diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2016-05-08 14:54:35 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2016-05-08 14:54:35 -0400 |
| commit | 63351ee9470841f04d279820a4e7c29302e8bd69 (patch) | |
| tree | 9f3dc5ec3a51e1b510272f1121e76ec2f764c9d7 | |
| parent | grsecurity-3.1-4.5.2-201604290633 (diff) | |
| download | hardened-patchset-63351ee9470841f04d279820a4e7c29302e8bd69.tar.gz hardened-patchset-63351ee9470841f04d279820a4e7c29302e8bd69.tar.bz2 hardened-patchset-63351ee9470841f04d279820a4e7c29302e8bd69.zip | |
grsecurity-3.1-4.5.3-20160508085820160508
| -rw-r--r-- | 4.5.2/1001_linux-4.5.2.patch | 5011 | ||||
| -rw-r--r-- | 4.5.3/0000_README (renamed from 4.5.2/0000_README) | 6 | ||||
| -rw-r--r-- | 4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch (renamed from 4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch) | 2251 | ||||
| -rw-r--r-- | 4.5.3/4425_grsec_remove_EI_PAX.patch (renamed from 4.5.2/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.5.2/4427_force_XATTR_PAX_tmpfs.patch) | 17 | ||||
| -rw-r--r-- | 4.5.3/4430_grsec-remove-localversion-grsec.patch (renamed from 4.5.2/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4435_grsec-mute-warnings.patch (renamed from 4.5.2/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4440_grsec-remove-protected-paths.patch (renamed from 4.5.2/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4450_grsec-kconfig-default-gids.patch (renamed from 4.5.2/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.5.2/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4470_disable-compat_vdso.patch (renamed from 4.5.2/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.5.3/4475_emutramp_default_on.patch (renamed from 4.5.2/4475_emutramp_default_on.patch) | 0 |
12 files changed, 1672 insertions, 5613 deletions
diff --git a/4.5.2/1001_linux-4.5.2.patch b/4.5.2/1001_linux-4.5.2.patch deleted file mode 100644 index 2c2064e..0000000 --- a/4.5.2/1001_linux-4.5.2.patch +++ /dev/null @@ -1,5011 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -index 08a4a32..0326154 100644 ---- a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt -@@ -134,12 +134,12 @@ mfio80 ddr_debug, mips_trace_data, mips_debug - mfio81 dreq0, mips_trace_data, eth_debug - mfio82 dreq1, mips_trace_data, eth_debug - mfio83 mips_pll_lock, mips_trace_data, usb_debug --mfio84 sys_pll_lock, mips_trace_data, usb_debug --mfio85 wifi_pll_lock, mips_trace_data, sdhost_debug --mfio86 bt_pll_lock, mips_trace_data, sdhost_debug --mfio87 rpu_v_pll_lock, dreq2, socif_debug --mfio88 rpu_l_pll_lock, dreq3, socif_debug --mfio89 audio_pll_lock, dreq4, dreq5 -+mfio84 audio_pll_lock, mips_trace_data, usb_debug -+mfio85 rpu_v_pll_lock, mips_trace_data, sdhost_debug -+mfio86 rpu_l_pll_lock, mips_trace_data, sdhost_debug -+mfio87 sys_pll_lock, dreq2, socif_debug -+mfio88 wifi_pll_lock, dreq3, socif_debug -+mfio89 bt_pll_lock, dreq4, dreq5 - tck - trstn - tdi -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 9a53c92..21e4b48 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -4016,6 +4016,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - sector if the number is odd); - i = IGNORE_DEVICE (don't bind to this - device); -+ j = NO_REPORT_LUNS (don't use report luns -+ command, uas only); - l = NOT_LOCKABLE (don't try to lock and - unlock ejectable media); - m = MAX_SECTORS_64 (don't transfer more -diff --git a/Makefile b/Makefile -index c621889..1ecaaeb 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 5 --SUBLEVEL = 1 -+SUBLEVEL = 2 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c -index 7d0cba6f..c86ea8a 100644 ---- a/arch/arm/kernel/setup.c -+++ b/arch/arm/kernel/setup.c -@@ -430,11 +430,13 @@ static void __init patch_aeabi_idiv(void) - pr_info("CPU: div instructions available: patching division code\n"); - - fn_addr = ((uintptr_t)&__aeabi_uidiv) & ~1; -+ asm ("" : "+g" (fn_addr)); - ((u32 *)fn_addr)[0] = udiv_instruction(); - ((u32 *)fn_addr)[1] = bx_lr_instruction(); - flush_icache_range(fn_addr, fn_addr + 8); - - fn_addr = ((uintptr_t)&__aeabi_idiv) & ~1; -+ asm ("" : "+g" (fn_addr)); - ((u32 *)fn_addr)[0] = sdiv_instruction(); - ((u32 *)fn_addr)[1] = bx_lr_instruction(); - flush_icache_range(fn_addr, fn_addr + 8); -diff --git a/arch/arm64/include/asm/opcodes.h b/arch/arm64/include/asm/opcodes.h -index 4e603ea..123f45d 100644 ---- a/arch/arm64/include/asm/opcodes.h -+++ b/arch/arm64/include/asm/opcodes.h -@@ -1 +1,5 @@ -+#ifdef CONFIG_CPU_BIG_ENDIAN -+#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN -+#endif -+ - #include <../../arm/include/asm/opcodes.h> -diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c -index c536c9e..0931155 100644 ---- a/arch/arm64/kernel/debug-monitors.c -+++ b/arch/arm64/kernel/debug-monitors.c -@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt_regs *regs) - - /* EL1 Single Step Handler hooks */ - static LIST_HEAD(step_hook); --static DEFINE_RWLOCK(step_hook_lock); -+static DEFINE_SPINLOCK(step_hook_lock); - - void register_step_hook(struct step_hook *hook) - { -- write_lock(&step_hook_lock); -- list_add(&hook->node, &step_hook); -- write_unlock(&step_hook_lock); -+ spin_lock(&step_hook_lock); -+ list_add_rcu(&hook->node, &step_hook); -+ spin_unlock(&step_hook_lock); - } - - void unregister_step_hook(struct step_hook *hook) - { -- write_lock(&step_hook_lock); -- list_del(&hook->node); -- write_unlock(&step_hook_lock); -+ spin_lock(&step_hook_lock); -+ list_del_rcu(&hook->node); -+ spin_unlock(&step_hook_lock); -+ synchronize_rcu(); - } - - /* -@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr) - struct step_hook *hook; - int retval = DBG_HOOK_ERROR; - -- read_lock(&step_hook_lock); -+ rcu_read_lock(); - -- list_for_each_entry(hook, &step_hook, node) { -+ list_for_each_entry_rcu(hook, &step_hook, node) { - retval = hook->fn(regs, esr); - if (retval == DBG_HOOK_HANDLED) - break; - } - -- read_unlock(&step_hook_lock); -+ rcu_read_unlock(); - - return retval; - } -diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c -index bdeed9d..433c4b9 100644 ---- a/arch/mips/alchemy/devboards/db1000.c -+++ b/arch/mips/alchemy/devboards/db1000.c -@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void) - if (board == BCSR_WHOAMI_DB1500) { - c0 = AU1500_GPIO2_INT; - c1 = AU1500_GPIO5_INT; -- d0 = AU1500_GPIO0_INT; -- d1 = AU1500_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1500_GPIO1_INT; - s1 = AU1500_GPIO4_INT; - } else if (board == BCSR_WHOAMI_DB1100) { - c0 = AU1100_GPIO2_INT; - c1 = AU1100_GPIO5_INT; -- d0 = AU1100_GPIO0_INT; -- d1 = AU1100_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1100_GPIO1_INT; - s1 = AU1100_GPIO4_INT; - -@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void) - } else if (board == BCSR_WHOAMI_DB1000) { - c0 = AU1000_GPIO2_INT; - c1 = AU1000_GPIO5_INT; -- d0 = AU1000_GPIO0_INT; -- d1 = AU1000_GPIO3_INT; -+ d0 = 0; /* GPIO number, NOT irq! */ -+ d1 = 3; /* GPIO number, NOT irq! */ - s0 = AU1000_GPIO1_INT; - s1 = AU1000_GPIO4_INT; - platform_add_devices(db1000_devs, ARRAY_SIZE(db1000_devs)); - } else if ((board == BCSR_WHOAMI_PB1500) || - (board == BCSR_WHOAMI_PB1500R2)) { - c0 = AU1500_GPIO203_INT; -- d0 = AU1500_GPIO201_INT; -+ d0 = 1; /* GPIO number, NOT irq! */ - s0 = AU1500_GPIO202_INT; - twosocks = 0; - flashsize = 64; -@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void) - */ - } else if (board == BCSR_WHOAMI_PB1100) { - c0 = AU1100_GPIO11_INT; -- d0 = AU1100_GPIO9_INT; -+ d0 = 9; /* GPIO number, NOT irq! */ - s0 = AU1100_GPIO10_INT; - twosocks = 0; - flashsize = 64; -@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void) - } else - return 0; /* unknown board, no further dev setup to do */ - -- irq_set_irq_type(d0, IRQ_TYPE_EDGE_BOTH); - irq_set_irq_type(c0, IRQ_TYPE_LEVEL_LOW); - irq_set_irq_type(s0, IRQ_TYPE_LEVEL_LOW); - -@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void) - c0, d0, /*s0*/0, 0, 0); - - if (twosocks) { -- irq_set_irq_type(d1, IRQ_TYPE_EDGE_BOTH); - irq_set_irq_type(c1, IRQ_TYPE_LEVEL_LOW); - irq_set_irq_type(s1, IRQ_TYPE_LEVEL_LOW); - -diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c -index b518f02..1c01d6e 100644 ---- a/arch/mips/alchemy/devboards/db1550.c -+++ b/arch/mips/alchemy/devboards/db1550.c -@@ -514,7 +514,7 @@ static void __init db1550_devices(void) - AU1000_PCMCIA_MEM_PHYS_ADDR + 0x000400000 - 1, - AU1000_PCMCIA_IO_PHYS_ADDR, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x000010000 - 1, -- AU1550_GPIO3_INT, AU1550_GPIO0_INT, -+ AU1550_GPIO3_INT, 0, - /*AU1550_GPIO21_INT*/0, 0, 0); - - db1x_register_pcmcia_socket( -@@ -524,7 +524,7 @@ static void __init db1550_devices(void) - AU1000_PCMCIA_MEM_PHYS_ADDR + 0x004400000 - 1, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x004000000, - AU1000_PCMCIA_IO_PHYS_ADDR + 0x004010000 - 1, -- AU1550_GPIO5_INT, AU1550_GPIO1_INT, -+ AU1550_GPIO5_INT, 1, - /*AU1550_GPIO22_INT*/0, 0, 1); - - platform_device_register(&db1550_nand_dev); -diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c -index 490cea5..5c62065 100644 ---- a/arch/mips/kernel/unaligned.c -+++ b/arch/mips/kernel/unaligned.c -@@ -885,7 +885,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, - { - union mips_instruction insn; - unsigned long value; -- unsigned int res; -+ unsigned int res, preempted; - unsigned long origpc; - unsigned long orig31; - void __user *fault_addr = NULL; -@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struct pt_regs *regs, - if (!access_ok(VERIFY_READ, addr, sizeof(*fpr))) - goto sigbus; - -- /* -- * Disable preemption to avoid a race between copying -- * state from userland, migrating to another CPU and -- * updating the hardware vector register below. -- */ -- preempt_disable(); -- -- res = __copy_from_user_inatomic(fpr, addr, -- sizeof(*fpr)); -- if (res) -- goto fault; -- -- /* -- * Update the hardware register if it is in use by the -- * task in this quantum, in order to avoid having to -- * save & restore the whole vector context. -- */ -- if (test_thread_flag(TIF_USEDMSA)) -- write_msa_wr(wd, fpr, df); -+ do { -+ /* -+ * If we have live MSA context keep track of -+ * whether we get preempted in order to avoid -+ * the register context we load being clobbered -+ * by the live context as it's saved during -+ * preemption. If we don't have live context -+ * then it can't be saved to clobber the value -+ * we load. -+ */ -+ preempted = test_thread_flag(TIF_USEDMSA); -+ -+ res = __copy_from_user_inatomic(fpr, addr, -+ sizeof(*fpr)); -+ if (res) -+ goto fault; - -- preempt_enable(); -+ /* -+ * Update the hardware register if it is in use -+ * by the task in this quantum, in order to -+ * avoid having to save & restore the whole -+ * vector context. -+ */ -+ preempt_disable(); -+ if (test_thread_flag(TIF_USEDMSA)) { -+ write_msa_wr(wd, fpr, df); -+ preempted = 0; -+ } -+ preempt_enable(); -+ } while (preempted); - break; - - case msa_st_op: -diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig -index 14f655c..86ed376 100644 ---- a/arch/parisc/Kconfig -+++ b/arch/parisc/Kconfig -@@ -29,6 +29,7 @@ config PARISC - select TTY # Needed for pdc_cons.c - select HAVE_DEBUG_STACKOVERFLOW - select HAVE_ARCH_AUDITSYSCALL -+ select HAVE_ARCH_SECCOMP_FILTER - select ARCH_NO_COHERENT_DMA_MMAP - - help -diff --git a/arch/parisc/include/asm/compat.h b/arch/parisc/include/asm/compat.h -index 0448a2c..3387307 100644 ---- a/arch/parisc/include/asm/compat.h -+++ b/arch/parisc/include/asm/compat.h -@@ -183,6 +183,13 @@ typedef struct compat_siginfo { - int _band; /* POLL_IN, POLL_OUT, POLL_MSG */ - int _fd; - } _sigpoll; -+ -+ /* SIGSYS */ -+ struct { -+ compat_uptr_t _call_addr; /* calling user insn */ -+ int _syscall; /* triggering system call number */ -+ compat_uint_t _arch; /* AUDIT_ARCH_* of syscall */ -+ } _sigsys; - } _sifields; - } compat_siginfo_t; - -diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h -index a5eba95..637ce8d 100644 ---- a/arch/parisc/include/asm/syscall.h -+++ b/arch/parisc/include/asm/syscall.h -@@ -39,6 +39,19 @@ static inline void syscall_get_arguments(struct task_struct *tsk, - } - } - -+static inline void syscall_set_return_value(struct task_struct *task, -+ struct pt_regs *regs, -+ int error, long val) -+{ -+ regs->gr[28] = error ? error : val; -+} -+ -+static inline void syscall_rollback(struct task_struct *task, -+ struct pt_regs *regs) -+{ -+ /* do nothing */ -+} -+ - static inline int syscall_get_arch(void) - { - int arch = AUDIT_ARCH_PARISC; -diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h -index 0abdd4c..1960b87 100644 ---- a/arch/parisc/include/asm/uaccess.h -+++ b/arch/parisc/include/asm/uaccess.h -@@ -76,6 +76,7 @@ struct exception_table_entry { - */ - struct exception_data { - unsigned long fault_ip; -+ unsigned long fault_gp; - unsigned long fault_space; - unsigned long fault_addr; - }; -diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c -index d2f6257..78d30d2 100644 ---- a/arch/parisc/kernel/asm-offsets.c -+++ b/arch/parisc/kernel/asm-offsets.c -@@ -299,6 +299,7 @@ int main(void) - #endif - BLANK(); - DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip)); -+ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp)); - DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space)); - DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr)); - BLANK(); -diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c -index 568b2c6..3cad8aa 100644 ---- a/arch/parisc/kernel/parisc_ksyms.c -+++ b/arch/parisc/kernel/parisc_ksyms.c -@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); - EXPORT_SYMBOL(lclear_user); - EXPORT_SYMBOL(lstrnlen_user); - --/* Global fixups */ --extern void fixup_get_user_skip_1(void); --extern void fixup_get_user_skip_2(void); --extern void fixup_put_user_skip_1(void); --extern void fixup_put_user_skip_2(void); -+/* Global fixups - defined as int to avoid creation of function pointers */ -+extern int fixup_get_user_skip_1; -+extern int fixup_get_user_skip_2; -+extern int fixup_put_user_skip_1; -+extern int fixup_put_user_skip_2; - EXPORT_SYMBOL(fixup_get_user_skip_1); - EXPORT_SYMBOL(fixup_get_user_skip_2); - EXPORT_SYMBOL(fixup_put_user_skip_1); -diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c -index ce0b2b4..8fb81a3 100644 ---- a/arch/parisc/kernel/ptrace.c -+++ b/arch/parisc/kernel/ptrace.c -@@ -270,7 +270,8 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, - long do_syscall_trace_enter(struct pt_regs *regs) - { - /* Do the secure computing check first. */ -- secure_computing_strict(regs->gr[20]); -+ if (secure_computing() == -1) -+ return -1; - - if (test_thread_flag(TIF_SYSCALL_TRACE) && - tracehook_report_syscall_entry(regs)) { -@@ -296,7 +297,11 @@ long do_syscall_trace_enter(struct pt_regs *regs) - regs->gr[23] & 0xffffffff); - - out: -- return regs->gr[20]; -+ /* -+ * Sign extend the syscall number to 64bit since it may have been -+ * modified by a compat ptrace call -+ */ -+ return (int) ((u32) regs->gr[20]); - } - - void do_syscall_trace_exit(struct pt_regs *regs) -diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c -index 984abbe..c342b2e 100644 ---- a/arch/parisc/kernel/signal32.c -+++ b/arch/parisc/kernel/signal32.c -@@ -371,6 +371,11 @@ copy_siginfo_to_user32 (compat_siginfo_t __user *to, const siginfo_t *from) - val = (compat_int_t)from->si_int; - err |= __put_user(val, &to->si_int); - break; -+ case __SI_SYS >> 16: -+ err |= __put_user(ptr_to_compat(from->si_call_addr), &to->si_call_addr); -+ err |= __put_user(from->si_syscall, &to->si_syscall); -+ err |= __put_user(from->si_arch, &to->si_arch); -+ break; - } - } - return err; -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index fbafa0d..c976ebf 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -329,6 +329,7 @@ tracesys_next: - - ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */ - LDREG TI_TASK(%r1), %r1 -+ LDREG TASK_PT_GR28(%r1), %r28 /* Restore return value */ - LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */ - LDREG TASK_PT_GR25(%r1), %r25 - LDREG TASK_PT_GR24(%r1), %r24 -@@ -342,6 +343,7 @@ tracesys_next: - stw %r21, -56(%r30) /* 6th argument */ - #endif - -+ cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 - b,n .Ltracesys_nosys - -diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c -index 553b098..77e2262 100644 ---- a/arch/parisc/kernel/traps.c -+++ b/arch/parisc/kernel/traps.c -@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) - - if (fault_space == 0 && !faulthandler_disabled()) - { -+ /* Clean up and return if in exception table. */ -+ if (fixup_exception(regs)) -+ return; - pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); - parisc_terminate("Kernel Fault", regs, code, fault_address); - } -diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S -index 536ef66..1052b74 100644 ---- a/arch/parisc/lib/fixup.S -+++ b/arch/parisc/lib/fixup.S -@@ -26,6 +26,7 @@ - - #ifdef CONFIG_SMP - .macro get_fault_ip t1 t2 -+ loadgp - addil LT%__per_cpu_offset,%r27 - LDREG RT%__per_cpu_offset(%r1),\t1 - /* t2 = smp_processor_id() */ -@@ -40,14 +41,19 @@ - LDREG RT%exception_data(%r1),\t1 - /* t1 = this_cpu_ptr(&exception_data) */ - add,l \t1,\t2,\t1 -+ /* %r27 = t1->fault_gp - restore gp */ -+ LDREG EXCDATA_GP(\t1), %r27 - /* t1 = t1->fault_ip */ - LDREG EXCDATA_IP(\t1), \t1 - .endm - #else - .macro get_fault_ip t1 t2 -+ loadgp - /* t1 = this_cpu_ptr(&exception_data) */ - addil LT%exception_data,%r27 - LDREG RT%exception_data(%r1),\t2 -+ /* %r27 = t2->fault_gp - restore gp */ -+ LDREG EXCDATA_GP(\t2), %r27 - /* t1 = t2->fault_ip */ - LDREG EXCDATA_IP(\t2), \t1 - .endm -diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c -index a762864..f906444 100644 ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs) - struct exception_data *d; - d = this_cpu_ptr(&exception_data); - d->fault_ip = regs->iaoq[0]; -+ d->fault_gp = regs->gr[27]; - d->fault_space = regs->isr; - d->fault_addr = regs->ior; - -diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index 3c5736e..54ed9c7 100644 ---- a/arch/powerpc/kernel/process.c -+++ b/arch/powerpc/kernel/process.c -@@ -854,7 +854,7 @@ void restore_tm_state(struct pt_regs *regs) - static inline void save_sprs(struct thread_struct *t) - { - #ifdef CONFIG_ALTIVEC -- if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC))) -+ if (cpu_has_feature(CPU_FTR_ALTIVEC)) - t->vrsave = mfspr(SPRN_VRSAVE); - #endif - #ifdef CONFIG_PPC_BOOK3S_64 -diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c -index 744e24b..4a811ca 100644 ---- a/arch/powerpc/mm/hugetlbpage.c -+++ b/arch/powerpc/mm/hugetlbpage.c -@@ -414,13 +414,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte) - { - struct hugepd_freelist **batchp; - -- batchp = this_cpu_ptr(&hugepd_freelist_cur); -+ batchp = &get_cpu_var(hugepd_freelist_cur); - - if (atomic_read(&tlb->mm->mm_users) < 2 || - cpumask_equal(mm_cpumask(tlb->mm), - cpumask_of(smp_processor_id()))) { - kmem_cache_free(hugepte_cache, hugepte); -- put_cpu_var(hugepd_freelist_cur); -+ put_cpu_var(hugepd_freelist_cur); - return; - } - -diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c -index 13dab0c..3776aca 100644 ---- a/arch/s390/mm/gup.c -+++ b/arch/s390/mm/gup.c -@@ -20,9 +20,9 @@ - static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - unsigned long end, int write, struct page **pages, int *nr) - { -+ struct page *head, *page; - unsigned long mask; - pte_t *ptep, pte; -- struct page *page; - - mask = (write ? _PAGE_PROTECT : 0) | _PAGE_INVALID | _PAGE_SPECIAL; - -@@ -37,12 +37,14 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - return 0; - VM_BUG_ON(!pfn_valid(pte_pfn(pte))); - page = pte_page(pte); -- if (!page_cache_get_speculative(page)) -+ head = compound_head(page); -+ if (!page_cache_get_speculative(head)) - return 0; - if (unlikely(pte_val(pte) != pte_val(*ptep))) { -- put_page(page); -+ put_page(head); - return 0; - } -+ VM_BUG_ON_PAGE(compound_head(page) != head, page); - pages[*nr] = page; - (*nr)++; - -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 44adbb8..f8dba20 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -42,7 +42,7 @@ - - #define KVM_PIO_PAGE_OFFSET 1 - #define KVM_COALESCED_MMIO_PAGE_OFFSET 2 --#define KVM_HALT_POLL_NS_DEFAULT 500000 -+#define KVM_HALT_POLL_NS_DEFAULT 400000 - - #define KVM_IRQCHIP_NUM_PINS KVM_IOAPIC_NUM_PINS - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index d47d231..eca5bd9 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -6074,12 +6074,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win) - } - - /* try to inject new event if pending */ -- if (vcpu->arch.nmi_pending) { -- if (kvm_x86_ops->nmi_allowed(vcpu)) { -- --vcpu->arch.nmi_pending; -- vcpu->arch.nmi_injected = true; -- kvm_x86_ops->set_nmi(vcpu); -- } -+ if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) { -+ --vcpu->arch.nmi_pending; -+ vcpu->arch.nmi_injected = true; -+ kvm_x86_ops->set_nmi(vcpu); - } else if (kvm_cpu_has_injectable_intr(vcpu)) { - /* - * Because interrupts can be injected asynchronously, we are -@@ -6548,10 +6546,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - if (inject_pending_event(vcpu, req_int_win) != 0) - req_immediate_exit = true; - /* enable NMI/IRQ window open exits if needed */ -- else if (vcpu->arch.nmi_pending) -- kvm_x86_ops->enable_nmi_window(vcpu); -- else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) -- kvm_x86_ops->enable_irq_window(vcpu); -+ else { -+ if (vcpu->arch.nmi_pending) -+ kvm_x86_ops->enable_nmi_window(vcpu); -+ if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) -+ kvm_x86_ops->enable_irq_window(vcpu); -+ } - - if (kvm_lapic_enabled(vcpu)) { - update_cr8_intercept(vcpu); -diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c -index 90d6d47..ecdb5a2 100644 ---- a/crypto/asymmetric_keys/pkcs7_trust.c -+++ b/crypto/asymmetric_keys/pkcs7_trust.c -@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7, - int cached_ret = -ENOKEY; - int ret; - -+ *_trusted = false; -+ - for (p = pkcs7->certs; p; p = p->next) - p->seen = false; - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 4a87678..9745cf9 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_req_create( - - osdc = &rbd_dev->rbd_client->client->osdc; - osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false, -- GFP_ATOMIC); -+ GFP_NOIO); - if (!osd_req) - return NULL; /* ENOMEM */ - -@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request) - rbd_dev = img_request->rbd_dev; - osdc = &rbd_dev->rbd_client->client->osdc; - osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops, -- false, GFP_ATOMIC); -+ false, GFP_NOIO); - if (!osd_req) - return NULL; /* ENOMEM */ - -@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, - bio_chain_clone_range(&bio_list, - &bio_offset, - clone_size, -- GFP_ATOMIC); -+ GFP_NOIO); - if (!obj_request->bio_list) - goto out_unwind; - } else if (type == OBJ_REQUEST_PAGES) { -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 99b375c..90c1511 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -18,6 +18,7 @@ - #include <linux/i2c.h> - #include <linux/platform_data/pca953x.h> - #include <linux/slab.h> -+#include <asm/unaligned.h> - #include <linux/of_platform.h> - #include <linux/acpi.h> - -@@ -159,7 +160,7 @@ static int pca953x_write_regs(struct pca953x_chip *chip, int reg, u8 *val) - switch (chip->chip_type) { - case PCA953X_TYPE: - ret = i2c_smbus_write_word_data(chip->client, -- reg << 1, (u16) *val); -+ reg << 1, cpu_to_le16(get_unaligned((u16 *)val))); - break; - case PCA957X_TYPE: - ret = i2c_smbus_write_byte_data(chip->client, reg << 1, -diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c -index b2b7b78..76ac906 100644 ---- a/drivers/gpio/gpio-pxa.c -+++ b/drivers/gpio/gpio-pxa.c -@@ -283,8 +283,8 @@ static int pxa_gpio_direction_output(struct gpio_chip *chip, - writel_relaxed(mask, base + (value ? GPSR_OFFSET : GPCR_OFFSET)); - - ret = pinctrl_gpio_direction_output(chip->base + offset); -- if (!ret) -- return 0; -+ if (ret) -+ return ret; - - spin_lock_irqsave(&gpio_lock, flags); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -index 7a4b101..75cb5b9 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c -@@ -816,10 +816,13 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - struct drm_device *ddev = adev->ddev; - struct drm_crtc *crtc; - uint32_t line_time_us, vblank_lines; -+ struct cgs_mode_info *mode_info; - - if (info == NULL) - return -EINVAL; - -+ mode_info = info->mode_info; -+ - if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) { - list_for_each_entry(crtc, - &ddev->mode_config.crtc_list, head) { -@@ -828,7 +831,7 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - info->active_display_mask |= (1 << amdgpu_crtc->crtc_id); - info->display_count++; - } -- if (info->mode_info != NULL && -+ if (mode_info != NULL && - crtc->enabled && amdgpu_crtc->enabled && - amdgpu_crtc->hw_mode.clock) { - line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) / -@@ -836,10 +839,10 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device, - vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end - - amdgpu_crtc->hw_mode.crtc_vdisplay + - (amdgpu_crtc->v_border * 2); -- info->mode_info->vblank_time_us = vblank_lines * line_time_us; -- info->mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); -- info->mode_info->ref_clock = adev->clock.spll.reference_freq; -- info->mode_info++; -+ mode_info->vblank_time_us = vblank_lines * line_time_us; -+ mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode); -+ mode_info->ref_clock = adev->clock.spll.reference_freq; -+ mode_info = NULL; - } - } - } -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -index b806079..53964b1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c -@@ -902,14 +902,6 @@ static int gmc_v7_0_early_init(void *handle) - gmc_v7_0_set_gart_funcs(adev); - gmc_v7_0_set_irq_funcs(adev); - -- if (adev->flags & AMD_IS_APU) { -- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -- } else { -- u32 tmp = RREG32(mmMC_SEQ_MISC0); -- tmp &= MC_SEQ_MISC0__MT__MASK; -- adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); -- } -- - return 0; - } - -@@ -930,6 +922,14 @@ static int gmc_v7_0_sw_init(void *handle) - if (r) - return r; - -+ if (adev->flags & AMD_IS_APU) { -+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -+ } else { -+ u32 tmp = RREG32(mmMC_SEQ_MISC0); -+ tmp &= MC_SEQ_MISC0__MT__MASK; -+ adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); -+ } -+ - r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); - if (r) - return r; -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -index 3efd455..e59251f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -@@ -856,14 +856,6 @@ static int gmc_v8_0_early_init(void *handle) - gmc_v8_0_set_gart_funcs(adev); - gmc_v8_0_set_irq_funcs(adev); - -- if (adev->flags & AMD_IS_APU) { -- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -- } else { -- u32 tmp = RREG32(mmMC_SEQ_MISC0); -- tmp &= MC_SEQ_MISC0__MT__MASK; -- adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); -- } -- - return 0; - } - -@@ -874,6 +866,8 @@ static int gmc_v8_0_late_init(void *handle) - return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0); - } - -+#define mmMC_SEQ_MISC0_FIJI 0xA71 -+ - static int gmc_v8_0_sw_init(void *handle) - { - int r; -@@ -884,6 +878,19 @@ static int gmc_v8_0_sw_init(void *handle) - if (r) - return r; - -+ if (adev->flags & AMD_IS_APU) { -+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; -+ } else { -+ u32 tmp; -+ -+ if (adev->asic_type == CHIP_FIJI) -+ tmp = RREG32(mmMC_SEQ_MISC0_FIJI); -+ else -+ tmp = RREG32(mmMC_SEQ_MISC0); -+ tmp &= MC_SEQ_MISC0__MT__MASK; -+ adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); -+ } -+ - r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); - if (r) - return r; -diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c -index 9535c5b..7e5a972 100644 ---- a/drivers/gpu/drm/drm_dp_helper.c -+++ b/drivers/gpu/drm/drm_dp_helper.c -@@ -178,7 +178,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - { - struct drm_dp_aux_msg msg; - unsigned int retry; -- int err; -+ int err = 0; - - memset(&msg, 0, sizeof(msg)); - msg.address = offset; -@@ -186,6 +186,8 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - msg.buffer = buffer; - msg.size = size; - -+ mutex_lock(&aux->hw_mutex); -+ - /* - * The specification doesn't give any recommendation on how often to - * retry native transactions. We used to retry 7 times like for -@@ -194,25 +196,24 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - */ - for (retry = 0; retry < 32; retry++) { - -- mutex_lock(&aux->hw_mutex); - err = aux->transfer(aux, &msg); -- mutex_unlock(&aux->hw_mutex); - if (err < 0) { - if (err == -EBUSY) - continue; - -- return err; -+ goto unlock; - } - - - switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) { - case DP_AUX_NATIVE_REPLY_ACK: - if (err < size) -- return -EPROTO; -- return err; -+ err = -EPROTO; -+ goto unlock; - - case DP_AUX_NATIVE_REPLY_NACK: -- return -EIO; -+ err = -EIO; -+ goto unlock; - - case DP_AUX_NATIVE_REPLY_DEFER: - usleep_range(AUX_RETRY_INTERVAL, AUX_RETRY_INTERVAL + 100); -@@ -221,7 +222,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, - } - - DRM_DEBUG_KMS("too many retries, giving up\n"); -- return -EIO; -+ err = -EIO; -+ -+unlock: -+ mutex_unlock(&aux->hw_mutex); -+ return err; - } - - /** -@@ -543,9 +548,7 @@ static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) - int max_retries = max(7, drm_dp_i2c_retry_count(msg, dp_aux_i2c_speed_khz)); - - for (retry = 0, defer_i2c = 0; retry < (max_retries + defer_i2c); retry++) { -- mutex_lock(&aux->hw_mutex); - ret = aux->transfer(aux, msg); -- mutex_unlock(&aux->hw_mutex); - if (ret < 0) { - if (ret == -EBUSY) - continue; -@@ -684,6 +687,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, - - memset(&msg, 0, sizeof(msg)); - -+ mutex_lock(&aux->hw_mutex); -+ - for (i = 0; i < num; i++) { - msg.address = msgs[i].addr; - drm_dp_i2c_msg_set_request(&msg, &msgs[i]); -@@ -738,6 +743,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, - msg.size = 0; - (void)drm_dp_i2c_do_msg(aux, &msg); - -+ mutex_unlock(&aux->hw_mutex); -+ - return err; - } - -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index a82b891..7285adb 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2926,9 +2926,11 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { - /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ - { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, - { 0, 0, 0, 0 }, - }; - -@@ -3008,6 +3010,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - } - ++p; - } -+ /* limit mclk on all R7 370 parts for stability */ -+ if (rdev->pdev->device == 0x6811 && -+ rdev->pdev->revision == 0x81) -+ max_mclk = 120000; - - if (rps->vce_active) { - rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; -diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c -index 200419d..18a2acb 100644 ---- a/drivers/gpu/drm/udl/udl_fb.c -+++ b/drivers/gpu/drm/udl/udl_fb.c -@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper, - out_destroy_fbi: - drm_fb_helper_release_fbi(helper); - out_gfree: -- drm_gem_object_unreference(&ufbdev->ufb.obj->base); -+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); - out: - return ret; - } -diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c -index 2a0a784..d7528e0 100644 ---- a/drivers/gpu/drm/udl/udl_gem.c -+++ b/drivers/gpu/drm/udl/udl_gem.c -@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, - return ret; - } - -- drm_gem_object_unreference(&obj->base); -+ drm_gem_object_unreference_unlocked(&obj->base); - *handle_p = handle; - return 0; - } -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index ad71160..ae83af6 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count) - return ret; - } - --static void usbhid_restart_queues(struct usbhid_device *usbhid) --{ -- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) -- usbhid_restart_out_queue(usbhid); -- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) -- usbhid_restart_ctrl_queue(usbhid); --} -- - static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) - { - struct usbhid_device *usbhid = hid->driver_data; -@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) - usb_kill_urb(usbhid->urbout); - } - -+static void hid_restart_io(struct hid_device *hid) -+{ -+ struct usbhid_device *usbhid = hid->driver_data; -+ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); -+ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); -+ -+ spin_lock_irq(&usbhid->lock); -+ clear_bit(HID_SUSPENDED, &usbhid->iofl); -+ usbhid_mark_busy(usbhid); -+ -+ if (clear_halt || reset_pending) -+ schedule_work(&usbhid->reset_work); -+ usbhid->retry_delay = 0; -+ spin_unlock_irq(&usbhid->lock); -+ -+ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) -+ return; -+ -+ if (!clear_halt) { -+ if (hid_start_in(hid) < 0) -+ hid_io_error(hid); -+ } -+ -+ spin_lock_irq(&usbhid->lock); -+ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) -+ usbhid_restart_out_queue(usbhid); -+ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) -+ usbhid_restart_ctrl_queue(usbhid); -+ spin_unlock_irq(&usbhid->lock); -+} -+ - /* Treat USB reset pretty much the same as suspend/resume */ - static int hid_pre_reset(struct usb_interface *intf) - { -@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_interface *intf) - return 1; - } - -+ /* No need to do another reset or clear a halted endpoint */ - spin_lock_irq(&usbhid->lock); - clear_bit(HID_RESET_PENDING, &usbhid->iofl); -+ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); - spin_unlock_irq(&usbhid->lock); - hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); -- status = hid_start_in(hid); -- if (status < 0) -- hid_io_error(hid); -- usbhid_restart_queues(usbhid); -+ -+ hid_restart_io(hid); - - return 0; - } -@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device *hid) - #ifdef CONFIG_PM - static int hid_resume_common(struct hid_device *hid, bool driver_suspended) - { -- struct usbhid_device *usbhid = hid->driver_data; -- int status; -- -- spin_lock_irq(&usbhid->lock); -- clear_bit(HID_SUSPENDED, &usbhid->iofl); -- usbhid_mark_busy(usbhid); -- -- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || -- test_bit(HID_RESET_PENDING, &usbhid->iofl)) -- schedule_work(&usbhid->reset_work); -- usbhid->retry_delay = 0; -- -- usbhid_restart_queues(usbhid); -- spin_unlock_irq(&usbhid->lock); -- -- status = hid_start_in(hid); -- if (status < 0) -- hid_io_error(hid); -+ int status = 0; - -+ hid_restart_io(hid); - if (driver_suspended && hid->driver && hid->driver->resume) - status = hid->driver->resume(hid); - return status; -@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) - static int hid_resume(struct usb_interface *intf) - { - struct hid_device *hid = usb_get_intfdata (intf); -- struct usbhid_device *usbhid = hid->driver_data; - int status; - -- if (!test_bit(HID_STARTED, &usbhid->iofl)) -- return 0; -- - status = hid_resume_common(hid, true); - dev_dbg(&intf->dev, "resume status %d\n", status); - return 0; -@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interface *intf) - static int hid_reset_resume(struct usb_interface *intf) - { - struct hid_device *hid = usb_get_intfdata(intf); -- struct usbhid_device *usbhid = hid->driver_data; - int status; - -- clear_bit(HID_SUSPENDED, &usbhid->iofl); - status = hid_post_reset(intf); - if (status >= 0 && hid->driver && hid->driver->reset_resume) { - int ret = hid->driver->reset_resume(hid); -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 99ef77f..94a8875 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2409,6 +2409,17 @@ void wacom_setup_device_quirks(struct wacom *wacom) - } - - /* -+ * Hack for the Bamboo One: -+ * the device presents a PAD/Touch interface as most Bamboos and even -+ * sends ghosts PAD data on it. However, later, we must disable this -+ * ghost interface, and we can not detect it unless we set it here -+ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. -+ */ -+ if (features->type == BAMBOO_PEN && -+ features->pktlen == WACOM_PKGLEN_BBTOUCH3) -+ features->device_type |= WACOM_DEVICETYPE_PAD; -+ -+ /* - * Raw Wacom-mode pen and touch events both come from interface - * 0, whose HID descriptor has an application usage of 0xFF0D - * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back -diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c -index 36544c4..303d0c9 100644 ---- a/drivers/hwmon/max1111.c -+++ b/drivers/hwmon/max1111.c -@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; - - int max1111_read_channel(int channel) - { -+ if (!the_max1111 || !the_max1111->spi) -+ return -ENODEV; -+ - return max1111_read(&the_max1111->spi->dev, channel); - } - EXPORT_SYMBOL(max1111_read_channel); -@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi) - { - struct max1111_data *data = spi_get_drvdata(spi); - -+#ifdef CONFIG_SHARPSL_PM -+ the_max1111 = NULL; -+#endif - hwmon_device_unregister(data->hwmon_dev); - sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); - sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index c73331f7..2072a31 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, - { - int ret; - int axis = chan->scan_index; -- unsigned int raw_val; -+ __le16 raw_val; - - mutex_lock(&data->mutex); - ret = bmc150_accel_set_power_state(data, true); -@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, - } - - ret = regmap_bulk_read(data->regmap, BMC150_ACCEL_AXIS_TO_REG(axis), -- &raw_val, 2); -+ &raw_val, sizeof(raw_val)); - if (ret < 0) { - dev_err(data->dev, "Error reading axis %d\n", axis); - bmc150_accel_set_power_state(data, false); - mutex_unlock(&data->mutex); - return ret; - } -- *val = sign_extend32(raw_val >> chan->scan_type.shift, -+ *val = sign_extend32(le16_to_cpu(raw_val) >> chan->scan_type.shift, - chan->scan_type.realbits - 1); - ret = bmc150_accel_set_power_state(data, false); - mutex_unlock(&data->mutex); -@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc150_accel_event = { - .realbits = (bits), \ - .storagebits = 16, \ - .shift = 16 - (bits), \ -+ .endianness = IIO_LE, \ - }, \ - .event_spec = &bmc150_accel_event, \ - .num_event_specs = 1 \ -diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c -index bbce3b0..4dac567 100644 ---- a/drivers/iio/gyro/bmg160_core.c -+++ b/drivers/iio/gyro/bmg160_core.c -@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160_data *data, int *val) - static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - { - int ret; -- unsigned int raw_val; -+ __le16 raw_val; - - mutex_lock(&data->mutex); - ret = bmg160_set_power_state(data, true); -@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - } - - ret = regmap_bulk_read(data->regmap, BMG160_AXIS_TO_REG(axis), &raw_val, -- 2); -+ sizeof(raw_val)); - if (ret < 0) { - dev_err(data->dev, "Error reading axis %d\n", axis); - bmg160_set_power_state(data, false); -@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) - return ret; - } - -- *val = sign_extend32(raw_val, 15); -+ *val = sign_extend32(le16_to_cpu(raw_val), 15); - ret = bmg160_set_power_state(data, false); - mutex_unlock(&data->mutex); - if (ret < 0) -@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg160_event = { - .sign = 's', \ - .realbits = 16, \ - .storagebits = 16, \ -+ .endianness = IIO_LE, \ - }, \ - .event_spec = &bmg160_event, \ - .num_event_specs = 1 \ -@@ -780,7 +781,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p) - mutex_unlock(&data->mutex); - goto err; - } -- data->buffer[i++] = ret; -+ data->buffer[i++] = val; - } - mutex_unlock(&data->mutex); - -diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c -index 139ae91..5b6abc5 100644 ---- a/drivers/iio/industrialio-buffer.c -+++ b/drivers/iio/industrialio-buffer.c -@@ -645,6 +645,7 @@ static int iio_verify_update(struct iio_dev *indio_dev, - unsigned int modes; - - memset(config, 0, sizeof(*config)); -+ config->watermark = ~0; - - /* - * If there is just one buffer and we are removing it there is nothing -diff --git a/drivers/iio/magnetometer/st_magn.h b/drivers/iio/magnetometer/st_magn.h -index 06a4d9c..9daca46 100644 ---- a/drivers/iio/magnetometer/st_magn.h -+++ b/drivers/iio/magnetometer/st_magn.h -@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(struct iio_dev *indio_dev) - static inline void st_magn_deallocate_ring(struct iio_dev *indio_dev) - { - } -+#define ST_MAGN_TRIGGER_SET_STATE NULL - #endif /* CONFIG_IIO_BUFFER */ - - #endif /* ST_MAGN_H */ -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 0e3b009..515bb8b 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev) - if (!group->default_domain) { - group->default_domain = __iommu_domain_alloc(dev->bus, - IOMMU_DOMAIN_DMA); -- group->domain = group->default_domain; -+ if (!group->domain) -+ group->domain = group->default_domain; - } - - ret = iommu_group_add_device(group, dev); -diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c -index 2d782ce..7ae89c6 100644 ---- a/drivers/media/platform/coda/coda-common.c -+++ b/drivers/media/platform/coda/coda-common.c -@@ -2118,14 +2118,12 @@ static int coda_probe(struct platform_device *pdev) - - pdev_id = of_id ? of_id->data : platform_get_device_id(pdev); - -- if (of_id) { -+ if (of_id) - dev->devtype = of_id->data; -- } else if (pdev_id) { -+ else if (pdev_id) - dev->devtype = &coda_devdata[pdev_id->driver_data]; -- } else { -- ret = -EINVAL; -- goto err_v4l2_register; -- } -+ else -+ return -EINVAL; - - spin_lock_init(&dev->irqlock); - INIT_LIST_HEAD(&dev->instances); -diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c -index 6310aca..d41ae95 100644 ---- a/drivers/media/platform/vsp1/vsp1_sru.c -+++ b/drivers/media/platform/vsp1/vsp1_sru.c -@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable) - mutex_lock(sru->ctrls.lock); - ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0) - & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK); -+ vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0); - mutex_unlock(sru->ctrls.lock); - - vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5); -diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c -index 9e29e70..d898880 100644 ---- a/drivers/media/usb/au0828/au0828-core.c -+++ b/drivers/media/usb/au0828/au0828-core.c -@@ -192,7 +192,7 @@ static void au0828_usb_disconnect(struct usb_interface *interface) - Set the status so poll routines can check and avoid - access after disconnect. - */ -- dev->dev_state = DEV_DISCONNECTED; -+ set_bit(DEV_DISCONNECTED, &dev->dev_state); - - au0828_rc_unregister(dev); - /* Digital TV */ -diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c -index b0f0679..3d6687f 100644 ---- a/drivers/media/usb/au0828/au0828-input.c -+++ b/drivers/media/usb/au0828/au0828-input.c -@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(struct au0828_rc *ir) - bool first = true; - - /* do nothing if device is disconnected */ -- if (ir->dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) - return 0; - - /* Check IR int */ -@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_dev *rc) - cancel_delayed_work_sync(&ir->work); - - /* do nothing if device is disconnected */ -- if (ir->dev->dev_state != DEV_DISCONNECTED) { -+ if (!test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) { - /* Disable IR */ - au8522_rc_clear(ir, 0xe0, 1 << 4); - } -diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c -index a136257..8bc69af 100644 ---- a/drivers/media/usb/au0828/au0828-video.c -+++ b/drivers/media/usb/au0828/au0828-video.c -@@ -104,14 +104,13 @@ static inline void print_err_status(struct au0828_dev *dev, - - static int check_dev(struct au0828_dev *dev) - { -- if (dev->dev_state & DEV_DISCONNECTED) { -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) { - pr_info("v4l2 ioctl: device not present\n"); - return -ENODEV; - } - -- if (dev->dev_state & DEV_MISCONFIGURED) { -- pr_info("v4l2 ioctl: device is misconfigured; " -- "close and open it again\n"); -+ if (test_bit(DEV_MISCONFIGURED, &dev->dev_state)) { -+ pr_info("v4l2 ioctl: device is misconfigured; close and open it again\n"); - return -EIO; - } - return 0; -@@ -519,8 +518,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb) - if (!dev) - return 0; - -- if ((dev->dev_state & DEV_DISCONNECTED) || -- (dev->dev_state & DEV_MISCONFIGURED)) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state) || -+ test_bit(DEV_MISCONFIGURED, &dev->dev_state)) - return 0; - - if (urb->status < 0) { -@@ -822,10 +821,10 @@ static int au0828_stream_interrupt(struct au0828_dev *dev) - int ret = 0; - - dev->stream_state = STREAM_INTERRUPT; -- if (dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) - return -ENODEV; - else if (ret) { -- dev->dev_state = DEV_MISCONFIGURED; -+ set_bit(DEV_MISCONFIGURED, &dev->dev_state); - dprintk(1, "%s device is misconfigured!