diff options
author | 2017-05-20 16:18:59 -0400 | |
---|---|---|
committer | 2017-05-20 16:18:59 -0400 | |
commit | 7204d256da7c380bc6fcc48f4acebc4b1e6fed07 (patch) | |
tree | 3ea7ead03bb7aa4c73f448a898bdaee1205f8fc4 | |
parent | Linux patch 4.10.16 (diff) | |
download | linux-patches-4.10.tar.gz linux-patches-4.10.tar.bz2 linux-patches-4.10.zip |
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1016_linux-4.10.17.patch | 3698 |
2 files changed, 3702 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 6a98163e..f7274569 100644 --- a/0000_README +++ b/0000_README @@ -107,6 +107,10 @@ Patch: 1015_linux-4.10.16.patch From: http://www.kernel.org Desc: Linux 4.10.16 +Patch: 1016_linux-4.10.17.patch +From: http://www.kernel.org +Desc: Linux 4.10.17 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1016_linux-4.10.17.patch b/1016_linux-4.10.17.patch new file mode 100644 index 00000000..9f329e26 --- /dev/null +++ b/1016_linux-4.10.17.patch @@ -0,0 +1,3698 @@ +diff --git a/Makefile b/Makefile +index e3e60e71fa78..2e8b04bd180e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 10 +-SUBLEVEL = 16 ++SUBLEVEL = 17 + EXTRAVERSION = + NAME = Fearless Coyote + +diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c +index c2b131527a64..a08d7a93aebb 100644 +--- a/arch/arm/kvm/psci.c ++++ b/arch/arm/kvm/psci.c +@@ -208,9 +208,10 @@ int kvm_psci_version(struct kvm_vcpu *vcpu) + + static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + { +- int ret = 1; ++ struct kvm *kvm = vcpu->kvm; + unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0); + unsigned long val; ++ int ret = 1; + + switch (psci_fn) { + case PSCI_0_2_FN_PSCI_VERSION: +@@ -230,7 +231,9 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + break; + case PSCI_0_2_FN_CPU_ON: + case PSCI_0_2_FN64_CPU_ON: ++ mutex_lock(&kvm->lock); + val = kvm_psci_vcpu_on(vcpu); ++ mutex_unlock(&kvm->lock); + break; + case PSCI_0_2_FN_AFFINITY_INFO: + case PSCI_0_2_FN64_AFFINITY_INFO: +@@ -279,6 +282,7 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + + static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) + { ++ struct kvm *kvm = vcpu->kvm; + unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0); + unsigned long val; + +@@ -288,7 +292,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) + val = PSCI_RET_SUCCESS; + break; + case KVM_PSCI_FN_CPU_ON: ++ mutex_lock(&kvm->lock); + val = kvm_psci_vcpu_on(vcpu); ++ mutex_unlock(&kvm->lock); + break; + default: + val = PSCI_RET_NOT_SUPPORTED; +diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h +index f5ea0ba70f07..fe39e6841326 100644 +--- a/arch/arm64/include/asm/kvm_emulate.h ++++ b/arch/arm64/include/asm/kvm_emulate.h +@@ -240,6 +240,12 @@ static inline u8 kvm_vcpu_trap_get_fault_type(const struct kvm_vcpu *vcpu) + return kvm_vcpu_get_hsr(vcpu) & ESR_ELx_FSC_TYPE; + } + ++static inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu) ++{ ++ u32 esr = kvm_vcpu_get_hsr(vcpu); ++ return (esr & ESR_ELx_SYS64_ISS_RT_MASK) >> ESR_ELx_SYS64_ISS_RT_SHIFT; ++} ++ + static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu) + { + return vcpu_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK; +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index 87e7e6608cd8..7cee552ce0bf 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -1573,8 +1573,8 @@ static int kvm_handle_cp_64(struct kvm_vcpu *vcpu, + { + struct sys_reg_params params; + u32 hsr = kvm_vcpu_get_hsr(vcpu); +- int Rt = (hsr >> 5) & 0xf; +- int Rt2 = (hsr >> 10) & 0xf; ++ int Rt = kvm_vcpu_sys_get_rt(vcpu); ++ int Rt2 = (hsr >> 10) & 0x1f; + + params.is_aarch32 = true; + params.is_32bit = false; +@@ -1625,7 +1625,7 @@ static int kvm_handle_cp_32(struct kvm_vcpu *vcpu, + { + struct sys_reg_params params; + u32 hsr = kvm_vcpu_get_hsr(vcpu); +- int Rt = (hsr >> 5) & 0xf; ++ int Rt = kvm_vcpu_sys_get_rt(vcpu); + + params.is_aarch32 = true; + params.is_32bit = true; +@@ -1740,7 +1740,7 @@ int kvm_handle_sys_reg(struct kvm_vcpu *vcpu, struct kvm_run *run) + { + struct sys_reg_params params; + unsigned long esr = kvm_vcpu_get_hsr(vcpu); +- int Rt = (esr >> 5) & 0x1f; ++ int Rt = kvm_vcpu_sys_get_rt(vcpu); + int ret; + + trace_kvm_handle_sys_reg(esr); +diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c +index d5e2b8309939..021db31b40ba 100644 +--- a/arch/powerpc/kernel/nvram_64.c ++++ b/arch/powerpc/kernel/nvram_64.c +@@ -561,6 +561,7 @@ static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type, + static struct pstore_info nvram_pstore_info = { + .owner = THIS_MODULE, + .name = "nvram", ++ .flags = PSTORE_FLAGS_DMESG, + .open = nvram_pstore_open, + .read = nvram_pstore_read, + .write = nvram_pstore_write, +diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h +index e5612f3e3b57..d7ac721a8a96 100644 +--- a/arch/x86/boot/boot.h ++++ b/arch/x86/boot/boot.h +@@ -16,7 +16,7 @@ + #ifndef BOOT_BOOT_H + #define BOOT_BOOT_H + +-#define STACK_SIZE 512 /* Minimum number of bytes for stack */ ++#define STACK_SIZE 1024 /* Minimum number of bytes for stack */ + + #ifndef __ASSEMBLY__ + +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c +index 22ef4f72cf32..d7176ea4812c 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/intel/rapl.c +@@ -761,7 +761,7 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = { + + X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_CORE, hsw_rapl_init), + X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_GT3E, hsw_rapl_init), +- X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X, hsw_rapl_init), ++ X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X, hsx_rapl_init), + X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_XEON_D, hsw_rapl_init), + + X86_RAPL_MODEL_MATCH(INTEL_FAM6_XEON_PHI_KNL, knl_rapl_init), +diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h +index 529bb4a6487a..e2904373010d 100644 +--- a/arch/x86/include/asm/pmem.h ++++ b/arch/x86/include/asm/pmem.h +@@ -103,7 +103,7 @@ static inline size_t arch_copy_from_iter_pmem(void *addr, size_t bytes, + + if (bytes < 8) { + if (!IS_ALIGNED(dest, 4) || (bytes != 4)) +- arch_wb_cache_pmem(addr, 1); ++ arch_wb_cache_pmem(addr, bytes); + } else { + if (!IS_ALIGNED(dest, 8)) { + dest = ALIGN(dest, boot_cpu_data.x86_clflush_size); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b3b212f20f78..a158128494de 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3085,6 +3085,12 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu, + (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR)) + return -EINVAL; + ++ /* INITs are latched while in SMM */ ++ if (events->flags & KVM_VCPUEVENT_VALID_SMM && ++ (events->smi.smm || events->smi.pending) && ++ vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED) ++ return -EINVAL; ++ + process_nmi(vcpu); + vcpu->arch.exception.pending = events->exception.injected; + vcpu->arch.exception.nr = events->exception.nr; +@@ -7249,6 +7255,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu, + mp_state->mp_state != KVM_MP_STATE_RUNNABLE) + return -EINVAL; + ++ /* INITs are latched while in SMM */ ++ if ((is_smm(vcpu) || vcpu->arch.smi_pending) && ++ (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED || ++ mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED)) ++ return -EINVAL; ++ + if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) { + vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED; + set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events); +diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c +index a5c9910d234f..09a085bde0d4 100644 +--- a/arch/x86/um/ptrace_64.c ++++ b/arch/x86/um/ptrace_64.c +@@ -125,7 +125,7 @@ int poke_user(struct task_struct *child, long addr, long data) + else if ((addr >= offsetof(struct user, u_debugreg[0])) && + (addr <= offsetof(struct user, u_debugreg[7]))) { + addr -= offsetof(struct user, u_debugreg[0]); +- addr = addr >> 2; ++ addr = addr >> 3; + if ((addr == 4) || (addr == 5)) + return -EIO; + child->thread.arch.debugregs[addr] = data; +diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c +index 7d5afdb417cc..418f1b8576cf 100644 +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -2028,7 +2028,8 @@ static unsigned long __init xen_read_phys_ulong(phys_addr_t addr) + + /* + * Translate a virtual address to a physical one without relying on mapped +- * page tables. ++ * page tables. Don't rely on big pages being aligned in (guest) physical ++ * space! + */ + static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) + { +@@ -2049,7 +2050,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) + sizeof(pud))); + if (!pud_present(pud)) + return 0; +- pa = pud_pfn(pud) << PAGE_SHIFT; ++ pa = pud_val(pud) & PTE_PFN_MASK; + if (pud_large(pud)) + return pa + (vaddr & ~PUD_MASK); + +@@ -2057,7 +2058,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) + sizeof(pmd))); + if (!pmd_present(pmd)) + return 0; +- pa = pmd_pfn(pmd) << PAGE_SHIFT; ++ pa = pmd_val(pmd) & PTE_PFN_MASK; + if (pmd_large(pmd)) + return pa + (vaddr & ~PMD_MASK); + +diff --git a/block/blk-integrity.c b/block/blk-integrity.c +index 319f2e4f4a8b..478f572cb1e7 100644 +--- a/block/blk-integrity.c ++++ b/block/blk-integrity.c +@@ -412,7 +412,8 @@ void blk_integrity_register(struct gendisk *disk, struct blk_integrity *template + + bi->flags = BLK_INTEGRITY_VERIFY | BLK_INTEGRITY_GENERATE | + template->flags; +- bi->interval_exp = ilog2(queue_logical_block_size(disk->queue)); ++ bi->interval_exp = template->interval_exp ? : ++ ilog2(queue_logical_block_size(disk->queue)); + bi->profile = template->profile ? template->profile : &nop_profile; + bi->tuple_size = template->tuple_size; + bi->tag_size = template->tag_size; +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index c3177c989dc8..14fd00d6c7f4 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -44,6 +44,11 @@ struct aead_async_req { + char iv[]; + }; + ++struct aead_tfm { ++ struct crypto_aead *aead; ++ bool has_key; ++}; ++ + struct aead_ctx { + struct aead_sg_list tsgl; + struct aead_async_rsgl first_rsgl; +@@ -722,24 +727,146 @@ static struct proto_ops algif_aead_ops = { + .poll = aead_poll, + }; + ++static int aead_check_key(struct socket *sock) ++{ ++ int err = 0; ++ struct sock *psk; ++ struct alg_sock *pask; ++ struct aead_tfm *tfm; ++ struct sock *sk = sock->sk; ++ struct alg_sock *ask = alg_sk(sk); ++ ++ lock_sock(sk); ++ if (ask->refcnt) ++ goto unlock_child; ++ ++ psk = ask->parent; ++ pask = alg_sk(ask->parent); ++ tfm = pask->private; ++ ++ err = -ENOKEY; ++ lock_sock_nested(psk, SINGLE_DEPTH_NESTING); ++ if (!tfm->has_key) ++ goto unlock; ++ ++ if (!pask->refcnt++) ++ sock_hold(psk); ++ ++ ask->refcnt = 1; ++ sock_put(psk); ++ ++ err = 0; ++ ++unlock: ++ release_sock(psk); ++unlock_child: ++ release_sock(sk); ++ ++ return err; ++} ++ ++static int aead_sendmsg_nokey(struct socket *sock, struct msghdr *msg, ++ size_t size) ++{ ++ int err; ++ ++ err = aead_check_key(sock); ++ if (err) ++ return err; ++ ++ return aead_sendmsg(sock, msg, size); ++} ++ ++static ssize_t aead_sendpage_nokey(struct socket *sock, struct page *page, ++ int offset, size_t size, int flags) ++{ ++ int err; ++ ++ err = aead_check_key(sock); ++ if (err) ++ return err; ++ ++ return aead_sendpage(sock, page, offset, size, flags); ++} ++ ++static int aead_recvmsg_nokey(struct socket *sock, struct msghdr *msg, ++ size_t ignored, int flags) ++{ ++ int err; ++ ++ err = aead_check_key(sock); ++ if (err) ++ return err; ++ ++ return aead_recvmsg(sock, msg, ignored, flags); ++} ++ ++static struct proto_ops algif_aead_ops_nokey = { ++ .family = PF_ALG, ++ ++ .connect = sock_no_connect, ++ .socketpair = sock_no_socketpair, ++ .getname = sock_no_getname, ++ .ioctl = sock_no_ioctl, ++ .listen = sock_no_listen, ++ .shutdown = sock_no_shutdown, ++ .getsockopt = sock_no_getsockopt, ++ .mmap = sock_no_mmap, ++ .bind = sock_no_bind, ++ .accept = sock_no_accept, ++ .setsockopt = sock_no_setsockopt, ++ ++ .release = af_alg_release, ++ .sendmsg = aead_sendmsg_nokey, ++ .sendpage = aead_sendpage_nokey, ++ .recvmsg = aead_recvmsg_nokey, ++ .poll = aead_poll, ++}; ++ + static void *aead_bind(const char *name, u32 type, u32 mask) + { +- return crypto_alloc_aead(name, type, mask); ++ struct aead_tfm *tfm; ++ struct crypto_aead *aead; ++ ++ tfm = kzalloc(sizeof(*tfm), GFP_KERNEL); ++ if (!tfm) ++ return ERR_PTR(-ENOMEM); ++ ++ aead = crypto_alloc_aead(name, type, mask); ++ if (IS_ERR(aead)) { ++ kfree(tfm); ++ return ERR_CAST(aead); ++ } ++ ++ tfm->aead = aead; ++ ++ return tfm; + } + + static void aead_release(void *private) + { +- crypto_free_aead(private); ++ struct aead_tfm *tfm = private; ++ ++ crypto_free_aead(tfm->aead); ++ kfree(tfm); + } + + static int aead_setauthsize(void *private, unsigned int authsize) + { +- return crypto_aead_setauthsize(private, authsize); ++ struct aead_tfm *tfm = private; ++ ++ return crypto_aead_setauthsize(tfm->aead, authsize); + } + + static int aead_setkey(void *private, const u8 *key, unsigned int keylen) + { +- return crypto_aead_setkey(private, key, keylen); ++ struct aead_tfm *tfm = private; ++ int err; ++ ++ err = crypto_aead_setkey(tfm->aead, key, keylen); ++ tfm->has_key = !err; ++ ++ return err; + } + + static void aead_sock_destruct(struct sock *sk) +@@ -756,12 +883,14 @@ static void aead_sock_destruct(struct sock *sk) + af_alg_release_parent(sk); + } + +-static int aead_accept_parent(void *private, struct sock *sk) ++static int aead_accept_parent_nokey(void *private, struct sock *sk) + { + struct aead_ctx *ctx; + struct alg_sock *ask = alg_sk(sk); +- unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(private); +- unsigned int ivlen = crypto_aead_ivsize(private); ++ struct aead_tfm *tfm = private; ++ struct crypto_aead *aead = tfm->aead; ++ unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(aead); ++ unsigned int ivlen = crypto_aead_ivsize(aead); + + ctx = sock_kmalloc(sk, len, GFP_KERNEL); + if (!ctx) +@@ -788,7 +917,7 @@ static int aead_accept_parent(void *private, struct sock *sk) + + ask->private = ctx; + +- aead_request_set_tfm(&ctx->aead_req, private); ++ aead_request_set_tfm(&ctx->aead_req, aead); + aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, + af_alg_complete, &ctx->completion); + +@@ -797,13 +926,25 @@ static int aead_accept_parent(void *private, struct sock *sk) + return 0; + } + ++static int aead_accept_parent(void *private, struct