Merge branch 'linux-4.14.y' of https://github.com/openela/kernel-lts into 15.0

.elts/config.yaml

@@ -1,5 +1,5 @@
 upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
 upstream_base: 4.19.304
 base: 4.14.336
-upstream_version: 4.19.317
-version: 4.14.350
+upstream_version: 4.19.319
+version: 4.14.352

.elts/meta/4.14.351.yaml

@@ -0,0 +1,222 @@
+a29d61e7e8e578fd6bc893e3fc566de319821ca5:
+  title: 'media: dvb: as102-fe: Fix as10x_register_addr packing'
+  mainline: 309422d280748c74f57f471559980268ac27732a
+  upstream: 86b769452b39428807f287ff5bb5aaf6fbfb7e9c
+763d3cd7f083891a68cf5158c5bab81bb5e8be0f:
+  title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()'
+  mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145
+  upstream: 213375679632f6ed1e4eb98b78a8f600977b9b34
+f3829e3d794cad5ddb6c88e0ff1b27b6435d224b:
+  title: 'IB/core: Implement a limit on UMAD receive List'
+  mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894
+  upstream: 1288cf1cceb0e6df276e182f5412370fb4169bcb
+8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88:
+  title: 'media: dw2102: Don''t translate i2c read into write'
+  mainline: 0e148a522b8453115038193e19ec7bea71403e4a
+  upstream: 74eb7ec7afe976a499484f56e8af020c3260a559
+fca275dacc79b9d77ec45e208a68284a19515d5f:
+  title: 'sctp: prefer struct_size over open coded arithmetic'
+  mainline: e5c5f3596de224422561d48eba6ece5210d967b3
+  upstream: 03f37e56305156bd25c5c237d1cc7f5c75495ef2
+b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3:
+  title: 'firmware: dmi: Stop decoding on broken entry'
+  mainline: 0ef11f604503b1862a21597436283f158114d77e
+  upstream: c2a350a3fa622a174e3704691d05989cdfde4d51
+d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f:
+  title: 'Input: ff-core - prefer struct_size over open coded arithmetic'
+  mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307
+  upstream: e52cfcf68df0b52565be68106e9f65ab8077b48a
+9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874:
+  title: 'net: dsa: mv88e6xxx: Correct check for empty list'
+  mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b
+  upstream: 47d28dde172696031c880c5778633cdca30394ee
+a65c17e8b9fe25ecae58373ddbea9fe06135f193:
+  title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div'
+  mainline: e9a844632630e18ed0671a7e3467431bd719952e
+  upstream: 2401cbc0f5d4bd1e327d247548cc6ee57bc76c53
+909138842fcc6194732efcd7e9d6ab4b9b715600:
+  title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels'
+  mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0
+  upstream: 32f2f5385eefa73aaebefda419147ac8599ba9e6
+cf654f32bbef8fd9d7d57d91a3378370a975e85f:
+  title: 'media: dvb-frontends: tda10048: Fix integer overflow'
+  mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07
+  upstream: 8167e4d7dc086d4f7ca7897dcff3827e4d22c99a
+f5a529216e877313cde4f8a3fc637c816642e861:
+  title: 'i2c: i801: Annotate apanel_addr as __ro_after_init'
+  mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d
+  upstream: 1a1f7053437d0f27534ecc9ec7e5d441c082b81c
+af94a2ea5b6eb5ead8c016a196311449e0e145ac:
+  title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n'
+  mainline: be140f1732b523947425aaafbe2e37b41b622d96
+  upstream: 85cc3ecb0b1256d539bb6a58a5f995c802a331c4
+b490b0a094cb6b1e6dc7c79ef9c76213480e03e8:
+  title: 'orangefs: fix out-of-bounds fsid access'
+  mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517
+  upstream: b90176a9553775e23966650e445b1866e62e4924
+48d99fb324e4d263c533ae24712372138c5cb664:
+  title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"'
+  mainline: 8873aab8646194a4446117bb617cc71bddda2dee
+  upstream: 04b90b8d0b6929d7427551215b71901959c8e098
+7523a69d10eba34a5bf215bbbf73b02932303c2b:
+  title: 'jffs2: Fix potential illegal address access in jffs2_free_inode'
+  mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830
+  upstream: b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8
+d232297f0376ff857296774d047ced0731895562:
+  title: 's390/pkey: Wipe sensitive data on failure'
+  mainline: 1d8c270de5eb74245d72325d285894a577a945d9
+  upstream: 6e2e374403bf73140d0efc9541cb1b3bea55ac02
+f1bac5dbfa7aaf5cee717a604ed1c94b363a9883:
+  title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()'
+  mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83
+  upstream: 8b5fd51b3040ce2596d22a72767c66d7435853b6
+f8f32610dabb5c07608475f3cfe4915aa4cd15e5:
+  title: 'tcp_metrics: validate source addr length'
+  mainline: 66be40e622e177316ae81717aa30057ba9e61dff
+  upstream: 19d997b59fa1fd7a02e770ee0881c0652b9c32c9
+ea462f7627ecabdd4263965f5a8864f0ab86d08b:
+  title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()'
+  mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d
+  upstream: 6a8a4fd082c439e19fede027e80c79bc4c84bb8e
+a8987b87ffb8455fddf7b29734f043256d589a34:
+  title: 'selftests/net: reap zerocopy completions passed up as ancillary data.'
+c75d2712b73df3ce9a145395882cee0d56f8916f:
+  title: 'selftests: fix OOM in msg_zerocopy selftest'
+  mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241
+  upstream: d6ab0198fb470e1a9948d08c610a94601a1fdb2c
+3688bfa238e9ea94bff46c0dc030f412f239a08c:
+  title: 'selftests: make order checking verbose in msg_zerocopy selftest'
+  mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219
+  upstream: b1cb48187a6edc2ab72f5b3e6b4af7a232730d64
+600edf70c16cb29b82c9fd1e830398168eea7bca:
+  title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2'
+  mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f
+  upstream: 7094a5fd20ab66028f1da7f06e0f2692d70346f9
+72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0:
+  title: 'nilfs2: fix inode number range checks'
+  mainline: e2fec219a36e0993642844be0f345513507031f4
+  upstream: 57235c3c88bb430043728d0d02f44a4efe386476
+ba6206b639aa6f1d9ade9cb55831ebc1f7268594:
+  title: 'nilfs2: add missing check for inode numbers on directory entries'
+  mainline: bb76c6c274683c8570ad788f79d4b875bde0e458
+  upstream: c33c2b0d92aa1c2262d999b2598ad6fbd53bd479
+34096341954fed86e3b510d1c0617470f21bb41d:
+  title: 'mm: optimize the redundant loop of mm_update_owner_next()'
+  mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1
+  upstream: 2890a7faf552dd3e4e40e343610ba3e0ba5b788e
+1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21:
+  title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt'
+  mainline: cd9151b618da4723877bd94eae952f2e50acbc0e
+  upstream: b162f19e6603571061b19dbb604a9883f0fa4ecc
+73f492747cfcd09e43ef25970d26c8943ab830ec:
+  title: 'fsnotify: Do not generate events for O_PATH file descriptors'
+  mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9
+  upstream: b7421cad1d8725831a98b339d7ecbb284dd1c5de
+6949c5283758b9d0847b1ce1d461e9c7d2730fa1:
+  title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"'
+  mainline: 30139c702048f1097342a31302cbd3d478f50c63
+  upstream: 253f9ea7e8e53a5176bd80ceb174907b10724c1a
+c300d28e4079a0046e79ff18bdffb48c7dee3861:
+  title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes'
+  mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4
+  upstream: 9baf60323efa992b7c915094529f0a1882c34e7e
+27967cf8362a84f47938fe7ff0ff57c991c858cc:
+  title: 'drm/amdgpu/atomfirmware: silence UBSAN warning'
+  mainline: d0417264437a8fa05f894cabba5a26715b32d78e
+  upstream: 385b615c95df14df68ca8322245c13a9389392f6
+a64eeaefb325e45890fca958151be84cfa53b633:
+  title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds'
+  mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7
+  upstream: cfb04472ce33bee2579caf4dc9f4242522f6e26e
+9c6553444512bcd2fdaf2b4153835f19f684f2c4:
+  title: 'media: dw2102: fix a potential buffer overflow'
+  mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d
+  upstream: 39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4
+900ede664c5f6c4194cc6a86558c291918c285dd:
+  title: 'i2c: pnx: move header into the driver'
+82043a1a1450176d4a5c5664b05ab1e7bfeed0ee:
+  title: 'i2c/busses: Convert timers to use timer_setup()'
+1921a68ba39c00e508c2b6fdd571d6fdeb6268e4:
+  title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr'
+  mainline: f63b94be6942ba82c55343e196bd09b53227618e
+  upstream: a349e5ab4dc9954746e836cd10b407ce48f9b2f6
+75fb795f98517dbdb2973414465cffa685d9cd8a:
+  title: 'nilfs2: fix incorrect inode allocation from reserved inodes'
+  mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1
+  upstream: de9d81daaca2b7b3c853bf2ff729353e84f06b18
+852460760459aec08d18bc7780f254f6f256606d:
+  title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit'
+  mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff
+  upstream: 83f5eb01c4beb9741bc1600bcd8b6e94a1774abe
+95139b5d59c4b6d6c56f39c2b4b4f26e22330000:
+  title: 'net: lantiq_etop: add blank line after declaration'
+  mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36
+  upstream: 12d204b835dd85c7fe6501be6ee1aaa1e5315ff9
+ae3b644b836cdcca258294db2569189af4ef7ff3:
+  title: 'net: ethernet: lantiq_etop: fix double free in detach'
+  mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69
+  upstream: 1a2db00a554cfda57c397cce79b2804bf9633fec
+84f3c0bb96cd91096079828b24b51af408265abe:
+  title: 'ppp: reject claimed-as-LCP but actually malformed packets'
+  mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55
+  upstream: 97d1efd8be26615ff680cdde86937d5943138f37
+4e591539244c71973243bd4315024d601991ee3a:
+  title: 'ARM: davinci: Convert comma to semicolon'
+  mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c
+  upstream: f9ace6a3278a613d22abbd7d69e13d481b800622
+400d7f0eceb6a1993c04f36ee766abff02f975b8:
+  title: 'USB: serial: option: add Telit generic core-dump composition'
+  mainline: 4298e400dbdbf259549d69c349e060652ad53611
+  upstream: a88697c3871ade2c9d03437d170af77ec92d2982
+4094a8160b0626b4fc428b2770adcd99652a9117:
+  title: 'USB: serial: option: add Telit FN912 rmnet compositions'
+  mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d
+  upstream: 908bc2cb55f8affc7a90bb8d17fd4323088e2a19
+01b762bc1225b0a0ffb18638161627cb185ce408:
+  title: 'USB: serial: option: add Fibocom FM350-GL'
+  mainline: 2604e08ff251dba330e16b65e80074c9c540aad7
+  upstream: de307ab87774c96700fa1831f78f5085255c35f8
+4dd077fc35bd45cb3763b56b29397495aa60e832:
+  title: 'USB: serial: option: add support for Foxconn T99W651'
+  mainline: 3c841d54b63e4446383de3238399a3910e47d8e2
+  upstream: 9fde2ddfed4787728a20aefea6a625c6b2b32fc4
+e8c421c3e622eec18fb2a723b3801e041094e76b:
+  title: 'USB: serial: option: add Netprisma LCUK54 series modules'
+  mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d
+  upstream: 038d9a89fac14fd9855383b2ae990ee755e36bd0
+bb8ef9c34dbad9828e35221d9b93887f81fedf61:
+  title: 'USB: serial: option: add Rolling RW350-GL variants'
+  mainline: ae420771551bd9f04347c59744dd062332bdec3e
+  upstream: 5bc1f4bee4d84245a3479f53aef38f82b99a19f0
+af79b0b19953f31e510d5330cb6d3bb246b096a2:
+  title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k'
+  mainline: 3859e85de30815a20bce7db712ce3d94d40a682d
+  upstream: 1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1
+4a1cba1a65533b8f9ece63c774c0bd1d265e14bf:
+  title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()'
+  mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0
+  upstream: a444c3fc264119801575ab086e03fb4952f23fd0
+d60eb2fd2445dd07125d1e450aa4c310d5baf190:
+  title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor'
+  mainline: a368ecde8a5055b627749b09c6218ef793043e47
+  upstream: d8418fd083d1b90a6c007cf8dcf81aeae274727b
+a43cf7b341011779151d27dd5bc52387d5f5f835:
+  title: 'hpet: Support 32-bit userspace'
+  mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8
+  upstream: e2cb94465de92f6a840bc7eface420b30cc64aa0
+c618a1f6d3ecaa97aaf0283d9b89824e651bc013:
+  title: 'libceph: fix race between delayed_work() and ceph_monc_stop()'
+  mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883
+  upstream: 1177afeca833174ba83504688eec898c6214f4bf
+bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279:
+  title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()'
+  mainline: 36534d3c54537bf098224a32dc31397793d4594d
+  upstream: 0fe6516462392ffe355a45a1ada8d264a783430f
+2a8372159bc037d3c15b66659a35ca18a0a61d98:
+  title: 'nilfs2: fix kernel bug on rename operation of broken directory'
+  mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4
+  upstream: ff9767ba2cb949701e45e6e4287f8af82986b703
+e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23:
+  title: 'i2c: rcar: bring hardware to known state when probing'
+  mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031
+  upstream: a291702b35433e4948476b79c034a21fd2b5ebc8

.elts/meta/4.14.352.yaml

@@ -0,0 +1,122 @@
+c133012a813396eefedf1bfa049efe8015b98812:
+  title: 'gcc-plugins: Rename last_stmt() for GCC 14+'
+  mainline: 2e3f65ccfe6b0778b261ad69c9603ae85f210334
+  upstream: 2d05669ce1f18c1bc51476980a0e8bd107682546
+2eb33ecdc2e4a03f4b673a04428924293b58cd7e:
+  title: 'scsi: qedf: Set qed_slowpath_params to zero before use'
+  mainline: 6c3bb589debd763dc4b94803ddf3c13b4fcca776
+  upstream: 9656f9540fa3949dfb65e9f18d263bbd96778831
+7af36fe3934a05c3df07dac10732c2f2097fa9eb:
+  title: 'ACPI: EC: Abort address space access upon error'
+  mainline: f6f172dc6a6d7775b2df6adfd1350700e9a847ec
+  upstream: 52a1125633abf465f59d184020add71616b87efa
+af32f802de713de4b0a2b4f6e97c8e1ca9dfc758:
+  title: 'ACPI: EC: Avoid returning AE_OK on errors in address space handler'
+  mainline: c4bd7f1d78340e63de4d073fd3dbe5391e2996e5
+  upstream: 286b25bf40251e940756371eae6c7e59fdbd6745
+2fac830d7e5b9250a13d556a1d5125a1a2b351b4:
+  title: 'wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata'
+  mainline: 6f6291f09a322c1c1578badac8072d049363f4e6
+  upstream: 46487275e810d1e7c99f36af9fdfae0909c4e200
+60882d697cfb5c6868f24649c60b8dd8d2703668:
+  title: 'wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()'
+  mainline: 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699
+  upstream: cd3212a9e0209dff7eda30f01ab8590f5e8d92fb
+f995731405d60b4b3e3cb2c556625c5c3a786c8f:
+  title: 'Input: silead - add support for capactive home button found on some x86 tablets'
+1501ce3d5bfea3a1e8aaec61b878f20d8a93dfcb:
+  title: 'Input: silead - Always support 10 fingers'
+  mainline: 38a38f5a36da9820680d413972cb733349400532
+  upstream: ce0368a52554d213c5cd447ba786b54390a845e1
+6e6d94454bba0055f8d77d3bb42d49c369e80e95:
+  title: 'ila: block BH in ila_output()'
+  mainline: cf28ff8e4c02e1ffa850755288ac954b6ff0db8c
+  upstream: 7435bd2f84a25aba607030237261b3795ba782da
+265ba671aaff09b4531db6875d668dfb4efd716a:
+  title: 'kconfig: gconf: give a proper initial state to the Save button'
+  mainline: 46edf4372e336ef3a61c3126e49518099d2e2e6d
+  upstream: b6d6a91b584a022424d99264741bdfa6b336c83b
+692c2ebeacc0c82e6c088e5a6f63ff9395a2082e:
+  title: 'kconfig: remove wrong expr_trans_bool()'
+  mainline: 77a92660d8fe8d29503fae768d9f5eb529c88b36
+  upstream: b366d89859fe7b58894b3698844b551fe32f892a
+8d3da24eb73289dde20e54b84c848e61ae0138b0:
+  title: 'fs/file: fix the check in find_next_fd()'
+  mainline: ed8c7fbdfe117abbef81f65428ba263118ef298a
+  upstream: 5611e11988535125b3a05305680851ff587702a9
+cdb32323efca90437116ce55ba43da736ecad374:
+  title: 'mei: demote client disconnect warning on suspend to debug'
+  mainline: 1db5322b7e6b58e1b304ce69a50e9dca798ca95b
+  upstream: bd2a753fa12cf3d28726a4bf067398514e52d57c
+56e8fc1b0ac2a752cba13ccd0e128f7eaadcd8d0:
+  title: 'wifi: cfg80211: wext: add extra SIOCSIWSCAN data check'
+  mainline: 6ef09cdc5ba0f93826c09d810c141a8d103a80fc
+  upstream: b02ba9a0b55b762bd04743a22f3d9f9645005e79
+0eafa6b4fdf53fdc8b8924325f994fe4ed0700a7:
+  title: 'Input: elantech - fix touchpad state on resume for Lenovo N24'
+  mainline: a69ce592cbe0417664bc5a075205aa75c2ec1273
+  upstream: 9b6a1cb833dc8ceab3fbc45a261a8dd37c4f8013
+2ba3ceb092c9ac54204c7416bfa884d37f59bd1a:
+  title: 's390/sclp: Fix sclp_init() cleanup on failure'
+  mainline: 6434b33faaa063df500af355ee6c3942e0f8d982
+  upstream: a778987afc36d5dc02a1f82d352a81edcaf7eb83
+f78b195536a163671b4aa1b85b88e432919c79f9:
+  title: 'ALSA: dmaengine_pcm: terminate dmaengine before synchronize'
+  mainline: 6a7db25aad8ce6512b366d2ce1d0e60bac00a09d
+  upstream: fe0a6e7eb38f9d5396f6ff548186a6cd62c08b1a
+c16c01ccdd91f3d7764c0e63da5ba2274eb031a8:
+  title: 'net: usb: qmi_wwan: add Telit FN912 compositions'
+  mainline: 77453e2b015b5ced5b3f45364dd5a72dfc3bdecb
+  upstream: 6f5c552bb803ac30a746addc91b3da9b94b48c4d
+eef43c3ccb72817061d1c663129fc04ff09de4a6:
+  title: 'net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()'
+  mainline: b8ec0dc3845f6c9089573cb5c2c4b05f7fc10728
+  upstream: 77cfeb27b8ded33c3f4023a24a2d1517ad4e4893
+43df6e148cb43ad243a345291d8ddc2cea7786ce:
+  title: 'Bluetooth: hci_core: cancel all works upon hci_unregister_dev()'
+  mainline: 0d151a103775dd9645c78c97f77d6e2a5298d913
+  upstream: 48542881997e17b49dc16b93fe910e0cfcf7a9f9
+fe34d279afd5186910b42c6ccf419f32552f6eab:
+  title: 'fs: better handle deep ancestor chains in is_subdir()'
+  mainline: 391b59b045004d5b985d033263ccba3e941a7740
+  upstream: a5c4645346b0efb5a10ed28ae281a9af29037608
+4e4a79155c2fe74dd5aea4e56b96923d39d50408:
+  title: 'spi: imx: Don''t expect DMA for i.MX{25,35,50,51,53} cspi devices'
+  mainline: ce1dac560a74220f2e53845ec0723b562288aed4
+  upstream: 4f5e56dddabe947cc840ffb2db60d9df6ca9e8b9
+010cabb684a2904c698713694a24cb0c99d24f41:
+  title: 'selftests/vDSO: fix clang build errors and warnings'
+  mainline: 73810cd45b99c6c418e1c6a487b52c1e74edb20d
+  upstream: d5e9dddd18fdfe04772bce07d4a34e39e7b1e402
+7cc7fff373ff4131e0db0e9f099913b524cd0275:
+  title: 'hfsplus: fix uninit-value in copy_name'
+  mainline: 0570730c16307a72f8241df12363f76600baf57d
+  upstream: 72805debec8f7aa342da194fe0ed7bc8febea335
+0092a371ee34e3dc89e46d1267ee614d60026158:
+  title: 'filelock: Remove locks reliably when fcntl/close race is detected'
+  mainline: 3cad1bc010416c6dd780643476bc59ed742436b9
+  upstream: d30ff33040834c3b9eee29740acd92f9c7ba2250
+a650c33ed9edba733de822a47397ead4c1ebc2fb:
+  title: 'ARM: 9324/1: fix get_user() broken with veneer'
+  mainline: 24d3ba0a7b44c1617c27f5045eecc4f34752ab03
+  upstream: 41a5c1717bf4ad1b6084e8682de64b178eabc059
+f70e0950f817b75ed1f01859f15d9c2b6a37dba2:
+  title: 'ACPI: processor_idle: Fix invalid comparison with insertion sort for latency'
+  mainline: 233323f9b9f828cd7cd5145ad811c1990b692542
+  upstream: c9d6e349f7aad4ab9c557047d357df256c15f25e
+aac14d323840fa0e71308002c051ce8174804c77:
+  title: 'net: relax socket state check at accept time.'
+  mainline: 26afda78cda3da974fd4c287962c169e9462c495
+  upstream: 7de00adc9bd035d861ba4177848ca0bfa5ed1e04
+3c99e72be6bf85c5e3e19ddf0e1a38a9eebbd4a6:
+  title: 'ocfs2: add bounds checking to ocfs2_check_dir_entry()'
+  mainline: 255547c6bb8940a97eea94ef9d464ea5967763fb
+  upstream: 13d38c00df97289e6fba2e54193959293fd910d2
+7f65c3bae2493c58ef7d6ef1bf9ce717c71fb87d:
+  title: 'jfs: don''t walk off the end of ealist'
+  mainline: d0fa70aca54c8643248e89061da23752506ec0d4
+  upstream: 7f91bd0f2941fa36449ce1a15faaa64f840d9746
+a429e9177821cfc3fc4b316b64e431ae613319c3:
+  title: 'filelock: Fix fcntl/close race recovery compat path'
+  mainline: f8138f2ad2f745b9a1c696a05b749eabe44337ea
+  upstream: a561145f3ae973ebf3e0aee41624e92a6c5cb38d