\n", __func__); - return ret; - } -@@ -1014,7 +1013,7 @@ static int au0828_v4l2_open(struct file *filp) - int ret; - - dprintk(1, -- "%s called std_set %d dev_state %d stream users %d users %d\n", -+ "%s called std_set %d dev_state %ld stream users %d users %d\n", - __func__, dev->std_set_in_tuner_core, dev->dev_state, - dev->streaming_users, dev->users); - -@@ -1033,7 +1032,7 @@ static int au0828_v4l2_open(struct file *filp) - au0828_analog_stream_enable(dev); - au0828_analog_stream_reset(dev); - dev->stream_state = STREAM_OFF; -- dev->dev_state |= DEV_INITIALIZED; -+ set_bit(DEV_INITIALIZED, &dev->dev_state); - } - dev->users++; - mutex_unlock(&dev->lock); -@@ -1047,7 +1046,7 @@ static int au0828_v4l2_close(struct file *filp) - struct video_device *vdev = video_devdata(filp); - - dprintk(1, -- "%s called std_set %d dev_state %d stream users %d users %d\n", -+ "%s called std_set %d dev_state %ld stream users %d users %d\n", - __func__, dev->std_set_in_tuner_core, dev->dev_state, - dev->streaming_users, dev->users); - -@@ -1063,7 +1062,7 @@ static int au0828_v4l2_close(struct file *filp) - del_timer_sync(&dev->vbi_timeout); - } - -- if (dev->dev_state == DEV_DISCONNECTED) -+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) - goto end; - - if (dev->users == 1) { -@@ -1092,7 +1091,7 @@ static void au0828_init_tuner(struct au0828_dev *dev) - .type = V4L2_TUNER_ANALOG_TV, - }; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - if (dev->std_set_in_tuner_core) -@@ -1164,7 +1163,7 @@ static int vidioc_querycap(struct file *file, void *priv, - struct video_device *vdev = video_devdata(file); - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - strlcpy(cap->driver, "au0828", sizeof(cap->driver)); -@@ -1207,7 +1206,7 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - f->fmt.pix.width = dev->width; -@@ -1226,7 +1225,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - return au0828_set_format(dev, VIDIOC_TRY_FMT, f); -@@ -1238,7 +1237,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv, - struct au0828_dev *dev = video_drvdata(file); - int rc; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - rc = check_dev(dev); -@@ -1260,7 +1259,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id norm) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - if (norm == dev->std) -@@ -1292,7 +1291,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *norm) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - *norm = dev->std; -@@ -1315,7 +1314,7 @@ static int vidioc_enum_input(struct file *file, void *priv, - [AU0828_VMUX_DEBUG] = "tv debug" - }; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - tmp = input->index; -@@ -1345,7 +1344,7 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - *i = dev->ctrl_input; -@@ -1356,7 +1355,7 @@ static void au0828_s_input(struct au0828_dev *dev, int index) - { - int i; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - switch (AUVI_INPUT(index).type) { -@@ -1441,7 +1440,7 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a) - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - a->index = dev->ctrl_ainput; -@@ -1461,7 +1460,7 @@ static int vidioc_s_audio(struct file *file, void *priv, const struct v4l2_audio - if (a->index != dev->ctrl_ainput) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - return 0; - } -@@ -1473,7 +1472,7 @@ static int vidioc_g_tuner(struct file *file, void *priv, struct v4l2_tuner *t) - if (t->index != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - strcpy(t->name, "Auvitek tuner"); -@@ -1493,7 +1492,7 @@ static int vidioc_s_tuner(struct file *file, void *priv, - if (t->index != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - au0828_init_tuner(dev); -@@ -1515,7 +1514,7 @@ static int vidioc_g_frequency(struct file *file, void *priv, - - if (freq->tuner != 0) - return -EINVAL; -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - freq->frequency = dev->ctrl_freq; - return 0; -@@ -1530,7 +1529,7 @@ static int vidioc_s_frequency(struct file *file, void *priv, - if (freq->tuner != 0) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - au0828_init_tuner(dev); -@@ -1556,7 +1555,7 @@ static int vidioc_g_fmt_vbi_cap(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - format->fmt.vbi.samples_per_line = dev->vbi_width; -@@ -1582,7 +1581,7 @@ static int vidioc_cropcap(struct file *file, void *priv, - if (cc->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) - return -EINVAL; - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - cc->bounds.left = 0; -@@ -1604,7 +1603,7 @@ static int vidioc_g_register(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - reg->val = au0828_read(dev, reg->reg); -@@ -1617,7 +1616,7 @@ static int vidioc_s_register(struct file *file, void *priv, - { - struct au0828_dev *dev = video_drvdata(file); - -- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, -+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, - dev->std_set_in_tuner_core, dev->dev_state); - - return au0828_writereg(dev, reg->reg, reg->val); -diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h -index 8276072..b28a05d 100644 ---- a/drivers/media/usb/au0828/au0828.h -+++ b/drivers/media/usb/au0828/au0828.h -@@ -21,6 +21,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include <linux/bitops.h> - #include <linux/usb.h> - #include <linux/i2c.h> - #include <linux/i2c-algo-bit.h> -@@ -122,9 +123,9 @@ enum au0828_stream_state { - - /* device state */ - enum au0828_dev_state { -- DEV_INITIALIZED = 0x01, -- DEV_DISCONNECTED = 0x02, -- DEV_MISCONFIGURED = 0x04 -+ DEV_INITIALIZED = 0, -+ DEV_DISCONNECTED = 1, -+ DEV_MISCONFIGURED = 2 - }; - - struct au0828_dev; -@@ -248,7 +249,7 @@ struct au0828_dev { - int input_type; - int std_set_in_tuner_core; - unsigned int ctrl_input; -- enum au0828_dev_state dev_state; -+ long unsigned int dev_state; /* defined at enum au0828_dev_state */; - enum au0828_stream_state stream_state; - wait_queue_head_t open; - -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index df3b8ec..a04d0f7 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -390,6 +390,7 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot) - slot->cd_idx = 0; - slot->cd_override_level = true; - if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD || -+ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXTM_SD || - slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD) - slot->host->mmc_host_ops.get_cd = bxt_get_cd; - -@@ -1173,6 +1174,30 @@ static const struct pci_device_id pci_ids[] = { - - { - .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_EMMC, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_SDIO, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, -+ .device = PCI_DEVICE_ID_INTEL_BXTM_SD, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, -+ }, -+ -+ { -+ .vendor = PCI_VENDOR_ID_INTEL, - .device = PCI_DEVICE_ID_INTEL_APL_EMMC, - .subvendor = PCI_ANY_ID, - .subdevice = PCI_ANY_ID, -diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h -index d1a0b4d..89e7151 100644 ---- a/drivers/mmc/host/sdhci-pci.h -+++ b/drivers/mmc/host/sdhci-pci.h -@@ -28,6 +28,9 @@ - #define PCI_DEVICE_ID_INTEL_BXT_SD 0x0aca - #define PCI_DEVICE_ID_INTEL_BXT_EMMC 0x0acc - #define PCI_DEVICE_ID_INTEL_BXT_SDIO 0x0ad0 -+#define PCI_DEVICE_ID_INTEL_BXTM_SD 0x1aca -+#define PCI_DEVICE_ID_INTEL_BXTM_EMMC 0x1acc -+#define PCI_DEVICE_ID_INTEL_BXTM_SDIO 0x1ad0 - #define PCI_DEVICE_ID_INTEL_APL_SD 0x5aca - #define PCI_DEVICE_ID_INTEL_APL_EMMC 0x5acc - #define PCI_DEVICE_ID_INTEL_APL_SDIO 0x5ad0 -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index c7f27fe..452bf500 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -309,8 +309,30 @@ static void pxav3_set_uhs_signaling(struct sdhci_host *host, unsigned int uhs) - __func__, uhs, ctrl_2); - } - -+static void pxav3_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ -+ struct mmc_host *mmc = host->mmc; -+ u8 pwr = host->pwr; -+ -+ sdhci_set_power(host, mode, vdd); -+ -+ if (host->pwr == pwr) -+ return; -+ -+ if (host->pwr == 0) -+ vdd = 0; -+ -+ if (!IS_ERR(mmc->supply.vmmc)) { -+ spin_unlock_irq(&host->lock); -+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -+ spin_lock_irq(&host->lock); -+ } -+} -+ - static const struct sdhci_ops pxav3_sdhci_ops = { - .set_clock = sdhci_set_clock, -+ .set_power = pxav3_set_power, - .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, - .get_max_clock = sdhci_pltfm_clk_get_max_clock, - .set_bus_width = sdhci_set_bus_width, -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 8059d72..6d485b5 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1250,10 +1250,24 @@ clock_set: - } - EXPORT_SYMBOL_GPL(sdhci_set_clock); - --static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -- unsigned short vdd) -+static void sdhci_set_power_reg(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) - { - struct mmc_host *mmc = host->mmc; -+ -+ spin_unlock_irq(&host->lock); -+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -+ spin_lock_irq(&host->lock); -+ -+ if (mode != MMC_POWER_OFF) -+ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL); -+ else -+ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); -+} -+ -+void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ - u8 pwr = 0; - - if (mode != MMC_POWER_OFF) { -@@ -1285,7 +1299,6 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, - sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); - if (host->quirks2 & SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON) - sdhci_runtime_pm_bus_off(host); -- vdd = 0; - } else { - /* - * Spec says that we should clear the power reg before setting -@@ -1316,12 +1329,20 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, - if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER) - mdelay(10); - } -+} -+EXPORT_SYMBOL_GPL(sdhci_set_power); - -- if (!IS_ERR(mmc->supply.vmmc)) { -- spin_unlock_irq(&host->lock); -- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -- spin_lock_irq(&host->lock); -- } -+static void __sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd) -+{ -+ struct mmc_host *mmc = host->mmc; -+ -+ if (host->ops->set_power) -+ host->ops->set_power(host, mode, vdd); -+ else if (!IS_ERR(mmc->supply.vmmc)) -+ sdhci_set_power_reg(host, mode, vdd); -+ else -+ sdhci_set_power(host, mode, vdd); - } - - /*****************************************************************************\ -@@ -1471,7 +1492,7 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios) - } - } - -- sdhci_set_power(host, ios->power_mode, ios->vdd); -+ __sdhci_set_power(host, ios->power_mode, ios->vdd); - - if (host->ops->platform_send_init_74_clocks) - host->ops->platform_send_init_74_clocks(host, ios->power_mode); -diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h -index 0115e99..033d72b 100644 ---- a/drivers/mmc/host/sdhci.h -+++ b/drivers/mmc/host/sdhci.h -@@ -529,6 +529,8 @@ struct sdhci_ops { - #endif - - void (*set_clock)(struct sdhci_host *host, unsigned int clock); -+ void (*set_power)(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd); - - int (*enable_dma)(struct sdhci_host *host); - unsigned int (*get_max_clock)(struct sdhci_host *host); -@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enabled(struct sdhci_host *host) - } - - void sdhci_set_clock(struct sdhci_host *host, unsigned int clock); -+void sdhci_set_power(struct sdhci_host *host, unsigned char mode, -+ unsigned short vdd); - void sdhci_set_bus_width(struct sdhci_host *host, int width); - void sdhci_reset(struct sdhci_host *host, u8 mask); - void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing); -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index b7f1a99..5ec8195 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3308,6 +3308,30 @@ static int bond_close(struct net_device *bond_dev) - return 0; - } - -+/* fold stats, assuming all rtnl_link_stats64 fields are u64, but -+ * that some drivers can provide 32bit values only. -+ */ -+static void bond_fold_stats(struct rtnl_link_stats64 *_res, -+ const struct rtnl_link_stats64 *_new, -+ const struct rtnl_link_stats64 *_old) -+{ -+ const u64 *new = (const u64 *)_new; -+ const u64 *old = (const u64 *)_old; -+ u64 *res = (u64 *)_res; -+ int i; -+ -+ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { -+ u64 nv = new[i]; -+ u64 ov = old[i]; -+ -+ /* detects if this particular field is 32bit only */ -+ if (((nv | ov) >> 32) == 0) -+ res[i] += (u32)nv - (u32)ov; -+ else -+ res[i] += nv - ov; -+ } -+} -+ - static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, - struct rtnl_link_stats64 *stats) - { -@@ -3316,43 +3340,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, - struct list_head *iter; - struct slave *slave; - -+ spin_lock(&bond->stats_lock); - memcpy(stats, &bond->bond_stats, sizeof(*stats)); - -- bond_for_each_slave(bond, slave, iter) { -- const struct rtnl_link_stats64 *sstats = -+ rcu_read_lock(); -+ bond_for_each_slave_rcu(bond, slave, iter) { -+ const struct rtnl_link_stats64 *new = - dev_get_stats(slave->dev, &temp); -- struct rtnl_link_stats64 *pstats = &slave->slave_stats; -- -- stats->rx_packets += sstats->rx_packets - pstats->rx_packets; -- stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes; -- stats->rx_errors += sstats->rx_errors - pstats->rx_errors; -- stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped; -- -- stats->tx_packets += sstats->tx_packets - pstats->tx_packets;; -- stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes; -- stats->tx_errors += sstats->tx_errors - pstats->tx_errors; -- stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped; -- -- stats->multicast += sstats->multicast - pstats->multicast; -- stats->collisions += sstats->collisions - pstats->collisions; -- -- stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors; -- stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors; -- stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors; -- stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors; -- stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors; -- stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors; -- -- stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors; -- stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors; -- stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors; -- stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors; -- stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors; -+ -+ bond_fold_stats(stats, new, &slave->slave_stats); - - /* save off the slave stats for the next run */ -- memcpy(pstats, sstats, sizeof(*sstats)); -+ memcpy(&slave->slave_stats, new, sizeof(*new)); - } -+ rcu_read_unlock(); -+ - memcpy(&bond->bond_stats, stats, sizeof(*stats)); -+ spin_unlock(&bond->stats_lock); - - return stats; - } -@@ -4166,6 +4170,7 @@ void bond_setup(struct net_device *bond_dev) - struct bonding *bond = netdev_priv(bond_dev); - - spin_lock_init(&bond->mode_lock); -+ spin_lock_init(&bond->stats_lock); - bond->params = bonding_defaults; - - /* Initialize pointers */ -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index d7e01a7..6746fd0 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, - dev->stats.tx_bytes += tx_cb_ptr->skb->len; - dma_unmap_single(&dev->dev, - dma_unmap_addr(tx_cb_ptr, dma_addr), -- tx_cb_ptr->skb->len, -+ dma_unmap_len(tx_cb_ptr, dma_len), - DMA_TO_DEVICE); - bcmgenet_free_cb(tx_cb_ptr); - } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) { -@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct net_device *dev, - } - - dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping); -- dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len); -+ dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len); - length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags | - (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) | - DMA_TX_APPEND_CRC; -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index acb1c5b..2ee05ce 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -3070,17 +3070,17 @@ static int mvneta_stop(struct net_device *dev) - struct mvneta_port *pp = netdev_priv(dev); - - /* Inform that we are stopping so we don't want to setup the -- * driver for new CPUs in the notifiers -+ * driver for new CPUs in the notifiers. The code of the -+ * notifier for CPU online is protected by the same spinlock, -+ * so when we get the lock, the notifer work is done. - */ - spin_lock(&pp->lock); - pp->is_stopped = true; -+ spin_unlock(&pp->lock); -+ - mvneta_stop_dev(pp); - mvneta_mdio_remove(pp); - unregister_cpu_notifier(&pp->cpu_notifier); -- /* Now that the notifier are unregistered, we can release le -- * lock -- */ -- spin_unlock(&pp->lock); - on_each_cpu(mvneta_percpu_disable, pp, true); - free_percpu_irq(dev->irq, pp->ports); - mvneta_cleanup_rxqs(pp); -@@ -3612,6 +3612,7 @@ static int mvneta_probe(struct platform_device *pdev) - dev->ethtool_ops = &mvneta_eth_tool_ops; - - pp = netdev_priv(dev); -+ spin_lock_init(&pp->lock); - pp->phy_node = phy_node; - pp->phy_interface = phy_mode; - -diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -index 25ce1b0..cd9b2b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -@@ -3141,7 +3141,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, - case QP_TRANS_RTS2RTS: - case QP_TRANS_SQD2SQD: - case QP_TRANS_SQD2RTS: -- if (slave != mlx4_master_func_num(dev)) -+ if (slave != mlx4_master_func_num(dev)) { - if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) { - port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1; - if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB) -@@ -3160,6 +3160,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, - if (qp_ctx->alt_path.mgid_index >= num_gids) - return -EINVAL; - } -+ } - break; - default: - break; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -index 3b89ed2..65a115f 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h -@@ -118,6 +118,8 @@ struct mlxsw_sp { - #define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100 - unsigned int interval; /* ms */ - } fdb_notify; -+#define MLXSW_SP_MIN_AGEING_TIME 10 -+#define MLXSW_SP_MAX_AGEING_TIME 1000000 - #define MLXSW_SP_DEFAULT_AGEING_TIME 300 - u32 ageing_time; - struct mlxsw_sp_upper master_bridge; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -index 7b56098..e1c74ef 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c -@@ -311,8 +311,13 @@ static int mlxsw_sp_port_attr_br_ageing_set(struct mlxsw_sp_port *mlxsw_sp_port, - unsigned long ageing_jiffies = clock_t_to_jiffies(ageing_clock_t); - u32 ageing_time = jiffies_to_msecs(ageing_jiffies) / 1000; - -- if (switchdev_trans_ph_prepare(trans)) -- return 0; -+ if (switchdev_trans_ph_prepare(trans)) { -+ if (ageing_time < MLXSW_SP_MIN_AGEING_TIME || -+ ageing_time > MLXSW_SP_MAX_AGEING_TIME) -+ return -ERANGE; -+ else -+ return 0; -+ } - - return mlxsw_sp_ageing_set(mlxsw_sp, ageing_time); - } -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -index 46bbea8..55007f1 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats { - u64 tx_dma_map_error; - u64 spurious_intr; - u64 mac_filter_limit_overrun; -+ u64 mbx_spurious_intr; - }; - - /* -@@ -1099,7 +1100,7 @@ struct qlcnic_mailbox { - unsigned long status; - spinlock_t queue_lock; /* Mailbox queue lock */ - spinlock_t aen_lock; /* Mailbox response/AEN lock */ -- atomic_t rsp_status; -+ u32 rsp_status; - u32 num_cmds; - }; - -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -index 37a731b..f9640d5ce 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter) - - static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx) - { -- atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED); -+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; - complete(&mbx->completion); - } - -@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter) - if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); - } else { -- if (atomic_read(&mbx->rsp_status) != rsp_status) -+ if (mbx->rsp_status != rsp_status) - qlcnic_83xx_notify_mbx_response(mbx); - } - out: -@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter) - if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); - } else { -- if (atomic_read(&mbx->rsp_status) != rsp_status) -+ if (mbx->rsp_status != rsp_status) - qlcnic_83xx_notify_mbx_response(mbx); - } - } -@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter, - - static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) - { -+ u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; - struct qlcnic_adapter *adapter = data; - struct qlcnic_mailbox *mbx; -- u32 mask, resp, event; - unsigned long flags; - - mbx = adapter->ahw->mailbox; -@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) - goto out; - - event = readl(QLCNIC_MBX_FW(adapter->ahw, 0)); -- if (event & QLCNIC_MBX_ASYNC_EVENT) -+ if (event & QLCNIC_MBX_ASYNC_EVENT) { - __qlcnic_83xx_process_aen(adapter); -- else -- qlcnic_83xx_notify_mbx_response(mbx); -+ } else { -+ if (mbx->rsp_status != rsp_status) -+ qlcnic_83xx_notify_mbx_response(mbx); -+ else -+ adapter->stats.mbx_spurious_intr++; -+ } - - out: - mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK); -@@ -4050,10 +4054,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) - struct qlcnic_adapter *adapter = mbx->adapter; - const struct qlcnic_mbx_ops *mbx_ops = mbx->ops; - struct device *dev = &adapter->pdev->dev; -- atomic_t *rsp_status = &mbx->rsp_status; - struct list_head *head = &mbx->cmd_q; - struct qlcnic_hardware_context *ahw; - struct qlcnic_cmd_args *cmd = NULL; -+ unsigned long flags; - - ahw = adapter->ahw; - -@@ -4063,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) - return; - } - -- atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT); -+ spin_lock_irqsave(&mbx->aen_lock, flags); -+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; -+ spin_unlock_irqrestore(&mbx->aen_lock, flags); - - spin_lock(&mbx->queue_lock); - -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -index 494e810..0a2318c 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = { - QLC_OFF(stats.mac_filter_limit_overrun)}, - {"spurious intr", QLC_SIZEOF(stats.spurious_intr), - QLC_OFF(stats.spurious_intr)}, -- -+ {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr), -+ QLC_OFF(stats.mbx_spurious_intr)}, - }; - - static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = { -diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -index 9979764..b28e73e 100644 ---- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c -+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, - return; - } - skb_reserve(new_skb, NET_IP_ALIGN); -+ -+ pci_dma_sync_single_for_cpu(qdev->pdev, -+ dma_unmap_addr(sbq_desc, mapaddr), -+ dma_unmap_len(sbq_desc, maplen), -+ PCI_DMA_FROMDEVICE); -+ - memcpy(skb_put(new_skb, length), skb->data, length); -+ -+ pci_dma_sync_single_for_device(qdev->pdev, -+ dma_unmap_addr(sbq_desc, mapaddr), -+ dma_unmap_len(sbq_desc, maplen), -+ PCI_DMA_FROMDEVICE); - skb = new_skb; - - /* Frame error, so drop the packet. */ -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 7384499..01f6d5b 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -1136,11 +1136,8 @@ static void sh_eth_ring_format(struct net_device *ndev) - break; - sh_eth_set_receive_align(skb); - -- /* RX descriptor */ -- rxdesc = &mdp->rx_ring[i]; - /* The size of the buffer is a multiple of 32 bytes. */ - buf_len = ALIGN(mdp->rx_buf_sz, 32); -- rxdesc->len = cpu_to_le32(buf_len << 16); - dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, - DMA_FROM_DEVICE); - if (dma_mapping_error(&ndev->dev, dma_addr)) { -@@ -1148,6 +1145,10 @@ static void sh_eth_ring_format(struct net_device *ndev) - break; - } - mdp->rx_skbuff[i] = skb; -+ -+ /* RX descriptor */ -+ rxdesc = &mdp->rx_ring[i]; -+ rxdesc->len = cpu_to_le32(buf_len << 16); - rxdesc->addr = cpu_to_le32(dma_addr); - rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP); - -@@ -1163,7 +1164,8 @@ static void sh_eth_ring_format(struct net_device *ndev) - mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); - - /* Mark the last entry as wrapping the ring. */ -- rxdesc->status |= cpu_to_le32(RD_RDLE); -+ if (rxdesc) -+ rxdesc->status |= cpu_to_le32(RD_RDLE); - - memset(mdp->tx_ring, 0, tx_ringsize); - -diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c -index 166a7fc..f39e719 100644 ---- a/drivers/net/ethernet/rocker/rocker.c -+++ b/drivers/net/ethernet/rocker/rocker.c -@@ -239,6 +239,7 @@ struct rocker { - struct { - u64 id; - } hw; -+ unsigned long ageing_time; - spinlock_t cmd_ring_lock; /* for cmd ring accesses */ - struct rocker_dma_ring_info cmd_ring; - struct rocker_dma_ring_info event_ring; -@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned long data) - struct rocker_port *rocker_port; - struct rocker_fdb_tbl_entry *entry; - struct hlist_node *tmp; -- unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME; -+ unsigned long next_timer = jiffies + rocker->ageing_time; - unsigned long expires; - unsigned long lock_flags; - int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE | -@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_time(struct rocker_port *rocker_port, - struct switchdev_trans *trans, - u32 ageing_time) - { -+ struct rocker *rocker = rocker_port->rocker; -+ - if (!switchdev_trans_ph_prepare(trans)) { - rocker_port->ageing_time = clock_t_to_jiffies(ageing_time); -+ if (rocker_port->ageing_time < rocker->ageing_time) -+ rocker->ageing_time = rocker_port->ageing_time; - mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies); - } - -@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id) - goto err_init_tbls; - } - -+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; - setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup, - (unsigned long) rocker); - mod_timer(&rocker->fdb_cleanup_timer, jiffies); - -+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; -+ - err = rocker_probe_ports(rocker); - if (err) { - dev_err(&pdev->dev, "failed to probe ports\n"); -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index d636d05..95394ed 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN; - if (copylen > good_linear) - copylen = good_linear; -+ else if (copylen < ETH_HLEN) -+ copylen = ETH_HLEN; - linear = copylen; - i = *from; - iov_iter_advance(&i, copylen); -@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - - if (!zerocopy) { - copylen = len; -- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear) -+ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); -+ if (linear > good_linear) - linear = good_linear; -- else -- linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); -+ else if (linear < ETH_HLEN) -+ linear = ETH_HLEN; - } - - skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen, -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index d61da9ec..aafe237 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -575,7 +575,7 @@ static int get_filter(void __user *arg, struct sock_filter **p) - - static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { -- struct ppp_file *pf = file->private_data; -+ struct ppp_file *pf; - struct ppp *ppp; - int err = -EFAULT, val, val2, i; - struct ppp_idle idle; -@@ -585,9 +585,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - void __user *argp = (void __user *)arg; - int __user *p = argp; - -- if (!pf) -- return ppp_unattached_ioctl(current->nsproxy->net_ns, -- pf, file, cmd, arg); -+ mutex_lock(&ppp_mutex); -+ -+ pf = file->private_data; -+ if (!pf) { -+ err = ppp_unattached_ioctl(current->nsproxy->net_ns, -+ pf, file, cmd, arg); -+ goto out; -+ } - - if (cmd == PPPIOCDETACH) { - /* -@@ -602,7 +607,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - * this fd and reopening /dev/ppp. - */ - err = -EINVAL; -- mutex_lock(&ppp_mutex); - if (pf->kind == INTERFACE) { - ppp = PF_TO_PPP(pf); - rtnl_lock(); -@@ -616,15 +620,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - } else - pr_warn("PPPIOCDETACH file->f_count=%ld\n", - atomic_long_read(&file->f_count)); -- mutex_unlock(&ppp_mutex); -- return err; -+ goto out; - } - - if (pf->kind == CHANNEL) { - struct channel *pch; - struct ppp_channel *chan; - -- mutex_lock(&ppp_mutex); - pch = PF_TO_CHANNEL(pf); - - switch (cmd) { -@@ -646,17 +648,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - err = chan->ops->ioctl(chan, cmd, arg); - up_read(&pch->chan_sem); - } -- mutex_unlock(&ppp_mutex); -- return err; -+ goto out; - } - - if (pf->kind != INTERFACE) { - /* can't happen */ - pr_err("PPP: not interface or channel??\n"); -- return -EINVAL; -+ err = -EINVAL; -+ goto out; - } - -- mutex_lock(&ppp_mutex); - ppp = PF_TO_PPP(pf); - switch (cmd) { - case PPPIOCSMRU: -@@ -831,7 +832,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - default: - err = -ENOTTY; - } -+ -+out: - mutex_unlock(&ppp_mutex); -+ - return err; - } - -@@ -844,7 +848,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, - struct ppp_net *pn; - int __user *p = (int __user *)arg; - -- mutex_lock(&ppp_mutex); - switch (cmd) { - case PPPIOCNEWUNIT: - /* Create a new ppp unit */ -@@ -894,7 +897,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, - default: - err = -ENOTTY; - } -- mutex_unlock(&ppp_mutex); -+ - return err; - } - -@@ -2304,7 +2307,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) - - pch->ppp = NULL; - pch->chan = chan; -- pch->chan_net = net; -+ pch->chan_net = get_net(net); - chan->ppp = pch; - init_ppp_file(&pch->file, CHANNEL); - pch->file.hdrlen = chan->hdrlen; -@@ -2401,6 +2404,8 @@ ppp_unregister_channel(struct ppp_channel *chan) - spin_lock_bh(&pn->all_channels_lock); - list_del(&pch->list); - spin_unlock_bh(&pn->all_channels_lock); -+ put_net(pch->chan_net); -+ pch->chan_net = NULL; - - pch->file.dead = 1; - wake_up_interruptible(&pch->file.rwait); -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 88bb8cc..81ecc2e 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte - - /* Re-attach the filter to persist device */ - if (!skip_filter && (tun->filter_attached == true)) { -- err = sk_attach_filter(&tun->fprog, tfile->socket.sk); -+ err = __sk_attach_filter(&tun->fprog, tfile->socket.sk, -+ lockdep_rtnl_is_held()); - if (!err) - goto out; - } -@@ -1000,7 +1001,6 @@ static void tun_net_init(struct net_device *dev) - /* Zero header length */ - dev->type = ARPHRD_NONE; - dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; -- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ - break; - - case IFF_TAP: -@@ -1012,7 +1012,6 @@ static void tun_net_init(struct net_device *dev) - - eth_hw_addr_random(dev); - -- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ - break; - } - } -@@ -1466,6 +1465,8 @@ static void tun_setup(struct net_device *dev) - - dev->ethtool_ops = &tun_ethtool_ops; - dev->destructor = tun_free_netdev; -+ /* We prefer our own queue length */ -+ dev->tx_queue_len = TUN_READQ_SIZE; - } - - /* Trivial set of netlink ops to allow deleting tun or tap -@@ -1807,7 +1808,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n) - - for (i = 0; i < n; i++) { - tfile = rtnl_dereference(tun->tfiles[i]); -- sk_detach_filter(tfile->socket.sk); -+ __sk_detach_filter(tfile->socket.sk, lockdep_rtnl_is_held()); - } - - tun->filter_attached = false; -@@ -1820,7 +1821,8 @@ static int tun_attach_filter(struct tun_struct *tun) - - for (i = 0; i < tun->numqueues; i++) { - tfile = rtnl_dereference(tun->tfiles[i]); -- ret = sk_attach_filter(&tun->fprog, tfile->socket.sk); -+ ret = __sk_attach_filter(&tun->fprog, tfile->socket.sk, -+ lockdep_rtnl_is_held()); - if (ret) { - tun_detach_filter(tun, i); - return ret; -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index a3a4ccf..1232a8c6 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -844,6 +844,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ - {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ - {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ -+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ - {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ - {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ - {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ -diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c -index 44541dbc..69b994f 100644 ---- a/drivers/net/wan/farsync.c -+++ b/drivers/net/wan/farsync.c -@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) - dev->mem_start = card->phys_mem - + BUF_OFFSET ( txBuffer[i][0][0]); - dev->mem_end = card->phys_mem -- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); -+ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); - dev->base_addr = card->pci_conf; - dev->irq = card->irq; - -diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c -index 73fb423..a794157 100644 ---- a/drivers/net/wireless/ath/ath9k/eeprom.c -+++ b/drivers/net/wireless/ath/ath9k/eeprom.c -@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - - if (match) { - if (AR_SREV_9287(ah)) { -- /* FIXME: array overrun? */ - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_9287[idxL].pwrPdg[i], - data_9287[idxL].vpdPdg[i], -@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - } else if (eeprom_4k) { - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_4k[idxL].pwrPdg[i], - data_4k[idxL].vpdPdg[i], -@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, - } else { - for (i = 0; i < numXpdGains; i++) { - minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; -- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; -+ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; - ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], - data_def[idxL].pwrPdg[i], - data_def[idxL].vpdPdg[i], -diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c -index 576eb70..cdbab06 100644 ---- a/drivers/nvdimm/bus.c -+++ b/drivers/nvdimm/bus.c -@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd_dimm_descs[] = { - [ND_CMD_IMPLEMENTED] = { }, - [ND_CMD_SMART] = { - .out_num = 2, -- .out_sizes = { 4, 8, }, -+ .out_sizes = { 4, 128, }, - }, - [ND_CMD_SMART_THRESHOLD] = { - .out_num = 2, -diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c -index ae81a2f..f0b56b3 100644 ---- a/drivers/nvdimm/pfn_devs.c -+++ b/drivers/nvdimm/pfn_devs.c -@@ -315,7 +315,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn) - } else { - /* from init we validate */ - if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0) -- return -EINVAL; -+ return -ENODEV; - } - - if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) { -diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c -index 4c2fa05..944674e 100644 ---- a/drivers/pcmcia/db1xxx_ss.c -+++ b/drivers/pcmcia/db1xxx_ss.c -@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock { - int stschg_irq; /* card-status-change irq */ - int card_irq; /* card irq */ - int eject_irq; /* db1200/pb1200 have these */ -+ int insert_gpio; /* db1000 carddetect gpio */ - - #define BOARD_TYPE_DEFAULT 0 /* most boards */ - #define BOARD_TYPE_DB1200 1 /* IRQs aren't gpios */ -@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct db1x_pcmcia_sock *sock) - /* carddetect gpio: low-active */ - static int db1000_card_inserted(struct db1x_pcmcia_sock *sock) - { -- return !gpio_get_value(irq_to_gpio(sock->insert_irq)); -+ return !gpio_get_value(sock->insert_gpio); - } - - static int db1x_card_inserted(struct db1x_pcmcia_sock *sock) -@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(struct platform_device *pdev) - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "card"); - sock->card_irq = r ? r->start : 0; - -- /* insert: irq which triggers on card insertion/ejection */ -+ /* insert: irq which triggers on card insertion/ejection -+ * BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here! -+ */ - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "insert"); - sock->insert_irq = r ? r->start : -1; -+ if (sock->board_type == BOARD_TYPE_DEFAULT) { -+ sock->insert_gpio = r ? r->start : -1; -+ sock->insert_irq = r ? gpio_to_irq(r->start) : -1; -+ } - - /* stschg: irq which trigger on card status change (optional) */ - r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "stschg"); -diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c -index a5bb939..1029aa7 100644 ---- a/drivers/pinctrl/freescale/pinctrl-imx.c -+++ b/drivers/pinctrl/freescale/pinctrl-imx.c -@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_device *pdev, - - if (of_property_read_bool(dev_np, "fsl,input-sel")) { - np = of_parse_phandle(dev_np, "fsl,input-sel", 0); -- if (np) { -- ipctl->input_sel_base = of_iomap(np, 0); -- if (IS_ERR(ipctl->input_sel_base)) { -- of_node_put(np); -- dev_err(&pdev->dev, -- "iomuxc input select base address not found\n"); -- return PTR_ERR(ipctl->input_sel_base); -- } -- } else { -+ if (!np) { - dev_err(&pdev->dev, "iomuxc fsl,input-sel property not found\n"); - return -EINVAL; - } -+ -+ ipctl->input_sel_base = of_iomap(np, 0); - of_node_put(np); -+ if (!ipctl->input_sel_base) { -+ dev_err(&pdev->dev, -+ "iomuxc input select base address not found\n"); -+ return -ENOMEM; -+ } - } - - imx_pinctrl_desc.name = dev_name(&pdev->dev); -diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -index 3524061..c8969dd 100644 ---- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c -+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -@@ -990,7 +990,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s, - int val; - - if (pull) -- pullidx = data_out ? 