Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.4 commit in: /
Date: Wed, 06 Oct 2021 11:33:41
Message-Id: 1633520003.dadcce23d781a274174c9b0651ea614a170cb057.mpagano@gentoo
1 commit: dadcce23d781a274174c9b0651ea614a170cb057
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Wed Oct 6 11:33:23 2021 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Wed Oct 6 11:33:23 2021 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dadcce23
7
8 Linux patch 4.4.286
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1285_linux-4.4.286.patch | 1021 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 1025 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index bd19b36..9700d52 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -1183,6 +1183,10 @@ Patch: 1284_linux-4.4.285.patch
21 From: http://www.kernel.org
22 Desc: Linux 4.4.285
23
24 +Patch: 1285_linux-4.4.286.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 4.4.286
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1285_linux-4.4.286.patch b/1285_linux-4.4.286.patch
33 new file mode 100644
34 index 0000000..58f6c0f
35 --- /dev/null
36 +++ b/1285_linux-4.4.286.patch
37 @@ -0,0 +1,1021 @@
38 +diff --git a/Makefile b/Makefile
39 +index 96cb7da465043..34ad8ef93d409 100644
40 +--- a/Makefile
41 ++++ b/Makefile
42 +@@ -1,6 +1,6 @@
43 + VERSION = 4
44 + PATCHLEVEL = 4
45 +-SUBLEVEL = 285
46 ++SUBLEVEL = 286
47 + EXTRAVERSION =
48 + NAME = Blurry Fish Butt
49 +
50 +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
51 +index 355aec0867f4d..e55a5e6ab4608 100644
52 +--- a/arch/alpha/include/asm/io.h
53 ++++ b/arch/alpha/include/asm/io.h
54 +@@ -60,7 +60,7 @@ extern inline void set_hae(unsigned long new_hae)
55 + * Change virtual addresses to physical addresses and vv.
56 + */
57 + #ifdef USE_48_BIT_KSEG
58 +-static inline unsigned long virt_to_phys(void *address)
59 ++static inline unsigned long virt_to_phys(volatile void *address)
60 + {
61 + return (unsigned long)address - IDENT_ADDR;
62 + }
63 +@@ -70,7 +70,7 @@ static inline void * phys_to_virt(unsigned long address)
64 + return (void *) (address + IDENT_ADDR);
65 + }
66 + #else
67 +-static inline unsigned long virt_to_phys(void *address)
68 ++static inline unsigned long virt_to_phys(volatile void *address)
69 + {
70 + unsigned long phys = (unsigned long)address;
71 +
72 +@@ -111,7 +111,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page)
73 + extern unsigned long __direct_map_base;
74 + extern unsigned long __direct_map_size;
75 +
76 +-static inline unsigned long __deprecated virt_to_bus(void *address)
77 ++static inline unsigned long __deprecated virt_to_bus(volatile void *address)
78 + {
79 + unsigned long phys = virt_to_phys(address);
80 + unsigned long bus = phys + __direct_map_base;
81 +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
82 +index 644f4326b3e75..dee4d691bc585 100644
83 +--- a/arch/arm64/Kconfig
84 ++++ b/arch/arm64/Kconfig
85 +@@ -381,7 +381,7 @@ config ARM64_ERRATUM_1024718
86 + help
87 + This option adds work around for Arm Cortex-A55 Erratum 1024718.
88 +
89 +- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect
90 ++ Affected Cortex-A55 cores (all revisions) could cause incorrect
91 + update of the hardware dirty bit when the DBM/AP bits are updated
92 + without a break-before-make. The work around is to disable the usage
93 + of hardware DBM locally on the affected cores. CPUs not affected by
94 +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
95 +index 10d6627673cbf..6cd79888944e6 100644
96 +--- a/arch/arm64/kernel/process.c
97 ++++ b/arch/arm64/kernel/process.c
98 +@@ -55,7 +55,7 @@
99 +
100 + #ifdef CONFIG_CC_STACKPROTECTOR
101 + #include <linux/stackprotector.h>
102 +-unsigned long __stack_chk_guard __read_mostly;
103 ++unsigned long __stack_chk_guard __ro_after_init;
104 + EXPORT_SYMBOL(__stack_chk_guard);
105 + #endif
106 +
107 +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
108 +index f096367380075..0b095b75abeb7 100644
109 +--- a/arch/arm64/mm/proc.S
110 ++++ b/arch/arm64/mm/proc.S
111 +@@ -222,8 +222,8 @@ ENTRY(__cpu_setup)
112 + cmp x9, #2
113 + b.lt 1f
114 + #ifdef CONFIG_ARM64_ERRATUM_1024718
115 +- /* Disable hardware DBM on Cortex-A55 r0p0, r0p1 & r1p0 */
116 +- cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(1, 0), x1, x2, x3, x4
117 ++ /* Disable hardware DBM on Cortex-A55 all versions */
118 ++ cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(0xf, 0xf), x1, x2, x3, x4
119 + cbnz x1, 1f
120 + #endif
121 + orr x10, x10, #TCR_HD // hardware Dirty flag update
122 +diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h
123 +index 932faa35655b1..2238232c360e9 100644
124 +--- a/arch/m68k/include/asm/raw_io.h
125 ++++ b/arch/m68k/include/asm/raw_io.h
126 +@@ -30,21 +30,21 @@ extern void __iounmap(void *addr, unsigned long size);
127 + * two accesses to memory, which may be undesirable for some devices.