.elts/upstream/4.19.318.yaml

@@ -0,0 +1,264 @@
+a8a223aa3fb7790168fbf777a8db5bcef011b4dc:
+  title: 'asm-generic: Move common compat types to asm-generic/compat.h'
+  mainline: fb3739759474d150a9927b920a80ea2afb4c2a51
+  skipped: not stable material
+86b769452b39428807f287ff5bb5aaf6fbfb7e9c:
+  title: 'media: dvb: as102-fe: Fix as10x_register_addr packing'
+  mainline: 309422d280748c74f57f471559980268ac27732a
+  backport: a29d61e7e8e578fd6bc893e3fc566de319821ca5
+213375679632f6ed1e4eb98b78a8f600977b9b34:
+  title: 'media: dvb-usb: dib0700_devices: Add missing release_firmware()'
+  mainline: 4b267c23ee064bd24c6933df0588ad1b6e111145
+  backport: 763d3cd7f083891a68cf5158c5bab81bb5e8be0f
+1288cf1cceb0e6df276e182f5412370fb4169bcb:
+  title: 'IB/core: Implement a limit on UMAD receive List'
+  mainline: ca0b44e20a6f3032224599f02e7c8fb49525c894
+  backport: f3829e3d794cad5ddb6c88e0ff1b27b6435d224b
+9eb4db08a808e3a3ba59193aeb84a57a6dc4d8c9:
+  title: 'drm/amd/display: Skip finding free audio for unknown engine_id'
+  mainline: 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3
+  skipped: patched file is not in 4.14.y
+74eb7ec7afe976a499484f56e8af020c3260a559:
+  title: 'media: dw2102: Don''t translate i2c read into write'
+  mainline: 0e148a522b8453115038193e19ec7bea71403e4a
+  backport: 8fb8547e74c70ef7ed9af6d75f8b27186d6c1d88
+03f37e56305156bd25c5c237d1cc7f5c75495ef2:
+  title: 'sctp: prefer struct_size over open coded arithmetic'
+  mainline: e5c5f3596de224422561d48eba6ece5210d967b3
+  backport: fca275dacc79b9d77ec45e208a68284a19515d5f
+c2a350a3fa622a174e3704691d05989cdfde4d51:
+  title: 'firmware: dmi: Stop decoding on broken entry'
+  mainline: 0ef11f604503b1862a21597436283f158114d77e
+  backport: b0f4f0d200c9bcb8c14b1f09a288dc89d026fdc3
+e52cfcf68df0b52565be68106e9f65ab8077b48a:
+  title: 'Input: ff-core - prefer struct_size over open coded arithmetic'
+  mainline: a08b8f8557ad88ffdff8905e5da972afe52e3307
+  backport: d2b33d0a14125c60fb7fc2fe60e7305ef606bc7f
+47d28dde172696031c880c5778633cdca30394ee:
+  title: 'net: dsa: mv88e6xxx: Correct check for empty list'
+  mainline: 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b
+  backport: 9c1cb2b6cbf9a9e1ee2e9702637c71adc476e874
+2401cbc0f5d4bd1e327d247548cc6ee57bc76c53:
+  title: 'media: dvb-frontends: tda18271c2dd: Remove casting during div'
+  mainline: e9a844632630e18ed0671a7e3467431bd719952e
+  backport: a65c17e8b9fe25ecae58373ddbea9fe06135f193
+32f2f5385eefa73aaebefda419147ac8599ba9e6:
+  title: 'media: s2255: Use refcount_t instead of atomic_t for num_channels'
+  mainline: 6cff72f6bcee89228a662435b7c47e21a391c8d0
+  backport: 909138842fcc6194732efcd7e9d6ab4b9b715600
+8167e4d7dc086d4f7ca7897dcff3827e4d22c99a:
+  title: 'media: dvb-frontends: tda10048: Fix integer overflow'
+  mainline: 1aa1329a67cc214c3b7bd2a14d1301a795760b07
+  backport: cf654f32bbef8fd9d7d57d91a3378370a975e85f
+1a1f7053437d0f27534ecc9ec7e5d441c082b81c:
+  title: 'i2c: i801: Annotate apanel_addr as __ro_after_init'
+  mainline: 355b1513b1e97b6cef84b786c6480325dfd3753d
+  backport: f5a529216e877313cde4f8a3fc637c816642e861
+85cc3ecb0b1256d539bb6a58a5f995c802a331c4:
+  title: 'powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n'
+  mainline: be140f1732b523947425aaafbe2e37b41b622d96
+  backport: af94a2ea5b6eb5ead8c016a196311449e0e145ac
+b90176a9553775e23966650e445b1866e62e4924:
+  title: 'orangefs: fix out-of-bounds fsid access'
+  mainline: 53e4efa470d5fc6a96662d2d3322cfc925818517
+  backport: b490b0a094cb6b1e6dc7c79ef9c76213480e03e8
+04b90b8d0b6929d7427551215b71901959c8e098:
+  title: 'powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"'
+  mainline: 8873aab8646194a4446117bb617cc71bddda2dee
+  backport: 48d99fb324e4d263c533ae24712372138c5cb664
+b6c8b3e31eb88c85094d848a0bd8b4bafe67e4d8:
+  title: 'jffs2: Fix potential illegal address access in jffs2_free_inode'
+  mainline: af9a8730ddb6a4b2edd779ccc0aceb994d616830
+  backport: 7523a69d10eba34a5bf215bbbf73b02932303c2b
+6e2e374403bf73140d0efc9541cb1b3bea55ac02:
+  title: 's390/pkey: Wipe sensitive data on failure'
+  mainline: 1d8c270de5eb74245d72325d285894a577a945d9
+  backport: d232297f0376ff857296774d047ced0731895562
+0cb018bf9217805f97740fe83261e18199fc2773:
+  title: 'tcp: take care of compressed acks in tcp_add_reno_sack()'
+  mainline: 19119f298bb1f2af3bb1093f5f2a1fed8da94e37
+  skipped: commit did not cherry-pick cleanly
+552970cb728120695820ef9decb0933b3f9ce774:
+  title: 'tcp: tcp_mark_head_lost is only valid for sack-tcp'
+  mainline: 636ef28d6e4d174e424102466caf572b0406fb0e
+  skipped: commit did not cherry-pick cleanly
+57a672a35020884512ae64fbbcb5c70149424781:
+  title: 'tcp: add ece_ack flag to reno sack functions'
+  mainline: c634e34f6ebfb75259e6ce467523fd3adf30d3d2
+  skipped: commit did not cherry-pick cleanly
+550968385e2f0df8e29c6431ab2dc0961499acb0:
+  title: 'net: tcp better handling of reordering then loss cases'
+  mainline: a29cb6914681a55667436a9eb7a42e28da8cf387
+  skipped: commit did not cherry-pick cleanly
+8b5fd51b3040ce2596d22a72767c66d7435853b6:
+  title: 'UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()'
+  mainline: a6458ab7fd4f427d4f6f54380453ad255b7fde83
+  backport: f1bac5dbfa7aaf5cee717a604ed1c94b363a9883
+19d997b59fa1fd7a02e770ee0881c0652b9c32c9:
+  title: 'tcp_metrics: validate source addr length'
+  mainline: 66be40e622e177316ae81717aa30057ba9e61dff
+  backport: f8f32610dabb5c07608475f3cfe4915aa4cd15e5
+6a8a4fd082c439e19fede027e80c79bc4c84bb8e:
+  title: 'bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()'
+  mainline: e271ff53807e8f2c628758290f0e499dbe51cb3d
+  backport: ea462f7627ecabdd4263965f5a8864f0ab86d08b
+d6ab0198fb470e1a9948d08c610a94601a1fdb2c:
+  title: 'selftests: fix OOM in msg_zerocopy selftest'
+  mainline: af2b7e5b741aaae9ffbba2c660def434e07aa241
+  backport: c75d2712b73df3ce9a145395882cee0d56f8916f
+b1cb48187a6edc2ab72f5b3e6b4af7a232730d64:
+  title: 'selftests: make order checking verbose in msg_zerocopy selftest'
+  mainline: 7d6d8f0c8b700c9493f2839abccb6d29028b4219
+  backport: 3688bfa238e9ea94bff46c0dc030f412f239a08c
+7094a5fd20ab66028f1da7f06e0f2692d70346f9:
+  title: 'inet_diag: Initialize pad field in struct inet_diag_req_v2'
+  mainline: 61cf1c739f08190a4cbf047b9fbb192a94d87e3f
+  backport: 600edf70c16cb29b82c9fd1e830398168eea7bca
+57235c3c88bb430043728d0d02f44a4efe386476:
+  title: 'nilfs2: fix inode number range checks'
+  mainline: e2fec219a36e0993642844be0f345513507031f4
+  backport: 72ae23ea4ee2e943e8d58ad302c6a843dbf80ad0
+c33c2b0d92aa1c2262d999b2598ad6fbd53bd479:
+  title: 'nilfs2: add missing check for inode numbers on directory entries'
+  mainline: bb76c6c274683c8570ad788f79d4b875bde0e458
+  backport: ba6206b639aa6f1d9ade9cb55831ebc1f7268594
+2890a7faf552dd3e4e40e343610ba3e0ba5b788e:
+  title: 'mm: optimize the redundant loop of mm_update_owner_next()'
+  mainline: cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1
+  backport: 34096341954fed86e3b510d1c0617470f21bb41d
+b162f19e6603571061b19dbb604a9883f0fa4ecc:
+  title: 'Bluetooth: Fix incorrect pointer arithmatic in ext_adv_report_evt'
+  mainline: cd9151b618da4723877bd94eae952f2e50acbc0e
+  backport: 1cbdc455dc33b76a9efdf4694308b2b1c8ea5a21
+a7428ec9d7911f1a74da20359063ff265081832a:
+  title: 'can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct'
+  mainline: 19d5b2698c35b2132a355c67b4d429053804f8cc
+  skipped: fixes patch not in branch
+b7421cad1d8725831a98b339d7ecbb284dd1c5de:
+  title: 'fsnotify: Do not generate events for O_PATH file descriptors'
+  mainline: 702eb71fd6501b3566283f8c96d7ccc6ddd662e9
+  backport: 73f492747cfcd09e43ef25970d26c8943ab830ec
+253f9ea7e8e53a5176bd80ceb174907b10724c1a:
+  title: 'Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"'
+  mainline: 30139c702048f1097342a31302cbd3d478f50c63
+  backport: 6949c5283758b9d0847b1ce1d461e9c7d2730fa1
+9baf60323efa992b7c915094529f0a1882c34e7e:
+  title: 'drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes'
+  mainline: 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4
+  backport: c300d28e4079a0046e79ff18bdffb48c7dee3861
+385b615c95df14df68ca8322245c13a9389392f6:
+  title: 'drm/amdgpu/atomfirmware: silence UBSAN warning'
+  mainline: d0417264437a8fa05f894cabba5a26715b32d78e
+  backport: 27967cf8362a84f47938fe7ff0ff57c991c858cc
+cfb04472ce33bee2579caf4dc9f4242522f6e26e:
+  title: 'bnx2x: Fix multiple UBSAN array-index-out-of-bounds'
+  mainline: 134061163ee5ca4759de5c24ca3bd71608891ba7
+  backport: a64eeaefb325e45890fca958151be84cfa53b633
+39fb2a0c2e78d9b2de726be119e6d06e38aa4ed4:
+  title: 'media: dw2102: fix a potential buffer overflow'
+  mainline: 1c73d0b29d04bf4082e7beb6a508895e118ee30d
+  backport: 9c6553444512bcd2fdaf2b4153835f19f684f2c4
+a349e5ab4dc9954746e836cd10b407ce48f9b2f6:
+  title: 'i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr'
+  mainline: f63b94be6942ba82c55343e196bd09b53227618e
+  backport: 1921a68ba39c00e508c2b6fdd571d6fdeb6268e4
+de9d81daaca2b7b3c853bf2ff729353e84f06b18:
+  title: 'nilfs2: fix incorrect inode allocation from reserved inodes'
+  mainline: 93aef9eda1cea9e84ab2453fcceb8addad0e46f1
+  backport: 75fb795f98517dbdb2973414465cffa685d9cd8a
+f0d7f98ff88c26698296f62fe91d7e7141fe4a47:
+  title: 'drm/i915: make find_fw_domain work on intel_uncore'
+  mainline: cb7ee69015aaba5e1091af94e73bc72483c08e37
+  skipped: fixes new functionality not in 4.14
+83f5eb01c4beb9741bc1600bcd8b6e94a1774abe:
+  title: 'tcp: fix incorrect undo caused by DSACK of TLP retransmit'
+  mainline: 0ec986ed7bab6801faed1440e8839dcc710331ff
+  backport: 852460760459aec08d18bc7780f254f6f256606d
+12d204b835dd85c7fe6501be6ee1aaa1e5315ff9:
+  title: 'net: lantiq_etop: add blank line after declaration'
+  mainline: 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36
+  backport: 95139b5d59c4b6d6c56f39c2b4b4f26e22330000
+1a2db00a554cfda57c397cce79b2804bf9633fec:
+  title: 'net: ethernet: lantiq_etop: fix double free in detach'
+  mainline: e1533b6319ab9c3a97dad314dd88b3783bc41b69
+  backport: ae3b644b836cdcca258294db2569189af4ef7ff3
+97d1efd8be26615ff680cdde86937d5943138f37:
+  title: 'ppp: reject claimed-as-LCP but actually malformed packets'
+  mainline: f2aeb7306a898e1cbd03963d376f4b6656ca2b55
+  backport: 84f3c0bb96cd91096079828b24b51af408265abe
+f9ace6a3278a613d22abbd7d69e13d481b800622:
+  title: 'ARM: davinci: Convert comma to semicolon'
+  mainline: acc3815db1a02d654fbc19726ceaadca0d7dd81c
+  backport: 4e591539244c71973243bd4315024d601991ee3a
+a88697c3871ade2c9d03437d170af77ec92d2982:
+  title: 'USB: serial: option: add Telit generic core-dump composition'
+  mainline: 4298e400dbdbf259549d69c349e060652ad53611
+  backport: 400d7f0eceb6a1993c04f36ee766abff02f975b8
+908bc2cb55f8affc7a90bb8d17fd4323088e2a19:
+  title: 'USB: serial: option: add Telit FN912 rmnet compositions'
+  mainline: 9a590ff283421b71560deded2110dbdcbe1f7d1d
+  backport: 4094a8160b0626b4fc428b2770adcd99652a9117
+de307ab87774c96700fa1831f78f5085255c35f8:
+  title: 'USB: serial: option: add Fibocom FM350-GL'
+  mainline: 2604e08ff251dba330e16b65e80074c9c540aad7
+  backport: 01b762bc1225b0a0ffb18638161627cb185ce408
+9fde2ddfed4787728a20aefea6a625c6b2b32fc4:
+  title: 'USB: serial: option: add support for Foxconn T99W651'
+  mainline: 3c841d54b63e4446383de3238399a3910e47d8e2
+  backport: 4dd077fc35bd45cb3763b56b29397495aa60e832
+038d9a89fac14fd9855383b2ae990ee755e36bd0:
+  title: 'USB: serial: option: add Netprisma LCUK54 series modules'
+  mainline: dc6dbe3ed28795b01c712ad8f567728f9c14b01d
+  backport: e8c421c3e622eec18fb2a723b3801e041094e76b
+5bc1f4bee4d84245a3479f53aef38f82b99a19f0:
+  title: 'USB: serial: option: add Rolling RW350-GL variants'
+  mainline: ae420771551bd9f04347c59744dd062332bdec3e
+  backport: bb8ef9c34dbad9828e35221d9b93887f81fedf61
+1d1f3d602971bbb8de654e7bbe78bf6c2ebd06c1:
+  title: 'USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k'
+  mainline: 3859e85de30815a20bce7db712ce3d94d40a682d
+  backport: af79b0b19953f31e510d5330cb6d3bb246b096a2
+a444c3fc264119801575ab086e03fb4952f23fd0:
+  title: 'usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()'
+  mainline: 6d3c721e686ea6c59e18289b400cc95c76e927e0
+  backport: 4a1cba1a65533b8f9ece63c774c0bd1d265e14bf
+d8418fd083d1b90a6c007cf8dcf81aeae274727b:
+  title: 'USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor'
+  mainline: a368ecde8a5055b627749b09c6218ef793043e47
+  backport: d60eb2fd2445dd07125d1e450aa4c310d5baf190
+e2cb94465de92f6a840bc7eface420b30cc64aa0:
+  title: 'hpet: Support 32-bit userspace'
+  mainline: 4e60131d0d36af65ab9c9144f4f163fe97ae36e8
+  backport: a43cf7b341011779151d27dd5bc52387d5f5f835
+1177afeca833174ba83504688eec898c6214f4bf:
+  title: 'libceph: fix race between delayed_work() and ceph_monc_stop()'
+  mainline: 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883
+  backport: c618a1f6d3ecaa97aaf0283d9b89824e651bc013
+e5a1f7427f97bde4bda73c02106c3bde87696f8f:
+  title: 'tcp: refactor tcp_retransmit_timer()'
+  mainline: 0d580fbd2db084a5c96ee9c00492236a279d5e0f
+  skipped: squashed into 6d9175b95504d28045909631514d06660b4b1a9a
+faa0a1fc2a0bb510b2381a5c7aa5b46e9a83d64a:
+  title: 'net: tcp: fix unexcepted socket die when snd_wnd is 0'
+  mainline: e89688e3e97868451a5d05b38a9d2633d6785cd4
+  skipped: commit is already present in branch
+0fe6516462392ffe355a45a1ada8d264a783430f:
+  title: 'tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()'
+  mainline: 36534d3c54537bf098224a32dc31397793d4594d
+  backport: bd19e77de5e3d3c721c8dc55e0d7f1b6a0117279
+7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4:
+  title: 'tcp: avoid too many retransmit packets'
+  mainline: 97a9063518f198ec0adb2ecb89789de342bb8283
+  skipped: fixes patch not in branch
+17866066b8ac1cc38fb449670bc15dc9fee4b40a:
+  title: 'SUNRPC: Fix RPC client cleaned up the freed pipefs dentries'
+  mainline: bfca5fb4e97c46503ddfc582335917b0cc228264
+  skipped: commit is already present in branch
+ff9767ba2cb949701e45e6e4287f8af82986b703:
+  title: 'nilfs2: fix kernel bug on rename operation of broken directory'
+  mainline: a9e1ddc09ca55746079cc479aa3eb6411f0d99d4
+  backport: 2a8372159bc037d3c15b66659a35ca18a0a61d98
+a291702b35433e4948476b79c034a21fd2b5ebc8:
+  title: 'i2c: rcar: bring hardware to known state when probing'
+  mainline: 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031
+  backport: e0aa415e86deeac3ffde591fc5fd5e4a13e9ff23

