diff options
author | Mike Pagano <mpagano@gentoo.org> | 2022-08-25 06:35:35 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2022-08-25 06:35:35 -0400 |
commit | dc22a2be91aae4e8b26fe9dc16b5ff11167b736b (patch) | |
tree | 60840604b677dd3d8752f9187f22e672c8f817f9 | |
parent | Linux patch 4.19.255 (diff) | |
download | linux-patches-dc22a2be91aae4e8b26fe9dc16b5ff11167b736b.tar.gz linux-patches-dc22a2be91aae4e8b26fe9dc16b5ff11167b736b.tar.bz2 linux-patches-dc22a2be91aae4e8b26fe9dc16b5ff11167b736b.zip |
Linux patch 4.19.2564.19-255
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1255_linux-4.19.256.patch | 7790 |
2 files changed, 7794 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 3ed2554f..b20110e2 100644 --- a/0000_README +++ b/0000_README @@ -1063,6 +1063,10 @@ Patch: 1254_linux-4.19.255.patch From: https://www.kernel.org Desc: Linux 4.19.255 +Patch: 1255_linux-4.19.256.patch +From: https://www.kernel.org +Desc: Linux 4.19.256 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1255_linux-4.19.256.patch b/1255_linux-4.19.256.patch new file mode 100644 index 00000000..f0d5c314 --- /dev/null +++ b/1255_linux-4.19.256.patch @@ -0,0 +1,7790 @@ +diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt +index be70b32c95d91..bc3fac8e1db3a 100644 +--- a/Documentation/atomic_bitops.txt ++++ b/Documentation/atomic_bitops.txt +@@ -59,7 +59,7 @@ Like with atomic_t, the rule of thumb is: + - RMW operations that have a return value are fully ordered. + + - RMW operations that are conditional are unordered on FAILURE, +- otherwise the above rules apply. In the case of test_and_{}_bit() operations, ++ otherwise the above rules apply. In the case of test_and_set_bit_lock(), + if the bit in memory is unchanged by the operation then it is deemed to have + failed. + +diff --git a/Makefile b/Makefile +index b8e5b38e5352d..ac79aef4520be 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 255 ++SUBLEVEL = 256 + EXTRAVERSION = + NAME = "People's Front" + +@@ -876,6 +876,9 @@ LDFLAGS_BUILD_ID := $(call ld-option, --build-id) + KBUILD_LDFLAGS_MODULE += $(LDFLAGS_BUILD_ID) + LDFLAGS_vmlinux += $(LDFLAGS_BUILD_ID) + ++KBUILD_LDFLAGS += -z noexecstack ++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments) ++ + ifeq ($(CONFIG_STRIP_ASM_SYMS),y) + LDFLAGS_vmlinux += $(call ld-option, -X,) + endif +diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +index 2375449c02d05..10626452878ab 100644 +--- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +@@ -5,7 +5,7 @@ + + / { + model = "AST2500 EVB"; +- compatible = "aspeed,ast2500"; ++ compatible = "aspeed,ast2500-evb", "aspeed,ast2500"; + + aliases { + serial4 = &uart5; +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index adecd6e08468c..334638ff50750 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -61,20 +61,18 @@ + reg = <0>; + clock-latency = <61036>; /* two CLK32 periods */ + #cooling-cells = <2>; +- operating-points = < ++ operating-points = + /* kHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1025000 +- 198000 950000 +- >; +- fsl,soc-operating-points = < ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1025000>, ++ <198000 950000>; ++ fsl,soc-operating-points = + /* KHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1175000 +- 198000 1175000 +- >; ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1175000>, ++ <198000 1175000>; + clocks = <&clks IMX6UL_CLK_ARM>, + <&clks IMX6UL_CLK_PLL2_BUS>, + <&clks IMX6UL_CLK_PLL2_PFD2>, +@@ -169,6 +167,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + }; + + dma_apbh: dma-apbh@1804000 { +@@ -939,7 +940,7 @@ + }; + + lcdif: lcdif@21c8000 { +- compatible = "fsl,imx6ul-lcdif", "fsl,imx28-lcdif"; ++ compatible = "fsl,imx6ul-lcdif", "fsl,imx6sx-lcdif"; + reg = <0x021c8000 0x4000>; + interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6UL_CLK_LCDIF_PIX>, +@@ -952,7 +953,7 @@ + qspi: qspi@21e0000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "fsl,imx6ul-qspi", "fsl,imx6sx-qspi"; ++ compatible = "fsl,imx6ul-qspi"; + reg = <0x021e0000 0x4000>, <0x60000000 0x10000000>; + reg-names = "QuadSPI", "QuadSPI-memory"; + interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>; +diff --git a/arch/arm/boot/dts/qcom-pm8841.dtsi b/arch/arm/boot/dts/qcom-pm8841.dtsi +index 2fd59c440903d..c73e5b149ac5e 100644 +--- a/arch/arm/boot/dts/qcom-pm8841.dtsi ++++ b/arch/arm/boot/dts/qcom-pm8841.dtsi +@@ -25,6 +25,7 @@ + compatible = "qcom,spmi-temp-alarm"; + reg = <0x2400>; + interrupts = <4 0x24 0 IRQ_TYPE_EDGE_RISING>; ++ #thermal-sensor-cells = <0>; + }; + }; + +diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S +index 7848780e88347..20fef6c41f6f7 100644 +--- a/arch/arm/lib/findbit.S ++++ b/arch/arm/lib/findbit.S +@@ -43,8 +43,8 @@ ENDPROC(_find_first_zero_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_zero_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -84,8 +84,8 @@ ENDPROC(_find_first_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -118,8 +118,8 @@ ENTRY(_find_first_zero_bit_be) + ENDPROC(_find_first_zero_bit_be) + + ENTRY(_find_next_zero_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +@@ -152,8 +152,8 @@ ENTRY(_find_first_bit_be) + ENDPROC(_find_first_bit_be) + + ENTRY(_find_next_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c +index a55a7ecf146a2..dd0b4195e629c 100644 +--- a/arch/arm/mach-bcm/bcm_kona_smc.c ++++ b/arch/arm/mach-bcm/bcm_kona_smc.c +@@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void) + return -ENODEV; + + prop_val = of_get_address(node, 0, &prop_size, NULL); ++ of_node_put(node); + if (!prop_val) + return -EINVAL; + +diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c +index 5d73f2c0b117e..dd2ff10790ab5 100644 +--- a/arch/arm/mach-omap2/display.c ++++ b/arch/arm/mach-omap2/display.c +@@ -211,6 +211,7 @@ static int __init omapdss_init_fbdev(void) + node = of_find_node_by_name(NULL, "omap4_padconf_global"); + if (node) + omap4_dsi_mux_syscon = syscon_node_to_regmap(node); ++ of_node_put(node); + + return 0; + } +diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c +index dfa65fc2c82bc..30445849b5e38 100644 +--- a/arch/arm/mach-omap2/prm3xxx.c ++++ b/arch/arm/mach-omap2/prm3xxx.c +@@ -711,6 +711,7 @@ static int omap3xxx_prm_late_init(void) + } + + irq_num = of_irq_get(np, 0); ++ of_node_put(np); + if (irq_num == -EPROBE_DEFER) + return irq_num; + +diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c +index 6aba9ebf80411..a8b1b9c6626ee 100644 +--- a/arch/arm/mach-zynq/common.c ++++ b/arch/arm/mach-zynq/common.c +@@ -84,6 +84,7 @@ static int __init zynq_get_revision(void) + } + + zynq_devcfg_base = of_iomap(np, 0); ++ of_node_put(np); + if (!zynq_devcfg_base) { + pr_err("%s: Unable to map I/O memory\n", __func__); + return -1; +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index f48d14cd10a3f..bdee07305ce54 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -261,7 +261,7 @@ + status = "disabled"; + }; + +- qpic_nand: nand@79b0000 { ++ qpic_nand: nand-controller@79b0000 { + compatible = "qcom,ipq8074-nand"; + reg = <0x79b0000 0x10000>; + #address-cells = <1>; +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 078ae020a77b8..1832687f7ba82 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1039,8 +1039,8 @@ + vddmx-supply = <&pm8916_l3>; + vddpx-supply = <&pm8916_l7>; + +- qcom,state = <&wcnss_smp2p_out 0>; +- qcom,state-names = "stop"; ++ qcom,smem-states = <&wcnss_smp2p_out 0>; ++ qcom,smem-state-names = "stop"; + + pinctrl-names = "default"; + pinctrl-0 = <&wcnss_pin_a>; +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index 773ea8e0e4421..f81074c68ff30 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -172,8 +172,9 @@ void tls_preserve_current_state(void); + + static inline void start_thread_common(struct pt_regs *regs, unsigned long pc) + { ++ s32 previous_syscall = regs->syscallno; + memset(regs, 0, sizeof(*regs)); +- forget_syscall(regs); ++ regs->syscallno = previous_syscall; + regs->pc = pc; + } + +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index 181c29af56179..7c69a203cdf8e 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -62,6 +62,7 @@ struct insn_emulation { + static LIST_HEAD(insn_emulation); + static int nr_insn_emulated __initdata; + static DEFINE_RAW_SPINLOCK(insn_emulation_lock); ++static DEFINE_MUTEX(insn_emulation_mutex); + + static void register_emulation_hooks(struct insn_emulation_ops *ops) + { +@@ -210,10 +211,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + loff_t *ppos) + { + int ret = 0; +- struct insn_emulation *insn = (struct insn_emulation *) table->data; ++ struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); + enum insn_emulation_mode prev_mode = insn->current_mode; + +- table->data = &insn->current_mode; ++ mutex_lock(&insn_emulation_mutex); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (ret || !write || prev_mode == insn->current_mode) +@@ -226,7 +227,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + update_insn_emulation_mode(insn, INSN_UNDEF); + } + ret: +- table->data = insn; ++ mutex_unlock(&insn_emulation_mutex); + return ret; + } + +@@ -250,7 +251,7 @@ static void __init register_insn_emulation_sysctl(void) + sysctl->maxlen = sizeof(int); + + sysctl->procname = insn->ops->name; +- sysctl->data = insn; ++ sysctl->data = &insn->current_mode; + sysctl->extra1 = &insn->min; + sysctl->extra2 = &insn->max; + sysctl->proc_handler = emulation_proc_handler; +diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h +index 10061ccf0440d..bbbdeeed702c8 100644 +--- a/arch/ia64/include/asm/processor.h ++++ b/arch/ia64/include/asm/processor.h +@@ -552,7 +552,7 @@ ia64_get_irr(unsigned int vector) + { + unsigned int reg = vector / 64; + unsigned int bit = vector % 64; +- u64 irr; ++ unsigned long irr; + + switch (reg) { + case 0: irr = ia64_getreg(_IA64_REG_CR_IRR0); break; +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 4d83f5bc7211c..54c8389decda4 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) + "refclk-frequency", &clock_rate); + if (i) { + dev_err(dev, "No UCTL \"refclk-frequency\"\n"); ++ of_node_put(uctl_node); + goto exit; + } + i = of_property_read_string(uctl_node, + "refclk-type", &clock_type); +- ++ of_node_put(uctl_node); + if (!i && strcmp("crystal", clock_type) == 0) + is_crystal_clock = true; + } +diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c +index f8d36710cd581..d408b3a5bfd57 100644 +--- a/arch/mips/kernel/proc.c ++++ b/arch/mips/kernel/proc.c +@@ -168,7 +168,7 @@ static void *c_start(struct seq_file *m, loff_t *pos) + { + unsigned long i = *pos; + +- return i < NR_CPUS ? (void *) (i + 1) : NULL; ++ return i < nr_cpu_ids ? (void *) (i + 1) : NULL; + } + + static void *c_next(struct seq_file *m, void *v, loff_t *pos) +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 620abc9686249..a97b3e5a1c00f 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -630,7 +630,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p, + return; + } + +- if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) { + if (fill_includes_sw_bits) { + UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); + } else { +@@ -2559,7 +2559,7 @@ static void check_pabits(void) + unsigned long entry; + unsigned pabits, fillbits; + +- if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) { + /* + * We'll only be making use of the fact that we can rotate bits + * into the fill if the CPU supports RIXI, so don't bother +diff --git a/arch/nios2/include/asm/entry.h b/arch/nios2/include/asm/entry.h +index cf37f55efbc22..bafb7b2ca59fc 100644 +--- a/arch/nios2/include/asm/entry.h ++++ b/arch/nios2/include/asm/entry.h +@@ -50,7 +50,8 @@ + stw r13, PT_R13(sp) + stw r14, PT_R14(sp) + stw r15, PT_R15(sp) +- stw r2, PT_ORIG_R2(sp) ++ movi r24, -1 ++ stw r24, PT_ORIG_R2(sp) + stw r7, PT_ORIG_R7(sp) + + stw ra, PT_RA(sp) +diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h +index 6424621448728..9da34c3022a27 100644 +--- a/arch/nios2/include/asm/ptrace.h ++++ b/arch/nios2/include/asm/ptrace.h +@@ -74,6 +74,8 @@ extern void show_regs(struct pt_regs *); + ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE)\ + - 1) + ++#define force_successful_syscall_return() (current_pt_regs()->orig_r2 = -1) ++ + int do_syscall_trace_enter(void); + void do_syscall_trace_exit(void); + #endif /* __ASSEMBLY__ */ +diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S +index 1e515ccd698e3..af556588248e7 100644 +--- a/arch/nios2/kernel/entry.S ++++ b/arch/nios2/kernel/entry.S +@@ -185,6 +185,7 @@ ENTRY(handle_system_call) + ldw r5, PT_R5(sp) + + local_restart: ++ stw r2, PT_ORIG_R2(sp) + /* Check that the requested system call is within limits */ + movui r1, __NR_syscalls + bgeu r2, r1, ret_invsyscall +@@ -192,7 +193,6 @@ local_restart: + movhi r11, %hiadj(sys_call_table) + add r1, r1, r11 + ldw r1, %lo(sys_call_table)(r1) +- beq r1, r0, ret_invsyscall + + /* Check if we are being traced */ + GET_THREAD_INFO r11 +@@ -213,6 +213,9 @@ local_restart: + translate_rc_and_ret: + movi r1, 0 + bge r2, zero, 3f ++ ldw r1, PT_ORIG_R2(sp) ++ addi r1, r1, 1 ++ beq r1, zero, 3f + sub r2, zero, r2 + movi r1, 1 + 3: +@@ -255,9 +258,9 @@ traced_system_call: + ldw r6, PT_R6(sp) + ldw r7, PT_R7(sp) + +- /* Fetch the syscall function, we don't need to check the boundaries +- * since this is already done. +- */ ++ /* Fetch the syscall function. */ ++ movui r1, __NR_syscalls ++ bgeu r2, r1, traced_invsyscall + slli r1, r2, 2 + movhi r11,%hiadj(sys_call_table) + add r1, r1, r11 +@@ -276,6 +279,9 @@ traced_system_call: + translate_rc_and_ret2: + movi r1, 0 + bge r2, zero, 4f ++ ldw r1, PT_ORIG_R2(sp) ++ addi r1, r1, 1 ++ beq r1, zero, 4f + sub r2, zero, r2 + movi r1, 1 + 4: +@@ -287,6 +293,11 @@ end_translate_rc_and_ret2: + RESTORE_SWITCH_STACK + br ret_from_exception + ++ /* If the syscall number was invalid return ENOSYS */ ++traced_invsyscall: ++ movi r2, -ENOSYS ++ br translate_rc_and_ret2 ++ + Luser_return: + GET_THREAD_INFO r11 /* get thread_info pointer */ + ldw r10, TI_FLAGS(r11) /* get thread_info->flags */ +@@ -336,9 +347,6 @@ external_interrupt: + /* skip if no interrupt is pending */ + beq r12, r0, ret_from_interrupt + +- movi r24, -1 +- stw r24, PT_ORIG_R2(sp) +- + /* + * Process an external hardware interrupt. + */ +diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c +index 20662b0f6c9e3..c1be8e1941385 100644 +--- a/arch/nios2/kernel/signal.c ++++ b/arch/nios2/kernel/signal.c +@@ -240,7 +240,7 @@ static int do_signal(struct pt_regs *regs) + /* + * If we were from a system call, check for system call restarting... + */ +- if (regs->orig_r2 >= 0) { ++ if (regs->orig_r2 >= 0 && regs->r1) { + continue_addr = regs->ea; + restart_addr = continue_addr - 4; + retval = regs->r2; +@@ -261,6 +261,7 @@ static int do_signal(struct pt_regs *regs) + regs->ea = restart_addr; + break; + } ++ regs->orig_r2 = -1; + } + + if (get_signal(&ksig)) { +diff --git a/arch/nios2/kernel/syscall_table.c b/arch/nios2/kernel/syscall_table.c +index 06e6ac1835b2e..cd10b6eed1283 100644 +--- a/arch/nios2/kernel/syscall_table.c ++++ b/arch/nios2/kernel/syscall_table.c +@@ -25,5 +25,6 @@ + #define __SYSCALL(nr, call) [nr] = (call), + + void *sys_call_table[__NR_syscalls] = { ++ [0 ... __NR_syscalls-1] = sys_ni_syscall, + #include <asm/unistd.h> + }; +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index 4d5ad9cb0f692..592e8cec16dd5 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -499,7 +499,6 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path) + dev->id.hversion_rev = iodc_data[1] & 0x0f; + dev->id.sversion = ((iodc_data[4] & 0x0f) << 16) | + (iodc_data[5] << 8) | iodc_data[6]; +- dev->hpa.name = parisc_pathname(dev); + dev->hpa.start = hpa; + /* This is awkward. The STI spec says that gfx devices may occupy + * 32MB or 64MB. Unfortunately, we don't know how to tell whether +@@ -513,10 +512,10 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path) + dev->hpa.end = hpa + 0xfff; + } + dev->hpa.flags = IORESOURCE_MEM; +- name = parisc_hardware_description(&dev->id); +- if (name) { +- strlcpy(dev->name, name, sizeof(dev->name)); +- } ++ dev->hpa.name = dev->name; ++ name = parisc_hardware_description(&dev->id) ? : "unknown"; ++ snprintf(dev->name, sizeof(dev->name), "%s [%s]", ++ name, parisc_pathname(dev)); + + /* Silently fail things like mouse ports which are subsumed within + * the keyboard controller +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index 74628aca2bf12..b0f8c56ea2829 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -75,23 +75,35 @@ const struct dma_map_ops *get_pci_dma_ops(void) + } + EXPORT_SYMBOL(get_pci_dma_ops); + +-/* +- * This function should run under locking protection, specifically +- * hose_spinlock. +- */ + static int get_phb_number(struct device_node *dn) + { + int ret, phb_id = -1; +- u32 prop_32; + u64 prop; + + /* + * Try fixed PHB numbering first, by checking archs and reading +- * the respective device-tree properties. Firstly, try powernv by +- * reading "ibm,opal-phbid", only present in OPAL environment. ++ * the respective device-tree properties. Firstly, try reading ++ * standard "linux,pci-domain", then try reading "ibm,opal-phbid" ++ * (only present in powernv OPAL environment), then try device-tree ++ * alias and as the last try to use lower bits of "reg" property. + */ +- ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ ret = of_get_pci_domain_nr(dn); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } ++ if (ret) ++ ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ + if (ret) { ++ ret = of_alias_get_id(dn, "pci"); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } ++ } ++ if (ret) { ++ u32 prop_32; + ret = of_property_read_u32_index(dn, "reg", 1, &prop_32); + prop = prop_32; + } +@@ -99,18 +111,20 @@ static int get_phb_number(struct device_node *dn) + if (!ret) + phb_id = (int)(prop & (MAX_PHBS - 1)); + ++ spin_lock(&hose_spinlock); ++ + /* We need to be sure to not use the same PHB number twice. */ + if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap)) +- return phb_id; ++ goto out_unlock; + +- /* +- * If not pseries nor powernv, or if fixed PHB numbering tried to add +- * the same PHB number twice, then fallback to dynamic PHB numbering. +- */ ++ /* If everything fails then fallback to dynamic PHB numbering. */ + phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS); + BUG_ON(phb_id >= MAX_PHBS); + set_bit(phb_id, phb_bitmap); + ++out_unlock: ++ spin_unlock(&hose_spinlock); ++ + return phb_id; + } + +@@ -121,10 +135,13 @@ struct pci_controller *pcibios_alloc_controller(struct device_node *dev) + phb = zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL); + if (phb == NULL) + return NULL; +- spin_lock(&hose_spinlock); ++ + phb->global_number = get_phb_number(dev); ++ ++ spin_lock(&hose_spinlock); + list_add_tail(&phb->list_node, &hose_list); + spin_unlock(&hose_spinlock); ++ + phb->dn = dev; + phb->is_dynamic = slab_is_available(); + #ifdef CONFIG_PPC64 +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index f8c49e5d4bd3b..c57aeb9f031cb 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -737,6 +737,13 @@ void __init early_init_devtree(void *params) + of_scan_flat_dt(early_init_dt_scan_root, NULL); + of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL); + ++ /* ++ * As generic code authors expect to be able to use static keys ++ * in early_param() handlers, we initialize the static keys just ++ * before parsing early params (it's fine to call jump_label_init() ++ * more than once). ++ */ ++ jump_label_init(); + parse_early_param(); + + /* make sure we've parsed cmdline for mem= before this */ +diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile +index cdf6a99600465..3c844bdd16c4e 100644 +--- a/arch/powerpc/mm/Makefile ++++ b/arch/powerpc/mm/Makefile +@@ -43,5 +43,12 @@ obj-$(CONFIG_HIGHMEM) += highmem.o + obj-$(CONFIG_PPC_COPRO_BASE) += copro_fault.o + obj-$(CONFIG_SPAPR_TCE_IOMMU) += mmu_context_iommu.o + obj-$(CONFIG_PPC_PTDUMP) += dump_linuxpagetables.o ++ifdef CONFIG_PPC_PTDUMP ++obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o ++obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o ++obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o ++obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o ++obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o ++endif + obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o + obj-$(CONFIG_PPC_MEM_KEYS) += pkeys.o +diff --git a/arch/powerpc/mm/dump_linuxpagetables-8xx.c b/arch/powerpc/mm/dump_linuxpagetables-8xx.c +new file mode 100644 +index 0000000000000..33f52a97975b4 +--- /dev/null ++++ b/arch/powerpc/mm/dump_linuxpagetables-8xx.c +@@ -0,0 +1,82 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * From split of dump_linuxpagetables.c ++ * Copyright 2016, Rashmica Gupta, IBM Corp. ++ * ++ */ ++#include <linux/kernel.h> ++#include <asm/pgtable.h> ++ ++#include "dump_linuxpagetables.h" ++ ++static const struct flag_info flag_array[] = { ++ { ++ .mask = _PAGE_PRIVILEGED, ++ .val = 0, ++ .set = "user", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_RO | _PAGE_NA, ++ .val = 0, ++ .set = "rw", ++ }, { ++ .mask = _PAGE_RO | _PAGE_NA, ++ .val = _PAGE_RO, ++ .set = "r ", ++ }, { ++ .mask = _PAGE_RO | _PAGE_NA, ++ .val = _PAGE_NA, ++ .set = " ", ++ }, { ++ .mask = _PAGE_EXEC, ++ .val = _PAGE_EXEC, ++ .set = " X ", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_PRESENT, ++ .val = _PAGE_PRESENT, ++ .set = "present", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_GUARDED, ++ .val = _PAGE_GUARDED, ++ .set = "guarded", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_DIRTY, ++ .val = _PAGE_DIRTY, ++ .set = "dirty", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_ACCESSED, ++ .val = _PAGE_ACCESSED, ++ .set = "accessed", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_NO_CACHE, ++ .val = _PAGE_NO_CACHE, ++ .set = "no cache", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_SPECIAL, ++ .val = _PAGE_SPECIAL, ++ .set = "special", ++ } ++}; ++ ++struct pgtable_level pg_level[5] = { ++ { ++ }, { /* pgd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pud */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pmd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pte */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, ++}; +diff --git a/arch/powerpc/mm/dump_linuxpagetables-book3s64.c b/arch/powerpc/mm/dump_linuxpagetables-book3s64.c +new file mode 100644 +index 0000000000000..a637e612b2055 +--- /dev/null ++++ b/arch/powerpc/mm/dump_linuxpagetables-book3s64.c +@@ -0,0 +1,115 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * From split of dump_linuxpagetables.c ++ * Copyright 2016, Rashmica Gupta, IBM Corp. ++ * ++ */ ++#include <linux/kernel.h> ++#include <asm/pgtable.h> ++ ++#include "dump_linuxpagetables.h" ++ ++static const struct flag_info flag_array[] = { ++ { ++ .mask = _PAGE_PRIVILEGED, ++ .val = 0, ++ .set = "user", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_READ, ++ .val = _PAGE_READ, ++ .set = "r", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_WRITE, ++ .val = _PAGE_WRITE, ++ .set = "w", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_EXEC, ++ .val = _PAGE_EXEC, ++ .set = " X ", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_PTE, ++ .val = _PAGE_PTE, ++ .set = "pte", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_PRESENT, ++ .val = _PAGE_PRESENT, ++ .set = "present", ++ .clear = " ", ++ }, { ++ .mask = H_PAGE_HASHPTE, ++ .val = H_PAGE_HASHPTE, ++ .set = "hpte", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_DIRTY, ++ .val = _PAGE_DIRTY, ++ .set = "dirty", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_ACCESSED, ++ .val = _PAGE_ACCESSED, ++ .set = "accessed", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_NON_IDEMPOTENT, ++ .val = _PAGE_NON_IDEMPOTENT, ++ .set = "non-idempotent", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_TOLERANT, ++ .val = _PAGE_TOLERANT, ++ .set = "tolerant", ++ .clear = " ", ++ }, { ++ .mask = H_PAGE_BUSY, ++ .val = H_PAGE_BUSY, ++ .set = "busy", ++ }, { ++#ifdef CONFIG_PPC_64K_PAGES ++ .mask = H_PAGE_COMBO, ++ .val = H_PAGE_COMBO, ++ .set = "combo", ++ }, { ++ .mask = H_PAGE_4K_PFN, ++ .val = H_PAGE_4K_PFN, ++ .set = "4K_pfn", ++ }, { ++#else /* CONFIG_PPC_64K_PAGES */ ++ .mask = H_PAGE_F_GIX, ++ .val = H_PAGE_F_GIX, ++ .set = "f_gix", ++ .is_val = true, ++ .shift = H_PAGE_F_GIX_SHIFT, ++ }, { ++ .mask = H_PAGE_F_SECOND, ++ .val = H_PAGE_F_SECOND, ++ .set = "f_second", ++ }, { ++#endif /* CONFIG_PPC_64K_PAGES */ ++ .mask = _PAGE_SPECIAL, ++ .val = _PAGE_SPECIAL, ++ .set = "special", ++ } ++}; ++ ++struct pgtable_level pg_level[5] = { ++ { ++ }, { /* pgd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pud */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pmd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pte */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, ++}; +diff --git a/arch/powerpc/mm/dump_linuxpagetables-generic.c b/arch/powerpc/mm/dump_linuxpagetables-generic.c +new file mode 100644 +index 0000000000000..fed6923bcb46e +--- /dev/null ++++ b/arch/powerpc/mm/dump_linuxpagetables-generic.c +@@ -0,0 +1,82 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * From split of dump_linuxpagetables.c ++ * Copyright 2016, Rashmica Gupta, IBM Corp. ++ * ++ */ ++#include <linux/kernel.h> ++#include <asm/pgtable.h> ++ ++#include "dump_linuxpagetables.h" ++ ++static const struct flag_info flag_array[] = { ++ { ++ .mask = _PAGE_USER, ++ .val = _PAGE_USER, ++ .set = "user", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_RW, ++ .val = 0, ++ .set = "r ", ++ .clear = "rw", ++ }, { ++#ifndef CONFIG_PPC_BOOK3S_32 ++ .mask = _PAGE_EXEC, ++ .val = _PAGE_EXEC, ++ .set = " X ", ++ .clear = " ", ++ }, { ++#endif ++ .mask = _PAGE_PRESENT, ++ .val = _PAGE_PRESENT, ++ .set = "present", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_GUARDED, ++ .val = _PAGE_GUARDED, ++ .set = "guarded", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_DIRTY, ++ .val = _PAGE_DIRTY, ++ .set = "dirty", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_ACCESSED, ++ .val = _PAGE_ACCESSED, ++ .set = "accessed", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_WRITETHRU, ++ .val = _PAGE_WRITETHRU, ++ .set = "write through", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_NO_CACHE, ++ .val = _PAGE_NO_CACHE, ++ .set = "no cache", ++ .clear = " ", ++ }, { ++ .mask = _PAGE_SPECIAL, ++ .val = _PAGE_SPECIAL, ++ .set = "special", ++ } ++}; ++ ++struct pgtable_level pg_level[5] = { ++ { ++ }, { /* pgd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pud */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pmd */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, { /* pte */ ++ .flag = flag_array, ++ .num = ARRAY_SIZE(flag_array), ++ }, ++}; +diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c +index 8464c2c01c0ca..6aa41669ac1ae 100644 +--- a/arch/powerpc/mm/dump_linuxpagetables.c ++++ b/arch/powerpc/mm/dump_linuxpagetables.c +@@ -28,6 +28,8 @@ + #include <asm/page.h> + #include <asm/pgalloc.h> + ++#include "dump_linuxpagetables.h" ++ + #ifdef CONFIG_PPC32 + #define KERN_VIRT_START 0 + #endif +@@ -102,159 +104,6 @@ static struct addr_marker address_markers[] = { + { -1, NULL }, + }; + +-struct flag_info { +- u64 mask; +- u64 val; +- const char *set; +- const char *clear; +- bool is_val; +- int shift; +-}; +- +-static const struct flag_info flag_array[] = { +- { +- .mask = _PAGE_USER | _PAGE_PRIVILEGED, +- .val = _PAGE_USER, +- .set = "user", +- .clear = " ", +- }, { +- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA, +- .val = _PAGE_RW, +- .set = "rw", +- }, { +- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA, +- .val = _PAGE_RO, +- .set = "ro", +- }, { +-#if _PAGE_NA != 0 +- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA, +- .val = _PAGE_RO, +- .set = "na", +- }, { +-#endif +- .mask = _PAGE_EXEC, +- .val = _PAGE_EXEC, +- .set = " X ", +- .clear = " ", +- }, { +- .mask = _PAGE_PTE, +- .val = _PAGE_PTE, +- .set = "pte", +- .clear = " ", +- }, { +- .mask = _PAGE_PRESENT, +- .val = _PAGE_PRESENT, +- .set = "present", +- .clear = " ", +- }, { +-#ifdef CONFIG_PPC_BOOK3S_64 +- .mask = H_PAGE_HASHPTE, +- .val = H_PAGE_HASHPTE, +-#else +- .mask = _PAGE_HASHPTE, +- .val = _PAGE_HASHPTE, +-#endif +- .set = "hpte", +- .clear = " ", +- }, { +-#ifndef CONFIG_PPC_BOOK3S_64 +- .mask = _PAGE_GUARDED, +- .val = _PAGE_GUARDED, +- .set = "guarded", +- .clear = " ", +- }, { +-#endif +- .mask = _PAGE_DIRTY, +- .val = _PAGE_DIRTY, +- .set = "dirty", +- .clear = " ", +- }, { +- .mask = _PAGE_ACCESSED, +- .val = _PAGE_ACCESSED, +- .set = "accessed", +- .clear = " ", +- }, { +-#ifndef CONFIG_PPC_BOOK3S_64 +- .mask = _PAGE_WRITETHRU, +- .val = _PAGE_WRITETHRU, +- .set = "write through", +- .clear = " ", +- }, { +-#endif +-#ifndef CONFIG_PPC_BOOK3S_64 +- .mask = _PAGE_NO_CACHE, +- .val = _PAGE_NO_CACHE, +- .set = "no cache", +- .clear = " ", +- }, { +-#else +- .mask = _PAGE_NON_IDEMPOTENT, +- .val = _PAGE_NON_IDEMPOTENT, +- .set = "non-idempotent", +- .clear = " ", +- }, { +- .mask = _PAGE_TOLERANT, +- .val = _PAGE_TOLERANT, +- .set = "tolerant", +- .clear = " ", +- }, { +-#endif +-#ifdef CONFIG_PPC_BOOK3S_64 +- .mask = H_PAGE_BUSY, +- .val = H_PAGE_BUSY, +- .set = "busy", +- }, { +-#ifdef CONFIG_PPC_64K_PAGES +- .mask = H_PAGE_COMBO, +- .val = H_PAGE_COMBO, +- .set = "combo", +- }, { +- .mask = H_PAGE_4K_PFN, +- .val = H_PAGE_4K_PFN, +- .set = "4K_pfn", +- }, { +-#else /* CONFIG_PPC_64K_PAGES */ +- .mask = H_PAGE_F_GIX, +- .val = H_PAGE_F_GIX, +- .set = "f_gix", +- .is_val = true, +- .shift = H_PAGE_F_GIX_SHIFT, +- }, { +- .mask = H_PAGE_F_SECOND, +- .val = H_PAGE_F_SECOND, +- .set = "f_second", +- }, { +-#endif /* CONFIG_PPC_64K_PAGES */ +-#endif +- .mask = _PAGE_SPECIAL, +- .val = _PAGE_SPECIAL, +- .set = "special", +- } +-}; +- +-struct pgtable_level { +- const struct flag_info *flag; +- size_t num; +- u64 mask; +-}; +- +-static struct pgtable_level pg_level[] = { +- { +- }, { /* pgd */ +- .flag = flag_array, +- .num = ARRAY_SIZE(flag_array), +- }, { /* pud */ +- .flag = flag_array, +- .num = ARRAY_SIZE(flag_array), +- }, { /* pmd */ +- .flag = flag_array, +- .num = ARRAY_SIZE(flag_array), +- }, { /* pte */ +- .flag = flag_array, +- .num = ARRAY_SIZE(flag_array), +- }, +-}; +- + static void dump_flag_info(struct pg_state *st, const struct flag_info + *flag, u64 pte, int num) + { +diff --git a/arch/powerpc/mm/dump_linuxpagetables.h b/arch/powerpc/mm/dump_linuxpagetables.h +new file mode 100644 +index 0000000000000..5d513636de73a +--- /dev/null ++++ b/arch/powerpc/mm/dump_linuxpagetables.h +@@ -0,0 +1,19 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#include <linux/types.h> ++ ++struct flag_info { ++ u64 mask; ++ u64 val; ++ const char *set; ++ const char *clear; ++ bool is_val; ++ int shift; ++}; ++ ++struct pgtable_level { ++ const struct flag_info *flag; ++ size_t num; ++ u64 mask; ++}; ++ ++extern struct pgtable_level pg_level[5]; +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index ad0216c41d2c5..67ad128a9a3d4 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -134,11 +134,11 @@ config POWER9_CPU + + config E5500_CPU + bool "Freescale e5500" +- depends on E500 ++ depends on PPC64 && E500 + + config E6500_CPU + bool "Freescale e6500" +- depends on E500 ++ depends on PPC64 && E500 + + config 860_CPU + bool "8xx family" +diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c +index 326d34e2aa029..946a09ae9fb25 100644 +--- a/arch/powerpc/platforms/cell/axon_msi.c ++++ b/arch/powerpc/platforms/cell/axon_msi.c +@@ -230,6 +230,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg) + if (!prop) { + dev_dbg(&dev->dev, + "axon_msi: no msi-address-(32|64) properties found\n"); ++ of_node_put(dn); + return -ENOENT; + } + +diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c +index db329d4bf1c30..8b664d9cfcd41 100644 +--- a/arch/powerpc/platforms/cell/spufs/inode.c ++++ b/arch/powerpc/platforms/cell/spufs/inode.c +@@ -684,6 +684,7 @@ spufs_init_isolated_loader(void) + return; + + loader = of_get_property(dn, "loader", &size); ++ of_node_put(dn); + if (!loader) + return; + +diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c +index 6fb1ceb5756d0..0f66bdf867ee0 100644 +--- a/arch/powerpc/platforms/powernv/rng.c ++++ b/arch/powerpc/platforms/powernv/rng.c +@@ -67,6 +67,8 @@ int powernv_get_random_real_mode(unsigned long *v) + struct powernv_rng *rng; + + rng = raw_cpu_read(powernv_rng); ++ if (!rng) ++ return 0; + + *v = rng_whiten(rng, __raw_rm_readq(rng->regs_real)); + +diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c +index 918be816b0977..6d41aa4db05d9 100644 +--- a/arch/powerpc/sysdev/fsl_pci.c ++++ b/arch/powerpc/sysdev/fsl_pci.c +@@ -523,6 +523,7 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary) + struct resource rsrc; + const int *bus_range; + u8 hdr_type, progif; ++ u32 class_code; + struct device_node *dev; + struct ccsr_pci __iomem *pci; + u16 temp; +@@ -596,6 +597,13 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary) + PPC_INDIRECT_TYPE_SURPRESS_PRIMARY_BUS; + if (fsl_pcie_check_link(hose)) + hose->indirect_type |= PPC_INDIRECT_TYPE_NO_PCIE_LINK; ++ /* Fix Class Code to PCI_CLASS_BRIDGE_PCI_NORMAL for pre-3.0 controller */ ++ if (in_be32(&pci->block_rev1) < PCIE_IP_REV_3_0) { ++ early_read_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, &class_code); ++ class_code &= 0xff; ++ class_code |= PCI_CLASS_BRIDGE_PCI_NORMAL << 8; ++ early_write_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, class_code); ++ } + } else { + /* + * Set PBFR(PCI Bus Function Register)[10] = 1 to +diff --git a/arch/powerpc/sysdev/fsl_pci.h b/arch/powerpc/sysdev/fsl_pci.h +index 151588530b065..caa05c4aa4272 100644 +--- a/arch/powerpc/sysdev/fsl_pci.h ++++ b/arch/powerpc/sysdev/fsl_pci.h +@@ -23,6 +23,7 @@ struct platform_device; + + #define PCIE_LTSSM 0x0404 /* PCIE Link Training and Status */ + #define PCIE_LTSSM_L0 0x16 /* L0 state */ ++#define PCIE_FSL_CSR_CLASSCODE 0x474 /* FSL GPEX CSR */ + #define PCIE_IP_REV_2_2 0x02080202 /* PCIE IP block version Rev2.2 */ + #define PCIE_IP_REV_3_0 0x02080300 /* PCIE IP block version Rev3.0 */ + #define PIWAR_EN 0x80000000 /* Enable */ +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index 5566bbc86f4af..aa705732150cc 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -631,6 +631,7 @@ static bool xive_get_max_prio(u8 *max_prio) + } + + reg = of_get_property(rootdn, "ibm,plat-res-int-priorities", &len); ++ of_node_put(rootdn); + if (!reg) { + pr_err("Failed to read 'ibm,plat-res-int-priorities' property\n"); + return false; +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index db44da32701f2..516aaa19daf28 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -26,9 +26,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) +- if (unlikely(!(prot & PROT_READ))) +- return -EINVAL; ++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) ++ return -EINVAL; + + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 24a9333dda2cb..7c65750508f25 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -22,6 +22,7 @@ + #include <linux/mm.h> + #include <linux/module.h> + #include <linux/irq.h> ++#include <linux/kexec.h> + + #include <asm/processor.h> + #include <asm/ptrace.h> +@@ -50,6 +51,9 @@ void die(struct pt_regs *regs, const char *str) + + ret = notify_die(DIE_OOPS, str, regs, 0, regs->scause, SIGSEGV); + ++ if (regs && kexec_should_crash(current)) ++ crash_kexec(regs); ++ + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irq(&die_lock); +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index 6539c50fb9aae..82500962f1b3d 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE + AFLAGS_header.o += -I$(objtree)/$(obj) + $(obj)/header.o: $(obj)/zoffset.h + +-LDFLAGS_setup.elf := -m elf_i386 -T ++LDFLAGS_setup.elf := -m elf_i386 -z noexecstack -T + $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE + $(call if_changed,ld) + +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index 5642f025b397c..23b6e2da72bf8 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -57,6 +57,10 @@ else + KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \ + && echo "-z noreloc-overflow -pie --no-dynamic-linker") + endif ++ ++KBUILD_LDFLAGS += -z noexecstack ++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments) ++ + LDFLAGS_vmlinux := -T + + hostprogs-y := mkpiggy +diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile +index 5bfe2243a08f8..ec5d8d0bd2221 100644 +--- a/arch/x86/entry/vdso/Makefile ++++ b/arch/x86/entry/vdso/Makefile +@@ -172,7 +172,7 @@ quiet_cmd_vdso = VDSO $@ + + VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \ + $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \ +- -Bsymbolic ++ -Bsymbolic -z noexecstack + GCOV_PROFILE := n + + # +diff --git a/arch/x86/kernel/pmem.c b/arch/x86/kernel/pmem.c +index 6b07faaa15798..23154d24b1173 100644 +--- a/arch/x86/kernel/pmem.c ++++ b/arch/x86/kernel/pmem.c +@@ -27,6 +27,11 @@ static __init int register_e820_pmem(void) + * simply here to trigger the module to load on demand. + */ + pdev = platform_device_alloc("e820_pmem", -1); +- return platform_device_add(pdev); ++ ++ rc = platform_device_add(pdev); ++ if (rc) ++ platform_device_put(pdev); ++ ++ return rc; + } + device_initcall(register_e820_pmem); +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 63754d248dfbe..25bdd06969b34 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1708,16 +1708,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; +- if (!seg_desc.p) { +- err_vec = NP_VECTOR; +- goto exception; +- } +- old_desc = seg_desc; +- seg_desc.type |= 2; /* busy */ +- ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +- sizeof(seg_desc), &ctxt->exception); +- if (ret != X86EMUL_CONTINUE) +- return ret; + break; + case VCPU_SREG_LDTR: + if (seg_desc.s || seg_desc.type != 2) +@@ -1755,8 +1745,17 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + if (ret != X86EMUL_CONTINUE) + return ret; + if (emul_is_noncanonical_address(get_desc_base(&seg_desc) | +- ((u64)base3 << 32), ctxt)) +- return emulate_gp(ctxt, 0); ++ ((u64)base3 << 32), ctxt)) ++ return emulate_gp(ctxt, err_code); ++ } ++ ++ if (seg == VCPU_SREG_TR) { ++ old_desc = seg_desc; ++ seg_desc.type |= 2; /* busy */ ++ ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, ++ sizeof(seg_desc), &ctxt->exception); ++ if (ret != X86EMUL_CONTINUE) ++ return ret; + } + load: + ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index ca5a6c3f8c911..2047edb5ff746 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -341,6 +341,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint) + struct kvm_lapic_irq irq; + int ret, vector; + ++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) ++ return -EINVAL; ++ + if (sint >= ARRAY_SIZE(synic->sint)) + return -EINVAL; + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 89d07312e58cf..027941e3df682 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -961,6 +961,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src, + *r = -1; + + if (irq->shorthand == APIC_DEST_SELF) { ++ if (KVM_BUG_ON(!src, kvm)) { ++ *r = 0; ++ return true; ++ } + *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); + return true; + } +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 85181457413e7..e1492a67e988a 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5142,8 +5142,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +- BUG_ON(!(gif_set(svm))); +- + trace_kvm_inj_virq(vcpu->arch.interrupt.nr); + ++vcpu->stat.irq_injections; + +diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c +index fa150855647cc..b4ff063a43712 100644 +--- a/arch/x86/mm/numa.c ++++ b/arch/x86/mm/numa.c +@@ -826,7 +826,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enable) + return; + } + mask = node_to_cpumask_map[node]; +- if (!mask) { ++ if (!cpumask_available(mask)) { + pr_err("node_to_cpumask_map[%i] NULL\n", node); + dump_stack(); + return; +@@ -872,7 +872,7 @@ const struct cpumask *cpumask_of_node(int node) + dump_stack(); + return cpu_none_mask; + } +- if (node_to_cpumask_map[node] == NULL) { ++ if (!cpumask_available(node_to_cpumask_map[node])) { + printk(KERN_WARNING + "cpumask_of_node(%d): no node_to_cpumask_map!\n", + node); +diff --git a/arch/x86/platform/olpc/olpc-xo1-sci.c b/arch/x86/platform/olpc/olpc-xo1-sci.c +index 7fa8b3b53bc0a..193860d7f2c40 100644 +--- a/arch/x86/platform/olpc/olpc-xo1-sci.c ++++ b/arch/x86/platform/olpc/olpc-xo1-sci.c +@@ -85,7 +85,7 @@ static void send_ebook_state(void) + return; + } + +- if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == state) ++ if (test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == !!state) + return; /* Nothing new to report. */ + + input_report_switch(ebook_switch_idev, SW_TABLET_MODE, state); +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index ded6c5c17fd73..144cda7da7ee1 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -401,6 +401,9 @@ static int register_device_clock(struct acpi_device *adev, + if (!lpss_clk_dev) + lpt_register_clock_device(); + ++ if (IS_ERR(lpss_clk_dev)) ++ return PTR_ERR(lpss_clk_dev); ++ + clk_data = platform_get_drvdata(lpss_clk_dev); + if (!clk_data) + return -ENODEV; +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index f68a4ffd3352e..c0cfd3a3ed5e5 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -630,33 +630,6 @@ int pcc_data_alloc(int pcc_ss_id) + return 0; + } + +-/* Check if CPPC revision + num_ent combination is supported */ +-static bool is_cppc_supported(int revision, int num_ent) +-{ +- int expected_num_ent; +- +- switch (revision) { +- case CPPC_V2_REV: +- expected_num_ent = CPPC_V2_NUM_ENT; +- break; +- case CPPC_V3_REV: +- expected_num_ent = CPPC_V3_NUM_ENT; +- break; +- default: +- pr_debug("Firmware exports unsupported CPPC revision: %d\n", +- revision); +- return false; +- } +- +- if (expected_num_ent != num_ent) { +- pr_debug("Firmware exports %d entries. Expected: %d for CPPC rev:%d\n", +- num_ent, expected_num_ent, revision); +- return false; +- } +- +- return true; +-} +- + /* + * An example CPC table looks like the following. + * +@@ -752,7 +725,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj->type); + goto out_free; + } +- cpc_ptr->num_entries = num_ent; + + /* Second entry should be revision. */ + cpc_obj = &out_obj->package.elements[1]; +@@ -763,10 +735,32 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj->type); + goto out_free; + } +- cpc_ptr->version = cpc_rev; + +- if (!is_cppc_supported(cpc_rev, num_ent)) ++ if (cpc_rev < CPPC_V2_REV) { ++ pr_debug("Unsupported _CPC Revision (%d) for CPU:%d\n", cpc_rev, ++ pr->id); + goto out_free; ++ } ++ ++ /* ++ * Disregard _CPC if the number of entries in the return pachage is not ++ * as expected, but support future revisions being proper supersets of ++ * the v3 and only causing more entries to be returned by _CPC. ++ */ ++ if ((cpc_rev == CPPC_V2_REV && num_ent != CPPC_V2_NUM_ENT) || ++ (cpc_rev == CPPC_V3_REV && num_ent != CPPC_V3_NUM_ENT) || ++ (cpc_rev > CPPC_V3_REV && num_ent <= CPPC_V3_NUM_ENT)) { ++ pr_debug("Unexpected number of _CPC return package entries (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } ++ if (cpc_rev > CPPC_V3_REV) { ++ num_ent = CPPC_V3_NUM_ENT; ++ cpc_rev = CPPC_V3_REV; ++ } ++ ++ cpc_ptr->num_entries = num_ent; ++ cpc_ptr->version = cpc_rev; + + /* Iterate through remaining entries in _CPC */ + for (i = 2; i < num_ent; i++) { +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index e3df3dda03321..3394ec64fe95d 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2118,13 +2118,6 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), + }, + }, +- { +- .ident = "ThinkPad X1 Carbon 6th", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Carbon 6th"), +- }, +- }, + { + .ident = "ThinkPad X1 Yoga 3rd", + .matches = { +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index c8018d73d5a79..c59235038bf29 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -132,10 +132,10 @@ static bool acpi_nondev_subnode_ok(acpi_handle scope, + return acpi_nondev_subnode_data_ok(handle, link, list, parent); + } + +-static int acpi_add_nondev_subnodes(acpi_handle scope, +- const union acpi_object *links, +- struct list_head *list, +- struct fwnode_handle *parent) ++static bool acpi_add_nondev_subnodes(acpi_handle scope, ++ const union acpi_object *links, ++ struct list_head *list, ++ struct fwnode_handle *parent) + { + bool ret = false; + int i; +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 847db3edcb5b8..a3b4ac97793f1 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -359,6 +359,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "80E3"), + }, + }, ++ { ++ .callback = init_nvs_save_s3, ++ .ident = "Lenovo G40-45", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), ++ }, ++ }, + /* + * https://bugzilla.kernel.org/show_bug.cgi?id=196907 + * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 096f29a2f710a..fcc3d7985762a 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2350,6 +2350,7 @@ const char *ata_get_cmd_descript(u8 command) + { ATA_CMD_WRITE_QUEUED_FUA_EXT, "WRITE DMA QUEUED FUA EXT" }, + { ATA_CMD_FPDMA_READ, "READ FPDMA QUEUED" }, + { ATA_CMD_FPDMA_WRITE, "WRITE FPDMA QUEUED" }, ++ { ATA_CMD_NCQ_NON_DATA, "NCQ NON-DATA" }, + { ATA_CMD_FPDMA_SEND, "SEND FPDMA QUEUED" }, + { ATA_CMD_FPDMA_RECV, "RECEIVE FPDMA QUEUED" }, + { ATA_CMD_PIO_READ, "READ SECTOR(S)" }, +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 3e00ab8a8890c..bc06f5919839c 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -3767,6 +3767,7 @@ static void __exit idt77252_exit(void) + card = idt77252_chain; + dev = card->atmdev; + idt77252_chain = card->next; ++ del_timer_sync(&card->tst_timer); + + if (dev->phy->stop) + dev->phy->stop(dev); +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c +index 4fef1fb918ece..5553df736c720 100644 +--- a/drivers/block/null_blk_main.c ++++ b/drivers/block/null_blk_main.c +@@ -1819,8 +1819,13 @@ static int null_add_dev(struct nullb_device *dev) + blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); + + mutex_lock(&lock); +- nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); +- dev->index = nullb->index; ++ rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); ++ if (rv < 0) { ++ mutex_unlock(&lock); ++ goto out_cleanup_zone; ++ } ++ nullb->index = rv; ++ dev->index = rv; + mutex_unlock(&lock); + + blk_queue_logical_block_size(nullb->q, dev->blocksize); +@@ -1832,13 +1837,16 @@ static int null_add_dev(struct nullb_device *dev) + + rv = null_gendisk_register(nullb); + if (rv) +- goto out_cleanup_zone; ++ goto out_ida_free; + + mutex_lock(&lock); + list_add_tail(&nullb->list, &nullb_list); + mutex_unlock(&lock); + + return 0; ++ ++out_ida_free: ++ ida_free(&nullb_indexes, nullb->index); + out_cleanup_zone: + if (dev->zoned) + null_zone_exit(dev); +diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c +index e9228520e4c7a..727fa4347b1e2 100644 +--- a/drivers/bluetooth/hci_intel.c ++++ b/drivers/bluetooth/hci_intel.c +@@ -1253,7 +1253,11 @@ static struct platform_driver intel_driver = { + + int __init intel_init(void) + { +- platform_driver_register(&intel_driver); ++ int err; ++ ++ err = platform_driver_register(&intel_driver); ++ if (err) ++ return err; + + return hci_uart_register_proto(&intel_proto); + } +diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c +index cbd970fb02f18..43342ea82afae 100644 +--- a/drivers/bus/hisi_lpc.c ++++ b/drivers/bus/hisi_lpc.c +@@ -504,13 +504,13 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + { + struct acpi_device *adev = ACPI_COMPANION(hostdev); + struct acpi_device *child; ++ struct platform_device *pdev; + int ret; + + /* Only consider the children of the host */ + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + const struct hisi_lpc_acpi_cell *cell; +- struct platform_device *pdev; + const struct resource *res; + bool found = false; + int num_res; +@@ -573,22 +573,24 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + + ret = platform_device_add_resources(pdev, res, num_res); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add_data(pdev, cell->pdata, + cell->pdata_size); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add(pdev); + if (ret) +- goto fail; ++ goto fail_put_device; + + acpi_device_set_enumerated(child); + } + + return 0; + ++fail_put_device: ++ platform_device_put(pdev); + fail: + hisi_lpc_acpi_remove(hostdev); + return ret; +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 708c486a6e960..ee41aec106ac6 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -675,6 +675,7 @@ static struct clk_branch gcc_sleep_clk_src = { + }, + .num_parents = 1, + .ops = &clk_branch2_ops, ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +@@ -1796,8 +1797,10 @@ static struct clk_regmap_div nss_port4_tx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_RX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_RX, 5, 0, 0), + F(78125000, P_UNIPHY1_RX, 4, 0, 0), + F(125000000, P_UNIPHY1_RX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_RX, 1, 0, 0), + F(156250000, P_UNIPHY1_RX, 2, 0, 0), + F(312500000, P_UNIPHY1_RX, 1, 0, 0), + { } +@@ -1836,8 +1839,10 @@ static struct clk_regmap_div nss_port5_rx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_TX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_TX, 5, 0, 0), + F(78125000, P_UNIPHY1_TX, 4, 0, 0), + F(125000000, P_UNIPHY1_TX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_TX, 1, 0, 0), + F(156250000, P_UNIPHY1_TX, 2, 0, 0), + F(312500000, P_UNIPHY1_TX, 1, 0, 0), + { } +@@ -1875,8 +1880,10 @@ static struct clk_regmap_div nss_port5_tx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_RX, 5, 0, 0), + F(25000000, P_UNIPHY2_RX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_RX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_RX, 1, 0, 0), + F(125000000, P_UNIPHY2_RX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_RX, 2, 0, 0), + F(312500000, P_UNIPHY2_RX, 1, 0, 0), +@@ -1915,8 +1922,10 @@ static struct clk_regmap_div nss_port6_rx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_TX, 5, 0, 0), + F(25000000, P_UNIPHY2_TX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_TX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_TX, 1, 0, 0), + F(125000000, P_UNIPHY2_TX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_TX, 2, 0, 0), + F(312500000, P_UNIPHY2_TX, 1, 0, 0), +@@ -3354,6 +3363,7 @@ static struct clk_branch gcc_nssnoc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi0_ahb_clk = { + .halt_reg = 0x6820c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6820c, + .enable_mask = BIT(0), +@@ -3371,6 +3381,7 @@ static struct clk_branch gcc_ubi0_ahb_clk = { + + static struct clk_branch gcc_ubi0_axi_clk = { + .halt_reg = 0x68200, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68200, + .enable_mask = BIT(0), +@@ -3388,6 +3399,7 @@ static struct clk_branch gcc_ubi0_axi_clk = { + + static struct clk_branch gcc_ubi0_nc_axi_clk = { + .halt_reg = 0x68204, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68204, + .enable_mask = BIT(0), +@@ -3405,6 +3417,7 @@ static struct clk_branch gcc_ubi0_nc_axi_clk = { + + static struct clk_branch gcc_ubi0_core_clk = { + .halt_reg = 0x68210, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68210, + .enable_mask = BIT(0), +@@ -3422,6 +3435,7 @@ static struct clk_branch gcc_ubi0_core_clk = { + + static struct clk_branch gcc_ubi0_mpt_clk = { + .halt_reg = 0x68208, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68208, + .enable_mask = BIT(0), +@@ -3439,6 +3453,7 @@ static struct clk_branch gcc_ubi0_mpt_clk = { + + static struct clk_branch gcc_ubi1_ahb_clk = { + .halt_reg = 0x6822c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6822c, + .enable_mask = BIT(0), +@@ -3456,6 +3471,7 @@ static struct clk_branch gcc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi1_axi_clk = { + .halt_reg = 0x68220, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68220, + .enable_mask = BIT(0), +@@ -3473,6 +3489,7 @@ static struct clk_branch gcc_ubi1_axi_clk = { + + static struct clk_branch gcc_ubi1_nc_axi_clk = { + .halt_reg = 0x68224, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68224, + .enable_mask = BIT(0), +@@ -3490,6 +3507,7 @@ static struct clk_branch gcc_ubi1_nc_axi_clk = { + + static struct clk_branch gcc_ubi1_core_clk = { + .halt_reg = 0x68230, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68230, + .enable_mask = BIT(0), +@@ -3507,6 +3525,7 @@ static struct clk_branch gcc_ubi1_core_clk = { + + static struct clk_branch gcc_ubi1_mpt_clk = { + .halt_reg = 0x68228, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68228, + .enable_mask = BIT(0), +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index 6e03b467395b2..ec48b5516e178 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -277,8 +277,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] __initconst = { + .name = "uart_group_012", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_UART, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ +- .dual.sel = ((0xec / 4) << 5) | 24, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ ++ .dual.sel = ((0x34 / 4) << 5) | 30, + .dual.group = 0, + }, + { +@@ -286,8 +286,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] __initconst = { + .name = "uart_group_34567", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_P2_PG, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ +- .dual.sel = ((0x34 / 4) << 5) | 30, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ ++ .dual.sel = ((0xec / 4) << 5) | 24, + .dual.group = 1, + }, + D_UGATE(CLK_UART0, "clk_uart0", UART_GROUP_012, 0, 0, 0x1b2, 0x1b3, 0x1b4, 0x1b5), +diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c +index 3e3cc28d5cfe3..f672dc1ecfacb 100644 +--- a/drivers/crypto/hisilicon/sec/sec_algs.c ++++ b/drivers/crypto/hisilicon/sec/sec_algs.c +@@ -457,7 +457,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + */ + } + +- mutex_lock(&ctx->queue->queuelock); ++ spin_lock_bh(&ctx->queue->queuelock); + /* Put the IV in place for chained cases */ + switch (ctx->cipher_alg) { + case SEC_C_AES_CBC_128: +@@ -517,7 +517,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + list_del(&backlog_req->backlog_head); + } + } +- mutex_unlock(&ctx->queue->queuelock); ++ spin_unlock_bh(&ctx->queue->queuelock); + + mutex_lock(&sec_req->lock); + list_del(&sec_req_el->head); +@@ -806,7 +806,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + */ + + /* Grab a big lock for a long time to avoid concurrency issues */ +- mutex_lock(&queue->queuelock); ++ spin_lock_bh(&queue->queuelock); + + /* + * Can go on to queue if we have space in either: +@@ -822,15 +822,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + ret = -EBUSY; + if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) { + list_add_tail(&sec_req->backlog_head, &ctx->backlog); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto out; + } + +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto err_free_elements; + } + ret = sec_send_request(sec_req, queue); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + if (ret) + goto err_free_elements; + +@@ -889,7 +889,7 @@ static int sec_alg_skcipher_init(struct crypto_skcipher *tfm) + if (IS_ERR(ctx->queue)) + return PTR_ERR(ctx->queue); + +- mutex_init(&ctx->queue->queuelock); ++ spin_lock_init(&ctx->queue->queuelock); + ctx->queue->havesoftqueue = false; + + return 0; +diff --git a/drivers/crypto/hisilicon/sec/sec_drv.h b/drivers/crypto/hisilicon/sec/sec_drv.h +index 2d2f186674ba9..ddc5d6bd7574e 100644 +--- a/drivers/crypto/hisilicon/sec/sec_drv.h ++++ b/drivers/crypto/hisilicon/sec/sec_drv.h +@@ -347,7 +347,7 @@ struct sec_queue { + DECLARE_BITMAP(unprocessed, SEC_QUEUE_LEN); + DECLARE_KFIFO_PTR(softqueue, typeof(struct sec_request_el *)); + bool havesoftqueue; +- struct mutex queuelock; ++ spinlock_t queuelock; + void *shadow[SEC_QUEUE_LEN]; + }; + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index 0fadf6a084943..4ec9a924a3381 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -987,11 +987,8 @@ static int sprd_dma_remove(struct platform_device *pdev) + { + struct sprd_dma_dev *sdev = platform_get_drvdata(pdev); + struct sprd_dma_chn *c, *cn; +- int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_get_sync(&pdev->dev); + + /* explicitly free the irq */ + if (sdev->irq > 0) +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index baa7280eccb34..1ce27bb9deada 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -826,7 +826,7 @@ static int scpi_init_versions(struct scpi_drvinfo *info) + info->firmware_version = le32_to_cpu(caps.platform_version); + } + /* Ignore error if not implemented */ +- if (scpi_info->is_legacy && ret == -EOPNOTSUPP) ++ if (info->is_legacy && ret == -EOPNOTSUPP) + return 0; + + return ret; +@@ -916,13 +916,14 @@ static int scpi_probe(struct platform_device *pdev) + struct resource res; + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; ++ struct scpi_drvinfo *scpi_drvinfo; + +- scpi_info = devm_kzalloc(dev, sizeof(*scpi_info), GFP_KERNEL); +- if (!scpi_info) ++ scpi_drvinfo = devm_kzalloc(dev, sizeof(*scpi_drvinfo), GFP_KERNEL); ++ if (!scpi_drvinfo) + return -ENOMEM; + + if (of_match_device(legacy_scpi_of_match, &pdev->dev)) +- scpi_info->is_legacy = true; ++ scpi_drvinfo->is_legacy = true; + + count = of_count_phandle_with_args(np, "mboxes", "#mbox-cells"); + if (count < 0) { +@@ -930,19 +931,19 @@ static int scpi_probe(struct platform_device *pdev) + return -ENODEV; + } + +- scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan), +- GFP_KERNEL); +- if (!scpi_info->channels) ++ scpi_drvinfo->channels = ++ devm_kcalloc(dev, count, sizeof(struct scpi_chan), GFP_KERNEL); ++ if (!scpi_drvinfo->channels) + return -ENOMEM; + +- ret = devm_add_action(dev, scpi_free_channels, scpi_info); ++ ret = devm_add_action(dev, scpi_free_channels, scpi_drvinfo); + if (ret) + return ret; + +- for (; scpi_info->num_chans < count; scpi_info->num_chans++) { ++ for (; scpi_drvinfo->num_chans < count; scpi_drvinfo->num_chans++) { + resource_size_t size; +- int idx = scpi_info->num_chans; +- struct scpi_chan *pchan = scpi_info->channels + idx; ++ int idx = scpi_drvinfo->num_chans; ++ struct scpi_chan *pchan = scpi_drvinfo->channels + idx; + struct mbox_client *cl = &pchan->cl; + struct device_node *shmem = of_parse_phandle(np, "shmem", idx); + +@@ -986,49 +987,57 @@ static int scpi_probe(struct platform_device *pdev) + return ret; + } + +- scpi_info->commands = scpi_std_commands; ++ scpi_drvinfo->commands = scpi_std_commands; + +- platform_set_drvdata(pdev, scpi_info); ++ platform_set_drvdata(pdev, scpi_drvinfo); + +- if (scpi_info->is_legacy) { ++ if (scpi_drvinfo->is_legacy) { + /* Replace with legacy variants */ + scpi_ops.clk_set_val = legacy_scpi_clk_set_val; +- scpi_info->commands = scpi_legacy_commands; ++ scpi_drvinfo->commands = scpi_legacy_commands; + + /* Fill priority bitmap */ + for (idx = 0; idx < ARRAY_SIZE(legacy_hpriority_cmds); idx++) + set_bit(legacy_hpriority_cmds[idx], +- scpi_info->cmd_priority); ++ scpi_drvinfo->cmd_priority); + } + +- ret = scpi_init_versions(scpi_info); ++ scpi_info = scpi_drvinfo; ++ ++ ret = scpi_init_versions(scpi_drvinfo); + if (ret) { + dev_err(dev, "incorrect or no SCP firmware found\n"); ++ scpi_info = NULL; + return ret; + } + +- if (scpi_info->is_legacy && !scpi_info->protocol_version && +- !scpi_info->firmware_version) ++ if (scpi_drvinfo->is_legacy && !scpi_drvinfo->protocol_version && ++ !scpi_drvinfo->firmware_version) + dev_info(dev, "SCP Protocol legacy pre-1.0 firmware\n"); + else + dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n", + FIELD_GET(PROTO_REV_MAJOR_MASK, +- scpi_info->protocol_version), ++ scpi_drvinfo->protocol_version), + FIELD_GET(PROTO_REV_MINOR_MASK, +- scpi_info->protocol_version), ++ scpi_drvinfo->protocol_version), + FIELD_GET(FW_REV_MAJOR_MASK, +- scpi_info->firmware_version), ++ scpi_drvinfo->firmware_version), + FIELD_GET(FW_REV_MINOR_MASK, +- scpi_info->firmware_version), ++ scpi_drvinfo->firmware_version), + FIELD_GET(FW_REV_PATCH_MASK, +- scpi_info->firmware_version)); +- scpi_info->scpi_ops = &scpi_ops; ++ scpi_drvinfo->firmware_version)); + + ret = devm_device_add_groups(dev, versions_groups); + if (ret) + dev_err(dev, "unable to create sysfs version group\n"); + +- return devm_of_platform_populate(dev); ++ scpi_drvinfo->scpi_ops = &scpi_ops; ++ ++ ret = devm_of_platform_populate(dev); ++ if (ret) ++ scpi_info = NULL; ++ ++ return ret; + } + + static const struct of_device_id scpi_of_match[] = { +diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-core.c +index 65e0b6a2c0313..059ba27f3c29c 100644 +--- a/drivers/fpga/altera-pr-ip-core.c ++++ b/drivers/fpga/altera-pr-ip-core.c +@@ -108,7 +108,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, const char *buf, + u32 *buffer_32 = (u32 *)buf; + size_t i = 0; + +- if (count <= 0) ++ if (!count) + return -EINVAL; + + /* Write out the complete 32-bit chunks */ +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 09999e3e3109e..7bda0f59c1099 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -476,7 +476,8 @@ int of_mm_gpiochip_add_data(struct device_node *np, + if (mm_gc->save_regs) + mm_gc->save_regs(mm_gc); + +- mm_gc->gc.of_node = np; ++ of_node_put(mm_gc->gc.of_node); ++ mm_gc->gc.of_node = of_node_get(np); + + ret = gpiochip_add_data(gc, data); + if (ret) +@@ -484,6 +485,7 @@ int of_mm_gpiochip_add_data(struct device_node *np, + + return 0; + err2: ++ of_node_put(np); + iounmap(mm_gc->regs); + err1: + kfree(gc->label); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index e25952d516e22..b51e7839b41b9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -883,6 +883,10 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain, + if (WARN_ON_ONCE(min_offset > max_offset)) + return -EINVAL; + ++ /* Check domain to be pinned to against preferred domains */ ++ if (bo->preferred_domains & domain) ++ domain = bo->preferred_domains & domain; ++ + /* A shared bo cannot be migrated to VRAM */ + if (bo->prime_shared_count) { + if (domain & AMDGPU_GEM_DOMAIN_GTT) +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index b6e7cc9082ca0..31b75d3ca6e90 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1301,10 +1301,21 @@ static struct i2c_driver adv7511_driver = { + + static int __init adv7511_init(void) + { +- if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) +- mipi_dsi_driver_register(&adv7533_dsi_driver); ++ int ret; ++ ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) { ++ ret = mipi_dsi_driver_register(&adv7533_dsi_driver); ++ if (ret) ++ return ret; ++ } + +- return i2c_add_driver(&adv7511_driver); ++ ret = i2c_add_driver(&adv7511_driver); ++ if (ret) { ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) ++ mipi_dsi_driver_unregister(&adv7533_dsi_driver); ++ } ++ ++ return ret; + } + module_init(adv7511_init); + +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index ea433bb189ca2..c72092319a533 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -607,7 +607,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count]; + int size = len + 2; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) { + dev_err(ctx->dev, "TX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +@@ -624,7 +624,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count]; + int size = len + 1; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) { + dev_err(ctx->dev, "RX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index 6c0ea39d57392..a263ac4aaab28 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -52,13 +52,7 @@ enum mtk_dpi_out_channel_swap { + }; + + enum mtk_dpi_out_color_format { +- MTK_DPI_COLOR_FORMAT_RGB, +- MTK_DPI_COLOR_FORMAT_RGB_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_444, +- MTK_DPI_COLOR_FORMAT_YCBCR_422, +- MTK_DPI_COLOR_FORMAT_XV_YCC, +- MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL ++ MTK_DPI_COLOR_FORMAT_RGB + }; + + struct mtk_dpi { +@@ -347,24 +341,11 @@ static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *dpi) + static void mtk_dpi_config_color_format(struct mtk_dpi *dpi, + enum mtk_dpi_out_color_format format) + { +- if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_444) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_BGR); +- } else if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_422) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, true); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, true); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } else { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, false); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } ++ /* only support RGB888 */ ++ mtk_dpi_config_yuv422_enable(dpi, false); ++ mtk_dpi_config_csc_enable(dpi, false); ++ mtk_dpi_config_swap_input(dpi, false); ++ mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); + } + + static void mtk_dpi_power_off(struct mtk_dpi *dpi, enum mtk_dpi_power_ctl pctl) +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 0dd317ac5fe57..a629a69c27568 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -651,6 +651,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + mtk_dsi_reset_engine(dsi); + mtk_dsi_lane0_ulp_mode_enter(dsi); + mtk_dsi_clk_ulp_mode_enter(dsi); ++ /* set the lane number as 0 to pull down mipi */ ++ writel(0, dsi->regs + DSI_TXRX_CTRL); + + mtk_dsi_disable(dsi); + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 1887473cdd79c..9959522ce802d 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -141,8 +141,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev) + for_each_endpoint_of_node(dev->of_node, ep) { + /* If the endpoint node exists, consider it enabled */ + remote = of_graph_get_remote_port(ep); +- if (remote) ++ if (remote) { ++ of_node_put(remote); ++ of_node_put(ep); + return true; ++ } + } + + return false; +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +index 88de122255825..69fe09b410872 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +@@ -134,12 +134,13 @@ int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) + { + struct msm_drm_private *priv = s->dev->dev_private; + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); +- struct mdp5_global_state *state = mdp5_get_global_state(s); ++ struct mdp5_global_state *state; + struct mdp5_hw_pipe_state *new_state; + + if (!hwpipe) + return 0; + ++ state = mdp5_get_global_state(s); + if (IS_ERR(state)) + return PTR_ERR(state); + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +index 8bff14ae16b0e..f0368d9a0154d 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +@@ -33,7 +33,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size) + { + u32 p = *addr; + +- if (*addr > bios->image0_size && bios->imaged_addr) { ++ if (*addr >= bios->image0_size && bios->imaged_addr) { + *addr -= bios->image0_size; + *addr += bios->imaged_addr; + } +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index f86ca163dcf34..a7273c01de34b 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2738,10 +2738,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + table->mc_reg_table_entry[k].mc_data[j] |= 0x100; + } + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + case MC_SEQ_RESERVE_M >> 2: ++ if (j >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) ++ return -EINVAL; + temp_reg = RREG32(MC_PMG_CMD_MRS1); + table->mc_reg_address[j].s1 = MC_PMG_CMD_MRS1 >> 2; + table->mc_reg_address[j].s0 = MC_SEQ_PMG_CMD_MRS1_LP >> 2; +@@ -2750,8 +2750,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + (temp_reg & 0xffff0000) | + (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff); + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + default: + break; +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index c0b6474359742..69eb0de9973fb 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1088,6 +1088,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc) + { + struct rockchip_crtc_state *rockchip_state; + ++ if (WARN_ON(!crtc->state)) ++ return NULL; ++ + rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL); + if (!rockchip_state) + return NULL; +diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c +index 0c607eb33d7e0..77003ce666a43 100644 +--- a/drivers/gpu/drm/vc4/vc4_dsi.c ++++ b/drivers/gpu/drm/vc4/vc4_dsi.c +@@ -853,11 +853,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder, + /* Find what divider gets us a faster clock than the requested + * pixel clock. + */ +- for (divider = 1; divider < 8; divider++) { +- if (parent_rate / divider < pll_clock) { +- divider--; ++ for (divider = 1; divider < 255; divider++) { ++ if (parent_rate / (divider + 1) < pll_clock) + break; +- } + } + + /* Now that we've picked a PLL divider, calculate back to its +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index 3eddd8f73b577..116ece4be2c95 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -835,6 +835,8 @@ static const struct hid_device_id alps_id[] = { + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1) }, ++ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, ++ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_T4_BTNLESS) }, + { } +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index 6f65f52572368..637a7ce281c61 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -794,6 +794,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr, + data->word = le16_to_cpup((__le16 *)buf); + break; + case I2C_SMBUS_I2C_BLOCK_DATA: ++ if (read_length > I2C_SMBUS_BLOCK_MAX) { ++ ret = -EINVAL; ++ goto power_normal; ++ } ++ + memcpy(data->block + 1, buf, read_length); + break; + case I2C_SMBUS_BLOCK_DATA: +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 152570b49f3b2..fb63845e9920d 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2095,7 +2095,7 @@ static int wacom_register_inputs(struct wacom *wacom) + + error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac); + if (error) { +- /* no pad in use on this interface */ ++ /* no pad events using this interface */ + input_free_device(pad_input_dev); + wacom_wac->pad_input = NULL; + pad_input_dev = NULL; +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 254afea67cf37..826c02a11133b 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1954,7 +1954,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev, + wacom_wac->has_mute_touch_switch = true; + usage->type = EV_SW; + usage->code = SW_MUTE_DEVICE; +- features->device_type |= WACOM_DEVICETYPE_PAD; + break; + case WACOM_HID_WD_TOUCHSTRIP: + wacom_map_usage(input, usage, field, EV_ABS, ABS_RX, 0); +@@ -2034,6 +2033,30 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field + wacom_wac->hid_data.inrange_state |= value; + } + ++ /* Process touch switch state first since it is reported through touch interface, ++ * which is indepentent of pad interface. In the case when there are no other pad ++ * events, the pad interface will not even be created. ++ */ ++ if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) || ++ (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) { ++ if (wacom_wac->shared->touch_input) { ++ bool *is_touch_on = &wacom_wac->shared->is_touch_on; ++ ++ if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value) ++ *is_touch_on = !