128 + */
129 + #define in_8(addr) \
130 +- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; })
131 ++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; })
132 + #define in_be16(addr) \
133 +- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; })
134 ++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; })
135 + #define in_be32(addr) \
136 +- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; })
137 ++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; })
138 + #define in_le16(addr) \
139 +- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; })
140 ++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; })
141 + #define in_le32(addr) \
142 +- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; })
143 ++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; })
144 +
145 +-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b))
146 +-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w))
147 +-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l))
148 +-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w))
149 +-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l))
150 ++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b))
151 ++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w))
152 ++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l))
153 ++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w))
154 ++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l))
155 +
156 + #define raw_inb in_8
157 + #define raw_inw in_be16
158 +diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
159 +index 80e742a1c162f..088888fcf8df3 100644
160 +--- a/arch/parisc/include/asm/page.h
161 ++++ b/arch/parisc/include/asm/page.h
162 +@@ -174,7 +174,7 @@ extern int npmem_ranges;
163 + #include <asm-generic/getorder.h>
164 + #include <asm/pdc.h>
165 +
166 +-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET)
167 ++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET))
168 +
169 + /* DEFINITION OF THE ZERO-PAGE (PAG0) */
170 + /* based on work by Jason Eckhardt (jason@×××××××.com) */
171 +diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
172 +index 6f80936e0eea4..75445ba7e237c 100644
173 +--- a/arch/sparc/kernel/mdesc.c
174 ++++ b/arch/sparc/kernel/mdesc.c
175 +@@ -37,6 +37,7 @@ struct mdesc_hdr {
176 + u32 node_sz; /* node block size */
177 + u32 name_sz; /* name block size */
178 + u32 data_sz; /* data block size */
179 ++ char data[];
180 + } __attribute__((aligned(16)));
181 +
182 + struct mdesc_elem {
183 +@@ -369,7 +370,7 @@ out:
184 +
185 + static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc)
186 + {
187 +- return (struct mdesc_elem *) (mdesc + 1);
188 ++ return (struct mdesc_elem *) mdesc->data;
189 + }
190 +
191 + static void *name_block(struct mdesc_hdr *mdesc)
192 +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
193 +index 79aff24eed653..28725a6ed5de0 100644
194 +--- a/arch/x86/xen/enlighten.c
195 ++++ b/arch/x86/xen/enlighten.c
196 +@@ -861,8 +861,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
197 + preempt_enable();
198 + }
199 +
200 +-static void xen_convert_trap_info(const struct desc_ptr *desc,
201 +- struct trap_info *traps)
202 ++static unsigned xen_convert_trap_info(const struct desc_ptr *desc,
203 ++ struct trap_info *traps, bool full)
204 + {
205 + unsigned in, out, count;
206 +
207 +@@ -872,17 +872,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc,
208 + for (in = out = 0; in < count; in++) {
209 + gate_desc *entry = (gate_desc*)(desc->address) + in;
210 +
211 +- if (cvt_gate_to_trap(in, entry, &traps[out]))
212 ++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full)
213 + out++;
214 + }
215 +- traps[out].address = 0;
216 ++
217 ++ return out;
218 + }
219 +
220 + void xen_copy_trap_info(struct trap_info *traps)
221 + {
222 + const struct desc_ptr *desc = this_cpu_ptr(&idt_desc);
223 +
224 +- xen_convert_trap_info(desc, traps);
225 ++ xen_convert_trap_info(desc, traps, true);
226 + }
227 +
228 + /* Load a new IDT into Xen. In principle this can be per-CPU, so we
229 +@@ -892,6 +893,7 @@ static void xen_load_idt(const struct desc_ptr *desc)
230 + {
231 + static DEFINE_SPINLOCK(lock);
232 + static struct trap_info traps[257];
233 ++ unsigned out;
234 +
235 + trace_xen_cpu_load_idt(desc);
236 +
237 +@@ -899,7 +901,8 @@ static void xen_load_idt(const struct desc_ptr *desc)
238 +
239 + memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc));
240 +
241 +- xen_convert_trap_info(desc, traps);
242 ++ out = xen_convert_trap_info(desc, traps, false);
243 ++ memset(&traps[out], 0, sizeof(traps[0]));
244 +
245 + xen_mc_flush();
246 + if (HYPERVISOR_set_trap_table(traps))
247 +diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
248 +index fc153aea2f6cf..091f03852dcac 100644
249 +--- a/drivers/edac/synopsys_edac.c
250 ++++ b/drivers/edac/synopsys_edac.c