.elts/upstream/4.19.319.yaml

@@ -0,0 +1,128 @@
+2d05669ce1f18c1bc51476980a0e8bd107682546:
+  title: 'gcc-plugins: Rename last_stmt() for GCC 14+'
+  mainline: 2e3f65ccfe6b0778b261ad69c9603ae85f210334
+  backport: c133012a813396eefedf1bfa049efe8015b98812
+9656f9540fa3949dfb65e9f18d263bbd96778831:
+  title: 'scsi: qedf: Set qed_slowpath_params to zero before use'
+  mainline: 6c3bb589debd763dc4b94803ddf3c13b4fcca776
+  backport: 2eb33ecdc2e4a03f4b673a04428924293b58cd7e
+52a1125633abf465f59d184020add71616b87efa:
+  title: 'ACPI: EC: Abort address space access upon error'
+  mainline: f6f172dc6a6d7775b2df6adfd1350700e9a847ec
+  backport: 7af36fe3934a05c3df07dac10732c2f2097fa9eb
+286b25bf40251e940756371eae6c7e59fdbd6745:
+  title: 'ACPI: EC: Avoid returning AE_OK on errors in address space handler'
+  mainline: c4bd7f1d78340e63de4d073fd3dbe5391e2996e5
+  backport: af32f802de713de4b0a2b4f6e97c8e1ca9dfc758
+46487275e810d1e7c99f36af9fdfae0909c4e200:
+  title: 'wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata'
+  mainline: 6f6291f09a322c1c1578badac8072d049363f4e6
+  backport: 2fac830d7e5b9250a13d556a1d5125a1a2b351b4
+cd3212a9e0209dff7eda30f01ab8590f5e8d92fb:
+  title: 'wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()'
+  mainline: 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699
+  backport: 60882d697cfb5c6868f24649c60b8dd8d2703668
+ce0368a52554d213c5cd447ba786b54390a845e1:
+  title: 'Input: silead - Always support 10 fingers'
+  mainline: 38a38f5a36da9820680d413972cb733349400532
+  backport: 1501ce3d5bfea3a1e8aaec61b878f20d8a93dfcb
+7435bd2f84a25aba607030237261b3795ba782da:
+  title: 'ila: block BH in ila_output()'
+  mainline: cf28ff8e4c02e1ffa850755288ac954b6ff0db8c
+  backport: 6e6d94454bba0055f8d77d3bb42d49c369e80e95
+b6d6a91b584a022424d99264741bdfa6b336c83b:
+  title: 'kconfig: gconf: give a proper initial state to the Save button'
+  mainline: 46edf4372e336ef3a61c3126e49518099d2e2e6d
+  backport: 265ba671aaff09b4531db6875d668dfb4efd716a
+b366d89859fe7b58894b3698844b551fe32f892a:
+  title: 'kconfig: remove wrong expr_trans_bool()'
+  mainline: 77a92660d8fe8d29503fae768d9f5eb529c88b36
+  backport: 692c2ebeacc0c82e6c088e5a6f63ff9395a2082e
+5611e11988535125b3a05305680851ff587702a9:
+  title: 'fs/file: fix the check in find_next_fd()'
+  mainline: ed8c7fbdfe117abbef81f65428ba263118ef298a
+  backport: 8d3da24eb73289dde20e54b84c848e61ae0138b0
+bd2a753fa12cf3d28726a4bf067398514e52d57c:
+  title: 'mei: demote client disconnect warning on suspend to debug'
+  mainline: 1db5322b7e6b58e1b304ce69a50e9dca798ca95b
+  backport: cdb32323efca90437116ce55ba43da736ecad374
+b02ba9a0b55b762bd04743a22f3d9f9645005e79:
+  title: 'wifi: cfg80211: wext: add extra SIOCSIWSCAN data check'
+  mainline: 6ef09cdc5ba0f93826c09d810c141a8d103a80fc
+  backport: 56e8fc1b0ac2a752cba13ccd0e128f7eaadcd8d0
+9b6a1cb833dc8ceab3fbc45a261a8dd37c4f8013:
+  title: 'Input: elantech - fix touchpad state on resume for Lenovo N24'
+  mainline: a69ce592cbe0417664bc5a075205aa75c2ec1273
+  backport: 0eafa6b4fdf53fdc8b8924325f994fe4ed0700a7
+0405060fa24286e361cf784bfb37695e8dadc541:
+  title: 'bytcr_rt5640 : inverse jack detect for Archos 101 cesium'
+  mainline: e3209a1827646daaab744aa6a5767b1f57fb5385
+  skipped: commit did not cherry-pick cleanly
+0aa5858cb091344f149d1169f00d08b585fa70de:
+  title: 'can: kvaser_usb: fix return value for hif_usb_send_regout'
+  mainline: 0d34d8163fd87978a6abd792e2d8ad849f4c3d57
+  skipped: fixes code not in 4.14.y
+a778987afc36d5dc02a1f82d352a81edcaf7eb83:
+  title: 's390/sclp: Fix sclp_init() cleanup on failure'
+  mainline: 6434b33faaa063df500af355ee6c3942e0f8d982
+  backport: 2ba3ceb092c9ac54204c7416bfa884d37f59bd1a
+fe0a6e7eb38f9d5396f6ff548186a6cd62c08b1a:
+  title: 'ALSA: dmaengine_pcm: terminate dmaengine before synchronize'
+  mainline: 6a7db25aad8ce6512b366d2ce1d0e60bac00a09d
+  backport: f78b195536a163671b4aa1b85b88e432919c79f9
+6f5c552bb803ac30a746addc91b3da9b94b48c4d:
+  title: 'net: usb: qmi_wwan: add Telit FN912 compositions'
+  mainline: 77453e2b015b5ced5b3f45364dd5a72dfc3bdecb
+  backport: c16c01ccdd91f3d7764c0e63da5ba2274eb031a8
+77cfeb27b8ded33c3f4023a24a2d1517ad4e4893:
+  title: 'net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()'
+  mainline: b8ec0dc3845f6c9089573cb5c2c4b05f7fc10728
+  backport: eef43c3ccb72817061d1c663129fc04ff09de4a6
+48542881997e17b49dc16b93fe910e0cfcf7a9f9:
+  title: 'Bluetooth: hci_core: cancel all works upon hci_unregister_dev()'
+  mainline: 0d151a103775dd9645c78c97f77d6e2a5298d913
+  backport: 43df6e148cb43ad243a345291d8ddc2cea7786ce
+a5c4645346b0efb5a10ed28ae281a9af29037608:
+  title: 'fs: better handle deep ancestor chains in is_subdir()'
+  mainline: 391b59b045004d5b985d033263ccba3e941a7740
+  backport: fe34d279afd5186910b42c6ccf419f32552f6eab
+4f5e56dddabe947cc840ffb2db60d9df6ca9e8b9:
+  title: 'spi: imx: Don''t expect DMA for i.MX{25,35,50,51,53} cspi devices'
+  mainline: ce1dac560a74220f2e53845ec0723b562288aed4
+  backport: 4e4a79155c2fe74dd5aea4e56b96923d39d50408
+d5e9dddd18fdfe04772bce07d4a34e39e7b1e402:
+  title: 'selftests/vDSO: fix clang build errors and warnings'
+  mainline: 73810cd45b99c6c418e1c6a487b52c1e74edb20d
+  backport: 010cabb684a2904c698713694a24cb0c99d24f41
+72805debec8f7aa342da194fe0ed7bc8febea335:
+  title: 'hfsplus: fix uninit-value in copy_name'
+  mainline: 0570730c16307a72f8241df12363f76600baf57d
+  backport: 7cc7fff373ff4131e0db0e9f099913b524cd0275
+d30ff33040834c3b9eee29740acd92f9c7ba2250:
+  title: 'filelock: Remove locks reliably when fcntl/close race is detected'
+  mainline: 3cad1bc010416c6dd780643476bc59ed742436b9
+  backport: 0092a371ee34e3dc89e46d1267ee614d60026158
+41a5c1717bf4ad1b6084e8682de64b178eabc059:
+  title: 'ARM: 9324/1: fix get_user() broken with veneer'
+  mainline: 24d3ba0a7b44c1617c27f5045eecc4f34752ab03
+  backport: a650c33ed9edba733de822a47397ead4c1ebc2fb
+c9d6e349f7aad4ab9c557047d357df256c15f25e:
+  title: 'ACPI: processor_idle: Fix invalid comparison with insertion sort for latency'
+  mainline: 233323f9b9f828cd7cd5145ad811c1990b692542
+  backport: f70e0950f817b75ed1f01859f15d9c2b6a37dba2
+7de00adc9bd035d861ba4177848ca0bfa5ed1e04:
+  title: 'net: relax socket state check at accept time.'
+  mainline: 26afda78cda3da974fd4c287962c169e9462c495
+  backport: aac14d323840fa0e71308002c051ce8174804c77
+13d38c00df97289e6fba2e54193959293fd910d2:
+  title: 'ocfs2: add bounds checking to ocfs2_check_dir_entry()'
+  mainline: 255547c6bb8940a97eea94ef9d464ea5967763fb
+  backport: 3c99e72be6bf85c5e3e19ddf0e1a38a9eebbd4a6
+7f91bd0f2941fa36449ce1a15faaa64f840d9746:
+  title: 'jfs: don''t walk off the end of ealist'
+  mainline: d0fa70aca54c8643248e89061da23752506ec0d4
+  backport: 7f65c3bae2493c58ef7d6ef1bf9ce717c71fb87d
+a561145f3ae973ebf3e0aee41624e92a6c5cb38d:
+  title: 'filelock: Fix fcntl/close race recovery compat path'
+  mainline: f8138f2ad2f745b9a1c696a05b749eabe44337ea
+  backport: a429e9177821cfc3fc4b316b64e431ae613319c3

Documentation/devicetree/bindings/input/touchscreen/silead_gsl1680.txt

@@ -23,6 +23,8 @@ Optional properties:
 - touchscreen-inverted-y  : See touchscreen.txt
 - touchscreen-swapped-x-y : See touchscreen.txt
 - silead,max-fingers	  : maximum number of fingers the touchscreen can detect
+- silead,home-button	  : Boolean, set to true on devices which have a
+			    capacitive home-button build into the touchscreen
 - vddio-supply		  : regulator phandle for controller VDDIO
 - avdd-supply		  : regulator phandle for controller AVDD
 

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 350
+SUBLEVEL = 352
 EXTRAVERSION = -openela
 NAME = Petit Gorille
 

arch/arm/include/asm/uaccess.h

@@ -145,16 +145,6 @@ extern int __get_user_64t_1(void *);
 extern int __get_user_64t_2(void *);
 extern int __get_user_64t_4(void *);
 
-#define __GUP_CLOBBER_1	"lr", "cc" __asmbl_clobber("ip")
-#ifdef CONFIG_CPU_USE_DOMAINS
-#define __GUP_CLOBBER_2	"ip", "lr", "cc"
-#else
-#define __GUP_CLOBBER_2 "lr", "cc" __asmbl_clobber("ip")
-#endif
-#define __GUP_CLOBBER_4	"lr", "cc" __asmbl_clobber("ip")
-#define __GUP_CLOBBER_32t_8 "lr", "cc" __asmbl_clobber("ip")
-#define __GUP_CLOBBER_8	"lr", "cc" __asmbl_clobber("ip")
-
 #define __get_user_x(__r2, __p, __e, __l, __s)				\
 	   __asm__ __volatile__ (					\
 		__asmeq("%0", "r0") __asmeq("%1", "r2")			\
@@ -162,7 +152,7 @@ extern int __get_user_64t_4(void *);
 		__asmbl("", "ip", "__get_user_" #__s)			\
 		: "=&r" (__e), "=r" (__r2)				\
 		: "0" (__p), "r" (__l)					\
-		: __GUP_CLOBBER_##__s)
+		: "ip", "lr", "cc")
 
 /* narrowing a double-word get into a single 32bit word register: */
 #ifdef __ARMEB__
@@ -184,7 +174,7 @@ extern int __get_user_64t_4(void *);
 		__asmbl("", "ip", "__get_user_64t_" #__s)		\
 		: "=&r" (__e), "=r" (__r2)				\
 		: "0" (__p), "r" (__l)					\
-		: __GUP_CLOBBER_##__s)
+		: "ip", "lr", "cc")
 #else
 #define __get_user_x_64t __get_user_x
 #endif

arch/arm/mach-davinci/pm.c

@@ -65,7 +65,7 @@ static void davinci_pm_suspend(void)
 
 	/* Configure sleep count in deep sleep register */
 	val = __raw_readl(pm_config.deepsleep_reg);
-	val &= ~DEEPSLEEP_SLEEPCOUNT_MASK,
+	val &= ~DEEPSLEEP_SLEEPCOUNT_MASK;
 	val |= pm_config.sleepcount;
 	__raw_writel(val, pm_config.deepsleep_reg);
 

arch/powerpc/include/asm/io.h

@@ -49,7 +49,7 @@ extern struct pci_dev *isa_bridge_pcidev;
  * define properly based on the platform
  */
 #ifndef CONFIG_PCI
-#define _IO_BASE	0
+#define _IO_BASE	POISON_POINTER_DELTA
 #define _ISA_MEM_BASE	0
 #define PCI_DRAM_OFFSET 0
 #elif defined(CONFIG_PPC32)

arch/powerpc/xmon/xmon.c

@@ -1119,7 +1119,7 @@ static int cpu_cmd(void)
 	unsigned long cpu, first_cpu, last_cpu;
 	int timeout;
 
-	if (!scanhex(&cpu)) {
+	if (!scanhex(&cpu) || cpu >= num_possible_cpus()) {
 		/* print cpus waiting or in xmon */
 		printf("cpus stopped:");
 		last_cpu = first_cpu = NR_CPUS;
@@ -2426,7 +2426,7 @@ static void dump_pacas(void)
 
 	termch = c;	/* Put c back, it wasn't 'a' */
 
-	if (scanhex(&num))
+	if (scanhex(&num) && num < num_possible_cpus())
 		dump_one_paca(num);
 	else
 		dump_one_paca(xmon_owner);
@@ -2509,7 +2509,7 @@ static void dump_xives(void)
 
 	termch = c;	/* Put c back, it wasn't 'a' */
 
-	if (scanhex(&num))
+	if (scanhex(&num) && num < num_possible_cpus())
 		dump_one_xive(num);
 	else
 		dump_one_xive(xmon_owner);

drivers/acpi/ec.c

@@ -1312,10 +1312,13 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_enable(ec);
 