sock *sk) ++{ ++ struct aead_tfm *tfm = private; ++ ++ if (!tfm->has_key) ++ return -ENOKEY; ++ ++ return aead_accept_parent_nokey(private, sk); ++} ++ + static const struct af_alg_type algif_type_aead = { + .bind = aead_bind, + .release = aead_release, + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .accept = aead_accept_parent, ++ .accept_nokey = aead_accept_parent_nokey, + .ops = &algif_aead_ops, ++ .ops_nokey = &algif_aead_ops_nokey, + .name = "aead", + .owner = THIS_MODULE + }; +diff --git a/drivers/Makefile b/drivers/Makefile +index 060026a02f59..c409c66710ac 100644 +--- a/drivers/Makefile ++++ b/drivers/Makefile +@@ -101,6 +101,7 @@ obj-$(CONFIG_USB_PHY) += usb/ + obj-$(CONFIG_USB) += usb/ + obj-$(CONFIG_PCI) += usb/ + obj-$(CONFIG_USB_GADGET) += usb/ ++obj-$(CONFIG_OF) += usb/ + obj-$(CONFIG_SERIO) += input/serio/ + obj-$(CONFIG_GAMEPORT) += input/gameport/ + obj-$(CONFIG_INPUT) += input/ +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 8f6c23c20c52..deed58013555 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -287,6 +287,9 @@ static int bcm_open(struct hci_uart *hu) + + hu->priv = bcm; + ++ if (!hu->tty->dev) ++ goto out; ++ + mutex_lock(&bcm_device_lock); + list_for_each(p, &bcm_device_list) { + struct bcm_device *dev = list_entry(p, struct bcm_device, list); +@@ -307,7 +310,7 @@ static int bcm_open(struct hci_uart *hu) + } + + mutex_unlock(&bcm_device_lock); +- ++out: + return 0; + } + +diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c +index 9e271286c5e5..73306384af6c 100644 +--- a/drivers/bluetooth/hci_intel.c ++++ b/drivers/bluetooth/hci_intel.c +@@ -307,6 +307,9 @@ static int intel_set_power(struct hci_uart *hu, bool powered) + struct list_head *p; + int err = -ENODEV; + ++ if (!hu->tty->dev) ++ return err; ++ + mutex_lock(&intel_device_list_lock); + + list_for_each(p, &intel_device_list) { +@@ -379,6 +382,9 @@ static void intel_busy_work(struct work_struct *work) + struct intel_data *intel = container_of(work, struct intel_data, + busy_work); + ++ if (!intel->hu->tty->dev) ++ return; ++ + /* Link is busy, delay the suspend */ + mutex_lock(&intel_device_list_lock); + list_for_each(p, &intel_device_list) { +@@ -889,6 +895,8 @@ static int intel_setup(struct hci_uart *hu) + list_for_each(p, &intel_device_list) { + struct intel_device *dev = list_entry(p, struct intel_device, + list); ++ if (!hu->tty->dev) ++ break; + if (hu->tty->dev->parent == dev->pdev->dev.parent) { + if (device_may_wakeup(&dev->pdev->dev)) { + set_bit(STATE_LPM_ENABLED, &intel->flags); +@@ -1056,6 +1064,9 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) + + BT_DBG("hu %p skb %p", hu, skb); + ++ if (!hu->tty->dev) ++ goto out_enqueue; ++ + /* Be sure our controller is resumed and potential LPM transaction + * completed before enqueuing any packet. + */ +@@ -1072,7 +1083,7 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) + } + } + mutex_unlock(&intel_device_list_lock); +- ++out_enqueue: + skb_queue_tail(&intel->txq, skb); + + return 0; +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index cca6e5bc1cea..51ba67de862e 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -891,6 +891,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + * for details on the intricacies of this. + */ + int left; ++ unsigned char *data_to_send; + + ssif_inc_stat(ssif_info, sent_messages_parts); + +@@ -899,6 +900,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + left = 32; + /* Length byte. */ + ssif_info->multi_data[ssif_info->multi_pos] = left; ++ data_to_send = ssif_info->multi_data + ssif_info->multi_pos; + ssif_info->multi_pos += left; + if (left < 32) + /* +@@ -912,7 +914,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + rv = ssif_i2c_send(ssif_info, msg_written_handler, + I2C_SMBUS_WRITE, + SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE, +- ssif_info->multi_data + ssif_info->multi_pos, ++ data_to_send, + I2C_SMBUS_BLOCK_DATA); + if (rv < 0) { + /* request failed, just return the error. */ +diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c +index 7bc09989e18a..c46eeda71595 100644 +--- a/drivers/crypto/ccp/ccp-dev-v3.c ++++ b/drivers/crypto/ccp/ccp-dev-v3.c +@@ -315,17 +315,73 @@ static int ccp_perform_ecc(struct ccp_op *op) + return ccp_do_cmd(op, cr, ARRAY_SIZE(cr)); + } + ++static void ccp_disable_queue_interrupts(struct ccp_device *ccp) ++{ ++ iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG); ++} ++ ++static void ccp_enable_queue_interrupts(struct ccp_device *ccp) ++{ ++ iowrite32(ccp->qim, ccp->io_regs + IRQ_MASK_REG); ++} ++ ++static void ccp_irq_bh(unsigned long data) ++{ ++ struct ccp_device *ccp = (struct ccp_device *)data; ++ struct ccp_cmd_queue *cmd_q; ++ u32 q_int, status; ++ unsigned int i; ++ ++ status = ioread32(ccp->io_regs + IRQ_STATUS_REG); ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ cmd_q = &ccp->cmd_q[i]; ++ ++ q_int = status & (cmd_q->int_ok | cmd_q->int_err); ++ if (q_int) { ++ cmd_q->int_status = status; ++ cmd_q->q_status = ioread32(cmd_q->reg_status); ++ cmd_q->q_int_status = ioread32(cmd_q->reg_int_status); ++ ++ /* On error, only save the first error value */ ++ if ((q_int & cmd_q->int_err) && !cmd_q->cmd_error) ++ cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status); ++ ++ cmd_q->int_rcvd = 1; ++ ++ /* Acknowledge the interrupt and wake the kthread */ ++ iowrite32(q_int, ccp->io_regs + IRQ_STATUS_REG); ++ wake_up_interruptible(&cmd_q->int_queue); ++ } ++ } ++ ccp_enable_queue_interrupts(ccp); ++} ++ ++static irqreturn_t ccp_irq_handler(int irq, void *data) ++{ ++ struct device *dev = data; ++ struct ccp_device *ccp = dev_get_drvdata(dev); ++ ++ ccp_disable_queue_interrupts(ccp); ++ if (ccp->use_tasklet) ++ tasklet_schedule(&ccp->irq_tasklet); ++ else ++ ccp_irq_bh((unsigned long)ccp); ++ ++ return IRQ_HANDLED; ++} ++ + static int ccp_init(struct ccp_device *ccp) + { + struct device *dev = ccp->dev; + struct ccp_cmd_queue *cmd_q; + struct dma_pool *dma_pool; + char dma_pool_name[MAX_DMAPOOL_NAME_LEN]; +- unsigned int qmr, qim, i; ++ unsigned int qmr, i; + int ret; + + /* Find available queues */ +- qim = 0; ++ ccp->qim = 0; + qmr = ioread32(ccp->io_regs + Q_MASK_REG); + for (i = 0; i < MAX_HW_QUEUES; i++) { + if (!(qmr & (1 << i))) +@@ -370,7 +426,7 @@ static int ccp_init(struct ccp_device *ccp) + init_waitqueue_head(&cmd_q->int_queue); + + /* Build queue interrupt mask (two interrupts per queue) */ +- qim |= cmd_q->int_ok | cmd_q->int_err; ++ ccp->qim |= cmd_q->int_ok | cmd_q->int_err; + + #ifdef CONFIG_ARM64 + /* For arm64 set the recommended queue cache settings */ +@@ -388,14 +444,14 @@ static int ccp_init(struct ccp_device *ccp) + dev_notice(dev, "%u command queues available\n", ccp->cmd_q_count); + + /* Disable and clear interrupts until ready */ +- iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG); ++ ccp_disable_queue_interrupts(ccp); + for (i = 0; i < ccp->cmd_q_count; i++) { + cmd_q = &ccp->cmd_q[i]; + + ioread32(cmd_q->reg_int_status); + ioread32(cmd_q->reg_status); + } +- iowrite32(qim, ccp->io_regs + IRQ_STATUS_REG); ++ iowrite32(ccp->qim, ccp->io_regs + IRQ_STATUS_REG); + + /* Request an irq */ + ret = ccp->get_irq(ccp); +@@ -404,6 +460,11 @@ static int ccp_init(struct ccp_device *ccp) + goto e_pool; + } + ++ /* Initialize the ISR tasklet? */ ++ if (ccp->use_tasklet) ++ tasklet_init(&ccp->irq_tasklet, ccp_irq_bh, ++ (unsigned long)ccp); ++ + dev_dbg(dev, "Starting threads...\n"); + /* Create a kthread for each queue */ + for (i = 0; i < ccp->cmd_q_count; i++) { +@@ -426,7 +487,7 @@ static int ccp_init(struct ccp_device *ccp) + + dev_dbg(dev, "Enabling interrupts...\n"); + /* Enable interrupts */ +- iowrite32(qim, ccp->io_regs + IRQ_MASK_REG); ++ ccp_enable_queue_interrupts(ccp); + + dev_dbg(dev, "Registering device...\n"); + ccp_add_device(ccp); +@@ -463,7 +524,7 @@ static void ccp_destroy(struct ccp_device *ccp) + { + struct ccp_cmd_queue *cmd_q; + struct ccp_cmd *cmd; +- unsigned int qim, i; ++ unsigned int i; + + /* Unregister the DMA engine */ + ccp_dmaengine_unregister(ccp); +@@ -474,22 +535,15 @@ static void ccp_destroy(struct ccp_device *ccp) + /* Remove this device from the list of available units */ + ccp_del_device(ccp); + +- /* Build queue interrupt mask (two interrupt masks per queue) */ +- qim = 0; +- for (i = 0; i < ccp->cmd_q_count; i++) { +- cmd_q = &ccp->cmd_q[i]; +- qim |= cmd_q->int_ok | cmd_q->int_err; +- } +- + /* Disable and clear interrupts */ +- iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG); ++ ccp_disable_queue_interrupts(ccp); + for (i = 0; i < ccp->cmd_q_count; i++) { + cmd_q = &ccp->cmd_q[i]; + + ioread32(cmd_q->reg_int_status); + ioread32(cmd_q->reg_status); + } +- iowrite32(qim, ccp->io_regs + IRQ_STATUS_REG); ++ iowrite32(ccp->qim, ccp->io_regs + IRQ_STATUS_REG); + + /* Stop the queue kthreads */ + for (i = 0; i < ccp->cmd_q_count; i++) +@@ -516,40 +570,6 @@ static void ccp_destroy(struct ccp_device *ccp) + } + } + +-static irqreturn_t ccp_irq_handler(int irq, void *data) +-{ +- struct device *dev = data; +- struct ccp_device *ccp = dev_get_drvdata(dev); +- struct ccp_cmd_queue *cmd_q; +- u32 q_int, status; +- unsigned int i; +- +- status = ioread32(ccp->io_regs + IRQ_STATUS_REG); +- +- for (i = 0; i < ccp->cmd_q_count; i++) { +- cmd_q = &ccp->cmd_q[i]; +- +- q_int = status & (cmd_q->int_ok | cmd_q->int_err); +- if (q_int) { +- cmd_q->int_status = status; +- cmd_q->q_status = ioread32(cmd_q->reg_status); +- cmd_q->q_int_status = ioread32(cmd_q->reg_int_status); +- +- /* On error, only save the first error value */ +- if ((q_int & cmd_q->int_err) && !cmd_q->cmd_error) +- cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status); +- +- cmd_q->int_rcvd = 1; +- +- /* Acknowledge the interrupt and wake the kthread */ +- iowrite32(q_int, ccp->io_regs + IRQ_STATUS_REG); +- wake_up_interruptible(&cmd_q->int_queue); +- } +- } +- +- return IRQ_HANDLED; +-} +- + static const struct ccp_actions ccp3_actions = { + .aes = ccp_perform_aes, + .xts_aes = ccp_perform_xts_aes, +diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c +index 3422f203455d..3c09904705e2 100644 +--- a/drivers/crypto/ccp/ccp-dev-v5.c ++++ b/drivers/crypto/ccp/ccp-dev-v5.c +@@ -651,6 +651,65 @@ static int ccp_assign_lsbs(struct ccp_device *ccp) + return rc; + } + ++static void ccp5_disable_queue_interrupts(struct ccp_device *ccp) ++{ ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) ++ iowrite32(0x0, ccp->cmd_q[i].reg_int_enable); ++} ++ ++static void ccp5_enable_queue_interrupts(struct ccp_device *ccp) ++{ ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) ++ iowrite32(SUPPORTED_INTERRUPTS, ccp->cmd_q[i].reg_int_enable); ++} ++ ++static void ccp5_irq_bh(unsigned long data) ++{ ++ struct ccp_device *ccp = (struct ccp_device *)data; ++ u32 status; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ struct ccp_cmd_queue *cmd_q = &ccp->cmd_q[i]; ++ ++ status = ioread32(cmd_q->reg_interrupt_status); ++ ++ if (status) { ++ cmd_q->int_status = status; ++ cmd_q->q_status = ioread32(cmd_q->reg_status); ++ cmd_q->q_int_status = ioread32(cmd_q->reg_int_status); ++ ++ /* On error, only save the first error value */ ++ if ((status & INT_ERROR) && !cmd_q->cmd_error) ++ cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status); ++ ++ cmd_q->int_rcvd = 1; ++ ++ /* Acknowledge the interrupt and wake the kthread */ ++ iowrite32(status, cmd_q->reg_interrupt_status); ++ wake_up_interruptible(&cmd_q->int_queue); ++ } ++ } ++ ccp5_enable_queue_interrupts(ccp); ++} ++ ++static irqreturn_t ccp5_irq_handler(int irq, void *data) ++{ ++ struct device *dev = data; ++ struct ccp_device *ccp = dev_get_drvdata(dev); ++ ++ ccp5_disable_queue_interrupts(ccp); ++ if (ccp->use_tasklet) ++ tasklet_schedule(&ccp->irq_tasklet); ++ else ++ ccp5_irq_bh((unsigned long)ccp); ++ return IRQ_HANDLED; ++} ++ + static int ccp5_init(struct ccp_device *ccp) + { + struct device *dev = ccp->dev; +@@ -735,19 +794,18 @@ static int ccp5_init(struct ccp_device *ccp) + dev_notice(dev, "%u command queues available\n", ccp->cmd_q_count); + + /* Turn off the queues and disable interrupts until ready */ ++ ccp5_disable_queue_interrupts(ccp); + for (i = 0; i < ccp->cmd_q_count; i++) { + cmd_q = &ccp->cmd_q[i]; + + cmd_q->qcontrol = 0; /* Start with nothing */ + iowrite32(cmd_q->qcontrol, cmd_q->reg_control); + +- /* Disable the interrupts */ +- iowrite32(0x00, cmd_q->reg_int_enable); + ioread32(cmd_q->reg_int_status); + ioread32(cmd_q->reg_status); + +- /* Clear the interrupts */ +- iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status); ++ /* Clear the interrupt status */ ++ iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status); + } + + dev_dbg(dev, "Requesting an IRQ...\n"); +@@ -757,6 +815,10 @@ static int ccp5_init(struct ccp_device *ccp) + dev_err(dev, "unable to allocate an IRQ\n"); + goto e_pool; + } ++ /* Initialize the ISR tasklet */ ++ if (ccp->use_tasklet) ++ tasklet_init(&ccp->irq_tasklet, ccp5_irq_bh, ++ (unsigned long)ccp); + + dev_dbg(dev, "Loading LSB map...\n"); + /* Copy the private LSB mask to the public registers */ +@@ -825,11 +887,7 @@ static int ccp5_init(struct ccp_device *ccp) + } + + dev_dbg(dev, "Enabling interrupts...\n"); +- /* Enable interrupts */ +- for (i = 0; i < ccp->cmd_q_count; i++) { +- cmd_q = &ccp->cmd_q[i]; +- iowrite32(ALL_INTERRUPTS, cmd_q->reg_int_enable); +- } ++ ccp5_enable_queue_interrupts(ccp); + + dev_dbg(dev, "Registering device...