251 +@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci)
252 +
253 + for (j = 0; j < csi->nr_channels; j++) {
254 + dimm = csi->channels[j]->dimm;
255 +- dimm->edac_mode = EDAC_FLAG_SECDED;
256 ++ dimm->edac_mode = EDAC_SECDED;
257 + dimm->mtype = synps_edac_get_mtype(priv->baseaddr);
258 + dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels;
259 + dimm->grain = SYNPS_EDAC_ERR_GRAIN;
260 +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c
261 +index 69cfc8dc6af1e..9b60efe6ec441 100644
262 +--- a/drivers/hid/hid-betopff.c
263 ++++ b/drivers/hid/hid-betopff.c
264 +@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid)
265 + {
266 + struct betopff_device *betopff;
267 + struct hid_report *report;
268 +- struct hid_input *hidinput =
269 +- list_first_entry(&hid->inputs, struct hid_input, list);
270 ++ struct hid_input *hidinput;
271 + struct list_head *report_list =
272 + &hid->report_enum[HID_OUTPUT_REPORT].report_list;
273 +- struct input_dev *dev = hidinput->input;
274 ++ struct input_dev *dev;
275 + int field_count = 0;
276 + int error;
277 + int i, j;
278 +
279 ++ if (list_empty(&hid->inputs)) {
280 ++ hid_err(hid, "no inputs found\n");
281 ++ return -ENODEV;
282 ++ }
283 ++
284 ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
285 ++ dev = hidinput->input;
286 ++
287 + if (list_empty(report_list)) {
288 + hid_err(hid, "no output reports found\n");
289 + return -ENODEV;
290 +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
291 +index d51fc2be0e10c..c7da6ec4d923d 100644
292 +--- a/drivers/hid/usbhid/hid-core.c
293 ++++ b/drivers/hid/usbhid/hid-core.c
294 +@@ -500,7 +500,7 @@ static void hid_ctrl(struct urb *urb)
295 +
296 + if (unplug) {
297 + usbhid->ctrltail = usbhid->ctrlhead;
298 +- } else {
299 ++ } else if (usbhid->ctrlhead != usbhid->ctrltail) {
300 + usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
301 +
302 + if (usbhid->ctrlhead != usbhid->ctrltail &&
303 +@@ -1185,9 +1185,20 @@ static void usbhid_stop(struct hid_device *hid)
304 + usbhid->intf->needs_remote_wakeup = 0;
305 +
306 + clear_bit(HID_STARTED, &usbhid->iofl);
307 ++
308 + spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */
309 + set_bit(HID_DISCONNECTED, &usbhid->iofl);
310 ++ while (usbhid->ctrltail != usbhid->ctrlhead) {
311 ++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
312 ++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);
313 ++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
314 ++ }
315 ++
316 ++ usbhid->ctrltail = (usbhid->ctrltail + 1) &
317 ++ (HID_CONTROL_FIFO_SIZE - 1);
318 ++ }
319 + spin_unlock_irq(&usbhid->lock);
320 ++
321 + usb_kill_urb(usbhid->urbin);
322 + usb_kill_urb(usbhid->urbout);
323 + usb_kill_urb(usbhid->urbctrl);
324 +diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
325 +index 035d5449227e5..c1175464064be 100644
326 +--- a/drivers/ipack/devices/ipoctal.c
327 ++++ b/drivers/ipack/devices/ipoctal.c
328 +@@ -38,6 +38,7 @@ struct ipoctal_channel {
329 + unsigned int pointer_read;
330 + unsigned int pointer_write;
331 + struct tty_port tty_port;
332 ++ bool tty_registered;
333 + union scc2698_channel __iomem *regs;
334 + union scc2698_block __iomem *block_regs;
335 + unsigned int board_id;
336 +@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
337 + return 0;
338 + }
339 +
340 +-static int ipoctal_open(struct tty_struct *tty, struct file *file)
341 ++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
342 + {
343 + struct ipoctal_channel *channel = dev_get_drvdata(tty->dev);
344 + struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
345 +- int err;
346 +-
347 +- tty->driver_data = channel;
348 ++ int res;
349 +
350 + if (!ipack_get_carrier(ipoctal->dev))
351 + return -EBUSY;
352 +
353 +- err = tty_port_open(&channel->tty_port, tty, file);
354 +- if (err)
355 +- ipack_put_carrier(ipoctal->dev);
356 ++ res = tty_standard_install(driver, tty);
357 ++ if (res)
358 ++ goto err_put_carrier;
359 ++
360 ++ tty->driver_data = channel;
361 ++
362 ++ return 0;
363 ++
364 ++err_put_carrier:
365 ++ ipack_put_carrier(ipoctal->dev);
366 ++
367 ++ return res;
368 ++}
369 ++
370 ++static int ipoctal_open(struct tty_struct *tty, struct file *file)
371 ++{
372 ++ struct ipoctal_channel *channel = tty->driver_data;
373 +
374 +- return err;
375 ++ return tty_port_open(&channel->tty_port, tty, file);
376 + }
377 +
378 + static void ipoctal_reset_stats(struct ipoctal_stats *stats)
379 +@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
380 + int res;
381 + int i;
382 + struct tty_driver *tty;
383 +- char name[20];
384 + struct ipoctal_channel *channel;
385 + struct ipack_region *region;
386 + void __iomem *addr;
387 +@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
388 + /* Fill struct tty_driver with ipoctal data */
389 + tty->owner = THIS_MODULE;