-	for (i = 0; i < bytes; ++i, ++address, ++value)
+	for (i = 0; i < bytes; ++i, ++address, ++value) {
 		result = (function == ACPI_READ) ?
 			acpi_ec_read(ec, address, value) :
 			acpi_ec_write(ec, address, *value);
+		if (result < 0)
+			break;
+	}
 
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_disable(ec);
@@ -1327,8 +1330,10 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
 		return AE_NOT_FOUND;
 	case -ETIME:
 		return AE_TIME;
-	default:
+	case 0:
 		return AE_OK;
+	default:
+		return AE_ERROR;
 	}
 }
 

drivers/acpi/processor_idle.c

@@ -29,7 +29,6 @@
 #include <linux/acpi.h>
 #include <linux/dmi.h>
 #include <linux/sched.h>       /* need_resched() */
-#include <linux/sort.h>
 #include <linux/tick.h>
 #include <linux/cpuidle.h>
 #include <linux/cpu.h>
@@ -541,28 +540,24 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
 	return;
 }
 
-static int acpi_cst_latency_cmp(const void *a, const void *b)
+static void acpi_cst_latency_sort(struct acpi_processor_cx *states, size_t length)
 {
-	const struct acpi_processor_cx *x = a, *y = b;
+	int i, j, k;
 
-	if (!(x->valid && y->valid))
-		return 0;
-	if (x->latency > y->latency)
-		return 1;
-	if (x->latency < y->latency)
-		return -1;
-	return 0;
-}
-static void acpi_cst_latency_swap(void *a, void *b, int n)
-{
-	struct acpi_processor_cx *x = a, *y = b;
-	u32 tmp;
+	for (i = 1; i < length; i++) {
+		if (!states[i].valid)
+			continue;
 
-	if (!(x->valid && y->valid))
-		return;
-	tmp = x->latency;
-	x->latency = y->latency;
-	y->latency = tmp;
+		for (j = i - 1, k = i; j >= 0; j--) {
+			if (!states[j].valid)
+				continue;
+
+			if (states[j].latency > states[k].latency)
+				swap(states[j].latency, states[k].latency);
+
+			k = j;
+		}
+	}
 }
 
 static int acpi_processor_power_verify(struct acpi_processor *pr)
@@ -607,10 +602,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 
 	if (buggy_latency) {
 		pr_notice("FW issue: working around C-state latencies out of order\n");
-		sort(&pr->power.states[1], max_cstate,
-		     sizeof(struct acpi_processor_cx),
-		     acpi_cst_latency_cmp,
-		     acpi_cst_latency_swap);
+		acpi_cst_latency_sort(&pr->power.states[1], max_cstate);
 	}
 
 	lapic_timer_propagate_broadcast(pr);

drivers/char/hpet.c

@@ -307,8 +307,13 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos)
 	if (!devp->hd_ireqfreq)
 		return -EIO;
 
-	if (count < sizeof(unsigned long))
-		return -EINVAL;
+	if (in_compat_syscall()) {
+		if (count < sizeof(compat_ulong_t))
+			return -EINVAL;
+	} else {
+		if (count < sizeof(unsigned long))
+			return -EINVAL;
+	}
 
 	add_wait_queue(&devp->hd_waitqueue, &wait);
 
@@ -332,9 +337,16 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos)
 		schedule();
 	}
 
-	retval = put_user(data, (unsigned long __user *)buf);
-	if (!retval)
-		retval = sizeof(unsigned long);
+	if (in_compat_syscall()) {
+		retval = put_user(data, (compat_ulong_t __user *)buf);
+		if (!retval)
+			retval = sizeof(compat_ulong_t);
+	} else {
+		retval = put_user(data, (unsigned long __user *)buf);
+		if (!retval)
+			retval = sizeof(unsigned long);
+	}
+
 out:
 	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(&devp->hd_waitqueue, &wait);
@@ -691,12 +703,24 @@ struct compat_hpet_info {
 	unsigned short hi_timer;
 };
 
+/* 32-bit types would lead to different command codes which should be
+ * translated into 64-bit ones before passed to hpet_ioctl_common
+ */
+#define COMPAT_HPET_INFO       _IOR('h', 0x03, struct compat_hpet_info)
+#define COMPAT_HPET_IRQFREQ    _IOW('h', 0x6, compat_ulong_t)
+
 static long
 hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct hpet_info info;
 	int err;
 
+	if (cmd == COMPAT_HPET_INFO)
+		cmd = HPET_INFO;
+
+	if (cmd == COMPAT_HPET_IRQFREQ)
+		cmd = HPET_IRQFREQ;
+
 	mutex_lock(&hpet_mutex);
 	err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
 	mutex_unlock(&hpet_mutex);

drivers/firmware/dmi_scan.c

@@ -99,6 +99,17 @@ static void dmi_decode_table(u8 *buf,
 	       (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
 		const struct dmi_header *dm = (const struct dmi_header *)data;
 
+		/*
+		 * If a short entry is found (less than 4 bytes), not only it
+		 * is invalid, but we cannot reliably locate the next entry.
+		 */
+		if (dm->length < sizeof(struct dmi_header)) {
+			pr_warn(FW_BUG
+				"Corrupted DMI table, offset %zd (only %d entries processed)\n",
+				data - buf, i);
+			break;
+		}
+
 		/*
 		 *  We want to know the total length (formatted area and
 		 *  strings) before decoding to make sure we won't run off the

drivers/gpu/drm/amd/include/atomfirmware.h

@@ -594,7 +594,7 @@ struct atom_gpio_pin_lut_v2_1
 {
   struct  atom_common_table_header  table_header;
   /*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut  */
-  struct  atom_gpio_pin_assignment  gpio_pin[8];
+  struct  atom_gpio_pin_assignment  gpio_pin[];
 };
 
 

drivers/gpu/drm/nouveau/nouveau_connector.c

@@ -958,6 +958,9 @@ nouveau_connector_get_modes(struct drm_connector *connector)
 		struct drm_display_mode *mode;
 
 		mode = drm_mode_duplicate(dev, nv_connector->native_mode);
+		if (!mode)
+			return 0;
+
 		drm_mode_probed_add(connector, mode);
 		ret = 1;
 	}

drivers/i2c/busses/i2c-i801.c

@@ -1032,7 +1032,7 @@ static const struct pci_device_id i801_ids[] = {
 MODULE_DEVICE_TABLE(pci, i801_ids);
 
 #if defined CONFIG_X86 && defined CONFIG_DMI
-static unsigned char apanel_addr;
+static unsigned char apanel_addr __ro_after_init;
 
 /* Scan the system ROM for the signature "FJKEYINF" */
 static __init const void __iomem *bios_signature(const void __iomem *bios)

drivers/i2c/busses/i2c-img-scb.c

@@ -826,9 +826,9 @@ next_atomic_cmd:
  * Timer function to check if something has gone wrong in automatic mode (so we
  * don't have to handle so many interrupts just to catch an exception).
  */
-static void img_i2c_check_timer(unsigned long arg)
+static void img_i2c_check_timer(struct timer_list *t)
 {
-	struct img_i2c *i2c = (struct img_i2c *)arg;
+	struct img_i2c *i2c = from_timer(i2c, t, check_timer);
 	unsigned long flags;
 	unsigned int line_status;
 
@@ -1362,8 +1362,7 @@ static int img_i2c_probe(struct platform_device *pdev)
 	}
 
 	/* Set up the exception check timer */
-	setup_timer(&i2c->check_timer, img_i2c_check_timer,
-		    (unsigned long)i2c);
+	timer_setup(&i2c->check_timer, img_i2c_check_timer, 0);
 
 	i2c->bitrate = timings[0].max_bitrate;
 	if (!of_property_read_u32(node, "clock-frequency", &val))

drivers/i2c/busses/i2c-pnx.c

@@ -15,10 +15,8 @@
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
-#include <linux/timer.h>
 #include <linux/completion.h>
 #include <linux/platform_device.h>
-#include <linux/i2c-pnx.h>
 #include <linux/io.h>
 #include <linux/err.h>
 #include <linux/clk.h>
@@ -29,6 +27,25 @@
 #define I2C_PNX_SPEED_KHZ_DEFAULT	100
 #define I2C_PNX_REGION_SIZE		0x100
 
+struct i2c_pnx_mif {
+	int			ret;		/* Return value */
+	int			mode;		/* Interface mode */
+	struct completion	complete;	/* I/O completion */
+	u8 *			buf;		/* Data buffer */
+	int			len;		/* Length of data buffer */
+	int			order;		/* RX Bytes to order via TX */
+};
+
+struct i2c_pnx_algo_data {
+	void __iomem		*ioaddr;
+	struct i2c_pnx_mif	mif;
+	int			last;
+	struct clk		*clk;
+	struct i2c_adapter	adapter;
+	int			irq;
+	u32			timeout;
+};
+
 enum {
 	mstatus_tdi = 0x00000001,
 	mstatus_afi = 0x00000002,
@@ -98,25 +115,6 @@ static inline int wait_reset(struct i2c_pnx_algo_data *data)
 	return (timeout <= 0);
 }
 
-static inline void i2c_pnx_arm_timer(struct i2c_pnx_algo_data *alg_data)
-{
-	struct timer_list *timer = &alg_data->mif.timer;
-	unsigned long expires = msecs_to_jiffies(alg_data->timeout);
-
-	if (expires <= 1)
-		expires = 2;
-
-	del_timer_sync(timer);
-
-	dev_dbg(&alg_data->adapter.dev, "Timer armed at %lu plus %lu jiffies.\n",
-		jiffies, expires);
-
-	timer->expires = jiffies + expires;
-	timer->data = (unsigned long)alg_data;
-
-	add_timer(timer);
-}
-
 /**
  * i2c_pnx_start - start a device
  * @slave_addr:		slave address
@@ -241,8 +239,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data)
 				~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
 				  I2C_REG_CTL(alg_data));
 
-			del_timer_sync(&alg_data->mif.timer);
-
 			dev_dbg(&alg_data->adapter.dev,
 				"%s(): Waking up xfer routine.\n",
 				__func__);
@@ -258,8 +254,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data)
 			~(mcntrl_afie | mcntrl_naie | mcntrl_drmie),
 			  I2C_REG_CTL(alg_data));
 
-		/* Stop timer. */
-		del_timer_sync(&alg_data->mif.timer);
 		dev_dbg(&alg_data->adapter.dev,
 			"%s(): Waking up xfer routine after zero-xfer.\n",
 			__func__);
@@ -346,8 +340,6 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
 				 mcntrl_drmie | mcntrl_daie);
 			iowrite32(ctl, I2C_REG_CTL(alg_data));
 
-			/* Kill timer. */
-			del_timer_sync(&alg_data->mif.timer);
 			complete(&alg_data->mif.complete);
 		}
 	}
@@ -382,8 +374,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
 			 mcntrl_drmie);
 		iowrite32(ctl, I2C_REG_CTL(alg_data));
 
-		/* Stop timer, to prevent timeout. */
-		del_timer_sync(&alg_data->mif.timer);
 		complete(&alg_data->mif.complete);
 	} else if (stat & mstatus_nai) {
 		/* Slave did not acknowledge, generate a STOP */
@@ -401,8 +391,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
 		/* Our return value. */
 		alg_data->mif.ret = -EIO;
 
-		/* Stop timer, to prevent timeout. */
-		del_timer_sync(&alg_data->mif.timer);
 		complete(&alg_data->mif.complete);
 	} else {
 		/*
@@ -435,9 +423,8 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
-static void i2c_pnx_timeout(unsigned long data)
+static void i2c_pnx_timeout(struct i2c_pnx_algo_data *alg_data)
 {
-	struct i2c_pnx_algo_data *alg_data = (struct i2c_pnx_algo_data *)data;
 	u32 ctl;
 
 	dev_err(&alg_data->adapter.dev,
@@ -454,7 +441,6 @@ static void i2c_pnx_timeout(unsigned long data)
 	iowrite32(ctl, I2C_REG_CTL(alg_data));
 	wait_reset(alg_data);
 	alg_data->mif.ret = -EIO;
-	complete(&alg_data->mif.complete);
 }
 
 static inline void bus_reset_if_active(struct i2c_pnx_algo_data *alg_data)
@@ -496,6 +482,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 	struct i2c_msg *pmsg;
 	int rc = 0, completed = 0, i;
 	struct i2c_pnx_algo_data *alg_data = adap->algo_data;
+	unsigned long time_left;
 	u32 stat;
 
 	dev_dbg(&alg_data->adapter.dev,
@@ -530,7 +517,6 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 		dev_dbg(&alg_data->adapter.dev, "%s(): mode %d, %d bytes\n",
 			__func__, alg_data->mif.mode, alg_data->mif.len);
 
-		i2c_pnx_arm_timer(alg_data);
 
 		/* initialize the completion var */
 		init_completion(&alg_data->mif.complete);
@@ -546,7 +532,10 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 			break;
 
 		/* Wait for completion */
-		wait_for_completion(&alg_data->mif.complete);
+		time_left = wait_for_completion_timeout(&alg_data->mif.complete,
+							alg_data->timeout);
+		if (time_left == 0)
+			i2c_pnx_timeout(alg_data);
 
 		if (!(rc = alg_data->mif.ret))
 			completed++;
@@ -639,7 +628,10 @@ static int i2c_pnx_probe(struct platform_device *pdev)
 	alg_data->adapter.algo_data = alg_data;
 	alg_data->adapter.nr = pdev->id;
 
-	alg_data->timeout = I2C_PNX_TIMEOUT_DEFAULT;
+	alg_data->timeout = msecs_to_jiffies(I2C_PNX_TIMEOUT_DEFAULT);
+	if (alg_data->timeout <= 1)
+		alg_data->timeout = 2;
+
 #ifdef CONFIG_OF
 	alg_data->adapter.dev.of_node = of_node_get(pdev->dev.of_node);
 	if (pdev->dev.of_node) {
@@ -659,9 +651,6 @@ static int i2c_pnx_probe(struct platform_device *pdev)
 	if (IS_ERR(alg_data->clk))
 		return PTR_ERR(alg_data->clk);
 
-	setup_timer(&alg_data->mif.timer, i2c_pnx_timeout,
-			(unsigned long)alg_data);
-
 	snprintf(alg_data->adapter.name, sizeof(alg_data->adapter.name),
 		 "%s", pdev->name);
 

drivers/i2c/busses/i2c-rcar.c

@@ -173,6 +173,14 @@ static void rcar_i2c_init(struct rcar_i2c_priv *priv)
 	rcar_i2c_write(priv, ICCCR, priv->icccr);
 }
 
+static void rcar_i2c_reset_slave(struct rcar_i2c_priv *priv)
+{
+	rcar_i2c_write(priv, ICSIER, 0);
+	rcar_i2c_write(priv, ICSSR, 0);
+	rcar_i2c_write(priv, ICSCR, SDBS);
+	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+}
+
 static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv)
 {
 	int i;
@@ -818,11 +826,8 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
 	/* ensure no irq is running before clearing ptr */
 	disable_irq(priv->irq);
-	rcar_i2c_write(priv, ICSIER, 0);
-	rcar_i2c_write(priv, ICSSR, 0);
+	rcar_i2c_reset_slave(priv);
 	enable_irq(priv->irq);
-	rcar_i2c_write(priv, ICSCR, SDBS);
-	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
 
 	priv->slave = NULL;
 
@@ -919,7 +924,9 @@ static int rcar_i2c_probe(struct platform_device *pdev)
 	if (ret < 0)
 		goto out_pm_put;
 
-	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+	/* Bring hardware to known state */
+	rcar_i2c_init(priv);
+	rcar_i2c_reset_slave(priv);
 
 	if (priv->devtype == I2C_RCAR_GEN3) {
 		priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);

drivers/infiniband/core/user_mad.c

@@ -60,6 +60,8 @@ MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("InfiniBand userspace MAD packet access");
 MODULE_LICENSE("Dual BSD/GPL");
 
+#define MAX_UMAD_RECV_LIST_SIZE 200000
+
 enum {
 	IB_UMAD_MAX_PORTS  = 64,
 	IB_UMAD_MAX_AGENTS = 32,
@@ -108,6 +110,7 @@ struct ib_umad_file {
 	struct mutex		mutex;
 	struct ib_umad_port    *port;
 	struct list_head	recv_list;
+	atomic_t		recv_list_size;
 	struct list_head	send_list;
 	struct list_head	port_list;
 	spinlock_t		send_lock;
@@ -160,24 +163,28 @@ static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id)
 	return file->agents_dead ? NULL : file->agent[id];
 }
 
-static int queue_packet(struct ib_umad_file *file,
-			struct ib_mad_agent *agent,
-			struct ib_umad_packet *packet)
+static int queue_packet(struct ib_umad_file *file, struct ib_mad_agent *agent,
+			struct ib_umad_packet *packet, bool is_recv_mad)
 {
 	int ret = 1;
 
 	mutex_lock(&file->mutex);
 
+	if (is_recv_mad &&
+	    atomic_read(&file->recv_list_size) > MAX_UMAD_RECV_LIST_SIZE)
+		goto unlock;
+
 	for (packet->mad.hdr.id = 0;
 	     packet->mad.hdr.id < IB_UMAD_MAX_AGENTS;
 	     packet->mad.hdr.id++)
 		if (agent == __get_agent(file, packet->mad.hdr.id)) {
 			list_add_tail(&packet->list, &file->recv_list);
+			atomic_inc(&file->recv_list_size);
 			wake_up_interruptible(&file->recv_wait);
 			ret = 0;
 			break;
 		}
-
+unlock:
 	mutex_unlock(&file->mutex);
 
 	return ret;
@@ -204,7 +211,7 @@ static void send_handler(struct ib_mad_agent *agent,
 	if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) {
 		packet->length = IB_MGMT_MAD_HDR;
 		packet->mad.hdr.status = ETIMEDOUT;
-		if (!queue_packet(file, agent, packet))
+		if (!queue_packet(file, agent, packet, false))
 			return;
 	}
 	kfree(packet);
@@ -260,7 +267,7 @@ static void recv_handler(struct ib_mad_agent *agent,
 		packet->mad.hdr.flow_label = cpu_to_be32(grh->flow_label);
 	}
 
-	if (queue_packet(file, agent, packet))
+	if (queue_packet(file, agent, packet, true))
 		goto err2;
 	return;
 
@@ -374,6 +381,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
 
 	packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
 	list_del(&packet->list);
+	atomic_dec(&file->recv_list_size);
 
 	mutex_unlock(&file->mutex);
 
@@ -386,6 +394,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
 		/* Requeue packet */
 		mutex_lock(&file->mutex);
 		list_add(&packet->list, &file->recv_list);
+		atomic_inc(&file->recv_list_size);
 		mutex_unlock(&file->mutex);
 	} else {
 		if (packet->recv_wc)

drivers/input/ff-core.c

@@ -24,8 +24,10 @@
 /* #define DEBUG */
 
 #include <linux/input.h>
+#include <linux/limits.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/overflow.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 
@@ -330,9 +332,8 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
 		return -EINVAL;
 	}
 