1 : 2; -+ pullidx = data_out ? 2 : 1; - - seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s", - gpio, -diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c -index 856f736..2673cd9 100644 ---- a/drivers/pinctrl/pinctrl-pistachio.c -+++ b/drivers/pinctrl/pinctrl-pistachio.c -@@ -469,27 +469,27 @@ static const char * const pistachio_mips_pll_lock_groups[] = { - "mfio83", - }; - --static const char * const pistachio_sys_pll_lock_groups[] = { -+static const char * const pistachio_audio_pll_lock_groups[] = { - "mfio84", - }; - --static const char * const pistachio_wifi_pll_lock_groups[] = { -+static const char * const pistachio_rpu_v_pll_lock_groups[] = { - "mfio85", - }; - --static const char * const pistachio_bt_pll_lock_groups[] = { -+static const char * const pistachio_rpu_l_pll_lock_groups[] = { - "mfio86", - }; - --static const char * const pistachio_rpu_v_pll_lock_groups[] = { -+static const char * const pistachio_sys_pll_lock_groups[] = { - "mfio87", - }; - --static const char * const pistachio_rpu_l_pll_lock_groups[] = { -+static const char * const pistachio_wifi_pll_lock_groups[] = { - "mfio88", - }; - --static const char * const pistachio_audio_pll_lock_groups[] = { -+static const char * const pistachio_bt_pll_lock_groups[] = { - "mfio89", - }; - -@@ -559,12 +559,12 @@ enum pistachio_mux_option { - PISTACHIO_FUNCTION_DREQ4, - PISTACHIO_FUNCTION_DREQ5, - PISTACHIO_FUNCTION_MIPS_PLL_LOCK, -+ PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, -+ PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, -+ PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, - PISTACHIO_FUNCTION_SYS_PLL_LOCK, - PISTACHIO_FUNCTION_WIFI_PLL_LOCK, - PISTACHIO_FUNCTION_BT_PLL_LOCK, -- PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, -- PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, -- PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, - PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND, - PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND, - PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND, -@@ -620,12 +620,12 @@ static const struct pistachio_function pistachio_functions[] = { - FUNCTION(dreq4), - FUNCTION(dreq5), - FUNCTION(mips_pll_lock), -+ FUNCTION(audio_pll_lock), -+ FUNCTION(rpu_v_pll_lock), -+ FUNCTION(rpu_l_pll_lock), - FUNCTION(sys_pll_lock), - FUNCTION(wifi_pll_lock), - FUNCTION(bt_pll_lock), -- FUNCTION(rpu_v_pll_lock), -- FUNCTION(rpu_l_pll_lock), -- FUNCTION(audio_pll_lock), - FUNCTION(debug_raw_cca_ind), - FUNCTION(debug_ed_sec20_cca_ind), - FUNCTION(debug_ed_sec40_cca_ind), -diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c -index 181ea98..2b0d702 100644 ---- a/drivers/pinctrl/sh-pfc/core.c -+++ b/drivers/pinctrl/sh-pfc/core.c -@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_device *pdev) - return ret; - } - -- pinctrl_provide_dummies(); -+ /* Enable dummy states for those platforms without pinctrl support */ -+ if (!of_have_populated_dt()) -+ pinctrl_provide_dummies(); - - ret = sh_pfc_init_ranges(pfc); - if (ret < 0) -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -index 00265f0..8b381d6 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c -@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc sun8i_a33_pinctrl_data = { - .pins = sun8i_a33_pins, - .npins = ARRAY_SIZE(sun8i_a33_pins), - .irq_banks = 2, -+ .irq_bank_base = 1, - }; - - static int sun8i_a33_pinctrl_probe(struct platform_device *pdev) -diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -index 7a2465f..884c2b3 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c -@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_resources(struct irq_data *d) - static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_cfg_reg(d->hwirq); -+ u32 reg = sunxi_irq_cfg_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 index = sunxi_irq_cfg_offset(d->hwirq); - unsigned long flags; - u32 regval; -@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) - static void sunxi_pinctrl_irq_ack(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 status_reg = sunxi_irq_status_reg(d->hwirq); -+ u32 status_reg = sunxi_irq_status_reg(d->hwirq, -+ pctl->desc->irq_bank_base); - u8 status_idx = sunxi_irq_status_offset(d->hwirq); - - /* Clear the IRQ */ -@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(struct irq_data *d) - static void sunxi_pinctrl_irq_mask(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); -+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 idx = sunxi_irq_ctrl_offset(d->hwirq); - unsigned long flags; - u32 val; -@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d) - static void sunxi_pinctrl_irq_unmask(struct irq_data *d) - { - struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); -- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); -+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); - u8 idx = sunxi_irq_ctrl_offset(d->hwirq); - unsigned long flags; - u32 val; -@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc) - if (bank == pctl->desc->irq_banks) - return; - -- reg = sunxi_irq_status_reg_from_bank(bank); -+ reg = sunxi_irq_status_reg_from_bank(bank, pctl->desc->irq_bank_base); - val = readl(pctl->membase + reg); - - if (val) { -@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_device *pdev, - - for (i = 0; i < pctl->desc->irq_banks; i++) { - /* Mask and clear all IRQs before registering a handler */ -- writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i)); -+ writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i, -+ pctl->desc->irq_bank_base)); - writel(0xffffffff, -- pctl->membase + sunxi_irq_status_reg_from_bank(i)); -+ pctl->membase + sunxi_irq_status_reg_from_bank(i, -+ pctl->desc->irq_bank_base)); - - irq_set_chained_handler_and_data(pctl->irq[i], - sunxi_pinctrl_irq_handler, -diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h -index e248e81..0afce1a 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h -+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h -@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc { - int npins; - unsigned pin_base; - unsigned irq_banks; -+ unsigned irq_bank_base; - bool irq_read_needs_mux; - }; - -@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16 pin) - return pin_num * PULL_PINS_BITS; - } - --static inline u32 sunxi_irq_cfg_reg(u16 irq) -+static inline u32 sunxi_irq_cfg_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - u8 reg = (irq % IRQ_PER_BANK) / IRQ_CFG_IRQ_PER_REG * 0x04; - -- return IRQ_CFG_REG + bank * IRQ_MEM_SIZE + reg; -+ return IRQ_CFG_REG + (bank_base + bank) * IRQ_MEM_SIZE + reg; - } - - static inline u32 sunxi_irq_cfg_offset(u16 irq) -@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq) - return irq_num * IRQ_CFG_IRQ_BITS; - } - --static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank) -+static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank, unsigned bank_base) - { -- return IRQ_CTRL_REG + bank * IRQ_MEM_SIZE; -+ return IRQ_CTRL_REG + (bank_base + bank) * IRQ_MEM_SIZE; - } - --static inline u32 sunxi_irq_ctrl_reg(u16 irq) -+static inline u32 sunxi_irq_ctrl_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - -- return sunxi_irq_ctrl_reg_from_bank(bank); -+ return sunxi_irq_ctrl_reg_from_bank(bank, bank_base); - } - - static inline u32 sunxi_irq_ctrl_offset(u16 irq) -@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq) - return irq_num * IRQ_CTRL_IRQ_BITS; - } - --static inline u32 sunxi_irq_status_reg_from_bank(u8 bank) -+static inline u32 sunxi_irq_status_reg_from_bank(u8 bank, unsigned bank_base) - { -- return IRQ_STATUS_REG + bank * IRQ_MEM_SIZE; -+ return IRQ_STATUS_REG + (bank_base + bank) * IRQ_MEM_SIZE; - } - --static inline u32 sunxi_irq_status_reg(u16 irq) -+static inline u32 sunxi_irq_status_reg(u16 irq, unsigned bank_base) - { - u8 bank = irq / IRQ_PER_BANK; - -- return sunxi_irq_status_reg_from_bank(bank); -+ return sunxi_irq_status_reg_from_bank(bank, bank_base); - } - - static inline u32 sunxi_irq_status_offset(u16 irq) -diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index b1bf42b..1deb6ad 100644 ---- a/drivers/scsi/scsi.c -+++ b/drivers/scsi/scsi.c -@@ -784,8 +784,9 @@ void scsi_attach_vpd(struct scsi_device *sdev) - int pg83_supported = 0; - unsigned char __rcu *vpd_buf, *orig_vpd_buf = NULL; - -- if (sdev->skip_vpd_pages) -+ if (!scsi_device_supports_vpd(sdev)) - return; -+ - retry_pg0: - vpd_buf = kmalloc(vpd_len, GFP_KERNEL); - if (!vpd_buf) -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 5a5457a..974ca5b 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo) - struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk); - struct scsi_device *sdp = sdkp->device; - struct Scsi_Host *host = sdp->host; -+ sector_t capacity = logical_to_sectors(sdp, sdkp->capacity); - int diskinfo[4]; - - /* default to most commonly used values */ -- diskinfo[0] = 0x40; /* 1 << 6 */ -- diskinfo[1] = 0x20; /* 1 << 5 */ -- diskinfo[2] = sdkp->capacity >> 11; -- -+ diskinfo[0] = 0x40; /* 1 << 6 */ -+ diskinfo[1] = 0x20; /* 1 << 5 */ -+ diskinfo[2] = capacity >> 11; -+ - /* override with calculated, extended default, or driver values */ - if (host->hostt->bios_param) -- host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo); -+ host->hostt->bios_param(sdp, bdev, capacity, diskinfo); - else -- scsicam_bios_param(bdev, sdkp->capacity, diskinfo); -+ scsicam_bios_param(bdev, capacity, diskinfo); - - geo->heads = diskinfo[0]; - geo->sectors = diskinfo[1]; -@@ -2337,14 +2338,6 @@ got_data: - if (sdkp->capacity > 0xffffffff) - sdp->use_16_for_rw = 1; - -- /* Rescale capacity to 512-byte units */ -- if (sector_size == 4096) -- sdkp->capacity <<= 3; -- else if (sector_size == 2048) -- sdkp->capacity <<= 2; -- else if (sector_size == 1024) -- sdkp->capacity <<= 1; -- - blk_queue_physical_block_size(sdp->request_queue, - sdkp->physical_block_size); - sdkp->device->sector_size = sector_size; -@@ -2795,28 +2788,6 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer) - sdkp->ws10 = 1; - } - --static int sd_try_extended_inquiry(struct scsi_device *sdp) --{ -- /* Attempt VPD inquiry if the device blacklist explicitly calls -- * for it. -- */ -- if (sdp->try_vpd_pages) -- return 1; -- /* -- * Although VPD inquiries can go to SCSI-2 type devices, -- * some USB ones crash on receiving them, and the pages -- * we currently ask for are for SPC-3 and beyond -- */ -- if (sdp->scsi_level > SCSI_SPC_2 && !sdp->skip_vpd_pages) -- return 1; -- return 0; --} -- --static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks) --{ -- return blocks << (ilog2(sdev->sector_size) - 9); --} -- - /** - * sd_revalidate_disk - called the first time a new disk is seen, - * performs disk spin up, read_capacity, etc. -@@ -2856,7 +2827,7 @@ static int sd_revalidate_disk(struct gendisk *disk) - if (sdkp->media_present) { - sd_read_capacity(sdkp, buffer); - -- if (sd_try_extended_inquiry(sdp)) { -+ if (scsi_device_supports_vpd(sdp)) { - sd_read_block_provisioning(sdkp); - sd_read_block_limits(sdkp); - sd_read_block_characteristics(sdkp); -@@ -2900,7 +2871,7 @@ static int sd_revalidate_disk(struct gendisk *disk) - /* Combine with controller limits */ - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); - -- set_capacity(disk, sdkp->capacity); -+ set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); - sd_config_write_same(sdkp); - kfree(buffer); - -diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h -index 5f2a84a..654630b 100644 ---- a/drivers/scsi/sd.h -+++ b/drivers/scsi/sd.h -@@ -65,7 +65,7 @@ struct scsi_disk { - struct device dev; - struct gendisk *disk; - atomic_t openers; -- sector_t capacity; /* size in 512-byte sectors */ -+ sector_t capacity; /* size in logical blocks */ - u32 max_xfer_blocks; - u32 opt_xfer_blocks; - u32 max_ws_blocks; -@@ -146,6 +146,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd) - return 0; - } - -+static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks) -+{ -+ return blocks << (ilog2(sdev->sector_size) - 9); -+} -+ - /* - * A DIF-capable target device can be formatted with different - * protection schemes. Currently 0 through 3 are defined: -diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c -index e237e9f..df56021 100644 ---- a/drivers/staging/android/ion/ion.c -+++ b/drivers/staging/android/ion/ion.c -@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, - * memory coming from the heaps is ready for dma, ie if it has a - * cached mapping that mapping has been invalidated - */ -- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) -+ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) { - sg_dma_address(sg) = sg_phys(sg); -+ sg_dma_len(sg) = sg->length; -+ } - mutex_lock(&dev->buffer_lock); - ion_buffer_add(dev, buffer); - mutex_unlock(&dev->buffer_lock); -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index c0f5c65..f1893e0 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) - goto __usbhs_pkt_handler_end; - } - -- ret = func(pkt, &is_done); -+ if (likely(func)) -+ ret = func(pkt, &is_done); - - if (is_done) - __usbhsf_pkt_del(pkt); -@@ -889,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) - - pkt->trans = len; - -+ usbhsf_tx_irq_ctrl(pipe, 0); - INIT_WORK(&pkt->work, xfer_work); - schedule_work(&pkt->work); - -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 657f967..2510535 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt) - struct usbhs_pipe *pipe = pkt->pipe; - struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe); - struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt); -+ unsigned long flags; - - ureq->req.actual = pkt->actual; - -- usbhsg_queue_pop(uep, ureq, 0); -+ usbhs_lock(priv, flags); -+ if (uep) -+ __usbhsg_queue_pop(uep, ureq, 0); -+ usbhs_unlock(priv, flags); - } - - static void usbhsg_queue_push(struct usbhsg_uep *uep, -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index c90a7e4..e4ade8d 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -2,7 +2,7 @@ - * USB Attached SCSI - * Note that this is not the same as the USB Mass Storage driver - * -- * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014 -+ * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016 - * Copyright Matthew Wilcox for Intel Corp, 2010 - * Copyright Sarah Sharp for Intel Corp, 2010 - * -@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd) - return SUCCESS; - } - -+static int uas_target_alloc(struct scsi_target *starget) -+{ -+ struct uas_dev_info *devinfo = (struct uas_dev_info *) -+ dev_to_shost(starget->dev.parent)->hostdata; -+ -+ if (devinfo->flags & US_FL_NO_REPORT_LUNS) -+ starget->no_report_luns = 1; -+ -+ return 0; -+} -+ - static int uas_slave_alloc(struct scsi_device *sdev) - { - struct uas_dev_info *devinfo = -@@ -800,7 +811,6 @@ static int uas_slave_configure(struct scsi_device *sdev) - if (devinfo->flags & US_FL_BROKEN_FUA) - sdev->broken_fua = 1; - -- scsi_change_queue_depth(sdev, devinfo->qdepth - 2); - return 0; - } - -@@ -808,6 +818,7 @@ static struct scsi_host_template uas_host_template = { - .module = THIS_MODULE, - .name = "uas", - .queuecommand = uas_queuecommand, -+ .target_alloc = uas_target_alloc, - .slave_alloc = uas_slave_alloc, - .slave_configure = uas_slave_configure, - .eh_abort_handler = uas_eh_abort_handler, -@@ -932,6 +943,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id) - if (result) - goto set_alt0; - -+ /* -+ * 1 tag is reserved for untagged commands + -+ * 1 tag to avoid off by one errors in some bridge firmwares -+ */ -+ shost->can_queue = devinfo->qdepth - 2; -+ - usb_set_intfdata(intf, shost); - result = scsi_add_host(shost, &intf->dev); - if (result) -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index ccc113e..53341a7 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_ATA_1X), - -+/* Reported-by: David Webb <djw@noc.ac.uk> */ -+UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999, -+ "Seagate", -+ "Expansion Desk", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_REPORT_LUNS), -+ - /* Reported-by: Hans de Goede <hdegoede@redhat.com> */ - UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, - "Seagate", -diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c -index 43576ed..9de988a 100644 ---- a/drivers/usb/storage/usb.c -+++ b/drivers/usb/storage/usb.c -@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) - US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 | - US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE | - US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES | -- US_FL_MAX_SECTORS_240); -+ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS); - - p = quirks; - while (*p) { -@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) - case 'i': - f |= US_FL_IGNORE_DEVICE; - break; -+ case 'j': -+ f |= US_FL_NO_REPORT_LUNS; -+ break; - case 'l': - f |= US_FL_NOT_LOCKABLE; - break; -diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c -index 7760fc1..1f413a2 100644 ---- a/drivers/virtio/virtio_pci_modern.c -+++ b/drivers/virtio/virtio_pci_modern.c -@@ -17,6 +17,7 @@ - * - */ - -+#include <linux/delay.h> - #define VIRTIO_PCI_NO_LEGACY - #include "virtio_pci_common.h" - -@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_device *vdev) - struct virtio_pci_device *vp_dev = to_vp_device(vdev); - /* 0 status means a reset. */ - vp_iowrite8(0, &vp_dev->common->device_status); -- /* Flush out the status write, and flush in device writes, -- * including MSI-X interrupts, if any. */ -- vp_ioread8(&vp_dev->common->device_status); -+ /* After writing 0 to device_status, the driver MUST wait for a read of -+ * device_status to return 0 before reinitializing the device. -+ * This will flush out the status write, and flush in device writes, -+ * including MSI-X interrupts, if any. -+ */ -+ while (vp_ioread8(&vp_dev->common->device_status)) -+ msleep(1); - /* Flush pending VQ/configuration callbacks. */ - vp_synchronize_vectors(vdev); - } -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 524c221..4436778 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *data) - struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; - int rc = 0; - -- irq_move_irq(data); -+ if (!VALID_EVTCHN(evtchn)) -+ return; - -- if (VALID_EVTCHN(evtchn)) -+ if (unlikely(irqd_is_setaffinity_pending(data))) { -+ int masked = test_and_set_mask(evtchn); -+ -+ clear_evtchn(evtchn); -+ -+ irq_move_masked_irq(data); -+ -+ if (!masked) -+ unmask_evtchn(evtchn); -+ } else - clear_evtchn(evtchn); - - if (pirq_needs_eoi(data->irq)) { -@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *data) - { - int evtchn = evtchn_from_irq(data->irq); - -- irq_move_irq(data); -+ if (!VALID_EVTCHN(evtchn)) -+ return; - -- if (VALID_EVTCHN(evtchn)) -+ if (unlikely(irqd_is_setaffinity_pending(data))) { -+ int masked = test_and_set_mask(evtchn); -+ -+ clear_evtchn(evtchn); -+ -+ irq_move_masked_irq(data); -+ -+ if (!masked) -+ unmask_evtchn(evtchn); -+ } else - clear_evtchn(evtchn); - } - -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 098bb8f..9a30ca6 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1883,7 +1883,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end) - */ - int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - { -- struct dentry *dentry = file->f_path.dentry; -+ struct dentry *dentry = file_dentry(file); - struct inode *inode = d_inode(dentry); - struct btrfs_root *root = BTRFS_I(inode)->root; - struct btrfs_trans_handle *trans; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 978c3a8..849a30a 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -4414,6 +4414,127 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans, - return ret; - } - -+/* -+ * When we are logging a new inode X, check if it doesn't have a reference that -+ * matches the reference from some other inode Y created in a past transaction -+ * and that was renamed in the current transaction. If we don't do this, then at -+ * log replay time we can lose inode Y (and all its files if it's a directory): -+ * -+ * mkdir /mnt/x -+ * echo "hello world" > /mnt/x/foobar -+ * sync -+ * mv /mnt/x /mnt/y -+ * mkdir /mnt/x # or touch /mnt/x -+ * xfs_io -c fsync /mnt/x -+ * <power fail> -+ * mount fs, trigger log replay -+ * -+ * After the log replay procedure, we would lose the first directory and all its -+ * files (file foobar). -+ * For the case where inode Y is not a directory we simply end up losing it: -+ * -+ * echo "123" > /mnt/foo -+ * sync -+ * mv /mnt/foo /mnt/bar -+ * echo "abc" > /mnt/foo -+ * xfs_io -c fsync /mnt/foo -+ * <power fail> -+ * -+ * We also need this for cases where a snapshot entry is replaced by some other -+ * entry (file or directory) otherwise we end up with an unreplayable log due to -+ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as -+ * if it were a regular entry: -+ * -+ * mkdir /mnt/x -+ * btrfs subvolume snapshot /mnt /mnt/x/snap -+ * btrfs subvolume delete /mnt/x/snap -+ * rmdir /mnt/x -+ * mkdir /mnt/x -+ * fsync /mnt/x or fsync some new file inside it -+ * <power fail> -+ * -+ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in -+ * the same transaction. -+ */ -+static int btrfs_check_ref_name_override(struct extent_buffer *eb, -+ const int slot, -+ const struct btrfs_key *key, -+ struct inode *inode) -+{ -+ int ret; -+ struct btrfs_path *search_path; -+ char *name = NULL; -+ u32 name_len = 0; -+ u32 item_size = btrfs_item_size_nr(eb, slot); -+ u32 cur_offset = 0; -+ unsigned long ptr = btrfs_item_ptr_offset(eb, slot); -+ -+ search_path = btrfs_alloc_path(); -+ if (!search_path) -+ return -ENOMEM; -+ search_path->search_commit_root = 1; -+ search_path->skip_locking = 1; -+ -+ while (cur_offset < item_size) { -+ u64 parent; -+ u32 this_name_len; -+ u32 this_len; -+ unsigned long name_ptr; -+ struct btrfs_dir_item *di; -+ -+ if (key->type == BTRFS_INODE_REF_KEY) { -+ struct btrfs_inode_ref *iref; -+ -+ iref = (struct btrfs_inode_ref *)(ptr + cur_offset); -+ parent = key->offset; -+ this_name_len = btrfs_inode_ref_name_len(eb, iref); -+ name_ptr = (unsigned long)(iref + 1); -+ this_len = sizeof(*iref) + this_name_len; -+ } else { -+ struct btrfs_inode_extref *extref; -+ -+ extref = (struct btrfs_inode_extref *)(ptr + -+ cur_offset); -+ parent = btrfs_inode_extref_parent(eb, extref); -+ this_name_len = btrfs_inode_extref_name_len(eb, extref); -+ name_ptr = (unsigned long)&extref->name; -+ this_len = sizeof(*extref) + this_name_len; -+ } -+ -+ if (this_name_len > name_len) { -+ char *new_name; -+ -+ new_name = krealloc(name, this_name_len, GFP_NOFS); -+ if (!new_name) { -+ ret = -ENOMEM; -+ goto out; -+ } -+ name_len = this_name_len; -+ name = new_name; -+ } -+ -+ read_extent_buffer(eb, name, name_ptr, this_name_len); -+ di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root, -+ search_path, parent, -+ name, this_name_len, 0); -+ if (di && !IS_ERR(di)) { -+ ret = 1; -+ goto out; -+ } else if (IS_ERR(di)) { -+ ret = PTR_ERR(di); -+ goto out; -+ } -+ btrfs_release_path(search_path); -+ -+ cur_offset += this_len; -+ } -+ ret = 0; -+out: -+ btrfs_free_path(search_path); -+ kfree(name); -+ return ret; -+} -+ - /* log a single inode in the tree log. - * At least one parent directory for this inode must exist in the tree - * or be logged already. -@@ -4586,6 +4707,22 @@ again: - if (min_key.type == BTRFS_INODE_ITEM_KEY) - need_log_inode_item = false; - -+ if ((min_key.type == BTRFS_INODE_REF_KEY || -+ min_key.type == BTRFS_INODE_EXTREF_KEY) && -+ BTRFS_I(inode)->generation == trans->transid) { -+ ret = btrfs_check_ref_name_override(path->nodes[0], -+ path->slots[0], -+ &min_key, inode); -+ if (ret < 0) { -+ err = ret; -+ goto out_unlock; -+ } else if (ret > 0) { -+ err = 1; -+ btrfs_set_log_full_commit(root->fs_info, trans); -+ goto out_unlock; -+ } -+ } -+ - /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ - if (min_key.type == BTRFS_XATTR_ITEM_KEY) { - if (ins_nr == 0) -diff --git a/fs/dcache.c b/fs/dcache.c -index 2398f9f9..7566b26 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1667,7 +1667,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) - DCACHE_OP_REVALIDATE | - DCACHE_OP_WEAK_REVALIDATE | - DCACHE_OP_DELETE | -- DCACHE_OP_SELECT_INODE)); -+ DCACHE_OP_SELECT_INODE | -+ DCACHE_OP_REAL)); - dentry->d_op = op; - if (!op) - return; -@@ -1685,6 +1686,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) - dentry->d_flags |= DCACHE_OP_PRUNE; - if (op->d_select_inode) - dentry->d_flags |= DCACHE_OP_SELECT_INODE; -+ if (op->d_real) -+ dentry->d_flags |= DCACHE_OP_REAL; - - } - EXPORT_SYMBOL(d_set_d_op); -diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c -index 38f7562..ecb5439 100644 ---- a/fs/ext4/crypto.c -+++ b/fs/ext4/crypto.c -@@ -475,13 +475,16 @@ uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size) - */ - static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags) - { -- struct inode *dir = d_inode(dentry->d_parent); -- struct ext4_crypt_info *ci = EXT4_I(dir)->i_crypt_info; -+ struct dentry *dir; -+ struct ext4_crypt_info *ci; - int dir_has_key, cached_with_key; - -- if (!ext4_encrypted_inode(dir)) -+ dir = dget_parent(dentry); -+ if (!ext4_encrypted_inode(d_inode(dir))) { -+ dput(dir); - return 0; -- -+ } -+ ci = EXT4_I(d_inode(dir))->i_crypt_info; - if (ci && ci->ci_keyring_key && - (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | - (1 << KEY_FLAG_REVOKED) | -@@ -491,6 +494,7 @@ static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags) - /* this should eventually be an flag in d_flags */ - cached_with_key = dentry->d_fsdata != NULL; - dir_has_key = (ci != NULL); -+ dput(dir); - - /* - * If the dentry was cached without the key, and it is a -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 157b458a..b213449 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -900,6 +900,29 @@ do { \ - #include "extents_status.h" - - /* -+ * Lock subclasses for i_data_sem in the ext4_inode_info structure. -+ * -+ * These are needed to avoid lockdep false positives when we need to -+ * allocate blocks to the quota inode during ext4_map_blocks(), while -+ * holding i_data_sem for a normal (non-quota) inode. Since we don't -+ * do quota tracking for the quota inode, this avoids deadlock (as -+ * well as infinite recursion, since it isn't turtles all the way -+ * down...) -+ * -+ * I_DATA_SEM_NORMAL - Used for most inodes -+ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode -+ * where the second inode has larger inode number -+ * than the first -+ * I_DATA_SEM_QUOTA - Used for quota inodes only -+ */ -+enum { -+ I_DATA_SEM_NORMAL = 0, -+ I_DATA_SEM_OTHER, -+ I_DATA_SEM_QUOTA, -+}; -+ -+ -+/* - * fourth extended file system inode data in memory - */ - struct ext4_inode_info { -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 4cd318f..38847f3 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -335,7 +335,7 @@ static int ext4_file_open(struct inode * inode, struct file * filp) - struct super_block *sb = inode->i_sb; - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - struct vfsmount *mnt = filp->f_path.mnt; -- struct inode *dir = filp->f_path.dentry->d_parent->d_inode; -+ struct dentry *dir; - struct path path; - char buf[64], *cp; - int ret; -@@ -379,14 +379,18 @@ static int ext4_file_open(struct inode * inode, struct file * filp) - if (ext4_encryption_info(inode) == NULL) - return -ENOKEY; - } -- if (ext4_encrypted_inode(dir) && -- !ext4_is_child_context_consistent_with_parent(dir, inode)) { -+ -+ dir = dget_parent(file_dentry(filp)); -+ if (ext4_encrypted_inode(d_inode(dir)) && -+ !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) { - ext4_warning(inode->i_sb, - "Inconsistent encryption contexts: %lu/%lu\n", -- (unsigned long) dir->i_ino, -+ (unsigned long) d_inode(dir)->i_ino, - (unsigned long) inode->i_ino); -+ dput(dir); - return -EPERM; - } -+ dput(dir); - /* - * Set up the jbd2_inode if we are opening the inode for - * writing and the journal is present -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 4098acc..796ff0e 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) - { - if (first < second) { - down_write(&EXT4_I(first)->i_data_sem); -- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); -+ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); - } else { - down_write(&EXT4_I(second)->i_data_sem); -- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); -+ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); - - } - } -@@ -484,6 +484,13 @@ mext_check_arguments(struct inode *orig_inode, - return -EBUSY; - } - -+ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { -+ ext4_debug("ext4 move extent: The argument files should " -+ "not be quota files [ino:orig %lu, donor %lu]\n", -+ orig_inode->i_ino, donor_inode->i_ino); -+ return -EBUSY; -+ } -+ - /* Ext4 move extent supports only extent based file */ - if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { - ext4_debug("ext4 move extent: orig file is not extents " -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 3ed01ec..a76ca67 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1324,9 +1324,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args) - return -1; - } - if (ext4_has_feature_quota(sb)) { -- ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options " -- "when QUOTA feature is enabled"); -- return -1; -+ ext4_msg(sb, KERN_INFO, "Journaled quota options " -+ "ignored when QUOTA feature is enabled"); -+ return 1; - } - qname = match_strdup(args); - if (!qname) { -@@ -1689,10 +1689,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, - return -1; - } - if (ext4_has_feature_quota(sb)) { -- ext4_msg(sb, KERN_ERR, -- "Cannot set journaled quota options " -+ ext4_msg(sb, KERN_INFO, -+ "Quota format mount options ignored " - "when QUOTA feature is enabled"); -- return -1; -+ return 1; - } - sbi->s_jquota_fmt = m->mount_opt; - #endif -@@ -1753,11 +1753,11 @@ static int parse_options(char *options, struct super_block *sb, - #ifdef CONFIG_QUOTA - if (ext4_has_feature_quota(sb) && - (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) { -- ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA " -- "feature is enabled"); -- return 0; -- } -- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { -+ ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota " -+ "mount options ignored."); -+ clear_opt(sb, USRQUOTA); -+ clear_opt(sb, GRPQUOTA); -+ } else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { - if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA]) - clear_opt(sb, USRQUOTA); - -@@ -5021,6 +5021,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) - EXT4_SB(sb)->s_jquota_fmt, type); - } - -+static void lockdep_set_quota_inode(struct inode *inode, int subclass) -+{ -+ struct ext4_inode_info *ei = EXT4_I(inode); -+ -+ /* The first argument of lockdep_set_subclass has to be -+ * *exactly* the same as the argument to init_rwsem() --- in -+ * this case, in init_once() --- or lockdep gets unhappy -+ * because the name of the lock is set using the -+ * stringification of the argument to init_rwsem(). -+ */ -+ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ -+ lockdep_set_subclass(&ei->i_data_sem, subclass); -+} -+ - /* - * Standard function to be called on quota_on - */ -@@ -5060,8 +5074,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, - if (err) - return err; - } -- -- return dquot_quota_on(sb, type, format_id, path); -+ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); -+ err = dquot_quota_on(sb, type, format_id, path); -+ if (err) -+ lockdep_set_quota_inode(path->dentry->d_inode, -+ I_DATA_SEM_NORMAL); -+ return err; - } - - static int ext4_quota_enable(struct super_block *sb, int type, int format_id, -@@ -5088,8 +5106,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, - - /* Don't account quota for quota files to avoid recursion */ - qf_inode->i_flags |= S_NOQUOTA; -+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); - err = dquot_enable(qf_inode, type, format_id, flags); - iput(qf_inode); -+ if (err) -+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); - - return err; - } -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 9cce670..7ded177 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page **pages, nfs_readdir_descriptor_t *desc, - again: - timestamp = jiffies; - gencount = nfs_inc_attr_generation_counter(); -- error = NFS_PROTO(inode)->readdir(file->f_path.dentry, cred, entry->cookie, pages, -+ error = NFS_PROTO(inode)->readdir(file_dentry(file), cred, entry->cookie, pages, - NFS_SERVER(inode)->dtsize, desc->plus); - if (error < 0) { - /* We requested READDIRPLUS, but the server doesn't grok it */ -@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en - count++; - - if (desc->plus != 0) -- nfs_prime_dcache(desc->file->f_path.dentry, entry); -+ nfs_prime_dcache(file_dentry(desc->file), entry); - - status = nfs_readdir_add_to_array(entry, page); - if (status != 0) -@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalidate(struct inode *dir) - */ - static int nfs_readdir(struct file *file, struct dir_context *ctx) - { -- struct dentry *dentry = file->f_path.dentry; -+ struct dentry *dentry = file_dentry(file); - struct inode *inode = d_inode(dentry); - nfs_readdir_descriptor_t my_desc, - *desc = &my_desc; -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 86faecf..847b678 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -940,7 +940,7 @@ int nfs_open(struct inode *inode, struct file *filp) - { - struct nfs_open_context *ctx; - -- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); -+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); - nfs_file_set_open_context(filp, ctx); -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index 57ca1c8..2a9ff14 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -26,7 +26,7 @@ static int - nfs4_file_open(struct inode *inode, struct file *filp) - { - struct nfs_open_context *ctx; -- struct dentry *dentry = filp->f_path.dentry; -+ struct dentry *dentry = file_dentry(filp); - struct dentry *parent = NULL; - struct inode *dir; - unsigned openflags = filp->f_flags; -@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) - parent = dget_parent(dentry); - dir = d_inode(parent); - -- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); -+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); - err = PTR_ERR(ctx); - if (IS_ERR(ctx)) - goto out; -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 619ad4b..4399ea8 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -295,6 +295,37 @@ static void ovl_dentry_release(struct dentry *dentry) - } - } - -+static struct dentry *ovl_d_real(struct dentry *dentry, struct inode *inode) -+{ -+ struct dentry *real; -+ -+ if (d_is_dir(dentry)) { -+ if (!inode || inode == d_inode(dentry)) -+ return dentry; -+ goto bug; -+ } -+ -+ real = ovl_dentry_upper(dentry); -+ if (real && (!inode || inode == d_inode(real))) -+ return real; -+ -+ real = ovl_dentry_lower(dentry); -+ if (!real) -+ goto bug; -+ -+ if (!inode || inode == d_inode(real)) -+ return real; -+ -+ /* Handle recursion */ -+ if (real->d_flags & DCACHE_OP_REAL) -+ return real->d_op->d_real(real, inode); -+ -+bug: -+ WARN(1, "ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n", dentry, -+ inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0); -+ return dentry; -+} -+ - static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags) - { - struct ovl_entry *oe = dentry->d_fsdata; -@@ -339,11 +370,13 @@ static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags) - static const struct dentry_operations ovl_dentry_operations = { - .d_release = ovl_dentry_release, - .d_select_inode = ovl_d_select_inode, -+ .d_real = ovl_d_real, - }; - - static const struct dentry_operations ovl_reval_dentry_operations = { - .d_release = ovl_dentry_release, - .d_select_inode = ovl_d_select_inode, -+ .d_real = ovl_d_real, - .d_revalidate = ovl_dentry_revalidate, - .d_weak_revalidate = ovl_dentry_weak_revalidate, - }; -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 22ab246..eeae401 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -199,7 +199,7 @@ - #define unreachable() __builtin_unreachable() - - /* Mark a function definition as prohibited from being cloned. */ --#define __noclone __attribute__((__noclone__)) -+#define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) - - #endif /* GCC_VERSION >= 40500 */ - -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index c4b5f4b..03dda7b 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -161,6 +161,7 @@ struct dentry_operations { - struct vfsmount *(*d_automount)(struct path *); - int (*d_manage)(struct dentry *, bool); - struct inode *(*d_select_inode)(struct dentry *, unsigned); -+ struct dentry *(*d_real)(struct dentry *, struct inode *); - } ____cacheline_aligned; - - /* -@@ -227,6 +228,7 @@ struct dentry_operations { - #define DCACHE_MAY_FREE 0x00800000 - #define DCACHE_FALLTHRU 0x01000000 /* Fall through to lower layer */ - #define DCACHE_OP_SELECT_INODE 0x02000000 /* Unioned entry: dcache op selects inode */ -+#define DCACHE_OP_REAL 0x08000000 - - extern seqlock_t rename_lock; - -@@ -582,4 +584,12 @@ static inline struct dentry *d_backing_dentry(struct dentry *upper) - return upper; - } - -+static inline struct dentry *d_real(struct dentry *dentry) -+{ -+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) -+ return dentry->d_op->d_real(dentry, NULL); -+ else -+ return dentry; -+} -+ - #endif /* __LINUX_DCACHE_H */ -diff --git a/include/linux/filter.h b/include/linux/filter.h -index 43aa1f8..a51a536 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -465,10 +465,14 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog, - void bpf_prog_destroy(struct bpf_prog *fp); - - int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk); -+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, -+ bool locked); - int sk_attach_bpf(u32 ufd, struct sock *sk); - int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk); - int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk); - int sk_detach_filter(struct sock *sk); -+int __sk_detach_filter(struct sock *sk, bool locked); -+ - int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, - unsigned int len); - -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 2c7f8d9..83c77b0 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -1234,6 +1234,16 @@ static inline struct inode *file_inode(const struct file *f) - return f->f_inode; - } - -+static inline struct dentry *file_dentry(const struct file *file) -+{ -+ struct dentry *dentry = file->f_path.dentry; -+ -+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) -+ return dentry->d_op->d_real(dentry, file_inode(file)); -+ else -+ return dentry; -+} -+ - static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl) - { - return locks_lock_inode_wait(file_inode(filp), fl); -diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h -index a338a688..dcb89e3 100644 ---- a/include/linux/if_bridge.h -+++ b/include/linux/if_bridge.h -@@ -46,10 +46,6 @@ struct br_ip_list { - #define BR_LEARNING_SYNC BIT(9) - #define BR_PROXYARP_WIFI BIT(10) - --/* values as per ieee8021QBridgeFdbAgingTime */ --#define BR_MIN_AGEING_TIME (10 * HZ) --#define BR_MAX_AGEING_TIME (1000000 * HZ) -- - #define BR_DEFAULT_AGEING_TIME (300 * HZ) - - extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *)); -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 5440b7b..6d1d8f4 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -267,6 +267,7 @@ struct header_ops { - void (*cache_update)(struct hh_cache *hh, - const struct net_device *dev, - const unsigned char *haddr); -+ bool (*validate)(const char *ll_header, unsigned int len); - }; - - /* These flag bits are private to the generic network queueing -@@ -1420,8 +1421,7 @@ enum netdev_priv_flags { - * @dma: DMA channel - * @mtu: Interface MTU value - * @type: Interface hardware type -- * @hard_header_len: Hardware header length, which means that this is the -- * minimum size of a packet. -+ * @hard_header_len: Maximum hardware header length. - * - * @needed_headroom: Extra headroom the hardware may need, but not in all - * cases can this be guaranteed -@@ -2627,6 +2627,24 @@ static inline int dev_parse_header(const struct sk_buff *skb, - return dev->header_ops->parse(skb, haddr); - } - -+/* ll_header must have at least hard_header_len allocated */ -+static inline bool dev_validate_header(const struct net_device *dev, -+ char *ll_header, int len) -+{ -+ if (likely(len >= dev->hard_header_len)) -+ return true; -+ -+ if (capable(CAP_SYS_RAWIO)) { -+ memset(ll_header + len, 0, dev->hard_header_len - len); -+ return true; -+ } -+ -+ if (dev->header_ops && dev->header_ops->validate) -+ return dev->header_ops->validate(ll_header, len); -+ -+ return false; -+} -+ - typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len); - int register_gifconf(unsigned int family, gifconf_func_t *gifconf); - static inline int unregister_gifconf(unsigned int family) -diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h -index 7f5f78b..245f57d 100644 ---- a/include/linux/usb_usual.h -+++ b/include/linux/usb_usual.h -@@ -79,6 +79,8 @@ - /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \ - US_FLAG(MAX_SECTORS_240, 0x08000000) \ - /* Sets max_sectors to 240 */ \ -+ US_FLAG(NO_REPORT_LUNS, 0x10000000) \ -+ /* Cannot handle REPORT_LUNS */ \ - - #define US_FLAG(name, value) US_FL_##name = value , - enum { US_DO_ALL_FLAGS }; -diff --git a/include/net/bonding.h b/include/net/bonding.h -index ee6c520..791800d 100644 ---- a/include/net/bonding.h -+++ b/include/net/bonding.h -@@ -215,6 +215,7 @@ struct bonding { - * ALB mode (6) - to sync the use and modifications of its hash table - */ - spinlock_t mode_lock; -+ spinlock_t stats_lock; - u8 send_peer_notif; - u8 igmp_retrans; - #ifdef CONFIG_PROC_FS -diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h -index f63a167..ba93c0f 100644 ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -513,6 +513,31 @@ static inline int scsi_device_tpgs(struct scsi_device *sdev) - return sdev->inquiry ? (sdev->inquiry[5] >> 4) & 0x3 : 0; - } - -+/** -+ * scsi_device_supports_vpd - test if a device supports VPD pages -+ * @sdev: the &struct scsi_device to test -+ * -+ * If the 'try_vpd_pages' flag is set it takes precedence. -+ * Otherwise we will assume VPD pages are supported if the -+ * SCSI level is at least SPC-3 and 'skip_vpd_pages' is not set. -+ */ -+static inline int scsi_device_supports_vpd(struct scsi_device *sdev) -+{ -+ /* Attempt VPD inquiry if the device blacklist explicitly calls -+ * for it. -+ */ -+ if (sdev->try_vpd_pages) -+ return 1; -+ /* -+ * Although VPD inquiries can go to SCSI-2 type devices, -+ * some USB ones crash on receiving them, and the pages -+ * we currently ask for are for SPC-3 and beyond -+ */ -+ if (sdev->scsi_level > SCSI_SPC_2 && !sdev->skip_vpd_pages) -+ return 1; -+ return 0; -+} -+ - #define MODULE_ALIAS_SCSI_DEVICE(type) \ - MODULE_ALIAS("scsi:t-" __stringify(type) "*") - #define SCSI_DEVICE_MODALIAS_FMT "scsi:t-0x%02x" -diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c -index 4504ca6..50da680 100644 ---- a/kernel/bpf/helpers.c -+++ b/kernel/bpf/helpers.c -@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5) - if (!task) - return -EINVAL; - -- memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); -+ strlcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); - return 0; - } - -diff --git a/mm/page_isolation.c b/mm/page_isolation.c -index 92c4c36..31555b6 100644 ---- a/mm/page_isolation.c -+++ b/mm/page_isolation.c -@@ -289,11 +289,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private, - * now as a simple work-around, we use the next node for destination. - */ - if (PageHuge(page)) { -- nodemask_t src = nodemask_of_node(page_to_nid(page)); -- nodemask_t dst; -- nodes_complement(dst, src); -+ int node = next_online_node(page_to_nid(page)); -+ if (node == MAX_NUMNODES) -+ node = first_online_node; - return alloc_huge_page_node(page_hstate(compound_head(page)), -- next_node(page_to_nid(page), dst)); -+ node); - } - - if (PageHighMem(page)) -diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c -index b563a3f..2fa3be9 100644 ---- a/net/ax25/ax25_ip.c -+++ b/net/ax25/ax25_ip.c -@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - } - #endif - -+static bool ax25_validate_header(const char *header, unsigned int len) -+{ -+ ax25_digi digi; -+ -+ if (!len) -+ return false; -+ -+ if (header[0]) -+ return true; -+ -+ return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL, -+ NULL); -+} -+ - const struct header_ops ax25_header_ops = { - .create = ax25_hard_header, -+ .validate = ax25_validate_header, - }; - - EXPORT_SYMBOL(ax25_header_ops); -diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c -index b3cca12..e2670c5 100644 ---- a/net/bridge/br_stp.c -+++ b/net/bridge/br_stp.c -@@ -568,6 +568,14 @@ int br_set_max_age(struct net_bridge *br, unsigned long val) - - } - -+/* Set time interval that dynamic forwarding entries live -+ * For pure software bridge, allow values outside the 802.1 -+ * standard specification for special cases: -+ * 0 - entry never ages (all permanant) -+ * 1 - entry disappears (no persistance) -+ * -+ * Offloaded switch entries maybe more restrictive -+ */ - int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) - { - struct switchdev_attr attr = { -@@ -579,11 +587,8 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) - unsigned long t = clock_t_to_jiffies(ageing_time); - int err; - -- if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME) -- return -ERANGE; -- - err = switchdev_port_attr_set(br->dev, &attr); -- if (err) -+ if (err && err != -EOPNOTSUPP) - return err; - - br->ageing_time = t; -diff --git a/net/core/filter.c b/net/core/filter.c -index bba502f..fb2951c 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -1147,7 +1147,8 @@ void bpf_prog_destroy(struct bpf_prog *fp) - } - EXPORT_SYMBOL_GPL(bpf_prog_destroy); - --static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) -+static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk, -+ bool locked) - { - struct sk_filter *fp, *old_fp; - -@@ -1163,10 +1164,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) - return -ENOMEM; - } - -- old_fp = rcu_dereference_protected(sk->sk_filter, -- sock_owned_by_user(sk)); -+ old_fp = rcu_dereference_protected(sk->sk_filter, locked); - rcu_assign_pointer(sk->sk_filter, fp); -- - if (old_fp) - sk_filter_uncharge(sk, old_fp); - -@@ -1245,7 +1244,8 @@ struct bpf_prog *__get_filter(struct sock_fprog *fprog, struct sock *sk) - * occurs or there is insufficient memory for the filter a negative - * errno code is returned. On success the return is zero. - */ --int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) -+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, -+ bool locked) - { - struct bpf_prog *prog = __get_filter(fprog, sk); - int err; -@@ -1253,7 +1253,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) - if (IS_ERR(prog)) - return PTR_ERR(prog); - -- err = __sk_attach_prog(prog, sk); -+ err = __sk_attach_prog(prog, sk, locked); - if (err < 0) { - __bpf_prog_release(prog); - return err; -@@ -1261,7 +1261,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) - - return 0; - } --EXPORT_SYMBOL_GPL(sk_attach_filter); -+EXPORT_SYMBOL_GPL(__sk_attach_filter); -+ -+int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) -+{ -+ return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk)); -+} - - int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk) - { -@@ -1307,7 +1312,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk) - if (IS_ERR(prog)) - return PTR_ERR(prog); - -- err = __sk_attach_prog(prog, sk); -+ err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk)); - if (err < 0) { - bpf_prog_put(prog); - return err; -@@ -2105,7 +2110,7 @@ static int __init register_sk_filter_ops(void) - } - late_initcall(register_sk_filter_ops); - --int sk_detach_filter(struct sock *sk) -+int __sk_detach_filter(struct sock *sk, bool locked) - { - int ret = -ENOENT; - struct sk_filter *filter; -@@ -2113,8 +2118,7 @@ int sk_detach_filter(struct sock *sk) - if (sock_flag(sk, SOCK_FILTER_LOCKED)) - return -EPERM; - -- filter = rcu_dereference_protected(sk->sk_filter, -- sock_owned_by_user(sk)); -+ filter = rcu_dereference_protected(sk->sk_filter, locked); - if (filter) { - RCU_INIT_POINTER(sk->sk_filter, NULL); - sk_filter_uncharge(sk, filter); -@@ -2123,7 +2127,12 @@ int sk_detach_filter(struct sock *sk) - - return ret; - } --EXPORT_SYMBOL_GPL(sk_detach_filter); -+EXPORT_SYMBOL_GPL(__sk_detach_filter); -+ -+int sk_detach_filter(struct sock *sk) -+{ -+ return __sk_detach_filter(sk, sock_owned_by_user(sk)); -+} - - int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, - unsigned int len) -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 8261d95..215e613 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, - + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */ - + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */ - + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */ -+ + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */ - + nla_total_size(1); /* IFLA_PROTO_DOWN */ - - } -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 902d606..8be8f27 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 seq) - * ICMPs are not backlogged, hence we cannot get an established - * socket here. - */ -- WARN_ON(req->sk); -- - if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) { - NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); - } else { -diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c -index fa4daba..d8fb47f 100644 ---- a/net/dsa/dsa.c -+++ b/net/dsa/dsa.c -@@ -935,6 +935,14 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst) - { - int i; - -+ dst->master_netdev->dsa_ptr = NULL; -+ -+ /* If we used a tagging format that doesn't have an ethertype -+ * field, make sure that all packets from this point get sent -+ * without the tag and go through the regular receive path. -+ */ -+ wmb(); -+ - for (i = 0; i < dst->pd->nr_chips; i++) { - struct dsa_switch *ds = dst->ds[i]; - -@@ -988,14 +996,6 @@ static int dsa_suspend(struct device *d) - struct dsa_switch_tree *dst = platform_get_drvdata(pdev); - int i, ret = 0; - -- dst->master_netdev->dsa_ptr = NULL; -- -- /* If we used a tagging format that doesn't have an ethertype -- * field, make sure that all packets from this point get sent -- * without the tag and go through the regular receive path. -- */ -- wmb(); -- - for (i = 0; i < dst->pd->nr_chips; i++) { - struct dsa_switch *ds = dst->ds[i]; - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index f6303b1..0212591 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - - ASSERT_RTNL(); - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* 1. Deleting primary ifaddr forces deletion all secondaries - * unless alias promotion is set - **/ -@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, - fib_del_ifaddr(ifa, ifa1); - } - -+no_promotions: - /* 2. Unlink it */ - - *ifap = ifa1->ifa_next; -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 4734475..8a9246d 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) - struct in_device *in_dev; - struct fib_result res; - struct rtable *rt; -- struct flowi4 fl4; - struct net *net; - int scope; - -@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) - - scope = RT_SCOPE_UNIVERSE; - if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { -- fl4.flowi4_oif = 0; -- fl4.flowi4_iif = LOOPBACK_IFINDEX; -- fl4.daddr = ip_hdr(skb)->saddr; -- fl4.saddr = 0; -- fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); -- fl4.flowi4_scope = scope; -- fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0; -- fl4.flowi4_tun_key.tun_id = 0; -+ struct flowi4 fl4 = { -+ .flowi4_iif = LOOPBACK_IFINDEX, -+ .daddr = ip_hdr(skb)->saddr, -+ .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), -+ .flowi4_scope = scope, -+ .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0, -+ }; - if (!fib_lookup(net, &fl4, &res, 0)) - return FIB_RES_PREFSRC(net, res); - } else { -@@ -922,6 +920,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - subnet = 1; - } - -+ if (in_dev->dead) -+ goto no_promotions; -+ - /* Deletion is more complicated than add. - * We should take care of not to delete too much :-) - * -@@ -997,6 +998,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) - } - } - -+no_promotions: - if (!(ok & BRD_OK)) - fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); - if (subnet && ifa->ifa_prefixlen < 31) { -diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -index c6eb421..ea91058 100644 ---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c -@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, - unsigned long event, - void *ptr) - { -- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; -+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; - struct netdev_notifier_info info; - -- netdev_notifier_info_init(&info, dev); -+ /* The masq_dev_notifier will catch the case of the device going -+ * down. So if the inetdev is dead and being destroyed we have -+ * no work to do. Otherwise this is an individual address removal -+ * and we have to perform the flush. -+ */ -+ if (idev->dead) -+ return NOTIFY_DONE; -+ -+ netdev_notifier_info_init(&info, idev->dev); - return masq_device_event(this, event, &info); - } - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 487ac67..a7b1a90 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -319,8 +319,6 @@ void tcp_req_err(struct sock *sk, u32 seq, bool abort) - /* ICMPs are not backlogged, hence we cannot get - * an established socket here. - */ -- WARN_ON(req->sk); -- - if (seq != tcp_rsk(req)->snt_isn) { - NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); - } else if (abort) { -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 95d2f19..eb8933b 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -2082,10 +2082,14 @@ void udp_v4_early_demux(struct sk_buff *skb) - if (!in_dev) - return; - -- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, -- iph->protocol); -- if (!ours) -- return; -+ /* we are supposed to accept bcast packets */ -+ if (skb->pkt_type == PACKET_MULTICAST) { -+ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, -+ iph->protocol); -+ if (!ours) -+ return; -+ } -+ - sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, - uh->source, iph->saddr, dif); - } else if (skb->pkt_type == PACKET_HOST) { -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index a163102..2a6606c 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk, - int getfrag(void *from, char *to, int offset, int len, - int odd, struct sk_buff *skb), - void *from, int length, int hh_len, int fragheaderlen, -- int transhdrlen, int mtu, unsigned int flags, -- const struct flowi6 *fl6) -+ int exthdrlen, int transhdrlen, int mtu, -+ unsigned int flags, const struct flowi6 *fl6) - - { - struct sk_buff *skb; -@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk, - skb_put(skb, fragheaderlen + transhdrlen); - - /* initialize network header pointer */ -- skb_reset_network_header(skb); -+ skb_set_network_header(skb, exthdrlen); - - /* initialize protocol header pointer */ - skb->transport_header = skb->network_header + fragheaderlen; -@@ -1359,7 +1359,7 @@ emsgsize: - (rt->dst.dev->features & NETIF_F_UFO) && - (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { - err = ip6_ufo_append_data(sk, queue, getfrag, from, length, -- hh_len, fragheaderlen, -+ hh_len, fragheaderlen, exthdrlen, - transhdrlen, mtu, flags, fl6); - if (err) - goto error; -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 6c5dfec..3991b21 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev) - - t = netdev_priv(dev); - -+ dev->rtnl_link_ops = &ip6_link_ops; - err = register_netdevice(dev); - if (err < 0) - goto out; - - strcpy(t->parms.name, dev->name); -- dev->rtnl_link_ops = &ip6_link_ops; - - dev_hold(dev); - ip6_tnl_link(ip6n, t); -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 422dd01..6794120 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -883,8 +883,8 @@ start_lookup: - flush_stack(stack, count, skb, count - 1); - } else { - if (!inner_flushed) -- UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, -- proto == IPPROTO_UDPLITE); -+ UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, -+ proto == IPPROTO_UDPLITE); - consume_skb(skb); - } - return 0; -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index ec22078..42de4cc 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) - struct l2tp_tunnel *tunnel = NULL; - int length; - -- /* Point to L2TP header */ -- optr = ptr = skb->data; -- - if (!pskb_may_pull(skb, 4)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; - session_id = ntohl(*((__be32 *) ptr)); - ptr += 4; - -@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) - if (!pskb_may_pull(skb, length)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; -+ ptr += 4; - pr_debug("%s: ip recv\n", tunnel->name); - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index a2c8747..9ee4ddb 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) - struct l2tp_tunnel *tunnel = NULL; - int length; - -- /* Point to L2TP header */ -- optr = ptr = skb->data; -- - if (!pskb_may_pull(skb, 4)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; - session_id = ntohl(*((__be32 *) ptr)); - ptr += 4; - -@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) - if (!pskb_may_pull(skb, length)) - goto discard; - -+ /* Point to L2TP header */ -+ optr = ptr = skb->data; -+ ptr += 4; - pr_debug("%s: ip recv\n", tunnel->name); - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } -diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c -index 978d3bc..1b33d89 100644 ---- a/net/mac80211/ibss.c -+++ b/net/mac80211/ibss.c -@@ -7,6 +7,7 @@ - * Copyright 2007, Michael Wu <flamingice@sourmilk.net> - * Copyright 2009, Johannes Berg <johannes@sipsolutions.net> - * Copyright 2013-2014 Intel Mobile Communications GmbH -+ * Copyright(c) 2016 Intel Deutschland GmbH - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -1485,14 +1486,21 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata) - - sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); - -- num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, -- &ifibss->chandef, -- channels, -- ARRAY_SIZE(channels)); - scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef); -- ieee80211_request_ibss_scan(sdata, ifibss->ssid, -- ifibss->ssid_len, channels, num, -- scan_width); -+ -+ if (ifibss->fixed_channel) { -+ num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, -+ &ifibss->chandef, -+ channels, -+ ARRAY_SIZE(channels)); -+ ieee80211_request_ibss_scan(sdata, ifibss->ssid, -+ ifibss->ssid_len, channels, -+ num, scan_width); -+ } else { -+ ieee80211_request_ibss_scan(sdata, ifibss->ssid, -+ ifibss->ssid_len, NULL, -+ 0, scan_width); -+ } - } else { - int interval = IEEE80211_SCAN_INTERVAL; - -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index c9e325d..7a2b791 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, - if (sdata->vif.txq) { - struct txq_info *txqi = to_txq_info(sdata->vif.txq); - -+ spin_lock_bh(&txqi->queue.lock); - ieee80211_purge_tx_queue(&local->hw, &txqi->queue); -+ spin_unlock_bh(&txqi->queue.lock); -+ - atomic_set(&sdata->txqs_len[txqi->txq.ac], 0); - } - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 60d093f..261df74 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2249,7 +2249,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - struct ieee80211_local *local = rx->local; - struct ieee80211_sub_if_data *sdata = rx->sdata; - struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -- u16 q, hdrlen; -+ u16 ac, q, hdrlen; - - hdr = (struct ieee80211_hdr *) skb->data; - hdrlen = ieee80211_hdrlen(hdr->frame_control); -@@ -2318,7 +2318,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - ether_addr_equal(sdata->vif.addr, hdr->addr3)) - return RX_CONTINUE; - -- q = ieee80211_select_queue_80211(sdata, skb, hdr); -+ ac = ieee80211_select_queue_80211(sdata, skb, hdr); -+ q = sdata->vif.hw_queue[ac]; - if (ieee80211_queue_stopped(&local->hw, q)) { - IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); - return RX_DROP_MONITOR; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index a4a4f89..23ed038 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -257,11 +257,11 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) - } - - /* Caller must hold local->sta_mtx */ --static void sta_info_hash_add(struct ieee80211_local *local, -- struct sta_info *sta) -+static int sta_info_hash_add(struct ieee80211_local *local, -+ struct sta_info *sta) - { -- rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, -- sta_rht_params); -+ return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, -+ sta_rht_params); - } - - static void sta_deliver_ps_frames(struct work_struct *wk) -@@ -498,11 +498,17 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - { - struct ieee80211_local *local = sta->local; - struct ieee80211_sub_if_data *sdata = sta->sdata; -- struct station_info sinfo; -+ struct station_info *sinfo; - int err = 0; - - lockdep_assert_held(&local->sta_mtx); - -+ sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); -+ if (!sinfo) { -+ err = -ENOMEM; -+ goto out_err; -+ } -+ - /* check if STA exists already */ - if (sta_info_get_bss(sdata, sta->sta.addr)) { - err = -EEXIST; -@@ -517,7 +523,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - set_sta_flag(sta, WLAN_STA_BLOCK_BA); - - /* make the station visible */ -- sta_info_hash_add(local, sta); -+ err = sta_info_hash_add(local, sta); -+ if (err) -+ goto out_drop_sta; - - list_add_tail_rcu(&sta->list, &local->sta_list); - -@@ -534,10 +542,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - ieee80211_sta_debugfs_add(sta); - rate_control_add_sta_debugfs(sta); - -- memset(&sinfo, 0, sizeof(sinfo)); -- sinfo.filled = 0; -- sinfo.generation = local->sta_generation; -- cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); -+ sinfo->generation = local->sta_generation; -+ cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); -+ kfree(sinfo); - - sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr); - -@@ -552,6 +559,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) - out_remove: - sta_info_hash_del(local, sta); - list_del_rcu(&sta->list); -+ out_drop_sta: - local->num_sta--; - synchronize_net(); - __cleanup_single_sta(sta); -@@ -898,7 +906,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - { - struct ieee80211_local *local = sta->local; - struct ieee80211_sub_if_data *sdata = sta->sdata; -- struct station_info sinfo = {}; -+ struct station_info *sinfo; - int ret; - - /* -@@ -936,8 +944,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - - sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr); - -- sta_set_sinfo(sta, &sinfo); -- cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); -+ sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL); -+ if (sinfo) -+ sta_set_sinfo(sta, sinfo); -+ cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); -+ kfree(sinfo); - - rate_control_remove_sta_debugfs(sta); - ieee80211_sta_debugfs_remove(sta); -diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c -index b18c5ed..0b80a71 100644 ---- a/net/mpls/af_mpls.c -+++ b/net/mpls/af_mpls.c -@@ -543,6 +543,9 @@ static struct net_device *find_outdev(struct net *net, - if (!dev) - return ERR_PTR(-ENODEV); - -+ if (IS_ERR(dev)) -+ return dev; -+ - /* The caller is holding rtnl anyways, so release the dev reference */ - dev_put(dev); - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 992396a..da1ae0e1 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1916,6 +1916,10 @@ retry: - goto retry; - } - -+ if (!dev_validate_header(dev, skb->data, len)) { -+ err = -EINVAL; -+ goto out_unlock; -+ } - if (len > (dev->mtu + dev->hard_header_len + extra_len) && - !packet_extra_vlan_len_allowed(dev, skb)) { - err = -EMSGSIZE; -@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb) - sock_wfree(skb); - } - --static bool ll_header_truncated(const struct net_device *dev, int len) --{ -- /* net device doesn't like empty head */ -- if (unlikely(len < dev->hard_header_len)) { -- net_warn_ratelimited("%s: packet size is too short (%d < %d)\n", -- current->comm, len, dev->hard_header_len); -- return true; -- } -- -- return false; --} -- - static void tpacket_set_protocol(const struct net_device *dev, - struct sk_buff *skb) - { -@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - if (unlikely(err < 0)) - return -EINVAL; - } else if (dev->hard_header_len) { -- if (ll_header_truncated(dev, tp_len)) -- return -EINVAL; -+ int hdrlen = min_t(int, dev->hard_header_len, tp_len); - - skb_push(skb, dev->hard_header_len); -- err = skb_store_bits(skb, 0, data, -- dev->hard_header_len); -+ err = skb_store_bits(skb, 0, data, hdrlen); - if (unlikely(err)) - return err; -+ if (!dev_validate_header(dev, skb->data, hdrlen)) -+ return -EINVAL; - if (!skb->protocol) - tpacket_set_protocol(dev, skb); - -- data += dev->hard_header_len; -- to_write -= dev->hard_header_len; -+ data += hdrlen; -+ to_write -= hdrlen; - } - - offset = offset_in_page(data); -@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len); - if (unlikely(offset < 0)) - goto out_free; -- } else { -- if (ll_header_truncated(dev, len)) -- goto out_free; - } - - /* Returns -EFAULT on error */ -@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - if (err) - goto out_free; - -+ if (sock->type == SOCK_RAW && -+ !dev_validate_header(dev, skb->data, len)) { -+ err = -EINVAL; -+ goto out_free; -+ } -+ - sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags); - - if (!gso_type && (len > dev->mtu + reserve + extra_len) && -diff --git a/net/socket.c b/net/socket.c -index c044d1e..db13ae8 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2240,31 +2240,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, - cond_resched(); - } - --out_put: -- fput_light(sock->file, fput_needed); -- - if (err == 0) -- return datagrams; -+ goto out_put; - -- if (datagrams != 0) { -+ if (datagrams == 0) { -+ datagrams = err; -+ goto out_put; -+ } -+ -+ /* -+ * We may return less entries than requested (vlen) if the -+ * sock is non block and there aren't enough datagrams... -+ */ -+ if (err != -EAGAIN) { - /* -- * We may return less entries than requested (vlen) if the -- * sock is non block and there aren't enough datagrams... -+ * ... or if recvmsg returns an error after we -+ * received some datagrams, where we record the -+ * error to return on the next call or if the -+ * app asks about it using getsockopt(SO_ERROR). - */ -- if (err != -EAGAIN) { -- /* -- * ... or if recvmsg returns an error after we -- * received some datagrams, where we record the -- * error to return on the next call or if the -- * app asks about it using getsockopt(SO_ERROR). -- */ -- sock->sk->sk_err = -err; -- } -- -- return datagrams; -+ sock->sk->sk_err = -err; - } -+out_put: -+ fput_light(sock->file, fput_needed); - -- return err; -+ return datagrams; - } - - SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, -diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c -index ad7f5b3..1c4ad47 100644 ---- a/net/xfrm/xfrm_input.c -+++ b/net/xfrm/xfrm_input.c -@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) - XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; - - skb_dst_force(skb); -+ dev_hold(skb->dev); - - nexthdr = x->type->input(x, skb); - - if (nexthdr == -EINPROGRESS) - return 0; - resume: -+ dev_put(skb->dev); -+ - spin_lock(&x->lock); - if (nexthdr <= 0) { - if (nexthdr == -EBADMSG) { -diff --git a/sound/core/timer.c b/sound/core/timer.c -index dca817f..e5e7e43 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -1041,8 +1041,8 @@ static int snd_timer_s_start(struct snd_timer * timer) - njiff += timer->sticks - priv->correction; - priv->correction = 0; - } -- priv->last_expires = priv->tlist.expires = njiff; -- add_timer(&priv->tlist); -+ priv->last_expires = njiff; -+ mod_timer(&priv->tlist, njiff); - return 0; - } - -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index e68fa44..0c95856 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -1623,6 +1623,8 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin, - - mutex_lock(&per_pin->lock); - pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE); -+ eld->monitor_present = pin_eld->monitor_present; -+ - if (pin_eld->monitor_present) - eld->eld_valid = !!(present & AC_PINSENSE_ELDV); - else -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 4f5ca0b..1402ba9 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4759,6 +4759,8 @@ enum { - ALC255_FIXUP_DELL_SPK_NOISE, - ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC280_FIXUP_HP_HEADSET_MIC, -+ ALC221_FIXUP_HP_FRONT_MIC, -+ ALC292_FIXUP_TPT460, - }; - - static const struct hda_fixup alc269_fixups[] = { -@@ -5401,6 +5403,19 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC269_FIXUP_HEADSET_MIC, - }, -+ [ALC221_FIXUP_HP_FRONT_MIC] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x19, 0x02a19020 }, /* Front Mic */ -+ { } -+ }, -+ }, -+ [ALC292_FIXUP_TPT460] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc_fixup_tpt440_dock, -+ .chained = true, -+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, -+ }, - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -@@ -5506,6 +5521,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), -+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), - SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), - SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), -@@ -5554,7 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK), - SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), -- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), -+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), - SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), -@@ -5649,6 +5665,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, - {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, - {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, -+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, - {} - }; - #define ALC225_STANDARD_PINS \ -@@ -6406,6 +6423,7 @@ enum { - ALC668_FIXUP_AUTO_MUTE, - ALC668_FIXUP_DELL_DISABLE_AAMIX, - ALC668_FIXUP_DELL_XPS13, -+ ALC662_FIXUP_ASUS_Nx50, - }; - - static const struct hda_fixup alc662_fixups[] = { -@@ -6646,6 +6664,12 @@ static const struct hda_fixup alc662_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_bass_chmap, - }, -+ [ALC662_FIXUP_ASUS_Nx50] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc_fixup_auto_mute_via_amp, -+ .chained = true, -+ .chain_id = ALC662_FIXUP_BASS_1A -+ }, - }; - - static const struct snd_pci_quirk alc662_fixup_tbl[] = { -@@ -6668,8 +6692,9 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), -- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A), -+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), - SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A), -+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), - SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP), - SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16), - SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16), -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index ddca654..1f8fb0d9 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = { - }; - - /* -+ * Dell usb dock with ALC4020 codec had a firmware problem where it got -+ * screwed up when zero volume is passed; just skip it as a workaround -+ */ -+static const struct usbmix_name_map dell_alc4020_map[] = { -+ { 16, NULL }, -+ { 19, NULL }, -+ { 0 } -+}; -+ -+/* - * Control map entries - */ - -@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { - .map = aureon_51_2_map, - }, - { -+ .id = USB_ID(0x0bda, 0x4014), -+ .map = dell_alc4020_map, -+ }, -+ { - .id = USB_ID(0x0dba, 0x1000), - .map = mbox1_map, - }, -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index cd7eac2..001fb4d 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1135,9 +1135,11 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ - case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ - case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ -+ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */ - case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ - case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ -+ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ - case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */ - return true; - } diff --git a/4.5.2/0000_README b/4.5.3/0000_README index 53f08f8..8d5157e 100644 --- a/4.5.2/0000_README +++ b/4.5.3/0000_README @@ -2,11 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1001_linux-4.5.2.patch -From: http://www.kernel.org -Desc: Linux 4.5.2 - -Patch: 4420_grsecurity-3.1-4.5.2-201604290633.patch +Patch: 4420_grsecurity-3.1-4.5.3-201605080858.