390 + tty->driver_name = KBUILD_MODNAME;
391 +- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
392 +- tty->name = name;
393 ++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
394 ++ if (!tty->name) {
395 ++ res = -ENOMEM;
396 ++ goto err_put_driver;
397 ++ }
398 + tty->major = 0;
399 +
400 + tty->minor_start = 0;
401 +@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
402 + res = tty_register_driver(tty);
403 + if (res) {
404 + dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
405 +- put_tty_driver(tty);
406 +- return res;
407 ++ goto err_free_name;
408 + }
409 +
410 + /* Save struct tty_driver for use it when uninstalling the device */
411 +@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
412 +
413 + channel = &ipoctal->channel[i];
414 + tty_port_init(&channel->tty_port);
415 +- tty_port_alloc_xmit_buf(&channel->tty_port);
416 ++ res = tty_port_alloc_xmit_buf(&channel->tty_port);
417 ++ if (res)
418 ++ continue;
419 + channel->tty_port.ops = &ipoctal_tty_port_ops;
420 +
421 + ipoctal_reset_stats(&channel->stats);
422 +@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
423 + spin_lock_init(&channel->lock);
424 + channel->pointer_read = 0;
425 + channel->pointer_write = 0;
426 +- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL);
427 ++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty,
428 ++ i, NULL, channel, NULL);
429 + if (IS_ERR(tty_dev)) {
430 + dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
431 ++ tty_port_free_xmit_buf(&channel->tty_port);
432 + tty_port_destroy(&channel->tty_port);
433 + continue;
434 + }
435 +- dev_set_drvdata(tty_dev, channel);
436 ++ channel->tty_registered = true;
437 + }
438 +
439 + /*
440 +@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
441 + ipoctal_irq_handler, ipoctal);
442 +
443 + return 0;
444 ++
445 ++err_free_name:
446 ++ kfree(tty->name);
447 ++err_put_driver:
448 ++ put_tty_driver(tty);
449 ++
450 ++ return res;
451 + }
452 +
453 + static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
454 +@@ -656,6 +681,7 @@ static void ipoctal_cleanup(struct tty_struct *tty)
455 +
456 + static const struct tty_operations ipoctal_fops = {
457 + .ioctl = NULL,
458 ++ .install = ipoctal_install,
459 + .open = ipoctal_open,
460 + .close = ipoctal_close,
461 + .write = ipoctal_write_tty,
462 +@@ -698,12 +724,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
463 +
464 + for (i = 0; i < NR_CHANNELS; i++) {
465 + struct ipoctal_channel *channel = &ipoctal->channel[i];
466 ++
467 ++ if (!channel->tty_registered)
468 ++ continue;
469 ++
470 + tty_unregister_device(ipoctal->tty_drv, i);
471 + tty_port_free_xmit_buf(&channel->tty_port);
472 + tty_port_destroy(&channel->tty_port);
473 + }
474 +
475 + tty_unregister_driver(ipoctal->tty_drv);
476 ++ kfree(ipoctal->tty_drv->name);
477 + put_tty_driver(ipoctal->tty_drv);
478 + kfree(ipoctal);
479 + }
480 +diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
481 +index 7ce6379fd1a36..1500027ae18b8 100644
482 +--- a/drivers/net/ethernet/i825xx/82596.c
483 ++++ b/drivers/net/ethernet/i825xx/82596.c
484 +@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit)
485 + err = -ENODEV;
486 + goto out;
487 + }
488 +- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */
489 ++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */
490 + dev->base_addr = MVME_I596_BASE;
491 + dev->irq = (unsigned) MVME16x_IRQ_I596;
492 + goto found;
493 +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
494 +index 9035cb5fc70d3..aa556e4f9051e 100644
495 +--- a/drivers/net/ethernet/intel/e100.c
496 ++++ b/drivers/net/ethernet/intel/e100.c
497 +@@ -2462,11 +2462,15 @@ static void e100_get_drvinfo(struct net_device *netdev,
498 + sizeof(info->bus_info));
499 + }
500 +
501 +-#define E100_PHY_REGS 0x1C
502 ++#define E100_PHY_REGS 0x1D
503 + static int e100_get_regs_len(struct net_device *netdev)
504 + {
505 + struct nic *nic = netdev_priv(netdev);
506 +- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);
507 ++
508 ++ /* We know the number of registers, and the size of the dump buffer.
509 ++ * Calculate the total size in bytes.
510 ++ */
511 ++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);
512 + }
513 +
514 + static void e100_get_regs(struct net_device *netdev,
515 +@@ -2480,14 +2484,18 @@ static void e100_get_regs(struct net_device *netdev,
516 + buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 |
517 + ioread8(&nic->csr->scb.cmd_lo) << 16 |
518 + ioread16(&nic->csr->scb.status);
519 +- for (i = E100_PHY_REGS; i >= 0; i--)
520 +- buff[1 + E100_PHY_REGS - i] =
521 +- mdio_read(netdev, nic->mii.phy_id, i);
522 ++ for (i = 0; i < E100_PHY_REGS; i++)
523 ++ /* Note that we read the registers in reverse order. This
524 ++ * ordering is the ABI apparently used by ethtool and other
525 ++ * applications.