(*is_touch_on); ++ else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF) ++ *is_touch_on = value; ++ ++ input_report_switch(wacom_wac->shared->touch_input, ++ SW_MUTE_DEVICE, !(*is_touch_on)); ++ input_sync(wacom_wac->shared->touch_input); ++ } ++ return; ++ } ++ ++ if (!input) ++ return; ++ + switch (equivalent_usage) { + case WACOM_HID_WD_TOUCHRING: + /* +@@ -2063,22 +2086,6 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field + input_event(input, usage->type, usage->code, 0); + break; + +- case WACOM_HID_WD_MUTE_DEVICE: +- case WACOM_HID_WD_TOUCHONOFF: +- if (wacom_wac->shared->touch_input) { +- bool *is_touch_on = &wacom_wac->shared->is_touch_on; +- +- if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value) +- *is_touch_on = !(*is_touch_on); +- else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF) +- *is_touch_on = value; +- +- input_report_switch(wacom_wac->shared->touch_input, +- SW_MUTE_DEVICE, !(*is_touch_on)); +- input_sync(wacom_wac->shared->touch_input); +- } +- break; +- + case WACOM_HID_WD_MODE_CHANGE: + if (wacom_wac->is_direct_mode != value) { + wacom_wac->is_direct_mode = value; +@@ -2719,7 +2726,7 @@ void wacom_wac_event(struct hid_device *hdev, struct hid_field *field, + /* usage tests must precede field tests */ + if (WACOM_BATTERY_USAGE(usage)) + wacom_wac_battery_event(hdev, field, usage, value); +- else if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input) ++ else if (WACOM_PAD_FIELD(field)) + wacom_wac_pad_event(hdev, field, usage, value); + else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input) + wacom_wac_pen_event(hdev, field, usage, value); +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index 83fab06ccfebd..6229f8e497fcc 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -245,6 +245,21 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x54a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Raptor Lake-S CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa76f), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Raptor Lake-S */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Meteor Lake-P */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7e24), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Rocket Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 512c61d31fe5c..bce7bf93d62a4 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -353,8 +353,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) + ctrl_reg = cdns_i2c_readreg(CDNS_I2C_CR_OFFSET); + ctrl_reg |= CDNS_I2C_CR_RW | CDNS_I2C_CR_CLR_FIFO; + ++ /* ++ * Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length ++ * byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if ++ * PEC is enabled, otherwise 1. ++ */ + if (id->p_msg->flags & I2C_M_RECV_LEN) +- id->recv_count = I2C_SMBUS_BLOCK_MAX + 1; ++ id->recv_count = I2C_SMBUS_BLOCK_MAX + id->p_msg->len; + + id->curr_recv_count = id->recv_count; + +@@ -540,6 +545,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + if (id->err_status & CDNS_I2C_IXR_ARB_LOST) + return -EAGAIN; + ++ if (msg->flags & I2C_M_RECV_LEN) ++ msg->len += min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX); ++ + return 0; + } + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 2a43f4e46af04..9079be0d51d15 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) + if (!adap) + return; + +- put_device(&adap->dev); + module_put(adap->owner); ++ /* Should be last, otherwise we risk use-after-free with 'adap' */ ++ put_device(&adap->dev); + } + EXPORT_SYMBOL(i2c_put_adapter); + +diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-gpmux.c +index 92cf5f48afe63..5053f1675a294 100644 +--- a/drivers/i2c/muxes/i2c-mux-gpmux.c ++++ b/drivers/i2c/muxes/i2c-mux-gpmux.c +@@ -141,6 +141,7 @@ static int i2c_mux_probe(struct platform_device *pdev) + return 0; + + err_children: ++ of_node_put(child); + i2c_mux_del_adapters(muxc); + err_parent: + i2c_put_adapter(parent); +diff --git a/drivers/iio/light/isl29028.c b/drivers/iio/light/isl29028.c +index f9912ab4f65c0..4c2810c2a4bf4 100644 +--- a/drivers/iio/light/isl29028.c ++++ b/drivers/iio/light/isl29028.c +@@ -639,7 +639,7 @@ static int isl29028_probe(struct i2c_client *client, + ISL29028_POWER_OFF_DELAY_MS); + pm_runtime_use_autosuspend(&client->dev); + +- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev); ++ ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, + "%s(): iio registration failed with error %d\n", +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index 64ee11542a566..be31faf6cc620 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -1222,8 +1222,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, + goto done; + + ret = init_user_ctxt(fd, uctxt); +- if (ret) ++ if (ret) { ++ hfi1_free_ctxt_rcv_groups(uctxt); + goto done; ++ } + + user_init(uctxt); + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 4798b718b085b..a4b5374deac87 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -210,6 +210,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp, + spin_lock_init(&qp->grp_lock); + spin_lock_init(&qp->state_lock); + ++ spin_lock_init(&qp->req.task.state_lock); ++ spin_lock_init(&qp->resp.task.state_lock); ++ spin_lock_init(&qp->comp.task.state_lock); ++ ++ spin_lock_init(&qp->sq.sq_lock); ++ spin_lock_init(&qp->rq.producer_lock); ++ spin_lock_init(&qp->rq.consumer_lock); ++ + atomic_set(&qp->ssn, 0); + atomic_set(&qp->skb_out, 0); + } +@@ -258,7 +266,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->req.opcode = -1; + qp->comp.opcode = -1; + +- spin_lock_init(&qp->sq.sq_lock); + skb_queue_head_init(&qp->req_pkts); + + rxe_init_task(rxe, &qp->req.task, qp, +@@ -308,9 +315,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + } + } + +- spin_lock_init(&qp->rq.producer_lock); +- spin_lock_init(&qp->rq.consumer_lock); +- + skb_queue_head_init(&qp->resp_pkts); + + rxe_init_task(rxe, &qp->resp.task, qp, +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 4bf6049dd2c79..8626c924f724c 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -640,7 +640,7 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev) + + ret = iommu_device_register(&data->iommu); + if (ret) +- return ret; ++ goto err_iommu_register; + + platform_set_drvdata(pdev, data); + +@@ -667,6 +667,10 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + + return 0; ++ ++err_iommu_register: ++ iommu_device_sysfs_remove(&data->iommu); ++ return ret; + } + + static int __maybe_unused exynos_sysmmu_suspend(struct device *dev) +diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c +index b0a4a3d2f60ea..244e2f7eae842 100644 +--- a/drivers/iommu/qcom_iommu.c ++++ b/drivers/iommu/qcom_iommu.c +@@ -767,9 +767,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_iommu_dev *qcom_iommu) + { + struct device_node *child; + +- for_each_child_of_node(qcom_iommu->dev->of_node, child) +- if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) ++ for_each_child_of_node(qcom_iommu->dev->of_node, child) { ++ if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) { ++ of_node_put(child); + return true; ++ } ++ } + + return false; + } +diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c +index 0abc0cd1c32ed..1b3048ecb6000 100644 +--- a/drivers/irqchip/irq-tegra.c ++++ b/drivers/irqchip/irq-tegra.c +@@ -157,10 +157,10 @@ static int tegra_ictlr_suspend(void) + lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); + + /* Disable COP interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + + /* Disable CPU interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + + /* Enable the wakeup sources of ictlr */ + writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); +@@ -181,12 +181,12 @@ static void tegra_ictlr_resume(void) + + writel_relaxed(lic->cpu_iep[i], + ictlr + ICTLR_CPU_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(lic->cpu_ier[i], + ictlr + ICTLR_CPU_IER_SET); + writel_relaxed(lic->cop_iep[i], + ictlr + ICTLR_COP_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(lic->cop_ier[i], + ictlr + ICTLR_COP_IER_SET); + } +@@ -321,7 +321,7 @@ static int __init tegra_ictlr_init(struct device_node *node, + lic->base[i] = base; + + /* Disable all interrupts */ +- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); + /* All interrupts target IRQ */ + writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index dd56536ab7288..5c45100f6d53e 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3533,7 +3533,7 @@ static void raid_status(struct dm_target *ti, status_type_t type, + { + struct raid_set *rs = ti->private; + struct mddev *mddev = &rs->md; +- struct r5conf *conf = mddev->private; ++ struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL; + int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0; + unsigned long recovery; + unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */ +@@ -3804,7 +3804,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs) + + memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices)); + +- for (i = 0; i < mddev->raid_disks; i++) { ++ for (i = 0; i < rs->raid_disks; i++) { + r = &rs->dev[i].rdev; + /* HM FIXME: enhance journal device recovery processing */ + if (test_bit(Journal, &r->flags)) +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index 3ca8627c2f1de..af5af0b78022b 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -20,7 +20,7 @@ + + #define HIGH_WATERMARK 50 + #define LOW_WATERMARK 45 +-#define MAX_WRITEBACK_JOBS 0 ++#define MAX_WRITEBACK_JOBS min(0x10000000 / PAGE_SIZE, totalram_pages / 16) + #define ENDIO_LATENCY 16 + #define WRITEBACK_LATENCY 64 + #define AUTOCOMMIT_BLOCKS_SSD 65536 +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index d2ee97cd7d14e..324d1dd58e2bc 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -3122,6 +3122,11 @@ static int dm_call_pr(struct block_device *bdev, iterate_devices_callout_fn fn, + goto out; + ti = dm_table_get_target(table, 0); + ++ if (dm_suspended_md(md)) { ++ ret = -EAGAIN; ++ goto out; ++ } ++ + ret = -EINVAL; + if (!ti->type->iterate_devices) + goto out; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 8e0f936b3e378..9f9cd2fadc1e7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1863,9 +1863,12 @@ static int raid10_remove_disk(struct mddev *mddev, struct md_rdev *rdev) + int err = 0; + int number = rdev->raid_disk; + struct md_rdev **rdevp; +- struct raid10_info *p = conf->mirrors + number; ++ struct raid10_info *p; + + print_conf(conf); ++ if (unlikely(number >= mddev->raid_disks)) ++ return 0; ++ p = conf->mirrors + number; + if (rdev == p->rdev) + rdevp = &p->rdev; + else if (rdev == p->replacement) +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index dad426cc0f903..6f04473f08385 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2670,10 +2670,10 @@ static void raid5_end_write_request(struct bio *bi) + if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) + clear_bit(R5_LOCKED, &sh->dev[i].flags); + set_bit(STRIPE_HANDLE, &sh->state); +- raid5_release_stripe(sh); + + if (sh->batch_head && sh != sh->batch_head) + raid5_release_stripe(sh->batch_head); ++ raid5_release_stripe(sh); + } + + static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) +diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c +index 7fb3f07bf0221..8e759728ef22b 100644 +--- a/drivers/media/pci/tw686x/tw686x-core.c ++++ b/drivers/media/pci/tw686x/tw686x-core.c +@@ -318,13 +318,6 @@ static int tw686x_probe(struct pci_dev *pci_dev, + + spin_lock_init(&dev->lock); + +- err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, +- dev->name, dev); +- if (err < 0) { +- dev_err(&pci_dev->dev, "unable to request interrupt\n"); +- goto iounmap; +- } +- + timer_setup(&dev->dma_delay_timer, tw686x_dma_delay, 0); + + /* +@@ -336,18 +329,23 @@ static int tw686x_probe(struct pci_dev *pci_dev, + err = tw686x_video_init(dev); + if (err) { + dev_err(&pci_dev->dev, "can't register video\n"); +- goto free_irq; ++ goto iounmap; + } + + err = tw686x_audio_init(dev); + if (err) + dev_warn(&pci_dev->dev, "can't register audio\n"); + ++ err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, ++ dev->name, dev); ++ if (err < 0) { ++ dev_err(&pci_dev->dev, "unable to request interrupt\n"); ++ goto iounmap; ++ } ++ + pci_set_drvdata(pci_dev, dev); + return 0; + +-free_irq: +- free_irq(pci_dev->irq, dev); + iounmap: + pci_iounmap(pci_dev, dev->mmio); + free_region: +diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +index 78e2cc0dead1a..4f4a51dd48e14 100644 +--- a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h ++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +@@ -48,12 +48,14 @@ struct mdp_ipi_init { + * @ipi_id : IPI_MDP + * @ap_inst : AP mtk_mdp_vpu address + * @vpu_inst_addr : VPU MDP instance address ++ * @padding : Alignment padding + */ + struct mdp_ipi_comm { + uint32_t msg_id; + uint32_t ipi_id; + uint64_t ap_inst; + uint32_t vpu_inst_addr; ++ uint32_t padding; + }; + + /** +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index ce46f87214708..1fb2cdd9c4b2b 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -413,7 +413,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count, + struct hdpvr_device *dev = video_drvdata(file); + struct hdpvr_buffer *buf = NULL; + struct urb *urb; +- unsigned int ret = 0; ++ int ret = 0; + int rem, cnt; + + if (*pos) +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 7aab26128f6d9..addf76a8d1b0e 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1339,17 +1339,17 @@ static int msb_ftl_initialize(struct msb_data *msb) + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; + msb->logical_block_count = msb->zone_count * 496 - 2; + +- msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); +- msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); ++ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); ++ msb->erased_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); + msb->lba_to_pba_table = + kmalloc_array(msb->logical_block_count, sizeof(u16), + GFP_KERNEL); + + if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || + !msb->erased_blocks_bitmap) { +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); +- kfree(msb->erased_blocks_bitmap); + return -ENOMEM; + } + +@@ -1961,7 +1961,8 @@ static int msb_bd_open(struct block_device *bdev, fmode_t mode) + static void msb_data_clear(struct msb_data *msb) + { + kfree(msb->boot_page); +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); + kfree(msb->cache); + msb->card = NULL; +diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c +index 43d8683266de2..caa61649fe797 100644 +--- a/drivers/mfd/t7l66xb.c ++++ b/drivers/mfd/t7l66xb.c +@@ -412,11 +412,8 @@ err_noirq: + + static int t7l66xb_remove(struct platform_device *dev) + { +- struct t7l66xb_platform_data *pdata = dev_get_platdata(&dev->dev); + struct t7l66xb *t7l66xb = platform_get_drvdata(dev); +- int ret; + +- ret = pdata->disable(dev); + clk_disable_unprepare(t7l66xb->clk48m); + clk_put(t7l66xb->clk48m); + clk_disable_unprepare(t7l66xb->clk32k); +@@ -427,8 +424,7 @@ static int t7l66xb_remove(struct platform_device *dev) + mfd_remove_devices(&dev->dev); + kfree(t7l66xb); + +- return ret; +- ++ return 0; + } + + static struct platform_driver t7l66xb_platform_driver = { +diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c +index 3eb3c237f3398..80b9f36dbca43 100644 +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -1479,7 +1479,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, + pcr->remap_addr = ioremap_nocache(base, len); + if (!pcr->remap_addr) { + ret = -ENOMEM; +- goto free_handle; ++ goto free_idr; + } + + pcr->rtsx_resv_buf = dma_alloc_coherent(&(pcidev->dev), +@@ -1541,6 +1541,10 @@ disable_msi: + pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr); + unmap: + iounmap(pcr->remap_addr); ++free_idr: ++ spin_lock(&rtsx_pci_lock); ++ idr_remove(&rtsx_pci_idr, pcr->id); ++ spin_unlock(&rtsx_pci_lock); + free_handle: + kfree(handle); + free_pcr: +diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c +index ce08a9f22308f..0dbe78383f8fa 100644 +--- a/drivers/misc/cxl/irq.c ++++ b/drivers/misc/cxl/irq.c +@@ -353,6 +353,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) + + out: + cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); ++ bitmap_free(ctx->irq_bitmap); + afu_irq_name_free(ctx); + return -ENOMEM; + } +diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c +index 22aded1065ae8..2245452a44c86 100644 +--- a/drivers/mmc/host/cavium-octeon.c ++++ b/drivers/mmc/host/cavium-octeon.c +@@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, "Error populating slots\n"); + octeon_mmc_set_shared_power(host, 0); ++ of_node_put(cn); + goto error; + } + i++; +diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c +index eee08d81b2421..f79806e31e7ea 100644 +--- a/drivers/mmc/host/cavium-thunderx.c ++++ b/drivers/mmc/host/cavium-thunderx.c +@@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev, + continue; + + ret = cvm_mmc_of_slot_probe(&host->slot_pdev[i]->dev, host); +- if (ret) ++ if (ret) { ++ of_node_put(child_node); + goto error; ++ } + } + i++; + } +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index 00b5465dfb0ce..d0db1c37552f8 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -653,7 +653,7 @@ static int pxamci_probe(struct platform_device *pdev) + + ret = pxamci_of_init(pdev, mmc); + if (ret) +- return ret; ++ goto out; + + host = mmc_priv(mmc); + host->mmc = mmc; +@@ -677,7 +677,7 @@ static int pxamci_probe(struct platform_device *pdev) + + ret = pxamci_init_ocr(host); + if (ret < 0) +- return ret; ++ goto out; + + mmc->caps = 0; + host->cmdat = 0; +diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c +index 8cd1794768ba1..70ce977cfeeca 100644 +--- a/drivers/mmc/host/sdhci-of-at91.c ++++ b/drivers/mmc/host/sdhci-of-at91.c +@@ -117,8 +117,13 @@ static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode, + static void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, + unsigned int timing) + { +- if (timing == MMC_TIMING_MMC_DDR52) +- sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R); ++ u8 mc1r; ++ ++ if (timing == MMC_TIMING_MMC_DDR52) { ++ mc1r = sdhci_readb(host, SDMMC_MC1R); ++ mc1r |= SDMMC_MC1R_DDR; ++ sdhci_writeb(host, mc1r, SDMMC_MC1R); ++ } + sdhci_set_uhs_signaling(host, timing); + } + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index d6cb0f9a34880..77ae23077f560 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -704,6 +704,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, + scfg_node = of_find_matching_node(NULL, scfg_device_ids); + if (scfg_node) + scfg_base = of_iomap(scfg_node, 0); ++ of_node_put(scfg_node); + if (scfg_base) { + sdhciovselcr = SDHCIOVSELCR_TGLEN | + SDHCIOVSELCR_VSELVAL; +diff --git a/drivers/mtd/devices/st_spi_fsm.c b/drivers/mtd/devices/st_spi_fsm.c +index 55d4a77f3b7f5..533096c88ae19 100644 +--- a/drivers/mtd/devices/st_spi_fsm.c ++++ b/drivers/mtd/devices/st_spi_fsm.c +@@ -2120,10 +2120,12 @@ static int stfsm_probe(struct platform_device *pdev) + (long long)fsm->mtd.size, (long long)(fsm->mtd.size >> 20), + fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10)); + +- return mtd_device_register(&fsm->mtd, NULL, 0); +- ++ ret = mtd_device_register(&fsm->mtd, NULL, 0); ++ if (ret) { + err_clk_unprepare: +- clk_disable_unprepare(fsm->clk); ++ clk_disable_unprepare(fsm->clk); ++ } ++ + return ret; + } + +diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/physmap_of_versatile.c +index 03f2b6e7bc7e8..7d56e97bd50f4 100644 +--- a/drivers/mtd/maps/physmap_of_versatile.c ++++ b/drivers/mtd/maps/physmap_of_versatile.c +@@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev) + return -ENODEV; + } + ebi_base = of_iomap(ebi, 0); ++ of_node_put(ebi); + if (!ebi_base) + return -ENODEV; + +@@ -221,6 +222,7 @@ int of_flash_probe_versatile(struct platform_device *pdev, + + versatile_flashprot = (enum versatile_flashprot)devid->data; + rmap = syscon_node_to_regmap(sysnp); ++ of_node_put(sysnp); + if (IS_ERR(rmap)) + return PTR_ERR(rmap); + +diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c +index f3bd86e136033..e57f7ba054bc5 100644 +--- a/drivers/mtd/sm_ftl.c ++++ b/drivers/mtd/sm_ftl.c +@@ -1091,9 +1091,9 @@ static void sm_release(struct mtd_blktrans_dev *dev) + { + struct sm_ftl *ftl = dev->priv; + +- mutex_lock(&ftl->mutex); + del_timer_sync(&ftl->timer); + cancel_work_sync(&ftl->flush_work); ++ mutex_lock(&ftl->mutex); + sm_cache_flush(ftl); + mutex_unlock(&ftl->mutex); + } +diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c +index ced11ea892698..25def028a1dce 100644 +--- a/drivers/net/can/pch_can.c ++++ b/drivers/net/can/pch_can.c +@@ -500,6 +500,7 @@ static void pch_can_error(struct net_device *ndev, u32 status) + if (!skb) + return; + ++ errc = ioread32(&priv->regs->errc); + if (status & PCH_BUS_OFF) { + pch_can_set_tx_all(priv, 0); + pch_can_set_rx_all(priv, 0); +@@ -507,9 +508,11 @@ static void pch_can_error(struct net_device *ndev, u32 status) + cf->can_id |= CAN_ERR_BUSOFF; + priv->can.can_stats.bus_off++; + can_bus_off(ndev); ++ } else { ++ cf->data[6] = errc & PCH_TEC; ++ cf->data[7] = (errc & PCH_REC) >> 8; + } + +- errc = ioread32(&priv->regs->errc); + /* Warning interrupt. */ + if (status & PCH_EWARN) { + state = CAN_STATE_ERROR_WARNING; +@@ -567,9 +570,6 @@ static void pch_can_error(struct net_device *ndev, u32 status) + break; + } + +- cf->data[6] = errc & PCH_TEC; +- cf->data[7] = (errc & PCH_REC) >> 8; +- + priv->can.state = state; + netif_receive_skb(skb); + +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index 963da8eda1687..0156c18d5a2d0 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -233,11 +233,8 @@ static void rcar_can_error(struct net_device *ndev) + if (eifr & (RCAR_CAN_EIFR_EWIF | RCAR_CAN_EIFR_EPIF)) { + txerr = readb(&priv->regs->tecr); + rxerr = readb(&priv->regs->recr); +- if (skb) { ++ if (skb) + cf->can_id |= CAN_ERR_CRTL; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } + } + if (eifr & RCAR_CAN_EIFR_BEIF) { + int rx_errors = 0, tx_errors = 0; +@@ -337,6 +334,9 @@ static void rcar_can_error(struct net_device *ndev) + can_bus_off(ndev); + if (skb) + cf->can_id |= CAN_ERR_BUSOFF; ++ } else if (skb) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + if (eifr & RCAR_CAN_EIFR_ORIF) { + netdev_dbg(priv->ndev, "Receive overrun error interrupt\n"); +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c +index 9f107798f904b..e7327ceabb76e 100644 +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + txerr = priv->read_reg(priv, SJA1000_TXERR); + rxerr = priv->read_reg(priv, SJA1000_RXERR); + +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- + if (isrc & IRQ_DOI) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & IRQ_BEI) { + /* bus error interrupt */ + priv->can.can_stats.bus_error++; +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 472175e37055e..5f730f791c27f 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -688,8 +688,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + + txerr = hi3110_read(spi, HI3110_READ_TEC); + rxerr = hi3110_read(spi, HI3110_READ_REC); +- cf->data[6] = txerr; +- cf->data[7] = rxerr; + tx_state = txerr >= rxerr ? new_state : 0; + rx_state = txerr <= rxerr ? new_state : 0; + can_change_state(net, cf, tx_state, rx_state); +@@ -702,6 +700,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + hi3110_hw_sleep(spi); + break; + } ++ } else { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + } + +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index 093fc9a529f08..bebdd133d9ed1 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + rxerr = (errc >> 16) & 0xFF; + txerr = errc & 0xFF; + +- if (skb) { +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } +- + if (isrc & SUN4I_INT_DATA_OR) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (skb && state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & SUN4I_INT_BUS_ERR) { + /* bus error interrupt */ + netdev_dbg(dev, "bus error interrupt\n"); +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 31a070226353a..23eba9bab7150 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -206,7 +206,7 @@ struct __packed ems_cpc_msg { + __le32 ts_sec; /* timestamp in seconds */ + __le32 ts_nsec; /* timestamp in nano seconds */ + +- union { ++ union __packed { + u8 generic[64]; + struct cpc_can_msg can_msg; + struct cpc_can_params can_params; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index a7c408acb0c09..01d4a731b579c 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -890,8 +890,10 @@ static void kvaser_usb_hydra_update_state(struct kvaser_usb_net_priv *priv, + new_state < CAN_STATE_BUS_OFF) + priv->can.can_stats.restarts++; + +- cf->data[6] = bec->txerr; +- cf->data[7] = bec->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec->txerr; ++ cf->data[7] = bec->rxerr; ++ } + + stats = &netdev->stats; + stats->rx_packets++; +@@ -1045,8 +1047,10 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv, + shhwtstamps->hwtstamp = hwtstamp; + + cf->can_id |= CAN_ERR_BUSERROR; +- cf->data[6] = bec.txerr; +- cf->data[7] = bec.rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec.txerr; ++ cf->data[7] = bec.rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 0e0403dd05500..5e281249ad5fe 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -857,8 +857,10 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + break; + } + +- cf->data[6] = es->txerr; +- cf->data[7] = es->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = es->txerr; ++ cf->data[7] = es->rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index 232f45f722f0c..5cb5be4dc941f 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -453,9 +453,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv, + + if (rx_errors) + stats->rx_errors++; +- +- cf->data[6] = txerr; +- cf->data[7] = rxerr; ++ if (priv->can.state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + + priv->bec.txerr = txerr; + priv->bec.rxerr = rxerr; +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 52a811f913846..eb11a8e7fcb7f 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -141,11 +141,7 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable) + * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds + * to current timer would be next second. + */ +- tempval = readl(fep->hwp + FEC_ATIME_CTRL); +- tempval |= FEC_T_CTRL_CAPTURE; +- writel(tempval, fep->hwp + FEC_ATIME_CTRL); +- +- tempval = readl(fep->hwp + FEC_ATIME); ++ tempval = fep->cc.read(&fep->cc); + /* Convert the ptp local counter to 1588 timestamp */ + ns = timecounter_cyc2time(&fep->tc, tempval); + ts = ns_to_timespec64(ns); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2f3b393e55068..85337806efc75 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -397,7 +397,9 @@ static void i40e_tx_timeout(struct net_device *netdev) + set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state); + break; + default: +- netdev_err(netdev, "tx_timeout recovery unsuccessful\n"); ++ netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-recoverable state.