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch b/4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch index 89fb9b5..c17a23a 100644 --- a/4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch +++ b/4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch @@ -408,7 +408,7 @@ index a93b414..f50a50b 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index 1ecaaeb..8e81686 100644 +index 9b56a6c..98a3817 100644 --- a/Makefile +++ b/Makefile @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -928,7 +928,7 @@ index 8a188bc..26608f1 100644 Counts number of I and D TLB Misses and exports them via Debugfs The counters can be cleared via Debugfs as well diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index 4f799e5..261490f 100644 +index 4f799e5..cc1200e 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -1622,6 +1622,7 @@ config HIGHPTE @@ -956,6 +956,15 @@ index 4f799e5..261490f 100644 help kexec is a system call that implements the ability to shutdown your current kernel, and to start another kernel. It is like a reboot +@@ -1997,7 +1999,7 @@ config EFI_STUB + + config EFI + bool "UEFI runtime support" +- depends on OF && !CPU_BIG_ENDIAN && MMU && AUTO_ZRELADDR && !XIP_KERNEL ++ depends on OF && !CPU_BIG_ENDIAN && MMU && AUTO_ZRELADDR && !XIP_KERNEL && !PAX_KERNEXEC + select UCS2_STRING + select EFI_PARAMS_FROM_FDT + select EFI_STUB diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug index c6b6175..2884505 100644 --- a/arch/arm/Kconfig.debug @@ -1635,7 +1644,7 @@ index 3848259..bee9d84 100644 struct of_cpuidle_method { const char *method; diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h -index fc8ba16..0c20017 100644 +index fc8ba16..d20fbde 100644 --- a/arch/arm/include/asm/domain.h +++ b/arch/arm/include/asm/domain.h @@ -42,7 +42,6 @@ @@ -1681,7 +1690,7 @@ index fc8ba16..0c20017 100644 - domain_val(DOMAIN_IO, DOMAIN_CLIENT) | \ + domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT) | \ domain_val(DOMAIN_VECTORS, DOMAIN_CLIENT)) -+#elif CONFIG_PAX_MEMORY_UDEREF ++#elif defined(CONFIG_PAX_MEMORY_UDEREF) + /* DOMAIN_VECTORS is defined to DOMAIN_KERNEL */ +#define DACR_INIT \ + (domain_val(DOMAIN_USER, DOMAIN_USERCLIENT) | \ @@ -2077,6 +2086,35 @@ index 3d6dc8b..1262ad3 100644 struct of_cpu_method { const char *method; +diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h +index cf4f3aa..3f68273 100644 +--- a/arch/arm/include/asm/string.h ++++ b/arch/arm/include/asm/string.h +@@ -7,19 +7,19 @@ + */ + + #define __HAVE_ARCH_STRRCHR +-extern char * strrchr(const char * s, int c); ++extern char * strrchr(const char * s, int c) __nocapture(1); + + #define __HAVE_ARCH_STRCHR +-extern char * strchr(const char * s, int c); ++extern char * strchr(const char * s, int c) __nocapture(1); + + #define __HAVE_ARCH_MEMCPY +-extern void * memcpy(void *, const void *, __kernel_size_t); ++extern void * memcpy(void *, const void *, __kernel_size_t) __nocapture(2); + + #define __HAVE_ARCH_MEMMOVE +-extern void * memmove(void *, const void *, __kernel_size_t); ++extern void * memmove(void *, const void *, __kernel_size_t) __nocapture(2); + + #define __HAVE_ARCH_MEMCHR +-extern void * memchr(const void *, int, __kernel_size_t); ++extern void * memchr(const void *, int, __kernel_size_t) __nocapture(1); + + #define __HAVE_ARCH_MEMSET + extern void * memset(void *, int, __kernel_size_t); diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h index 776757d..a552c1d 100644 --- a/arch/arm/include/asm/thread_info.h @@ -2849,7 +2887,7 @@ index 69bda1a..755113a 100644 if (waddr != addr) { flush_kernel_vmap_range(waddr, twopage ? size / 2 : size); diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c -index 4adfb46..1cf6cb9 100644 +index 4adfb46..65a3b13 100644 --- a/arch/arm/kernel/process.c +++ b/arch/arm/kernel/process.c @@ -114,8 +114,8 @@ void __show_regs(struct pt_regs *regs) @@ -2872,20 +2910,7 @@ index 4adfb46..1cf6cb9 100644 /* * Copy the initial value of the domain access control register * from the current thread: thread->addr_limit will have been -@@ -312,12 +312,6 @@ unsigned long get_wchan(struct task_struct *p) - return 0; - } - --unsigned long arch_randomize_brk(struct mm_struct *mm) --{ -- unsigned long range_end = mm->brk + 0x02000000; -- return randomize_range(mm->brk, range_end, 0) ? : mm->brk; --} -- - #ifdef CONFIG_MMU - #ifdef CONFIG_KUSER_HELPERS - /* -@@ -333,7 +327,7 @@ static struct vm_area_struct gate_vma = { +@@ -333,7 +333,7 @@ static struct vm_area_struct gate_vma = { static int __init gate_vma_init(void) { @@ -2894,7 +2919,7 @@ index 4adfb46..1cf6cb9 100644 return 0; } arch_initcall(gate_vma_init); -@@ -362,91 +356,13 @@ const char *arch_vma_name(struct vm_area_struct *vma) +@@ -362,91 +362,13 @@ const char *arch_vma_name(struct vm_area_struct *vma) return is_gate_vma(vma) ? "[vectors]" : NULL; } @@ -3459,7 +3484,7 @@ index 78c02b3..c94109a 100644 struct omap_device *omap_device_alloc(struct platform_device *pdev, struct omap_hwmod **ohs, int oh_cnt); diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index b6d62e4..6ba9f74 100644 +index 2af6ff6..1f2959f 100644 --- a/arch/arm/mach-omap2/omap_hwmod.c +++ b/arch/arm/mach-omap2/omap_hwmod.c @@ -200,10 +200,10 @@ struct omap_hwmod_soc_ops { @@ -4703,6 +4728,62 @@ index c150539..45f5724 100644 #endif /* CONFIG_PGTABLE_LEVELS > 2 */ #if CONFIG_PGTABLE_LEVELS > 3 +diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h +index 2eb714c..6c0fdb7 100644 +--- a/arch/arm64/include/asm/string.h ++++ b/arch/arm64/include/asm/string.h +@@ -17,40 +17,40 @@ + #define __ASM_STRING_H + + #define __HAVE_ARCH_STRRCHR +-extern char *strrchr(const char *, int c); ++extern char *strrchr(const char *, int c) __nocapture(1); + + #define __HAVE_ARCH_STRCHR +-extern char *strchr(const char *, int c); ++extern char *strchr(const char *, int c) __nocapture(1); + + #define __HAVE_ARCH_STRCMP +-extern int strcmp(const char *, const char *); ++extern int strcmp(const char *, const char *) __nocapture(1, 2); + + #define __HAVE_ARCH_STRNCMP +-extern int strncmp(const char *, const char *, __kernel_size_t); ++extern int strncmp(const char *, const char *, __kernel_size_t) __nocapture(1, 2); + + #define __HAVE_ARCH_STRLEN + extern __kernel_size_t strlen(const char *); + + #define __HAVE_ARCH_STRNLEN +-extern __kernel_size_t strnlen(const char *, __kernel_size_t); ++extern __kernel_size_t strnlen(const char *, __kernel_size_t) __nocapture(1); + + #define __HAVE_ARCH_MEMCPY +-extern void *memcpy(void *, const void *, __kernel_size_t); +-extern void *__memcpy(void *, const void *, __kernel_size_t); ++extern void *memcpy(void *, const void *, __kernel_size_t) __nocapture(2); ++extern void *__memcpy(void *, const void *, __kernel_size_t) __nocapture(2); + + #define __HAVE_ARCH_MEMMOVE +-extern void *memmove(void *, const void *, __kernel_size_t); +-extern void *__memmove(void *, const void *, __kernel_size_t); ++extern void *memmove(void *, const void *, __kernel_size_t) __nocapture(2); ++extern void *__memmove(void *, const void *, __kernel_size_t) __nocapture(2); + + #define __HAVE_ARCH_MEMCHR +-extern void *memchr(const void *, int, __kernel_size_t); ++extern void *memchr(const void *, int, __kernel_size_t) __nocapture(1); + + #define __HAVE_ARCH_MEMSET + extern void *memset(void *, int, __kernel_size_t); + extern void *__memset(void *, int, __kernel_size_t); + + #define __HAVE_ARCH_MEMCMP +-extern int memcmp(const void *, const void *, size_t); ++extern int memcmp(const void *, const void *, size_t) __nocapture(1, 2); + + + #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index b2ede967..865eed5 100644 --- a/arch/arm64/include/asm/uaccess.h @@ -6848,7 +6929,7 @@ index 7e5fa09..65c1072 100644 } #endif /* !CONFIG_NEED_MULTIPLE_NODES */ diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c -index 3530376..81fb96b 100644 +index 3530376..754dde3 100644 --- a/arch/mips/mm/mmap.c +++ b/arch/mips/mm/mmap.c @@ -59,6 +59,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, @@ -6888,7 +6969,7 @@ index 3530376..81fb96b 100644 if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; -@@ -160,45 +166,34 @@ void arch_pick_mmap_layout(struct mm_struct *mm) +@@ -160,14 +166,30 @@ void arch_pick_mmap_layout(struct mm_struct *mm) { unsigned long random_factor = 0UL; @@ -6919,37 +7000,6 @@ index 3530376..81fb96b 100644 mm->get_unmapped_area = arch_get_unmapped_area_topdown; } } - --static inline unsigned long brk_rnd(void) --{ -- unsigned long rnd = get_random_long(); -- -- rnd = rnd << PAGE_SHIFT; -- /* 8MB for 32bit, 256MB for 64bit */ -- if (TASK_IS_32BIT_ADDR) -- rnd = rnd & 0x7ffffful; -- else -- rnd = rnd & 0xffffffful; -- -- return rnd; --} -- --unsigned long arch_randomize_brk(struct mm_struct *mm) --{ -- unsigned long base = mm->brk; -- unsigned long ret; -- -- ret = PAGE_ALIGN(base + brk_rnd()); -- -- if (ret < mm->brk) -- return mm->brk; -- -- return ret; --} -- - int __virt_addr_valid(const volatile void *kaddr) - { - return pfn_valid(PFN_DOWN(virt_to_phys(kaddr))); diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c index a2358b4..7cead4f 100644 --- a/arch/mips/sgi-ip27/ip27-nmi.c @@ -8774,7 +8824,7 @@ index 2c01665..85a54a8 100644 sechdrs, module); #endif diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index 54ed9c7..f7d6e72 100644 +index 54ed9c7..681162e 100644 --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -1185,8 +1185,8 @@ void show_regs(struct pt_regs * regs) @@ -8810,11 +8860,10 @@ index 54ed9c7..f7d6e72 100644 regs->trap, (void *)regs->nip, (void *)lr); firstframe = 1; } -@@ -1754,49 +1754,3 @@ void notrace __ppc64_runlatch_off(void) - mtspr(SPRN_CTRLT, ctrl); +@@ -1755,13 +1755,6 @@ void notrace __ppc64_runlatch_off(void) } #endif /* CONFIG_PPC64 */ -- + -unsigned long arch_align_stack(unsigned long sp) -{ - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) @@ -8822,44 +8871,9 @@ index 54ed9c7..f7d6e72 100644 - return sp & ~0xf; -} - --static inline unsigned long brk_rnd(void) --{ -- unsigned long rnd = 0; -- -- /* 8MB for 32bit, 1GB for 64bit */ -- if (is_32bit_task()) -- rnd = (get_random_long() % (1UL<<(23-PAGE_SHIFT))); -- else -- rnd = (get_random_long() % (1UL<<(30-PAGE_SHIFT))); -- -- return rnd << PAGE_SHIFT; --} -- --unsigned long arch_randomize_brk(struct mm_struct *mm) --{ -- unsigned long base = mm->brk; -- unsigned long ret; -- --#ifdef CONFIG_PPC_STD_MMU_64 -- /* -- * If we are using 1TB segments and we are allowed to randomise -- * the heap, we can put it above 1TB so it is backed by a 1TB -- * segment. Otherwise the heap will be in the bottom 1TB -- * which always uses 256MB segments and this may result in a -- * performance penalty. -- */ -- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T)) -- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T); --#endif -- -- ret = PAGE_ALIGN(base + brk_rnd()); -- -- if (ret < mm->brk) -- return mm->brk; -- -- return ret; --} -- + static inline unsigned long brk_rnd(void) + { + unsigned long rnd = 0; diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c index 30a03c0..e2d507b 100644 --- a/arch/powerpc/kernel/ptrace.c @@ -9447,14 +9461,13 @@ index 7873e17..d21af5b 100644 if (r_type == R_390_GOTPC) rc = apply_rela_bits(loc, val, 1, 32, 0); diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c -index 2bba7df..587489f 100644 +index 2bba7df..8f1e6b5 100644 --- a/arch/s390/kernel/process.c +++ b/arch/s390/kernel/process.c -@@ -233,23 +233,3 @@ unsigned long get_wchan(struct task_struct *p) - } +@@ -234,13 +234,6 @@ unsigned long get_wchan(struct task_struct *p) return 0; } -- + -unsigned long arch_align_stack(unsigned long sp) -{ - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) @@ -9462,18 +9475,9 @@ index 2bba7df..587489f 100644 - return sp & ~0xf; -} - --static inline unsigned long brk_rnd(void) --{ -- return (get_random_int() & BRK_RND_MASK) << PAGE_SHIFT; --} -- --unsigned long arch_randomize_brk(struct mm_struct *mm) --{ -- unsigned long ret; -- -- ret = PAGE_ALIGN(mm->brk + brk_rnd()); -- return (ret > mm->brk) ? ret : mm->brk; --} + static inline unsigned long brk_rnd(void) + { + return (get_random_int() & BRK_RND_MASK) << PAGE_SHIFT; diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c index 45c4daa..42703fb 100644 --- a/arch/s390/mm/mmap.c @@ -12928,6 +12932,22 @@ index db75d07..8e6d0af 100644 struct biosregs ireg, oreg; struct e820entry *desc = boot_params.e820_map; static struct e820entry buf; /* static so it is zeroed */ +diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h +index 725e820..d7ea2759 100644 +--- a/arch/x86/boot/string.h ++++ b/arch/x86/boot/string.h +@@ -6,9 +6,9 @@ + #undef memset + #undef memcmp + +-void *memcpy(void *dst, const void *src, size_t len); ++void *memcpy(void *dst, const void *src, size_t len) __nocapture(2); + void *memset(void *dst, int c, size_t len); +-int memcmp(const void *s1, const void *s2, size_t len); ++int memcmp(const void *s1, const void *s2, size_t len) __nocapture(1, 2); + + /* + * Access builtin version by default. If one needs to use optimized version, diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c index ba3e100..6501b8f 100644 --- a/arch/x86/boot/video-vesa.c @@ -14663,23 +14683,6 @@ index 3643dd5..17d5e30 100644 u128 ivs[SERPENT_PARALLEL_BLOCKS - 1]; unsigned int j; -diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c -index a841e97..8381c09d 100644 ---- a/arch/x86/crypto/sha-mb/sha1_mb.c -+++ b/arch/x86/crypto/sha-mb/sha1_mb.c -@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx, - - req = cast_mcryptd_ctx_to_req(req_ctx); - if (irqs_disabled()) -- rctx->complete(&req->base, ret); -+ req_ctx->complete(&req->base, ret); - else { - local_bh_disable(); -- rctx->complete(&req->base, ret); -+ req_ctx->complete(&req->base, ret); - local_bh_enable(); - } - } diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S index a410950..02d2056 100644 --- a/arch/x86/crypto/sha1_ssse3_asm.S @@ -19979,6 +19982,19 @@ index 77a99ac..39ff7f5 100644 +extern void machine_emergency_restart(void) __noreturn; #endif /* _ASM_X86_EMERGENCY_RESTART_H */ +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 6d7d0e5..bce15a1 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -142,7 +142,7 @@ extern pgprot_t kmap_prot; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned int idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT diff --git a/arch/x86/include/asm/floppy.h b/arch/x86/include/asm/floppy.h index 1c7eefe..d0e4702 100644 --- a/arch/x86/include/asm/floppy.h @@ -22650,6 +22666,103 @@ index 70bbe39..4ae2bd4 100644 }; void dump_trace(struct task_struct *tsk, struct pt_regs *regs, +diff --git a/arch/x86/include/asm/string_32.h b/arch/x86/include/asm/string_32.h +index 3d3e835..5cc6d8d 100644 +--- a/arch/x86/include/asm/string_32.h ++++ b/arch/x86/include/asm/string_32.h +@@ -6,25 +6,25 @@ + /* Let gcc decide whether to inline or use the out of line functions */ + + #define __HAVE_ARCH_STRCPY +-extern char *strcpy(char *dest, const char *src); ++extern char *strcpy(char *dest, const char *src) __nocapture(2); + + #define __HAVE_ARCH_STRNCPY +-extern char *strncpy(char *dest, const char *src, size_t count); ++extern char *strncpy(char *dest, const char *src, size_t count) __nocapture(2); + + #define __HAVE_ARCH_STRCAT +-extern char *strcat(char *dest, const char *src); ++extern char *strcat(char *dest, const char *src) __nocapture(2); + + #define __HAVE_ARCH_STRNCAT +-extern char *strncat(char *dest, const char *src, size_t count); ++extern char *strncat(char *dest, const char *src, size_t count) __nocapture(2); + + #define __HAVE_ARCH_STRCMP +-extern int strcmp(const char *cs, const char *ct); ++extern int strcmp(const char *cs, const char *ct) __nocapture(1, 2); + + #define __HAVE_ARCH_STRNCMP +-extern int strncmp(const char *cs, const char *ct, size_t count); ++extern int strncmp(const char *cs, const char *ct, size_t count) __nocapture(1, 2); + + #define __HAVE_ARCH_STRCHR +-extern char *strchr(const char *s, int c); ++extern char *strchr(const char *s, int c) __nocapture(1); + + #define __HAVE_ARCH_STRLEN + extern size_t strlen(const char *s); +@@ -197,12 +197,12 @@ static inline void *__memcpy3d(void *to, const void *from, size_t len) + #endif + + #define __HAVE_ARCH_MEMMOVE +-void *memmove(void *dest, const void *src, size_t n); ++void *memmove(void *dest, const void *src, size_t n) __nocapture(2); + + #define memcmp __builtin_memcmp + + #define __HAVE_ARCH_MEMCHR +-extern void *memchr(const void *cs, int c, size_t count); ++extern void *memchr(const void *cs, int c, size_t count) __nocapture(1); + + static inline void *__memset_generic(void *s, char c, size_t count) + { +@@ -247,7 +247,7 @@ extern size_t strnlen(const char *s, size_t count); + /* end of additional stuff */ + + #define __HAVE_ARCH_STRSTR +-extern char *strstr(const char *cs, const char *ct); ++extern char *strstr(const char *cs, const char *ct) __nocapture(1, 2); + + /* + * This looks horribly ugly, but the compiler can optimize it totally, +diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h +index ff8b9a1..01d4b80 100644 +--- a/arch/x86/include/asm/string_64.h ++++ b/arch/x86/include/asm/string_64.h +@@ -27,8 +27,8 @@ static __always_inline void *__inline_memcpy(void *to, const void *from, size_t + function. */ + + #define __HAVE_ARCH_MEMCPY 1 +-extern void *memcpy(void *to, const void *from, size_t len); +-extern void *__memcpy(void *to, const void *from, size_t len); ++extern void *memcpy(void *to, const void *from, size_t len) __nocapture(2); ++extern void *__memcpy(void *to, const void *from, size_t len) __nocapture(2); + + #ifndef CONFIG_KMEMCHECK + #if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4 +@@ -56,14 +56,14 @@ void *memset(void *s, int c, size_t n); + void *__memset(void *s, int c, size_t n); + + #define __HAVE_ARCH_MEMMOVE +-void *memmove(void *dest, const void *src, size_t count); +-void *__memmove(void *dest, const void *src, size_t count); ++void *memmove(void *dest, const void *src, size_t count) __nocapture(2); ++void *__memmove(void *dest, const void *src, size_t count) __nocapture(2); + +-int memcmp(const void *cs, const void *ct, size_t count); ++int memcmp(const void *cs, const void *ct, size_t count) __nocapture(1, 2); + size_t strlen(const char *s); +-char *strcpy(char *dest, const char *src); +-char *strcat(char *dest, const char *src); +-int strcmp(const char *cs, const char *ct); ++char *strcpy(char *dest, const char *src) __nocapture(2); ++char *strcat(char *dest, const char *src) __nocapture(2); ++int strcmp(const char *cs, const char *ct) __nocapture(1, 2); + + #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__) + diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h index 751bf4b..a1278b5 100644 --- a/arch/x86/include/asm/switch_to.h @@ -24455,7 +24568,7 @@ index f316e34..48c21c5 100644 static int cmdline_apic __initdata; diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c -index ad59d70..c3570b7 100644 +index ef49551..ba2e857 100644 --- a/arch/x86/kernel/apic/vector.c +++ b/arch/x86/kernel/apic/vector.c @@ -37,6 +37,7 @@ static struct irq_chip lapic_controller; @@ -28859,20 +28972,48 @@ index 6d9582e..f746287 100644 return; } diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c -index 33ee3e0..da3519a 100644 +index 33ee3e0..ca43dee 100644 --- a/arch/x86/kernel/paravirt-spinlocks.c +++ b/arch/x86/kernel/paravirt-spinlocks.c -@@ -23,7 +23,7 @@ bool pv_is_native_spin_unlock(void) +@@ -23,16 +23,32 @@ bool pv_is_native_spin_unlock(void) } #endif -struct pv_lock_ops pv_lock_ops = { ++#ifdef CONFIG_SMP ++#ifdef CONFIG_QUEUED_SPINLOCKS ++static void native_wait(u8 *ptr, u8 val) ++{ ++} ++ ++static void native_kick(int cpu) ++{ ++} ++//#else /* !CONFIG_QUEUED_SPINLOCKS */ ++static void native_unlock_kick(struct arch_spinlock *lock, __ticket_t ticket) ++{ ++} ++#endif /* !CONFIG_QUEUED_SPINLOCKS */ ++#endif /* SMP */ ++ +struct pv_lock_ops pv_lock_ops __read_only = { #ifdef CONFIG_SMP #ifdef CONFIG_QUEUED_SPINLOCKS .queued_spin_lock_slowpath = native_queued_spin_lock_slowpath, + .queued_spin_unlock = PV_CALLEE_SAVE(__native_queued_spin_unlock), +- .wait = paravirt_nop, +- .kick = paravirt_nop, ++ .wait = native_wait, ++ .kick = native_kick, + #else /* !CONFIG_QUEUED_SPINLOCKS */ + .lock_spinning = __PV_IS_CALLEE_SAVE(paravirt_nop), +- .unlock_kick = paravirt_nop, ++ .unlock_kick = native_unlock_kick, + #endif /* !CONFIG_QUEUED_SPINLOCKS */ + #endif /* SMP */ + }; diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c -index f08ac28..0151389 100644 +index f08ac28..4599189 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c @@ -64,6 +64,9 @@ u64 _paravirt_ident_64(u64 x) @@ -28947,16 +29088,54 @@ index f08ac28..0151389 100644 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl), .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl), .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable), -@@ -324,7 +331,7 @@ __visible struct pv_irq_ops pv_irq_ops = { +@@ -324,7 +331,23 @@ __visible struct pv_irq_ops pv_irq_ops = { #endif }; -__visible struct pv_cpu_ops pv_cpu_ops = { ++static void native_alloc_ldt(struct desc_struct *ldt, unsigned entries) ++{ ++} ++ ++static void native_free_ldt(struct desc_struct *ldt, unsigned entries) ++{ ++} ++ ++static void native_start_context_switch(struct task_struct *prev) ++{ ++} ++ ++static void native_end_context_switch(struct task_struct *next) ++{ ++} ++ +__visible struct pv_cpu_ops pv_cpu_ops __read_only = { .cpuid = native_cpuid, .get_debugreg = native_get_debugreg, .set_debugreg = native_set_debugreg, -@@ -379,15 +386,20 @@ NOKPROBE_SYMBOL(native_get_debugreg); +@@ -356,8 +379,8 @@ __visible struct pv_cpu_ops pv_cpu_ops = { + .write_gdt_entry = native_write_gdt_entry, + .write_idt_entry = native_write_idt_entry, + +- .alloc_ldt = paravirt_nop, +- .free_ldt = paravirt_nop, ++ .alloc_ldt = native_alloc_ldt, ++ .free_ldt = native_free_ldt, + + .load_sp0 = native_load_sp0, + +@@ -370,8 +393,8 @@ __visible struct pv_cpu_ops pv_cpu_ops = { + .set_iopl_mask = native_set_iopl_mask, + .io_delay = native_io_delay, + +- .start_context_switch = paravirt_nop, +- .end_context_switch = paravirt_nop, ++ .start_context_switch = native_start_context_switch, ++ .end_context_switch = native_end_context_switch, + }; + + /* At this point, native_get/set_debugreg has real function entries */ +@@ -379,15 +402,64 @@ NOKPROBE_SYMBOL(native_get_debugreg); NOKPROBE_SYMBOL(native_set_debugreg); NOKPROBE_SYMBOL(native_load_idt); @@ -28975,11 +29154,84 @@ index f08ac28..0151389 100644 #endif -struct pv_mmu_ops pv_mmu_ops = { ++static void native_pgd_free(struct mm_struct *mm, pgd_t *pgd) ++{ ++} ++ ++static void native_alloc_pte(struct mm_struct *mm, unsigned long pfn) ++{ ++} ++ ++static void native_alloc_pmd(struct mm_struct *mm, unsigned long pfn) ++{ ++} ++ ++static void native_alloc_pud(struct mm_struct *mm, unsigned long pfn) ++{ ++} ++ ++static void native_release_pte(unsigned long pfn) ++{ ++} ++ ++static void native_release_pmd(unsigned long pfn) ++{ ++} ++ ++static void native_release_pud(unsigned long pfn) ++{ ++} ++ ++static void native_pte_update(struct mm_struct *mm, unsigned long addr, pte_t *ptep) ++{ ++} ++ ++static void native_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm) ++{ ++} ++ ++static void native_exit_mmap(struct mm_struct *mm) ++{ ++} ++ ++static void native_activate_mm(struct mm_struct *prev, struct mm_struct *next) ++{ ++} ++ +struct pv_mmu_ops pv_mmu_ops __read_only = { .read_cr2 = native_read_cr2, .write_cr2 = native_write_cr2, -@@ -434,6 +446,7 @@ struct pv_mmu_ops pv_mmu_ops = { +@@ -400,20 +472,20 @@ struct pv_mmu_ops pv_mmu_ops = { + .flush_tlb_others = native_flush_tlb_others, + + .pgd_alloc = __paravirt_pgd_alloc, +- .pgd_free = paravirt_nop, ++ .pgd_free = native_pgd_free, + +- .alloc_pte = paravirt_nop, +- .alloc_pmd = paravirt_nop, +- .alloc_pud = paravirt_nop, +- .release_pte = paravirt_nop, +- .release_pmd = paravirt_nop, +- .release_pud = paravirt_nop, ++ .alloc_pte = native_alloc_pte, ++ .alloc_pmd = native_alloc_pmd, ++ .alloc_pud = native_alloc_pud, ++ .release_pte = native_release_pte, ++ .release_pmd = native_release_pmd, ++ .release_pud = native_release_pud, + + .set_pte = native_set_pte, + .set_pte_at = native_set_pte_at, + .set_pmd = native_set_pmd, + .set_pmd_at = native_set_pmd_at, +- .pte_update = paravirt_nop, ++ .pte_update = native_pte_update, + + .ptep_modify_prot_start = __ptep_modify_prot_start, + .ptep_modify_prot_commit = __ptep_modify_prot_commit, +@@ -434,6 +506,7 @@ struct pv_mmu_ops pv_mmu_ops = { .make_pud = PTE_IDENT, .set_pgd = native_set_pgd, @@ -28987,7 +29239,20 @@ index f08ac28..0151389 100644 #endif #endif /* CONFIG_PGTABLE_LEVELS >= 3 */ -@@ -454,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = { +@@ -443,9 +516,9 @@ struct pv_mmu_ops pv_mmu_ops = { + .make_pte = PTE_IDENT, + .make_pgd = PTE_IDENT, + +- .dup_mmap = paravirt_nop, +- .exit_mmap = paravirt_nop, +- .activate_mm = paravirt_nop, ++ .dup_mmap = native_dup_mmap, ++ .exit_mmap = native_exit_mmap, ++ .activate_mm = native_activate_mm, + + .lazy_mode = { + .enter = paravirt_nop, +@@ -454,6 +527,12 @@ struct pv_mmu_ops pv_mmu_ops = { }, .set_fixmap = native_set_fixmap, @@ -31513,10 +31778,10 @@ index 539062e..0aa69ab 100644 .disabled_by_bios = vmx_disabled_by_bios, .hardware_setup = hardware_setup, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index eca5bd9..5cf1b68 100644 +index ac4963c..902039d 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c -@@ -1945,8 +1945,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) +@@ -1944,8 +1944,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) { struct kvm *kvm = vcpu->kvm; int lm = is_long_mode(vcpu); @@ -31527,7 +31792,7 @@ index eca5bd9..5cf1b68 100644 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64 : kvm->arch.xen_hvm_config.blob_size_32; u32 page_num = data & ~PAGE_MASK; -@@ -2647,6 +2647,8 @@ long kvm_arch_dev_ioctl(struct file *filp, +@@ -2646,6 +2646,8 @@ long kvm_arch_dev_ioctl(struct file *filp, if (n < msr_list.nmsrs) goto out; r = -EFAULT; @@ -31536,7 +31801,7 @@ index eca5bd9..5cf1b68 100644 if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; -@@ -3047,7 +3049,7 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu, +@@ -3046,7 +3048,7 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu, static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu) { @@ -31545,7 +31810,7 @@ index eca5bd9..5cf1b68 100644 u64 xstate_bv = xsave->header.xfeatures; u64 valid; -@@ -3083,7 +3085,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu) +@@ -3082,7 +3084,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu) static void load_xsave(struct kvm_vcpu *vcpu, u8 *src) { @@ -31554,7 +31819,7 @@ index eca5bd9..5cf1b68 100644 u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET); u64 valid; -@@ -3127,7 +3129,7 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu, +@@ -3126,7 +3128,7 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu, fill_xsave((u8 *) guest_xsave->region, vcpu); } else { memcpy(guest_xsave->region, @@ -31563,7 +31828,7 @@ index eca5bd9..5cf1b68 100644 sizeof(struct fxregs_state)); *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)] = XFEATURE_MASK_FPSSE; -@@ -3152,7 +3154,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu, +@@ -3151,7 +3153,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu, } else { if (xstate_bv & ~XFEATURE_MASK_FPSSE) return -EINVAL; @@ -31572,7 +31837,7 @@ index eca5bd9..5cf1b68 100644 guest_xsave->region, sizeof(struct fxregs_state)); } return 0; -@@ -6422,6 +6424,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm, +@@ -6421,6 +6423,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm, * exiting to the userspace. Otherwise, the value will be returned to the * userspace. */ @@ -31580,7 +31845,7 @@ index eca5bd9..5cf1b68 100644 static int vcpu_enter_guest(struct kvm_vcpu *vcpu) { int r; -@@ -6686,6 +6689,7 @@ out: +@@ -6687,6 +6690,7 @@ out: return r; } @@ -31588,7 +31853,7 @@ index eca5bd9..5cf1b68 100644 static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu) { if (!kvm_arch_vcpu_runnable(vcpu) && -@@ -7233,7 +7237,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu, +@@ -7234,7 +7238,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu, int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) { struct fxregs_state *fxsave = @@ -31597,7 +31862,7 @@ index eca5bd9..5cf1b68 100644 memcpy(fpu->fpr, fxsave->st_space, 128); fpu->fcw = fxsave->cwd; -@@ -7250,7 +7254,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) +@@ -7251,7 +7255,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) { struct fxregs_state *fxsave = @@ -31606,7 +31871,7 @@ index eca5bd9..5cf1b68 100644 memcpy(fxsave->st_space, fpu->fpr, 128); fxsave->cwd = fpu->fcw; -@@ -7266,9 +7270,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) +@@ -7267,9 +7271,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) static void fx_init(struct kvm_vcpu *vcpu) { @@ -31619,7 +31884,7 @@ index eca5bd9..5cf1b68 100644 /* @@ -7292,7 +7296,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu) - kvm_put_guest_xcr0(vcpu); + */ vcpu->guest_fpu_loaded = 1; __kernel_fpu_begin(); - __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state); @@ -31627,7 +31892,7 @@ index eca5bd9..5cf1b68 100644 trace_kvm_fpu(1); } -@@ -7595,6 +7599,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) +@@ -7593,6 +7597,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) struct static_key kvm_no_apic_vcpu __read_mostly; @@ -31636,7 +31901,7 @@ index eca5bd9..5cf1b68 100644 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) { struct page *page; -@@ -7612,11 +7618,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) +@@ -7610,11 +7616,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) else vcpu->arch.mp_state = KVM_MP_STATE_UNINITIALIZED; @@ -31655,7 +31920,7 @@ index eca5bd9..5cf1b68 100644 vcpu->arch.pio_data = page_address(page); kvm_set_tsc_khz(vcpu, max_tsc_khz); -@@ -7674,6 +7683,9 @@ fail_mmu_destroy: +@@ -7672,6 +7681,9 @@ fail_mmu_destroy: kvm_mmu_destroy(vcpu); fail_free_pio_data: free_page((unsigned long)vcpu->arch.pio_data); @@ -31665,7 +31930,7 @@ index eca5bd9..5cf1b68 100644 fail: return r; } -@@ -7692,6 +7704,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) +@@ -7690,6 +7702,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) free_page((unsigned long)vcpu->arch.pio_data); if (!lapic_in_kernel(vcpu)) static_key_slow_dec(&kvm_no_apic_vcpu); @@ -34338,7 +34603,7 @@ index 903ec1e..41b4708 100644 } diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index e830c71..f7e9e6c 100644 +index e830c71..2c3c46a 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -14,6 +14,8 @@ @@ -34595,7 +34860,7 @@ index e830c71..f7e9e6c 100644 code = BUS_MCEERR_AR; } #endif -@@ -927,6 +1039,107 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte) +@@ -927,6 +1039,109 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte) return 1; } @@ -34689,7 +34954,9 @@ index e830c71..f7e9e6c 100644 + */ + "invlpg (%0)\n" +#endif ++ ASM_STAC "\n" + __copyuser_seg"testb $0,(%0)\n" ++ ASM_CLAC "\n" + "xorb %3,(%1)\n" + : + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER) @@ -34703,7 +34970,7 @@ index e830c71..f7e9e6c 100644 /* * Handle a spurious fault caused by a stale TLB entry. * -@@ -1012,6 +1225,9 @@ int show_unhandled_signals = 1; +@@ -1012,6 +1227,9 @@ int show_unhandled_signals = 1; static inline int access_error(unsigned long error_code, struct vm_area_struct *vma) { @@ -34713,7 +34980,7 @@ index e830c71..f7e9e6c 100644 if (error_code & PF_WRITE) { /* write, present and write, not present: */ if (unlikely(!(vma->vm_flags & VM_WRITE))) -@@ -1074,6 +1290,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code, +@@ -1074,6 +1292,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code, tsk = current; mm = tsk->mm; @@ -34736,7 +35003,7 @@ index e830c71..f7e9e6c 100644 /* * Detect and handle instructions that would cause a page fault for * both a tracked kernel page and a userspace page. -@@ -1198,6 +1430,11 @@ retry: +@@ -1198,6 +1432,11 @@ retry: might_sleep(); } @@ -34748,7 +35015,7 @@ index e830c71..f7e9e6c 100644 vma = find_vma(mm, address); if (unlikely(!vma)) { bad_area(regs, error_code, address); -@@ -1209,18 +1446,24 @@ retry: +@@ -1209,18 +1448,24 @@ retry: bad_area(regs, error_code, address); return; } @@ -34784,7 +35051,7 @@ index e830c71..f7e9e6c 100644 if (unlikely(expand_stack(vma, address))) { bad_area(regs, error_code, address); return; -@@ -1340,3 +1583,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code) +@@ -1340,3 +1585,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code) } NOKPROBE_SYMBOL(trace_do_page_fault); #endif /* CONFIG_TRACING */ @@ -36364,7 +36631,7 @@ index 9f0614d..92ae64a 100644 p += get_opcode(p, &opcode); for (i = 0; i < ARRAY_SIZE(imm_wop); i++) diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index 4eb287e..e91945b 100644 +index 4eb287e..a021315 100644 --- a/arch/x86/mm/pgtable.c +++ b/arch/x86/mm/pgtable.c @@ -98,10 +98,75 @@ static inline void pgd_list_del(pgd_t *pgd) @@ -36703,14 +36970,18 @@ index 4eb287e..e91945b 100644 void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) { unsigned long address = __fix_to_virt(idx); -@@ -536,6 +652,7 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) +@@ -536,9 +652,10 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) } set_pte_vaddr(address, pte); fixmaps_set++; + fix_user_fixmap(idx, address); } - void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, ++void native_set_fixmap(unsigned int idx, phys_addr_t phys, + pgprot_t flags) + { + __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags)); @@ -602,9 +719,11 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot) prot = pgprot_4k_2_large(prot); @@ -38359,7 +38630,7 @@ index e3679db..16b93d1 100644 #ifdef CONFIG_ACPI_NUMA diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index c913ca4..b6d8c05 100644 +index c913ca4..a314c65 100644 --- a/arch/x86/xen/mmu.c +++ b/arch/x86/xen/mmu.c @@ -1950,7 +1950,11 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) @@ -38406,7 +38677,27 @@ index c913ca4..b6d8c05 100644 #endif /* This will work as long as patching hasn't happened yet -@@ -2472,6 +2488,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = { +@@ -2423,6 +2439,10 @@ static void xen_leave_lazy_mmu(void) + preempt_enable(); + } + ++static void xen_pte_update(struct mm_struct *mm, unsigned long addr, pte_t *ptep) ++{ ++} ++ + static const struct pv_mmu_ops xen_mmu_ops __initconst = { + .read_cr2 = xen_read_cr2, + .write_cr2 = xen_write_cr2, +@@ -2435,7 +2455,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = { + .flush_tlb_single = xen_flush_tlb_single, + .flush_tlb_others = xen_flush_tlb_others, + +- .pte_update = paravirt_nop, ++ .pte_update = xen_pte_update, + + .pgd_alloc = xen_pgd_alloc, + .pgd_free = xen_pgd_free, +@@ -2472,6 +2492,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = { .pud_val = PV_CALLEE_SAVE(xen_pud_val), .make_pud = PV_CALLEE_SAVE(xen_make_pud), .set_pgd = xen_set_pgd_hyper, @@ -40740,7 +41031,7 @@ index 279e539..b87ed03 100644 static void platform_msi_free_descs(struct device *dev, int base, int nvec) diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index 301b785..82070c6 100644 +index 0caf92a..cff4879 100644 --- a/drivers/base/power/domain.c +++ b/drivers/base/power/domain.c @@ -1804,8 +1804,10 @@ int genpd_dev_pm_attach(struct device *dev) @@ -42580,6 +42871,31 @@ index e496dae..3db53b6 100644 { .ident = "Sony Vaio", .matches = { +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 2521425..10e45de 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -74,6 +74,11 @@ static void tpm_dev_release(struct device *dev) + kfree(chip); + } + ++static void tpm_put_device(void *dev) ++{ ++ put_device(dev); ++} ++ + /** + * tpmm_chip_alloc() - allocate a new struct tpm_chip instance + * @dev: device to which the chip is associated +@@ -136,7 +141,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, + chip->cdev.owner = chip->pdev->driver->owner; + chip->cdev.kobj.parent = &chip->dev.kobj; + +- devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); ++ devm_add_action(dev, tpm_put_device, &chip->dev); + + return chip; + } diff --git a/drivers/char/tpm/tpm_acpi.c b/drivers/char/tpm/tpm_acpi.c index 565a947..dcdc06e 100644 --- a/drivers/char/tpm/tpm_acpi.c @@ -43004,7 +43320,7 @@ index eae5107..26e7a39 100644 } EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler); diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index cd83d47..3d6afab 100644 +index e895123..05de99b 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -141,13 +141,13 @@ struct pstate_funcs { @@ -43084,7 +43400,7 @@ index cd83d47..3d6afab 100644 const char *buf, size_t count) { unsigned int input; -@@ -850,19 +850,19 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force) +@@ -855,19 +855,19 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force) cpu->pstate.current_pstate = pstate; @@ -43112,7 +43428,7 @@ index cd83d47..3d6afab 100644 intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false); } -@@ -1016,7 +1016,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) +@@ -1021,7 +1021,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) from = cpu->pstate.current_pstate; @@ -43121,7 +43437,7 @@ index cd83d47..3d6afab 100644 intel_pstate_set_pstate(cpu, target_pstate, true); -@@ -1249,15 +1249,15 @@ static unsigned int force_load; +@@ -1254,15 +1254,15 @@ static unsigned int force_load; static int intel_pstate_msrs_not_valid(void) { @@ -43141,7 +43457,7 @@ index cd83d47..3d6afab 100644 { pid_params.sample_rate_ms = policy->sample_rate_ms; pid_params.p_gain_pct = policy->p_gain_pct; -@@ -1269,15 +1269,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy) +@@ -1274,15 +1274,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy) static void copy_cpu_funcs(struct pstate_funcs *funcs) { @@ -43402,34 +43718,6 @@ index 832a2c3..1794080 100644 .attrs = cpuidle_default_attrs, .name = "cpuidle", }; -diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -index 3d9acc5..60fc0fa 100644 ---- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -+++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c -@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out) - struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); - struct ccp_aes_cmac_exp_ctx state; - -+ /* Don't let anything leak to 'out' */ -+ memset(&state, 0, sizeof(state)); -+ - state.null_msg = rctx->null_msg; - memcpy(state.iv, rctx->iv, sizeof(state.iv)); - state.buf_count = rctx->buf_count; -diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c -index 8ef06fa..ab9945f 100644 ---- a/drivers/crypto/ccp/ccp-crypto-sha.c -+++ b/drivers/crypto/ccp/ccp-crypto-sha.c -@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out) - struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); - struct ccp_sha_exp_ctx state; - -+ /* Don't let anything leak to 'out' */ -+ memset(&state, 0, sizeof(state)); -+ - state.type = rctx->type; - state.msg_bits = rctx->msg_bits; - state.first = rctx->first; diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c index eee2c7e..268aa3e 100644 --- a/drivers/crypto/hifn_795x.c @@ -44176,10 +44464,10 @@ index d425374..1da1716 100644 EXPORT_SYMBOL_GPL(cper_next_record_id); diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 2cd37da..8bcbe8b 100644 +index c51f3b2..d1cc54e 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c -@@ -176,14 +176,16 @@ static struct attribute_group efi_subsys_attr_group = { +@@ -176,15 +176,17 @@ static struct attribute_group efi_subsys_attr_group = { }; static struct efivars generic_efivars; @@ -44190,11 +44478,13 @@ index 2cd37da..8bcbe8b 100644 { - generic_ops.get_variable = efi.get_variable; - generic_ops.set_variable = efi.set_variable; +- generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; - generic_ops.get_next_variable = efi.get_next_variable; - generic_ops.query_variable_store = efi_query_variable_store; + pax_open_kernel(); + *(void **)&generic_ops.get_variable = efi.get_variable; + *(void **)&generic_ops.set_variable = efi.set_variable; ++ *(void **)&generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; + *(void **)&generic_ops.get_next_variable = efi.get_next_variable; + *(void **)&generic_ops.query_variable_store = efi_query_variable_store; + pax_close_kernel(); @@ -44421,10 +44711,10 @@ index 5c1ba87..ab4a059 100644 /* diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index 5e7770f..a84a2c6 100644 +index ff29975..a7fe398 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -1733,7 +1733,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor); +@@ -1734,7 +1734,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor); * amdgpu smumgr functions */ struct amdgpu_smumgr_funcs { @@ -44433,7 +44723,7 @@ index 5e7770f..a84a2c6 100644 int (*request_smu_load_fw)(struct amdgpu_device *adev); int (*request_smu_specific_fw)(struct amdgpu_device *adev, uint32_t fwtype); }; -@@ -2345,7 +2345,7 @@ static inline void amdgpu_unregister_atpx_handler(void) {} +@@ -2346,7 +2346,7 @@ static inline void amdgpu_unregister_atpx_handler(void) {} * KMS */ extern const struct drm_ioctl_desc amdgpu_ioctls_kms[]; @@ -44443,7 +44733,7 @@ index 5e7770f..a84a2c6 100644 int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags); int amdgpu_driver_unload_kms(struct drm_device *dev); diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -index 81dc6b6..2762d6b 100644 +index 3c89586..14cfa09 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c @@ -493,7 +493,7 @@ static int amdgpu_atpx_init(void) @@ -44588,10 +44878,10 @@ index 119cdc2..fd6698c 100644 { struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector); diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index d6c68d0..ea00f37 100644 +index 51bfc11..4d4112a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1091,7 +1091,7 @@ static bool amdgpu_switcheroo_can_switch(struct pci_dev *pdev) +@@ -1085,7 +1085,7 @@ static bool amdgpu_switcheroo_can_switch(struct pci_dev *pdev) * locking inversion with the driver load path. And the access here is * completely racy anyway. So don't bother with locking for now. */ @@ -44654,7 +44944,7 @@ index 9ef1db8..bfd5d78 100644 } diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index e23843f..9ecc6f3 100644 +index 4488e82..9b87225 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -749,4 +749,4 @@ const struct drm_ioctl_desc amdgpu_ioctls_kms[] = { @@ -45704,25 +45994,19 @@ index 813ef23..17928d6 100644 { struct drm_device *dev = connector->dev; diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c -index 7cd87a0..be562ce 100644 +index 7cd87a0..1ccc140 100644 --- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c +++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c -@@ -120,9 +120,14 @@ static void dsi_set_pipe_plane_enable_state(struct drm_device *dev, - u32 pipeconf_reg = PIPEACONF; - u32 dspcntr_reg = DSPACNTR; - -- u32 dspcntr = dev_priv->dspcntr[pipe]; -+ u32 dspcntr; - u32 mipi = MIPI_PORT_EN | PASS_FROM_SPHY_TO_AFE | SEL_FLOPPED_HSTX; +@@ -645,6 +645,9 @@ static void mdfld_dsi_dpi_set_power(struct drm_encoder *encoder, bool on) + if (!gma_power_begin(dev, true)) + return; + if (pipe == -1) + return; + -+ dspcntr = dev_priv->dspcntr[pipe]; -+ - if (pipe) { - pipeconf_reg = PIPECCONF; - dspcntr_reg = DSPCCNTR; + if (on) { + if (mdfld_get_panel_type(dev, pipe) == TMD_VID) + mdfld_dsi_dpi_turn_on(dpi_output, pipe); diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_output.c b/drivers/gpu/drm/gma500/mdfld_dsi_output.c index d758f4c..7828190 100644 --- a/drivers/gpu/drm/gma500/mdfld_dsi_output.c @@ -46237,7 +46521,7 @@ index fa8afa7..0bac957 100644 /** diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 46947ff..c3efaa4 100644 +index a9c3513..9c2b9c9 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -15106,13 +15106,13 @@ struct intel_quirk { @@ -46776,10 +47060,10 @@ index 6911b8c..89d6867 100644 return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index 8627651..87df69f 100644 +index 47e5264..3393741 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -831,7 +831,7 @@ static int qxl_conn_get_modes(struct drm_connector *connector) +@@ -836,7 +836,7 @@ static int qxl_conn_get_modes(struct drm_connector *connector) return ret; } @@ -46815,10 +47099,10 @@ index 7307b07..8eecdd0 100644 } diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h -index 6e6b9b1..4462096 100644 +index 3f3897e..0bc8075 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h -@@ -290,10 +290,10 @@ struct qxl_device { +@@ -292,10 +292,10 @@ struct qxl_device { unsigned int last_sent_io_cmd; /* interrupt handling */ @@ -47141,7 +47425,7 @@ index b928c17..e5d9400 100644 if (regcomp (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c -index 9bc408c..3bb75f5 100644 +index c4b4f29..90464ff 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c @@ -491,7 +491,7 @@ static int radeon_atpx_init(void) @@ -47154,7 +47438,7 @@ index 9bc408c..3bb75f5 100644 if (radeon_atpx_priv.dhandle == ACPI_HANDLE(&pdev->dev)) return VGA_SWITCHEROO_IGD; diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index 340f3f5..3a0afbe 100644 +index 9cfc1c3..524ccaa 100644 --- a/drivers/gpu/drm/radeon/radeon_connectors.c +++ b/drivers/gpu/drm/radeon/radeon_connectors.c @@ -851,7 +851,7 @@ static int radeon_lvds_get_modes(struct drm_connector *connector) @@ -47203,10 +47487,10 @@ index 340f3f5..3a0afbe 100644 { struct drm_device *dev = connector->dev; diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index e239633..4ae1159 100644 +index 4197ca1..f07709e 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -1259,7 +1259,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) +@@ -1253,7 +1253,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) * locking inversion with the driver load path. And the access here is * completely racy anyway. So