526 ++ */
527 ++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,
528 ++ E100_PHY_REGS - 1 - i);
529 + memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));
530 + e100_exec_cb(nic, NULL, e100_dump);
531 + msleep(10);
532 +- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,
533 +- sizeof(nic->mem->dump_buf));
534 ++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,
535 ++ sizeof(nic->mem->dump_buf));
536 + }
537 +
538 + static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
539 +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
540 +index 112ce16717cda..b9014ec73b67c 100644
541 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
542 ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
543 +@@ -311,6 +311,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
544 + int nhoff = skb_network_offset(skb);
545 + int ret = 0;
546 +
547 ++ if (skb->encapsulation)
548 ++ return -EPROTONOSUPPORT;
549 ++
550 + if (skb->protocol != htons(ETH_P_IP))
551 + return -EPROTONOSUPPORT;
552 +
553 +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
554 +index cce901add6542..908de9e453944 100644
555 +--- a/drivers/net/hamradio/6pack.c
556 ++++ b/drivers/net/hamradio/6pack.c
557 +@@ -68,9 +68,9 @@
558 + #define SIXP_DAMA_OFF 0
559 +
560 + /* default level 2 parameters */
561 +-#define SIXP_TXDELAY (HZ/4) /* in 1 s */
562 ++#define SIXP_TXDELAY 25 /* 250 ms */
563 + #define SIXP_PERSIST 50 /* in 256ths */
564 +-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */
565 ++#define SIXP_SLOTTIME 10 /* 100 ms */
566 + #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */
567 + #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */
568 +
569 +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
570 +index 5d988829f7d52..e6f272019da0d 100644
571 +--- a/drivers/net/usb/hso.c
572 ++++ b/drivers/net/usb/hso.c
573 +@@ -2729,14 +2729,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
574 +
575 + serial = kzalloc(sizeof(*serial), GFP_KERNEL);
576 + if (!serial)
577 +- goto exit;
578 ++ goto err_free_dev;
579 +
580 + hso_dev->port_data.dev_serial = serial;
581 + serial->parent = hso_dev;
582 +
583 + if (hso_serial_common_create
584 + (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE))
585 +- goto exit;
586 ++ goto err_free_serial;
587 +
588 + serial->tx_data_length--;
589 + serial->write_data = hso_mux_serial_write_data;
590 +@@ -2752,11 +2752,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
591 + /* done, return it */
592 + return hso_dev;
593 +
594 +-exit:
595 +- if (serial) {
596 +- tty_unregister_device(tty_drv, serial->minor);
597 +- kfree(serial);
598 +- }
599 ++err_free_serial:
600 ++ kfree(serial);
601 ++err_free_dev:
602 + kfree(hso_dev);
603 + return NULL;
604 +
605 +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
606 +index 39d03300d3d9a..9906a3b562e93 100644
607 +--- a/drivers/scsi/scsi_transport_iscsi.c
608 ++++ b/drivers/scsi/scsi_transport_iscsi.c
609 +@@ -429,9 +429,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
610 + struct iscsi_transport *t = iface->transport;
611 + int param = -1;
612 +
613 +- if (attr == &dev_attr_iface_enabled.attr)
614 +- param = ISCSI_NET_PARAM_IFACE_ENABLE;
615 +- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
616 ++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
617 + param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;
618 + else if (attr == &dev_attr_iface_header_digest.attr)
619 + param = ISCSI_IFACE_PARAM_HDRDGST_EN;
620 +@@ -471,7 +469,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
621 + if (param != -1)
622 + return t->attr_is_visible(ISCSI_IFACE_PARAM, param);
623 +
624 +- if (attr == &dev_attr_iface_vlan_id.attr)
625 ++ if (attr == &dev_attr_iface_enabled.attr)
626 ++ param = ISCSI_NET_PARAM_IFACE_ENABLE;
627 ++ else if (attr == &dev_attr_iface_vlan_id.attr)
628 + param = ISCSI_NET_PARAM_VLAN_ID;
629 + else if (attr == &dev_attr_iface_vlan_priority.attr)
630 + param = ISCSI_NET_PARAM_VLAN_PRIORITY;
631 +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
632 +index 9f14560686b68..88bfe7682a9eb 100644
633 +--- a/drivers/spi/spi-tegra20-slink.c
634 ++++ b/drivers/spi/spi-tegra20-slink.c
635 +@@ -1210,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev)
636 + }
637 + #endif
638 +
639 +-static int tegra_slink_runtime_suspend(struct device *dev)
640 ++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev)
641 + {
642 + struct spi_master *master = dev_get_drvdata(dev);
643 + struct tegra_slink_data *tspi = spi_master_get_devdata(master);
644 +@@ -1222,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev)
645 + return 0;
646 + }
647 +
648 +-static int tegra_slink_runtime_resume(struct device *dev)
649 ++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev)
650 + {
651 + struct spi_master *master = dev_get_drvdata(dev);
652 + struct tegra_slink_data *tspi = spi_master_get_devdata(master);
653 +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
654 +index 9f479b4c64919..0fab196a1d90b 100644
655 +--- a/drivers/tty/vt/vt.c
656 ++++ b/drivers/tty/vt/vt.c
657 +@@ -882,8 +882,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
658 + new_row_size = new_cols << 1;
659 + new_screen_size = new_row_size * new_rows;
660 +
661 +- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
662 +- return 0;
663 ++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
664 ++ /*
665 ++ * This function is being called here to cover the case
666 ++ * where the userspace calls the FBIOPUT_VSCREENINFO twice,
667 ++ * passing the same fb_var_screeninfo containing the fields
668 ++ * yres/xres equal to a number non-multiple of vc_font.height
669 ++ * and yres_virtual/xres_virtual equal to number lesser than the
670 ++ * vc_font.height and yres/xres.