\n"); + /* Put this on the unit list to make it available */ +@@ -881,17 +939,15 @@ static void ccp5_destroy(struct ccp_device *ccp) + ccp_del_device(ccp); + + /* Disable and clear interrupts */ ++ ccp5_disable_queue_interrupts(ccp); + for (i = 0; i < ccp->cmd_q_count; i++) { + cmd_q = &ccp->cmd_q[i]; + + /* Turn off the run bit */ + iowrite32(cmd_q->qcontrol & ~CMD5_Q_RUN, cmd_q->reg_control); + +- /* Disable the interrupts */ +- iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status); +- + /* Clear the interrupt status */ +- iowrite32(0x00, cmd_q->reg_int_enable); ++ iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status); + ioread32(cmd_q->reg_int_status); + ioread32(cmd_q->reg_status); + } +@@ -924,38 +980,6 @@ static void ccp5_destroy(struct ccp_device *ccp) + } + } + +-static irqreturn_t ccp5_irq_handler(int irq, void *data) +-{ +- struct device *dev = data; +- struct ccp_device *ccp = dev_get_drvdata(dev); +- u32 status; +- unsigned int i; +- +- for (i = 0; i < ccp->cmd_q_count; i++) { +- struct ccp_cmd_queue *cmd_q = &ccp->cmd_q[i]; +- +- status = ioread32(cmd_q->reg_interrupt_status); +- +- if (status) { +- cmd_q->int_status = status; +- cmd_q->q_status = ioread32(cmd_q->reg_status); +- cmd_q->q_int_status = ioread32(cmd_q->reg_int_status); +- +- /* On error, only save the first error value */ +- if ((status & INT_ERROR) && !cmd_q->cmd_error) +- cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status); +- +- cmd_q->int_rcvd = 1; +- +- /* Acknowledge the interrupt and wake the kthread */ +- iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status); +- wake_up_interruptible(&cmd_q->int_queue); +- } +- } +- +- return IRQ_HANDLED; +-} +- + static void ccp5_config(struct ccp_device *ccp) + { + /* Public side */ +diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h +index cd9a7051da3c..20aa30f272b6 100644 +--- a/drivers/crypto/ccp/ccp-dev.h ++++ b/drivers/crypto/ccp/ccp-dev.h +@@ -109,9 +109,8 @@ + #define INT_COMPLETION 0x1 + #define INT_ERROR 0x2 + #define INT_QUEUE_STOPPED 0x4 +-#define ALL_INTERRUPTS (INT_COMPLETION| \ +- INT_ERROR| \ +- INT_QUEUE_STOPPED) ++#define INT_EMPTY_QUEUE 0x8 ++#define SUPPORTED_INTERRUPTS (INT_COMPLETION | INT_ERROR) + + #define LSB_REGION_WIDTH 5 + #define MAX_LSB_CNT 8 +@@ -337,7 +336,10 @@ struct ccp_device { + void *dev_specific; + int (*get_irq)(struct ccp_device *ccp); + void (*free_irq)(struct ccp_device *ccp); ++ unsigned int qim; + unsigned int irq; ++ bool use_tasklet; ++ struct tasklet_struct irq_tasklet; + + /* I/O area used for device communication. The register mapping + * starts at an offset into the mapped bar. +diff --git a/drivers/crypto/ccp/ccp-pci.c b/drivers/crypto/ccp/ccp-pci.c +index 28a9996c1085..e880d4cf4ada 100644 +--- a/drivers/crypto/ccp/ccp-pci.c ++++ b/drivers/crypto/ccp/ccp-pci.c +@@ -69,6 +69,7 @@ static int ccp_get_msix_irqs(struct ccp_device *ccp) + goto e_irq; + } + } ++ ccp->use_tasklet = true; + + return 0; + +@@ -100,6 +101,7 @@ static int ccp_get_msi_irq(struct ccp_device *ccp) + dev_notice(dev, "unable to allocate MSI IRQ (%d)\n", ret); + goto e_msi; + } ++ ccp->use_tasklet = true; + + return 0; + +diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c +index 4721d50c4628..cc8f89a86ca2 100644 +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -287,7 +287,6 @@ static void s5p_sg_done(struct s5p_aes_dev *dev) + static void s5p_aes_complete(struct s5p_aes_dev *dev, int err) + { + dev->req->base.complete(&dev->req->base, err); +- dev->busy = false; + } + + static void s5p_unset_outdata(struct s5p_aes_dev *dev) +@@ -462,7 +461,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id) + spin_unlock_irqrestore(&dev->lock, flags); + + s5p_aes_complete(dev, 0); +- dev->busy = true; ++ /* Device is still busy */ + tasklet_schedule(&dev->tasklet); + } else { + /* +@@ -483,6 +482,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id) + + error: + s5p_sg_done(dev); ++ dev->busy = false; + spin_unlock_irqrestore(&dev->lock, flags); + s5p_aes_complete(dev, err); + +@@ -634,6 +634,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) + + indata_error: + s5p_sg_done(dev); ++ dev->busy = false; + spin_unlock_irqrestore(&dev->lock, flags); + s5p_aes_complete(dev, err); + } +diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c +index 53a016c3dffa..82e42867a21f 100644 +--- a/drivers/dax/dax.c ++++ b/drivers/dax/dax.c +@@ -76,36 +76,27 @@ struct dax_dev { + struct resource res[0]; + }; + ++/* ++ * Rely on the fact that drvdata is set before the attributes are ++ * registered, and that the attributes are unregistered before drvdata ++ * is cleared to assume that drvdata is always valid. ++ */ + static ssize_t id_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct dax_region *dax_region; +- ssize_t rc = -ENXIO; ++ struct dax_region *dax_region = dev_get_drvdata(dev); + +- device_lock(dev); +- dax_region = dev_get_drvdata(dev); +- if (dax_region) +- rc = sprintf(buf, "%d\n", dax_region->id); +- device_unlock(dev); +- +- return rc; ++ return sprintf(buf, "%d\n", dax_region->id); + } + static DEVICE_ATTR_RO(id); + + static ssize_t region_size_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct dax_region *dax_region; +- ssize_t rc = -ENXIO; ++ struct dax_region *dax_region = dev_get_drvdata(dev); + +- device_lock(dev); +- dax_region = dev_get_drvdata(dev); +- if (dax_region) +- rc = sprintf(buf, "%llu\n", (unsigned long long) +- resource_size(&dax_region->res)); +- device_unlock(dev); +- +- return rc; ++ return sprintf(buf, "%llu\n", (unsigned long long) ++ resource_size(&dax_region->res)); + } + static struct device_attribute dev_attr_region_size = __ATTR(size, 0444, + region_size_show, NULL); +@@ -113,16 +104,9 @@ static struct device_attribute dev_attr_region_size = __ATTR(size, 0444, + static ssize_t align_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- struct dax_region *dax_region; +- ssize_t rc = -ENXIO; ++ struct dax_region *dax_region = dev_get_drvdata(dev); + +- device_lock(dev); +- dax_region = dev_get_drvdata(dev); +- if (dax_region) +- rc = sprintf(buf, "%u\n", dax_region->align); +- device_unlock(dev); +- +- return rc; ++ return sprintf(buf, "%u\n", dax_region->align); + } + static DEVICE_ATTR_RO(align); + +@@ -646,13 +630,10 @@ static void dax_dev_release(struct device *dev) + kfree(dax_dev); + } + +-static void unregister_dax_dev(void *dev) ++static void kill_dax_dev(struct dax_dev *dax_dev) + { +- struct dax_dev *dax_dev = to_dax_dev(dev); + struct cdev *cdev = &dax_dev->cdev; + +- dev_dbg(dev, "%s\n", __func__); +- + /* + * Note, rcu is not protecting the liveness of dax_dev, rcu is + * ensuring that any fault handlers that might have seen +@@ -664,6 +645,15 @@ static void unregister_dax_dev(void *dev) + synchronize_srcu(&dax_srcu); + unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1); + cdev_del(cdev); ++} ++ ++static void unregister_dax_dev(void *dev) ++{ ++ struct dax_dev *dax_dev = to_dax_dev(dev); ++ ++ dev_dbg(dev, "%s\n", __func__); ++ ++ kill_dax_dev(dax_dev); + device_unregister(dev); + } + +@@ -740,6 +730,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region, + dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id); + rc = device_add(dev); + if (rc) { ++ kill_dax_dev(dax_dev); + put_device(dev); + return ERR_PTR(rc); + } +diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c +index c1fb545e8d78..42de5f22da93 100644 +--- a/drivers/infiniband/core/sysfs.c ++++ b/drivers/infiniband/core/sysfs.c +@@ -1301,7 +1301,7 @@ int ib_device_register_sysfs(struct ib_device *device, + free_port_list_attributes(device); + + err_unregister: +- device_unregister(class_dev); ++ device_del(class_dev); + + err: + return ret; +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 71580cc28c9e..5f76caede5ab 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1520,7 +1520,9 @@ int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid) + + if (!qp->device->attach_mcast) + return -ENOSYS; +- if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD) ++ if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD || ++ lid < be16_to_cpu(IB_MULTICAST_LID_BASE) || ++ lid == be16_to_cpu(IB_LID_PERMISSIVE)) + return -EINVAL; + + ret = qp->device->attach_mcast(qp, gid, lid); +@@ -1536,7 +1538,9 @@ int ib_detach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid) + + if (!qp->device->detach_mcast) + return -ENOSYS; +- if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD) ++ if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD || ++ lid < be16_to_cpu(IB_MULTICAST_LID_BASE) || ++ lid == be16_to_cpu(IB_LID_PERMISSIVE)) + return -EINVAL; + + ret = qp->device->detach_mcast(qp, gid, lid); +diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c +index 717ed4b159d3..6e46a6c002a7 100644 +--- a/drivers/infiniband/hw/hfi1/ruc.c ++++ b/drivers/infiniband/hw/hfi1/ruc.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2017 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -823,23 +823,29 @@ void hfi1_make_ruc_header(struct rvt_qp *qp, struct ib_other_headers *ohdr, + /* when sending, force a reschedule every one of these periods */ + #define SEND_RESCHED_TIMEOUT (5 * HZ) /* 5s in jiffies */ + ++void hfi1_do_send_from_rvt(struct rvt_qp *qp) ++{ ++ hfi1_do_send(qp, false); ++} ++ + void _hfi1_do_send(struct work_struct *work) + { + struct iowait *wait = container_of(work, struct iowait, iowork); + struct rvt_qp *qp = iowait_to_qp(wait); + +- hfi1_do_send(qp); ++ hfi1_do_send(qp, true); + } + + /** + * hfi1_do_send - perform a send on a QP + * @work: contains a pointer to the QP ++ * @in_thread: true if in a workqueue thread + * + * Process entries in the send work queue until credit or queue is + * exhausted. Only allow one CPU to send a packet per QP. + * Otherwise, two threads could send packets out of order. + */ +-void hfi1_do_send(struct rvt_qp *qp) ++void hfi1_do_send(struct rvt_qp *qp, bool in_thread) + { + struct hfi1_pkt_state ps; + struct hfi1_qp_priv *priv = qp->priv; +@@ -907,8 +913,10 @@ void hfi1_do_send(struct rvt_qp *qp) + qp->s_hdrwords = 0; + /* allow other tasks to run */ + if (unlikely(time_after(jiffies, timeout))) { +- if (workqueue_congested(cpu, +- ps.ppd->hfi1_wq)) { ++ if (!in_thread || ++ workqueue_congested( ++ cpu, ++ ps.ppd->hfi1_wq)) { + spin_lock_irqsave( + &qp->s_lock, + ps.flags); +@@ -921,11 +929,9 @@ void hfi1_do_send(struct rvt_qp *qp) + *ps.ppd->dd->send_schedule); + return; + } +- if (!irqs_disabled()) { +- cond_resched(); +- this_cpu_inc( +- *ps.ppd->dd->send_schedule); +- } ++ cond_resched(); ++ this_cpu_inc( ++ *ps.ppd->dd->send_schedule); + timeout = jiffies + (timeout_int) / 8; + } + spin_lock_irqsave(&qp->s_lock, ps.flags); +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index 95ed4d6da510..6002aa9317ef 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2017 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -1832,7 +1832,7 @@ int hfi1_register_ib_device(struct hfi1_devdata *dd) + dd->verbs_dev.rdi.driver_f.qp_priv_free = qp_priv_free; + dd->verbs_dev.rdi.driver_f.free_all_qps = free_all_qps; + dd->verbs_dev.rdi.driver_f.notify_qp_reset = notify_qp_reset; +- dd->verbs_dev.rdi.driver_f.do_send = hfi1_do_send; ++ dd->verbs_dev.rdi.driver_f.do_send = hfi1_do_send_from_rvt; + dd->verbs_dev.rdi.driver_f.schedule_send = hfi1_schedule_send; + dd->verbs_dev.rdi.driver_f.schedule_send_no_lock = _hfi1_schedule_send; + dd->verbs_dev.rdi.driver_f.get_pmtu_from_attr = get_pmtu_from_attr; +diff --git a/drivers/infiniband/hw/hfi1/verbs.h b/drivers/infiniband/hw/hfi1/verbs.h +index e6b893010e6d..228dc5545159 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.h ++++ b/drivers/infiniband/hw/hfi1/verbs.h +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2017 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -370,7 +370,9 @@ void hfi1_make_ruc_header(struct rvt_qp *qp, struct ib_other_headers *ohdr, + + void _hfi1_do_send(struct work_struct *work); + +-void hfi1_do_send(struct rvt_qp *qp); ++void hfi1_do_send_from_rvt(struct rvt_qp *qp); ++ ++void hfi1_do_send(struct rvt_qp *qp, bool in_thread); + + void hfi1_send_complete(struct rvt_qp *qp, struct rvt_swqe *wqe, + enum ib_wc_status status); +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 7031a8dd4d14..71a99b9daa52 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -2935,6 +2935,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev) + mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]); + + err_map: ++ mlx4_ib_free_eqs(dev, ibdev); + iounmap(ibdev->uar_map); + + err_uar: +diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c +index e010fe459e67..8772d88d324d 100644 +--- a/drivers/infiniband/hw/mlx4/mcg.c ++++ b/drivers/infiniband/hw/mlx4/mcg.c +@@ -1102,7 +1102,8 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy + while ((p = rb_first(&ctx->mcg_table)) != NULL) { + group = rb_entry(p, struct mcast_group, node); + if (atomic_read(&group->refcount)) +- mcg_warn_group(group, "group refcount %d!!! (pointer %p)\n", atomic_read(&group->refcount), group); ++ mcg_debug_group(group, "group refcount %d!!! (pointer %p)\n", ++ atomic_read(&group->refcount), group); + + force_clean_group(group); + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c +index 6bd5740e2691..09396bd7b02d 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c +@@ -281,8 +281,11 @@ void ipoib_delete_debug_files(struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + ++ WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n"); ++ WARN_ONCE(!priv->path_dentry, "null path debug file\n"); + debugfs_remove(priv->mcg_dentry); + debugfs_remove(priv->path_dentry); ++ priv->mcg_dentry = priv->path_dentry = NULL; + } + + int ipoib_register_debugfs(void) +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 4584c03bc355..d5931375d7a6 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -108,6 +108,33 @@ static struct ib_client ipoib_client = { + .get_net_dev_by_params = ipoib_get_net_dev_by_params, + }; + ++#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG ++static int ipoib_netdev_event(struct notifier_block *this, ++ unsigned long event, void *ptr) ++{ ++ struct netdev_notifier_info *ni = ptr; ++ struct net_device *dev = ni->dev; ++ ++ if (dev->netdev_ops->ndo_open != ipoib_open) ++ return NOTIFY_DONE; ++ ++ switch (event) { ++ case NETDEV_REGISTER: ++ ipoib_create_debug_files(dev); ++ break; ++ case NETDEV_CHANGENAME: ++ ipoib_delete_debug_files(dev); ++ ipoib_create_debug_files(dev); ++ break; ++ case NETDEV_UNREGISTER: ++ ipoib_delete_debug_files(dev); ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++#endif ++ + int ipoib_open(struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); +@@ -1665,8 +1692,6 @@ void ipoib_dev_cleanup(struct net_device *dev) + + ASSERT_RTNL(); + +- ipoib_delete_debug_files(dev); +- + /* Delete any child interfaces first */ + list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) { + /* Stop GC on child */ +@@ -2085,8 +2110,6 @@ static struct net_device *ipoib_add_port(const char *format, + goto register_failed; + } + +- ipoib_create_debug_files(priv->dev); +- + if (ipoib_cm_add_mode_attr(priv->dev)) + goto sysfs_failed; + if (ipoib_add_pkey_attr(priv->dev)) +@@ -2101,7 +2124,6 @@ static struct net_device *ipoib_add_port(const char *format, + return priv->dev; + + sysfs_failed: +- ipoib_delete_debug_files(priv->dev); + unregister_netdev(priv->dev); + + register_failed: +@@ -2186,6 +2208,12 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data) + kfree(dev_list); + } + ++#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG ++static struct notifier_block ipoib_netdev_notifier = { ++ .notifier_call = ipoib_netdev_event, ++}; ++#endif ++ + static int __init ipoib_init_module(void) + { + int ret; +@@ -2238,6 +2266,9 @@ static int __init ipoib_init_module(void) + if (ret) + goto err_client; + ++#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG ++ register_netdevice_notifier(&ipoib_netdev_notifier); ++#endif + return 0; + + err_client: +@@ -2255,6 +2286,9 @@ static int __init ipoib_init_module(void) + + static void __exit ipoib_cleanup_module(void) + { ++#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG ++ unregister_netdevice_notifier(&ipoib_netdev_notifier); ++#endif + ipoib_netlink_fini(); + ib_unregister_client(&ipoib_client); + ib_sa_unregister_client(&ipoib_sa_client); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +index fd811115af49..b692e9a2963c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +@@ -87,8 +87,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv, + goto register_failed; + } + +- ipoib_create_debug_files(priv->dev); +- + /* RTNL childs don't need proprietary sysfs entries */ + if (type == IPOIB_LEGACY_CHILD) { + if (ipoib_cm_add_mode_attr(priv->dev)) +@@ -109,7 +107,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv, + + sysfs_failed: + result = -ENOMEM; +- ipoib_delete_debug_files(priv->dev); + unregister_netdevice(priv->dev); + + register_failed: +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 8a9f742d8ed7..f6b9f2ce24ed 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1649,12 +1649,16 @@ static int crypt_set_key(struct crypt_config *cc, char *key) + + static int crypt_wipe_key(struct crypt_config *cc) + { ++ int r; ++ + clear_bit(DM_CRYPT_KEY_VALID, &cc->flags); +- memset(&cc->key, 0, cc->key_size * sizeof(u8)); ++ get_random_bytes(&cc->key, cc->key_size); + kzfree(cc->key_string); + cc->key_string = NULL; ++ r = crypt_setkey(cc); ++ memset(&cc->key, 0, cc->key_size * sizeof(u8)); + +- return crypt_setkey(cc); ++ return r; + } + + static void crypt_dtr(struct dm_target *ti) +diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c +index bf2b2676cb8a..80e3df1f1f7d 100644 +--- a/drivers/md/dm-era-target.c ++++ b/drivers/md/dm-era-target.c +@@ -961,15 +961,15 @@ static int metadata_commit(struct era_metadata *md) + } + } + +- r = save_sm_root(md); ++ r = dm_tm_pre_commit(md->tm); + if (r) { +- DMERR("%s: save_sm_root failed", __func__); ++ DMERR("%s: pre commit failed", __func__); + return r; + } + +- r = dm_tm_pre_commit(md->tm); ++ r = save_sm_root(md); + if (r) { +- DMERR("%s: pre commit failed", __func__); ++ DMERR("%s: save_sm_root failed", __func__); + return r; + } + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 6e702fc69a83..1153478d3545 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -961,10 +961,14 @@ int dm_mq_init_request_queue(struct mapped_device *md, struct dm_table *t) + dm_init_md_queue(md); + + /* backfill 'mq' sysfs registration normally done in blk_register_queue */ +- blk_mq_register_dev(disk_to_dev(md->disk), q); ++ err = blk_mq_register_dev(disk_to_dev(md->disk), q); ++ if (err) ++ goto out_cleanup_queue; + + return 0; + ++out_cleanup_queue: ++ blk_cleanup_queue(q); + out_tag_set: + blk_mq_free_tag_set(md->tag_set); + out_kfree_tag_set: +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index d1c05c12a9db..be869a990e38 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1070,6 +1070,7 @@ static void passdown_endio(struct bio *bio) + * to unmap (we ignore err). + */ + queue_passdown_pt2(bio->bi_private); ++ bio_put(bio); + } + + static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m) +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 7b0f647bcccb..34540b3055c7 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2094,6 +2094,8 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio) + (i == r1_bio->read_disk || + !test_bit(MD_RECOVERY_SYNC, &mddev->recovery)))) + continue; ++ if (test_bit(Faulty, &conf->mirrors[i].rdev->flags)) ++ continue; + + bio_set_op_attrs(wbio, REQ_OP_WRITE, 0); + if (test_bit(FailFast, &conf->mirrors[i].rdev->flags)) +diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c +index 97dd2925ed6e..4b76af2b8715 100644 +--- a/drivers/nvdimm/btt_devs.c ++++ b/drivers/nvdimm/btt_devs.c +@@ -314,7 +314,7 @@ int nd_btt_probe(struct device *dev, struct nd_namespace_common *ndns) + if (rc < 0) { + struct nd_btt *nd_btt = to_nd_btt(btt_dev); + +- __nd_detach_ndns(btt_dev, &nd_btt->ndns); ++ nd_detach_ndns(btt_dev, &nd_btt->ndns); + put_device(btt_dev); + } + +diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c +index ca6d572c48fc..8513c8ac963b 100644 +--- a/drivers/nvdimm/claim.c ++++ b/drivers/nvdimm/claim.c +@@ -21,8 +21,13 @@ + void __nd_detach_ndns(struct device *dev, struct nd_namespace_common **_ndns) + { + struct nd_namespace_common *ndns = *_ndns; ++ struct nvdimm_bus *nvdimm_bus; + +- lockdep_assert_held(&ndns->dev.mutex); ++ if (!ndns) ++ return; ++ ++ nvdimm_bus = walk_to_nvdimm_bus(&ndns->dev); ++ lockdep_assert_held(&nvdimm_bus->reconfig_mutex); + dev_WARN_ONCE(dev, ndns->claim != dev, "%s: invalid claim\n", __func__); + ndns->claim = NULL; + *_ndns = NULL; +@@ -37,18 +42,20 @@ void nd_detach_ndns(struct device *dev, + if (!ndns) + return; + get_device(&ndns->dev); +- device_lock(&ndns->dev); ++ nvdimm_bus_lock(&ndns->dev); + __nd_detach_ndns(dev, _ndns); +- device_unlock(&ndns->dev); ++ nvdimm_bus_unlock(&ndns->dev); + put_device(&ndns->dev); + } + + bool __nd_attach_ndns(struct device *dev, struct nd_namespace_common *attach, + struct nd_namespace_common **_ndns) + { ++ struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&attach->dev); ++ + if (attach->claim) + return false; +- lockdep_assert_held(&attach->dev.mutex); ++ lockdep_assert_held(&nvdimm_bus->reconfig_mutex); + dev_WARN_ONCE(dev, *_ndns, "%s: invalid claim\n", __func__); + attach->claim = dev; + *_ndns = attach; +@@ -61,9 +68,9 @@ bool nd_attach_ndns(struct device *dev, struct nd_namespace_common *attach, + { + bool claimed; + +- device_lock(&attach->dev); ++ nvdimm_bus_lock(&attach->dev); + claimed = __nd_attach_ndns(dev, attach, _ndns); +- device_unlock(&attach->dev); ++ nvdimm_bus_unlock(&attach->dev); + return claimed; + } + +@@ -114,7 +121,7 @@ static void nd_detach_and_reset(struct device *dev, + struct nd_namespace_common **_ndns) + { + /* detach the namespace and destroy / reset the device */ +- nd_detach_ndns(dev, _ndns); ++ __nd_detach_ndns(dev, _ndns); + if (is_idle(dev, *_ndns)) { + nd_device_unregister(dev, ND_ASYNC); + } else if (is_nd_btt(dev)) { +@@ -184,7 +191,7 @@ ssize_t nd_namespace_store(struct device *dev, + } + + WARN_ON_ONCE(!is_nvdimm_bus_locked(dev)); +- if (!nd_attach_ndns(dev, ndns, _ndns)) { ++ if (!__nd_attach_ndns(dev, ndns, _ndns)) { + dev_dbg(dev, "%s already claimed\n", + dev_name(&ndns->dev)); + len = -EBUSY; +diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c +index 45fa82cae87c..c1b6556aea6e 100644 +--- a/drivers/nvdimm/dax_devs.c ++++ b/drivers/nvdimm/dax_devs.c +@@ -124,7 +124,7 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns) + dev_dbg(dev, "%s: dax: %s\n", __func__, + rc == 0 ? dev_name(dax_dev) : "<none>"); + if (rc < 0) { +- __nd_detach_ndns(dax_dev, &nd_pfn->ndns); ++ nd_detach_ndns(dax_dev, &nd_pfn->ndns); + put_device(dax_dev); + } else + __nd_device_register(dax_dev); +diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c +index 6c033c9a2f06..335c8175410b 100644 +--- a/drivers/nvdimm/pfn_devs.c ++++ b/drivers/nvdimm/pfn_devs.c +@@ -484,7 +484,7 @@ int nd_pfn_probe(struct device *dev, struct nd_namespace_common *ndns) + dev_dbg(dev, "%s: pfn: %s\n", __func__, + rc == 0 ? dev_name(pfn_dev) : "<none>"); + if (rc < 0) { +- __nd_detach_ndns(pfn_dev, &nd_pfn->ndns); ++ nd_detach_ndns(pfn_dev, &nd_pfn->ndns); + put_device(pfn_dev); + } else + __nd_device_register(pfn_dev); +@@ -538,7 +538,8 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn, + nd_pfn->npfns = le64_to_cpu(pfn_sb->npfns); + altmap = NULL; + } else if (nd_pfn->mode == PFN_MODE_PMEM) { +- nd_pfn->npfns = (resource_size(res) - offset) / PAGE_SIZE; ++ nd_pfn->npfns = PFN_SECTION_ALIGN_UP((resource_size(res) ++ - offset) / PAGE_SIZE); + if (le64_to_cpu(nd_pfn->pfn_sb->npfns) > nd_pfn->npfns) + dev_info(&nd_pfn->dev, + "number of pfns truncated from %lld to %ld\n", +@@ -625,7 +626,8 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn) + */ + start += start_pad; + size = resource_size(&nsio->res); +- npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K; ++ npfns = PFN_SECTION_ALIGN_UP((size - start_pad - end_trunc - SZ_8K) ++ / PAGE_SIZE); + if (nd_pfn->mode == PFN_MODE_PMEM) { + /* + * vmemmap_populate_hugepages() allocates the memmap array in +diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c +index 5b536be5a12e..0fc18262a2bc 100644 +--- a/drivers/nvdimm/pmem.c ++++ b/drivers/nvdimm/pmem.c +@@ -388,12 +388,12 @@ static void nd_pmem_shutdown(struct device *dev) + + static void nd_pmem_notify(struct device *dev, enum nvdimm_event event) + { +- struct pmem_device *pmem = dev_get_drvdata(dev); +- struct nd_region *nd_region = to_region(pmem); ++ struct nd_region *nd_region; + resource_size_t offset = 0, end_trunc = 0; + struct nd_namespace_common *ndns; + struct nd_namespace_io *nsio; + struct resource res; ++ struct badblocks *bb; + + if (event != NVDIMM_REVALIDATE_POISON) + return; +@@ -402,20 +402,33 @@ static void nd_pmem_notify(struct device *dev, enum nvdimm_event event) + struct nd_btt *nd_btt = to_nd_btt(dev); + + ndns = nd_btt->ndns; +- } else if (is_nd_pfn(dev)) { +- struct nd_pfn *nd_pfn = to_nd_pfn(dev); +- struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb; ++ nd_region = to_nd_region(ndns->dev.parent); ++ nsio = to_nd_namespace_io(&ndns->dev); ++ bb = &nsio->bb; ++ } else { ++ struct pmem_device *pmem = dev_get_drvdata(dev); + +- ndns = nd_pfn->ndns; +- offset = pmem->data_offset + __le32_to_cpu(pfn_sb->start_pad); +- end_trunc = __le32_to_cpu(pfn_sb->end_trunc); +- } else +- ndns = to_ndns(dev); ++ nd_region = to_region(pmem); ++ bb = &pmem->bb; ++ ++ if (is_nd_pfn(dev)) { ++ struct nd_pfn *nd_pfn = to_nd_pfn(dev); ++ struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb; ++ ++ ndns = nd_pfn->ndns; ++ offset = pmem->data_offset + ++ __le32_to_cpu(pfn_sb->start_pad); ++ end_trunc = __le32_to_cpu(pfn_sb->end_trunc); ++ } else { ++ ndns = to_ndns(dev); ++ } ++ ++ nsio = to_nd_namespace_io(&ndns->dev); ++ } + +- nsio = to_nd_namespace_io(&ndns->dev); + res.start = nsio->res.start + offset; + res.end = nsio->res.end - end_trunc; +- nvdimm_badblocks_populate(nd_region, &pmem->bb, &res); ++ nvdimm_badblocks_populate(nd_region, bb, &res); + } + + MODULE_ALIAS("pmem"); +diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c +index b7cb5066d961..378885f4050b 100644 +--- a/drivers/nvdimm/region_devs.c ++++ b/drivers/nvdimm/region_devs.c +@@ -968,17 +968,20 @@ EXPORT_SYMBOL_GPL(nvdimm_flush); + */ + int nvdimm_has_flush(struct nd_region *nd_region) + { +- struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev); + int i; + + /* no nvdimm == flushing capability unknown */ + if (nd_region->ndr_mappings == 0) + return -ENXIO; + +- for (i = 0; i < nd_region->ndr_mappings; i++) +- /* flush hints present, flushing required */ +- if (ndrd_get_flush_wpq(ndrd, i, 0)) ++ for (i = 0; i < nd_region->ndr_mappings; i++) { ++ struct nd_mapping *nd_mapping = &nd_region->mapping[i]; ++ struct nvdimm *nvdimm = nd_mapping->nvdimm; ++ ++ /* flush hints present / available */ ++ if (nvdimm->num_flush) + return 1; ++ } + + /* + * The platform defines dimm devices without hints, assume +diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c +index 70390de66e0e..eb0a095efe9c 100644 +--- a/drivers/staging/comedi/drivers/jr3_pci.c ++++ b/drivers/staging/comedi/drivers/jr3_pci.c +@@ -611,7 +611,7 @@ static void jr3_pci_poll_dev(unsigned long data) + s = &dev->subdevices[i]; + spriv = s->private; + +- if (now > spriv->next_time_min) { ++ if (time_after_eq(now, spriv->next_time_min)) { + struct jr3_pci_poll_delay sub_delay; + + sub_delay = jr3_pci_poll_subdevice(s); +@@ -727,11 +727,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev, + s->insn_read = jr3_pci_ai_insn_read; + + spriv = jr3_pci_alloc_spriv(dev, s); +- if (spriv) { +- /* Channel specific range and maxdata */ +- s->range_table_list = spriv->range_table_list; +- s->maxdata_list = spriv->maxdata_list; +- } ++ if (!spriv) ++ return -ENOMEM; ++ ++ /* Channel specific range and maxdata */ ++ s->range_table_list = spriv->range_table_list; ++ s->maxdata_list = spriv->maxdata_list; + } + + /* Reset DSP card */ +diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c +index 400969170d1c..f03e43b1b5f6 100644 +--- a/drivers/staging/gdm724x/gdm_mux.c ++++ b/drivers/staging/gdm724x/gdm_mux.c +@@ -664,9 +664,8 @@ static int __init gdm_usb_mux_init(void) + + static void __exit gdm_usb_mux_exit(void) + { +- unregister_lte_tty_driver(); +- + usb_deregister(&gdm_mux_driver); ++ unregister_lte_tty_driver(); + } + + module_init(gdm_usb_mux_init); +diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c +index e9b6b21f7422..f759aa8a342d 100644 +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -47,15 +47,25 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer) + { + int status = 0; ++ u8 *usb_buffer; + + if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags)) + return STATUS_FAILURE; + + mutex_lock(&priv->usb_lock); + ++ usb_buffer = kmemdup(buffer, length, GFP_KERNEL); ++ if (!usb_buffer) { ++ mutex_unlock(&priv->usb_lock); ++ return -ENOMEM; ++ } ++ + status = usb_control_msg(priv->usb, +- usb_sndctrlpipe(priv->usb, 0), request, 0x40, value, +- index, buffer, length, USB_CTL_WAIT); ++ usb_sndctrlpipe(priv->usb, 0), ++ request, 0x40, value, ++ index, usb_buffer, length, USB_CTL_WAIT); ++ ++ kfree(usb_buffer); + + mutex_unlock(&priv->usb_lock); + +@@ -75,15 +85,28 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer) + { + int status; ++ u8 *usb_buffer; + + if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags)) + return