don't bother with locking for now. */ @@ -47331,10 +47615,10 @@ index 414953c..1b26674 100644 -int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms); +const int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms); diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index e06ac54..46eabfd 100644 +index f342aad..f7b725f 100644 --- a/drivers/gpu/drm/radeon/radeon_ttm.c +++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -961,7 +961,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size) +@@ -963,7 +963,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size) man->size = size >> PAGE_SHIFT; } @@ -47343,7 +47627,7 @@ index e06ac54..46eabfd 100644 static const struct vm_operations_struct *ttm_vm_ops = NULL; static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) -@@ -1002,8 +1002,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma) +@@ -1004,8 +1004,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma) } if (unlikely(ttm_vm_ops == NULL)) { ttm_vm_ops = vma->vm_ops; @@ -48976,10 +49260,10 @@ index d47df93..93e4cfd 100644 } } diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c -index 6b4e8a0..271bdc3 100644 +index 564adf3..49ca28c 100644 --- a/drivers/infiniband/core/ucm.c +++ b/drivers/infiniband/core/ucm.c -@@ -919,14 +919,14 @@ static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file, +@@ -920,14 +920,14 @@ static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file, const char __user *inbuf, int in_len, int out_len) { @@ -50008,10 +50292,10 @@ index a1e75cb..88d1c47 100644 This option enables code in the AMD IOMMU driver to collect various statistics about whats happening in the driver and exports that diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 374c129..928e753 100644 +index 5efadad..d1b358e 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c -@@ -739,11 +739,21 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu, +@@ -804,11 +804,21 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu, static void build_completion_wait(struct iommu_cmd *cmd, u64 address) { @@ -57064,6 +57348,19 @@ index 6d04183..d69aee9 100644 ---help--- Say Y here if you want to support for Freescale FlexCAN. +diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c +index 1deb8ff..4e2b0c1 100644 +--- a/drivers/net/can/bfin_can.c ++++ b/drivers/net/can/bfin_can.c +@@ -338,7 +338,7 @@ static int bfin_can_get_berr_counter(const struct net_device *dev, + return 0; + } + +-static int bfin_can_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t bfin_can_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bfin_can_priv *priv = netdev_priv(dev); + struct bfin_can_regs __iomem *reg = priv->membase; diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index 141c2a4..ca734ed 100644 --- a/drivers/net/can/dev.c @@ -57077,6 +57374,19 @@ index 141c2a4..ca734ed 100644 .kind = "can", .maxtype = IFLA_CAN_MAX, .policy = can_policy, +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 41c0fc9..517f7e3 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -465,7 +465,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev, + return err; + } + +-static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + const struct flexcan_priv *priv = netdev_priv(dev); + struct flexcan_regs __iomem *regs = priv->regs; diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c index 5d04f54..9586a90 100644 --- a/drivers/net/can/janz-ican3.c @@ -57156,15 +57466,24 @@ index 69fc840..77a32fc 100644 .setup = dummy_setup, .validate = dummy_validate, diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c -index c89b9ae..7dcddfd 100644 +index c89b9ae..66151c0 100644 --- a/drivers/net/ethernet/8390/ax88796.c +++ b/drivers/net/ethernet/8390/ax88796.c +@@ -834,7 +834,7 @@ static int ax_probe(struct platform_device *pdev) + struct ei_device *ei_local; + struct ax_device *ax; + struct resource *irq, *mem, *mem2; +- unsigned long mem_size, mem2_size = 0; ++ resource_size_t mem_size, mem2_size = 0; + int ret = 0; + + dev = ax__alloc_ei_netdev(sizeof(struct ax_device)); @@ -878,9 +878,11 @@ static int ax_probe(struct platform_device *pdev) if (ax->plat->reg_offsets) ei_local->reg_offset = ax->plat->reg_offsets; else { + resource_size_t _mem_size = mem_size; -+ do_div(_mem_size, 0x18); ++ _mem_size /= 0x18; ei_local->reg_offset = ax->reg_offsets; for (ret = 0; ret < 0x18; ret++) - ax->reg_offsets[ret] = (mem_size / 0x18) * ret; @@ -57240,6 +57559,32 @@ index 2f79d29..ed5a64e 100644 { void __iomem *shmem = ei_status.mem + (start_page << 8); shmem -= ei_status.tx_start_page << 8; +diff --git a/drivers/net/ethernet/adi/bfin_mac.c b/drivers/net/ethernet/adi/bfin_mac.c +index 74139cb..6c2a056 100644 +--- a/drivers/net/ethernet/adi/bfin_mac.c ++++ b/drivers/net/ethernet/adi/bfin_mac.c +@@ -1123,7 +1123,7 @@ static void tx_reclaim_skb_timeout(unsigned long lp) + tx_reclaim_skb((struct bfin_mac_local *)lp); + } + +-static int bfin_mac_hard_start_xmit(struct sk_buff *skb, ++static netdev_tx_t bfin_mac_hard_start_xmit(struct sk_buff *skb, + struct net_device *dev) + { + struct bfin_mac_local *lp = netdev_priv(dev); +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index 8d50314..df65782 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -438,7 +438,7 @@ static void emac_timeout(struct net_device *dev) + /* Hardware start transmission. + * Send a packet to media from the upper layer. + */ +-static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct emac_board_info *db = netdev_priv(dev); + unsigned long channel; diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c index f749e4d..23a27f1 100644 --- a/drivers/net/ethernet/altera/altera_tse_main.c @@ -57276,6 +57621,32 @@ index f749e4d..23a27f1 100644 /* Scatter/gather IO is not supported, * so it is turned off +diff --git a/drivers/net/ethernet/amd/7990.c b/drivers/net/ethernet/amd/7990.c +index 66d0b73c..5e0763f 100644 +--- a/drivers/net/ethernet/amd/7990.c ++++ b/drivers/net/ethernet/amd/7990.c +@@ -535,7 +535,7 @@ void lance_tx_timeout(struct net_device *dev) + } + EXPORT_SYMBOL_GPL(lance_tx_timeout); + +-int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + volatile struct lance_init_block *ib = lp->init_block; +diff --git a/drivers/net/ethernet/amd/7990.h b/drivers/net/ethernet/amd/7990.h +index e9e0be3..1b8e3af 100644 +--- a/drivers/net/ethernet/amd/7990.h ++++ b/drivers/net/ethernet/amd/7990.h +@@ -240,7 +240,7 @@ struct lance_private { + /* Now the prototypes we export */ + int lance_open(struct net_device *dev); + int lance_close(struct net_device *dev); +-int lance_start_xmit(struct sk_buff *skb, struct net_device *dev); ++netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev); + void lance_set_multicast(struct net_device *dev); + void lance_tx_timeout(struct net_device *dev); + #ifdef CONFIG_NET_POLL_CONTROLLER diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c index 9496005..1fb7ac2 100644 --- a/drivers/net/ethernet/amd/amd8111e.c @@ -57300,6 +57671,41 @@ index 9496005..1fb7ac2 100644 lp->ipg_data.ipg_timer.expires = jiffies + IPG_CONVERGE_JIFFIES; lp->ipg_data.ipg = DEFAULT_IPG; +diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c +index b10964e..93b7cb8 100644 +--- a/drivers/net/ethernet/amd/atarilance.c ++++ b/drivers/net/ethernet/amd/atarilance.c +@@ -339,7 +339,7 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr + *init_rec ); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); + static irqreturn_t lance_interrupt( int irq, void *dev_id ); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -770,7 +770,7 @@ static void lance_tx_timeout (struct net_device *dev) + + /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */ + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) + { + struct lance_private *lp = netdev_priv(dev); + struct lance_ioreg *IO = lp->iobase; +diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c +index b584b78..5e994f9 100644 +--- a/drivers/net/ethernet/amd/declance.c ++++ b/drivers/net/ethernet/amd/declance.c +@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + volatile struct lance_regs *ll = lp->ll; diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c index 7ccebae..237f6bb 100644 --- a/drivers/net/ethernet/amd/pcnet32.c @@ -57333,6 +57739,41 @@ index 7ccebae..237f6bb 100644 struct pcnet32_private *lp = netdev_priv(dev); unsigned long flags; +diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c +index 3d8c6b2..35160ad 100644 +--- a/drivers/net/ethernet/amd/sun3lance.c ++++ b/drivers/net/ethernet/amd/sun3lance.c +@@ -235,7 +235,7 @@ struct lance_private { + static int lance_probe( struct net_device *dev); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); + static irqreturn_t lance_interrupt( int irq, void *dev_id); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -511,7 +511,7 @@ static void lance_init_ring( struct net_device *dev ) + } + + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) + { + struct lance_private *lp = netdev_priv(dev); + int entry, len; +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 7847638..6126840 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + int entry, skblen, len; diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h index b6fa891..31ef157 100644 --- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h @@ -58178,6 +58619,19 @@ index 08a23e6..2ffb80f 100644 { struct nb8800_priv *priv = netdev_priv(dev); struct nb8800_tx_desc *txd; +diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +index 87c6b5b..ebb3a41 100644 +--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +@@ -571,7 +571,7 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id) + /* + * tx request callback + */ +-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bcm_enet_priv *priv; + struct bcm_enet_desc *desc; diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c index 8fc3f3c..d97e01e 100644 --- a/drivers/net/ethernet/broadcom/bnx2.c @@ -59357,6 +59811,19 @@ index 6528231..8503500 100644 { u32 wr_mid; u64 cntrl, *end; +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index 48d9194..68ced25 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1021,7 +1021,7 @@ static void dm9000_send_packet(struct net_device *dev, + * Hardware start transmission. + * Send a packet to media from the upper layer. + */ +-static int ++static netdev_tx_t + dm9000_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + unsigned long flags; diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c index 3acde3b..284086c 100644 --- a/drivers/net/ethernet/dec/tulip/de4x5.c @@ -59440,7 +59907,7 @@ index d1cf127..9d52393 100644 struct be_adapter *adapter = pci_get_drvdata(pdev); diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c -index 84384e1..baac17d 100644 +index 84384e1..9643fe6 100644 --- a/drivers/net/ethernet/faraday/ftgmac100.c +++ b/drivers/net/ethernet/faraday/ftgmac100.c @@ -30,6 +30,8 @@ @@ -59452,8 +59919,17 @@ index 84384e1..baac17d 100644 #include <net/ip.h> #include "ftgmac100.h" +@@ -1120,7 +1122,7 @@ static int ftgmac100_stop(struct net_device *netdev) + return 0; + } + +-static int ftgmac100_hard_start_xmit(struct sk_buff *skb, ++static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + struct net_device *netdev) + { + struct ftgmac100 *priv = netdev_priv(netdev); diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c -index dce5f7b..2433466 100644 +index dce5f7b..222e709 100644 --- a/drivers/net/ethernet/faraday/ftmac100.c +++ b/drivers/net/ethernet/faraday/ftmac100.c @@ -31,6 +31,8 @@ @@ -59465,6 +59941,76 @@ index dce5f7b..2433466 100644 #include "ftmac100.h" +@@ -1009,7 +1011,7 @@ static int ftmac100_stop(struct net_device *netdev) + return 0; + } + +-static int ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev) + { + struct ftmac100 *priv = netdev_priv(netdev); + dma_addr_t map; +diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c +index 25553ee..0b3cdea 100644 +--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c ++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c +@@ -306,7 +306,7 @@ static int mpc52xx_fec_close(struct net_device *dev) + * invariant will hold if you make sure that the netif_*_queue() + * calls are done at the proper times. + */ +-static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct mpc52xx_fec_priv *priv = netdev_priv(dev); + struct bcom_fec_bd *bd; +diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +index 48a9c17..0745505 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c ++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +@@ -509,7 +509,7 @@ static struct sk_buff *tx_skb_align_workaround(struct net_device *dev, + } + #endif + +-static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct fs_enet_private *fep = netdev_priv(dev); + cbd_t __iomem *bdp; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index b9ecf19..26b1b45 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -112,7 +112,7 @@ + const char gfar_driver_version[] = "2.0"; + + static int gfar_enet_open(struct net_device *dev); +-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev); + static void gfar_reset_task(struct work_struct *work); + static void gfar_timeout(struct net_device *dev); + static int gfar_close(struct net_device *dev); +@@ -2315,7 +2315,7 @@ static inline bool gfar_csum_errata_76(struct gfar_private *priv, + /* This is called by the kernel when a frame is ready for transmission. + * It is pointed to by the dev->hard_start_xmit function pointer + */ +-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct gfar_private *priv = netdev_priv(dev); + struct gfar_priv_tx_q *tx_queue = NULL; +diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c +index 5bf1ade..4e74666 100644 +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3085,7 +3085,7 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth) + + /* This is called by the kernel when a frame is ready for transmission. */ + /* It is pointed to by the dev->hard_start_xmit function pointer */ +-static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ucc_geth_private *ugeth = netdev_priv(dev); + #ifdef CONFIG_UGETH_TX_ON_DEMAND diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c index 0c4afe9..d888314 100644 --- a/drivers/net/ethernet/hisilicon/hip04_eth.c @@ -59516,6 +60062,63 @@ index d4f92ed..38fdf5b 100644 snprintf(ae_dev->name, AE_NAME_SIZE, "%s%d", DSAF_DEVICE_NAME, (int)atomic_inc_return(&id)); +diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c +index c984998..187fa04 100644 +--- a/drivers/net/ethernet/i825xx/lib82596.c ++++ b/drivers/net/ethernet/i825xx/lib82596.c +@@ -347,7 +347,7 @@ static const char init_setup[] = + 0x7f /* *multi IA */ }; + + static int i596_open(struct net_device *dev); +-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev); + static irqreturn_t i596_interrupt(int irq, void *dev_id); + static int i596_close(struct net_device *dev); + static void i596_add_cmd(struct net_device *dev, struct i596_cmd *cmd); +@@ -965,7 +965,7 @@ static void i596_tx_timeout (struct net_device *dev) + } + + +-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct i596_private *lp = netdev_priv(dev); + struct tx_cmd *tx_cmd; +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 2a0dc12..d590cfd 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -2048,7 +2048,7 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev, + dev_consume_skb_any(skb); + } + +-static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ehea_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ehea_port *port = netdev_priv(dev); + struct ehea_swqe *swqe; +diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c +index 5d7db6c..1592aba 100644 +--- a/drivers/net/ethernet/ibm/emac/core.c ++++ b/drivers/net/ethernet/ibm/emac/core.c +@@ -1385,7 +1385,7 @@ static inline int emac_xmit_finish(struct emac_instance *dev, int len) + } + + /* Tx lock BH */ +-static int emac_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct emac_instance *dev = netdev_priv(ndev); + unsigned int len = skb->len; +@@ -1443,7 +1443,7 @@ static inline int emac_xmit_split(struct emac_instance *dev, int slot, + } + + /* Tx lock BH disabled (SG version for TAH equipped EMACs) */ +-static int emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev) + { + struct emac_instance *dev = netdev_priv(ndev); + int nr_frags = skb_shinfo(skb)->nr_frags; diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c index 068789e..f4928f0 100644 --- a/drivers/net/ethernet/intel/e100.c @@ -59735,6 +60338,19 @@ index a94daa8..d1d3bd0 100644 .notifier_call = mlxsw_sp_netdevice_event, }; +diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c +index a8522d8..2126286 100644 +--- a/drivers/net/ethernet/micrel/ks8695net.c ++++ b/drivers/net/ethernet/micrel/ks8695net.c +@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev) + * sk_buff and adds it to the TX ring. It then kicks the TX DMA + * engine to ensure transmission begins. + */ +-static int ++static netdev_tx_t + ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct ks8695_priv *ksp = netdev_priv(ndev); diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c index 2fc5cd5..6c6108a 100644 --- a/drivers/net/ethernet/micrel/ks8851_mll.c @@ -59748,6 +60364,19 @@ index 2fc5cd5..6c6108a 100644 { int retv = NETDEV_TX_OK; struct ks_net *ks = netdev_priv(netdev); +diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c +index 3e67f45..f1e1504 100644 +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -319,7 +319,7 @@ static irqreturn_t moxart_mac_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct moxart_mac_priv_t *priv = netdev_priv(ndev); + void *desc; diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c index 9ba9758..9c7c77f 100644 --- a/drivers/net/ethernet/neterion/s2io.c @@ -59812,6 +60441,32 @@ index 43c618b..bb6e368 100644 { struct nfp_net *nn = netdev_priv(netdev); const struct skb_frag_struct *frag; +diff --git a/drivers/net/ethernet/netx-eth.c b/drivers/net/ethernet/netx-eth.c +index 9fbc302..f87f84a 100644 +--- a/drivers/net/ethernet/netx-eth.c ++++ b/drivers/net/ethernet/netx-eth.c +@@ -107,7 +107,7 @@ static void netx_eth_set_multicast_list(struct net_device *ndev) + /* implement me */ + } + +-static int ++static netdev_tx_t + netx_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct netx_eth_priv *priv = netdev_priv(ndev); +diff --git a/drivers/net/ethernet/nuvoton/w90p910_ether.c b/drivers/net/ethernet/nuvoton/w90p910_ether.c +index afa4458..95ab01b 100644 +--- a/drivers/net/ethernet/nuvoton/w90p910_ether.c ++++ b/drivers/net/ethernet/nuvoton/w90p910_ether.c +@@ -633,7 +633,7 @@ static int w90p910_send_frame(struct net_device *dev, + return 0; + } + +-static int w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct w90p910_ether *ether = netdev_priv(dev); + diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c index 75e88f4..1db3bf6 100644 --- a/drivers/net/ethernet/nvidia/forcedeth.c @@ -59827,6 +60482,19 @@ index 75e88f4..1db3bf6 100644 __le32 txvlan; __le32 flaglen; }; +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index b1ce7aa..c082651 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -1063,7 +1063,7 @@ static int lpc_eth_close(struct net_device *ndev) + return 0; + } + +-static int lpc_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t lpc_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct netdata_local *pldat = netdev_priv(ndev); + u32 len, txidx; diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c index 3b98b263b..13d2129 100644 --- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c @@ -60000,6 +60668,19 @@ index f39e719..d05dce9 100644 .notifier_call = rocker_netevent_event, }; +diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c +index ca73366..8debe39 100644 +--- a/drivers/net/ethernet/seeq/sgiseeq.c ++++ b/drivers/net/ethernet/seeq/sgiseeq.c +@@ -578,7 +578,7 @@ static inline int sgiseeq_reset(struct net_device *dev) + return 0; + } + +-static int sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct sgiseeq_private *sp = netdev_priv(dev); + struct hpc3_ethregs *hregs = sp->hregs; diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c index c771e0a..bbb368d 100644 --- a/drivers/net/ethernet/sfc/ptp.c @@ -60083,6 +60764,54 @@ index 9d78830..74fc649 100644 if (tx_done != state->packet_count) { /* Don't free the skbs; they will be picked up on TX * overflow or channel teardown. +diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c +index 7a254da..0693a2b4 100644 +--- a/drivers/net/ethernet/sgi/ioc3-eth.c ++++ b/drivers/net/ethernet/sgi/ioc3-eth.c +@@ -103,7 +103,7 @@ static inline struct net_device *priv_netdev(struct ioc3_private *dev) + + static int ioc3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd); + static void ioc3_set_multicast_list(struct net_device *dev); +-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev); + static void ioc3_timeout(struct net_device *dev); + static inline unsigned int ioc3_hash(const unsigned char *addr); + static inline void ioc3_stop(struct ioc3_private *ip); +@@ -1397,7 +1397,7 @@ static struct pci_driver ioc3_driver = { + .remove = ioc3_remove_one, + }; + +-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + unsigned long data; + struct ioc3_private *ip = netdev_priv(dev); +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index bd64eb9..73ba84d 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -511,7 +511,7 @@ static void smc911x_hardware_send_pkt(struct net_device *dev) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc911x_local *lp = netdev_priv(dev); + unsigned int free; +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index db7db8a..6a1696c 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -637,7 +637,7 @@ done: if (!THROTTLE_TX_PKTS) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc_local *lp = netdev_priv(dev); + void __iomem *ioaddr = lp->base; diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c index 8af2556..6da27b9 100644 --- a/drivers/net/ethernet/smsc/smsc911x.c @@ -60111,6 +60840,73 @@ index 3f20bb1..59add41 100644 } /* To mask all all interrupts.*/ +diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c +index aa4f9d2..d9ffff3 100644 +--- a/drivers/net/ethernet/sun/sunbmac.c ++++ b/drivers/net/ethernet/sun/sunbmac.c +@@ -950,7 +950,7 @@ static void bigmac_tx_timeout(struct net_device *dev) + } + + /* Put a packet on the wire. */ +-static int bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bigmac *bp = netdev_priv(dev); + int len, entry; +diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c +index 9b825780..71a2b34 100644 +--- a/drivers/net/ethernet/sun/sunqe.c ++++ b/drivers/net/ethernet/sun/sunqe.c +@@ -568,7 +568,7 @@ out: + } + + /* Get a packet queued to go onto the wire. */ +-static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t qe_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct sunqe *qep = netdev_priv(dev); + struct sunqe_buffers *qbufs = qep->buffers; +diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c +index 23fa298..c650e26 100644 +--- a/drivers/net/ethernet/sun/sunvnet.c ++++ b/drivers/net/ethernet/sun/sunvnet.c +@@ -1152,15 +1152,15 @@ vnet_select_queue(struct net_device *dev, struct sk_buff *skb, + return port->q_index; + } + +-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev); + +-static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb) ++static netdev_tx_t vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb) + { + struct net_device *dev = port->vp->dev; + struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING]; + struct sk_buff *segs; + int maclen, datalen; +- int status; ++ netdev_tx_t status; + int gso_size, gso_type, gso_segs; + int hlen = skb_transport_header(skb) - skb_mac_header(skb); + int proto = IPPROTO_IP; +@@ -1216,7 +1216,7 @@ static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb) + skb_push(skb, maclen); + skb_reset_mac_header(skb); + +- status = 0; ++ status = NETDEV_TX_OK; + while (segs) { + struct sk_buff *curr = segs; + +@@ -1255,7 +1255,7 @@ out_dropped: + return NETDEV_TX_OK; + } + +-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct vnet *vp = netdev_priv(dev); + struct vnet_port *port = NULL; diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c index af11ed1..21bca5f 100644 --- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c @@ -60124,6 +60920,32 @@ index af11ed1..21bca5f 100644 { struct net_local *lp = netdev_priv(ndev); struct dwceqos_tx trans; +diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c +index 7eef45e..c813085 100644 +--- a/drivers/net/ethernet/ti/cpmac.c ++++ b/drivers/net/ethernet/ti/cpmac.c +@@ -545,7 +545,7 @@ fatal_error: + + } + +-static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + int queue, len; + struct cpmac_desc *desc; +diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c +index 029841f..e899a548 100644 +--- a/drivers/net/ethernet/ti/netcp_core.c ++++ b/drivers/net/ethernet/ti/netcp_core.c +@@ -1237,7 +1237,7 @@ out: + } + + /* Submit the packet */ +-static int netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct netcp_intf *netcp = netdev_priv(ndev); + int subqueue = skb_get_queue_mapping(skb); diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c index 2b7550c..f75bc6c 100644 --- a/drivers/net/ethernet/via/via-rhine.c @@ -60163,6 +60985,32 @@ index 8da7b93..719204a 100644 { struct w5300_priv *priv = netdev_priv(ndev); +diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c +index 5a1068d..6de663b 100644 +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -673,7 +673,7 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag) + return 0; + } + +-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct temac_local *lp = netdev_priv(ndev); + struct cdmac_bd *cur_p; +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 4684644..6687c7f 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -652,7 +652,7 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp, + * start the transmission. Additionally if checksum offloading is supported, + * it populates AXI Stream Control fields with appropriate values. + */ +-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + u32 ii; + u32 num_frag; diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 0bf7edd..7fc5d06 100644 --- a/drivers/net/geneve.c @@ -62962,7 +63810,7 @@ index a040edc..4ea3fa7 100644 crypto_hdr[2] = 0; crypto_hdr[3] = 0x20 | (keyconf->keyidx << 6); diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index 5a854c6..8871801 100644 +index 1198caa..90099d6 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c @@ -2123,7 +2123,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file, @@ -65430,6 +66278,32 @@ index a912dc0..a8225ba 100644 u16 int_num; ZD_ASSERT(in_interrupt()); +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index f5231a2..966574d 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -142,7 +142,7 @@ void xenvif_wake_queue(struct xenvif_queue *queue) + netif_tx_wake_queue(netdev_get_tx_queue(dev, id)); + } + +-static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct xenvif *vif = netdev_priv(dev); + struct xenvif_queue *queue = NULL; +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 96ccd4e..8e1c6b7 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -550,7 +550,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb, + + #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1) + +-static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct netfront_info *np = netdev_priv(dev); + struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats); diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 680f578..cf80097 100644 --- a/drivers/nvme/host/pci.c @@ -75262,7 +76136,7 @@ index cffa0a0..1758349 100644 file->f_version = event_count; return POLLIN | POLLRDNORM; diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 59e7a33..86f0d9a 100644 +index 59e7a33..0296a3e 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -168,7 +168,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, @@ -75301,7 +76175,23 @@ index 59e7a33..86f0d9a 100644 if (copy_to_user(buf, dev->rawdescriptors[i] + (*ppos - pos), min(len, alloclen))) { -@@ -1485,7 +1485,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb +@@ -1186,10 +1186,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg) + + static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg) + { +- struct usbdevfs_connectinfo ci = { +- .devnum = ps->dev->devnum, +- .slow = ps->dev->speed == USB_SPEED_LOW +- }; ++ struct usbdevfs_connectinfo ci; ++ ++ memset(&ci, 0, sizeof(ci)); ++ ci.devnum = ps->dev->devnum; ++ ci.slow = ps->dev->speed == USB_SPEED_LOW; + + if (copy_to_user(arg, &ci, sizeof(ci))) + return -EFAULT; +@@ -1485,7 +1486,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb } } as->urb->dev = ps->dev; @@ -75722,7 +76612,7 @@ index a7de8e8..e1ef134 100644 spin_lock_init(&uhci->lock); setup_timer(&uhci->fsbr_timer, uhci_fsbr_timeout, diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index f0640b7..f87a6f9 100644 +index 48672fa..9245081 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -32,7 +32,7 @@ @@ -75735,10 +76625,10 @@ index f0640b7..f87a6f9 100644 /* Device for a quirk */ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 0c8087d..0f5a685 100644 +index 8e713cc..8c92a15 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c -@@ -4870,7 +4870,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) +@@ -4872,7 +4872,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) int retval; /* Accept arbitrarily long scatter-gather lists */ @@ -75965,28 +76855,6 @@ index da0ad32..50b5bbe 100644 /* Dynamic bitflag definitions (us->dflags): used in set_bit() etc. */ -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index facaaf0..e40da77 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) - if (!(size > 0)) - return 0; - -+ if (size > urb->transfer_buffer_length) { -+ /* should not happen, probably malicious packet */ -+ if (ud->side == USBIP_STUB) { -+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); -+ return 0; -+ } else { -+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); -+ return -EPIPE; -+ } -+ } -+ - ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); - if (ret != size) { - dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret); diff --git a/drivers/usb/usbip/vhci.h b/drivers/usb/usbip/vhci.h index a863a98..d272795 100644 --- a/drivers/usb/usbip/vhci.h @@ -93710,7 +94578,7 @@ index 914ac13..6a872f7 100644 /* first set the basic ref node struct up */ atomic_set(&ref->refs, 1); diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 4545e2e..4a2c0a9 100644 +index d8d68af..2524afc0 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -1271,7 +1271,7 @@ static void __setup_root(u32 nodesize, u32 sectorsize, u32 stripesize, @@ -93953,7 +94821,7 @@ index 539e7b5..9de4167 100644 .attrs = attrs, }; diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c -index 0e1e61a..227b156 100644 +index d39f714..1adad12 100644 --- a/fs/btrfs/tests/btrfs-tests.c +++ b/fs/btrfs/tests/btrfs-tests.c @@ -119,7 +119,7 @@ struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(void) @@ -95511,7 +96379,7 @@ index 7566b26..660a3cc 100644 dcache_init(); inode_init(); diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index bece948..e657aeb 100644 +index 8580831..36166e5 100644 --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -247,6 +247,10 @@ static struct dentry *start_creating(const char *name, struct dentry *parent) @@ -111613,7 +112481,7 @@ index 510413eb..34d9a8c 100644 seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq); diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index fa95ab2..7ab502b 100644 +index 9d2f3e0..52c3ee0 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -15,12 +15,19 @@ @@ -111784,7 +112652,7 @@ index fa95ab2..7ab502b 100644 mss.resident >> 10, (unsigned long)(mss.pss >> (10 + PSS_SHIFT)), mss.shared_clean >> 10, -@@ -1588,6 +1638,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1615,6 +1665,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) char buffer[64]; int nid; @@ -111798,7 +112666,7 @@ index fa95ab2..7ab502b 100644 if (!mm) return 0; -@@ -1602,11 +1659,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1629,11 +1686,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy); } @@ -112960,7 +113828,7 @@ index 85c40f4..52fcd23 100644 error = notify_change(path->dentry, &newattrs, &delegated_inode); inode_unlock(inode); diff --git a/fs/xattr.c b/fs/xattr.c -index 4861322..205ea1d 100644 +index 4861322..7266aed 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -208,6 +208,27 @@ vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value, @@ -112979,7 +113847,7 @@ index 4861322..205ea1d 100644 + return error; + + if (inode->i_op->getxattr) -+ error = inode->i_op->getxattr(dentry, XATTR_NAME_PAX_FLAGS, value, size); ++ error = inode->i_op->getxattr(dentry, XATTR_NAME_USER_PAX_FLAGS, value, size); + else + error = -EOPNOTSUPP; + @@ -124499,7 +125367,7 @@ index 5bdab6b..9ae82fe 100644 #define pud_none(pud) 0 #define pud_bad(pud) 0 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h -index eb1973b..b24b581 100644 +index eb1973b..76f4987 100644 --- a/include/asm-generic/atomic-long.h +++ b/include/asm-generic/atomic-long.h @@ -22,6 +22,12 @@ @@ -124696,7 +125564,7 @@ index eb1973b..b24b581 100644 #undef ATOMIC_LONG_INC_DEC_OP -@@ -187,4 +224,51 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u) +@@ -187,4 +224,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u) #define atomic_long_inc_not_zero(l) \ ATOMIC_LONG_PFX(_inc_not_zero)((ATOMIC_LONG_PFX(_t) *)(l)) @@ -124731,8 +125599,12 @@ index eb1973b..b24b581 100644 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v)) +#define atomic_inc_unchecked(v) atomic_inc(v) +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v) ++#ifndef atomic_inc_return_unchecked +#define atomic_inc_return_unchecked(v) atomic_inc_return(v) ++#endif ++#ifndef atomic_add_return_unchecked +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v)) ++#endif +#define atomic_dec_unchecked(v) atomic_dec(v) +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n)) +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i)) @@ -125745,7 +126617,7 @@ index 8609d57..86e4d79 100644 int (*generic_packet) (struct cdrom_device_info *, struct packet_command *); diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h -index 89d944b..1d98ada 100644 +index 7fc7cb7..5de1aa8 100644 --- a/include/linux/cgroup-defs.h +++ b/include/linux/cgroup-defs.h @@ -424,7 +424,7 @@ struct cftype { @@ -129119,7 +129991,7 @@ index 2696c1f..9320d41 100644 static inline int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst) diff --git a/include/linux/mm.h b/include/linux/mm.h -index 516e149..93b0b57 100644 +index a6c240e..c25ac8d 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -155,6 +155,11 @@ extern unsigned int kobjsize(const void *objp); @@ -129153,7 +130025,7 @@ index 516e149..93b0b57 100644 struct mmu_gather; struct inode; -@@ -1175,8 +1181,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address, +@@ -1179,8 +1185,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address, unsigned long *pfn); int follow_phys(struct vm_area_struct *vma, unsigned long address, unsigned int flags, unsigned long *prot, resource_size_t *phys); @@ -129164,7 +130036,7 @@ index 516e149..93b0b57 100644 static inline void unmap_shared_mapping_range(struct address_space *mapping, loff_t const holebegin, loff_t const holelen) -@@ -1217,9 +1223,9 @@ static inline int fixup_user_fault(struct task_struct *tsk, +@@ -1221,9 +1227,9 @@ static inline int fixup_user_fault(struct task_struct *tsk, } #endif @@ -129177,7 +130049,7 @@ index 516e149..93b0b57 100644 long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, unsigned long start, unsigned long nr_pages, -@@ -1310,39 +1316,11 @@ int clear_page_dirty_for_io(struct page *page); +@@ -1314,39 +1320,11 @@ int clear_page_dirty_for_io(struct page *page); int get_cmdline(struct task_struct *task, char *buffer, int buflen); @@ -129217,7 +130089,7 @@ index 516e149..93b0b57 100644 int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t); extern unsigned long move_page_tables(struct vm_area_struct *vma, -@@ -1487,8 +1465,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, +@@ -1491,8 +1469,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, { return 0; } @@ -129233,7 +130105,7 @@ index 516e149..93b0b57 100644 #endif #if defined(__PAGETABLE_PMD_FOLDED) || !defined(CONFIG_MMU) -@@ -1498,6 +1483,12 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, +@@ -1502,6 +1487,12 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, return 0; } @@ -129246,7 +130118,7 @@ index 516e149..93b0b57 100644 static inline void mm_nr_pmds_init(struct mm_struct *mm) {} static inline unsigned long mm_nr_pmds(struct mm_struct *mm) -@@ -1510,6 +1501,7 @@ static inline void mm_dec_nr_pmds(struct mm_struct *mm) {} +@@ -1514,6 +1505,7 @@ static inline void mm_dec_nr_pmds(struct mm_struct *mm) {} #else int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address); @@ -129254,7 +130126,7 @@ index 516e149..93b0b57 100644 static inline void mm_nr_pmds_init(struct mm_struct *mm) { -@@ -1547,11 +1539,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a +@@ -1551,11 +1543,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a NULL: pud_offset(pgd, address); } @@ -129278,7 +130150,7 @@ index 516e149..93b0b57 100644 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */ #if USE_SPLIT_PTE_PTLOCKS -@@ -1934,12 +1938,23 @@ extern struct vm_area_struct *copy_vma(struct vm_area_struct **, +@@ -1938,12 +1942,23 @@ extern struct vm_area_struct *copy_vma(struct vm_area_struct **, bool *need_rmap_locks); extern void exit_mmap(struct mm_struct *); @@ -129302,7 +130174,7 @@ index 516e149..93b0b57 100644 if (rlim < RLIM_INFINITY) { if (((new - start) + (end_data - start_data)) > rlim) return -ENOSPC; -@@ -1974,6 +1989,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, +@@ -1978,6 +1993,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate); extern int do_munmap(struct mm_struct *, unsigned long, size_t); @@ -129310,7 +130182,7 @@ index 516e149..93b0b57 100644 static inline unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, -@@ -2010,10 +2026,11 @@ struct vm_unmapped_area_info { +@@ -2014,10 +2030,11 @@ struct vm_unmapped_area_info { unsigned long high_limit; unsigned long align_mask; unsigned long align_offset; @@ -129324,7 +130196,7 @@ index 516e149..93b0b57 100644 /* * Search for an unmapped address range. -@@ -2025,7 +2042,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); +@@ -2029,7 +2046,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info); * - satisfies (begin_addr & align_mask) == (align_offset & align_mask) */ static inline unsigned long @@ -129333,7 +130205,7 @@ index 516e149..93b0b57 100644 { if (info->flags & VM_UNMAPPED_AREA_TOPDOWN) return unmapped_area_topdown(info); -@@ -2085,6 +2102,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add +@@ -2089,6 +2106,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr, struct vm_area_struct **pprev); @@ -129344,7 +130216,7 @@ index 516e149..93b0b57 100644 /* Look up the first VMA which intersects the interval start_addr..end_addr-1, NULL if none. Assume start_addr < end_addr. */ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr) -@@ -2114,10 +2135,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, +@@ -2118,10 +2139,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, } #ifdef CONFIG_MMU @@ -129357,7 +130229,7 @@ index 516e149..93b0b57 100644 { return __pgprot(0); } -@@ -2282,7 +2303,7 @@ extern int get_hwpoison_page(struct page *page); +@@ -2286,7 +2307,7 @@ extern int get_hwpoison_page(struct page *page); extern int sysctl_memory_failure_early_kill; extern int sysctl_memory_failure_recovery; extern void shake_page(struct page *p, int access); @@ -129366,7 +130238,7 @@ index 516e149..93b0b57 100644 extern int soft_offline_page(struct page *page, int flags); -@@ -2367,5 +2388,11 @@ void __init setup_nr_node_ids(void); +@@ -2371,5 +2392,11 @@ void __init setup_nr_node_ids(void); static inline void setup_nr_node_ids(void) {} #endif @@ -131654,6 +132526,164 @@ index f5f80c5..d4e916a 