\n"); ++ set_bit(__I40E_DOWN_REQUESTED, pf->state); ++ set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state); + break; + } + +diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h +index ca54e268d157b..33cbe4f70d590 100644 +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -594,6 +594,8 @@ struct igb_adapter { + struct igb_mac_addr *mac_table; + struct vf_mac_filter vf_macs; + struct vf_mac_filter *vf_mac_list; ++ /* lock for VF resources */ ++ spinlock_t vfs_lock; + }; + + /* flags controlling PTP/1588 function */ +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 9f45ecd9e8e5e..aacfa5fcdc408 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -3517,6 +3517,7 @@ static int igb_disable_sriov(struct pci_dev *pdev) + struct net_device *netdev = pci_get_drvdata(pdev); + struct igb_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + + /* reclaim resources allocated to VFs */ + if (adapter->vf_data) { +@@ -3529,12 +3530,13 @@ static int igb_disable_sriov(struct pci_dev *pdev) + pci_disable_sriov(pdev); + msleep(500); + } +- ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + kfree(adapter->vf_mac_list); + adapter->vf_mac_list = NULL; + kfree(adapter->vf_data); + adapter->vf_data = NULL; + adapter->vfs_allocated_count = 0; ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ); + wrfl(); + msleep(100); +@@ -3694,7 +3696,9 @@ static void igb_remove(struct pci_dev *pdev) + igb_release_hw_control(adapter); + + #ifdef CONFIG_PCI_IOV ++ rtnl_lock(); + igb_disable_sriov(pdev); ++ rtnl_unlock(); + #endif + + unregister_netdev(netdev); +@@ -3855,6 +3859,9 @@ static int igb_sw_init(struct igb_adapter *adapter) + + spin_lock_init(&adapter->nfc_lock); + spin_lock_init(&adapter->stats64_lock); ++ ++ /* init spinlock to avoid concurrency of VF resources */ ++ spin_lock_init(&adapter->vfs_lock); + #ifdef CONFIG_PCI_IOV + switch (hw->mac.type) { + case e1000_82576: +@@ -7601,8 +7608,10 @@ unlock: + static void igb_msg_task(struct igb_adapter *adapter) + { + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + u32 vf; + ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + for (vf = 0; vf < adapter->vfs_allocated_count; vf++) { + /* process any reset requests */ + if (!igb_check_for_rst(hw, vf)) +@@ -7616,6 +7625,7 @@ static void igb_msg_task(struct igb_adapter *adapter) + if (!igb_check_for_ack(hw, vf)) + igb_rcv_ack_from_vf(adapter, vf); + } ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + } + + /** +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index d79e177f89901..ec303d4d2d7a5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -95,7 +95,7 @@ struct page_pool; + #define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) + #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) + #define MLX5E_MAX_RQ_NUM_MTTS \ +- ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ ++ (ALIGN_DOWN(U16_MAX, 4) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ + #define MLX5E_ORDER2_MAX_PACKET_MTU (order_base_2(10 * 1024)) + #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW \ + (ilog2(MLX5E_MAX_RQ_NUM_MTTS / MLX5E_REQUIRED_WQE_MTTS)) +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 8c458c8f57a3b..a19e04f8bcc8f 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -799,8 +799,7 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, + use_cache = false; + } + +- fl6->flowlabel = ip6_make_flowinfo(RT_TOS(prio), +- info->key.label); ++ fl6->flowlabel = ip6_make_flowinfo(prio, info->key.label); + dst_cache = (struct dst_cache *)&info->dst_cache; + if (use_cache) { + dst = dst_cache_get_ip6(dst_cache, &fl6->saddr); +diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c +index 12f100392ed11..ca9042ddb6d71 100644 +--- a/drivers/net/netdevsim/bpf.c ++++ b/drivers/net/netdevsim/bpf.c +@@ -330,10 +330,12 @@ nsim_map_alloc_elem(struct bpf_offloaded_map *offmap, unsigned int idx) + { + struct nsim_bpf_bound_map *nmap = offmap->dev_priv; + +- nmap->entry[idx].key = kmalloc(offmap->map.key_size, GFP_USER); ++ nmap->entry[idx].key = kmalloc(offmap->map.key_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].key) + return -ENOMEM; +- nmap->entry[idx].value = kmalloc(offmap->map.value_size, GFP_USER); ++ nmap->entry[idx].value = kmalloc(offmap->map.value_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].value) { + kfree(nmap->entry[idx].key); + nmap->entry[idx].key = NULL; +@@ -475,7 +477,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) + if (offmap->map.map_flags) + return -EINVAL; + +- nmap = kzalloc(sizeof(*nmap), GFP_USER); ++ nmap = kzalloc(sizeof(*nmap), GFP_KERNEL_ACCOUNT); + if (!nmap) + return -ENOMEM; + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index efee7bacfd76a..cf6ff8732fb2c 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1706,7 +1706,7 @@ static const struct driver_info ax88179_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1719,7 +1719,7 @@ static const struct driver_info ax88178a_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1732,7 +1732,7 @@ static const struct driver_info cypress_GX3_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1745,7 +1745,7 @@ static const struct driver_info dlink_dub1312_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1758,7 +1758,7 @@ static const struct driver_info sitecom_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1771,7 +1771,7 @@ static const struct driver_info samsung_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1784,7 +1784,7 @@ static const struct driver_info lenovo_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1797,7 +1797,7 @@ static const struct driver_info belkin_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index e5c7a5c051090..1316f5b0c0d7e 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -845,13 +845,11 @@ int usbnet_stop (struct net_device *net) + + mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags); + +- /* deferred work (task, timer, softirq) must also stop. +- * can't flush_scheduled_work() until we drop rtnl (later), +- * else workers could deadlock; so make workers a NOP. +- */ ++ /* deferred work (timer, softirq, task) must also stop */ + dev->flags = 0; + del_timer_sync (&dev->delay); + tasklet_kill (&dev->bh); ++ cancel_work_sync(&dev->kevent); + if (!pm) + usb_autopm_put_interface(dev->intf); + +@@ -1614,8 +1612,6 @@ void usbnet_disconnect (struct usb_interface *intf) + net = dev->net; + unregister_netdev (net); + +- cancel_work_sync(&dev->kevent); +- + usb_scuttle_anchored_urbs(&dev->deferred); + + if (dev->driver_info->unbind) +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index 241e6f0e1dfe2..4489875fc87b0 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -879,13 +879,12 @@ static void ath10k_snoc_init_napi(struct ath10k *ar) + static int ath10k_snoc_request_irq(struct ath10k *ar) + { + struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar); +- int irqflags = IRQF_TRIGGER_RISING; + int ret, id; + + for (id = 0; id < CE_COUNT_MAX; id++) { + ret = request_irq(ar_snoc->ce_irqs[id].irq_line, +- ath10k_snoc_per_engine_handler, +- irqflags, ce_name[id], ar); ++ ath10k_snoc_per_engine_handler, 0, ++ ce_name[id], ar); + if (ret) { + ath10k_err(ar, + "failed to register IRQ handler for CE %d: %d", +diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h +index 9f64e32381f94..81107100e3682 100644 +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) + } + + #ifdef CONFIG_ATH9K_HTC_DEBUGFS +- +-#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +-#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) ++#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) ++#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) ++#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) ++#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) ++#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) + #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ + + #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index cb136d9d46214..49d5873309900 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -946,7 +946,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + priv->hw = hw; + priv->htc = htc_handle; + priv->dev = dev; +- htc_handle->drv_priv = priv; + SET_IEEE80211_DEV(hw, priv->dev); + + ret = ath9k_htc_wait_for_target(priv); +@@ -967,6 +966,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + if (ret) + goto err_init; + ++ htc_handle->drv_priv = priv; ++ + return 0; + + err_init: +diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c +index 55a809cb31054..3a46b319e9f10 100644 +--- a/drivers/net/wireless/ath/wil6210/debugfs.c ++++ b/drivers/net/wireless/ath/wil6210/debugfs.c +@@ -1002,20 +1002,14 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + void *cmd; + int cmdlen = len - sizeof(struct wmi_cmd_hdr); + u16 cmdid; +- int rc, rc1; ++ int rc1; + +- if (cmdlen < 0) ++ if (cmdlen < 0 || *ppos != 0) + return -EINVAL; + +- wmi = kmalloc(len, GFP_KERNEL); +- if (!wmi) +- return -ENOMEM; +- +- rc = simple_write_to_buffer(wmi, len, ppos, buf, len); +- if (rc < 0) { +- kfree(wmi); +- return rc; +- } ++ wmi = memdup_user(buf, len); ++ if (IS_ERR(wmi)) ++ return PTR_ERR(wmi); + + cmd = (cmdlen > 0) ? &wmi[1] : NULL; + cmdid = le16_to_cpu(wmi->command_id); +@@ -1025,7 +1019,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + + wil_info(wil, "0x%04x[%d] -> %d\n", cmdid, cmdlen, rc1); + +- return rc; ++ return len; + } + + static const struct file_operations fops_wmi = { +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +index 54ff83829afb1..f204e139e5f02 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +@@ -2422,7 +2422,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + /* Repeat initial/next rate. + * For legacy IL_NUMBER_TRY == 1, this loop will not execute. + * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */ +- while (repeat_rate > 0 && idx < LINK_QUAL_MAX_RETRY_NUM) { ++ while (repeat_rate > 0) { + if (is_legacy(tbl_type.lq_type)) { + if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) + ant_toggle_cnt++; +@@ -2441,6 +2441,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + cpu_to_le32(new_rate); + repeat_rate--; + idx++; ++ if (idx >= LINK_QUAL_MAX_RETRY_NUM) ++ goto out; + } + + il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, +@@ -2485,6 +2487,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + repeat_rate--; + } + ++out: + lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF; + lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF; + +diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c +index 1c6d428515a48..b15a1b99f28f7 100644 +--- a/drivers/net/wireless/intersil/p54/main.c ++++ b/drivers/net/wireless/intersil/p54/main.c +@@ -688,7 +688,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif, + * queues have already been stopped and no new frames can sneak + * up from behind. + */ +- while ((total = p54_flush_count(priv) && i--)) { ++ while ((total = p54_flush_count(priv)) && i--) { + /* waste time */ + msleep(20); + } +diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c +index e41bf042352ed..3dcfad5b61ff0 100644 +--- a/drivers/net/wireless/intersil/p54/p54spi.c ++++ b/drivers/net/wireless/intersil/p54/p54spi.c +@@ -177,7 +177,7 @@ static int p54spi_request_firmware(struct ieee80211_hw *dev) + + ret = p54_parse_firmware(dev, priv->firmware); + if (ret) { +- release_firmware(priv->firmware); ++ /* the firmware is released by the caller */ + return ret; + } + +@@ -672,6 +672,7 @@ static int p54spi_probe(struct spi_device *spi) + return 0; + + err_free_common: ++ release_firmware(priv->firmware); + free_irq(gpio_to_irq(p54spi_gpio_irq), spi); + err_free_gpio_irq: + gpio_free(p54spi_gpio_irq); +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 3d8e17bb8a101..7de92af2af029 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -552,7 +552,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- uintptr_t pending_cookie; ++ atomic_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1136,8 +1136,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw, + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- data->pending_cookie++; +- cookie = data->pending_cookie; ++ cookie = atomic_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -3120,6 +3119,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, + const u8 *src; + unsigned int hwsim_flags; + int i; ++ unsigned long flags; + bool found = false; + + if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] || +@@ -3144,18 +3144,20 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, + goto out; + + /* look for the skb matching the cookie passed back from user */ ++ spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { +- u64 skb_cookie; ++ uintptr_t skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { +- skb_unlink(skb, &data2->pending); ++ __skb_unlink(skb, &data2->pending); + found = true; + break; + } + } ++ spin_unlock_irqrestore(&data2->pending.lock, flags); + + /* not found */ + if (!found) +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index f29a154d995c8..d75763410cdc1 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -283,6 +283,7 @@ static int if_usb_probe(struct usb_interface *intf, + return 0; + + err_get_fw: ++ usb_put_dev(udev); + lbs_remove_card(priv); + err_add_card: + if_usb_reset_device(cardp); +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index 1b5abd4816ed7..203b888f38d8e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -114,6 +114,7 @@ static int mt76_led_init(struct mt76_dev *dev) + if (!of_property_read_u32(np, "led-sources", &led_pin)) + dev->led_pin = led_pin; + dev->led_al = of_property_read_bool(np, "led-active-low"); ++ of_node_put(np); + } + + return devm_led_classdev_register(dev->dev, &dev->led_cdev); +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 498994041bbcb..474439fc2da1f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -370,8 +370,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -381,8 +381,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + &h2c_data[4], &h2c_data[5], + &h2c_data[6], &h2c_data[7]); + +- if (h2c_len <= 0) +- return count; ++ if (h2c_len == 0) ++ return -EINVAL; + + for (i = 0; i < h2c_len; i++) + h2c_data_packed[i] = (u8)h2c_data[i]; +diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c +index 311d6ab8d0160..6301aa413c3b8 100644 +--- a/drivers/ntb/test/ntb_tool.c ++++ b/drivers/ntb/test/ntb_tool.c +@@ -367,14 +367,16 @@ static ssize_t tool_fn_write(struct tool_ctx *tc, + u64 bits; + int n; + ++ if (*offp) ++ return 0; ++ + buf = kmalloc(size + 1, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +- ret = simple_write_to_buffer(buf, size, offp, ubuf, size); +- if (ret < 0) { ++ if (copy_from_user(buf, ubuf, size)) { + kfree(buf); +- return ret; ++ return -EFAULT; + } + + buf[size] = 0; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 7cd38c9eaa020..f494e76faaa01 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4799,6 +4799,9 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, + /* Broadcom multi-function device */ + { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + { 0 } + }; +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index 415e913609945..70a3026304b63 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1455,8 +1455,10 @@ static int nmk_pinctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + + has_config = nmk_pinctrl_dt_get_config(np, &configs); + np_config = of_parse_phandle(np, "ste,config", 0); +- if (np_config) ++ if (np_config) { + has_config |= nmk_pinctrl_dt_get_config(np_config, &configs); ++ of_node_put(np_config); ++ } + if (has_config) { + const char *gpio_name; + const char *pin; +diff --git a/drivers/pinctrl/qcom/pinctrl-msm8916.c b/drivers/pinctrl/qcom/pinctrl-msm8916.c +index 20ebf244e80de..359f5b43bebc2 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm8916.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c +@@ -852,8 +852,8 @@ static const struct msm_pingroup msm8916_groups[] = { + PINGROUP(28, pwr_modem_enabled_a, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac), + PINGROUP(29, cci_i2c, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac), + PINGROUP(30, cci_i2c, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), +- PINGROUP(31, cci_timer0, NA, NA, NA, NA, NA, NA, NA, NA), +- PINGROUP(32, cci_timer1, NA, NA, NA, NA, NA, NA, NA, NA), ++ PINGROUP(31, cci_timer0, flash_strobe, NA, NA, NA, NA, NA, NA, NA), ++ PINGROUP(32, cci_timer1, flash_strobe, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(33, cci_async, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), + PINGROUP(34, pwr_nav_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), + PINGROUP(35, pwr_crypto_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), +diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c +index 374a8028fec77..b36a000ed969b 100644 +--- a/drivers/platform/olpc/olpc-ec.c ++++ b/drivers/platform/olpc/olpc-ec.c +@@ -170,7 +170,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf, + int i, m; + unsigned char ec_cmd[EC_MAX_CMD_ARGS]; + unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; +- char cmdbuf[64]; ++ char cmdbuf[64] = ""; + int ec_cmd_bytes; + + mutex_lock(&ec_dbgfs_lock); +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index b255590aef36e..b2bd7ee46c452 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -189,8 +189,12 @@ static void of_get_regulation_constraints(struct device_node *np, + } + + suspend_np = of_get_child_by_name(np, regulator_states[i]); +- if (!suspend_np || !suspend_state) ++ if (!suspend_np) + continue; ++ if (!suspend_state) { ++ of_node_put(suspend_np); ++ continue; ++ } + + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index 6cc0f9a5533e0..63726d8fb3320 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -415,6 +415,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + irq_handler_t thread_fn) + { + int ret; ++ int irq_number; + + ret = platform_get_irq_byname(pdev, name); + if (ret < 0 && optional) { +@@ -425,14 +426,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + return ret; + } + ++ irq_number = ret; ++ + ret = devm_request_threaded_irq(&pdev->dev, ret, + NULL, thread_fn, + IRQF_TRIGGER_RISING | IRQF_ONESHOT, + "wcnss", wcnss); +- if (ret) ++ if (ret) { + dev_err(&pdev->dev, "request %s IRQ failed\n", name); ++ return ret; ++ } + +- return ret; ++ /* Return the IRQ number if the IRQ was successfully acquired */ ++ return irq_number; + } + + static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index f23f10887d93c..f4f950c231d69 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1364,6 +1364,7 @@ static int qcom_smd_parse_edge(struct device *dev, + } + + edge->ipc_regmap = syscon_node_to_regmap(syscon_np); ++ of_node_put(syscon_np); + if (IS_ERR(edge->ipc_regmap)) { + ret = PTR_ERR(edge->ipc_regmap); + goto put_node; +diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c +index 76d3c50bf078b..ba8fc756264b1 100644 +--- a/drivers/s390/char/zcore.c ++++ b/drivers/s390/char/zcore.c +@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; + static struct dentry *zcore_hsa_file; + static struct ipl_parameter_block *ipl_block; + ++static DEFINE_MUTEX(hsa_buf_mutex); + static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); + + /* +@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; + bytes = min(PAGE_SIZE - offset, count); +- if (copy_to_user(dest, hsa_buf + offset, bytes)) ++ if (copy_to_user(dest, hsa_buf + offset, bytes)) { ++ mutex_unlock(&hsa_buf_mutex); + return -EFAULT; ++ } + src += bytes; + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; +@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index 7a06cdff6572d..862b0eb0fe6de 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -205,19 +205,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + if (work_pending(&sch->todo_work)) + goto out_unlock; + +- if (cio_update_schib(sch)) { +- vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); +- rc = 0; +- goto out_unlock; +- } +- +- private = dev_get_drvdata(&sch->dev); +- if (private->state == VFIO_CCW_STATE_NOT_OPER) { +- private->state = private->mdev ? VFIO_CCW_STATE_IDLE : +- VFIO_CCW_STATE_STANDBY; +- } + rc = 0; + ++ if (cio_update_schib(sch)) ++ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); ++ + out_unlock: + spin_unlock_irqrestore(sch->lock, flags); + +diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c +index 09ce175bbfcf6..dc87a6b84d739 100644 +--- a/drivers/s390/scsi/zfcp_fc.c ++++ b/drivers/s390/scsi/zfcp_fc.c +@@ -145,27 +145,33 @@ void zfcp_fc_enqueue_event(struct zfcp_adapter *adapter, + + static int zfcp_fc_wka_port_get(struct zfcp_fc_wka_port *wka_port) + { ++ int ret = -EIO; ++ + if (mutex_lock_interruptible(&wka_port->mutex)) + return -ERESTARTSYS; + + if (wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE || + wka_port->status == ZFCP_FC_WKA_PORT_CLOSING) { + wka_port->status = ZFCP_FC_WKA_PORT_OPENING; +- if (zfcp_fsf_open_wka_port(wka_port)) ++ if (zfcp_fsf_open_wka_port(wka_port)) { ++ /* could not even send request, nothing to wait for */ + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; ++ goto out; ++ } + } + +- mutex_unlock(&wka_port->mutex); +- +- wait_event(wka_port->completion_wq, ++ wait_event(wka_port->opened, + wka_port->status == ZFCP_FC_WKA_PORT_ONLINE || + wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE); + + if (wka_port->status == ZFCP_FC_WKA_PORT_ONLINE) { + atomic_inc(&wka_port->refcount); +- return 0; ++ ret = 0; ++ goto out; + } +- return -EIO; ++out: ++ mutex_unlock(&wka_port->mutex); ++ return ret; + } + + static void zfcp_fc_wka_port_offline(struct work_struct *work) +@@ -181,9 +187,12 @@ static void zfcp_fc_wka_port_offline(struct work_struct *work) + + wka_port->status = ZFCP_FC_WKA_PORT_CLOSING; + if (zfcp_fsf_close_wka_port(wka_port)) { ++ /* could not even send request, nothing to wait for */ + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; +- wake_up(&wka_port->completion_wq); ++ goto out; + } ++ wait_event(wka_port->closed, ++ wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE); + out: + mutex_unlock(&wka_port->mutex); + } +@@ -193,13 +202,15 @@ static void zfcp_fc_wka_port_put(struct zfcp_fc_wka_port *wka_port) + if (atomic_dec_return(&wka_port->refcount) != 0) + return; + /* wait 10 milliseconds, other reqs might pop in */ +- schedule_delayed_work(&wka_port->work, HZ / 100); ++ queue_delayed_work(wka_port->adapter->work_queue, &wka_port->work, ++ msecs_to_jiffies(10)); + } + + static void zfcp_fc_wka_port_init(struct zfcp_fc_wka_port *wka_port, u32 d_id, + struct zfcp_adapter *adapter) + { +- init_waitqueue_head(&wka_port->completion_wq); ++ init_waitqueue_head(&wka_port->opened); ++ init_waitqueue_head(&wka_port->closed); + + wka_port->adapter = adapter; + wka_port->d_id = d_id; +diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h +index 3cd74729cfb98..9bfce7ff65952 100644 +--- a/drivers/s390/scsi/zfcp_fc.h ++++ b/drivers/s390/scsi/zfcp_fc.h +@@ -170,7 +170,8 @@ enum zfcp_fc_wka_status { + /** + * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC port + * @adapter: Pointer to adapter structure this WKA port belongs to +- * @completion_wq: Wait for completion of open/close command ++ * @opened: Wait for completion of open command ++ * @closed: Wait for completion of close command + * @status: Current status of WKA port + * @refcount: Reference count to keep port open as long as it is in use + * @d_id: FC destination id or well-known-address +@@ -180,7 +181,8 @@ enum zfcp_fc_wka_status { + */ + struct zfcp_fc_wka_port { + struct zfcp_adapter *adapter; +- wait_queue_head_t completion_wq; ++ wait_queue_head_t opened; ++ wait_queue_head_t closed; + enum zfcp_fc_wka_status status; + atomic_t refcount; + u32 d_id; +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index 5bb278a604ed2..eae9804f695df 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -1592,7 +1592,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req) + wka_port->status = ZFCP_FC_WKA_PORT_ONLINE; + } + out: +- wake_up(&wka_port->completion_wq); ++ wake_up(&wka_port->opened); + } + + /** +@@ -1650,7 +1650,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req) + } + + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; +- wake_up(&wka_port->completion_wq); ++ wake_up(&wka_port->closed); + } + + /** +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 6bb45ae19d587..339582690482a 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -195,7 +195,7 @@ static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size); + static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp); + static Sg_fd *sg_add_sfp(Sg_device * sdp); + static void sg_remove_sfp(struct kref *); +-static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); ++static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy); + static Sg_request *sg_add_request(Sg_fd * sfp); + static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); + static Sg_device *sg_get_dev(int dev); +@@ -417,6 +417,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + Sg_fd *sfp; + Sg_request *srp; + int req_pack_id = -1; ++ bool busy; + sg_io_hdr_t *hp; + struct sg_header *old_hdr = NULL; + int retval = 0; +@@ -464,25 +465,19 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + } else + req_pack_id = old_hdr->pack_id; + } +- srp = sg_get_rq_mark(sfp, req_pack_id); ++ srp = sg_get_rq_mark(sfp, req_pack_id, &busy); + if (!srp) { /* now wait on packet to arrive */ +- if (atomic_read(&sdp->detaching)) { +- retval = -ENODEV; +- goto free_old_hdr; +- } + if (filp->f_flags & O_NONBLOCK) { + retval = -EAGAIN; + goto free_old_hdr; + } + retval = wait_event_interruptible(sfp->read_wait, +- (atomic_read(&sdp->detaching) || +- (srp = sg_get_rq_mark(sfp, req_pack_id)))); +- if (atomic_read(&sdp->detaching)) { +- retval = -ENODEV; +- goto free_old_hdr; +- } +- if (retval) { +- /* -ERESTARTSYS as signal hit process */ ++ ((srp = sg_get_rq_mark(sfp, req_pack_id, &busy)) || ++ (!busy && atomic_read(&sdp->detaching)))); ++ if (!srp) { ++ /* signal or detaching */ ++ if (!retval) ++ retval = -ENODEV; + goto free_old_hdr; + } + } +@@ -933,9 +928,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) + if (result < 0) + return result; + result = wait_event_interruptible(sfp->read_wait, +- (srp_done(sfp, srp) || atomic_read(&sdp->detaching))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; ++ srp_done(sfp, srp)); + write_lock_irq(&sfp->rq_list_lock); + if (srp->done) { + srp->done = 2; +@@ -2079,19 +2072,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp) + } + + static Sg_request * +-sg_get_rq_mark(Sg_fd * sfp, int pack_id) ++sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy) + { + Sg_request *resp; + unsigned long iflags; + ++ *busy = false; + write_lock_irqsave(&sfp->rq_list_lock, iflags); + list_for_each_entry(resp, &sfp->rq_list, entry) { +- /* look for requests that are ready + not SG_IO owned */ +- if ((1 == resp->done) && (!resp->sg_io_owned) && ++ /* look for requests that are not SG_IO owned */ ++ if ((!resp->sg_io_owned) && + ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { +- resp->done = 2; /* guard against other readers */ +- write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +- return resp; ++ switch (resp->done) { ++ case 0: /* request active */ ++ *busy = true; ++ break; ++ case 1: /* request done; response ready to return */ ++ resp->done = 2; /* guard against other readers */ ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ return resp; ++ case 2: /* response already being returned */ ++ break; ++ } + } + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +@@ -2145,6 +2147,15 @@ sg_remove_request(Sg_fd * sfp, Sg_request * srp) + res = 1; + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ ++ /* ++ * If the device is detaching, wakeup any readers in case we just ++ * removed the last response, which would leave nothing for them to ++ * return other than -ENODEV. ++ */ ++ if (unlikely(atomic_read(&sfp->parentdp->detaching))) ++ wake_up_interruptible_all(&sfp->read_wait); ++ + return res; + } + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 98f2d076f938f..b86cc0342ae3f 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -4638,10 +4638,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request( + } + + switch (scmd->sc_data_direction) { +- case DMA_TO_DEVICE: ++ case DMA_FROM_DEVICE: + request->data_direction = SOP_READ_FLAG; + break; +- case DMA_FROM_DEVICE: ++ case DMA_TO_DEVICE: + request->data_direction = SOP_WRITE_FLAG; + break; + case DMA_NONE: +diff --git a/drivers/soc/amlogic/meson-mx-socinfo.c b/drivers/soc/amlogic/meson-mx-socinfo.c +index 78f0f1aeca578..92125dd65f338 100644 +--- a/drivers/soc/amlogic/meson-mx-socinfo.c ++++ b/drivers/soc/amlogic/meson-mx-socinfo.c +@@ -126,6 +126,7 @@ static int __init meson_mx_socinfo_init(void) + np = of_find_matching_node(NULL, meson_mx_socinfo_analog_top_ids); + if (np) { + analog_top_regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(analog_top_regmap)) + return PTR_ERR(analog_top_regmap); + +diff --git a/drivers/soc/fsl/guts.c b/drivers/soc/fsl/guts.c +index 302e0c8d69d93..6693c32e74478 100644 +--- a/drivers/soc/fsl/guts.c ++++ b/drivers/soc/fsl/guts.c +@@ -136,7 +136,7 @@ static int fsl_guts_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct resource *res; + const struct fsl_soc_die_attr *soc_die; +- const char *machine; ++ const char *machine = NULL; + u32 svr; + + /* Initialize guts */ +diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c +index 283b2832728ee..414621f3c43cd 100644 +--- a/drivers/soundwire/bus_type.c ++++ b/drivers/soundwire/bus_type.c +@@ -154,12 +154,8 @@ int __sdw_register_driver(struct sdw_driver *drv, struct module *owner) + + drv->driver.owner = owner; + drv->driver.probe = sdw_drv_probe; +- +- if (drv->remove) +- drv->driver.remove = sdw_drv_remove; +- +- if (drv->shutdown) +- drv->driver.shutdown = sdw_drv_shutdown; ++ drv->driver.remove = sdw_drv_remove; ++ drv->driver.shutdown = sdw_drv_shutdown; + + return driver_register(&drv->driver); + } +diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h +index 94a1489940697..2c3b333041731 100644 +--- a/drivers/staging/rtl8192u/r8192U.h ++++ b/drivers/staging/rtl8192u/r8192U.h +@@ -1000,7 +1000,7 @@ typedef struct r8192_priv { + bool bis_any_nonbepkts; + bool bcurrent_turbo_EDCA; + bool bis_cur_rdlstate; +- struct timer_list fsync_timer; ++ struct delayed_work fsync_work; + bool bfsync_processing; /* 500ms Fsync timer is active or not */ + u32 rate_record; + u32 rateCountDiffRecord; +diff --git a/drivers/staging/rtl8192u/r8192U_dm.c b/drivers/staging/rtl8192u/r8192U_dm.c +index 5fb5f583f7038..c24a291895451 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.c ++++ b/drivers/staging/rtl8192u/r8192U_dm.c +@@ -2627,19 +2627,20 @@ static void dm_init_fsync(struct net_device *dev) + priv->ieee80211->fsync_seconddiff_ratethreshold = 200; + priv->ieee80211->fsync_state = Default_Fsync; + priv->framesyncMonitor = 1; /* current default 0xc38 monitor on */ +- timer_setup(&priv->fsync_timer, dm_fsync_timer_callback, 0); ++ INIT_DELAYED_WORK(&priv->fsync_work, dm_fsync_work_callback); + } + + static void dm_deInit_fsync(struct net_device *dev) + { + struct r8192_priv *priv = ieee80211_priv(dev); + +- del_timer_sync(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); + } + +-void dm_fsync_timer_callback(struct timer_list *t) ++void dm_fsync_work_callback(struct work_struct *work) + { +- struct r8192_priv *priv = from_timer(priv, t, fsync_timer); ++ struct r8192_priv *priv = ++ container_of(work, struct r8192_priv, fsync_work.work); + struct net_device *dev = priv->ieee80211->dev; + u32 rate_index, rate_count = 0, rate_count_diff = 0; + bool bSwitchFromCountDiff = false; +@@ -2706,17 +2707,16 @@ void dm_fsync_timer_callback(struct timer_list *t) + } + } + if (bDoubleTimeInterval) { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval*priv->ieee80211->fsync_multiple_timeinterval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval * ++ priv->ieee80211->fsync_multiple_timeinterval)); + } else { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval)); + } + } else { + /* Let Register return to default value; */ +@@ -2744,7 +2744,7 @@ static void dm_EndSWFsync(struct net_device *dev) + struct r8192_priv *priv = ieee80211_priv(dev); + + RT_TRACE(COMP_HALDM, "%s\n", __func__); +- del_timer_sync(&(priv->fsync_timer)); ++ cancel_delayed_work_sync(&priv->fsync_work); + + /* Let Register return to default value; */ + if (priv->bswitch_fsync) { +@@ -2786,11 +2786,9 @@ static void dm_StartSWFsync(struct net_device *dev) + if (priv->ieee80211->fsync_rate_bitmap & rateBitmap) + priv->rate_record += priv->stats.received_rate_histogram[1][rateIndex]; + } +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv->ieee80211->fsync_time_interval)); + + write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cd); + +diff --git a/drivers/staging/rtl8192u/r8192U_dm.h b/drivers/staging/rtl8192u/r8192U_dm.h +index 0de0332906bd3..eeb03130de150 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.h ++++ b/drivers/staging/rtl8192u/r8192U_dm.h +@@ -167,7 +167,7 @@ void dm_force_tx_fw_info(struct net_device *dev, + void dm_init_edca_turbo(struct net_device *dev); + void dm_rf_operation_test_callback(unsigned long data); + void dm_rf_pathcheck_workitemcallback(struct work_struct *work); +-void dm_fsync_timer_callback(struct timer_list *t); ++void dm_fsync_work_callback(struct work_struct *work); + void dm_cck_txpower_adjust(struct net_device *dev, bool binch14); + void dm_shadow_init(struct net_device *dev); + void dm_initialize_txpower_tracking(struct net_device *dev); +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index d42fc2ae8592e..e568cb4b2ffcf 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -175,6 +175,10 @@ tee_ioctl_shm_register(struct tee_context *ctx, + if (data.flags) + return -EINVAL; + ++ if (!access_ok(VERIFY_WRITE, (void __user *)(unsigned long)data.addr, ++ data.length)) ++ return -EFAULT; ++ + shm = tee_shm_register(ctx, data.addr, data.length, + TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED); + if (IS_ERR(shm)) +diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c +index 4dce4a8f71ed9..17b2361bc8f21 100644 +--- a/drivers/thermal/thermal_sysfs.c ++++ b/drivers/thermal/thermal_sysfs.c +@@ -909,12 +909,13 @@ static const struct attribute_group cooling_device_stats_attr_group = { + + static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + { ++ const struct attribute_group *stats_attr_group = NULL; + struct cooling_dev_stats *stats; + unsigned long states; + int var; + + if (cdev->ops->get_max_state(cdev, &states)) +- return; ++ goto out; + + states++; /* Total number of states is highest state + 1 */ + +@@ -924,7 +925,7 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + + stats = kzalloc(var, GFP_KERNEL); + if (!stats) +- return; ++ goto out; + + stats->time_in_state = (ktime_t *)(stats + 1); + stats->trans_table = (unsigned int *)(stats->time_in_state + states); +@@ -934,9 +935,12 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + + spin_lock_init(&stats->lock); + ++ stats_attr_group = &cooling_device_stats_attr_group; ++ ++out: + /* Fill the empty slot left in cooling_device_attr_groups */ + var = ARRAY_SIZE(cooling_device_attr_groups) - 2; +- cooling_device_attr_groups[var] = &cooling_device_stats_attr_group; ++ cooling_device_attr_groups[var] = stats_attr_group; + } + + static void cooling_device_stats_destroy(struct thermal_cooling_device *cdev) +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 5d2bb4d95186f..f6d2be13b32ee 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -410,6 +410,27 @@ static int gsm_read_ea(unsigned int *val, u8 c) + return c & EA; + } + ++/** ++ * gsm_read_ea_val - read a value until EA ++ * @val: variable holding value ++ * @data: buffer of data ++ * @dlen: length of data ++ * ++ * Processes an EA value. Updates the passed variable and ++ * returns the processed data length. ++ */ ++static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int dlen) ++{ ++ unsigned int len = 0; ++ ++ for (; dlen > 0; dlen--) { ++ len++; ++ if (gsm_read_ea(val, *data++)) ++ break; ++ } ++ return len; ++} ++ + /** + * gsm_encode_modem - encode modem data bits + * @dlci: DLCI to encode from +@@ -657,6 +678,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len, + return m; + } + ++/** ++ * gsm_is_flow_ctrl_msg - checks if flow control message ++ * @msg: message to check ++ * ++ * Returns true if the given message is a flow control command of the ++ * control channel. False is returned in any other case. ++ */ ++static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg) ++{ ++ unsigned int cmd; ++ ++ if (msg->addr > 0) ++ return false; ++ ++ switch (msg->ctrl & ~PF) { ++ case UI: ++ case UIH: ++ cmd = 0; ++ if (gsm_read_ea_val(&cmd, msg->data + 2, msg->len - 2) < 1) ++ break; ++ switch (cmd & ~PF) { ++ case CMD_FCOFF: ++ case CMD_FCON: ++ return true; ++ } ++ break; ++ } ++ ++ return false; ++} ++ + /** + * gsm_data_kick - poke the queue + * @gsm: GSM Mux +@@ -675,7 +727,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci) + int len; + + list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { +- if (gsm->constipated && msg->addr) ++ if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg)) + continue; + if (gsm->encoding != 0) { + gsm->txframe[0] = GSM1_SOF; +@@ -1330,7 +1382,7 @@ static void gsm_control_retransmit(struct timer_list *t) + spin_lock_irqsave(&gsm->control_lock, flags); + ctrl = gsm->pending_cmd; + if (ctrl) { +- if (gsm->cretries == 0) { ++ if (gsm->cretries == 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) { + gsm->pending_cmd = NULL; + ctrl->error = -ETIMEDOUT; + ctrl->done = 1; +@@ -1482,8 +1534,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + switch (dlci->state) { + case DLCI_OPENING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else if (!dlci->addr && gsm->control == (DM | PF)) { +@@ -1498,8 +1550,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + break; + case DLCI_CLOSING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, DISC|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else +@@ -1840,7 +1892,7 @@ static void gsm_queue(struct gsm_mux *gsm) + goto invalid; + #endif + if (dlci == NULL || dlci->state != DLCI_OPEN) { +- gsm_command(gsm, address, DM|PF); ++ gsm_response(gsm, address, DM|PF); + return; + } + dlci->data(dlci, gsm->buf, gsm->len); +@@ -2467,11 +2519,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file, + static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, + const unsigned char *buf, size_t nr) + { +- int space = tty_write_room(tty); ++ struct gsm_mux *gsm = tty->disc_data; ++ unsigned long flags; ++ int space; ++ int ret; ++ ++ if (!gsm) ++ return -ENODEV; ++ ++ ret = -ENOBUFS; ++ spin_lock_irqsave(&gsm->tx_lock, flags); ++ space = tty_write_room(tty); + if (space >= nr) +- return tty->ops->write(tty, buf, nr); +- set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); +- return -ENOBUFS; ++ ret = tty->ops->write(tty, buf, nr); ++ else ++ set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); ++ spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ ++ return ret; + } + + /** +@@ -2496,12 +2561,15 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file, + + poll_wait(file, &tty->read_wait, wait); + poll_wait(file, &tty->write_wait, wait); ++ ++ if (gsm->dead) ++ mask |= EPOLLHUP; + if (tty_hung_up_p(file)) + mask |= EPOLLHUP; ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) ++ mask |= EPOLLHUP; + if (!tty_is_writelocked(tty) && tty_write_room(tty) > 0) + mask |= EPOLLOUT | EPOLLWRNORM; +- if (gsm->dead) +- mask |= EPOLLHUP; + return mask; + } + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index c73d0eddd9b8d..cc9d1f416db84 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -140,12 +140,15 @@ static void dw8250_check_lcr(struct uart_port *p, int value) + /* Returns once the transmitter is empty or we run out of retries */ + static void dw8250_tx_wait_empty(struct uart_port *p) + { ++ struct uart_8250_port *up = up_to_u8250p(p); + unsigned int tries = 20000; + unsigned int delay_threshold = tries - 1000; + unsigned int lsr; + + while (tries--) { + lsr = readb (p->membase + (UART_LSR << p->regshift)); ++ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; ++ + if (lsr & UART_LSR_TEMT) + break; + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 6449c156c4d67..70f74ebc25dc3 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -237,6 +237,7 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status) + struct tty_port *tport = &port->state->port; + unsigned char ch = 0; + char flag = 0; ++ int ret; + + do { + if (status & STAT_RX_RDY(port)) { +@@ -249,6 +250,16 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status) + port->icount.parity++; + } + ++ /* ++ * For UART2, error bits are not cleared on buffer read. ++ * This causes interrupt loop and system hang. ++ */ ++ if (IS_EXTENDED(port) && (status & STAT_BRK_ERR)) { ++ ret = readl(port->membase + UART_STAT); ++ ret |= STAT_BRK_ERR; ++ writel(ret, port->membase + UART_STAT); ++ } ++ + if (status & STAT_BRK_DET) { + port->icount.brk++; + status &= ~(STAT_FRM_ERR | STAT_PAR_ERR); +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index 2b6376e6e5ad4..eb0d3f55235ad 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -1141,6 +1141,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l) + /* No compatible property, so try the name. */ + soc_string = np->name; + ++ of_node_put(np); ++ + /* Extract the SOC number from the "PowerPC," string */ + if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc) + return 0; +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 20565603a3658..198bf54568cc4 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -351,7 +351,7 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows) + /* allocate everything in one go */ + memsize = cols * rows * sizeof(char32_t); + memsize += rows * sizeof(char32_t *); +- p = vmalloc(memsize); ++ p = vzalloc(memsize); + if (!p) + return NULL; + +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index df661460e9f96..59d5d506d73c4 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1805,7 +1805,6 @@ static void usb_giveback_urb_bh(unsigned long param) + + spin_lock_irq(&bh->lock); + bh->running = true; +- restart: + list_replace_init(&bh->head, &local_list); + spin_unlock_irq(&bh->lock); + +@@ -1819,10 +1818,17 @@ static void usb_giveback_urb_bh(unsigned long param) + bh->completing_ep = NULL; + } + +- /* check if there are new URBs to giveback */ ++ /* ++ * giveback new URBs next time to prevent this function ++ * from not exiting for a long time. ++ */ + spin_lock_irq(&bh->lock); +- if (!list_empty(&bh->head)) +- goto restart; ++ if (!list_empty(&bh->head)) { ++ if (bh->high_prio) ++ tasklet_hi_schedule(&bh->bh); ++ else ++ tasklet_schedule(&bh->bh); ++ } + bh->running = false; + spin_unlock_irq(&bh->lock); + } +@@ -1847,7 +1853,7 @@ static void usb_giveback_urb_bh(unsigned long param) + void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + { + struct giveback_urb_bh *bh; +- bool running, high_prio_bh; ++ bool running; + + /* pass status to tasklet via unlinked */ + if (likely(!urb->unlinked)) +@@ -1858,13 +1864,10 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + return; + } + +- if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) { ++ if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) + bh = &hcd->high_prio_bh; +- high_prio_bh = true; +- } else { ++ else + bh = &hcd->low_prio_bh; +- high_prio_bh = false; +- } + + spin_lock(&bh->lock); + list_add_tail(&urb->urb_list, &bh->head); +@@ -1873,7 +1876,7 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + + if (running) + ; +- else if (high_prio_bh) ++ else if (bh->high_prio) + tasklet_hi_schedule(&bh->bh); + else + tasklet_schedule(&bh->bh); +@@ -2881,6 +2884,7 @@ int usb_add_hcd(struct usb_hcd *hcd, + + /* initialize