671 ++ * In the second call, the struct fb_var_screeninfo isn't
672 ++ * being modified by the underlying driver because of the
673 ++ * if above, and this causes the fbcon_display->vrows to become
674 ++ * negative and it eventually leads to out-of-bound
675 ++ * access by the imageblit function.
676 ++ * To give the correct values to the struct and to not have
677 ++ * to deal with possible errors from the code below, we call
678 ++ * the resize_screen here as well.
679 ++ */
680 ++ return resize_screen(vc, new_cols, new_rows, user);
681 ++ }
682 +
683 + if (new_screen_size > (4 << 20))
684 + return -EINVAL;
685 +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
686 +index 4eb8e181763d1..ffe6cb4c78ffb 100644
687 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c
688 ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c
689 +@@ -1253,7 +1253,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
690 + do {
691 + tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ;
692 + udelay(1);
693 +- } while (tmp != CS_IDST || timeout-- > 0);
694 ++ } while (tmp != CS_IDST && timeout-- > 0);
695 +
696 + if (tmp == CS_IDST)
697 + r8a66597_bset(r8a66597,
698 +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
699 +index df7c9f46be548..85a57385958fd 100644
700 +--- a/drivers/usb/musb/tusb6010.c
701 ++++ b/drivers/usb/musb/tusb6010.c
702 +@@ -193,6 +193,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
703 + }
704 + if (len > 0) {
705 + /* Write the rest 1 - 3 bytes to FIFO */
706 ++ val = 0;
707 + memcpy(&val, buf, len);
708 + musb_writel(fifo, 0, val);
709 + }
710 +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
711 +index f039b85d5f57f..0fbdfea7ec2c1 100644
712 +--- a/drivers/usb/serial/cp210x.c
713 ++++ b/drivers/usb/serial/cp210x.c
714 +@@ -230,6 +230,7 @@ static const struct usb_device_id id_table[] = {
715 + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
716 + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
717 + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
718 ++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */
719 + { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
720 + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
721 + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
722 +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
723 +index 7a9b9542882fd..8a94c85428d9e 100644
724 +--- a/drivers/usb/serial/mos7840.c
725 ++++ b/drivers/usb/serial/mos7840.c
726 +@@ -126,7 +126,6 @@
727 + #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02
728 + #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44
729 + #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03
730 +-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24
731 +
732 + /* This driver also supports
733 + * ATEN UC2324 device using Moschip MCS7840
734 +@@ -207,7 +206,6 @@ static const struct usb_device_id id_table[] = {
735 + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)},
736 + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
737 + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)},
738 +- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
739 + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
740 + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
741 + {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)},
742 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
743 +index 02ded56bcbc6b..ec8ad931f41e3 100644
744 +--- a/drivers/usb/serial/option.c
745 ++++ b/drivers/usb/serial/option.c
746 +@@ -1187,6 +1187,14 @@ static const struct usb_device_id option_ids[] = {
747 + .driver_info = NCTRL(0) | RSVD(1) },
748 + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */
749 + .driver_info = NCTRL(2) | RSVD(3) },
750 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */
751 ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
752 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */
753 ++ .driver_info = NCTRL(0) | RSVD(1) },
754 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */
755 ++ .driver_info = NCTRL(2) | RSVD(3) },
756 ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */
757 ++ .driver_info = NCTRL(0) | RSVD(1) },
758 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
759 + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
760 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
761 +@@ -1632,7 +1640,6 @@ static const struct usb_device_id option_ids[] = {
762 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
763 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
764 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
765 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
766 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
767 + .driver_info = RSVD(1) },
768 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),
769 +@@ -2052,6 +2059,8 @@ static const struct usb_device_id option_ids[] = {
770 + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
771 + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
772 + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
773 ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */
774 ++ .driver_info = RSVD(3) },
775 + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
776 + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
777 + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
778 +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
779 +index 71c9ed70aa683..cda22b312a4c1 100644
780 +--- a/fs/cifs/connect.c
781 ++++ b/fs/cifs/connect.c
782 +@@ -2961,9 +2961,10 @@ cifs_match_super(struct super_block *sb, void *data)
783 + spin_lock(&cifs_tcp_ses_lock);
784 + cifs_sb = CIFS_SB(sb);
785 + tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
786 +- if (IS_ERR(tlink)) {
787 ++ if (tlink == NULL) {
788 ++ /* can not match superblock if tlink were ever null */
789 + spin_unlock(&cifs_tcp_ses_lock);
790 +- return rc;
791 ++ return 0;
792 + }
793 + tcon = tlink_tcon(tlink);
794 + ses = tcon->ses;
795 +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
796 +index 7b626e942987f..96dc313d6251b 100644
797 +--- a/fs/ext4/dir.c
798 ++++ b/fs/ext4/dir.c
799 +@@ -521,7 +521,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
800 + struct dir_private_info *info = file->private_data;
801 + struct inode *inode = file_inode(file);
802 + struct fname *fname;
803 +- int ret;
804 ++ int ret = 0;
805 +
806 + if (!info) {
807 + info = ext4_htree_create_dir_info(file, ctx->pos);
808 +@@ -569,7 +569,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
809 + info->curr_minor_hash,
810 + &info->next_hash);
811 + if (ret < 0)
812 +- return ret;
813 ++ goto finished;
814 + if (ret == 0) {
815 + ctx->pos = ext4_get_htree_eof(file);
816 + break;
817 +@@ -600,7 +600,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
818 + }
819 + finished:
820 + info->last_pos = ctx->pos;
821 +- return 0;
822 ++ return ret < 0 ? ret : 0;
823 + }
824 +
825 + static int ext4_dir_open(struct inode * inode, struct file * filp)
826 +diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c
827 +index b218f965817bf..613cc38c9efad 100644
828 +--- a/fs/qnx4/dir.c
829 ++++ b/fs/qnx4/dir.c
830 +@@ -14,13 +14,48 @@
831 + #include <linux/buffer_head.h>
832 + #include "qnx4.h"
833 +
834 ++/*
835 ++ * A qnx4 directory entry is an inode entry or link info
836 ++ * depending on the status field in the last byte. The
837 ++ * first byte is where the name start either way, and a
838 ++ * zero means it's empty.