100644 { rcu_lock_release(&(sp)->dep_map); __srcu_read_unlock(sp, idx); +diff --git a/include/linux/string.h b/include/linux/string.h +index 9eebc66..733834c 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -18,51 +18,51 @@ extern void *memdup_user_nul(const void __user *, size_t); + #include <asm/string.h> + + #ifndef __HAVE_ARCH_STRCPY +-extern char * strcpy(char *,const char *); ++extern char * strcpy(char *,const char *) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRNCPY +-extern char * strncpy(char *,const char *, __kernel_size_t); ++extern char * strncpy(char *,const char *, __kernel_size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRLCPY +-size_t strlcpy(char *, const char *, size_t); ++size_t strlcpy(char *, const char *, size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRSCPY +-ssize_t __must_check strscpy(char *, const char *, size_t); ++ssize_t __must_check strscpy(char *, const char *, size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRCAT +-extern char * strcat(char *, const char *); ++extern char * strcat(char *, const char *) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRNCAT +-extern char * strncat(char *, const char *, __kernel_size_t); ++extern char * strncat(char *, const char *, __kernel_size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRLCAT +-extern size_t strlcat(char *, const char *, __kernel_size_t); ++extern size_t strlcat(char *, const char *, __kernel_size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRCMP +-extern int strcmp(const char *,const char *); ++extern int strcmp(const char *,const char *) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRNCMP +-extern int strncmp(const char *,const char *,__kernel_size_t); ++extern int strncmp(const char *,const char *,__kernel_size_t) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRCASECMP +-extern int strcasecmp(const char *s1, const char *s2); ++extern int strcasecmp(const char *s1, const char *s2) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRNCASECMP +-extern int strncasecmp(const char *s1, const char *s2, size_t n); ++extern int strncasecmp(const char *s1, const char *s2, size_t n) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRCHR +-extern char * strchr(const char *,int); ++extern char * strchr(const char *,int) __nocapture(1); + #endif + #ifndef __HAVE_ARCH_STRCHRNUL +-extern char * strchrnul(const char *,int); ++extern char * strchrnul(const char *,int) __nocapture(1); + #endif + #ifndef __HAVE_ARCH_STRNCHR +-extern char * strnchr(const char *, size_t, int); ++extern char * strnchr(const char *, size_t, int) __nocapture(1); + #endif + #ifndef __HAVE_ARCH_STRRCHR +-extern char * strrchr(const char *,int); ++extern char * strrchr(const char *,int) __nocapture(1); + #endif +-extern char * __must_check skip_spaces(const char *); ++extern char * __must_check skip_spaces(const char *) __nocapture(1); + + extern char *strim(char *); + +@@ -72,10 +72,10 @@ static inline __must_check char *strstrip(char *str) + } + + #ifndef __HAVE_ARCH_STRSTR +-extern char * strstr(const char *, const char *); ++extern char * strstr(const char *, const char *) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRNSTR +-extern char * strnstr(const char *, const char *, size_t); ++extern char * strnstr(const char *, const char *, size_t) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRLEN + extern __kernel_size_t strlen(const char *); +@@ -84,55 +84,55 @@ extern __kernel_size_t strlen(const char *); + extern __kernel_size_t strnlen(const char *,__kernel_size_t); + #endif + #ifndef __HAVE_ARCH_STRPBRK +-extern char * strpbrk(const char *,const char *); ++extern char * strpbrk(const char *,const char *) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRSEP +-extern char * strsep(char **,const char *); ++extern char * strsep(char **,const char *) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_STRSPN +-extern __kernel_size_t strspn(const char *,const char *); ++extern __kernel_size_t strspn(const char *,const char *) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_STRCSPN +-extern __kernel_size_t strcspn(const char *,const char *); ++extern __kernel_size_t strcspn(const char *,const char *) __nocapture(1, 2); + #endif + + #ifndef __HAVE_ARCH_MEMSET + extern void * memset(void *,int,__kernel_size_t); + #endif + #ifndef __HAVE_ARCH_MEMCPY +-extern void * memcpy(void *,const void *,__kernel_size_t); ++extern void * memcpy(void *,const void *,__kernel_size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_MEMMOVE +-extern void * memmove(void *,const void *,__kernel_size_t); ++extern void * memmove(void *,const void *,__kernel_size_t) __nocapture(2); + #endif + #ifndef __HAVE_ARCH_MEMSCAN + extern void * memscan(void *,int,__kernel_size_t); + #endif + #ifndef __HAVE_ARCH_MEMCMP +-extern int memcmp(const void *,const void *,__kernel_size_t); ++extern int memcmp(const void *,const void *,__kernel_size_t) __nocapture(1, 2); + #endif + #ifndef __HAVE_ARCH_MEMCHR +-extern void * memchr(const void *,int,__kernel_size_t); ++extern void * memchr(const void *,int,__kernel_size_t) __nocapture(1); + #endif +-void *memchr_inv(const void *s, int c, size_t n); ++void *memchr_inv(const void *s, int c, size_t n) __nocapture(1); + char *strreplace(char *s, char old, char new); + + extern void kfree_const(const void *x); + +-extern char *kstrdup(const char *s, gfp_t gfp); +-extern const char *kstrdup_const(const char *s, gfp_t gfp); +-extern char *kstrndup(const char *s, size_t len, gfp_t gfp); +-extern void *kmemdup(const void *src, size_t len, gfp_t gfp); ++extern char *kstrdup(const char *s, gfp_t gfp) __nocapture(1); ++extern const char *kstrdup_const(const char *s, gfp_t gfp) __nocapture(1); ++extern char *kstrndup(const char *s, size_t len, gfp_t gfp) __nocapture(1); ++extern void *kmemdup(const void *src, size_t len, gfp_t gfp) __nocapture(1); + + extern char **argv_split(gfp_t gfp, const char *str, int *argcp); + extern void argv_free(char **argv); + +-extern bool sysfs_streq(const char *s1, const char *s2); +-extern int strtobool(const char *s, bool *res); ++extern bool sysfs_streq(const char *s1, const char *s2) __nocapture(1, 2); ++extern int strtobool(const char *s, bool *res) __nocapture(1); + + #ifdef CONFIG_BINARY_PRINTF +-int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args); +-int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf); ++int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args) __nocapture(3); ++int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) __nocapture(3); + int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); + #endif + diff --git a/include/linux/sunrpc/addr.h b/include/linux/sunrpc/addr.h index 5c9c6cd..f16c5c9 100644 --- a/include/linux/sunrpc/addr.h @@ -131811,7 +132841,7 @@ index 017fced..d4a9fc9 100644 extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h -index 185815c..9901529 100644 +index 185815c..5ade9cd 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -102,7 +102,12 @@ union bpf_attr; @@ -131867,6 +132897,15 @@ index 185815c..9901529 100644 asmlinkage long sys_truncate(const char __user *path, long length); asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length); asmlinkage long sys_stat(const char __user *filename, +@@ -457,7 +463,7 @@ asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size, + unsigned long prot, unsigned long pgoff, + unsigned long flags); + asmlinkage long sys_msync(unsigned long start, size_t len, int flags); +-asmlinkage long sys_fadvise64(int fd, loff_t offset, size_t len, int advice); ++asmlinkage long sys_fadvise64(int fd, loff_t offset, loff_t len, int advice); + asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice); + asmlinkage long sys_munmap(unsigned long addr, size_t len); + asmlinkage long sys_mlock(unsigned long start, size_t len); @@ -604,7 +610,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *); asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *); asmlinkage long sys_send(int, void __user *, size_t, unsigned); @@ -134185,16 +135224,17 @@ index 0e011eb..0020b3c 100644 #ifdef __HAVE_BUILTIN_BSWAP64__ return __builtin_bswap64(val); diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h -index 1590c49..5eab462 100644 +index 1590c49..6977e11 100644 --- a/include/uapi/linux/xattr.h +++ b/include/uapi/linux/xattr.h -@@ -73,5 +73,9 @@ +@@ -73,5 +73,10 @@ #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default" #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT +/* User namespace */ -+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax." ++#define XATTR_PAX_PREFIX "pax." +#define XATTR_PAX_FLAGS_SUFFIX "flags" ++#define XATTR_NAME_USER_PAX_FLAGS XATTR_USER_PREFIX XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX +#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX #endif /* _UAPI_LINUX_XATTR_H */ @@ -135356,10 +136396,10 @@ index 45432b5..988f1e4 100644 +} +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog); diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 6a498da..19ed7eb 100644 +index 355cd5f..6273802 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c -@@ -3330,7 +3330,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp, +@@ -3333,7 +3333,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp, key = &cft->lockdep_key; #endif kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name), @@ -135368,7 +136408,7 @@ index 6a498da..19ed7eb 100644 NULL, key); if (IS_ERR(kn)) return PTR_ERR(kn); -@@ -3434,11 +3434,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts) +@@ -3437,11 +3437,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts) /* free copy for custom atomic_write_len, see init_cftypes() */ if (cft->max_write_len && cft->max_write_len != PAGE_SIZE) kfree(cft->kf_ops); @@ -135386,7 +136426,7 @@ index 6a498da..19ed7eb 100644 } } -@@ -3469,8 +3472,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) +@@ -3472,8 +3475,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) kf_ops->atomic_write_len = cft->max_write_len; } @@ -135399,7 +136439,7 @@ index 6a498da..19ed7eb 100644 } return 0; -@@ -3483,7 +3488,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts) +@@ -3486,7 +3491,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts) if (!cfts || !cfts[0].ss) return -ENOENT; @@ -135408,7 +136448,7 @@ index 6a498da..19ed7eb 100644 cgroup_apply_cftypes(cfts, false); cgroup_exit_cftypes(cfts); return 0; -@@ -3540,7 +3545,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) +@@ -3543,7 +3548,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) mutex_lock(&cgroup_mutex); @@ -135417,7 +136457,7 @@ index 6a498da..19ed7eb 100644 ret = cgroup_apply_cftypes(cfts, true); if (ret) cgroup_rm_cftypes_locked(cfts); -@@ -3561,8 +3566,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) +@@ -3564,8 +3569,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) { struct cftype *cft; @@ -135429,7 +136469,7 @@ index 6a498da..19ed7eb 100644 return cgroup_add_cftypes(ss, cfts); } -@@ -3578,8 +3585,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) +@@ -3581,8 +3588,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) { struct cftype *cft; @@ -135441,7 +136481,7 @@ index 6a498da..19ed7eb 100644 return cgroup_add_cftypes(ss, cfts); } -@@ -5722,6 +5731,9 @@ static void cgroup_release_agent(struct work_struct *work) +@@ -5725,6 +5734,9 @@ static void cgroup_release_agent(struct work_struct *work) if (!pathbuf || !agentbuf) goto out; @@ -135451,7 +136491,7 @@ index 6a498da..19ed7eb 100644 path = cgroup_path(cgrp, pathbuf, PATH_MAX); if (!path) goto out; -@@ -5984,7 +5996,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v) +@@ -5987,7 +5999,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v) struct task_struct *task; int count = 0; @@ -135870,7 +136910,7 @@ index 2a20c0d..3eb7d03 100644 #ifdef CONFIG_MODULE_UNLOAD { diff --git a/kernel/events/core.c b/kernel/events/core.c -index f0b4b32..390e9b9 100644 +index a0ef98b..c60fa0a 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -350,8 +350,15 @@ static struct srcu_struct pmus_srcu; @@ -135919,7 +136959,7 @@ index f0b4b32..390e9b9 100644 struct hrtimer *timer = &cpuctx->hrtimer; struct pmu *pmu = cpuctx->ctx.pmu; unsigned long flags; -@@ -2883,7 +2891,7 @@ void __perf_event_task_sched_in(struct task_struct *prev, +@@ -2893,7 +2901,7 @@ void __perf_event_task_sched_in(struct task_struct *prev, perf_pmu_sched_task(prev, task, true); } @@ -135928,7 +136968,7 @@ index f0b4b32..390e9b9 100644 { u64 frequency = event->attr.sample_freq; u64 sec = NSEC_PER_SEC; -@@ -3934,9 +3942,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) +@@ -3944,9 +3952,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) total += perf_event_count(event); *enabled += event->total_time_enabled + @@ -135940,7 +136980,7 @@ index f0b4b32..390e9b9 100644 list_for_each_entry(child, &event->child_list, child_list) { (void)perf_event_read(child, false); -@@ -3968,12 +3976,12 @@ static int __perf_read_group_add(struct perf_event *leader, +@@ -3978,12 +3986,12 @@ static int __perf_read_group_add(struct perf_event *leader, */ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] += leader->total_time_enabled + @@ -135955,7 +136995,7 @@ index f0b4b32..390e9b9 100644 } /* -@@ -4475,10 +4483,10 @@ void perf_event_update_userpage(struct perf_event *event) +@@ -4485,10 +4493,10 @@ void perf_event_update_userpage(struct perf_event *event) userpg->offset -= local64_read(&event->hw.prev_count); userpg->time_enabled = enabled + @@ -135968,7 +137008,7 @@ index f0b4b32..390e9b9 100644 arch_perf_update_userpage(event, userpg, now); -@@ -5153,7 +5161,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, +@@ -5163,7 +5171,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, /* Data. */ sp = perf_user_stack_pointer(regs); @@ -135977,7 +137017,7 @@ index f0b4b32..390e9b9 100644 dyn_size = dump_size - rem; perf_output_skip(handle, rem); -@@ -5244,11 +5252,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, +@@ -5254,11 +5262,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, values[n++] = perf_event_count(event); if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] = enabled + @@ -135991,7 +137031,7 @@ index f0b4b32..390e9b9 100644 } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); -@@ -7558,8 +7566,7 @@ perf_event_mux_interval_ms_store(struct device *dev, +@@ -7568,8 +7576,7 @@ perf_event_mux_interval_ms_store(struct device *dev, cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu); cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer); @@ -136001,7 +137041,7 @@ index f0b4b32..390e9b9 100644 } put_online_cpus(); mutex_unlock(&mux_interval_mutex); -@@ -7928,7 +7935,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, +@@ -7938,7 +7945,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, event->parent = parent_event; event->ns = get_pid_ns(task_active_pid_ns(current)); @@ -136010,7 +137050,7 @@ index f0b4b32..390e9b9 100644 event->state = PERF_EVENT_STATE_INACTIVE; -@@ -8290,6 +8297,11 @@ SYSCALL_DEFINE5(perf_event_open, +@@ -8300,6 +8307,11 @@ SYSCALL_DEFINE5(perf_event_open, if (flags & ~PERF_FLAG_ALL) return -EINVAL; @@ -136022,7 +137062,7 @@ index f0b4b32..390e9b9 100644 err = perf_copy_attr(attr_uptr, &attr); if (err) return err; -@@ -8777,10 +8789,10 @@ static void sync_child_event(struct perf_event *child_event, +@@ -8788,10 +8800,10 @@ static void sync_child_event(struct perf_event *child_event, /* * Add back the child's count to the parent's count: */ @@ -136730,7 +137770,7 @@ index 2e391c7..555531a 100644 int threads = max_threads; int min = MIN_THREADS; diff --git a/kernel/futex.c b/kernel/futex.c -index 5d6ce64..3124491 100644 +index 11b5021..fb30ef5 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -202,7 +202,7 @@ struct futex_pi_state { @@ -136772,7 +137812,7 @@ index 5d6ce64..3124491 100644 pagefault_disable(); ret = __copy_from_user_inatomic(dest, from, sizeof(u32)); -@@ -3135,6 +3140,7 @@ static void __init futex_detect_cmpxchg(void) +@@ -3154,6 +3159,7 @@ static void __init futex_detect_cmpxchg(void) { #ifndef CONFIG_HAVE_FUTEX_CMPXCHG u32 curval; @@ -136780,7 +137820,7 @@ index 5d6ce64..3124491 100644 /* * This will fail and we want it. Some arch implementations do -@@ -3146,8 +3152,11 @@ static void __init futex_detect_cmpxchg(void) +@@ -3165,8 +3171,11 @@ static void __init futex_detect_cmpxchg(void) * implementation, the non-functional ones will return * -ENOSYS. */ @@ -137506,7 +138546,7 @@ index 0551c21..f753f95 100644 debug_mutex_free_waiter(&waiter); mutex_release(&lock->dep_map, 1, ip); diff --git a/kernel/module.c b/kernel/module.c -index 794ebe8..74c285e 100644 +index 794ebe8..f81f123 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -59,6 +59,7 @@ @@ -138076,7 +139116,7 @@ index 794ebe8..74c285e 100644 return ERR_PTR(-ENOEXEC); } -@@ -2851,8 +2947,14 @@ static struct module *setup_load_info(struct load_info *info, int flags) +@@ -2851,8 +2947,16 @@ static struct module *setup_load_info(struct load_info *info, int flags) static int check_modinfo(struct module *mod, struct load_info *info, int flags) { const char *modmagic = get_modinfo(info, "vermagic"); @@ -138084,14 +139124,16 @@ index 794ebe8..74c285e 100644 int err; +#if defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR) || defined(CONFIG_PAX_RAP) -+ if (!license || !license_is_gpl_compatible(license)) ++ if (!license || !license_is_gpl_compatible(license)) { ++ pr_err("%s: module is not compatible with the KERNEXEC 'or' method and RAP\n", mod->name); + return -ENOEXEC; ++ } +#endif + if (flags & MODULE_INIT_IGNORE_VERMAGIC) modmagic = NULL; -@@ -2877,7 +2979,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags) +@@ -2877,7 +2981,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags) } /* Set up license info based on the info section */ @@ -138100,7 +139142,7 @@ index 794ebe8..74c285e 100644 return 0; } -@@ -2974,7 +3076,7 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2974,7 +3078,7 @@ static int move_module(struct module *mod, struct load_info *info) void *ptr; /* Do the allocs. */ @@ -138109,7 +139151,7 @@ index 794ebe8..74c285e 100644 /* * The pointer to this block is stored in the module structure * which is inside the block. Just mark it as not being a -@@ -2984,11 +3086,11 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2984,11 +3088,11 @@ static int move_module(struct module *mod, struct load_info *info) if (!ptr) return -ENOMEM; @@ -138125,7 +139167,7 @@ index 794ebe8..74c285e 100644 /* * The pointer to this block is stored in the module structure * which is inside the block. This block doesn't need to be -@@ -2997,13 +3099,45 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2997,13 +3101,45 @@ static int move_module(struct module *mod, struct load_info *info) */ kmemleak_ignore(ptr); if (!ptr) { @@ -138175,7 +139217,7 @@ index 794ebe8..74c285e 100644 /* Transfer each section which specifies SHF_ALLOC */ pr_debug("final section addresses:\n"); -@@ -3014,16 +3148,45 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -3014,16 +3150,45 @@ static int move_module(struct module *mod, struct load_info *info) if (!(shdr->sh_flags & SHF_ALLOC)) continue; @@ -138228,7 +139270,7 @@ index 794ebe8..74c285e 100644 pr_debug("\t0x%lx %s\n", (long)shdr->sh_addr, info->secstrings + shdr->sh_name); } -@@ -3080,12 +3243,12 @@ static void flush_module_icache(const struct module *mod) +@@ -3080,12 +3245,12 @@ static void flush_module_icache(const struct module *mod) * Do it before processing of module parameters, so the module * can provide parameter accessor functions of its own. */ @@ -138247,7 +139289,7 @@ index 794ebe8..74c285e 100644 set_fs(old_fs); } -@@ -3143,8 +3306,10 @@ static void module_deallocate(struct module *mod, struct load_info *info) +@@ -3143,8 +3308,10 @@ static void module_deallocate(struct module *mod, struct load_info *info) { percpu_modfree(mod); module_arch_freeing_init(mod); @@ -138260,7 +139302,7 @@ index 794ebe8..74c285e 100644 } int __weak module_finalize(const Elf_Ehdr *hdr, -@@ -3157,7 +3322,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, +@@ -3157,7 +3324,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, static int post_relocation(struct module *mod, const struct load_info *info) { /* Sort exception table now relocations are done. */ @@ -138270,7 +139312,7 @@ index 794ebe8..74c285e 100644 /* Copy relocated percpu area over. */ percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr, -@@ -3205,13 +3372,15 @@ static void do_mod_ctors(struct module *mod) +@@ -3205,13 +3374,15 @@ static void do_mod_ctors(struct module *mod) /* For freeing module_init on success, in case kallsyms traversing */ struct mod_initfree { struct rcu_head rcu; @@ -138288,7 +139330,7 @@ index 794ebe8..74c285e 100644 kfree(m); } -@@ -3231,7 +3400,8 @@ static noinline int do_init_module(struct module *mod) +@@ -3231,7 +3402,8 @@ static noinline int do_init_module(struct module *mod) ret = -ENOMEM; goto fail; } @@ -138298,7 +139340,7 @@ index 794ebe8..74c285e 100644 /* * We want to find out whether @mod uses async during init. Clear -@@ -3290,10 +3460,10 @@ static noinline int do_init_module(struct module *mod) +@@ -3290,10 +3462,10 @@ static noinline int do_init_module(struct module *mod) mod_tree_remove_init(mod); disable_ro_nx(&mod->init_layout); module_arch_freeing_init(mod); @@ -138313,7 +139355,7 @@ index 794ebe8..74c285e 100644 /* * We want to free module_init, but be aware that kallsyms may be * walking this with preempt disabled. In all the failure paths, we -@@ -3481,9 +3651,38 @@ static int load_module(struct load_info *info, const char __user *uargs, +@@ -3481,9 +3653,38 @@ static int load_module(struct load_info *info, const char __user *uargs, if (err) goto free_unload; @@ -138352,7 +139394,7 @@ index 794ebe8..74c285e 100644 /* Fix up syms, so that st_value is a pointer to location. */ err = simplify_symbols(mod, info); if (err < 0) -@@ -3499,13 +3698,6 @@ static int load_module(struct load_info *info, const char __user *uargs, +@@ -3499,13 +3700,6 @@ static int load_module(struct load_info *info, const char __user *uargs, flush_module_icache(mod); @@ -138366,7 +139408,7 @@ index 794ebe8..74c285e 100644 dynamic_debug_setup(info->debug, info->num_debug); /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */ -@@ -3557,11 +3749,10 @@ static int load_module(struct load_info *info, const char __user *uargs, +@@ -3557,11 +3751,10 @@ static int load_module(struct load_info *info, const char __user *uargs, ddebug_cleanup: dynamic_debug_remove(info->debug); synchronize_sched(); @@ -138379,7 +139421,7 @@ index 794ebe8..74c285e 100644 free_unload: module_unload_free(mod); unlink_mod: -@@ -3581,7 +3772,8 @@ static int load_module(struct load_info *info, const char __user *uargs, +@@ -3581,7 +3774,8 @@ static int load_module(struct load_info *info, const char __user *uargs, */ ftrace_release_mod(mod); /* Free lock-classes; relies on the preceding sync_rcu() */ @@ -138389,7 +139431,7 @@ index 794ebe8..74c285e 100644 module_deallocate(mod, info); free_copy: -@@ -3664,10 +3856,16 @@ static const char *get_ksymbol(struct module *mod, +@@ -3664,10 +3858,16 @@ static const char *get_ksymbol(struct module *mod, struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms); /* At worse, next value is at end of module */ @@ -138409,7 +139451,7 @@ index 794ebe8..74c285e 100644 /* Scan for closest preceding symbol, and next symbol. (ELF starts real symbols at 1). */ -@@ -3920,7 +4118,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3920,7 +4120,7 @@ static int m_show(struct seq_file *m, void *p) return 0; seq_printf(m, "%s %u", @@ -138418,7 +139460,7 @@ index 794ebe8..74c285e 100644 print_unload_info(m, mod); /* Informative for users. */ -@@ -3929,7 +4127,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3929,7 +4129,7 @@ static int m_show(struct seq_file *m, void *p) mod->state == MODULE_STATE_COMING ? "Loading" : "Live"); /* Used by oprofile and other similar tools. */ @@ -138427,7 +139469,7 @@ index 794ebe8..74c285e 100644 /* Taints info */ if (mod->taints) -@@ -3965,7 +4163,17 @@ static const struct file_operations proc_modules_operations = { +@@ -3965,7 +4165,17 @@ static const struct file_operations proc_modules_operations = { static int __init proc_modules_init(void) { @@ -138445,7 +139487,7 @@ index 794ebe8..74c285e 100644 return 0; } module_init(proc_modules_init); -@@ -4026,7 +4234,8 @@ struct module *__module_address(unsigned long addr) +@@ -4026,7 +4236,8 @@ struct module *__module_address(unsigned long addr) { struct module *mod; @@ -138455,7 +139497,7 @@ index 794ebe8..74c285e 100644 return NULL; module_assert_mutex_or_preempt(); -@@ -4069,11 +4278,21 @@ bool is_module_text_address(unsigned long addr) +@@ -4069,11 +4280,21 @@ bool is_module_text_address(unsigned long addr) */ struct module *__module_text_address(unsigned long addr) { @@ -139566,7 +140608,7 @@ index a5d966c..9c2d28b 100644 #ifdef CONFIG_RT_GROUP_SCHED /* diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index a74073f8..757e116 100644 +index 1c1d2a0..a8b297a 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2263,7 +2263,7 @@ void set_numabalancing_state(bool enabled) @@ -142007,46 +143049,10 @@ index 9acb29f..6fe517c 100644 .thread_should_run = watchdog_should_run, .thread_fn = watchdog, diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 7ff5dc7..72c5756 100644 +index 9e82d04..72c5756 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c -@@ -667,6 +667,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work, - */ - smp_wmb(); - set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0); -+ /* -+ * The following mb guarantees that previous clear of a PENDING bit -+ * will not be reordered with any speculative LOADS or STORES from -+ * work->current_func, which is executed afterwards. This possible -+ * reordering can lead to a missed execution on attempt to qeueue -+ * the same @work. E.g. consider this case: -+ * -+ * CPU#0 CPU#1 -+ * ---------------------------- -------------------------------- -+ * -+ * 1 STORE event_indicated -+ * 2 queue_work_on() { -+ * 3 test_and_set_bit(PENDING) -+ * 4 } set_..._and_clear_pending() { -+ * 5 set_work_data() # clear bit -+ * 6 smp_mb() -+ * 7 work->current_func() { -+ * 8 LOAD event_indicated -+ * } -+ * -+ * Without an explicit full barrier speculative LOAD on line 8 can -+ * be executed before CPU#0 does STORE on line 1. If that happens, -+ * CPU#0 observes the PENDING bit is still set and new execution of -+ * a @work is not queued in a hope, that CPU#1 will eventually -+ * finish the queued @work. Meanwhile CPU#1 does not see -+ * event_indicated is set, because speculative LOAD was executed -+ * before actual STORE. -+ */ -+ smp_mb(); - } - - static void clear_work_data(struct work_struct *work) -@@ -1921,9 +1950,8 @@ static void pool_mayday_timeout(unsigned long __pool) +@@ -1950,9 +1950,8 @@ static void pool_mayday_timeout(unsigned long __pool) * multiple times. Does GFP_KERNEL allocations. Called only from * manager. */ @@ -142057,7 +143063,7 @@ index 7ff5dc7..72c5756 100644 { restart: spin_unlock_irq(&pool->lock); -@@ -2013,9 +2041,8 @@ static bool manage_workers(struct worker *worker) +@@ -2042,9 +2041,8 @@ static bool manage_workers(struct worker *worker) * CONTEXT: * spin_lock_irq(pool->lock) which is released and regrabbed. */ @@ -142068,7 +143074,7 @@ index 7ff5dc7..72c5756 100644 { struct pool_workqueue *pwq = get_work_pwq(work); struct worker_pool *pool = worker->pool; -@@ -4561,7 +4588,7 @@ static void rebind_workers(struct worker_pool *pool) +@@ -4590,7 +4588,7 @@ static void rebind_workers(struct worker_pool *pool) WARN_ON_ONCE(!(worker_flags & WORKER_UNBOUND)); worker_flags |= WORKER_REBOUND; worker_flags &= ~WORKER_UNBOUND; @@ -143171,6 +144177,19 @@ index f05b2d5..0d6e01f 100644 {VM_ACCOUNT, "account" }, {VM_NORESERVE, "noreserve" }, {VM_HUGETLB, "hugetlb" }, +diff --git a/mm/fadvise.c b/mm/fadvise.c +index b8a5bc6..bf65b8c 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -154,7 +154,7 @@ out: + + #ifdef __ARCH_WANT_SYS_FADVISE64 + +-SYSCALL_DEFINE4(fadvise64, int, fd, loff_t, offset, size_t, len, int, advice) ++SYSCALL_DEFINE4(fadvise64, int, fd, loff_t, offset, loff_t, len, int, advice) + { + return sys_fadvise64_64(fd, offset, len, advice); + } diff --git a/mm/filemap.c b/mm/filemap.c index da7a35d..d10518d 100644 --- a/mm/filemap.c @@ -143784,10 +144803,10 @@ index f56825b..f86f118 100644 if (end == start) return error; diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index caf3bf7..162b323 100644 +index a65ad1d..0a39040 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c -@@ -748,7 +748,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page) +@@ -749,7 +749,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page) mem_cgroup_update_tree(memcg, page); #if MAX_NUMNODES > 1 if (unlikely(do_numainfo)) @@ -143796,7 +144815,7 @@ index caf3bf7..162b323 100644 #endif } } -@@ -1381,7 +1381,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg) +@@ -1382,7 +1382,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg) * numainfo_events > 0 means there was at least NUMAINFO_EVENTS_TARGET * pagein/pageout changes since the last update. */ @@ -143805,7 +144824,7 @@ index caf3bf7..162b323 100644 return; if (atomic_inc_return(&memcg->numainfo_updating) > 1) return; -@@ -1395,7 +1395,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg) +@@ -1396,7 +1396,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg) node_clear(nid, memcg->scan_nodes); } @@ -143846,7 +144865,7 @@ index ac595e7..78fa945 100644 /* * free pages are specially detected outside this table: diff --git a/mm/memory.c b/mm/memory.c -index 8132787..64b99d0 100644 +index 3345dcf..291e077 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -416,6 +416,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud, @@ -143891,7 +144910,7 @@ index 8132787..64b99d0 100644 vma->vm_file, vma->vm_ops ? vma->vm_ops->fault : NULL, vma->vm_file ? vma->vm_file->f_op->mmap : NULL, -@@ -1448,6 +1453,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr, +@@ -1488,6 +1493,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr, page_add_file_rmap(page); set_pte_at(mm, addr, pte, mk_pte(page, prot)); @@ -143902,7 +144921,7 @@ index 8132787..64b99d0 100644 retval = 0; pte_unmap_unlock(pte, ptl); return retval; -@@ -1492,9 +1501,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, +@@ -1532,9 +1541,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, if (!page_count(page)) return -EINVAL; if (!(vma->vm_flags & VM_MIXEDMAP)) { @@ -143924,7 +144943,7 @@ index 8132787..64b99d0 100644 } return insert_page(vma, addr, page, vma->vm_page_prot); } -@@ -1580,6 +1601,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr, +@@ -1620,6 +1641,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr, pfn_t pfn) { BUG_ON(!(vma->vm_flags & VM_MIXEDMAP)); @@ -143932,7 +144951,7 @@ index 8132787..64b99d0 100644 if (addr < vma->vm_start || addr >= vma->vm_end) return -EFAULT; -@@ -1832,7 +1854,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud, +@@ -1872,7 +1894,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud, BUG_ON(pud_huge(*pud)); @@ -143943,7 +144962,7 @@ index 8132787..64b99d0 100644 if (!pmd) return -ENOMEM; do { -@@ -1852,7 +1876,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd, +@@ -1892,7 +1916,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd, unsigned long next; int err; @@ -143954,7 +144973,7 @@ index 8132787..64b99d0 100644 if (!pud) return -ENOMEM; do { -@@ -2048,6 +2074,196 @@ static inline int wp_page_reuse(struct mm_struct *mm, +@@ -2088,6 +2114,196 @@ static inline int wp_page_reuse(struct mm_struct *mm, return VM_FAULT_WRITE; } @@ -144151,7 +145170,7 @@ index 8132787..64b99d0 100644 /* * Handle the case of a page which we actually need to copy to a new page. * -@@ -2102,6 +2318,12 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2142,6 +2358,12 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma, */ page_table = pte_offset_map_lock(mm, pmd, address, &ptl); if (likely(pte_same(*page_table, orig_pte))) { @@ -144164,7 +145183,7 @@ index 8132787..64b99d0 100644 if (old_page) { if (!PageAnon(old_page)) { dec_mm_counter_fast(mm, -@@ -2157,6 +2379,10 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2197,6 +2419,10 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma, page_remove_rmap(old_page, false); } @@ -144175,7 +145194,7 @@ index 8132787..64b99d0 100644 /* Free the old page.. */ new_page = old_page; page_copied = 1; -@@ -2585,6 +2811,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2625,6 +2851,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, if (mem_cgroup_swap_full(page) || (vma->vm_flags & VM_LOCKED) || PageMlocked(page)) try_to_free_swap(page); @@ -144187,7 +145206,7 @@ index 8132787..64b99d0 100644 unlock_page(page); if (page != swapcache) { /* -@@ -2608,6 +2839,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2648,6 +2879,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, address, page_table); @@ -144199,7 +145218,7 @@ index 8132787..64b99d0 100644 unlock: pte_unmap_unlock(page_table, ptl); out: -@@ -2627,40 +2863,6 @@ out_release: +@@ -2667,40 +2903,6 @@ out_release: } /* @@ -144240,7 +145259,7 @@ index 8132787..64b99d0 100644 * We enter with non-exclusive mmap_sem (to exclude vma changes, * but allow concurrent faults), and pte mapped but not yet locked. * We return with mmap_sem still held, but pte unmapped and unlocked. -@@ -2670,25 +2872,22 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2710,25 +2912,22 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, unsigned int flags) { struct mem_cgroup *memcg; @@ -144272,7 +145291,7 @@ index 8132787..64b99d0 100644 if (!pte_none(*page_table)) goto unlock; /* Deliver the page fault to userland, check inside PT lock */ -@@ -2701,6 +2900,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2741,6 +2940,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, } /* Allocate our own private page. */ @@ -144281,7 +145300,7 @@ index 8132787..64b99d0 100644 if (unlikely(anon_vma_prepare(vma))) goto oom; page = alloc_zeroed_user_highpage_movable(vma, address); -@@ -2734,6 +2935,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2774,6 +2975,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, VM_UFFD_MISSING); } @@ -144293,7 +145312,7 @@ index 8132787..64b99d0 100644 inc_mm_counter_fast(mm, MM_ANONPAGES); page_add_new_anon_rmap(page, vma, address, false); mem_cgroup_commit_charge(page, memcg, false, false); -@@ -2743,6 +2949,12 @@ setpte: +@@ -2783,6 +2989,12 @@ setpte: /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, address, page_table); @@ -144306,7 +145325,7 @@ index 8132787..64b99d0 100644 unlock: pte_unmap_unlock(page_table, ptl); return 0; -@@ -2977,6 +3189,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3017,6 +3229,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma, return ret; } do_set_pte(vma, address, fault_page, pte, false, false); @@ -144318,7 +145337,7 @@ index 8132787..64b99d0 100644 unlock_page(fault_page); unlock_out: pte_unmap_unlock(pte, ptl); -@@ -3028,7 +3245,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3068,7 +3285,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma, } goto uncharge_out; } @@ -144337,7 +145356,7 @@ index 8132787..64b99d0 100644 mem_cgroup_commit_charge(new_page, memcg, false, false); lru_cache_add_active_or_unevictable(new_page, vma); pte_unmap_unlock(pte, ptl); -@@ -3086,6 +3314,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3126,6 +3354,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, return ret; } do_set_pte(vma, address, fault_page, pte, true, false); @@ -144349,7 +145368,7 @@ index 8132787..64b99d0 100644 pte_unmap_unlock(pte, ptl); if (set_page_dirty(fault_page)) -@@ -3338,6 +3571,12 @@ static int handle_pte_fault(struct mm_struct *mm, +@@ -3378,6 +3611,12 @@ static int handle_pte_fault(struct mm_struct *mm, if (flags & FAULT_FLAG_WRITE) flush_tlb_fix_spurious_fault(vma, address); } @@ -144362,7 +145381,7 @@ index 8132787..64b99d0 100644 unlock: pte_unmap_unlock(pte, ptl); return 0; -@@ -3357,9 +3596,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3397,9 +3636,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, pmd_t *pmd; pte_t *pte; @@ -144404,7 +145423,7 @@ index 8132787..64b99d0 100644 pgd = pgd_offset(mm, address); pud = pud_alloc(mm, pgd, address); if (!pud) -@@ -3493,6 +3764,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) +@@ -3533,6 +3804,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -144428,7 +145447,7 @@ index 8132787..64b99d0 100644 #endif /* __PAGETABLE_PUD_FOLDED */ #ifndef __PAGETABLE_PMD_FOLDED -@@ -3525,6 +3813,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) +@@ -3565,6 +3853,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -144461,7 +145480,7 @@ index 8132787..64b99d0 100644 #endif /* __PAGETABLE_PMD_FOLDED */ static int __follow_pte(struct mm_struct *mm, unsigned long address, -@@ -3634,8 +3948,8 @@ out: +@@ -3674,8 +3988,8 @@ out: return ret; } @@ -144472,7 +145491,7 @@ index 8132787..64b99d0 100644 { resource_size_t phys_addr; unsigned long prot = 0; -@@ -3661,8 +3975,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys); +@@ -3701,8 +4015,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys); * Access another process' address space as given in mm. If non-NULL, use the * given task for page fault accounting. */ @@ -144483,7 +145502,7 @@ index 8132787..64b99d0 100644 { struct vm_area_struct *vma; void *old_buf = buf; -@@ -3670,7 +3984,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, +@@ -3710,7 +4024,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, down_read(&mm->mmap_sem); /* ignore errors, just check how much was successfully transferred */ while (len) { @@ -144492,7 +145511,7 @@ index 8132787..64b99d0 100644 void *maddr; struct page *page = NULL; -@@ -3731,8 +4045,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, +@@ -3771,8 +4085,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, * * The caller must hold a reference on @mm. */ @@ -144503,7 +145522,7 @@ index 8132787..64b99d0 100644 { return __access_remote_vm(NULL, mm, addr, buf, len, write); } -@@ -3742,11 +4056,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr, +@@ -3782,11 +4096,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr, * Source/target buffer must be kernel space, * Do not walk the page table directly, use get_user_pages */ @@ -144595,10 +145614,10 @@ index 9a3f6b9..b9af66c 100644 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE); diff --git a/mm/migrate.c b/mm/migrate.c -index 3ad0fea..2b361a1 100644 +index 625741f..ed2d240 100644 --- a/mm/migrate.c +++ b/mm/migrate.c -@@ -1509,8 +1509,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, +@@ -1515,8 +1515,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, */ tcred = __task_cred(task); if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) && @@ -146749,7 +147768,7 @@ index 79f3bf0..92c8a7e 100644 /* diff --git a/mm/shmem.c b/mm/shmem.c -index 440e2a7..8aeebaa 100644 +index 440e2a7..9091191 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -33,7 +33,7 @@ @@ -146770,7 +147789,7 @@ index 440e2a7..8aeebaa 100644 /* * shmem_fallocate communicates with shmem_fault or shmem_writepage via -@@ -2670,6 +2670,25 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler, +@@ -2670,6 +2670,23 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler, return simple_xattr_set(&info->xattrs, name, value, size, flags); } @@ -146781,12 +147800,10 @@ index 440e2a7..8aeebaa 100644 +{ + struct shmem_inode_info *info = SHMEM_I(d_inode(dentry)); + -+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS + if (strcmp(name, XATTR_NAME_PAX_FLAGS)) + return -EOPNOTSUPP; + if (size > 8) + return -EINVAL; -+#endif + + name = xattr_full_name(handler, name); + return simple_xattr_set(&info->xattrs, name, value, size, flags); @@ -146796,7 +147813,7 @@ index 440e2a7..8aeebaa 100644 static const struct xattr_handler shmem_security_xattr_handler = { .prefix = XATTR_SECURITY_PREFIX, .get = shmem_xattr_handler_get, -@@ -2682,6 +2701,14 @@ static const struct xattr_handler shmem_trusted_xattr_handler = { +@@ -2682,6 +2699,14 @@ static const struct xattr_handler shmem_trusted_xattr_handler = { .set = shmem_xattr_handler_set, }; @@ -146811,7 +147828,7 @@ index 440e2a7..8aeebaa 100644 static const struct xattr_handler *shmem_xattr_handlers[] = { #ifdef CONFIG_TMPFS_POSIX_ACL &posix_acl_access_xattr_handler, -@@ -2689,6 +2716,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { +@@ -2689,6 +2714,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { #endif &shmem_security_xattr_handler, &shmem_trusted_xattr_handler, @@ -146823,7 +147840,7 @@ index 440e2a7..8aeebaa 100644 NULL }; -@@ -3051,8 +3083,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) +@@ -3051,8 +3081,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) int err = -ENOMEM; /* Round up to L1_CACHE_BYTES to resist false sharing */ @@ -147750,7 +148767,7 @@ index 5ec1580..017a002 100644 EXPORT_SYMBOL(kmem_cache_free); diff --git a/mm/slub.c b/mm/slub.c -index d8fbd4a..f864712 100644 +index 2a722e1..1e5e2f8 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -34,6 +34,7 @@ @@ -154874,7 +155891,7 @@ index 85ca189..871f064 100644 if (!todrop_rate[i]) return 0; diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index f57b4dc..8cba121 100644 +index f57b4dc..8cba1213 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -611,7 +611,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, @@ -155652,7 +156669,7 @@ index 11de55e..f25e448 100644 return 0; } diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index f1ffb34..4e5a217 100644 +index d2bc03f..a95bb86 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -287,7 +287,7 @@ static void netlink_overrun(struct sock *sk) @@ -157246,7 +158263,7 @@ index 1095be9..815d777 100644 /* make a copy for the caller */ *handle = ctxh; diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 273bc3a..1a4b204 100644 +index 008c25d..b2bb1df7 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -1623,7 +1623,7 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) @@ -157694,7 +158711,7 @@ index c8b8a8b..75b302c 100644 /* Build up the XDR from the receive buffers. */ rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len); diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c -index df57f3c..5febb1e 100644 +index df57f3ce..5febb1e 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c +++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c @@ -291,7 +291,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp, @@ -159738,10 +160755,10 @@ index 23ba1c6..cad2484 100755 # Find all available archs find_all_archs() diff --git a/security/Kconfig b/security/Kconfig -index e452378..51e3107 100644 +index e452378..4388a35 100644 --- a/security/Kconfig +++ b/security/Kconfig -@@ -4,6 +4,987 @@ +@@ -4,6 +4,989 @@ menu "Security options" @@ -160705,13 +161722,15 @@ index e452378..51e3107 100644 + +config PAX_RAP + bool "Prevent code reuse attacks" -+ depends on X86_64 && !PARAVIRT ++ depends on X86_64 + default y if GRKERNSEC_CONFIG_AUTO + help + By saying Y here the kernel will check indirect control transfers + in order to detect and prevent attacks that try to hijack control + flow by overwriting code pointers. + ++ Note that binary modules cannot be instrumented by this approach. ++ + Note that the implementation requires a gcc with plugin support, + i.e., gcc 4.5 or newer. You may need to install the supporting + headers explicitly in addition to the normal gcc package. @@ -160729,7 +161748,7 @@ index e452378..51e3107 100644 source security/keys/Kconfig config SECURITY_DMESG_RESTRICT -@@ -104,7 +1085,7 @@ config INTEL_TXT +@@ -104,7 +1087,7 @@ config INTEL_TXT config LSM_MMAP_MIN_ADDR int "Low address space for LSM to protect from user allocation" depends on SECURITY && SECURITY_SELINUX @@ -167209,15 +168228,20 @@ index 0000000..50d373c +} diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c new file mode 100644 -index 0000000..c77d26d +index 0000000..a716d7a --- /dev/null +++ b/tools/gcc/randomize_layout_plugin.c -@@ -0,0 +1,935 @@ +@@ -0,0 +1,940 @@ +/* -+ * Copyright 2014,2015 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net> ++ * Copyright 2014-2016 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net> + * and PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 + * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * + * Usage: + * $ # for 4.5/4.6/C based 4.7 + * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o randomize_layout_plugin.so randomize_layout_plugin.c @@ -168815,10 +169839,10 @@ index 0000000..ebdcf7c +} diff --git a/tools/gcc/rap_plugin/rap_plugin.c b/tools/gcc/rap_plugin/rap_plugin.c new file mode 100644 -index 0000000..c5827cb +index 0000000..a6d423f --- /dev/null +++ b/tools/gcc/rap_plugin/rap_plugin.c -@@ -0,0 +1,479 @@ +@@ -0,0 +1,480 @@ +/* + * Copyright 2012-2016 by PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -169060,6 +170084,7 @@ index 0000000..c5827cb + ASM_OUTPUT_LABEL(asm_out_file, name); + free(name); + } ++ + if (hash.hash) + fprintf(asm_out_file, "\t.previous\n"); +} @@ -182000,12 +183025,12 @@ index 0000000..be9724d +exit 0 diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c new file mode 100644 -index 0000000..5aabc22 +index 0000000..ee987da --- /dev/null +++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c @@ -0,0 +1,369 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -182375,12 +183400,12 @@ index 0000000..5aabc22 +#include "gcc-generate-gimple-pass.h" diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c new file mode 100644 -index 0000000..9f9bcd6 +index 0000000..b12cef3 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c -@@ -0,0 +1,1118 @@ +@@ -0,0 +1,1166 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -182973,7 +183998,7 @@ index 0000000..9f9bcd6 + return get_lhs(assign); +} + -+tree handle_intentional_overflow(struct visited *visited, interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2) ++tree handle_intentional_overflow(interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2) +{ + tree new_rhs, orig_rhs; + void (*gimple_assign_set_rhs)(gimple, tree); @@ -182982,10 +184007,10 @@ index 0000000..9f9bcd6 + tree lhs = gimple_assign_lhs(stmt); + + if (!check_overflow) -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + + if (change_rhs == NULL_TREE) -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + + if (new_rhs2 == NULL_TREE) { + orig_rhs = rhs1; @@ -182997,11 +184022,11 @@ index 0000000..9f9bcd6 + + check_size_overflow(expand_from, stmt, TREE_TYPE(change_rhs), change_rhs, orig_rhs, BEFORE_STMT); + -+ new_rhs = change_assign_rhs(visited, stmt, orig_rhs, change_rhs); ++ new_rhs = change_assign_rhs(expand_from->visited, stmt, orig_rhs, change_rhs); + gimple_assign_set_rhs(stmt, new_rhs); + update_stmt(stmt); + -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); +} + +static bool is_subtraction_special(struct visited *visited, const gassign *stmt) @@ -183107,7 +184132,7 @@ index 0000000..9f9bcd6 + } +} + -+tree handle_integer_truncation(struct visited *visited, interesting_stmts_t expand_from, const_tree lhs) ++tree handle_integer_truncation(interesting_stmts_t expand_from, const_tree lhs) +{ + tree new_rhs1, new_rhs2; + tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs; @@ -183115,28 +184140,28 @@ index 0000000..9f9bcd6 + tree rhs1 = gimple_assign_rhs1(stmt); + tree rhs2 = gimple_assign_rhs2(stmt); + -+ if (!is_subtraction_special(visited, stmt)) ++ if (!is_subtraction_special(expand_from->visited, stmt)) + return NULL_TREE; + -+ new_rhs1 = expand(visited, expand_from, rhs1); -+ new_rhs2 = expand(visited, expand_from, rhs2); ++ new_rhs1 = expand(expand_from, rhs1); ++ new_rhs2 = expand(expand_from, rhs2); + -+ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs1); -+ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs2); ++ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(expand_from->visited, new_rhs1); ++ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(expand_from->visited, new_rhs2); + + if (new_rhs1_def_stmt_rhs1 == NULL_TREE || new_rhs2_def_stmt_rhs1 == NULL_TREE) + return NULL_TREE; + + if (!types_compatible_p(TREE_TYPE(new_rhs1_def_stmt_rhs1), TREE_TYPE(new_rhs2_def_stmt_rhs1))) { -+ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs1_def_stmt_rhs1); -+ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs2_def_stmt_rhs1); ++ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(expand_from->visited, stmt, new_rhs1_def_stmt_rhs1); ++ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(expand_from->visited, stmt, new_rhs2_def_stmt_rhs1); + } + -+ assign = create_binary_assign(visited, MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1); ++ assign = create_binary_assign(expand_from->visited, MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1); + new_lhs = gimple_assign_lhs(assign); + check_size_overflow(expand_from, assign, TREE_TYPE(new_lhs), new_lhs, rhs1, AFTER_STMT); + -+ return dup_assign(visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); +} + +bool is_a_neg_overflow(const gassign *stmt, const_tree rhs) @@ -183497,14 +184522,62 @@ index 0000000..9f9bcd6 + // _51 = _50 * gt signed type max; + return is_mult_const(rhs1) || is_mult_const(rhs2); +} ++ ++/* True: ++ * drivers/net/ethernet/via/via-velocity.c velocity_rx_refill() ++ * u16 = cpu_to_le16(s32) | const ++ * rd->size = cpu_to_le16(vptr->rx.buf_sz) | RX_INTEN; ++ * ++ * _36 = (signed short) _35; ++ * _37 = _36 | -32768; ++ * _38 = (short unsigned int) _37; ++ */ ++ ++bool short_or_neg_const_ushort(gassign *stmt) ++{ ++ const_tree rhs, lhs_type, rhs_type; ++ const_tree def_rhs1, def_rhs2; ++ const_gimple def_stmt; ++ gimple def_def_stmt = NULL; ++ ++ if (!gimple_assign_cast_p(stmt)) ++ return false; ++ ++ // _38 = (short unsigned int) _37; ++ lhs_type = TREE_TYPE(gimple_assign_lhs(stmt)); ++ if (!TYPE_UNSIGNED(lhs_type)) ++ return false; ++ if (TYPE_MODE(lhs_type) != HImode) ++ return false; ++ rhs = gimple_assign_rhs1(stmt); ++ rhs_type = TREE_TYPE(rhs); ++ if (TYPE_UNSIGNED(rhs_type)) ++ return false; ++ if (TYPE_MODE(rhs_type) != HImode) ++ return false; ++ ++ // _37 = _36 | -32768; ++ def_stmt = get_def_stmt(rhs); ++ if (!def_stmt || gimple_assign_rhs_code(def_stmt) != BIT_IOR_EXPR) ++ return false; ++ def_rhs1 = gimple_assign_rhs1(def_stmt); ++ def_rhs2 = gimple_assign_rhs2(def_stmt); ++ if (is_gimple_constant(def_rhs1) && !is_gt_zero(def_rhs1)) ++ def_def_stmt = get_def_stmt(def_rhs2); ++ else if (is_gimple_constant(def_rhs2) && !is_gt_zero(def_rhs2)) ++ def_def_stmt = get_def_stmt(def_rhs1); ++ ++ // _36 = (signed short) _35; ++ return def_def_stmt && gimple_assign_cast_p(def_def_stmt); ++} diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c new file mode 100644 -index 0000000..5622b51 +index 0000000..c910983 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c @@ -0,0 +1,137 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -183642,10 +184715,10 @@ index 0000000..5622b51 + diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h new file mode 100644 -index 0000000..b7f66f7 +index 0000000..4bd2e7f --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow.h -@@ -0,0 +1,329 @@ +@@ -0,0 +1,331 @@ +#ifndef SIZE_OVERFLOW_H +#define SIZE_OVERFLOW_H + @@ -183844,14 +184917,15 @@ index 0000000..b7f66f7 +extern bool is_a_cast_and_const_overflow(const_tree no_const_rhs); +extern bool is_const_plus_unsigned_signed_truncation(const_tree lhs); +extern bool is_a_constant_overflow(const gassign *stmt, const_tree rhs); -+extern tree handle_intentional_overflow(struct visited *visited, interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2); -+extern tree handle_integer_truncation(struct visited *visited, interesting_stmts_t expand_from, const_tree lhs); ++extern tree handle_intentional_overflow(interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2); ++extern tree handle_integer_truncation(interesting_stmts_t expand_from, const_tree lhs); +extern bool is_a_neg_overflow(const gassign *stmt, const_tree rhs); +extern enum intentional_overflow_type add_mul_intentional_overflow(const gassign *stmt); +extern void unsigned_signed_cast_intentional_overflow(struct visited *visited, gassign *stmt); +extern bool neg_short_add_intentional_overflow(gassign *stmt); +extern bool is_bitfield_unnamed_cast(const_tree decl, gassign *assign); +extern bool uconst_neg_intentional_overflow(const gassign *stmt); ++extern bool short_or_neg_const_ushort(gassign *stmt); + + +// insert_size_overflow_asm.c @@ -183894,6 +184968,7 @@ index 0000000..b7f66f7 + gimple first_stmt; + tree orig_node; + unsigned int num; ++ struct visited *visited; +}; + +extern unsigned int size_overflow_function_transform(struct cgraph_node *node); @@ -183903,7 +184978,7 @@ index 0000000..b7f66f7 +// size_overflow_transform_core.c +extern tree cast_to_new_size_overflow_type(struct visited *visited, gimple stmt, tree rhs, tree size_overflow_type, bool before); +extern tree get_size_overflow_type(struct visited *visited, const_gimple stmt, const_tree node); -+extern tree expand(struct visited *visited, interesting_stmts_t expand_from, tree lhs); ++extern tree expand(interesting_stmts_t expand_from, tree lhs); +extern void check_size_overflow(interesting_stmts_t expand_from, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before); +extern tree dup_assign(struct visited *visited, gassign *oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3); +extern tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before); @@ -183977,12 +185052,12 @@ index 0000000..b7f66f7 +#endif diff --git a/tools/gcc/size_overflow_plugin/size_overflow_debug.c b/tools/gcc/size_overflow_plugin/size_overflow_debug.c new file mode 100644 -index 0000000..fc58e16 +index 0000000..4098952 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_debug.c @@ -0,0 +1,194 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -205929,12 +207004,12 @@ index 0000000..17bc0d8 +enable_so_zpios_read_fndecl_64734 zpios_read fndecl 3 64734 NULL diff --git a/tools/gcc/size_overflow_plugin/size_overflow_ipa.c b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c new file mode 100644 -index 0000000..758edea +index 0000000..0a679f8 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c @@ -0,0 +1,1163 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -207098,12 +208173,12 @@ index 0000000..758edea +#include "gcc-generate-ipa-pass.h" diff --git a/tools/gcc/size_overflow_plugin/size_overflow_misc.c b/tools/gcc/size_overflow_plugin/size_overflow_misc.c new file mode 100644 -index 0000000..a44ea14 +index 0000000..7f459ed --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_misc.c @@ -0,0 +1,505 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -207609,7 +208684,7 @@ index 0000000..a44ea14 + diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c new file mode 100644 -index 0000000..21e7d5c +index 0000000..9fc86df --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c @@ -0,0 +1,290 @@ @@ -207644,7 +208719,7 @@ index 0000000..21e7d5c +tree size_overflow_type_TI; + +static struct plugin_info size_overflow_plugin_info = { -+ .version = "20160306", ++ .version = "20160502", + .help = "no-size-overflow\tturn off size overflow checking\n", +}; + @@ -207905,12 +208980,12 @@ index 0000000..21e7d5c +} diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c new file mode 100644 -index 0000000..4ac5098 +index 0000000..87af656 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c @@ -0,0 +1,352 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -208263,12 +209338,12 @@ index 0000000..4ac5098 + diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform.c b/tools/gcc/size_overflow_plugin/size_overflow_transform.c new file mode 100644 -index 0000000..c958d66 +index 0000000..eebcf4c --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_transform.c -@@ -0,0 +1,745 @@ +@@ -0,0 +1,743 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -208524,24 +209599,23 @@ index 0000000..c958d66 + return search_interesting_stmt(head, next_node_ret, ret, first_node, 0); +} + -+static void handle_binary_assign(struct visited *visited, interesting_stmts_t expand_from, gassign *assign, tree rhs) ++static void handle_binary_assign(interesting_stmts_t expand_from, gassign *assign, tree rhs) +{ + tree new_node; + gimple def_orig_node; + -+ new_node = expand(visited, expand_from, rhs); ++ new_node = expand(expand_from, rhs); + if (new_node == NULL_TREE) + return; + + def_orig_node = get_def_stmt(rhs); -+ change_orig_node(visited, assign, rhs, new_node, 0); -+ -+ if (pointer_set_contains(visited->no_cast_check, def_orig_node)) ++ if (pointer_set_contains(expand_from->visited->no_cast_check, def_orig_node)) + return; ++ change_orig_node(expand_from->visited, assign, rhs, new_node, 0); + check_size_overflow(expand_from, assign, TREE_TYPE(new_node), new_node, rhs, BEFORE_STMT); +} + -+static bool search_error_codes(struct visited *visited, gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code) ++static bool search_error_codes(gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code) +{ + gimple def_stmt; + @@ -208567,7 +209641,7 @@ index 0000000..c958d66 + + switch (gimple_num_ops(assign)) { + case 2: -+ return search_error_codes(visited, visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code); ++ return search_error_codes(visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code); + case 3: + if (!error_code) + return error_code; @@ -208577,9 +209651,9 @@ index 0000000..c958d66 + * before the error code PHI. + */ + rhs1 = gimple_assign_rhs1(assign); -+ handle_binary_assign(visited, expand_from, assign, rhs1); ++ handle_binary_assign(expand_from, assign, rhs1); + rhs2 = gimple_assign_rhs2(assign); -+ handle_binary_assign(visited, expand_from, assign, rhs2); ++ handle_binary_assign(expand_from, assign, rhs2); + return error_code; + } + gcc_unreachable(); @@ -208589,7 +209663,7 @@ index 0000000..c958d66 + + error_code = has_error_code(as_a_gphi(def_stmt)); + for (i = 0; i < gimple_phi_num_args(def_stmt); i++) { -+ error_code = search_error_codes(visited, visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code); ++ error_code = search_error_codes(visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code); + } + return error_code; + } @@ -208600,7 +209674,7 @@ index 0000000..c958d66 + } +} + -+static bool handle_error_codes(struct visited *visited, interesting_stmts_t expand_from) ++static bool handle_error_codes(interesting_stmts_t expand_from) +{ + bool error_code; + gimple_set *visited_error_codes; @@ -208610,7 +209684,7 @@ index 0000000..c958d66 + return false; + + visited_error_codes = pointer_set_create(); -+ error_code = search_error_codes(visited, visited_error_codes, expand_from, expand_from->orig_node, false); ++ error_code = search_error_codes(visited_error_codes, expand_from, expand_from->orig_node, false); + pointer_set_destroy(visited_error_codes); + + return error_code; @@ -208624,19 +209698,18 @@ index 0000000..c958d66 + tree new_node; + gimple orig_def_stmt; + -+ if (handle_error_codes(visited, cur)) ++ cur->visited = visited; ++ if (handle_error_codes(cur)) + continue; + -+ new_node = expand(visited, cur, cur->orig_node); ++ new_node = expand(cur, cur->orig_node); + if (new_node == NULL_TREE) + continue; + + orig_def_stmt = get_def_stmt(cur->orig_node); -+ -+ change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num); -+ + if (pointer_set_contains(visited->no_cast_check, orig_def_stmt)) + continue; ++ change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num); + check_size_overflow(cur, cur->first_stmt, TREE_TYPE(new_node), new_node, cur->orig_node, BEFORE_STMT); + } +} @@ -209014,12 +210087,12 @@ index 0000000..c958d66 +} diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c new file mode 100644 -index 0000000..9162fe5 +index 0000000..062204a --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c -@@ -0,0 +1,1015 @@ +@@ -0,0 +1,1025 @@ +/* -+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com> ++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 + * + * Homepage: @@ -209374,7 +210447,7 @@ index 0000000..9162fe5 + return result; +} + -+static tree handle_phi(struct visited *visited, interesting_stmts_t expand_from, tree orig_result) ++static tree handle_phi(interesting_stmts_t expand_from, tree orig_result) +{ +#if BUILDING_GCC_VERSION <= 4007 + VEC(tree, heap) *args = NULL; @@ -209386,18 +210459,18 @@ index 0000000..9162fe5 + gphi *oldstmt = as_a_gphi(get_def_stmt(orig_result)); + + len = gimple_phi_num_args(oldstmt); -+ pointer_set_insert(visited->stmts, oldstmt); ++ pointer_set_insert(expand_from->visited->stmts, oldstmt); + for (i = 0; i < len; i++) { + tree arg, new_arg; + + arg = gimple_phi_arg_def(oldstmt, i); -+ new_arg = expand(visited, expand_from, arg); ++ new_arg = expand(expand_from, arg); + + if (ssa_name_var == NULL_TREE && new_arg != NULL_TREE) + ssa_name_var = SSA_NAME_VAR(new_arg); + + if (is_gimple_constant(arg)) { -+ tree size_overflow_type = get_size_overflow_type(visited, oldstmt, arg); ++ tree size_overflow_type = get_size_overflow_type(expand_from->visited, oldstmt, arg); + + new_arg = cast_a_tree(size_overflow_type, arg); + } @@ -209410,9 +210483,9 @@ index 0000000..9162fe5 + } + +#if BUILDING_GCC_VERSION <= 4007 -+ return create_new_phi_node(visited, &args, ssa_name_var, oldstmt); ++ return create_new_phi_node(expand_from->visited, &args, ssa_name_var, oldstmt); +#else -+ return create_new_phi_node(visited, args, ssa_name_var, oldstmt); ++ return create_new_phi_node(expand_from->visited, args, ssa_name_var, oldstmt); +#endif +} + @@ -209429,7 +210502,7 @@ index 0000000..9162fe5 + return create_assign(visited, stmt, rhs1, AFTER_STMT); +} + -+static bool skip_lhs_cast_check(const gassign *stmt) ++static bool skip_lhs_cast_check(struct visited *visited, const gassign *stmt) +{ + const_tree rhs = gimple_assign_rhs1(stmt); + const_gimple def_stmt = get_def_stmt(rhs); @@ -209438,8 +210511,10 @@ index 0000000..9162fe5 + if (gimple_code(def_stmt) == GIMPLE_ASM) + return true; + -+ if (is_const_plus_unsigned_signed_truncation(rhs)) ++ if (is_const_plus_unsigned_signed_truncation(rhs)) { ++ pointer_set_insert(visited->no_cast_check, stmt); + return true; ++ } + + return false; +} @@ -209564,14 +210639,15 @@ index 0000000..9162fe5 + const_tree rhs_type = TREE_TYPE(rhs); + tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min; + ++ if (pointer_set_contains(expand_from->visited->no_cast_check, stmt)) ++ return; ++ + gcc_assert(rhs_type != NULL_TREE); + if (TREE_CODE(rhs_type) == POINTER_TYPE) + return; + + gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE); + -+ if (is_const_plus_unsigned_signed_truncation(rhs)) -+ return; + if (is_gimple_assign(stmt) && neg_short_add_intentional_overflow(as_a_gassign(stmt))) + return; + @@ -209629,7 +210705,7 @@ index 0000000..9162fe5 + * _589 = -_588; + * _590 = (long int) _589; + */ -+static bool handle_unsigned_neg_or_bit_not(struct visited *visited, interesting_stmts_t expand_from, const gassign *stmt) ++static bool handle_unsigned_neg_or_bit_not(interesting_stmts_t expand_from, const gassign *stmt) +{ + gimple def_neg_stmt, neg_stmt; + tree lhs, new_neg_rhs; @@ -209654,13 +210730,13 @@ index 0000000..9162fe5 + if (!def_neg_stmt) + return false; + -+ new_neg_rhs = get_my_stmt_lhs(visited, def_neg_stmt); ++ new_neg_rhs = get_my_stmt_lhs(expand_from->visited, def_neg_stmt); + check_size_overflow(expand_from, neg_stmt, TREE_TYPE(new_neg_rhs), new_neg_rhs, lhs, BEFORE_STMT); -+ pointer_set_insert(visited->no_cast_check, stmt); ++ pointer_set_insert(expand_from->visited->no_cast_check, stmt); + return true; +} + -+static tree create_cast_overflow_check(struct visited *visited, interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt) ++static tree create_cast_overflow_check(interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt) +{ + bool cast_lhs, cast_rhs; + tree lhs = gimple_assign_lhs(stmt); @@ -209686,18 +210762,18 @@ index 0000000..9162fe5 + { true, false, true, true }, // lhs < rhs + }; + -+ if (handle_unsigned_neg_or_bit_not(visited, expand_from, stmt)) -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ if (handle_unsigned_neg_or_bit_not(expand_from, stmt)) ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); + + // skip lhs check on HI -> QI cast + if (rhs_mode == HImode && lhs_mode == QImode) { -+ pointer_set_insert(visited->no_cast_check, stmt); -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ pointer_set_insert(expand_from->visited->no_cast_check, stmt); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); + } + + // skip lhs check on signed SI -> HI cast or signed SI -> QI cast + if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode)) -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + + if (lhs_size > rhs_size) { + cast_lhs = check_lhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)]; @@ -209711,53 +210787,60 @@ index 0000000..9162fe5 + } + + if (!cast_lhs && !cast_rhs) -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); + -+ if (cast_lhs && !skip_lhs_cast_check(stmt)) ++ if (cast_lhs && !skip_lhs_cast_check(expand_from->visited, stmt)) + check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, lhs, BEFORE_STMT); + + if (cast_rhs) + check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs, BEFORE_STMT); + -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); +} + -+static tree handle_unary_rhs(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt) ++static tree handle_unary_rhs(interesting_stmts_t expand_from, gassign *stmt) +{ + enum tree_code rhs_code; + tree rhs1, new_rhs1, lhs = gimple_assign_lhs(stmt); + -+ if (pointer_set_contains(visited->my_stmts, stmt)) ++ if (pointer_set_contains(expand_from->visited->my_stmts, stmt)) + return lhs; + + rhs1 = gimple_assign_rhs1(stmt); + if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE) -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + -+ new_rhs1 = expand(visited, expand_from, rhs1); ++ new_rhs1 = expand(expand_from, rhs1); + + if (new_rhs1 == NULL_TREE) -+ return create_cast_assign(visited, stmt); ++ return create_cast_assign(expand_from->visited, stmt); ++ ++ if (pointer_set_contains(expand_from->visited->no_cast_check, stmt)) ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); + -+ if (pointer_set_contains(visited->no_cast_check, stmt)) -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++#if BUILDING_GCC_VERSION >= 5000 ++ if (short_or_neg_const_ushort(stmt)) { ++ pointer_set_insert(expand_from->visited->no_cast_check, stmt); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ } ++#endif + + rhs_code = gimple_assign_rhs_code(stmt); + if (rhs_code == BIT_NOT_EXPR || rhs_code == NEGATE_EXPR) { -+ tree size_overflow_type = get_size_overflow_type(visited, stmt, rhs1); ++ tree size_overflow_type = get_size_overflow_type(expand_from->visited, stmt, rhs1); + -+ new_rhs1 = cast_to_new_size_overflow_type(visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT); ++ new_rhs1 = cast_to_new_size_overflow_type(expand_from->visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT); + check_size_overflow(expand_from, stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT); -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + } + + if (!gimple_assign_cast_p(stmt)) -+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); ++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE); + -+ return create_cast_overflow_check(visited, expand_from, new_rhs1, stmt); ++ return create_cast_overflow_check(expand_from, new_rhs1, stmt); +} + -+static tree handle_unary_ops(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt) ++static tree handle_unary_ops(interesting_stmts_t expand_from, gassign *stmt) +{ + tree rhs1, lhs = gimple_assign_lhs(stmt); + gimple def_stmt = get_def_stmt(lhs); @@ -209766,14 +210849,14 @@ index 0000000..9162fe5 + rhs1 = gimple_assign_rhs1(def_stmt); + + if (is_gimple_constant(rhs1)) -+ return create_assign(visited, def_stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT); + + switch (TREE_CODE(rhs1)) { + case SSA_NAME: { -+ tree ret = handle_unary_rhs(visited, expand_from, as_a_gassign(def_stmt)); ++ tree ret = handle_unary_rhs(expand_from, as_a_gassign(def_stmt)); + + if (gimple_assign_cast_p(stmt)) -+ unsigned_signed_cast_intentional_overflow(visited, stmt); ++ unsigned_signed_cast_intentional_overflow(expand_from->visited, stmt); + return ret; + } + case ARRAY_REF: @@ -209786,10 +210869,10 @@ index 0000000..9162fe5 +#endif + case TARGET_MEM_REF: + case VIEW_CONVERT_EXPR: -+ return create_assign(visited, def_stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT); + case PARM_DECL: + case VAR_DECL: -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + + default: + debug_gimple_stmt(def_stmt); @@ -209843,7 +210926,7 @@ index 0000000..9162fe5 + return true; +} + -+static tree handle_comparison_code_class(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2) ++static tree handle_comparison_code_class(interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2) +{ + tree rhs1, rhs2, lhs; + @@ -209853,15 +210936,15 @@ index 0000000..9162fe5 + + lhs = gimple_assign_lhs(stmt); + if (new_rhs2 == NULL_TREE) -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); + + rhs2 = gimple_assign_rhs2(stmt); + if (!is_gimple_constant(rhs2)) + check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs2), new_rhs2, rhs2, BEFORE_STMT); -+ return create_assign(visited, stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT); +} + -+static tree handle_binary_ops(struct visited *visited, interesting_stmts_t expand_from, tree lhs) ++static tree handle_binary_ops(interesting_stmts_t expand_from, tree lhs) +{ + enum intentional_overflow_type res; + tree rhs1, rhs2, new_lhs; @@ -209870,7 +210953,7 @@ index 0000000..9162fe5 + tree new_rhs2 = NULL_TREE; + + if (is_ptr_diff(def_stmt)) -+ return create_assign(visited, def_stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT); + + rhs1 = gimple_assign_rhs1(def_stmt); + rhs2 = gimple_assign_rhs2(def_stmt); @@ -209889,86 +210972,86 @@ index 0000000..9162fe5 + case EXACT_DIV_EXPR: + case POINTER_PLUS_EXPR: + case BIT_AND_EXPR: -+ return create_assign(visited, def_stmt, lhs, AFTER_STMT); ++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT); + default: + break; + } + -+ new_lhs = handle_integer_truncation(visited, expand_from, lhs); ++ new_lhs = handle_integer_truncation(expand_from, lhs); + if (new_lhs != NULL_TREE) + return new_lhs; + + if (TREE_CODE(rhs1) == SSA_NAME) -+ new_rhs1 = expand(visited, expand_from, rhs1); ++ new_rhs1 = expand(expand_from, rhs1); + if (TREE_CODE(rhs2) == SSA_NAME) -+ new_rhs2 = expand(visited, expand_from, rhs2); ++ new_rhs2 = expand(expand_from, rhs2); + + res = add_mul_intentional_overflow(def_stmt); + if (res != NO_INTENTIONAL_OVERFLOW) { -+ new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); -+ insert_cast_expr(visited, as_a_gassign(get_def_stmt(new_lhs)), res); ++ new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); ++ insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), res); + return new_lhs; + } + + if (skip_expr_on_double_type(def_stmt)) { -+ new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); -+ insert_cast_expr(visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW); ++ new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); ++ insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW); + return new_lhs; + } + + if (is_a_neg_overflow(def_stmt, rhs2)) -+ return handle_intentional_overflow(visited, expand_from, true, def_stmt, new_rhs1, NULL_TREE); ++ return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs1, NULL_TREE); + if (is_a_neg_overflow(def_stmt, rhs1)) -+ return handle_intentional_overflow(visited, expand_from, true, def_stmt, new_rhs2, new_rhs2); ++ return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs2, new_rhs2); + + + if (is_a_constant_overflow(def_stmt, rhs2)) -+ return handle_intentional_overflow(visited, expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE); ++ return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE); + if (is_a_constant_overflow(def_stmt, rhs1)) -+ return handle_intentional_overflow(visited, expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2); ++ return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2); + + // the const is between 0 and (signed) MAX + if (is_gimple_constant(rhs1)) -+ new_rhs1 = create_assign(visited, def_stmt, rhs1, BEFORE_STMT); ++ new_rhs1 = create_assign(expand_from->visited, def_stmt, rhs1, BEFORE_STMT); + if (is_gimple_constant(rhs2)) -+ new_rhs2 = create_assign(visited, def_stmt, rhs2, BEFORE_STMT); ++ new_rhs2 = create_assign(expand_from->visited, def_stmt, rhs2, BEFORE_STMT); + + if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison) -+ return handle_comparison_code_class(visited, expand_from, def_stmt, new_rhs1, new_rhs2); ++ return handle_comparison_code_class(expand_from, def_stmt, new_rhs1, new_rhs2); + + if (uconst_neg_intentional_overflow(def_stmt)) { + inform(gimple_location(def_stmt), "%s: gcc intentional overflow", __func__); + gcc_unreachable(); + } + -+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); ++ return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE); +} + +#if BUILDING_GCC_VERSION >= 4006 -+static tree get_new_rhs(struct visited *visited, interesting_stmts_t expand_from, tree size_overflow_type, tree rhs) ++static tree get_new_rhs(interesting_stmts_t expand_from, tree size_overflow_type, tree rhs) +{ + if (is_gimple_constant(rhs)) + return cast_a_tree(size_overflow_type, rhs); + if (TREE_CODE(rhs) != SSA_NAME) + return NULL_TREE; -+ return expand(visited, expand_from, rhs); ++ return expand(expand_from, rhs); +} + -+static tree handle_ternary_ops(struct visited *visited, interesting_stmts_t expand_from, tree lhs) ++static tree handle_ternary_ops(interesting_stmts_t expand_from, tree lhs) +{ + tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type; + gassign *def_stmt = as_a_gassign(get_def_stmt(lhs)); + -+ size_overflow_type = get_size_overflow_type(visited, def_stmt, lhs); ++ size_overflow_type = get_size_overflow_type(expand_from->visited, def_stmt, lhs); + + rhs1 = gimple_assign_rhs1(def_stmt); + rhs2 = gimple_assign_rhs2(def_stmt); + rhs3 = gimple_assign_rhs3(def_stmt); -+ new_rhs1 = get_new_rhs(visited, expand_from, size_overflow_type, rhs1); -+ new_rhs2 = get_new_rhs(visited, expand_from, size_overflow_type, rhs2); -+ new_rhs3 = get_new_rhs(visited, expand_from, size_overflow_type, rhs3); ++ new_rhs1 = get_new_rhs(expand_from, size_overflow_type, rhs1); ++ new_rhs2 = get_new_rhs(expand_from, size_overflow_type, rhs2); ++ new_rhs3 = get_new_rhs(expand_from, size_overflow_type, rhs3); + -+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3); ++ return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3); +} +#endif + @@ -209988,7 +211071,7 @@ index 0000000..9162fe5 + return get_my_stmt_lhs(visited, def_stmt); +} + -+tree expand(struct visited *visited, interesting_stmts_t expand_from, tree lhs) ++tree expand(interesting_stmts_t expand_from, tree lhs) +{ + gimple def_stmt; + @@ -209997,11 +211080,11 @@ index 0000000..9162fe5 + if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP) + return NULL_TREE; + -+ if (pointer_set_contains(visited->my_stmts, def_stmt)) ++ if (pointer_set_contains(expand_from->visited->my_stmts, def_stmt)) + return lhs; + -+ if (pointer_set_contains(visited->stmts, def_stmt)) -+ return expand_visited(visited, def_stmt); ++ if (pointer_set_contains(expand_from->visited->stmts, def_stmt)) ++ return expand_visited(expand_from->visited, def_stmt); + + if (is_gimple_constant(lhs)) + return NULL_TREE; @@ -210010,21 +211093,21 @@ index 0000000..9162fe5 + + switch (gimple_code(def_stmt)) { + case GIMPLE_PHI: -+ return handle_phi(visited, expand_from, lhs); ++ return handle_phi(expand_from, lhs); + case GIMPLE_CALL: + case GIMPLE_ASM: + if (is_size_overflow_asm(def_stmt)) -+ return expand(visited, expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt))); -+ return create_assign(visited, def_stmt, lhs, AFTER_STMT); ++ return expand(expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt))); ++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT); + case GIMPLE_ASSIGN: + switch (gimple_num_ops(def_stmt)) { + case 2: -+ return handle_unary_ops(visited, expand_from, as_a_gassign(def_stmt)); ++ return handle_unary_ops(expand_from, as_a_gassign(def_stmt)); + case 3: -+ return handle_binary_ops(visited, expand_from, lhs); ++ return handle_binary_ops(expand_from, lhs); +#if BUILDING_GCC_VERSION >= 4006 + case 4: -+ return handle_ternary_ops(visited, expand_from, lhs); ++ return handle_ternary_ops(expand_from, lhs); +#endif + } + default: diff --git a/4.5.2/4425_grsec_remove_EI_PAX.patch b/4.5.3/4425_grsec_remove_EI_PAX.patch index 2a1aa6c..2a1aa6c 100644 --- a/4.5.2/4425_grsec_remove_EI_PAX.patch +++ b/4.5.3/4425_grsec_remove_EI_PAX.patch diff --git a/4.5.2/4427_force_XATTR_PAX_tmpfs.patch b/4.5.3/4427_force_XATTR_PAX_tmpfs.patch index 6db8e37..aa2a091 100644 --- a/4.5.2/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.5.3/4427_force_XATTR_PAX_tmpfs.patch @@ -6,7 +6,7 @@ namespace supported on tmpfs so that the PaX markings survive emerge. diff -Naur a/mm/shmem.c b/mm/shmem.c --- a/mm/shmem.c 2016-04-29 19:56:25.306101147 -0400 +++ b/mm/shmem.c 2016-04-29 19:59:44.126104490 -0400 -@@ -2670,24 +2670,20 @@ +@@ -2670,7 +2670,6 @@ return simple_xattr_set(&info->xattrs, name, value, size, flags); } @@ -14,16 +14,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c static int shmem_user_xattr_handler_set(const struct xattr_handler *handler, struct dentry *dentry, const char *name, const void *value, size_t size, int flags) - { - struct shmem_inode_info *info = SHMEM_I(d_inode(dentry)); - --#ifdef CONFIG_PAX_XATTR_PAX_FLAGS - if (strcmp(name, XATTR_NAME_PAX_FLAGS)) - return -EOPNOTSUPP; - if (size > 8) - return -EINVAL; --#endif - +@@ -2685,7 +2684,6 @@ name = xattr_full_name(handler, name); return simple_xattr_set(&info->xattrs, name, value, size, flags); } @@ -31,7 +22,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c static const struct xattr_handler shmem_security_xattr_handler = { .prefix = XATTR_SECURITY_PREFIX, -@@ -2701,13 +2697,11 @@ +@@ -2699,13 +2697,11 @@ .set = shmem_xattr_handler_set, }; @@ -45,7 +36,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c static const struct xattr_handler *shmem_xattr_handlers[] = { #ifdef CONFIG_TMPFS_POSIX_ACL -@@ -2717,9 +2711,7 @@ +@@ -2715,9 +2711,7 @@ &shmem_security_xattr_handler, &shmem_trusted_xattr_handler, diff --git a/4.5.2/4430_grsec-remove-localversion-grsec.patch b/4.5.3/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.5.2/4430_grsec-remove-localversion-grsec.patch +++ b/4.5.3/4430_grsec-remove-localversion-grsec.patch diff --git a/4.5.2/4435_grsec-mute-warnings.patch b/4.5.3/4435_grsec-mute-warnings.patch index b7564e4..b7564e4 100644 --- a/4.5.2/4435_grsec-mute-warnings.patch +++ b/4.5.3/4435_grsec-mute-warnings.patch diff --git a/4.5.2/4440_grsec-remove-protected-paths.patch b/4.5.3/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.5.2/4440_grsec-remove-protected-paths.patch +++ b/4.5.3/4440_grsec-remove-protected-paths.patch diff --git a/4.5.2/4450_grsec-kconfig-default-gids.patch b/4.5.3/4450_grsec-kconfig-default-gids.patch index 79a866b..79a866b 100644 --- a/4.5.2/4450_grsec-kconfig-default-gids.patch +++ b/4.5.3/4450_grsec-kconfig-default-gids.patch diff --git a/4.5.2/4465_selinux-avc_audit-log-curr_ip.patch b/4.5.3/4465_selinux-avc_audit-log-curr_ip.patch index 7248385..7248385 100644 --- a/4.5.2/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.5.3/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.5.2/4470_disable-compat_vdso.patch b/4.5.3/4470_disable-compat_vdso.patch index 4aba080..4aba080 100644 --- a/4.5.2/4470_disable-compat_vdso.patch +++ b/4.5.3/4470_disable-compat_vdso.patch diff --git a/4.5.2/4475_emutramp_default_on.patch b/4.5.3/4475_emutramp_default_on.patch index afd6019..afd6019 100644 --- a/4.5.2/4475_emutramp_default_on.patch +++ b/4.5.3/4475_emutramp_default_on.patch |