-	ff_dev_size = sizeof(struct ff_device) +
-				max_effects * sizeof(struct file *);
-	if (ff_dev_size < max_effects) /* overflow */
+	ff_dev_size = struct_size(ff, effect_owners, max_effects);
+	if (ff_dev_size == SIZE_MAX) /* overflow */
 		return -EINVAL;
 
 	ff = kzalloc(ff_dev_size, GFP_KERNEL);

drivers/input/mouse/elantech.c

@@ -1519,16 +1519,47 @@ static void elantech_disconnect(struct psmouse *psmouse)
 	psmouse->private = NULL;
 }
 
+/*
+ * Some hw_version 4 models fail to properly activate absolute mode on
+ * resume without going through disable/enable cycle.
+ */
+static const struct dmi_system_id elantech_needs_reenable[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+	{
+		/* Lenovo N24 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "81AF"),
+		},
+	},
+#endif
+	{ }
+};
+
 /*
  * Put the touchpad back into absolute mode when reconnecting
  */
 static int elantech_reconnect(struct psmouse *psmouse)
 {
+	int err;
+
 	psmouse_reset(psmouse);
 
 	if (elantech_detect(psmouse, 0))
 		return -1;
 
+	if (dmi_check_system(elantech_needs_reenable)) {
+		err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE);
+		if (err)
+			psmouse_warn(psmouse, "failed to deactivate mouse on %s: %d\n",
+				     psmouse->ps2dev.serio->phys, err);
+
+		err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE);
+		if (err)
+			psmouse_warn(psmouse, "failed to reactivate mouse on %s: %d\n",
+				     psmouse->ps2dev.serio->phys, err);
+	}
+
 	if (elantech_set_absolute_mode(psmouse)) {
 		psmouse_err(psmouse,
 			    "failed to put touchpad back into absolute mode.\n");

drivers/input/touchscreen/silead.c

@@ -57,7 +57,7 @@
 #define SILEAD_POINT_Y_MSB_OFF	0x01
 #define SILEAD_POINT_X_OFF	0x02
 #define SILEAD_POINT_X_MSB_OFF	0x03
-#define SILEAD_TOUCH_ID_MASK	0xF0
+#define SILEAD_EXTRA_DATA_MASK	0xF0
 
 #define SILEAD_CMD_SLEEP_MIN	10000
 #define SILEAD_CMD_SLEEP_MAX	20000
@@ -78,7 +78,6 @@ struct silead_ts_data {
 	struct regulator_bulk_data regulators[2];
 	char fw_name[64];
 	struct touchscreen_properties prop;
-	u32 max_fingers;
 	u32 chip_id;
 	struct input_mt_pos pos[SILEAD_MAX_FINGERS];
 	int slots[SILEAD_MAX_FINGERS];
@@ -106,10 +105,13 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data)
 	input_set_abs_params(data->input, ABS_MT_POSITION_Y, 0, 4095, 0, 0);
 	touchscreen_parse_properties(data->input, true, &data->prop);
 
-	input_mt_init_slots(data->input, data->max_fingers,
+	input_mt_init_slots(data->input, SILEAD_MAX_FINGERS,
 			    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED |
 			    INPUT_MT_TRACK);
 
+	if (device_property_read_bool(dev, "silead,home-button"))
+		input_set_capability(data->input, EV_KEY, KEY_LEFTMETA);
+
 	data->input->name = SILEAD_TS_NAME;
 	data->input->phys = "input/ts";
 	data->input->id.bustype = BUS_I2C;
@@ -140,7 +142,8 @@ static void silead_ts_read_data(struct i2c_client *client)
 	struct input_dev *input = data->input;
 	struct device *dev = &client->dev;
 	u8 *bufp, buf[SILEAD_TS_DATA_LEN];
-	int touch_nr, error, i;
+	int touch_nr, softbutton, error, i;
+	bool softbutton_pressed = false;
 
 	error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_DATA,
 					      SILEAD_TS_DATA_LEN, buf);
@@ -149,21 +152,40 @@ static void silead_ts_read_data(struct i2c_client *client)
 		return;
 	}
 
-	touch_nr = buf[0];
-	if (touch_nr > data->max_fingers) {
+	if (buf[0] > SILEAD_MAX_FINGERS) {
 		dev_warn(dev, "More touches reported then supported %d > %d\n",
-			 touch_nr, data->max_fingers);
-		touch_nr = data->max_fingers;
+			 buf[0], SILEAD_MAX_FINGERS);
+		buf[0] = SILEAD_MAX_FINGERS;
 	}
 
+	touch_nr = 0;
 	bufp = buf + SILEAD_POINT_DATA_LEN;
-	for (i = 0; i < touch_nr; i++, bufp += SILEAD_POINT_DATA_LEN) {
-		/* Bits 4-7 are the touch id */
-		data->id[i] = (bufp[SILEAD_POINT_X_MSB_OFF] &
-			       SILEAD_TOUCH_ID_MASK) >> 4;
-		touchscreen_set_mt_pos(&data->pos[i], &data->prop,
+	for (i = 0; i < buf[0]; i++, bufp += SILEAD_POINT_DATA_LEN) {
+		softbutton = (bufp[SILEAD_POINT_Y_MSB_OFF] &
+			      SILEAD_EXTRA_DATA_MASK) >> 4;
+
+		if (softbutton) {
+			/*
+			 * For now only respond to softbutton == 0x01, some
+			 * tablets *without* a capacative button send 0x04
+			 * when crossing the edges of the screen.
+			 */
+			if (softbutton == 0x01)
+				softbutton_pressed = true;
+
+			continue;
+		}
+
+		/*
+		 * Bits 4-7 are the touch id, note not all models have
+		 * hardware touch ids so atm we don't use these.
+		 */
+		data->id[touch_nr] = (bufp[SILEAD_POINT_X_MSB_OFF] &
+				      SILEAD_EXTRA_DATA_MASK) >> 4;
+		touchscreen_set_mt_pos(&data->pos[touch_nr], &data->prop,
 			get_unaligned_le16(&bufp[SILEAD_POINT_X_OFF]) & 0xfff,
 			get_unaligned_le16(&bufp[SILEAD_POINT_Y_OFF]) & 0xfff);
+		touch_nr++;
 	}
 
 	input_mt_assign_slots(input, data->slots, data->pos, touch_nr, 0);
@@ -179,12 +201,12 @@ static void silead_ts_read_data(struct i2c_client *client)
 	}
 
 	input_mt_sync_frame(input);
+	input_report_key(input, KEY_LEFTMETA, softbutton_pressed);
 	input_sync(input);
 }
 
 static int silead_ts_init(struct i2c_client *client)
 {
-	struct silead_ts_data *data = i2c_get_clientdata(client);
 	int error;
 
 	error = i2c_smbus_write_byte_data(client, SILEAD_REG_RESET,
@@ -194,7 +216,7 @@ static int silead_ts_init(struct i2c_client *client)
 	usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX);
 
 	error = i2c_smbus_write_byte_data(client, SILEAD_REG_TOUCH_NR,
-					data->max_fingers);
+					  SILEAD_MAX_FINGERS);
 	if (error)
 		goto i2c_write_err;
 	usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX);
@@ -421,13 +443,6 @@ static void silead_ts_read_props(struct i2c_client *client)
 	const char *str;
 	int error;
 
-	error = device_property_read_u32(dev, "silead,max-fingers",
-					 &data->max_fingers);
-	if (error) {
-		dev_dbg(dev, "Max fingers read error %d\n", error);
-		data->max_fingers = 5; /* Most devices handle up-to 5 fingers */
-	}
-
 	error = device_property_read_string(dev, "firmware-name", &str);
 	if (!error)
 		snprintf(data->fw_name, sizeof(data->fw_name),

drivers/media/dvb-frontends/as102_fe_types.h

@@ -183,6 +183,6 @@ struct as10x_register_addr {
 	uint32_t addr;
 	/* register mode access */
 	uint8_t mode;
-};
+} __packed;
 
 #endif

drivers/media/dvb-frontends/tda10048.c

@@ -422,6 +422,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
 	struct tda10048_config *config = &state->config;
 	int i;
 	u32 if_freq_khz;
+	u64 sample_freq;
 
 	dprintk(1, "%s(bw = %d)\n", __func__, bw);
 
@@ -463,9 +464,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)
 	dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor);
 
 	/* Calculate the sample frequency */
-	state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45);
-	state->sample_freq /= (state->pll_nfactor + 1);
-	state->sample_freq /= (state->pll_pfactor + 4);
+	sample_freq = state->xtal_hz;
+	sample_freq *= state->pll_mfactor + 45;
+	do_div(sample_freq, state->pll_nfactor + 1);
+	do_div(sample_freq, state->pll_pfactor + 4);
+	state->sample_freq = sample_freq;
 	dprintk(1, "- sample_freq = %d\n", state->sample_freq);
 
 	/* Update the I/F */

drivers/media/dvb-frontends/tda18271c2dd.c

@@ -345,7 +345,7 @@ static int CalcMainPLL(struct tda_state *state, u32 freq)
 
 	OscFreq = (u64) freq * (u64) Div;
 	OscFreq *= (u64) 16384;
-	do_div(OscFreq, (u64)16000000);
+	do_div(OscFreq, 16000000);
 	MainDiv = OscFreq;
 
 	state->m_Regs[MPD] = PostDiv & 0x77;
@@ -369,7 +369,7 @@ static int CalcCalPLL(struct tda_state *state, u32 freq)
 	OscFreq = (u64)freq * (u64)Div;
 	/* CalDiv = u32( OscFreq * 16384 / 16000000 ); */
 	OscFreq *= (u64)16384;
-	do_div(OscFreq, (u64)16000000);
+	do_div(OscFreq, 16000000);
 	CalDiv = OscFreq;
 
 	state->m_Regs[CPD] = PostDiv;

drivers/media/usb/dvb-usb/dib0700_devices.c

@@ -2423,7 +2423,12 @@ static int stk9090m_frontend_attach(struct dvb_usb_adapter *adap)
 
 	adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &stk9090m_config);
 
-	return adap->fe_adap[0].fe == NULL ?  -ENODEV : 0;
+	if (!adap->fe_adap[0].fe) {
+		release_firmware(state->frontend_firmware);
+		return -ENODEV;
+	}
+
+	return 0;
 }
 
 static int dib9090_tuner_attach(struct dvb_usb_adapter *adap)
@@ -2496,8 +2501,10 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)
 	dib9000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, 0x80);
 	adap->fe_adap[0].fe = dvb_attach(dib9000_attach, &adap->dev->i2c_adap, 0x80, &nim9090md_config[0]);
 
-	if (adap->fe_adap[0].fe == NULL)
+	if (!adap->fe_adap[0].fe) {
+		release_firmware(state->frontend_firmware);
 		return -ENODEV;
+	}
 
 	i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_3_4, 0);
 	dib9000_i2c_enumeration(i2c, 1, 0x12, 0x82);
@@ -2505,7 +2512,12 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)
 	fe_slave = dvb_attach(dib9000_attach, i2c, 0x82, &nim9090md_config[1]);
 	dib9000_set_slave_frontend(adap->fe_adap[0].fe, fe_slave);
 
-	return fe_slave == NULL ?  -ENODEV : 0;
+	if (!fe_slave) {
+		release_firmware(state->frontend_firmware);
+		return -ENODEV;
+	}
+
+	return 0;
 }
 
 static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap)

drivers/media/usb/dvb-usb/dw2102.c

@@ -721,6 +721,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 {
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
 	struct dw2102_state *state;
+	int j;
 
 	if (!d)
 		return -ENODEV;
@@ -734,11 +735,11 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 		return -EAGAIN;
 	}
 
-	switch (num) {
-	case 1:
-		switch (msg[0].addr) {
+	j = 0;
+	while (j < num) {
+		switch (msg[j].addr) {
 		case SU3000_STREAM_CTRL:
-			state->data[0] = msg[0].buf[0] + 0x36;
+			state->data[0] = msg[j].buf[0] + 0x36;
 			state->data[1] = 3;
 			state->data[2] = 0;
 			if (dvb_usb_generic_rw(d, state->data, 3,
@@ -750,61 +751,86 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 			if (dvb_usb_generic_rw(d, state->data, 1,
 					state->data, 2, 0) < 0)
 				err("i2c transfer failed.");
-			msg[0].buf[1] = state->data[0];
-			msg[0].buf[0] = state->data[1];
+			msg[j].buf[1] = state->data[0];
+			msg[j].buf[0] = state->data[1];
 			break;
 		default:
-			if (3 + msg[0].len > sizeof(state->data)) {
-				warn("i2c wr: len=%d is too big!\n",
-				     msg[0].len);
+			/* if the current write msg is followed by a another
+			 * read msg to/from the same address
+			 */
+			if ((j+1 < num) && (msg[j+1].flags & I2C_M_RD) &&
+			    (msg[j].addr == msg[j+1].addr)) {
+				/* join both i2c msgs to one usb read command */
+				if (4 + msg[j].len > sizeof(state->data)) {
+					warn("i2c combined wr/rd: write len=%d is too big!\n",
+					    msg[j].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+				if (1 + msg[j+1].len > sizeof(state->data)) {
+					warn("i2c combined wr/rd: read len=%d is too big!\n",
+					    msg[j+1].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+
+				state->data[0] = 0x09;
+				state->data[1] = msg[j].len;
+				state->data[2] = msg[j+1].len;
+				state->data[3] = msg[j].addr;
+				memcpy(&state->data[4], msg[j].buf, msg[j].len);
+
+				if (dvb_usb_generic_rw(d, state->data, msg[j].len + 4,
+					state->data, msg[j+1].len + 1, 0) < 0)
+					err("i2c transfer failed.");
+
+				memcpy(msg[j+1].buf, &state->data[1], msg[j+1].len);
+				j++;
+				break;
+			}
+
+			if (msg[j].flags & I2C_M_RD) {
+				/* single read */
+				if (4 + msg[j].len > sizeof(state->data)) {
+					warn("i2c rd: len=%d is too big!\n", msg[j].len);
+					num = -EOPNOTSUPP;
+					break;
+				}
+
+				state->data[0] = 0x09;
+				state->data[1] = 0;
+				state->data[2] = msg[j].len;
+				state->data[3] = msg[j].addr;
+				memcpy(&state->data[4], msg[j].buf, msg[j].len);
+
+				if (dvb_usb_generic_rw(d, state->data, 4,
+					state->data, msg[j].len + 1, 0) < 0)
+					err("i2c transfer failed.");
+
+				memcpy(msg[j].buf, &state->data[1], msg[j].len);
+				break;
+			}
+
+			/* single write */
+			if (3 + msg[j].len > sizeof(state->data)) {
+				warn("i2c wr: len=%d is too big!\n", msg[j].len);
 				num = -EOPNOTSUPP;
 				break;
 			}
 
-			/* always i2c write*/
 			state->data[0] = 0x08;
-			state->data[1] = msg[0].addr;
-			state->data[2] = msg[0].len;
+			state->data[1] = msg[j].addr;
+			state->data[2] = msg[j].len;
 
-			memcpy(&state->data[3], msg[0].buf, msg[0].len);
+			memcpy(&state->data[3], msg[j].buf, msg[j].len);
 
-			if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3,
+			if (dvb_usb_generic_rw(d, state->data, msg[j].len + 3,
 						state->data, 1, 0) < 0)
 				err("i2c transfer failed.");
+		} // switch
+		j++;
 
-		}
-		break;
-	case 2:
-		/* always i2c read */
-		if (4 + msg[0].len > sizeof(state->data)) {
-			warn("i2c rd: len=%d is too big!\n",
-			     msg[0].len);
-			num = -EOPNOTSUPP;
-			break;
-		}
-		if (1 + msg[1].len > sizeof(state->data)) {
-			warn("i2c rd: len=%d is too big!\n",
-			     msg[1].len);
-			num = -EOPNOTSUPP;
-			break;
-		}
-
-		state->data[0] = 0x09;
-		state->data[1] = msg[0].len;
-		state->data[2] = msg[1].len;
-		state->data[3] = msg[0].addr;
-		memcpy(&state->data[4], msg[0].buf, msg[0].len);
-
-		if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
-					state->data, msg[1].len + 1, 0) < 0)
-			err("i2c transfer failed.");
-
-		memcpy(msg[1].buf, &state->data[1], msg[1].len);
-		break;
-	default:
-		warn("more than 2 i2c messages at a time is not handled yet.");
-		break;
-	}
+	} // while
 	mutex_unlock(&d->data_mutex);
 	mutex_unlock(&d->i2c_mutex);
 	return num;

drivers/media/usb/s2255/s2255drv.c

@@ -256,7 +256,7 @@ struct s2255_vc {
 struct s2255_dev {
 	struct s2255_vc         vc[MAX_CHANNELS];
 	struct v4l2_device      v4l2_dev;
-	atomic_t                num_channels;
+	refcount_t		num_channels;
 	int			frames;
 	struct mutex		lock;	/* channels[].vdev.lock */
 	struct mutex		cmdlock; /* protects cmdbuf */
@@ -1581,11 +1581,11 @@ static void s2255_video_device_release(struct video_device *vdev)
 		container_of(vdev, struct s2255_vc, vdev);
 
 	dprintk(dev, 4, "%s, chnls: %d\n", __func__,
-		atomic_read(&dev->num_channels));
+		refcount_read(&dev->num_channels));
 
 	v4l2_ctrl_handler_free(&vc->hdl);
 
-	if (atomic_dec_and_test(&dev->num_channels))
+	if (refcount_dec_and_test(&dev->num_channels))
 		s2255_destroy(dev);
 	return;
 }
@@ -1688,7 +1688,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
 				"failed to register video device!\n");
 			break;
 		}
-		atomic_inc(&dev->num_channels);
+		refcount_inc(&dev->num_channels);
 		v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n",
 			  video_device_node_name(&vc->vdev));
 
@@ -1696,11 +1696,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
 	pr_info("Sensoray 2255 V4L driver Revision: %s\n",
 		S2255_VERSION);
 	/* if no channels registered, return error and probe will fail*/
-	if (atomic_read(&dev->num_channels) == 0) {
+	if (refcount_read(&dev->num_channels) == 0) {
 		v4l2_device_unregister(&dev->v4l2_dev);
 		return ret;
 	}
-	if (atomic_read(&dev->num_channels) != MAX_CHANNELS)
+	if (refcount_read(&dev->num_channels) != MAX_CHANNELS)
 		pr_warn("s2255: Not all channels available.\n");
 	return 0;
 }
@@ -2250,7 +2250,7 @@ static int s2255_probe(struct usb_interface *interface,
 		goto errorFWDATA1;
 	}
 