STATUS_FAILURE; + + mutex_lock(&priv->usb_lock); + ++ usb_buffer = kmalloc(length, GFP_KERNEL); ++ if (!usb_buffer) { ++ mutex_unlock(&priv->usb_lock); ++ return -ENOMEM; ++ } ++ + status = usb_control_msg(priv->usb, +- usb_rcvctrlpipe(priv->usb, 0), request, 0xc0, value, +- index, buffer, length, USB_CTL_WAIT); ++ usb_rcvctrlpipe(priv->usb, 0), ++ request, 0xc0, value, ++ index, usb_buffer, length, USB_CTL_WAIT); ++ ++ if (status == length) ++ memcpy(buffer, usb_buffer, length); ++ ++ kfree(usb_buffer); + + mutex_unlock(&priv->usb_lock); + +diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c +index 3775706578b2..99eb12469dcb 100644 +--- a/drivers/staging/wilc1000/linux_wlan.c ++++ b/drivers/staging/wilc1000/linux_wlan.c +@@ -1251,11 +1251,12 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type, + else + strcpy(ndev->name, "p2p%d"); + +- vif->idx = wl->vif_num; + vif->wilc = *wilc; + vif->ndev = ndev; + wl->vif[i] = vif; + wl->vif_num = i; ++ vif->idx = wl->vif_num; ++ + ndev->netdev_ops = &wilc_netdev_ops; + + { +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index da2c73a255de..4d970a7bbd97 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4673,6 +4673,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) + continue; + } + atomic_set(&sess->session_reinstatement, 1); ++ atomic_set(&sess->session_fall_back_to_erl0, 1); + spin_unlock(&sess->conn_lock); + + list_move_tail(&se_sess->sess_list, &free_list); +diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c +index bf40f03755dd..11291c1c779a 100644 +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -1531,6 +1531,7 @@ static void lio_tpg_close_session(struct se_session *se_sess) + return; + } + atomic_set(&sess->session_reinstatement, 1); ++ atomic_set(&sess->session_fall_back_to_erl0, 1); + spin_unlock(&sess->conn_lock); + + iscsit_stop_time2retain_timer(sess); +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 450f51deb2a2..d11c9891134d 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -206,6 +206,7 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn) + initiatorname_param->value) && + (sess_p->sess_ops->SessionType == sessiontype))) { + atomic_set(&sess_p->session_reinstatement, 1); ++ atomic_set(&sess_p->session_fall_back_to_erl0, 1); + spin_unlock(&sess_p->conn_lock); + iscsit_inc_session_usage_count(sess_p); + iscsit_stop_time2retain_timer(sess_p); +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 87aa376a1a1a..e00050ccb61d 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -595,8 +595,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + if (ret < 0) + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + +- if (ret) +- target_complete_cmd(cmd, SAM_STAT_GOOD); ++ target_complete_cmd(cmd, SAM_STAT_GOOD); + return 0; + } + +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index 6ec5dded4ae0..cfb10b48c0cc 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -507,8 +507,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes + * been failed with a non-zero SCSI status. + */ + if (cmd->scsi_status) { +- pr_err("compare_and_write_callback: non zero scsi_status:" ++ pr_debug("compare_and_write_callback: non zero scsi_status:" + " 0x%02x\n", cmd->scsi_status); ++ *post_ret = 1; ++ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) ++ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + goto out; + } + +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index a23fa5ed1d67..2b907385b4a8 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -216,16 +216,11 @@ static int pty_signal(struct tty_struct *tty, int sig) + static void pty_flush_buffer(struct tty_struct *tty) + { + struct tty_struct *to = tty->link; +- struct tty_ldisc *ld; + + if (!to) + return; + +- ld = tty_ldisc_ref(to); +- tty_buffer_flush(to, ld); +- if (ld) +- tty_ldisc_deref(ld); +- ++ tty_buffer_flush(to, NULL); + if (to->packet) { + spin_lock_irq(&tty->ctrl_lock); + tty->ctrl_status |= TIOCPKT_FLUSHWRITE; +diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c +index a2a529994ba5..44e5b5bf713b 100644 +--- a/drivers/tty/serial/omap-serial.c ++++ b/drivers/tty/serial/omap-serial.c +@@ -1712,7 +1712,8 @@ static int serial_omap_probe(struct platform_device *pdev) + return 0; + + err_add_port: +- pm_runtime_put(&pdev->dev); ++ pm_runtime_dont_use_autosuspend(&pdev->dev); ++ pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); + pm_qos_remove_request(&up->pm_qos_request); + device_init_wakeup(up->dev, false); +@@ -1725,9 +1726,13 @@ static int serial_omap_remove(struct platform_device *dev) + { + struct uart_omap_port *up = platform_get_drvdata(dev); + ++ pm_runtime_get_sync(up->dev); ++ ++ uart_remove_one_port(&serial_omap_reg, &up->port); ++ ++ pm_runtime_dont_use_autosuspend(up->dev); + pm_runtime_put_sync(up->dev); + pm_runtime_disable(up->dev); +- uart_remove_one_port(&serial_omap_reg, &up->port); + pm_qos_remove_request(&up->pm_qos_request); + device_init_wakeup(&dev->dev, false); + +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index 3e2ef4fd7382..d65f92bcd0f1 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -906,14 +906,13 @@ static int s3c24xx_serial_request_dma(struct s3c24xx_uart_port *p) + return -ENOMEM; + } + +- dma->rx_addr = dma_map_single(dma->rx_chan->device->dev, dma->rx_buf, ++ dma->rx_addr = dma_map_single(p->port.dev, dma->rx_buf, + dma->rx_size, DMA_FROM_DEVICE); + + spin_lock_irqsave(&p->port.lock, flags); + + /* TX buffer */ +- dma->tx_addr = dma_map_single(dma->tx_chan->device->dev, +- p->port.state->xmit.buf, ++ dma->tx_addr = dma_map_single(p->port.dev, p->port.state->xmit.buf, + UART_XMIT_SIZE, DMA_TO_DEVICE); + + spin_unlock_irqrestore(&p->port.lock, flags); +@@ -927,7 +926,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p) + + if (dma->rx_chan) { + dmaengine_terminate_all(dma->rx_chan); +- dma_unmap_single(dma->rx_chan->device->dev, dma->rx_addr, ++ dma_unmap_single(p->port.dev, dma->rx_addr, + dma->rx_size, DMA_FROM_DEVICE); + kfree(dma->rx_buf); + dma_release_channel(dma->rx_chan); +@@ -936,7 +935,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p) + + if (dma->tx_chan) { + dmaengine_terminate_all(dma->tx_chan); +- dma_unmap_single(dma->tx_chan->device->dev, dma->tx_addr, ++ dma_unmap_single(p->port.dev, dma->tx_addr, + UART_XMIT_SIZE, DMA_TO_DEVICE); + dma_release_channel(dma->tx_chan); + dma->tx_chan = NULL; +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 0a6369510f2d..0b845e550fbd 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -58,7 +58,6 @@ MODULE_DEVICE_TABLE (usb, wdm_ids); + #define WDM_SUSPENDING 8 + #define WDM_RESETTING 9 + #define WDM_OVERFLOW 10 +-#define WDM_DRAIN_ON_OPEN 11 + + #define WDM_MAX 16 + +@@ -182,7 +181,7 @@ static void wdm_in_callback(struct urb *urb) + "nonzero urb status received: -ESHUTDOWN\n"); + goto skip_error; + case -EPIPE: +- dev_dbg(&desc->intf->dev, ++ dev_err(&desc->intf->dev, + "nonzero urb status received: -EPIPE\n"); + break; + default: +@@ -210,25 +209,6 @@ static void wdm_in_callback(struct urb *urb) + desc->reslength = length; + } + } +- +- /* +- * Handling devices with the WDM_DRAIN_ON_OPEN flag set: +- * If desc->resp_count is unset, then the urb was submitted +- * without a prior notification. If the device returned any +- * data, then this implies that it had messages queued without +- * notifying us. Continue reading until that queue is flushed. +- */ +- if (!desc->resp_count) { +- if (!length) { +- /* do not propagate the expected -EPIPE */ +- desc->rerr = 0; +- goto unlock; +- } +- dev_dbg(&desc->intf->dev, "got %d bytes without notification\n", length); +- set_bit(WDM_RESPONDING, &desc->flags); +- usb_submit_urb(desc->response, GFP_ATOMIC); +- } +- + skip_error: + set_bit(WDM_READ, &desc->flags); + wake_up(&desc->wait); +@@ -243,7 +223,6 @@ static void wdm_in_callback(struct urb *urb) + service_outstanding_interrupt(desc); + } + +-unlock: + spin_unlock(&desc->iuspin); + } + +@@ -686,17 +665,6 @@ static int wdm_open(struct inode *inode, struct file *file) + dev_err(&desc->intf->dev, + "Error submitting int urb - %d\n", rv); + rv = usb_translate_errors(rv); +- } else if (test_bit(WDM_DRAIN_ON_OPEN, &desc->flags)) { +- /* +- * Some devices keep pending messages queued +- * without resending notifications. We must +- * flush the message queue before we can +- * assume a one-to-one relationship between +- * notifications and messages in the queue +- */ +- dev_dbg(&desc->intf->dev, "draining queued data\n"); +- set_bit(WDM_RESPONDING, &desc->flags); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); + } + } else { + rv = 0; +@@ -803,8 +771,7 @@ static void wdm_rxwork(struct work_struct *work) + /* --- hotplug --- */ + + static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor *ep, +- u16 bufsize, int (*manage_power)(struct usb_interface *, int), +- bool drain_on_open) ++ u16 bufsize, int (*manage_power)(struct usb_interface *, int)) + { + int rv = -ENOMEM; + struct wdm_device *desc; +@@ -891,68 +858,6 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor + + desc->manage_power = manage_power; + +- /* +- * "drain_on_open" enables a hack to work around a firmware +- * issue observed on network functions, in particular MBIM +- * functions. +- * +- * Quoting section 7 of the CDC-WMC r1.1 specification: +- * +- * "The firmware shall interpret GetEncapsulatedResponse as a +- * request to read response bytes. The firmware shall send +- * the next wLength bytes from the response. The firmware +- * shall allow the host to retrieve data using any number of +- * GetEncapsulatedResponse requests. The firmware shall +- * return a zero- length reply if there are no data bytes +- * available. +- * +- * The firmware shall send ResponseAvailable notifications +- * periodically, using any appropriate algorithm, to inform +- * the host that there is data available in the reply +- * buffer. The firmware is allowed to send ResponseAvailable +- * notifications even if there is no data available, but +- * this will obviously reduce overall performance." +- * +- * These requirements, although they make equally sense, are +- * often not implemented by network functions. Some firmwares +- * will queue data indefinitely, without ever resending a +- * notification. The result is that the driver and firmware +- * loses "syncronization" if the driver ever fails to respond +- * to a single notification, something which easily can happen +- * on release(). When this happens, the driver will appear to +- * never receive notifications for the most current data. Each +- * notification will only cause a single read, which returns +- * the oldest data in the firmware's queue. +- * +- * The "drain_on_open" hack resolves the situation by draining +- * data from the firmware until none is returned, without a +- * prior notification. +- * +- * This will inevitably race with the firmware, risking that +- * we read data from the device before handling the associated +- * notification. To make things worse, some of the devices +- * needing the hack do not implement the "return zero if no +- * data is available" requirement either. Instead they return +- * an error on the subsequent read in this case. This means +- * that "winning" the race can cause an unexpected EIO to +- * userspace. +- * +- * "winning" the race is more likely on resume() than on +- * open(), and the unexpected error is more harmful in the +- * middle of an open session. The hack is therefore only +- * applied on open(), and not on resume() where it logically +- * would be equally necessary. So we define open() as the only +- * driver <-> device "syncronization point". Should we happen +- * to lose a notification after open(), then syncronization +- * will be lost until release() +- * +- * The hack should not be enabled for CDC WDM devices +- * conforming to the CDC-WMC r1.1 specification. This is +- * ensured by setting drain_on_open to false in wdm_probe(). +- */ +- if (drain_on_open) +- set_bit(WDM_DRAIN_ON_OPEN, &desc->flags); +- + spin_lock(&wdm_device_list_lock); + list_add(&desc->device_list, &wdm_device_list); + spin_unlock(&wdm_device_list_lock); +@@ -1006,7 +911,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id) + goto err; + ep = &iface->endpoint[0].desc; + +- rv = wdm_create(intf, ep, maxcom, &wdm_manage_power, false); ++ rv = wdm_create(intf, ep, maxcom, &wdm_manage_power); + + err: + return rv; +@@ -1038,7 +943,7 @@ struct usb_driver *usb_cdc_wdm_register(struct usb_interface *intf, + { + int rv = -EINVAL; + +- rv = wdm_create(intf, ep, bufsize, manage_power, true); ++ rv = wdm_create(intf, ep, bufsize, manage_power); + if (rv < 0) + goto err; + +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index cdee5130638b..eb87a259d55c 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1331,6 +1331,24 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg) + */ + if (udev->parent && !PMSG_IS_AUTO(msg)) + status = 0; ++ ++ /* ++ * If the device is inaccessible, don't try to resume ++ * suspended interfaces and just return the error. ++ */ ++ if (status && status != -EBUSY) { ++ int err; ++ u16 devstat; ++ ++ err = usb_get_status(udev, USB_RECIP_DEVICE, 0, ++ &devstat); ++ if (err) { ++ dev_err(&udev->dev, ++ "Failed to suspend device, error %d\n", ++ status); ++ goto done; ++ } ++ } + } + + /* If the suspend failed, resume interfaces that did get suspended */ +@@ -1763,6 +1781,9 @@ static int autosuspend_check(struct usb_device *udev) + int w, i; + struct usb_interface *intf; + ++ if (udev->state == USB_STATE_NOTATTACHED) ++ return -ENODEV; ++ + /* Fail if autosuspend is disabled, or any interfaces are in use, or + * any interface drivers require remote wakeup but it isn't available. + */ +diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c +index e26bd5e773ad..87ad6b6bfee8 100644 +--- a/drivers/usb/core/file.c ++++ b/drivers/usb/core/file.c +@@ -29,6 +29,7 @@ + #define MAX_USB_MINORS 256 + static const struct file_operations *usb_minors[MAX_USB_MINORS]; + static DECLARE_RWSEM(minor_rwsem); ++static DEFINE_MUTEX(init_usb_class_mutex); + + static int usb_open(struct inode *inode, struct file *file) + { +@@ -111,8 +112,9 @@ static void release_usb_class(struct kref *kref) + + static void destroy_usb_class(void) + { +- if (usb_class) +- kref_put(&usb_class->kref, release_usb_class); ++ mutex_lock(&init_usb_class_mutex); ++ kref_put(&usb_class->kref, release_usb_class); ++ mutex_unlock(&init_usb_class_mutex); + } + + int usb_major_init(void) +@@ -173,7 +175,10 @@ int usb_register_dev(struct usb_interface *intf, + if (intf->minor >= 0) + return -EADDRINUSE; + ++ mutex_lock(&init_usb_class_mutex); + retval = init_usb_class(); ++ mutex_unlock(&init_usb_class_mutex); ++ + if (retval) + return retval; + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 48fbf523d186..4e87b94cca92 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1066,6 +1066,9 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + + portstatus = portchange = 0; + status = hub_port_status(hub, port1, &portstatus, &portchange); ++ if (status) ++ goto abort; ++ + if (udev || (portstatus & USB_PORT_STAT_CONNECTION)) + dev_dbg(&port_dev->dev, "status %04x change %04x\n", + portstatus, portchange); +@@ -1198,7 +1201,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + + /* Scan all ports that need attention */ + kick_hub_wq(hub); +- ++ abort: + if (type == HUB_INIT2 || type == HUB_INIT3) { + /* Allow autosuspend if it was suppressed */ + disconnected: +@@ -2084,6 +2087,12 @@ void usb_disconnect(struct usb_device **pdev) + dev_info(&udev->dev, "USB disconnect, device number %d\n", + udev->devnum); + ++ /* ++ * Ensure that the pm runtime code knows that the USB device ++ * is in the process of being disconnected. ++ */ ++ pm_runtime_barrier(&udev->dev); ++ + usb_lock_device(udev); + + hub_disconnect_children(udev); +diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig +index 8ad203296079..f3ee80ece682 100644 +--- a/drivers/usb/gadget/Kconfig ++++ b/drivers/usb/gadget/Kconfig +@@ -460,6 +460,7 @@ config USB_CONFIGFS_F_TCM + choice + tristate "USB Gadget Drivers" + default USB_ETH ++ optional + help + A Linux "Gadget Driver" talks to the USB Peripheral Controller + driver through the abstract "gadget" API. Some other operating +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 8414ed2a02de..0d11dbd04de8 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1493,6 +1493,17 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + */ + max_esit_payload = xhci_get_max_esit_payload(udev, ep); + interval = xhci_get_endpoint_interval(udev, ep); ++ ++ /* Periodic endpoint bInterval limit quirk */ ++ if (usb_endpoint_xfer_int(&ep->desc) || ++ usb_endpoint_xfer_isoc(&ep->desc)) { ++ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) && ++ udev->speed >= USB_SPEED_HIGH && ++ interval >= 7) { ++ interval = 6; ++ } ++ } ++ + mult = xhci_get_endpoint_mult(udev, ep); + max_packet = usb_endpoint_maxp(&ep->desc); + max_burst = xhci_get_endpoint_max_burst(udev, ep); +@@ -2474,7 +2485,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) + (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) | + xhci->cmd_ring->cycle_state; + xhci_dbg_trace(xhci, trace_xhci_dbg_init, +- "// Setting command ring address to 0x%x", val); ++ "// Setting command ring address to 0x%016llx", val_64); + xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring); + xhci_dbg_cmd_ptrs(xhci); + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 954abfd5014d..93f566cb968b 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -199,6 +199,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + pdev->device == 0x1042) + xhci->quirks |= XHCI_BROKEN_STREAMS; + ++ if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241) ++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7; ++ + if (xhci->quirks & XHCI_RESET_ON_RESUME) + xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, + "QUIRK: Resetting on resume"); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index ea18bf49c2eb..98eb5d50e03d 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1652,6 +1652,7 @@ struct xhci_hcd { + #define XHCI_MISSING_CAS (1 << 24) + /* For controller with a broken Port Disable implementation */ + #define XHCI_BROKEN_PORT_PED (1 << 25) ++#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c +index 3525626bf086..7bfb6b78f3a3 100644 +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -159,6 +159,7 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) + case USB_ENDPOINT_XFER_INT: + if (dev->info->intr) + goto try_intr; ++ continue; + case USB_ENDPOINT_XFER_ISOC: + if (dev->info->iso) + goto try_iso; +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index c6c388bed156..b3c97c0cc882 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -873,6 +873,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID, + USB_CLASS_VENDOR_SPEC, + USB_SUBCLASS_VENDOR_SPEC, 0x00) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, + { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, + { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 48ee04c94a75..71fb9e59db71 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -873,6 +873,12 @@ + #define FIC_VID 0x1457 + #define FIC_NEO1973_DEBUG_PID 0x5118 + ++/* ++ * Actel / Microsemi ++ */ ++#define ACTEL_VID 0x1514 ++#define MICROSEMI_ARROW_SF2PLUS_BOARD_PID 0x2008 ++ + /* Olimex */ + #define OLIMEX_VID 0x15BA + #define OLIMEX_ARM_USB_OCD_PID 0x0003 +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index b3cc33fa6d26..5ecd400dcf8c 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -243,69 +243,46 @@ static int vfio_iova_put_vfio_pfn(struct vfio_dma *dma, struct vfio_pfn *vpfn) + return ret; + } + +-struct vwork { +- struct mm_struct *mm; +- long npage; +- struct work_struct work; +-}; +- +-/* delayed decrement/increment for locked_vm */ +-static void vfio_lock_acct_bg(struct work_struct *work) +-{ +- struct vwork *vwork = container_of(work, struct vwork, work); +- struct mm_struct *mm; +- +- mm = vwork->mm; +- down_write(&mm->mmap_sem); +- mm->locked_vm += vwork->npage; +- up_write(&mm->mmap_sem); +- mmput(mm); +- kfree(vwork); +-} +- +-static void vfio_lock_acct(struct task_struct *task, long npage) ++static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap) + { +- struct vwork *vwork; + struct mm_struct *mm; + bool is_current; ++ int ret; + + if (!npage) +- return; ++ return 0; + + is_current = (task->mm == current->mm); + + mm = is_current ? task->mm : get_task_mm(task); + if (!mm) +- return; /* process exited */ ++ return -ESRCH; /* process exited */ + +- if (down_write_trylock(&mm->mmap_sem)) { +- mm->locked_vm += npage; +- up_write(&mm->mmap_sem); +- if (!is_current) +- mmput(mm); +- return; +- } ++ ret = down_write_killable(&mm->mmap_sem); ++ if (!ret) { ++ if (npage > 0) { ++ if (lock_cap ? !*lock_cap : ++ !has_capability(task, CAP_IPC_LOCK)) { ++ unsigned long limit; ++ ++ limit = task_rlimit(task, ++ RLIMIT_MEMLOCK) >> PAGE_SHIFT; ++ ++ if (mm->locked_vm + npage > limit) ++ ret = -ENOMEM; ++ } ++ } ++ ++ if (!ret) ++ mm->locked_vm += npage; + +- if (is_current) { +- mm = get_task_mm(task); +- if (!mm) +- return; ++ up_write(&mm->mmap_sem); + } + +- /* +- * Couldn't get mmap_sem lock, so must setup to update +- * mm->locked_vm later. If locked_vm were atomic, we +- * wouldn't need this silliness +- */ +- vwork = kmalloc(sizeof(struct vwork), GFP_KERNEL); +- if (WARN_ON(!vwork)) { ++ if (!is_current) + mmput(mm); +- return; +- } +- INIT_WORK(&vwork->work, vfio_lock_acct_bg); +- vwork->mm = mm; +- vwork->npage = npage; +- schedule_work(&vwork->work); ++ ++ return ret; + } + + /* +@@ -402,7 +379,7 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + long npage, unsigned long *pfn_base) + { +- unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; ++ unsigned long pfn = 0, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + bool lock_cap = capable(CAP_IPC_LOCK); + long ret, pinned = 0, lock_acct = 0; + bool rsvd; +@@ -439,8 +416,6 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + /* Lock all the consecutive pages from pfn_base */ + for (vaddr += PAGE_SIZE, iova += PAGE_SIZE; pinned < npage; + pinned++, vaddr += PAGE_SIZE, iova += PAGE_SIZE) { +- unsigned long pfn = 0; +- + ret = vaddr_get_pfn(current->mm, vaddr, dma->prot, &pfn); + if (ret) + break; +@@ -457,14 +432,25 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + put_pfn(pfn, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", + __func__, limit << PAGE_SHIFT); +- break; ++ ret = -ENOMEM; ++ goto unpin_out; + } + lock_acct++; + } + } + + out: +- vfio_lock_acct(current, lock_acct); ++ ret = vfio_lock_acct(current, lock_acct, &lock_cap); ++ ++unpin_out: ++ if (ret) { ++ if (!rsvd) { ++ for (pfn = *pfn_base ; pinned ; pfn++, pinned--) ++ put_pfn(pfn, dma->prot); ++ } ++ ++ return ret; ++ } + + return pinned; + } +@@ -485,7 +471,7 @@ static long vfio_unpin_pages_remote(struct vfio_dma *dma, dma_addr_t iova, + } + + if (do_accounting) +- vfio_lock_acct(dma->task, locked - unlocked); ++ vfio_lock_acct(dma->task, locked - unlocked, NULL); + + return unlocked; + } +@@ -519,8 +505,14 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr, + goto pin_page_exit; + } + +- if (!rsvd && do_accounting) +- vfio_lock_acct(dma->task, 1); ++ if (!rsvd && do_accounting) { ++ ret = vfio_lock_acct(dma->task, 1, &lock_cap); ++ if (ret) { ++ put_pfn(*pfn_base, dma->prot); ++ goto pin_page_exit; ++ } ++ } ++ + ret = 1; + + pin_page_exit: +@@ -540,7 +532,7 @@ static int vfio_unpin_page_external(struct vfio_dma *dma, dma_addr_t iova, + unlocked = vfio_iova_put_vfio_pfn(dma, vpfn); + + if (do_accounting) +- vfio_lock_acct(dma->task, -unlocked); ++ vfio_lock_acct(dma->task, -unlocked, NULL); + + return unlocked; + } +@@ -737,7 +729,7 @@ static long vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma, + + dma->iommu_mapped = false; + if (do_accounting) { +- vfio_lock_acct(dma->task, -unlocked); ++ vfio_lock_acct(dma->task, -unlocked, NULL); + return 0; + } + return unlocked; +@@ -1346,7 +1338,7 @@ static void vfio_iommu_unmap_unpin_reaccount(struct vfio_iommu *iommu) + if (!is_invalid_reserved_pfn(vpfn->pfn)) + locked++; + } +- vfio_lock_acct(dma->task, locked - unlocked); ++ vfio_lock_acct(dma->task, locked - unlocked, NULL); + } + } + +diff --git a/fs/block_dev.c b/fs/block_dev.c +index b94e2a4974a1..68a5c769495f 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -103,12 +103,11 @@ void invalidate_bdev(struct block_device *bdev) + { + struct address_space *mapping = bdev->bd_inode->i_mapping; + +- if (mapping->nrpages == 0) +- return; +- +- invalidate_bh_lrus(); +- lru_add_drain_all(); /* make sure all lru add caches are flushed */ +- invalidate_mapping_pages(mapping, 0, -1); ++ if (mapping->nrpages) { ++ invalidate_bh_lrus(); ++ lru_add_drain_all(); /* make sure all lru add caches are flushed */ ++ invalidate_mapping_pages(mapping, 0, -1); ++ } + /* 99% of the time, we don't need to flush the cleancache on the bdev. + * But, for the strange corners, lets be cautious + */ +diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c +index febc28f9e2c2..75267cdd5dfd 100644 +--- a/fs/ceph/xattr.c ++++ b/fs/ceph/xattr.c +@@ -392,6 +392,7 @@ static int __set_xattr(struct ceph_inode_info *ci, + + if (update_xattr) { + int err = 0; ++ + if (xattr && (flags & XATTR_CREATE)) + err = -EEXIST; + else if (!xattr && (flags & XATTR_REPLACE)) +@@ -399,12 +400,14 @@ static int __set_xattr(struct ceph_inode_info *ci, + if (err) { + kfree(name); + kfree(val); ++ kfree(*newxattr); + return err; + } + if (update_xattr < 0) { + if (xattr) + __remove_xattr(ci, xattr); + kfree(name); ++ kfree(*newxattr); + return 0; + } + } +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 02b071bf3732..a0b3e7d1be48 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -83,6 +83,9 @@ convert_sfm_char(const __u16 src_char, char *target) + case SFM_COLON: + *target = ':'; + break; ++ case SFM_DOUBLEQUOTE: ++ *target = '"'; ++ break; + case SFM_ASTERISK: + *target = '*'; + break; +@@ -418,6 +421,9 @@ static __le16 convert_to_sfm_char(char src_char, bool end_of_string) + case ':': + dest_char = cpu_to_le16(SFM_COLON); + break; ++ case '"': ++ dest_char = cpu_to_le16(SFM_DOUBLEQUOTE); ++ break; + case '*': + dest_char = cpu_to_le16(SFM_ASTERISK); + break; +diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h +index 479bc0a941f3..07ade707fa60 100644 +--- a/fs/cifs/cifs_unicode.h ++++ b/fs/cifs/cifs_unicode.h +@@ -57,6 +57,7 @@ + * not conflict (although almost does) with the mapping above. + */ + ++#define SFM_DOUBLEQUOTE ((__u16) 0xF020) + #define SFM_ASTERISK ((__u16) 0xF021) + #define SFM_QUESTION ((__u16) 0xF025) + #define SFM_COLON ((__u16) 0xF022) +@@ -64,8 +65,8 @@ + #define SFM_LESSTHAN ((__u16) 0xF023) + #define SFM_PIPE ((__u16) 0xF027) + #define SFM_SLASH ((__u16) 0xF026) +-#define SFM_PERIOD ((__u16) 0xF028) +-#define SFM_SPACE ((__u16) 0xF029) ++#define SFM_SPACE ((__u16) 0xF028) ++#define SFM_PERIOD ((__u16) 0xF029) + + /* + * Mapping mechanism to use when one of the seven reserved characters is +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 70f4e65fced2..16b532acc13d 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -87,6 +87,7 @@ extern mempool_t *cifs_req_poolp; + extern mempool_t *cifs_mid_poolp; + + struct workqueue_struct *cifsiod_wq; ++struct workqueue_struct *cifsoplockd_wq; + __u32 cifs_lock_secret; + + /* +@@ -1282,9 +1283,16 @@ init_cifs(void) + goto out_clean_proc; + } + ++ cifsoplockd_wq = alloc_workqueue("cifsoplockd", ++ WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); ++ if (!cifsoplockd_wq) { ++ rc = -ENOMEM; ++ goto out_destroy_cifsiod_wq; ++ } ++ + rc = cifs_fscache_register(); + if (rc) +- goto out_destroy_wq; ++ goto out_destroy_cifsoplockd_wq; + + rc = cifs_init_inodecache(); + if (rc) +@@ -1332,7 +1340,9 @@ init_cifs(void) + cifs_destroy_inodecache(); + out_unreg_fscache: + cifs_fscache_unregister(); +-out_destroy_wq: ++out_destroy_cifsoplockd_wq: ++ destroy_workqueue(cifsoplockd_wq); ++out_destroy_cifsiod_wq: + destroy_workqueue(cifsiod_wq); + out_clean_proc: + cifs_proc_clean(); +@@ -1355,6 +1365,7 @@ exit_cifs(void) + cifs_destroy_mids(); + cifs_destroy_inodecache(); + cifs_fscache_unregister(); ++ destroy_workqueue(cifsoplockd_wq); + destroy_workqueue(cifsiod_wq); + cifs_proc_clean(); + } +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 7fa45f48e59d..aba772a82bf2 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1655,6 +1655,7 @@ void cifs_oplock_break(struct work_struct *work); + + extern const struct slow_work_ops cifs_oplock_break_ops; + extern struct workqueue_struct *cifsiod_wq; ++extern struct workqueue_struct *cifsoplockd_wq; + extern __u32 