio *chip = cval->head.mixer->chip; ++ u32 pv = kcontrol->private_value; ++ u32 node_id = pv & 0xff; ++ u32 sense; ++ u32 cbj_ctrl2; ++ bool presence; ++ int err; ++ ++ err = snd_usb_lock_shutdown(chip); ++ if (err < 0) ++ return err; ++ err = realtek_hda_get(chip, ++ HDA_VERB_CMD(AC_VERB_GET_PIN_SENSE, node_id, 0), ++ &sense); ++ if (err < 0) ++ goto err; ++ if (pv & REALTEK_MIC_FLAG) { ++ err = realtek_hda_set(chip, ++ HDA_VERB_CMD(AC_VERB_SET_COEF_INDEX, ++ REALTEK_VENDOR_REGISTERS, ++ REALTEK_CBJ_CTRL2)); ++ if (err < 0) ++ goto err; ++ err = realtek_hda_get(chip, ++ HDA_VERB_CMD(AC_VERB_GET_PROC_COEF, ++ REALTEK_VENDOR_REGISTERS, 0), ++ &cbj_ctrl2); ++ if (err < 0) ++ goto err; ++ } ++err: ++ snd_usb_unlock_shutdown(chip); ++ if (err < 0) ++ return err; ++ ++ presence = sense & AC_PINSENSE_PRESENCE; ++ if (pv & REALTEK_MIC_FLAG) ++ presence = presence && (cbj_ctrl2 & 0x0070) == 0x0070; ++ ucontrol->value.integer.value[0] = presence; ++ return 0; ++} ++ ++static const struct snd_kcontrol_new realtek_connector_ctl_ro = { ++ .iface = SNDRV_CTL_ELEM_IFACE_CARD, ++ .name = "", /* will be filled later manually */ ++ .access = SNDRV_CTL_ELEM_ACCESS_READ, ++ .info = snd_ctl_boolean_mono_info, ++ .get = realtek_ctl_connector_get, ++}; ++ ++static int realtek_resume_jack(struct usb_mixer_elem_list *list) ++{ ++ snd_ctl_notify(list->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, ++ &list->kctl->id); ++ return 0; ++} ++ ++static int realtek_add_jack(struct usb_mixer_interface *mixer, ++ char *name, u32 val) ++{ ++ struct usb_mixer_elem_info *cval; ++ struct snd_kcontrol *kctl; ++ ++ cval = kzalloc(sizeof(*cval), GFP_KERNEL); ++ if (!cval) ++ return -ENOMEM; ++ snd_usb_mixer_elem_init_std(&cval->head, mixer, ++ REALTEK_JACK_INTERRUPT_NODE); ++ cval->head.resume = realtek_resume_jack; ++ cval->val_type = USB_MIXER_BOOLEAN; ++ cval->channels = 1; ++ cval->min = 0; ++ cval->max = 1; ++ kctl = snd_ctl_new1(&realtek_connector_ctl_ro, cval); ++ if (!kctl) { ++ kfree(cval); ++ return -ENOMEM; ++ } ++ kctl->private_value = val; ++ strscpy(kctl->id.name, name, sizeof(kctl->id.name)); ++ kctl->private_free = snd_usb_mixer_elem_free; ++ return snd_usb_mixer_add_control(&cval->head, kctl); ++} ++ ++static int dell_dock_mixer_create(struct usb_mixer_interface *mixer) ++{ ++ int err; ++ ++ err = realtek_add_jack(mixer, "Line Out Jack", REALTEK_LINE1); ++ if (err < 0) ++ return err; ++ err = realtek_add_jack(mixer, "Headphone Jack", REALTEK_HP_OUT); ++ if (err < 0) ++ return err; ++ err = realtek_add_jack(mixer, "Headset Mic Jack", ++ REALTEK_HP_OUT | REALTEK_MIC_FLAG); ++ if (err < 0) ++ return err; ++ return 0; ++} ++ + static void dell_dock_init_vol(struct snd_usb_audio *chip, int ch, int id) + { + u16 buf = 0; +@@ -3024,8 +3188,14 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) + err = snd_soundblaster_e1_switch_create(mixer); + break; + case USB_ID(0x0bda, 0x4014): /* Dell WD15 dock */ ++ err = dell_dock_mixer_create(mixer); ++ if (err < 0) ++ break; + err = dell_dock_mixer_init(mixer); + break; ++ case USB_ID(0x0bda, 0x402e): /* Dell WD19 dock */ ++ err = dell_dock_mixer_create(mixer); ++ break; + + case USB_ID(0x2a39, 0x3fd2): /* RME ADI-2 Pro */ + case USB_ID(0x2a39, 0x3fd3): /* RME ADI-2 DAC */ +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index c78d8813811ccb..8a793e4c9400a7 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -2624,6 +2624,8 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al, + + /* If we have branch cycles always annotate them. */ + if (bs && bs->nr && entries[0].flags.cycles) { ++ int i; ++ + bi = sample__resolve_bstack(sample, al); + if (bi) { + struct addr_map_symbol *prev = NULL; +@@ -2638,7 +2640,7 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al, + * Note that perf stores branches reversed from + * program order! + */ +- for (int i = bs->nr - 1; i >= 0; i--) { ++ for (i = bs->nr - 1; i >= 0; i--) { + addr_map_symbol__account_cycles(&bi[i].from, + nonany_branch_mode ? NULL : prev, + bi[i].flags.cycles); +@@ -2647,12 +2649,6 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al, + if (total_cycles) + *total_cycles += bi[i].flags.cycles; + } +- for (unsigned int i = 0; i < bs->nr; i++) { +- map__put(bi[i].to.ms.map); +- maps__put(bi[i].to.ms.maps); +- map__put(bi[i].from.ms.map); +- maps__put(bi[i].from.ms.maps); +- } + free(bi); + } + } +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 354e1e04a26627..81b7ec2ae86152 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -299,8 +299,11 @@ void perf_session__delete(struct perf_session *session) + perf_session__release_decomp_events(session); + perf_env__exit(&session->header.env); + machines__exit(&session->machines); +- if (session->data) ++ if (session->data) { ++ if (perf_data__is_read(session->data)) ++ evlist__delete(session->evlist); + perf_data__close(session->data); ++ } + free(session); + } +