-	atomic_set(&dev->num_channels, 0);
+	refcount_set(&dev->num_channels, 0);
 	dev->pid = id->idProduct;
 	dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL);
 	if (!dev->fw_data)
@@ -2370,12 +2370,12 @@ static void s2255_disconnect(struct usb_interface *interface)
 {
 	struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface));
 	int i;
-	int channels = atomic_read(&dev->num_channels);
+	int channels = refcount_read(&dev->num_channels);
 	mutex_lock(&dev->lock);
 	v4l2_device_disconnect(&dev->v4l2_dev);
 	mutex_unlock(&dev->lock);
 	/*see comments in the uvc_driver.c usb disconnect function */
-	atomic_inc(&dev->num_channels);
+	refcount_inc(&dev->num_channels);
 	/* unregister each video device. */
 	for (i = 0; i < channels; i++)
 		video_unregister_device(&dev->vc[i].vdev);
@@ -2388,7 +2388,7 @@ static void s2255_disconnect(struct usb_interface *interface)
 		dev->vc[i].vidstatus_ready = 1;
 		wake_up(&dev->vc[i].wait_vidstatus);
 	}
-	if (atomic_dec_and_test(&dev->num_channels))
+	if (refcount_dec_and_test(&dev->num_channels))
 		s2255_destroy(dev);
 	dev_info(&interface->dev, "%s\n", __func__);
 }

drivers/misc/mei/main.c

@@ -271,7 +271,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
 	}
 
 	if (!mei_cl_is_connected(cl)) {
-		cl_err(dev, cl, "is not connected");
+		cl_dbg(dev, cl, "is not connected");
 		rets = -ENODEV;
 		goto out;
 	}

drivers/net/bonding/bond_options.c

@@ -1074,9 +1074,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond,
 	__be32 target;
 
 	if (newval->string) {
-		if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) {
-			netdev_err(bond->dev, "invalid ARP target %pI4 specified\n",
-				   &target);
+		if (strlen(newval->string) < 1 ||
+		    !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) {
+			netdev_err(bond->dev, "invalid ARP target specified\n");
 			return ret;
 		}
 		if (newval->string[0] == '+')

drivers/net/dsa/mv88e6xxx/chip.c

@@ -227,8 +227,8 @@ struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip)
 {
 	struct mv88e6xxx_mdio_bus *mdio_bus;
 
-	mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus,
-				    list);
+	mdio_bus = list_first_entry_or_null(&chip->mdios,
+					    struct mv88e6xxx_mdio_bus, list);
 	if (!mdio_bus)
 		return NULL;
 

drivers/net/ethernet/broadcom/bnx2x/bnx2x.h

@@ -1252,7 +1252,7 @@ enum {
 
 struct bnx2x_fw_stats_req {
 	struct stats_query_header hdr;
-	struct stats_query_entry query[FP_SB_MAX_E1x+
+	struct stats_query_entry query[FP_SB_MAX_E2 +
 		BNX2X_FIRST_QUEUE_QUERY_IDX];
 };
 

drivers/net/ethernet/lantiq_etop.c

@@ -221,8 +221,9 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)
 	if (ch->dma.irq)
 		free_irq(ch->dma.irq, priv);
 	if (IS_RX(ch->idx)) {
-		int desc;
-		for (desc = 0; desc < LTQ_DESC_NUM; desc++)
+		struct ltq_dma_channel *dma = &ch->dma;
+
+		for (dma->desc = 0; dma->desc < LTQ_DESC_NUM; dma->desc++)
 			dev_kfree_skb_any(ch->skb[ch->dma.desc]);
 	}
 }

drivers/net/ppp/ppp_generic.c

@@ -73,6 +73,7 @@
 #define MPHDRLEN_SSN	4	/* ditto with short sequence numbers */
 
 #define PPP_PROTO_LEN	2
+#define PPP_LCP_HDRLEN	4
 
 /*
  * An instance of /dev/ppp can be associated with either a ppp
@@ -494,6 +495,15 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
 	return ret;
 }
 
+static bool ppp_check_packet(struct sk_buff *skb, size_t count)
+{
+	/* LCP packets must include LCP header which 4 bytes long:
+	 * 1-byte code, 1-byte identifier, and 2-byte length.
+	 */
+	return get_unaligned_be16(skb->data) != PPP_LCP ||
+		count >= PPP_PROTO_LEN + PPP_LCP_HDRLEN;
+}
+
 static ssize_t ppp_write(struct file *file, const char __user *buf,
 			 size_t count, loff_t *ppos)
 {
@@ -516,6 +526,11 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,
 		kfree_skb(skb);
 		goto out;
 	}
+	ret = -EINVAL;
+	if (unlikely(!ppp_check_packet(skb, count))) {
+		kfree_skb(skb);
+		goto out;
+	}
 
 	switch (pf->kind) {
 	case INTERFACE:

drivers/net/usb/qmi_wwan.c

@@ -1326,6 +1326,8 @@ static const struct usb_device_id products[] = {
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)},	/* Telit LE910Cx */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)},	/* Telit LE910Cx */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)},	/* Telit LN940 series */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x3000, 0)},	/* Telit FN912 series */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x3001, 0)},	/* Telit FN912 series */
 	{QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},	/* Telewell TW-3G HSPA+ */
 	{QMI_FIXED_INTF(0x1c9e, 0x9803, 4)},	/* Telewell TW-3G HSPA+ */
 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */

drivers/s390/char/sclp.c

@@ -1187,6 +1187,7 @@ sclp_init(void)
 fail_unregister_reboot_notifier:
 	unregister_reboot_notifier(&sclp_reboot_notifier);
 fail_init_state_uninitialized:
+	list_del(&sclp_state_change_event.list);
 	sclp_init_state = sclp_init_state_uninitialized;
 fail_unlock:
 	spin_unlock_irqrestore(&sclp_lock, flags);

drivers/s390/crypto/pkey_api.c

@@ -1088,7 +1088,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 		if (rc)
 			break;
 		if (copy_to_user(ucs, &kcs, sizeof(kcs)))
-			return -EFAULT;
+			rc = -EFAULT;
 		memzero_explicit(&kcs, sizeof(kcs));
 		break;
 	}
@@ -1119,7 +1119,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
 		if (rc)
 			break;
 		if (copy_to_user(ucp, &kcp, sizeof(kcp)))
-			return -EFAULT;
+			rc = -EFAULT;
 		memzero_explicit(&kcp, sizeof(kcp));
 		break;
 	}

drivers/scsi/qedf/qedf_main.c

@@ -3046,6 +3046,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
 	}
 
 	/* Start the Slowpath-process */
+	memset(&slowpath_params, 0, sizeof(struct qed_slowpath_params));
 	slowpath_params.int_mode = QED_INT_MODE_MSIX;
 	slowpath_params.drv_major = QEDF_DRIVER_MAJOR_VER;
 	slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER;

drivers/spi/spi-imx.c

@@ -908,7 +908,7 @@ static struct spi_imx_devtype_data imx35_cspi_devtype_data = {
 	.rx_available = mx31_rx_available,
 	.reset = mx31_reset,
 	.fifo_size = 8,
-	.has_dmamode = true,
+	.has_dmamode = false,
 	.dynamic_burst = false,
 	.devtype = IMX35_CSPI,
 };

drivers/usb/core/config.c

@@ -291,6 +291,20 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	if (ifp->desc.bNumEndpoints >= num_ep)
 		goto skip_to_next_endpoint_or_interface_descriptor;
 
+	/* Save a copy of the descriptor and use it instead of the original */
+	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+	memcpy(&endpoint->desc, d, n);
+	d = &endpoint->desc;
+
+	/* Clear the reserved bits in bEndpointAddress */
+	i = d->bEndpointAddress &
+			(USB_ENDPOINT_DIR_MASK | USB_ENDPOINT_NUMBER_MASK);
+	if (i != d->bEndpointAddress) {
+		dev_notice(ddev, "config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n",
+		    cfgno, inum, asnum, d->bEndpointAddress, i);
+		endpoint->desc.bEndpointAddress = i;
+	}
+
 	/* Check for duplicate endpoint addresses */
 	if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
 		dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
@@ -308,10 +322,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		}
 	}
 
-	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+	/* Accept this endpoint */
 	++ifp->desc.bNumEndpoints;
-
-	memcpy(&endpoint->desc, d, n);
 	INIT_LIST_HEAD(&endpoint->urb_list);
 
 	/*

drivers/usb/core/quirks.c

@@ -313,6 +313,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	{ USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT |
 	  USB_QUIRK_DELAY_CTRL_MSG },
 
+	/* START BP-850k Printer */
+	{ USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF },
+
 	/* MIDI keyboard WORLDE MINI */
 	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },

drivers/usb/gadget/configfs.c

@@ -156,9 +156,12 @@ static int usb_string_copy(const char *s, char **s_copy)
 	int ret;
 	char *str;
 	char *copy = *s_copy;
+
 	ret = strlen(s);
 	if (ret > MAX_USB_STRING_LEN)
 		return -EOVERFLOW;
+	if (ret < 1)
+		return -EINVAL;
 
 	if (copy) {
 		str = copy;

drivers/usb/serial/option.c

@@ -1428,6 +1428,10 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff),	/* Telit LN940 (MBIM) */
 	  .driver_info = NCTRL(0) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff),	/* Telit FN912 */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff),	/* Telit FN912 */
+	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff),	/* Telit LE910-S1 (RNDIS) */
 	  .driver_info = NCTRL(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff),	/* Telit LE910-S1 (ECM) */
@@ -1436,6 +1440,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff),	/* Telit LE910R1 (ECM) */
 	  .driver_info = NCTRL(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff),	/* Telit generic core-dump device */
+	  .driver_info = NCTRL(0) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9010),				/* Telit SBL FN980 flashing device */
 	  .driver_info = NCTRL(0) | ZLP },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9200),				/* Telit LE910S1 flashing device */
@@ -2227,6 +2233,10 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00),
+	  .driver_info = NCTRL(2) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00),
+	  .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
 	  .driver_info = RSVD(1) | RSVD(4) },
@@ -2286,6 +2296,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff),			/* Foxconn T99W373 MBIM */
 	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff),			/* Foxconn T99W651 RNDIS */
+	  .driver_info = RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */
@@ -2323,6 +2335,32 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff),			/* Rolling RW135-GL (laptop MBIM) */
 	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff),			/* Rolling RW350-GL (laptop MBIM) */
+	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Global */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for Global SKU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WRD for China SKU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for SA */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for EU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for NA */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for China EDU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Golbal EDU */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },

fs/dcache.c

@@ -3564,28 +3564,25 @@ out:
   
 bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
 {
-	bool result;
+	bool subdir;
 	unsigned seq;
 
 	if (new_dentry == old_dentry)
 		return true;
 
-	do {
-		/* for restarting inner loop in case of seq retry */
-		seq = read_seqbegin(&rename_lock);
-		/*
-		 * Need rcu_readlock to protect against the d_parent trashing
-		 * due to d_move
-		 */
-		rcu_read_lock();
-		if (d_ancestor(old_dentry, new_dentry))
-			result = true;
-		else
-			result = false;
-		rcu_read_unlock();
-	} while (read_seqretry(&rename_lock, seq));
-
-	return result;
+	/* Access d_parent under rcu as d_move() may change it. */
+	rcu_read_lock();
+	seq = read_seqbegin(&rename_lock);
+	subdir = d_ancestor(old_dentry, new_dentry);
+	 /* Try lockless once... */
+	if (read_seqretry(&rename_lock, seq)) {
+		/* ...else acquire lock for progress even on deep chains. */
+		read_seqlock_excl(&rename_lock);
+		subdir = d_ancestor(old_dentry, new_dentry);
+		read_sequnlock_excl(&rename_lock);
+	}
+	rcu_read_unlock();
+	return subdir;
 }
 
 static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)

fs/file.c

@@ -467,12 +467,12 @@ struct files_struct init_files = {
 
 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
 {
-	unsigned int maxfd = fdt->max_fds;
+	unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */
 	unsigned int maxbit = maxfd / BITS_PER_LONG;
 	unsigned int bitbit = start / BITS_PER_LONG;
 
 	bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG;
-	if (bitbit > maxfd)
+	if (bitbit >= maxfd)
 		return maxfd;
 	if (bitbit > start)
 		start = bitbit;

fs/hfsplus/xattr.c

@@ -706,7 +706,7 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
 		return err;
 	}
 
-	strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN +
+	strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN +
 			XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL);
 	if (!strbuf) {
 		res = -ENOMEM;

fs/jffs2/super.c

@@ -63,6 +63,7 @@ static void jffs2_i_init_once(void *foo)
 	struct jffs2_inode_info *f = foo;
 
 	mutex_init(&f->sem);
+	f->target = NULL;
 	inode_init_once(&f->vfs_inode);
 }
 

fs/jfs/xattr.c

@@ -810,7 +810,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data,
 		       size_t buf_size)
 {
 	struct jfs_ea_list *ealist;
-	struct jfs_ea *ea;
+	struct jfs_ea *ea, *ealist_end;
 	struct ea_buffer ea_buf;
 	int xattr_size;
 	ssize_t size;
@@ -830,9 +830,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data,
 		goto not_found;
 
 	ealist = (struct jfs_ea_list *) ea_buf.xattr;
+	ealist_end = END_EALIST(ealist);
 
 	/* Find the named attribute */
-	for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea))
+	for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) {
+		if (unlikely(ea + 1 > ealist_end) ||
+		    unlikely(NEXT_EA(ea) > ealist_end)) {
+			size = -EUCLEAN;
+			goto release;
+		}
+
 		if ((namelen == ea->namelen) &&
 		    memcmp(name, ea->name, namelen) == 0) {
 			/* Found it */
@@ -847,6 +854,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data,
 			memcpy(data, value, size);
 			goto release;
 		}
+	}
       not_found:
 	size = -ENODATA;
       release:
@@ -874,7 +882,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size)
 	ssize_t size = 0;
 	int xattr_size;
 	struct jfs_ea_list *ealist;
-	struct jfs_ea *ea;
+	struct jfs_ea *ea, *ealist_end;
 	struct ea_buffer ea_buf;
 
 	down_read(&JFS_IP(inode)->xattr_sem);
@@ -889,9 +897,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size)
 		goto release;
 
 	ealist = (struct jfs_ea_list *) ea_buf.xattr;
+	ealist_end = END_EALIST(ealist);
 
 	/* compute required size of list */
-	for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) {
+	for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) {
+		if (unlikely(ea + 1 > ealist_end) ||
+		    unlikely(NEXT_EA(ea) > ealist_end)) {
+			size = -EUCLEAN;
+			goto release;
+		}
+
 		if (can_list(ea))
 			size += name_size(ea) + 1;
 	}

fs/locks.c

@@ -2308,8 +2308,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
 	error = do_lock_file_wait(filp, cmd, file_lock);
 
 	/*
-	 * Attempt to detect a close/fcntl race and recover by releasing the
-	 * lock that was just acquired. There is no need to do that when we're
+	 * Detect close/fcntl races and recover by zapping all POSIX locks
+	 * associated with this file and our files_struct, just like on
+	 * filp_flush(). There is no need to do that when we're
 	 * unlocking though, or for OFD locks.
 	 */
 	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2323,9 +2324,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
 		f = fcheck(fd);
 		spin_unlock(&current->files->file_lock);
 		if (f != filp) {
-			file_lock->fl_type = F_UNLCK;
-			error = do_lock_file_wait(filp, cmd, file_lock);
-			WARN_ON_ONCE(error);
+			locks_remove_posix(filp, &current->files);
 			error = -EBADF;
 		}
 	}
@@ -2439,8 +2438,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
 	error = do_lock_file_wait(filp, cmd, file_lock);
 
 	/*
-	 * Attempt to detect a close/fcntl race and recover by releasing the
-	 * lock that was just acquired. There is no need to do that when we're
+	 * Detect close/fcntl races and recover by zapping all POSIX locks
+	 * associated with this file and our files_struct, just like on
+	 * filp_flush(). There is no need to do that when we're
 	 * unlocking though, or for OFD locks.
 	 */
 	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2454,9 +2454,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
 		f = fcheck(fd);
 		spin_unlock(&current->files->file_lock);
 		if (f != filp) {
-			file_lock->fl_type = F_UNLCK;
-			error = do_lock_file_wait(filp, cmd, file_lock);
-			WARN_ON_ONCE(error);
+			locks_remove_posix(filp, &current->files);
 			error = -EBADF;
 		}
 	}

fs/nilfs2/alloc.c

@@ -386,11 +386,12 @@ void *nilfs_palloc_block_get_entry(const struct inode *inode, __u64 nr,
  * @target: offset number of an entry in the group (start point)
  * @bsize: size in bits
  * @lock: spin lock protecting @bitmap
+ * @wrap: whether to wrap around
  */
 static int nilfs_palloc_find_available_slot(unsigned char *bitmap,
 					    unsigned long target,
 					    unsigned int bsize,
-					    spinlock_t *lock)
+					    spinlock_t *lock, bool wrap)
 {
 	int pos, end = bsize;
 
@@ -406,6 +407,8 @@ static int nilfs_palloc_find_available_slot(unsigned char *bitmap,
 
 		end = target;
 	}
+	if (!wrap)
+		return -ENOSPC;
 
 	/* wrap around */
 	for (pos = 0; pos < end; pos++) {
@@ -504,9 +507,10 @@ int nilfs_palloc_count_max_entries(struct inode *inode, u64 nused, u64 *nmaxp)
  * nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object
  * @inode: inode of metadata file using this allocator
  * @req: nilfs_palloc_req structure exchanged for the allocation
+ * @wrap: whether to wrap around
  */
 int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
-				     struct nilfs_palloc_req *req)
+				     struct nilfs_palloc_req *req, bool wrap)
 {
 	struct buffer_head *desc_bh, *bitmap_bh;
 	struct nilfs_palloc_group_desc *desc;
@@ -525,7 +529,7 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
 	entries_per_group = nilfs_palloc_entries_per_group(inode);
 
 	for (i = 0; i < ngroups; i += n) {
-		if (group >= ngroups) {
+		if (group >= ngroups && wrap) {
 			/* wrap around */
 			group = 0;
 			maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr,
@@ -550,7 +554,13 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
 				bitmap = bitmap_kaddr + bh_offset(bitmap_bh);
 				pos = nilfs_palloc_find_available_slot(
 					bitmap, group_offset,
-					entries_per_group, lock);
+					entries_per_group, lock, wrap);
+				/*
+				 * Since the search for a free slot in the
+				 * second and subsequent bitmap blocks always
+				 * starts from the beginning, the wrap flag
+				 * only has an effect on the first search.
+				 */
 				if (pos >= 0) {
 					/* found a free entry */
 					nilfs_palloc_group_desc_add_entries(

fs/nilfs2/alloc.h

@@ -59,8 +59,8 @@ struct nilfs_palloc_req {
 	struct buffer_head *pr_entry_bh;
 };
 