tasklets */ + init_giveback_urb_bh(&hcd->high_prio_bh); ++ hcd->high_prio_bh.high_prio = true; + init_giveback_urb_bh(&hcd->low_prio_bh); + + /* enable irqs just before we start the controller, +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 3ebcbd199a791..b0a2b8805f41d 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -361,6 +361,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) + spin_unlock_irq (&epdata->dev->lock); + + DBG (epdata->dev, "endpoint gone\n"); ++ wait_for_completion(&done); + epdata->status = -ENODEV; + } + } +diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig +index d83d93c6ef9e2..33b5648b2819b 100644 +--- a/drivers/usb/gadget/udc/Kconfig ++++ b/drivers/usb/gadget/udc/Kconfig +@@ -309,7 +309,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig" + + config USB_AMD5536UDC + tristate "AMD5536 UDC" +- depends on USB_PCI ++ depends on USB_PCI && HAS_DMA + select USB_SNP_CORE + help + The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge. +diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c +index 576f7d79ad4ef..d1dc644b215c7 100644 +--- a/drivers/usb/host/ehci-ppc-of.c ++++ b/drivers/usb/host/ehci-ppc-of.c +@@ -148,6 +148,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device *op) + } else { + ehci->has_amcc_usb23 = 1; + } ++ of_node_put(np); + } + + if (of_get_property(dn, "big-endian", NULL)) { +diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c +index f5f532601092a..a964a93ff35b5 100644 +--- a/drivers/usb/host/ohci-nxp.c ++++ b/drivers/usb/host/ohci-nxp.c +@@ -153,6 +153,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) + } + + isp1301_i2c_client = isp1301_get_client(isp1301_node); ++ of_node_put(isp1301_node); + if (!isp1301_i2c_client) + return -EPROBE_DEFER; + +diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c +index 76a9b40b08f15..96c5c7655283d 100644 +--- a/drivers/usb/host/ohci-ppc-of.c ++++ b/drivers/usb/host/ohci-ppc-of.c +@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) + release_mem_region(res.start, 0x4); + } else + pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); ++ of_node_put(np); + } + + irq_dispose_mapping(irq); +diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c +index 5b287257ec11c..04eeaf6a028a4 100644 +--- a/drivers/usb/renesas_usbhs/rza.c ++++ b/drivers/usb/renesas_usbhs/rza.c +@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) + extal_clk = of_find_node_by_name(NULL, "extal"); + of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb); + of_property_read_u32(extal_clk, "clock-frequency", &freq_extal); ++ ++ of_node_put(usb_x1_clk); ++ of_node_put(extal_clk); ++ + if (freq_usb == 0) { + if (freq_extal == 12000000) { + /* Select 12MHz XTAL */ +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index a43263a0edd88..891e52bc5002c 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -757,7 +757,8 @@ static void sierra_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index b1f0aa12ba39c..eb4f206511867 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -251,7 +251,7 @@ static int serial_open(struct tty_struct *tty, struct file *filp) + * + * Shut down a USB serial port. Serialized against activate by the + * tport mutex and kept to matching open/close pairs +- * of calls by the initialized flag. ++ * of calls by the tty-port initialized flag. + * + * Not called if tty is console. + */ +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 997ff88ec04b6..2ebf0842fa430 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -463,7 +463,8 @@ void usb_wwan_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 7a386fb30bf1f..0d146b45e0b4e 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1808,6 +1808,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, + buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL); + if (!buf) { + kfree(caps->buf); ++ caps->buf = NULL; + caps->size = 0; + return ERR_PTR(-ENOMEM); + } +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 549f78e77255c..81f64ef6fa4c2 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -772,8 +772,10 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + return -ENODEV; + + panel = of_graph_get_remote_port_parent(endpoint); +- if (!panel) +- return -ENODEV; ++ if (!panel) { ++ err = -ENODEV; ++ goto out_endpoint_put; ++ } + + if (fb->vendor->init_panel) { + err = fb->vendor->init_panel(fb, panel); +@@ -783,11 +785,11 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + + err = clcdfb_of_get_backlight(panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = clcdfb_of_get_mode(&fb->dev->dev, panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth", + &max_bandwidth); +@@ -816,11 +818,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + + if (of_property_read_u32_array(endpoint, + "arm,pl11x,tft-r0g0b0-pads", +- tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) +- return -ENOENT; ++ tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) { ++ err = -ENOENT; ++ goto out_panel_put; ++ } ++ ++ of_node_put(panel); ++ of_node_put(endpoint); + + return clcdfb_of_init_tft_panel(fb, tft_r0b0g0[0], + tft_r0b0g0[1], tft_r0b0g0[2]); ++out_panel_put: ++ of_node_put(panel); ++out_endpoint_put: ++ of_node_put(endpoint); ++ return err; + } + + static int clcdfb_of_vram_setup(struct clcd_fb *fb) +diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c +index 13ba371e70aa3..f7920987dd248 100644 +--- a/drivers/video/fbdev/arkfb.c ++++ b/drivers/video/fbdev/arkfb.c +@@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info) + return -EINVAL; + } + +- ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); ++ value = (hdiv * info->var.pixclock) / hmul; ++ if (!value) { ++ fb_dbg(info, "invalid pixclock\n"); ++ value = 1; ++ } ++ ark_set_pixclock(info, value); + svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul, hdiv, + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, + (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1, +@@ -789,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info) + value = ((value * hmul / hdiv) / 8) - 5; + vga_wcrt(par->state.vgabase, 0x42, (value + 1) / 2); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 17ed20a73c2db..417f4bcc1182c 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -103,8 +103,8 @@ static int logo_lines; + enums. */ + static int logo_shown = FBCON_LOGO_CANSHOW; + /* console mappings */ +-static int first_fb_vc; +-static int last_fb_vc = MAX_NR_CONSOLES - 1; ++static unsigned int first_fb_vc; ++static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1; + static int fbcon_is_default = 1; + static int fbcon_has_exited; + static int primary_device = -1; +@@ -456,10 +456,12 @@ static int __init fb_console_setup(char *this_opt) + options += 3; + if (*options) + first_fb_vc = simple_strtoul(options, &options, 10) - 1; +- if (first_fb_vc < 0) ++ if (first_fb_vc >= MAX_NR_CONSOLES) + first_fb_vc = 0; + if (*options++ == '-') + last_fb_vc = simple_strtoul(options, &options, 10) - 1; ++ if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES) ++ last_fb_vc = MAX_NR_CONSOLES - 1; + fbcon_is_default = 0; + continue; + } +diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c +index f6d7b04d6dffa..bdbafff4529f7 100644 +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -399,7 +399,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + u32 xres, right, hslen, left, xtotal; + u32 yres, lower, vslen, upper, ytotal; + u32 vxres, xoffset, vyres, yoffset; +- u32 bpp, base, dacspeed24, mem; ++ u32 bpp, base, dacspeed24, mem, freq; + u8 r7; + int i; + +@@ -642,7 +642,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + par->atc[VGA_ATC_OVERSCAN] = 0; + + /* Calculate VCLK that most closely matches the requested dot clock */ +- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); ++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3); ++ if (freq < I740_RFREQ_FIX) { ++ fb_dbg(info, "invalid pixclock\n"); ++ freq = I740_RFREQ_FIX; ++ } ++ i740_calc_vclk(freq, par); + + /* Since we program the clocks ourselves, always use VCLK2. */ + par->misc |= 0x0C; +diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c +index d63f23e26f7d7..b17b806b41878 100644 +--- a/drivers/video/fbdev/s3fb.c ++++ b/drivers/video/fbdev/s3fb.c +@@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info) + value = clamp((htotal + hsstart + 1) / 2 + 2, hsstart + 4, htotal + 1); + svga_wcrt_multi(par->state.vgabase, s3_dtpc_regs, value); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c +index fde27feae5d0c..d6b2ce95a8594 100644 +--- a/drivers/video/fbdev/sis/init.c ++++ b/drivers/video/fbdev/sis/init.c +@@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay, + } + break; + case 400: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDwidth >= 600))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDheight >= 600))) { + if(VDisplay == 300) ModeIndex = ModeIndex_400x300[Depth]; + } + break; + case 512: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDwidth >= 768))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDheight >= 768))) { + if(VDisplay == 384) ModeIndex = ModeIndex_512x384[Depth]; + } + break; +diff --git a/drivers/video/fbdev/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c +index 5cac871db3ee2..cbae9c5100927 100644 +--- a/drivers/video/fbdev/vt8623fb.c ++++ b/drivers/video/fbdev/vt8623fb.c +@@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info) + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, 1, + 1, info->node); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + + /* Device and screen back on */ +diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c +index 94e055ee7ad66..aa65b20883ef7 100644 +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -341,8 +341,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + goto err_vbg_core_exit; + } + +- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, +- DEVICE_NAME, gdev); ++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME, ++ gdev); + if (ret) { + vbg_err("vboxguest: Error requesting irq: %d\n", ret); + goto err_vbg_core_exit; +@@ -352,7 +352,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + vbg_err("vboxguest: Error misc_register %s failed: %d\n", + DEVICE_NAME, ret); +- goto err_vbg_core_exit; ++ goto err_free_irq; + } + + ret = misc_register(&gdev->misc_device_user); +@@ -388,6 +388,8 @@ err_unregister_misc_device_user: + misc_deregister(&gdev->misc_device_user); + err_unregister_misc_device: + misc_deregister(&gdev->misc_device); ++err_free_irq: ++ free_irq(pci->irq, gdev); + err_vbg_core_exit: + vbg_core_exit(gdev); + err_disable_pcidev: +@@ -404,6 +406,7 @@ static void vbg_pci_remove(struct pci_dev *pci) + vbg_gdev = NULL; + mutex_unlock(&vbg_gdev_mutex); + ++ free_irq(pci->irq, gdev); + device_remove_file(gdev->dev, &dev_attr_host_features); + device_remove_file(gdev->dev, &dev_attr_host_version); + misc_deregister(&gdev->misc_device_user); +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 454c6826abdb4..1c1dadfd4e4d7 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -128,7 +128,7 @@ static ssize_t xenbus_file_read(struct file *filp, + { + struct xenbus_file_priv *u = filp->private_data; + struct read_buffer *rb; +- unsigned i; ++ ssize_t i; + int ret; + + mutex_lock(&u->reply_mutex); +@@ -148,7 +148,7 @@ again: + rb = list_entry(u->read_buffers.next, struct read_buffer, list); + i = 0; + while (i < len) { +- unsigned sz = min((unsigned)len - i, rb->len - rb->cons); ++ size_t sz = min_t(size_t, len - i, rb->len - rb->cons); + + ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz); + +diff --git a/fs/attr.c b/fs/attr.c +index d22e8187477fa..4d2541c1e68c3 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -134,6 +134,8 @@ EXPORT_SYMBOL(setattr_prepare); + */ + int inode_newsize_ok(const struct inode *inode, loff_t offset) + { ++ if (offset < 0) ++ return -EINVAL; + if (inode->i_size < offset) { + unsigned long limit; + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index c9fd018dcf764..98f87cc474332 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2920,6 +2920,20 @@ int open_ctree(struct super_block *sb, + err = -EINVAL; + goto fail_alloc; + } ++ /* ++ * We have unsupported RO compat features, although RO mounted, we ++ * should not cause any metadata write, including log replay. ++ * Or we could screw up whatever the new feature requires. ++ */ ++ if (unlikely(features && btrfs_super_log_root(disk_super) && ++ !btrfs_test_opt(fs_info, NOLOGREPLAY))) { ++ btrfs_err(fs_info, ++"cannot replay dirty log with unsupported compat_ro features (0x%llx), try rescue=nologreplay", ++ features); ++ err = -EINVAL; ++ goto fail_alloc; ++ } ++ + + ret = btrfs_init_workqueues(fs_info, fs_devices); + if (ret) { +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index a91f74cf5cd18..0ce7ab8f875a4 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -318,6 +318,9 @@ static void merge_rbio(struct btrfs_raid_bio *dest, + { + bio_list_merge(&dest->bio_list, &victim->bio_list); + dest->bio_list_bytes += victim->bio_list_bytes; ++ /* Also inherit the bitmaps from @victim. */ ++ bitmap_or(dest->dbitmap, victim->dbitmap, dest->dbitmap, ++ dest->stripe_npages); + dest->generic_bio_cnt += victim->generic_bio_cnt; + bio_list_init(&victim->bio_list); + } +@@ -862,6 +865,12 @@ static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err) + + if (rbio->generic_bio_cnt) + btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt); ++ /* ++ * Clear the data bitmap, as the rbio may be cached for later usage. ++ * do this before before unlock_stripe() so there will be no new bio ++ * for this bio. ++ */ ++ bitmap_clear(rbio->dbitmap, 0, rbio->stripe_npages); + + /* + * At this moment, rbio->bio_list is empty, however since rbio does not +@@ -1196,6 +1205,9 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + else + BUG(); + ++ /* We should have at least one data sector. */ ++ ASSERT(bitmap_weight(rbio->dbitmap, rbio->stripe_npages)); ++ + /* at this point we either have a full stripe, + * or we've read the full stripe from the drive. + * recalculate the parity and write the new results. +@@ -1269,6 +1281,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + for (stripe = 0; stripe < rbio->real_stripes; stripe++) { + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { + struct page *page; ++ ++ /* This vertical stripe has no data, skip it. */ ++ if (!test_bit(pagenr, rbio->dbitmap)) ++ continue; ++ + if (stripe < rbio->nr_data) { + page = page_in_rbio(rbio, stripe, pagenr, 1); + if (!page) +@@ -1293,6 +1310,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { + struct page *page; ++ ++ /* This vertical stripe has no data, skip it. */ ++ if (!test_bit(pagenr, rbio->dbitmap)) ++ continue; ++ + if (stripe < rbio->nr_data) { + page = page_in_rbio(rbio, stripe, pagenr, 1); + if (!page) +@@ -1733,6 +1755,33 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule) + run_plug(plug); + } + ++/* Add the original bio into rbio->bio_list, and update rbio::dbitmap. */ ++static void rbio_add_bio(struct btrfs_raid_bio *rbio, struct bio *orig_bio) ++{ ++ const struct btrfs_fs_info *fs_info = rbio->fs_info; ++ const u64 orig_logical = orig_bio->bi_iter.bi_sector << SECTOR_SHIFT; ++ const u64 full_stripe_start = rbio->bbio->raid_map[0]; ++ const u32 orig_len = orig_bio->bi_iter.bi_size; ++ const u32 sectorsize = fs_info->sectorsize; ++ u64 cur_logical; ++ ++ ASSERT(orig_logical >= full_stripe_start && ++ orig_logical + orig_len <= full_stripe_start + ++ rbio->nr_data * rbio->stripe_len); ++ ++ bio_list_add(&rbio->bio_list, orig_bio); ++ rbio->bio_list_bytes += orig_bio->bi_iter.bi_size; ++ ++ /* Update the dbitmap. */ ++ for (cur_logical = orig_logical; cur_logical < orig_logical + orig_len; ++ cur_logical += sectorsize) { ++ int bit = ((u32)(cur_logical - full_stripe_start) >> ++ PAGE_SHIFT) % rbio->stripe_npages; ++ ++ set_bit(bit, rbio->dbitmap); ++ } ++} ++ + /* + * our main entry point for writes from the rest of the FS. + */ +@@ -1749,9 +1798,8 @@ int raid56_parity_write(struct btrfs_fs_info *fs_info, struct bio *bio, + btrfs_put_bbio(bbio); + return PTR_ERR(rbio); + } +- bio_list_add(&rbio->bio_list, bio); +- rbio->bio_list_bytes = bio->bi_iter.bi_size; + rbio->operation = BTRFS_RBIO_WRITE; ++ rbio_add_bio(rbio, bio); + + btrfs_bio_counter_inc_noblocked(fs_info); + rbio->generic_bio_cnt = 1; +@@ -2053,9 +2101,12 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio) + atomic_set(&rbio->error, 0); + + /* +- * read everything that hasn't failed. Thanks to the +- * stripe cache, it is possible that some or all of these +- * pages are going to be uptodate. ++ * Read everything that hasn't failed. However this time we will ++ * not trust any cached sector. ++ * As we may read out some stale data but higher layer is not reading ++ * that stale part. ++ * ++ * So here we always re-read everything in recovery path. + */ + for (stripe = 0; stripe < rbio->real_stripes; stripe++) { + if (rbio->faila == stripe || rbio->failb == stripe) { +@@ -2064,16 +2115,6 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio) + } + + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { +- struct page *p; +- +- /* +- * the rmw code may have already read this +- * page in +- */ +- p = rbio_stripe_page(rbio, stripe, pagenr); +- if (PageUptodate(p)) +- continue; +- + ret = rbio_add_io_page(rbio, &bio_list, + rbio_stripe_page(rbio, stripe, pagenr), + stripe, pagenr, rbio->stripe_len); +@@ -2155,8 +2196,7 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio, + } + + rbio->operation = BTRFS_RBIO_READ_REBUILD; +- bio_list_add(&rbio->bio_list, bio); +- rbio->bio_list_bytes = bio->bi_iter.bi_size; ++ rbio_add_bio(rbio, bio); + + rbio->faila = find_logical_bio_stripe(rbio, bio); + if (rbio->faila == -1) { +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index e00c50ea2eafd..0fe32c567ed74 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1081,7 +1081,9 @@ again: + extref = btrfs_lookup_inode_extref(NULL, root, path, name, namelen, + inode_objectid, parent_objectid, 0, + 0); +- if (!IS_ERR_OR_NULL(extref)) { ++ if (IS_ERR(extref)) { ++ return PTR_ERR(extref); ++ } else if (extref) { + u32 item_size; + u32 cur_offset = 0; + unsigned long base; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index cc34a28aecbcd..f906984eb25b0 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -762,9 +762,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +- name = &src->ea_data[0]; + name_len = (size_t)src->ea_name_length; +- value = &src->ea_data[src->ea_name_length + 1]; + value_len = (size_t)le16_to_cpu(src->ea_value_length); + + if (name_len == 0) { +@@ -777,6 +775,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + goto out; + } + ++ name = &src->ea_data[0]; ++ value = &src->ea_data[src->ea_name_length + 1]; ++ + if (ea_name) { + if (ea_name_len == name_len && + memcmp(ea_name, name, name_len) == 0) { +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index ad9fd08f66bab..44a1f356aca29 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -1088,9 +1088,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_frags_per_group); + goto failed_mount; + } +- if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { ++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || ++ sbi->s_inodes_per_group > sb->s_blocksize * 8) { + ext2_msg(sb, KERN_ERR, +- "error: #inodes per group too big: %lu", ++ "error: invalid #inodes per group: %lu", + sbi->s_inodes_per_group); + goto failed_mount; + } +@@ -1100,6 +1101,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - + le32_to_cpu(es->s_first_data_block) - 1) + / EXT2_BLOCKS_PER_GROUP(sb)) + 1; ++ if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", ++ le32_to_cpu(es->s_inodes_count), ++ (u64)sbi->s_groups_count * sbi->s_inodes_per_group); ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / + EXT2_DESC_PER_BLOCK(sb); + sbi->s_group_desc = kmalloc_array (db_count, +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index a2943382bf18b..b1c6b9398eef5 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -34,6 +34,9 @@ static int get_max_inline_xattr_value_size(struct inode *inode, + struct ext4_inode *raw_inode; + int free, min_offs; + ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) ++ return 0; ++ + min_offs = EXT4_SB(inode->i_sb)->s_inode_size - + EXT4_GOOD_OLD_INODE_SIZE - + EXT4_I(inode)->i_extra_isize - +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 76c887108df35..34cee87a0ac7d 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1755,7 +1755,14 @@ static void mpage_release_unused_pages(struct mpage_da_data *mpd, + ext4_lblk_t start, last; + start = index << (PAGE_SHIFT - inode->i_blkbits); + last = end << (PAGE_SHIFT - inode->i_blkbits); ++ ++ /* ++ * avoid racing with extent status tree scans made by ++ * ext4_insert_delayed_block() ++ */ ++ down_write(&EXT4_I(inode)->i_data_sem); + ext4_es_remove_extent(inode, start, last - start + 1); ++ up_write(&EXT4_I(inode)->i_data_sem); + } + + pagevec_init(&pvec); +@@ -4837,8 +4844,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode, + __le32 *magic = (void *)raw_inode + + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; + +- if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <= +- EXT4_INODE_SIZE(inode->i_sb) && ++ if (EXT4_INODE_HAS_XATTR_SPACE(inode) && + *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { + ext4_set_inode_state(inode, EXT4_STATE_XATTR); + return ext4_find_inline_data_nolock(inode); +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index 9adfe217b39d2..37ce665ae1d29 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode) + struct inode *tmp_inode = NULL; + struct migrate_struct lb; + unsigned long max_entries; +- __u32 goal; ++ __u32 goal, tmp_csum_seed; + uid_t owner[2]; + + /* +@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode) + * the migration. + */ + ei = EXT4_I(inode); ++ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* +@@ -593,6 +594,7 @@ err_out: + * the inode is not visible to user space. + */ + tmp_inode->i_blocks = 0; ++ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; + + /* Reset the extent details */ + ext4_ext_tree_init(handle, tmp_inode); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 5f85994191504..a878b9a8d9ead 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -53,6 +53,7 @@ static struct buffer_head *ext4_append(handle_t *handle, + struct inode *inode, + ext4_lblk_t *block) + { ++ struct ext4_map_blocks map; + struct buffer_head *bh; + int err; + +@@ -62,6 +63,21 @@ static struct buffer_head *ext4_append(handle_t *handle, + return ERR_PTR(-ENOSPC); + + *block = inode->i_size >> inode->i_sb->s_blocksize_bits; ++ map.m_lblk = *block; ++ map.m_len = 1; ++ ++ /* ++ * We're appending new directory block. Make sure the block is not ++ * allocated yet, otherwise we will end up corrupting the ++ * directory. ++ */ ++ err = ext4_map_blocks(NULL, inode, &map, 0); ++ if (err < 0) ++ return ERR_PTR(err); ++ if (err) { ++ EXT4_ERROR_INODE(inode, "Logical block already allocated"); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + + bh = ext4_bread(handle, inode, *block, EXT4_GET_BLOCKS_CREATE); + if (IS_ERR(bh)) +@@ -2826,11 +2842,8 @@ bool ext4_empty_dir(struct inode *inode) + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, +- bh->b_data, bh->b_size, offset)) { +- offset = (offset | (sb->s_blocksize - 1)) + 1; +- continue; +- } +- if (le32_to_cpu(de->inode)) { ++ bh->b_data, bh->b_size, offset) || ++ le32_to_cpu(de->inode)) { + brelse(bh); + return false; + } +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index d37493b39ab97..dd23c97ae951d 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1483,6 +1483,7 @@ static void