839 ++ *
840 ++ * Also, due to a bug in gcc, we don't want to use the
841 ++ * real (differently sized) name arrays in the inode and
842 ++ * link entries, but always the 'de_name[]' one in the
843 ++ * fake struct entry.
844 ++ *
845 ++ * See
846 ++ *
847 ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6
848 ++ *
849 ++ * for details, but basically gcc will take the size of the
850 ++ * 'name' array from one of the used union entries randomly.
851 ++ *
852 ++ * This use of 'de_name[]' (48 bytes) avoids the false positive
853 ++ * warnings that would happen if gcc decides to use 'inode.di_name'
854 ++ * (16 bytes) even when the pointer and size were to come from
855 ++ * 'link.dl_name' (48 bytes).
856 ++ *
857 ++ * In all cases the actual name pointer itself is the same, it's
858 ++ * only the gcc internal 'what is the size of this field' logic
859 ++ * that can get confused.
860 ++ */
861 ++union qnx4_directory_entry {
862 ++ struct {
863 ++ const char de_name[48];
864 ++ u8 de_pad[15];
865 ++ u8 de_status;
866 ++ };
867 ++ struct qnx4_inode_entry inode;
868 ++ struct qnx4_link_info link;
869 ++};
870 ++
871 + static int qnx4_readdir(struct file *file, struct dir_context *ctx)
872 + {
873 + struct inode *inode = file_inode(file);
874 + unsigned int offset;
875 + struct buffer_head *bh;
876 +- struct qnx4_inode_entry *de;
877 +- struct qnx4_link_info *le;
878 + unsigned long blknum;
879 + int ix, ino;
880 + int size;
881 +@@ -37,27 +72,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
882 + }
883 + ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK;
884 + for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) {
885 ++ union qnx4_directory_entry *de;
886 ++
887 + offset = ix * QNX4_DIR_ENTRY_SIZE;
888 +- de = (struct qnx4_inode_entry *) (bh->b_data + offset);
889 +- if (!de->di_fname[0])
890 ++ de = (union qnx4_directory_entry *) (bh->b_data + offset);
891 ++
892 ++ if (!de->de_name[0])
893 + continue;
894 +- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
895 ++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
896 + continue;
897 +- if (!(de->di_status & QNX4_FILE_LINK))
898 +- size = QNX4_SHORT_NAME_MAX;
899 +- else
900 +- size = QNX4_NAME_MAX;
901 +- size = strnlen(de->di_fname, size);
902 +- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname));
903 +- if (!(de->di_status & QNX4_FILE_LINK))
904 ++ if (!(de->de_status & QNX4_FILE_LINK)) {
905 ++ size = sizeof(de->inode.di_fname);
906 + ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1;
907 +- else {
908 +- le = (struct qnx4_link_info*)de;
909 +- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) *
910 ++ } else {
911 ++ size = sizeof(de->link.dl_fname);
912 ++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) *
913 + QNX4_INODES_PER_BLOCK +
914 +- le->dl_inode_ndx;
915 ++ de->link.dl_inode_ndx;
916 + }
917 +- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) {
918 ++ size = strnlen(de->de_name, size);
919 ++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name));
920 ++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) {
921 + brelse(bh);
922 + return 0;
923 + }
924 +diff --git a/include/linux/compiler.h b/include/linux/compiler.h
925 +index 7cabe0cc86651..bc8077e5e688e 100644
926 +--- a/include/linux/compiler.h
927 ++++ b/include/linux/compiler.h
928 +@@ -208,6 +208,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
929 + (typeof(ptr)) (__ptr + (off)); })
930 + #endif
931 +
932 ++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0)
933 ++
934 + #ifndef OPTIMIZER_HIDE_VAR
935 + #define OPTIMIZER_HIDE_VAR(var) barrier()
936 + #endif
937 +diff --git a/include/linux/cred.h b/include/linux/cred.h
938 +index d2db1da3036c4..ee2b36cdb80d8 100644
939 +--- a/include/linux/cred.h
940 ++++ b/include/linux/cred.h
941 +@@ -243,7 +243,7 @@ static inline struct cred *get_new_cred(struct cred *cred)
942 + * @cred: The credentials to reference
943 + *
944 + * Get a reference on the specified set of credentials. The caller must
945 +- * release the reference.