cifs_lock_secret; + + extern mempool_t *cifs_mid_poolp; +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 2dc92351027b..a1016485468d 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -717,6 +717,9 @@ CIFSSMBEcho(struct TCP_Server_Info *server) + if (rc) + return rc; + ++ if (server->capabilities & CAP_UNICODE) ++ smb->hdr.Flags2 |= SMBFLG2_UNICODE; ++ + /* set up echo request */ + smb->hdr.Tid = 0xffff; + smb->hdr.WordCount = 1; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index acf7bc1eab77..cfb3b5a50005 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2879,16 +2879,14 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data) + { + struct cifs_sb_info *old = CIFS_SB(sb); + struct cifs_sb_info *new = mnt_data->cifs_sb; ++ bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; ++ bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; + +- if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) { +- if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)) +- return 0; +- /* The prepath should be null terminated strings */ +- if (strcmp(new->prepath, old->prepath)) +- return 0; +- ++ if (old_set && new_set && !strcmp(new->prepath, old->prepath)) + return 1; +- } ++ else if (!old_set && !new_set) ++ return 1; ++ + return 0; + } + +diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c +index 001528781b6b..bdba9e7a9438 100644 +--- a/fs/cifs/ioctl.c ++++ b/fs/cifs/ioctl.c +@@ -264,10 +264,14 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) + rc = -EOPNOTSUPP; + break; + case CIFS_IOC_GET_MNT_INFO: ++ if (pSMBFile == NULL) ++ break; + tcon = tlink_tcon(pSMBFile->tlink); + rc = smb_mnt_get_fsinfo(xid, tcon, (void __user *)arg); + break; + case CIFS_ENUMERATE_SNAPSHOTS: ++ if (pSMBFile == NULL) ++ break; + if (arg == 0) { + rc = -EINVAL; + goto cifs_ioc_exit; +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index c6729156f9a0..5419afea0a36 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -492,7 +492,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) + CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, + &pCifsInode->flags); + +- queue_work(cifsiod_wq, ++ queue_work(cifsoplockd_wq, + &netfile->oplock_break); + netfile->oplock_break_cancelled = false; + +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 97307808ae42..967dfe656ced 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -494,7 +494,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, + else + cfile->oplock_break_cancelled = true; + +- queue_work(cifsiod_wq, &cfile->oplock_break); ++ queue_work(cifsoplockd_wq, &cfile->oplock_break); + kfree(lw); + return true; + } +@@ -638,7 +638,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, + &cinode->flags); + spin_unlock(&cfile->file_info_lock); +- queue_work(cifsiod_wq, &cfile->oplock_break); ++ queue_work(cifsoplockd_wq, ++ &cfile->oplock_break); + + spin_unlock(&tcon->open_file_lock); + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 007abf7195af..36334fe3266c 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -924,6 +924,7 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon, + } + if (snapshot_in.snapshot_array_size < sizeof(struct smb_snapshot_array)) { + rc = -ERANGE; ++ kfree(retbuf); + return rc; + } + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 802185386851..7c1c6c39d582 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -569,8 +569,12 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + } + + if (rsplen != sizeof(struct validate_negotiate_info_rsp)) { +- cifs_dbg(VFS, "invalid size of protocol negotiate response\n"); +- return -EIO; ++ cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n", ++ rsplen); ++ ++ /* relax check since Mac returns max bufsize allowed on ioctl */ ++ if (rsplen > CIFSMaxBufSize) ++ return -EIO; + } + + /* check validate negotiate info response matches what we got earlier */ +@@ -1670,8 +1674,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + * than one credit. Windows typically sets this smaller, but for some + * ioctls it may be useful to allow server to send more. No point + * limiting what the server can send as long as fits in one credit ++ * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE ++ * (by default, note that it can be overridden to make max larger) ++ * in responses (except for read responses which can be bigger. ++ * We may want to bump this limit up + */ +- req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */ ++ req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize); + + if (is_fsctl) + req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); +diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c +index d6cd7ea4851d..ef76f93c50cb 100644 +--- a/fs/crypto/policy.c ++++ b/fs/crypto/policy.c +@@ -169,27 +169,61 @@ int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg) + } + EXPORT_SYMBOL(fscrypt_ioctl_get_policy); + ++/** ++ * fscrypt_has_permitted_context() - is a file's encryption policy permitted ++ * within its directory? ++ * ++ * @parent: inode for parent directory ++ * @child: inode for file being looked up, opened, or linked into @parent ++ * ++ * Filesystems must call this before permitting access to an inode in a ++ * situation where the parent directory is encrypted (either before allowing ++ * ->lookup() to succeed, or for a regular file before allowing it to be opened) ++ * and before any operation that involves linking an inode into an encrypted ++ * directory, including link, rename, and cross rename. It enforces the ++ * constraint that within a given encrypted directory tree, all files use the ++ * same encryption policy. The pre-access check is needed to detect potentially ++ * malicious offline violations of this constraint, while the link and rename ++ * checks are needed to prevent online violations of this constraint. ++ * ++ * Return: 1 if permitted, 0 if forbidden. If forbidden, the caller must fail ++ * the filesystem operation with EPERM. ++ */ + int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) + { +- struct fscrypt_info *parent_ci, *child_ci; ++ const struct fscrypt_operations *cops = parent->i_sb->s_cop; ++ const struct fscrypt_info *parent_ci, *child_ci; ++ struct fscrypt_context parent_ctx, child_ctx; + int res; + +- if ((parent == NULL) || (child == NULL)) { +- printk(KERN_ERR "parent %p child %p\n", parent, child); +- BUG_ON(1); +- } +- + /* No restrictions on file types which are never encrypted */ + if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && + !S_ISLNK(child->i_mode)) + return 1; + +- /* no restrictions if the parent directory is not encrypted */ +- if (!parent->i_sb->s_cop->is_encrypted(parent)) ++ /* No restrictions if the parent directory is unencrypted */ ++ if (!cops->is_encrypted(parent)) + return 1; +- /* if the child directory is not encrypted, this is always a problem */ +- if (!parent->i_sb->s_cop->is_encrypted(child)) ++ ++ /* Encrypted directories must not contain unencrypted files */ ++ if (!cops->is_encrypted(child)) + return 0; ++ ++ /* ++ * Both parent and child are encrypted, so verify they use the same ++ * encryption policy. Compare the fscrypt_info structs if the keys are ++ * available, otherwise retrieve and compare the fscrypt_contexts. ++ * ++ * Note that the fscrypt_context retrieval will be required frequently ++ * when accessing an encrypted directory tree without the key. ++ * Performance-wise this is not a big deal because we already don't ++ * really optimize for file access without the key (to the extent that ++ * such access is even possible), given that any attempted access ++ * already causes a fscrypt_context retrieval and keyring search. ++ * ++ * In any case, if an unexpected error occurs, fall back to "forbidden". ++ */ ++ + res = fscrypt_get_encryption_info(parent); + if (res) + return 0; +@@ -198,17 +232,32 @@ int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) + return 0; + parent_ci = parent->i_crypt_info; + child_ci = child->i_crypt_info; +- if (!parent_ci && !child_ci) +- return 1; +- if (!parent_ci || !child_ci) ++ ++ if (parent_ci && child_ci) { ++ return memcmp(parent_ci->ci_master_key, child_ci->ci_master_key, ++ FS_KEY_DESCRIPTOR_SIZE) == 0 && ++ (parent_ci->ci_data_mode == child_ci->ci_data_mode) && ++ (parent_ci->ci_filename_mode == ++ child_ci->ci_filename_mode) && ++ (parent_ci->ci_flags == child_ci->ci_flags); ++ } ++ ++ res = cops->get_context(parent, &parent_ctx, sizeof(parent_ctx)); ++ if (res != sizeof(parent_ctx)) + return 0; + +- return (memcmp(parent_ci->ci_master_key, +- child_ci->ci_master_key, +- FS_KEY_DESCRIPTOR_SIZE) == 0 && +- (parent_ci->ci_data_mode == child_ci->ci_data_mode) && +- (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) && +- (parent_ci->ci_flags == child_ci->ci_flags)); ++ res = cops->get_context(child, &child_ctx, sizeof(child_ctx)); ++ if (res != sizeof(child_ctx)) ++ return 0; ++ ++ return memcmp(parent_ctx.master_key_descriptor, ++ child_ctx.master_key_descriptor, ++ FS_KEY_DESCRIPTOR_SIZE) == 0 && ++ (parent_ctx.contents_encryption_mode == ++ child_ctx.contents_encryption_mode) && ++ (parent_ctx.filenames_encryption_mode == ++ child_ctx.filenames_encryption_mode) && ++ (parent_ctx.flags == child_ctx.flags); + } + EXPORT_SYMBOL(fscrypt_has_permitted_context); + +diff --git a/fs/dax.c b/fs/dax.c +index a39b404b646a..917c66584810 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -503,35 +503,6 @@ int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index) + } + + /* +- * Invalidate exceptional DAX entry if easily possible. This handles DAX +- * entries for invalidate_inode_pages() so we evict the entry only if we can +- * do so without blocking. +- */ +-int dax_invalidate_mapping_entry(struct address_space *mapping, pgoff_t index) +-{ +- int ret = 0; +- void *entry, **slot; +- struct radix_tree_root *page_tree = &mapping->page_tree; +- +- spin_lock_irq(&mapping->tree_lock); +- entry = __radix_tree_lookup(page_tree, index, NULL, &slot); +- if (!entry || !radix_tree_exceptional_entry(entry) || +- slot_locked(mapping, slot)) +- goto out; +- if (radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_DIRTY) || +- radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_TOWRITE)) +- goto out; +- radix_tree_delete(page_tree, index); +- mapping->nrexceptional--; +- ret = 1; +-out: +- spin_unlock_irq(&mapping->tree_lock); +- if (ret) +- dax_wake_mapping_entry_waiter(mapping, index, entry, true); +- return ret; +-} +- +-/* + * Invalidate exceptional DAX entry if it is clean. + */ + int dax_invalidate_mapping_entry_sync(struct address_space *mapping, +@@ -1029,7 +1000,7 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data, + * into page tables. We have to tear down these mappings so that data + * written by write(2) is visible in mmap. + */ +- if ((iomap->flags & IOMAP_F_NEW) && inode->i_mapping->nrpages) { ++ if (iomap->flags & IOMAP_F_NEW) { + invalidate_inode_pages2_range(inode->i_mapping, + pos >> PAGE_SHIFT, + (end - 1) >> PAGE_SHIFT); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 750b3f1eba31..a5f0fef53a81 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5810,6 +5810,11 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) + file_update_time(vma->vm_file); + + down_read(&EXT4_I(inode)->i_mmap_sem); ++ ++ ret = ext4_convert_inline_data(inode); ++ if (ret) ++ goto out_ret; ++ + /* Delalloc case is easy... */ + if (test_opt(inode->i_sb, DELALLOC) && + !ext4_should_journal_data(inode) && +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index af06bda51a54..0cf3794a69a7 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -316,7 +316,6 @@ int update_inode_page(struct inode *inode) + } else if (err != -ENOENT) { + f2fs_stop_checkpoint(sbi, false); + } +- f2fs_inode_synced(inode); + return 0; + } + ret = update_inode(inode, node_page); +@@ -446,6 +445,7 @@ void handle_failed_inode(struct inode *inode) + * in a panic when flushing dirty inodes in gdirty_list. + */ + update_inode_page(inode); ++ f2fs_inode_synced(inode); + + /* don't make bad inode, since it becomes a regular file. */ + unlock_new_inode(inode); +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 56c19b0610a8..c4aca1900941 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -148,8 +148,6 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode, + inode->i_mapping->a_ops = &f2fs_dblock_aops; + ino = inode->i_ino; + +- f2fs_balance_fs(sbi, true); +- + f2fs_lock_op(sbi); + err = f2fs_add_link(dentry, inode); + if (err) +@@ -163,6 +161,8 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode, + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); ++ ++ f2fs_balance_fs(sbi, true); + return 0; + out: + handle_failed_inode(inode); +@@ -423,8 +423,6 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry, + inode_nohighmem(inode); + inode->i_mapping->a_ops = &f2fs_dblock_aops; + +- f2fs_balance_fs(sbi, true); +- + f2fs_lock_op(sbi); + err = f2fs_add_link(dentry, inode); + if (err) +@@ -487,6 +485,8 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry, + } + + kfree(sd); ++ ++ f2fs_balance_fs(sbi, true); + return err; + out: + handle_failed_inode(inode); +@@ -508,8 +508,6 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + inode->i_mapping->a_ops = &f2fs_dblock_aops; + mapping_set_gfp_mask(inode->i_mapping, GFP_F2FS_HIGH_ZERO); + +- f2fs_balance_fs(sbi, true); +- + set_inode_flag(inode, FI_INC_LINK); + f2fs_lock_op(sbi); + err = f2fs_add_link(dentry, inode); +@@ -524,6 +522,8 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); ++ ++ f2fs_balance_fs(sbi, true); + return 0; + + out_fail: +@@ -554,8 +554,6 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry, + init_special_inode(inode, inode->i_mode, rdev); + inode->i_op = &f2fs_special_inode_operations; + +- f2fs_balance_fs(sbi, true); +- + f2fs_lock_op(sbi); + err = f2fs_add_link(dentry, inode); + if (err) +@@ -569,6 +567,8 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry, + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); ++ ++ f2fs_balance_fs(sbi, true); + return 0; + out: + handle_failed_inode(inode); +@@ -595,8 +595,6 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry, + inode->i_mapping->a_ops = &f2fs_dblock_aops; + } + +- f2fs_balance_fs(sbi, true); +- + f2fs_lock_op(sbi); + err = acquire_orphan_inode(sbi); + if (err) +@@ -622,6 +620,8 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry, + /* link_count