-int nilfs_palloc_prepare_alloc_entry(struct inode *,
-				     struct nilfs_palloc_req *);
+int nilfs_palloc_prepare_alloc_entry(struct inode *inode,
+				     struct nilfs_palloc_req *req, bool wrap);
 void nilfs_palloc_commit_alloc_entry(struct inode *,
 				     struct nilfs_palloc_req *);
 void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *);

fs/nilfs2/dat.c

@@ -84,7 +84,7 @@ int nilfs_dat_prepare_alloc(struct inode *dat, struct nilfs_palloc_req *req)
 {
 	int ret;
 
-	ret = nilfs_palloc_prepare_alloc_entry(dat, req);
+	ret = nilfs_palloc_prepare_alloc_entry(dat, req, true);
 	if (ret < 0)
 		return ret;
 

fs/nilfs2/dir.c

@@ -152,6 +152,9 @@ static bool nilfs_check_page(struct page *page)
 			goto Enamelen;
 		if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1))
 			goto Espan;
+		if (unlikely(p->inode &&
+			     NILFS_PRIVATE_INODE(le64_to_cpu(p->inode))))
+			goto Einumber;
 	}
 	if (offs != limit)
 		goto Eend;
@@ -177,6 +180,9 @@ Enamelen:
 	goto bad_entry;
 Espan:
 	error = "directory entry across blocks";
+	goto bad_entry;
+Einumber:
+	error = "disallowed inode number";
 bad_entry:
 	nilfs_error(sb,
 		    "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
@@ -399,11 +405,39 @@ found:
 
 struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)
 {
-	struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p);
+	struct page *page;
+	struct nilfs_dir_entry *de, *next_de;
+	size_t limit;
+	char *msg;
 
+	de = nilfs_get_page(dir, 0, &page);
 	if (IS_ERR(de))
 		return NULL;
-	return nilfs_next_entry(de);
+
+	limit = nilfs_last_byte(dir, 0);  /* is a multiple of chunk size */
+	if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino ||
+		     !nilfs_match(1, ".", de))) {
+		msg = "missing '.'";
+		goto fail;
+	}
+
+	next_de = nilfs_next_entry(de);
+	/*
+	 * If "next_de" has not reached the end of the chunk, there is
+	 * at least one more record.  Check whether it matches "..".
+	 */
+	if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) ||
+		     !nilfs_match(2, "..", next_de))) {
+		msg = "missing '..'";
+		goto fail;
+	}
+	*p = page;
+	return next_de;
+
+fail:
+	nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg);
+	nilfs_put_page(page);
+	return NULL;
 }
 
 ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)

fs/nilfs2/ifile.c

@@ -64,13 +64,10 @@ int nilfs_ifile_create_inode(struct inode *ifile, ino_t *out_ino,
 	struct nilfs_palloc_req req;
 	int ret;
 
-	req.pr_entry_nr = 0;  /*
-			       * 0 says find free inode from beginning
-			       * of a group. dull code!!
-			       */
+	req.pr_entry_nr = NILFS_FIRST_INO(ifile->i_sb);
 	req.pr_entry_bh = NULL;
 
-	ret = nilfs_palloc_prepare_alloc_entry(ifile, &req);
+	ret = nilfs_palloc_prepare_alloc_entry(ifile, &req, false);
 	if (!ret) {
 		ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1,
 						   &req.pr_entry_bh);

fs/nilfs2/nilfs.h

@@ -125,9 +125,15 @@ enum {
 #define NILFS_FIRST_INO(sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino)
 
 #define NILFS_MDT_INODE(sb, ino) \
-	((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino)))
+	((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino)))
 #define NILFS_VALID_INODE(sb, ino) \
-	((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino)))
+	((ino) >= NILFS_FIRST_INO(sb) ||				\
+	 ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino))))
+
+#define NILFS_PRIVATE_INODE(ino) ({					\
+	ino_t __ino = (ino);						\
+	((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO &&	\
+	 (__ino) != NILFS_SKETCH_INO); })
 
 /**
  * struct nilfs_transaction_info: context information for synchronization

fs/nilfs2/the_nilfs.c

@@ -429,6 +429,12 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 	}
 
 	nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino);
+	if (nilfs->ns_first_ino < NILFS_USER_INO) {
+		nilfs_err(nilfs->ns_sb,
+			  "too small lower limit for non-reserved inode numbers: %u",
+			  nilfs->ns_first_ino);
+		return -EINVAL;
+	}
 
 	nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
 	if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {

fs/nilfs2/the_nilfs.h

@@ -190,7 +190,7 @@ struct the_nilfs {
 	unsigned long		ns_nrsvsegs;
 	unsigned long		ns_first_data_block;
 	int			ns_inode_size;
-	int			ns_first_ino;
+	unsigned int		ns_first_ino;
 	u32			ns_crc_seed;
 
 	/* /sys/fs/<nilfs>/<device> */

fs/ocfs2/dir.c

@@ -313,13 +313,16 @@ out:
  * bh passed here can be an inode block or a dir data block, depending
  * on the inode inline data flag.
  */
-static int ocfs2_check_dir_entry(struct inode * dir,
-				 struct ocfs2_dir_entry * de,
-				 struct buffer_head * bh,
+static int ocfs2_check_dir_entry(struct inode *dir,
+				 struct ocfs2_dir_entry *de,
+				 struct buffer_head *bh,
+				 char *buf,
+				 unsigned int size,
 				 unsigned long offset)
 {
 	const char *error_msg = NULL;
 	const int rlen = le16_to_cpu(de->rec_len);
+	const unsigned long next_offset = ((char *) de - buf) + rlen;
 
 	if (unlikely(rlen < OCFS2_DIR_REC_LEN(1)))
 		error_msg = "rec_len is smaller than minimal";
@@ -327,9 +330,11 @@ static int ocfs2_check_dir_entry(struct inode * dir,
 		error_msg = "rec_len % 4 != 0";
 	else if (unlikely(rlen < OCFS2_DIR_REC_LEN(de->name_len)))
 		error_msg = "rec_len is too small for name_len";
-	else if (unlikely(
-		 ((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize))
-		error_msg = "directory entry across blocks";
+	else if (unlikely(next_offset > size))
+		error_msg = "directory entry overrun";
+	else if (unlikely(next_offset > size - OCFS2_DIR_REC_LEN(1)) &&
+		 next_offset != size)
+		error_msg = "directory entry too close to end";
 
 	if (unlikely(error_msg != NULL))
 		mlog(ML_ERROR, "bad entry in directory #%llu: %s - "
@@ -371,16 +376,17 @@ static inline int ocfs2_search_dirblock(struct buffer_head *bh,
 	de_buf = first_de;
 	dlimit = de_buf + bytes;
 
-	while (de_buf < dlimit) {
+	while (de_buf < dlimit - OCFS2_DIR_MEMBER_LEN) {
 		/* this code is executed quadratically often */
 		/* do minimal checking `by hand' */
 
 		de = (struct ocfs2_dir_entry *) de_buf;
 
-		if (de_buf + namelen <= dlimit &&
+		if (de->name + namelen <= dlimit &&
 		    ocfs2_match(namelen, name, de)) {
 			/* found a match - just to be sure, do a full check */
-			if (!ocfs2_check_dir_entry(dir, de, bh, offset)) {
+			if (!ocfs2_check_dir_entry(dir, de, bh, first_de,
+						   bytes, offset)) {
 				ret = -1;
 				goto bail;
 			}
@@ -1157,7 +1163,7 @@ static int __ocfs2_delete_entry(handle_t *handle, struct inode *dir,
 	pde = NULL;
 	de = (struct ocfs2_dir_entry *) first_de;
 	while (i < bytes) {
-		if (!ocfs2_check_dir_entry(dir, de, bh, i)) {
+		if (!ocfs2_check_dir_entry(dir, de, bh, first_de, bytes, i)) {
 			status = -EIO;
 			mlog_errno(status);
 			goto bail;
@@ -1657,7 +1663,8 @@ int __ocfs2_add_entry(handle_t *handle,
 		/* These checks should've already been passed by the
 		 * prepare function, but I guess we can leave them
 		 * here anyway. */
-		if (!ocfs2_check_dir_entry(dir, de, insert_bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, insert_bh, data_start,
+					   size, offset)) {
 			retval = -ENOENT;
 			goto bail;
 		}
@@ -1795,7 +1802,8 @@ static int ocfs2_dir_foreach_blk_id(struct inode *inode,
 		}
 
 		de = (struct ocfs2_dir_entry *) (data->id_data + ctx->pos);
-		if (!ocfs2_check_dir_entry(inode, de, di_bh, ctx->pos)) {
+		if (!ocfs2_check_dir_entry(inode, de, di_bh, (char *)data->id_data,
+					   i_size_read(inode), ctx->pos)) {
 			/* On error, skip the f_pos to the end. */
 			ctx->pos = i_size_read(inode);
 			break;
@@ -1892,7 +1900,8 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode,
 		while (ctx->pos < i_size_read(inode)
 		       && offset < sb->s_blocksize) {
 			de = (struct ocfs2_dir_entry *) (bh->b_data + offset);
-			if (!ocfs2_check_dir_entry(inode, de, bh, offset)) {
+			if (!ocfs2_check_dir_entry(inode, de, bh, bh->b_data,
+						   sb->s_blocksize, offset)) {
 				/* On error, skip the f_pos to the
 				   next block. */
 				ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1;
@@ -3368,7 +3377,7 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh,
 	struct super_block *sb = dir->i_sb;
 	struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
 	struct ocfs2_dir_entry *de, *last_de = NULL;
-	char *de_buf, *limit;
+	char *first_de, *de_buf, *limit;
 	unsigned long offset = 0;
 	unsigned int rec_len, new_rec_len, free_space = dir->i_sb->s_blocksize;
 
@@ -3381,14 +3390,16 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh,
 	else
 		free_space = dir->i_sb->s_blocksize - i_size_read(dir);
 
-	de_buf = di->id2.i_data.id_data;
+	first_de = di->id2.i_data.id_data;
+	de_buf = first_de;
 	limit = de_buf + i_size_read(dir);
 	rec_len = OCFS2_DIR_REC_LEN(namelen);
 
 	while (de_buf < limit) {
 		de = (struct ocfs2_dir_entry *)de_buf;
 
-		if (!ocfs2_check_dir_entry(dir, de, di_bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, di_bh, first_de,
+					   i_size_read(dir), offset)) {
 			ret = -ENOENT;
 			goto out;
 		}
@@ -3470,7 +3481,8 @@ static int ocfs2_find_dir_space_el(struct inode *dir, const char *name,
 			/* move to next block */
 			de = (struct ocfs2_dir_entry *) bh->b_data;
 		}
-		if (!ocfs2_check_dir_entry(dir, de, bh, offset)) {
+		if (!ocfs2_check_dir_entry(dir, de, bh, bh->b_data, blocksize,
+					   offset)) {
 			status = -ENOENT;
 			goto bail;
 		}

fs/orangefs/super.c

@@ -188,7 +188,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf)
 		     (long)new_op->downcall.resp.statfs.files_avail);
 
 	buf->f_type = sb->s_magic;
-	memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid));
+	buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id;
+	buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id;
 	buf->f_bsize = new_op->downcall.resp.statfs.block_size;
 	buf->f_namelen = ORANGEFS_NAME_MAX;
 

include/linux/fsnotify.h

@@ -38,7 +38,13 @@ static inline int fsnotify_perm(struct file *file, int mask)
 	__u32 fsnotify_mask = 0;
 	int ret;
 
-	if (file->f_mode & FMODE_NONOTIFY)
+	/*
+	 * FMODE_NONOTIFY are fds generated by fanotify itself which should not
+	 * generate new events. We also don't want to generate events for
+	 * FMODE_PATH fds (involves open & close events) as they are just
+	 * handle creation / destruction events and not "real" file events.
+	 */
+	if (file->f_mode & (FMODE_NONOTIFY | FMODE_PATH))
 		return 0;
 	if (!(mask & (MAY_READ | MAY_OPEN)))
 		return 0;

include/linux/i2c-pnx.h

@@ -1,38 +0,0 @@
-/*
- * Header file for I2C support on PNX010x/4008.
- *
- * Author: Dennis Kovalev <dkovalev@ru.mvista.com>
- *
- * 2004-2006 (c) MontaVista Software, Inc. This file is licensed under
- * the terms of the GNU General Public License version 2. This program
- * is licensed "as is" without any warranty of any kind, whether express
- * or implied.
- */
-
-#ifndef __I2C_PNX_H__
-#define __I2C_PNX_H__
-
-struct platform_device;
-struct clk;
-
-struct i2c_pnx_mif {
-	int			ret;		/* Return value */
-	int			mode;		/* Interface mode */
-	struct completion	complete;	/* I/O completion */
-	struct timer_list	timer;		/* Timeout */
-	u8 *			buf;		/* Data buffer */
-	int			len;		/* Length of data buffer */
-	int			order;		/* RX Bytes to order via TX */
-};
-
-struct i2c_pnx_algo_data {
-	void __iomem		*ioaddr;
-	struct i2c_pnx_mif	mif;
-	int			last;
-	struct clk		*clk;
-	struct i2c_adapter	adapter;
-	int			irq;
-	u32			timeout;
-};
-
-#endif /* __I2C_PNX_H__ */

kernel/exit.c

@@ -498,6 +498,8 @@ retry:
 	 * Search through everything else, we should not get here often.
 	 */
 	for_each_process(g) {
+		if (atomic_read(&mm->mm_users) <= 1)
+			break;
 		if (g->flags & PF_KTHREAD)
 			continue;
 		for_each_thread(g, c) {

mm/page-writeback.c

@@ -1531,7 +1531,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc)
 	 */
 	dtc->wb_thresh = __wb_calc_thresh(dtc);
 	dtc->wb_bg_thresh = dtc->thresh ?
-		div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
+		div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
 
 	/*
 	 * In order to avoid the stacked BDI deadlock we need

net/bluetooth/hci_core.c

@@ -3208,7 +3208,11 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
 
+	cancel_work_sync(&hdev->rx_work);
+	cancel_work_sync(&hdev->cmd_work);
+	cancel_work_sync(&hdev->tx_work);
 	cancel_work_sync(&hdev->power_on);
+	cancel_work_sync(&hdev->error_reset);
 
 	hci_dev_do_close(hdev);
 

net/bluetooth/hci_event.c

@@ -5024,7 +5024,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 			bt_dev_err(hdev, "Dropping invalid advertising data");
 		}
 
-		ptr += sizeof(*ev) + ev->length + 1;
+		ptr += sizeof(*ev) + ev->length;
 	}
 
 	hci_dev_unlock(hdev);

net/ceph/mon_client.c

@@ -963,13 +963,19 @@ static void delayed_work(struct work_struct *work)
 	struct ceph_mon_client *monc =
 		container_of(work, struct ceph_mon_client, delayed_work.work);
 
-	dout("monc delayed_work\n");
 	mutex_lock(&monc->mutex);
+	dout("%s mon%d\n", __func__, monc->cur_mon);
+	if (monc->cur_mon < 0) {
+		goto out;
+	}
+
 	if (monc->hunting) {
 		dout("%s continuing hunt\n", __func__);
 		reopen_session(monc);
 	} else {
 		int is_auth = ceph_auth_is_authenticated(monc->auth);
+
+		dout("%s is_authed %d\n", __func__, is_auth);
 		if (ceph_con_keepalive_expired(&monc->con,
 					       CEPH_MONC_PING_TIMEOUT)) {
 			dout("monc keepalive timeout\n");
@@ -994,6 +1000,8 @@ static void delayed_work(struct work_struct *work)
 		}
 	}
 	__schedule_delayed(monc);
+
+out:
 	mutex_unlock(&monc->mutex);
 }
 
@@ -1107,13 +1115,15 @@ EXPORT_SYMBOL(ceph_monc_init);
 void ceph_monc_stop(struct ceph_mon_client *monc)
 {
 	dout("stop\n");
-	cancel_delayed_work_sync(&monc->delayed_work);
 
 	mutex_lock(&monc->mutex);
 	__close_session(monc);
+	monc->hunting = false;
 	monc->cur_mon = -1;
 	mutex_unlock(&monc->mutex);
 
+	cancel_delayed_work_sync(&monc->delayed_work);
+
 	/*
 	 * flush msgr queue before we destroy ourselves to ensure that:
 	 *  - any work that references our embedded con is finished.

net/ipv4/af_inet.c

@@ -745,7 +745,9 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags,
 	sock_rps_record_flow(sk2);
 	WARN_ON(!((1 << sk2->sk_state) &
 		  (TCPF_ESTABLISHED | TCPF_SYN_RECV |
-		  TCPF_CLOSE_WAIT | TCPF_CLOSE)));
+		   TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 |
+		   TCPF_CLOSING | TCPF_CLOSE_WAIT |
+		   TCPF_CLOSE)));
 
 	sock_graft(sk2, newsock);
 

net/ipv4/inet_diag.c

@@ -1089,6 +1089,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb,
 	req.sdiag_family = AF_UNSPEC; /* compatibility */
 	req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
 	req.idiag_ext = rc->idiag_ext;
+	req.pad = 0;
 	req.idiag_states = rc->idiag_states;
 	req.id = rc->id;
 
@@ -1107,6 +1108,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
 	req.sdiag_family = rc->idiag_family;
 	req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
 	req.idiag_ext = rc->idiag_ext;
+	req.pad = 0;
 	req.idiag_states = rc->idiag_states;
 	req.id = rc->id;
 

net/ipv4/tcp_input.c

@@ -1953,8 +1953,16 @@ void tcp_clear_retrans(struct tcp_sock *tp)
 static inline void tcp_init_undo(struct tcp_sock *tp)
 {
 	tp->undo_marker = tp->snd_una;
+
 	/* Retransmission still in flight may cause DSACKs later. */
-	tp->undo_retrans = tp->retrans_out ? : -1;
+	/* First, account for regular retransmits in flight: */
+	tp->undo_retrans = tp->retrans_out;
+	/* Next, account for TLP retransmits in flight: */
+	if (tp->tlp_high_seq && tp->tlp_retrans)
+		tp->undo_retrans++;
+	/* Finally, avoid 0, because undo_retrans==0 means "can undo now": */
+	if (!tp->undo_retrans)
+		tp->undo_retrans = -1;
 }
 