946 ++ * release the reference. If %NULL is passed, it is returned with no action.
947 + *
948 + * This is used to deal with a committed set of credentials. Although the
949 + * pointer is const, this will temporarily discard the const and increment the
950 +@@ -254,6 +254,8 @@ static inline struct cred *get_new_cred(struct cred *cred)
951 + static inline const struct cred *get_cred(const struct cred *cred)
952 + {
953 + struct cred *nonconst_cred = (struct cred *) cred;
954 ++ if (!cred)
955 ++ return cred;
956 + validate_creds(cred);
957 + nonconst_cred->non_rcu = 0;
958 + return get_new_cred(nonconst_cred);
959 +@@ -264,7 +266,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
960 + * @cred: The credentials to release
961 + *
962 + * Release a reference to a set of credentials, deleting them when the last ref
963 +- * is released.
964 ++ * is released. If %NULL is passed, nothing is done.
965 + *
966 + * This takes a const pointer to a set of credentials because the credentials
967 + * on task_struct are attached by const pointers to prevent accidental
968 +@@ -274,9 +276,11 @@ static inline void put_cred(const struct cred *_cred)
969 + {
970 + struct cred *cred = (struct cred *) _cred;
971 +
972 +- validate_creds(cred);
973 +- if (atomic_dec_and_test(&(cred)->usage))
974 +- __put_cred(cred);
975 ++ if (cred) {
976 ++ validate_creds(cred);
977 ++ if (atomic_dec_and_test(&(cred)->usage))
978 ++ __put_cred(cred);
979 ++ }
980 + }
981 +
982 + /**
983 +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
984 +index 8ac3663e0012d..c142e100840e4 100644
985 +--- a/kernel/trace/blktrace.c
986 ++++ b/kernel/trace/blktrace.c
987 +@@ -1581,6 +1581,14 @@ static int blk_trace_remove_queue(struct request_queue *q)
988 + if (bt == NULL)
989 + return -EINVAL;
990 +
991 ++ if (bt->trace_state == Blktrace_running) {
992 ++ bt->trace_state = Blktrace_stopped;
993 ++ spin_lock_irq(&running_trace_lock);
994 ++ list_del_init(&bt->running_list);
995 ++ spin_unlock_irq(&running_trace_lock);
996 ++ relay_flush(bt->rchan);
997 ++ }
998 ++
999 + put_probe_ref();
1000 + synchronize_rcu();
1001 + blk_trace_free(bt);
1002 +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
1003 +index 921115327ec8f..3884bb1a59dd0 100644
1004 +--- a/net/mac80211/wpa.c
1005 ++++ b/net/mac80211/wpa.c
1006 +@@ -519,6 +519,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
1007 + return RX_DROP_UNUSABLE;
1008 + }
1009 +
1010 ++ /* reload hdr - skb might have been reallocated */
1011 ++ hdr = (void *)rx->skb->data;
1012 ++
1013 + data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
1014 + if (!rx->sta || data_len < 0)
1015 + return RX_DROP_UNUSABLE;
1016 +@@ -751,6 +754,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
1017 + return RX_DROP_UNUSABLE;
1018 + }
1019 +
1020 ++ /* reload hdr - skb might have been reallocated */
1021 ++ hdr = (void *)rx->skb->data;
1022 ++
1023 + data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
1024 + if (!rx->sta || data_len < 0)
1025 + return RX_DROP_UNUSABLE;
1026 +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
1027 +index da0aa720da6fd..7b69d1ad8f3eb 100644
1028 +--- a/net/netfilter/ipset/ip_set_hash_gen.h
1029 ++++ b/net/netfilter/ipset/ip_set_hash_gen.h
1030 +@@ -102,11 +102,11 @@ htable_size(u8 hbits)
1031 + {
1032 + size_t hsize;
1033 +
1034 +- /* We must fit both into u32 in jhash and size_t */
1035 ++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
1036 + if (hbits > 31)
1037 + return 0;
1038 + hsize = jhash_size(hbits);
1039 +- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)
1040 ++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
1041 + < hsize)
1042 + return 0;
1043 +
1044 +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
1045 +index 85ca189bdc3d2..de196dd95dcdf 100644
1046 +--- a/net/netfilter/ipvs/ip_vs_conn.c
1047 ++++ b/net/netfilter/ipvs/ip_vs_conn.c
1048 +@@ -1368,6 +1368,10 @@ int __init ip_vs_conn_init(void)
1049 + int idx;
1050 +
1051 + /* Compute size and mask */
1052 ++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
1053 ++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
1054 ++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
1055 ++ }
1056 + ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
1057 + ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
1058 +