was changed by d_tmpfile as well. */ + f2fs_unlock_op(sbi); + unlock_new_inode(inode); ++ ++ f2fs_balance_fs(sbi, true); + return 0; + + release_out: +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index bdc3afad4a8c..6b3531167e6d 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1348,7 +1348,7 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + jbd2_superblock_csum_set(journal, sb); + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; +- ret = submit_bh(REQ_OP_WRITE, write_flags, bh); ++ ret = submit_bh(REQ_OP_WRITE, write_flags | REQ_SYNC, bh); + wait_on_buffer(bh); + if (buffer_write_io_error(bh)) { + clear_buffer_write_io_error(bh); +diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c +index 551bc74ed2b8..fdf520f43f2e 100644 +--- a/fs/orangefs/inode.c ++++ b/fs/orangefs/inode.c +@@ -224,8 +224,7 @@ int orangefs_setattr(struct dentry *dentry, struct iattr *iattr) + if (ret) + goto out; + +- if ((iattr->ia_valid & ATTR_SIZE) && +- iattr->ia_size != i_size_read(inode)) { ++ if (iattr->ia_valid & ATTR_SIZE) { + ret = orangefs_setattr_size(inode, iattr); + if (ret) + goto out; +diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c +index a290ff6ec756..7c315938e9c2 100644 +--- a/fs/orangefs/namei.c ++++ b/fs/orangefs/namei.c +@@ -193,8 +193,6 @@ static struct dentry *orangefs_lookup(struct inode *dir, struct dentry *dentry, + goto out; + } + +- ORANGEFS_I(inode)->getattr_time = jiffies - 1; +- + gossip_debug(GOSSIP_NAME_DEBUG, + "%s:%s:%d " + "Found good inode [%lu] with count [%d]\n", +diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c +index 74a81b1daaac..237c9c04dc3b 100644 +--- a/fs/orangefs/xattr.c ++++ b/fs/orangefs/xattr.c +@@ -76,11 +76,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, + if (S_ISLNK(inode->i_mode)) + return -EOPNOTSUPP; + +- if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) { +- gossip_err("Invalid key length (%d)\n", +- (int)strlen(name)); ++ if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) + return -EINVAL; +- } + + fsuid = from_kuid(&init_user_ns, current_fsuid()); + fsgid = from_kgid(&init_user_ns, current_fsgid()); +@@ -172,6 +169,9 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name, + struct orangefs_kernel_op_s *new_op = NULL; + int ret = -ENOMEM; + ++ if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) ++ return -EINVAL; ++ + down_write(&orangefs_inode->xattr_sem); + new_op = op_alloc(ORANGEFS_VFS_OP_REMOVEXATTR); + if (!new_op) +@@ -231,23 +231,13 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name, + "%s: name %s, buffer_size %zd\n", + __func__, name, size); + +- if (size >= ORANGEFS_MAX_XATTR_VALUELEN || +- flags < 0) { +- gossip_err("orangefs_inode_setxattr: bogus values of size(%d), flags(%d)\n", +- (int)size, +- flags); ++ if (size > ORANGEFS_MAX_XATTR_VALUELEN) ++ return -EINVAL; ++ if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) + return -EINVAL; +- } + + internal_flag = convert_to_internal_xattr_flags(flags); + +- if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) { +- gossip_err +- ("orangefs_inode_setxattr: bogus key size (%d)\n", +- (int)(strlen(name))); +- return -EINVAL; +- } +- + /* This is equivalent to a removexattr */ + if (size == 0 && value == NULL) { + gossip_debug(GOSSIP_XATTR_DEBUG, +@@ -358,7 +348,7 @@ ssize_t orangefs_listxattr(struct dentry *dentry, char *buffer, size_t size) + + returned_count = new_op->downcall.resp.listxattr.returned_count; + if (returned_count < 0 || +- returned_count >= ORANGEFS_MAX_XATTR_LISTLEN) { ++ returned_count > ORANGEFS_MAX_XATTR_LISTLEN) { + gossip_err("%s: impossible value for returned_count:%d:\n", + __func__, + returned_count); +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 16e06dd89457..2e1f16d22c16 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -209,7 +209,7 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode, + if (err) + goto out_dput; + +- if (ovl_type_merge(dentry->d_parent)) { ++ if (ovl_type_merge(dentry->d_parent) && d_is_dir(newdentry)) { + /* Setting opaque here is just an optimization, allow to fail */ + ovl_set_opaque(dentry, newdentry); + } +diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c +index 729677e18e36..8e6ae68abf8d 100644 +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -705,6 +705,7 @@ int pstore_register(struct pstore_info *psi) + if (psi->flags & PSTORE_FLAGS_PMSG) + pstore_register_pmsg(); + ++ /* Start watching for new records, if desired. */ + if (pstore_update_ms >= 0) { + pstore_timer.expires = jiffies + + msecs_to_jiffies(pstore_update_ms); +@@ -727,6 +728,11 @@ EXPORT_SYMBOL_GPL(pstore_register); + + void pstore_unregister(struct pstore_info *psi) + { ++ /* Stop timer and make sure all work has finished. */ ++ pstore_update_ms = -1; ++ del_timer_sync(&pstore_timer); ++ flush_work(&pstore_work); ++ + if (psi->flags & PSTORE_FLAGS_PMSG) + pstore_unregister_pmsg(); + if (psi->flags & PSTORE_FLAGS_FTRACE) +@@ -826,7 +832,9 @@ static void pstore_timefunc(unsigned long dummy) + schedule_work(&pstore_work); + } + +- mod_timer(&pstore_timer, jiffies + msecs_to_jiffies(pstore_update_ms)); ++ if (pstore_update_ms >= 0) ++ mod_timer(&pstore_timer, ++ jiffies + msecs_to_jiffies(pstore_update_ms)); + } + + module_param(backend, charp, 0444); +diff --git a/fs/xattr.c b/fs/xattr.c +index 7e3317cf4045..94f49a082dd2 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -530,7 +530,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, + size = XATTR_SIZE_MAX; + kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN); + if (!kvalue) { +- kvalue = vmalloc(size); ++ kvalue = vzalloc(size); + if (!kvalue) + return -ENOMEM; + } +diff --git a/include/linux/dax.h b/include/linux/dax.h +index 24ad71173995..f6cc5ef33e35 100644 +--- a/include/linux/dax.h ++++ b/include/linux/dax.h +@@ -41,7 +41,6 @@ ssize_t dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter, + int dax_iomap_fault(struct vm_area_struct *vma, struct vm_fault *vmf, + struct iomap_ops *ops); + int dax_delete_mapping_entry(struct address_space *mapping, pgoff_t index); +-int dax_invalidate_mapping_entry(struct address_space *mapping, pgoff_t index); + int dax_invalidate_mapping_entry_sync(struct address_space *mapping, + pgoff_t index); + void dax_wake_mapping_entry_waiter(struct address_space *mapping, +diff --git a/kernel/padata.c b/kernel/padata.c +index 3202aa17492c..f1aef1639204 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -354,7 +354,7 @@ static int padata_setup_cpumasks(struct parallel_data *pd, + + cpumask_and(pd->cpumask.pcpu, pcpumask, cpu_online_mask); + if (!alloc_cpumask_var(&pd->cpumask.cbcpu, GFP_KERNEL)) { +- free_cpumask_var(pd->cpumask.cbcpu); ++ free_cpumask_var(pd->cpumask.pcpu); + return -ENOMEM; + } + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 1aec370bf9e9..ab8b3ce14dc8 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3144,6 +3144,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, + enum compact_priority prio, enum compact_result *compact_result) + { + struct page *page; ++ unsigned int noreclaim_flag = current->flags & PF_MEMALLOC; + + if (!order) + return NULL; +@@ -3151,7 +3152,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, + current->flags |= PF_MEMALLOC; + *compact_result = try_to_compact_pages(gfp_mask, order, alloc_flags, ac, + prio); +- current->flags &= ~PF_MEMALLOC; ++ current->flags = (current->flags & ~PF_MEMALLOC) | noreclaim_flag; + + if (*compact_result <= COMPACT_INACTIVE) + return NULL; +diff --git a/mm/truncate.c b/mm/truncate.c +index dd7b24e083c5..c2d7deae28bb 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -66,17 +66,14 @@ static void truncate_exceptional_entry(struct address_space *mapping, + + /* + * Invalidate exceptional entry if easily possible. This handles exceptional +- * entries for invalidate_inode_pages() so for DAX it evicts only unlocked and +- * clean entries. ++ * entries for invalidate_inode_pages(). + */ + static int invalidate_exceptional_entry(struct address_space *mapping, + pgoff_t index, void *entry) + { +- /* Handled by shmem itself */ +- if (shmem_mapping(mapping)) ++ /* Handled by shmem itself, or for DAX we do nothing. */ ++ if (shmem_mapping(mapping) || dax_mapping(mapping)) + return 1; +- if (dax_mapping(mapping)) +- return dax_invalidate_mapping_entry(mapping, index); + clear_shadow_entry(mapping, index, entry); + return 1; + } +@@ -685,6 +682,17 @@ int invalidate_inode_pages2_range(struct address_space *mapping, + cond_resched(); + index++; + } ++ /* ++ * For DAX we invalidate page tables after invalidating radix tree. We ++ * could invalidate page tables while invalidating each entry however ++ * that would be expensive. And doing range unmapping before doesn't ++ * work as we have no cheap way to find whether radix tree entry didn't ++ * get remapped later. ++ */ ++ if (dax_mapping(mapping)) { ++ unmap_mapping_range(mapping, (loff_t)start << PAGE_SHIFT, ++ (loff_t)(end - start + 1) << PAGE_SHIFT, 0); ++ } + cleancache_invalidate_inode(mapping); + return ret; + } +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 48f9471e7c85..c88a6007e643 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -1680,7 +1680,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, + if (msg->msg_flags & MSG_OOB) + return -EOPNOTSUPP; + +- if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE)) ++ if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE| ++ MSG_CMSG_COMPAT)) + return -EINVAL; + + if (len < 4 || len > HCI_MAX_FRAME_SIZE) +diff --git a/net/core/datagram.c b/net/core/datagram.c +index f4947e737f34..d797baa69e43 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -760,7 +760,7 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb, + + if (msg_data_left(msg) < chunk) { + if (__skb_checksum_complete(skb)) +- goto csum_error; ++ return -EINVAL; + if (skb_copy_datagram_msg(skb, hlen, msg, chunk)) + goto fault; + } else { +@@ -768,15 +768,16 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb, + if (skb_copy_and_csum_datagram(skb, hlen, &msg->msg_iter, + chunk, &csum)) + goto fault; +- if (csum_fold(csum)) +- goto csum_error; ++ ++ if (csum_fold(csum)) { ++ iov_iter_revert(&msg->msg_iter, chunk); ++ return -EINVAL; ++ } ++ + if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) + netdev_rx_csum_fault(skb->dev); + } + return 0; +-csum_error: +- iov_iter_revert(&msg->msg_iter, chunk); +- return -EINVAL; + fault: + return -EFAULT; + } +diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c +new file mode 100644 +index 000000000000..745b4b1b8b21 +--- /dev/null ++++ b/tools/perf/arch/s390/annotate/instructions.c +@@ -0,0 +1,30 @@ ++static struct ins_ops *s390__associate_ins_ops(struct arch *arch, const char *name) ++{ ++ struct ins_ops *ops = NULL; ++ ++ /* catch all kind of jumps */ ++ if (strchr(name, 'j') || ++ !strncmp(name, "bct", 3) || ++ !strncmp(name, "br", 2)) ++ ops = &jump_ops; ++ /* override call/returns */ ++ if (!strcmp(name, "bras") || ++ !strcmp(name, "brasl") || ++ !strcmp(name, "basr")) ++ ops = &call_ops; ++ if (!strcmp(name, "br")) ++ ops = &ret_ops; ++ ++ arch__associate_ins_ops(arch, name, ops); ++ return ops; ++} ++ ++static int s390__annotate_init(struct arch *arch) ++{ ++ if (!arch->initialized) { ++ arch->initialized = true; ++ arch->associate_instruction_ops = s390__associate_ins_ops; ++ } ++ ++ return 0; ++} +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index cea3e7958cde..bd58651d6040 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -108,6 +108,7 @@ static int arch__associate_ins_ops(struct arch* arch, const char *name, struct i + #include "arch/arm64/annotate/instructions.c" + #include "arch/x86/annotate/instructions.c" + #include "arch/powerpc/annotate/instructions.c" ++#include "arch/s390/annotate/instructions.c" + + static struct arch architectures[] = { + { +@@ -132,6 +133,13 @@ static struct arch architectures[] = { + }, + { + .name = "s390", ++ .init = s390__annotate_init, ++ .objdump = { ++ .comment_char = '#', ++ }, ++ }, ++ { ++ .name = "s390", + .objdump = { + .comment_char = '#', + }, +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index c5a6e0b12452..78bd632f144d 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -1826,7 +1826,7 @@ static int addr_filter__resolve_kernel_syms(struct addr_filter *filt) + filt->addr = start; + if (filt->range && !filt->size && !filt->sym_to) { + filt->size = size; +- no_size = !!size; ++ no_size = !size; + } + } + +@@ -1840,7 +1840,7 @@ static int addr_filter__resolve_kernel_syms(struct addr_filter *filt) + if (err) + return err; + filt->size = start + size - filt->addr; +- no_size = !!size; ++ no_size = !size; + } + + /* The very last symbol in kallsyms does not imply a particular size */ +diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c +index 4af47079cf04..e717fed80219 100644 +--- a/tools/testing/selftests/x86/ldt_gdt.c ++++ b/tools/testing/selftests/x86/ldt_gdt.c +@@ -403,6 +403,51 @@ static void *threadproc(void *ctx) + } + } + ++#ifdef __i386__ ++ ++#ifndef SA_RESTORE ++#define SA_RESTORER 0x04000000 ++#endif ++ ++/* ++ * The UAPI header calls this 'struct sigaction', which conflicts with ++ * glibc. Sigh. ++ */ ++struct fake_ksigaction { ++ void *handler; /* the real type is nasty */ ++ unsigned long sa_flags; ++ void (*sa_restorer)(void); ++ unsigned char sigset[8]; ++}; ++ ++static void fix_sa_restorer(int sig) ++{ ++ struct fake_ksigaction ksa; ++ ++ if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) { ++ /* ++ * glibc has a nasty bug: it sometimes writes garbage to ++ * sa_restorer. This interacts quite badly with anything ++ * that fiddles with SS because it can trigger legacy ++ * stack switching. Patch it up. See: ++ * ++ * https://sourceware.org/bugzilla/show_bug.cgi?id=21269 ++ */ ++ if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) { ++ ksa.sa_restorer = NULL; ++ if (syscall(SYS_rt_sigaction, sig, &ksa, NULL, ++ sizeof(ksa.sigset)) != 0) ++ err(1, "rt_sigaction"); ++ } ++ } ++} ++#else ++static void fix_sa_restorer(int sig) ++{ ++ /* 64-bit glibc works fine. */ ++} ++#endif ++ + static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), + int flags) + { +@@ -414,6 +459,7 @@ static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), + if (sigaction(sig, &sa, 0)) + err(1, "sigaction"); + ++ fix_sa_restorer(sig); + } + + static jmp_buf jmpbuf; |