 /* Enter Loss state. If we detect SACK reneging, forget all SACK information
@@ -2028,6 +2036,7 @@ void tcp_enter_loss(struct sock *sk)
 				       net->ipv4.sysctl_tcp_reordering);
 	tcp_set_ca_state(sk, TCP_CA_Loss);
 	tp->high_seq = tp->snd_nxt;
+	tp->tlp_high_seq = 0;
 	tcp_ecn_queue_cwr(tp);
 
 	/* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
@@ -2876,7 +2885,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
 				  tcp_fackets_out(tp) > tp->reordering;
 		}
 		if (tcp_try_undo_dsack(sk)) {
-			tcp_try_keep_open(sk);
+			tcp_try_to_open(sk, flag);
 			return;
 		}
 		tcp_rack_identify_loss(sk, ack_flag);

net/ipv4/tcp_metrics.c

@@ -628,6 +628,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] =
 	[TCP_METRICS_ATTR_ADDR_IPV4]	= { .type = NLA_U32, },
 	[TCP_METRICS_ATTR_ADDR_IPV6]	= { .type = NLA_BINARY,
 					    .len = sizeof(struct in6_addr), },
+	[TCP_METRICS_ATTR_SADDR_IPV4]	= { .type = NLA_U32, },
 	/* Following attributes are not received for GET/DEL,
 	 * we keep them for reference
 	 */

net/ipv4/tcp_timer.c

@@ -433,8 +433,13 @@ static bool tcp_rtx_probe0_timed_out(const struct sock *sk,
 {
 	const struct tcp_sock *tp = tcp_sk(sk);
 	const int timeout = TCP_RTO_MAX * 2;
-	u32 rcv_delta, rtx_delta;
+	u32 rtx_delta;
+	s32 rcv_delta;
 
+	/* Note: timer interrupt might have been delayed by at least one jiffy,
+	 * and tp->rcv_tstamp might very well have been written recently.
+	 * rcv_delta can thus be negative.
+	 */
 	rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
 	if (rcv_delta <= timeout)
 		return false;
@@ -480,8 +485,6 @@ void tcp_retransmit_timer(struct sock *sk)
 	if (WARN_ON_ONCE(!skb))
 		return;
 
-	tp->tlp_high_seq = 0;
-
 	if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
 	    !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
 		/* Receiver dastardly shrinks window. Our retransmits

net/ipv6/ila/ila_lwt.c

@@ -55,7 +55,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 		return orig_dst->lwtstate->orig_output(net, sk, skb);
 	}
 
+	local_bh_disable();
 	dst = dst_cache_get(&ilwt->dst_cache);
+	local_bh_enable();
 	if (unlikely(!dst)) {
 		struct ipv6hdr *ip6h = ipv6_hdr(skb);
 		struct flowi6 fl6;
@@ -83,8 +85,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 			goto drop;
 		}
 
-		if (ilwt->connected)
+		if (ilwt->connected) {
+			local_bh_disable();
 			dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr);
+			local_bh_enable();
+		}
 	}
 
 	skb_dst_set(skb, dst);

net/mac80211/mesh.c

@@ -1452,6 +1452,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 	ifmsh->last_preq = jiffies;
 	ifmsh->next_perr = jiffies;
 	ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
+	ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
 	/* Allocate all mesh structures when creating the first mesh interface. */
 	if (!mesh_allocated)
 		ieee80211s_init();

net/mac80211/scan.c

@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <net/mac80211.h>
+#include <linux/overflow.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -592,15 +593,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 			local->hw_scan_ies_bufsize *= n_bands;
 		}
 
-		local->hw_scan_req = kmalloc(
-				sizeof(*local->hw_scan_req) +
-				req->n_channels * sizeof(req->channels[0]) +
-				local->hw_scan_ies_bufsize, GFP_KERNEL);
+		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
+							 req.channels,
+							 req->n_channels) +
+					     local->hw_scan_ies_bufsize,
+					     GFP_KERNEL);
 		if (!local->hw_scan_req)
 			return -ENOMEM;
 
 		local->hw_scan_req->req.ssids = req->ssids;
 		local->hw_scan_req->req.n_ssids = req->n_ssids;
+		/* None of the channels are actually set
+		 * up but let UBSAN know the boundaries.
+		 */
+		local->hw_scan_req->req.n_channels = req->n_channels;
+
 		ies = (u8 *)local->hw_scan_req +
 			sizeof(*local->hw_scan_req) +
 			req->n_channels * sizeof(req->channels[0]);

net/mac802154/tx.c

@@ -42,8 +42,8 @@ void ieee802154_xmit_worker(struct work_struct *work)
 	if (res)
 		goto err_tx;
 
-	dev->stats.tx_packets++;
-	dev->stats.tx_bytes += skb->len;
+	DEV_STATS_INC(dev, tx_packets);
+	DEV_STATS_ADD(dev, tx_bytes, skb->len);
 
 	ieee802154_xmit_complete(&local->hw, skb, false);
 
@@ -94,8 +94,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
 			goto err_tx;
 		}
 
-		dev->stats.tx_packets++;
-		dev->stats.tx_bytes += len;
+		DEV_STATS_INC(dev, tx_packets);
+		DEV_STATS_ADD(dev, tx_bytes, len);
 	} else {
 		local->tx_skb = skb;
 		queue_work(local->workqueue, &local->tx_work);

net/sctp/socket.c

@@ -66,6 +66,7 @@
 #include <linux/slab.h>
 #include <linux/file.h>
 #include <linux/compat.h>
+#include <linux/overflow.h>
 
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -6407,6 +6408,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
 	struct sctp_sock *sp = sctp_sk(sk);
 	struct sctp_association *asoc;
 	struct sctp_assoc_ids *ids;
+	size_t ids_size;
 	u32 num = 0;
 
 	if (sctp_style(sk, TCP))
@@ -6419,11 +6421,11 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
 		num++;
 	}
 
-	if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
+	ids_size = struct_size(ids, gaids_assoc_id, num);
+	if (len < ids_size)
 		return -EINVAL;
 
-	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
-
+	len = ids_size;
 	ids = kmalloc(len, GFP_USER | __GFP_NOWARN);
 	if (unlikely(!ids))
 		return -ENOMEM;

net/wireless/scan.c

@@ -1405,10 +1405,14 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 	wiphy = &rdev->wiphy;
 
 	/* Determine number of channels, needed to allocate creq */
-	if (wreq && wreq->num_channels)
+	if (wreq && wreq->num_channels) {
+		/* Passed from userspace so should be checked */
+		if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
+			return -EINVAL;
 		n_channels = wreq->num_channels;
-	else
+	} else {
 		n_channels = ieee80211_get_num_supported_channels(wiphy);
+	}
 
 	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
 		       n_channels * sizeof(void *),

scripts/gcc-plugins/gcc-common.h

@@ -971,4 +971,8 @@ static inline void debug_gimple_stmt(const_gimple s)
 #define SET_DECL_MODE(decl, mode)	DECL_MODE(decl) = (mode)
 #endif
 
+#if BUILDING_GCC_VERSION >= 14000
+#define last_stmt(x)			last_nondebug_stmt(x)
+#endif
+
 #endif

scripts/kconfig/expr.c

@@ -333,35 +333,6 @@ static struct expr *expr_eliminate_yn(struct expr *e)
 	return e;
 }
 
-/*
- * bool FOO!=n => FOO
- */
-struct expr *expr_trans_bool(struct expr *e)
-{
-	if (!e)
-		return NULL;
-	switch (e->type) {
-	case E_AND:
-	case E_OR:
-	case E_NOT:
-		e->left.expr = expr_trans_bool(e->left.expr);
-		e->right.expr = expr_trans_bool(e->right.expr);
-		break;
-	case E_UNEQUAL:
-		// FOO!=n -> FOO
-		if (e->left.sym->type == S_TRISTATE) {
-			if (e->right.sym == &symbol_no) {
-				e->type = E_SYMBOL;
-				e->right.sym = NULL;
-			}
-		}
-		break;
-	default:
-		;
-	}
-	return e;
-}
-
 /*
  * e1 || e2 -> ?
  */

scripts/kconfig/expr.h

@@ -211,7 +211,6 @@ struct expr *expr_copy(const struct expr *org);
 void expr_free(struct expr *e);
 void expr_eliminate_eq(struct expr **ep1, struct expr **ep2);
 tristate expr_calc_value(struct expr *e);
-struct expr *expr_trans_bool(struct expr *e);
 struct expr *expr_eliminate_dups(struct expr *e);
 struct expr *expr_transform(struct expr *e);
 int expr_contains_symbol(struct expr *dep, struct symbol *sym);

scripts/kconfig/gconf.c

@@ -1488,7 +1488,6 @@ int main(int ac, char *av[])
 
 	conf_parse(name);
 	fixup_rootmenu(&rootmenu);
-	conf_read(NULL);
 
 	/* Load the interface and connect signals */
 	init_main_window(glade_file);
@@ -1496,6 +1495,8 @@ int main(int ac, char *av[])
 	init_left_tree();
 	init_right_tree();
 
+	conf_read(NULL);
+
 	switch (view_mode) {
 	case SINGLE_VIEW:
 		display_tree_part();

scripts/kconfig/menu.c

@@ -330,8 +330,6 @@ void menu_finalize(struct menu *parent)
 				dep = expr_transform(prop->visible.expr);
 				dep = expr_alloc_and(expr_copy(basedep), dep);
 				dep = expr_eliminate_dups(dep);
-				if (menu->sym && menu->sym->type != S_TRISTATE)
-					dep = expr_trans_bool(dep);
 				prop->visible.expr = dep;
 				if (prop->type == P_SELECT) {
 					struct symbol *es = prop_get_symbol(prop);

sound/core/pcm_dmaengine.c

@@ -354,6 +354,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan);
 int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream)
 {
 	struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state);
+	if (status == DMA_PAUSED)
+		dmaengine_terminate_async(prtd->dma_chan);
 
 	dmaengine_synchronize(prtd->dma_chan);
 	kfree(prtd);
@@ -371,6 +377,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close);
 int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream)
 {
 	struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct dma_tx_state state;
+	enum dma_status status;
+
+	status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state);
+	if (status == DMA_PAUSED)
+		dmaengine_terminate_async(prtd->dma_chan);
 
 	dmaengine_synchronize(prtd->dma_chan);
 	dma_release_channel(prtd->dma_chan);

tools/testing/selftests/net/msg_zerocopy.c

@@ -81,6 +81,7 @@ static bool cfg_rx;
 static int  cfg_runtime_ms	= 4200;
 static int  cfg_verbose;
 static int  cfg_waittime_ms	= 500;
+static int  cfg_notification_limit = 32;
 static bool cfg_zerocopy;
 
 static socklen_t cfg_alen;
@@ -91,6 +92,7 @@ static char payload[IP_MAXPACKET];
 static long packets, bytes, completions, expected_completions;
 static int  zerocopied = -1;
 static uint32_t next_completion;
+static uint32_t sends_since_notify;
 
 static unsigned long gettimeofday_ms(void)
 {
@@ -182,6 +184,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
 		error(1, errno, "send");
 	if (cfg_verbose && ret != len)
 		fprintf(stderr, "send: ret=%u != %u\n", ret, len);
+	sends_since_notify++;
 
 	if (len) {
 		packets++;
@@ -306,7 +309,53 @@ static int do_setup_tx(int domain, int type, int protocol)
 	return fd;
 }
 
-static bool do_recv_completion(int fd)
+static uint32_t do_process_zerocopy_cookies(struct rds_zcopy_cookies *ck)
+{
+	int i;
+
+	if (ck->num > RDS_MAX_ZCOOKIES)
+		error(1, 0, "Returned %d cookies, max expected %d\n",
+		      ck->num, RDS_MAX_ZCOOKIES);
+	for (i = 0; i < ck->num; i++)
+		if (cfg_verbose >= 2)
+			fprintf(stderr, "%d\n", ck->cookies[i]);
+	return ck->num;
+}
+
+static bool do_recvmsg_completion(int fd)
+{
+	char cmsgbuf[CMSG_SPACE(sizeof(struct rds_zcopy_cookies))];
+	struct rds_zcopy_cookies *ck;
+	struct cmsghdr *cmsg;
+	struct msghdr msg;
+	bool ret = false;
+
+	memset(&msg, 0, sizeof(msg));
+	msg.msg_control = cmsgbuf;
+	msg.msg_controllen = sizeof(cmsgbuf);
+
+	if (recvmsg(fd, &msg, MSG_DONTWAIT))
+		return ret;
+
+	if (msg.msg_flags & MSG_CTRUNC)
+		error(1, errno, "recvmsg notification: truncated");
+
+	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+		if (cmsg->cmsg_level == SOL_RDS &&
+		    cmsg->cmsg_type == RDS_CMSG_ZCOPY_COMPLETION) {
+
+			ck = (struct rds_zcopy_cookies *)CMSG_DATA(cmsg);
+			completions += do_process_zerocopy_cookies(ck);
+			ret = true;
+			break;
+		}
+		error(0, 0, "ignoring cmsg at level %d type %d\n",
+			    cmsg->cmsg_level, cmsg->cmsg_type);
+	}
+	return ret;
+}
+
+static bool do_recv_completion(int fd, int domain)
 {
 	struct sock_extended_err *serr;
 	struct msghdr msg = {};
@@ -315,6 +364,9 @@ static bool do_recv_completion(int fd)
 	int ret, zerocopy;
 	char control[100];
 
+	if (domain == PF_RDS)
+		return do_recvmsg_completion(fd);
+
 	msg.msg_control = control;
 	msg.msg_controllen = sizeof(control);
 
@@ -348,7 +400,7 @@ static bool do_recv_completion(int fd)
 	/* Detect notification gaps. These should not happen often, if at all.
 	 * Gaps can occur due to drops, reordering and retransmissions.
 	 */
-	if (lo != next_completion)
+	if (cfg_verbose && lo != next_completion)
 		fprintf(stderr, "gap: %u..%u does not append to %u\n",
 			lo, hi, next_completion);
 	next_completion = hi + 1;
@@ -370,20 +422,21 @@ static bool do_recv_completion(int fd)
 }
 
 /* Read all outstanding messages on the errqueue */
-static void do_recv_completions(int fd)
+static void do_recv_completions(int fd, int domain)
 {
-	while (do_recv_completion(fd)) {}
+	while (do_recv_completion(fd, domain)) {}
+	sends_since_notify = 0;
 }
 
 /* Wait for all remaining completions on the errqueue */
-static void do_recv_remaining_completions(int fd)
+static void do_recv_remaining_completions(int fd, int domain)
 {
 	int64_t tstop = gettimeofday_ms() + cfg_waittime_ms;
 
 	while (completions < expected_completions &&
 	       gettimeofday_ms() < tstop) {
-		if (do_poll(fd, POLLERR))
-			do_recv_completions(fd);
+		if (do_poll(fd, domain == PF_RDS ? POLLIN : POLLERR))
+			do_recv_completions(fd, domain);
 	}
 
 	if (completions < expected_completions)
@@ -455,15 +508,18 @@ static void do_tx(int domain, int type, int protocol)
 		else
 			do_sendmsg(fd, &msg, cfg_zerocopy);
 
+		if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit)
+			do_recv_completions(fd, domain);
+
 		while (!do_poll(fd, POLLOUT)) {
 			if (cfg_zerocopy)
-				do_recv_completions(fd);
+				do_recv_completions(fd, domain);
 		}
 
 	} while (gettimeofday_ms() < tstop);
 
 	if (cfg_zerocopy)
-		do_recv_remaining_completions(fd);
+		do_recv_remaining_completions(fd, domain);
 
 	if (close(fd))
 		error(1, errno, "close");
@@ -612,7 +668,7 @@ static void parse_opts(int argc, char **argv)
 
 	cfg_payload_len = max_payload_len;
 
-	while ((c = getopt(argc, argv, "46c:C:D:i:mp:rs:S:t:vz")) != -1) {
+	while ((c = getopt(argc, argv, "46c:C:D:i:l:mp:rs:S:t:vz")) != -1) {
 		switch (c) {
 		case '4':
 			if (cfg_family != PF_UNSPEC)
@@ -640,6 +696,9 @@ static void parse_opts(int argc, char **argv)
 			if (cfg_ifindex == 0)
 				error(1, errno, "invalid iface: %s", optarg);
 			break;
+		case 'l':
+			cfg_notification_limit = strtoul(optarg, NULL, 0);
+			break;
 		case 'm':
 			cfg_cork_mixed = true;
 			break;

tools/testing/selftests/vDSO/parse_vdso.c

@@ -77,14 +77,20 @@ static struct vdso_info
 	ELF(Verdef) *verdef;
 } vdso_info;
 
-/* Straight from the ELF specification. */
-static unsigned long elf_hash(const unsigned char *name)
+/*
+ * Straight from the ELF specification...and then tweaked slightly, in order to
+ * avoid a few clang warnings.
+ */
+static unsigned long elf_hash(const char *name)
 {
 	unsigned long h = 0, g;
-	while (*name)
+	const unsigned char *uch_name = (const unsigned char *)name;
+
+	while (*uch_name)
 	{
-		h = (h << 4) + *name++;
-		if (g = h & 0xf0000000)
+		h = (h << 4) + *uch_name++;
+		g = h & 0xf0000000;
+		if (g)
 			h ^= g >> 24;
 		h &= ~g;
 	}

tools/testing/selftests/vDSO/vdso_standalone_test_x86.c

@@ -20,7 +20,7 @@ extern void *vdso_sym(const char *version, const char *name);
 extern void vdso_init_from_sysinfo_ehdr(uintptr_t base);
 extern void vdso_init_from_auxv(void *auxv);
 
-/* We need a libc functions... */
+/* We need some libc functions... */
 int strcmp(const char *a, const char *b)
 {
 	/* This implementation is buggy: it never returns -1. */
@@ -36,6 +36,20 @@ int strcmp(const char *a, const char *b)
 	return 0;
 }
 
+/*
+ * The clang build needs this, although gcc does not.
+ * Stolen from lib/string.c.
+ */
+void *memcpy(void *dest, const void *src, size_t count)
+{
+	char *tmp = dest;
+	const char *s = src;
+
+	while (count--)
+		*tmp++ = *s++;
+	return dest;
+}
+
 /* ...and two syscalls.  This is x86-specific. */
 static inline long x86_syscall3(long nr, long a0, long a1, long a2)
 {
@@ -72,7 +86,7 @@ void to_base10(char *lastdig, time_t n)
 	}
 }
 
-__attribute__((externally_visible)) void c_main(void **stack)
+void c_main(void **stack)
 {
 	/* Parse the stack */
 	long argc = (long)*stack;