ext4_update_super(struct super_block *sb, + * Update the fs overhead information + */ + ext4_calculate_overhead(sb); ++ es->s_overhead_clusters = cpu_to_le32(sbi->s_overhead); + + if (test_opt(sb, DEBUG)) + printk(KERN_DEBUG "EXT4-fs: added group %u:" +@@ -1980,6 +1981,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + } + brelse(bh); + ++ /* ++ * For bigalloc, trim the requested size to the nearest cluster ++ * boundary to avoid creating an unusable filesystem. We do this ++ * silently, instead of returning an error, to avoid breaking ++ * callers that blindly resize the filesystem to the full size of ++ * the underlying block device. ++ */ ++ if (ext4_has_feature_bigalloc(sb)) ++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); ++ + retry: + o_blocks_count = ext4_blocks_count(es); + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 0cd9b84bdd9db..497649c69bba7 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -2188,8 +2188,9 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, + struct ext4_inode *raw_inode; + int error; + +- if (EXT4_I(inode)->i_extra_isize == 0) ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) + return 0; ++ + raw_inode = ext4_raw_inode(&is->iloc); + header = IHDR(inode, raw_inode); + is->s.base = is->s.first = IFIRST(header); +@@ -2217,8 +2218,9 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, + struct ext4_xattr_search *s = &is->s; + int error; + +- if (EXT4_I(inode)->i_extra_isize == 0) ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) + return -ENOSPC; ++ + error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */); + if (error) + return error; +diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h +index f39cad2abe2a8..990084e00374f 100644 +--- a/fs/ext4/xattr.h ++++ b/fs/ext4/xattr.h +@@ -95,6 +95,19 @@ struct ext4_xattr_entry { + + #define EXT4_ZERO_XATTR_VALUE ((void *)-1) + ++/* ++ * If we want to add an xattr to the inode, we should make sure that ++ * i_extra_isize is not 0 and that the inode size is not less than ++ * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. ++ * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data ++ * |--------------------------|------------|------|---------|---|-------| ++ */ ++#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ ++ ((EXT4_I(inode)->i_extra_isize != 0) && \ ++ (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ ++ sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ ++ EXT4_INODE_SIZE((inode)->i_sb))) ++ + struct ext4_xattr_info { + const char *name; + const void *value; +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index ff3f97ba1a555..2c28f488ac2f0 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1232,7 +1232,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + dec_valid_node_count(sbi, dn->inode, !ofs); + goto fail; + } +- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR); ++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) { ++ err = -EFSCORRUPTED; ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto fail; ++ } + #endif + new_ni.nid = dn->nid; + new_ni.ino = dn->inode->i_ino; +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 821597c618843..3b51c881baf8c 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -174,6 +174,12 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, + inode->i_uid = make_kuid(fc->user_ns, attr->uid); + inode->i_gid = make_kgid(fc->user_ns, attr->gid); + inode->i_blocks = attr->blocks; ++ ++ /* Sanitize nsecs */ ++ attr->atimensec = min_t(u32, attr->atimensec, NSEC_PER_SEC - 1); ++ attr->mtimensec = min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1); ++ attr->ctimensec = min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1); ++ + inode->i_atime.tv_sec = attr->atime; + inode->i_atime.tv_nsec = attr->atimensec; + /* mtime from server may be stale due to local buffered write */ +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 8c305593fb51f..dbad00c20aa16 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1339,8 +1339,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + struct journal_head *jh; + int ret = 0; + +- if (is_handle_aborted(handle)) +- return -EROFS; + if (!buffer_jbd(bh)) + return -EUCLEAN; + +@@ -1387,6 +1385,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + journal = transaction->t_journal; + jbd_lock_bh_state(bh); + ++ if (is_handle_aborted(handle)) { ++ /* ++ * Check journal aborting with @jh->b_state_lock locked, ++ * since 'jh->b_transaction' could be replaced with ++ * 'jh->b_next_transaction' during old transaction ++ * committing if journal aborted, which may fail ++ * assertion on 'jh->b_frozen_data == NULL'. ++ */ ++ ret = -EROFS; ++ goto out_unlock_bh; ++ } ++ + if (jh->b_modified == 0) { + /* + * This buffer's got modified and becoming part +diff --git a/fs/namei.c b/fs/namei.c +index 327844fedf3d2..c34ee9653559c 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3453,6 +3453,8 @@ struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag) + child = d_alloc(dentry, &slash_name); + if (unlikely(!child)) + goto out_err; ++ if (!IS_POSIXACL(dir)) ++ mode &= ~current_umask(); + error = dir->i_op->tmpfile(dir, child, mode); + if (error) + goto out_err; +diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c +index bf34ddaa2ad74..c1c26b06764fe 100644 +--- a/fs/nfs/nfs4idmap.c ++++ b/fs/nfs/nfs4idmap.c +@@ -547,22 +547,20 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap, + return true; + } + +-static void +-nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret) ++static void nfs_idmap_complete_pipe_upcall(struct idmap_legacy_upcalldata *data, ++ int ret) + { +- struct key *authkey = idmap->idmap_upcall_data->authkey; +- +- kfree(idmap->idmap_upcall_data); +- idmap->idmap_upcall_data = NULL; +- complete_request_key(authkey, ret); +- key_put(authkey); ++ complete_request_key(data->authkey, ret); ++ key_put(data->authkey); ++ kfree(data); + } + +-static void +-nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret) ++static void nfs_idmap_abort_pipe_upcall(struct idmap *idmap, ++ struct idmap_legacy_upcalldata *data, ++ int ret) + { +- if (idmap->idmap_upcall_data != NULL) +- nfs_idmap_complete_pipe_upcall_locked(idmap, ret); ++ if (cmpxchg(&idmap->idmap_upcall_data, data, NULL) == data) ++ nfs_idmap_complete_pipe_upcall(data, ret); + } + + static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) +@@ -599,7 +597,7 @@ static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) + + ret = rpc_queue_upcall(idmap->idmap_pipe, msg); + if (ret < 0) +- nfs_idmap_abort_pipe_upcall(idmap, ret); ++ nfs_idmap_abort_pipe_upcall(idmap, data, ret); + + return ret; + out2: +@@ -655,6 +653,7 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + struct request_key_auth *rka; + struct rpc_inode *rpci = RPC_I(file_inode(filp)); + struct idmap *idmap = (struct idmap *)rpci->private; ++ struct idmap_legacy_upcalldata *data; + struct key *authkey; + struct idmap_msg im; + size_t namelen_in; +@@ -664,10 +663,11 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + * will have been woken up and someone else may now have used + * idmap_key_cons - so after this point we may no longer touch it. + */ +- if (idmap->idmap_upcall_data == NULL) ++ data = xchg(&idmap->idmap_upcall_data, NULL); ++ if (data == NULL) + goto out_noupcall; + +- authkey = idmap->idmap_upcall_data->authkey; ++ authkey = data->authkey; + rka = get_request_key_auth(authkey); + + if (mlen != sizeof(im)) { +@@ -689,18 +689,17 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (namelen_in == 0 || namelen_in == IDMAP_NAMESZ) { + ret = -EINVAL; + goto out; +-} ++ } + +- ret = nfs_idmap_read_and_verify_message(&im, +- &idmap->idmap_upcall_data->idmap_msg, +- rka->target_key, authkey); ++ ret = nfs_idmap_read_and_verify_message(&im, &data->idmap_msg, ++ rka->target_key, authkey); + if (ret >= 0) { + key_set_timeout(rka->target_key, nfs_idmap_cache_timeout); + ret = mlen; + } + + out: +- nfs_idmap_complete_pipe_upcall_locked(idmap, ret); ++ nfs_idmap_complete_pipe_upcall(data, ret); + out_noupcall: + return ret; + } +@@ -714,7 +713,7 @@ idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg) + struct idmap *idmap = data->idmap; + + if (msg->errno) +- nfs_idmap_abort_pipe_upcall(idmap, msg->errno); ++ nfs_idmap_abort_pipe_upcall(idmap, data, msg->errno); + } + + static void +@@ -722,8 +721,11 @@ idmap_release_pipe(struct inode *inode) + { + struct rpc_inode *rpci = RPC_I(inode); + struct idmap *idmap = (struct idmap *)rpci->private; ++ struct idmap_legacy_upcalldata *data; + +- nfs_idmap_abort_pipe_upcall(idmap, -EPIPE); ++ data = xchg(&idmap->idmap_upcall_data, NULL); ++ if (data) ++ nfs_idmap_complete_pipe_upcall(data, -EPIPE); + } + + int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, kuid_t *uid) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index f48a11fa78bb9..f9f76594b866b 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2920,12 +2920,13 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + } + + out: +- if (opendata->lgp) { +- nfs4_lgopen_release(opendata->lgp); +- opendata->lgp = NULL; +- } +- if (!opendata->cancelled) ++ if (!opendata->cancelled) { ++ if (opendata->lgp) { ++ nfs4_lgopen_release(opendata->lgp); ++ opendata->lgp = NULL; ++ } + nfs4_sequence_free_slot(&opendata->o_res.seq_res); ++ } + return ret; + } + +@@ -8701,6 +8702,9 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf + rpc_delay(task, NFS4_POLL_RETRY_MAX); + /* fall through */ + case -NFS4ERR_RETRY_UNCACHED_REP: ++ case -EACCES: ++ dprintk("%s: failed to reclaim complete error %d for server %s, retrying\n", ++ __func__, task->tk_status, clp->cl_hostname); + return -EAGAIN; + case -NFS4ERR_BADSESSION: + case -NFS4ERR_DEADSESSION: +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index ba6c7c59261a0..271f8c9fe2538 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -277,7 +277,7 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, + return FILEID_INVALID; + + dentry = d_find_any_alias(inode); +- if (WARN_ON(!dentry)) ++ if (!dentry) + return FILEID_INVALID; + + type = ovl_dentry_to_fh(dentry, fid, max_len); +diff --git a/fs/splice.c b/fs/splice.c +index fd28c7da3c837..ef1604e307f18 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -899,17 +899,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + { + struct pipe_inode_info *pipe; + long ret, bytes; +- umode_t i_mode; + size_t len; + int i, flags, more; + + /* +- * We require the input being a regular file, as we don't want to +- * randomly drop data for eg socket -> socket splicing. Use the +- * piped splicing for that! ++ * We require the input to be seekable, as we don't want to randomly ++ * drop data for eg socket -> socket splicing. Use the piped splicing ++ * for that! + */ +- i_mode = file_inode(in)->i_mode; +- if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode))) ++ if (unlikely(!(in->f_mode & FMODE_LSEEK))) + return -EINVAL; + + /* +diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h +index 8e0b8250a1399..c1f437d31a888 100644 +--- a/include/acpi/cppc_acpi.h ++++ b/include/acpi/cppc_acpi.h +@@ -20,7 +20,7 @@ + #include <acpi/pcc.h> + #include <acpi/processor.h> + +-/* Support CPPCv2 and CPPCv3 */ ++/* CPPCv2 and CPPCv3 support */ + #define CPPC_V2_REV 2 + #define CPPC_V3_REV 3 + #define CPPC_V2_NUM_ENT 21 +diff --git a/include/asm-generic/bitops/atomic.h b/include/asm-generic/bitops/atomic.h +index dd90c9792909d..18399e3759a24 100644 +--- a/include/asm-generic/bitops/atomic.h ++++ b/include/asm-generic/bitops/atomic.h +@@ -35,9 +35,6 @@ static inline int test_and_set_bit(unsigned int nr, volatile unsigned long *p) + unsigned long mask = BIT_MASK(nr); + + p += BIT_WORD(nr); +- if (READ_ONCE(*p) & mask) +- return 1; +- + old = atomic_long_fetch_or(mask, (atomic_long_t *)p); + return !!(old & mask); + } +@@ -48,9 +45,6 @@ static inline int test_and_clear_bit(unsigned int nr, volatile unsigned long *p) + unsigned long mask = BIT_MASK(nr); + + p += BIT_WORD(nr); +- if (!(READ_ONCE(*p) & mask)) +- return 0; +- + old = atomic_long_fetch_andnot(mask, (atomic_long_t *)p); + return !!(old & mask); + } +diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h +index 9168fc33a4f78..9d5b0a0a651f1 100644 +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -117,7 +117,6 @@ static __always_inline int test_clear_buffer_##name(struct buffer_head *bh) \ + * of the form "mark_buffer_foo()". These are higher-level functions which + * do something in addition to setting a b_state bit. + */ +-BUFFER_FNS(Uptodate, uptodate) + BUFFER_FNS(Dirty, dirty) + TAS_BUFFER_FNS(Dirty, dirty) + BUFFER_FNS(Lock, locked) +@@ -135,6 +134,30 @@ BUFFER_FNS(Meta, meta) + BUFFER_FNS(Prio, prio) + BUFFER_FNS(Defer_Completion, defer_completion) + ++static __always_inline void set_buffer_uptodate(struct buffer_head *bh) ++{ ++ /* ++ * make it consistent with folio_mark_uptodate ++ * pairs with smp_load_acquire in buffer_uptodate ++ */ ++ smp_mb__before_atomic(); ++ set_bit(BH_Uptodate, &bh->b_state); ++} ++ ++static __always_inline void clear_buffer_uptodate(struct buffer_head *bh) ++{ ++ clear_bit(BH_Uptodate, &bh->b_state); ++} ++ ++static __always_inline int buffer_uptodate(const struct buffer_head *bh) ++{ ++ /* ++ * make it consistent with folio_test_uptodate ++ * pairs with smp_mb__before_atomic in set_buffer_uptodate ++ */ ++ return (smp_load_acquire(&bh->b_state) & (1UL << BH_Uptodate)) != 0; ++} ++ + #define bh_offset(bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK) + + /* If we *know* page->private refers to buffer_heads */ +diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h +index 89fc8dc7bf38d..ab9ff74818a4f 100644 +--- a/include/linux/kfifo.h ++++ b/include/linux/kfifo.h +@@ -629,7 +629,7 @@ __kfifo_uint_must_check_helper( \ + * writer, you don't need extra locking to use these macro. + */ + #define kfifo_to_user(fifo, to, len, copied) \ +-__kfifo_uint_must_check_helper( \ ++__kfifo_int_must_check_helper( \ + ({ \ + typeof((fifo) + 1) __tmp = (fifo); \ + void __user *__to = (to); \ +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 827f70ce0b497..4f96aef4e8b85 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -128,6 +128,7 @@ static inline bool is_error_page(struct page *page) + #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_PENDING_TIMER 2 + #define KVM_REQ_UNHALT 3 ++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQUEST_ARCH_BASE 8 + + #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ +@@ -482,6 +483,7 @@ struct kvm { + struct srcu_struct srcu; + struct srcu_struct irq_srcu; + pid_t userspace_pid; ++ bool vm_bugged; + }; + + #define kvm_err(fmt, ...) \ +@@ -510,6 +512,31 @@ struct kvm { + #define vcpu_err(vcpu, fmt, ...) \ + kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) + ++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); ++static inline void kvm_vm_bugged(struct kvm *kvm) ++{ ++ kvm->vm_bugged = true; ++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED); ++} ++ ++#define KVM_BUG(cond, kvm, fmt...) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ ++#define KVM_BUG_ON(cond, kvm) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ + static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) + { + return srcu_dereference_check(kvm->buses[idx], &kvm->srcu, +@@ -770,7 +797,6 @@ void kvm_reload_remote_mmus(struct kvm *kvm); + + bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req, + unsigned long *vcpu_bitmap, cpumask_var_t tmp); +-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); + + long kvm_arch_dev_ioctl(struct file *filp, + unsigned int ioctl, unsigned long arg); +diff --git a/include/linux/mfd/t7l66xb.h b/include/linux/mfd/t7l66xb.h +index b4629818aea58..d4e7f0453c915 100644 +--- a/include/linux/mfd/t7l66xb.h ++++ b/include/linux/mfd/t7l66xb.h +@@ -16,7 +16,6 @@ + + struct t7l66xb_platform_data { + int (*enable)(struct platform_device *dev); +- int (*disable)(struct platform_device *dev); + int (*suspend)(struct platform_device *dev); + int (*resume)(struct platform_device *dev); + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 9003e29cde461..e972d1ae1ee63 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void); + int watchdog_nmi_enable(unsigned int cpu); + void watchdog_nmi_disable(unsigned int cpu); + ++void lockup_detector_reconfigure(void); ++ + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. + * +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index c0dd2f749d3f8..1658e9f8d8032 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -59,6 +59,8 @@ + #define PCI_CLASS_BRIDGE_EISA 0x0602 + #define PCI_CLASS_BRIDGE_MC 0x0603 + #define PCI_CLASS_BRIDGE_PCI 0x0604 ++#define PCI_CLASS_BRIDGE_PCI_NORMAL 0x060400 ++#define PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE 0x060401 + #define PCI_CLASS_BRIDGE_PCMCIA 0x0605 + #define PCI_CLASS_BRIDGE_NUBUS 0x0606 + #define PCI_CLASS_BRIDGE_CARDBUS 0x0607 +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index 97e2ddec18b1a..cf7feb8eb1bae 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -66,6 +66,7 @@ + + struct giveback_urb_bh { + bool running; ++ bool high_prio; + spinlock_t lock; + struct list_head head; + struct tasklet_struct bh; +diff --git a/include/sound/core.h b/include/sound/core.h +index 36a5934cf4b10..b5a8cc4d02cc1 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -444,4 +444,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, + } + #endif + ++/* async signal helpers */ ++struct snd_fasync; ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp); ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); ++void snd_fasync_free(struct snd_fasync *fasync); ++ + #endif /* __SOUND_CORE_H */ +diff --git a/include/trace/events/spmi.h b/include/trace/events/spmi.h +index 8b60efe18ba68..a6819fd85cdf4 100644 +--- a/include/trace/events/spmi.h ++++ b/include/trace/events/spmi.h +@@ -21,15 +21,15 @@ TRACE_EVENT(spmi_write_begin, + __field ( u8, sid ) + __field ( u16, addr ) + __field ( u8, len ) +- __dynamic_array ( u8, buf, len + 1 ) ++ __dynamic_array ( u8, buf, len ) + ), + + TP_fast_assign( + __entry->opcode = opcode; + __entry->sid = sid; + __entry->addr = addr; +- __entry->len = len + 1; +- memcpy(__get_dynamic_array(buf), buf, len + 1); ++ __entry->len = len; ++ memcpy(__get_dynamic_array(buf), buf, len); + ), + + TP_printk("opc=%d sid=%02d addr=0x%04x len=%d buf=0x[%*phD]", +@@ -92,7 +92,7 @@ TRACE_EVENT(spmi_read_end, + __field ( u16, addr ) + __field ( int, ret ) + __field ( u8, len ) +- __dynamic_array ( u8, buf, len + 1 ) ++ __dynamic_array ( u8, buf, len ) + ), + + TP_fast_assign( +@@ -100,8 +100,8 @@ TRACE_EVENT(spmi_read_end, + __entry->sid = sid; + __entry->addr = addr; + __entry->ret = ret; +- __entry->len = len + 1; +- memcpy(__get_dynamic_array(buf), buf, len + 1); ++ __entry->len = len; ++ memcpy(__get_dynamic_array(buf), buf, len); + ), + + TP_printk("opc=%d sid=%02d addr=0x%04x ret=%d len=%02d buf=0x[%*phD]", +diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h +index bfc4b5d22a5e6..383f3d508a53d 100644 +--- a/include/uapi/linux/can/error.h ++++ b/include/uapi/linux/can/error.h +@@ -120,6 +120,9 @@ + #define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70 /* 0111 0000 */ + #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80 /* 1000 0000 */ + +-/* controller specific additional information / data[5..7] */ ++/* data[5] is reserved (do not use) */ ++ ++/* TX error counter / data[6] */ ++/* RX error counter / data[7] */ + + #endif /* _UAPI_CAN_ERROR_H */ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 30ac8ee8294c3..694ee0b1fefea 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3496,6 +3496,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + coerce_reg_to_size(dst_reg, 4); + } + ++ __update_reg_bounds(dst_reg); + __reg_deduce_bounds(dst_reg); + __reg_bound_offset(dst_reg); + return 0; +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 993b84cc1db5a..099191716d4c9 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1566,7 +1566,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + preempt_disable(); + + /* Ensure it is not in reserved area nor out of text */ +- if (!kernel_text_address((unsigned long) p->addr) || ++ if (!(core_kernel_text((unsigned long) p->addr) || ++ is_module_text_address((unsigned long) p->addr)) || + within_kprobe_blacklist((unsigned long) p->addr) || + jump_label_text_reserved(p->addr, p->addr) || + find_bug((unsigned long)p->addr)) { +diff --git a/kernel/power/user.c b/kernel/power/user.c +index 2d8b60a3c86b9..6a11154b3d526 100644 +--- a/kernel/power/user.c ++++ b/kernel/power/user.c +@@ -29,6 +29,7 @@ + + #include "power.h" + ++static bool need_wait; + + #define SNAPSHOT_MINOR 231 + +@@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) + * Resuming. We may need to wait for the image device to + * appear. + */ +- wait_for_device_probe(); ++ need_wait = true; + + data->swap = -1; + data->mode = O_WRONLY; +@@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, + ssize_t res; + loff_t pg_offp = *offp & ~PAGE_MASK; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + lock_system_sleep(); + + data = filp->private_data; +@@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, + loff_t size; + sector_t offset; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) + return -ENOTTY; + if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) +diff --git a/kernel/profile.c b/kernel/profile.c +index efa58f63dc1bf..7fc6214042308 100644 +--- a/kernel/profile.c ++++ b/kernel/profile.c +@@ -108,6 +108,13 @@ int __ref profile_init(void) + + /* only text is profiled */ + prof_len = (_etext - _stext) >> prof_shift; ++ ++ if (!prof_len) { ++ pr_warn("profiling shift: %u too large\n", prof_shift); ++ prof_on = 0; ++ return -EINVAL; ++ } ++ + buffer_bytes = prof_len*sizeof(atomic_t); + + if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL)) +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 70e8cd3954745..9c6c3572b1312 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -434,7 +434,7 @@ static inline void rt_queue_push_tasks(struct rq *rq) + #endif /* CONFIG_SMP */ + + static void enqueue_top_rt_rq(struct rt_rq *rt_rq); +-static void dequeue_top_rt_rq(struct rt_rq *rt_rq); ++static void dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count); + + static inline int on_rt_rq(struct sched_rt_entity *rt_se) + { +@@ -516,7 +516,7 @@ static void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + rt_se = rt_rq->tg->rt_se[cpu]; + + if (!rt_se) { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + /* Kick cpufreq (see the comment in kernel/sched/sched.h). */ + cpufreq_update_util(rq_of_rt_rq(rt_rq), 0); + } +@@ -602,7 +602,7 @@ static inline void sched_rt_rq_enqueue(struct rt_rq *rt_rq) + + static inline void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + } + + static inline int rt_rq_throttled(struct rt_rq *rt_rq) +@@ -1001,7 +1001,7 @@ static void update_curr_rt(struct rq *rq) + } + + static void +-dequeue_top_rt_rq(struct rt_rq *rt_rq) ++dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count) + { + struct rq *rq = rq_of_rt_rq(rt_rq); + +@@ -1012,7 +1012,7 @@ dequeue_top_rt_rq(struct rt_rq *rt_rq) + + BUG_ON(!rq->nr_running); + +- sub_nr_running(rq, rt_rq->rt_nr_running); ++ sub_nr_running(rq, count); + rt_rq->rt_queued = 0; + + } +@@ -1291,18 +1291,21 @@ static void __dequeue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flag + static void dequeue_rt_stack(struct sched_rt_entity *rt_se, unsigned int flags) + { + struct sched_rt_entity *back = NULL; ++ unsigned int rt_nr_running; + + for_each_sched_rt_entity(rt_se) { + rt_se->back = back; + back = rt_se; + } + +- dequeue_top_rt_rq(rt_rq_of_se(back)); ++ rt_nr_running = rt_rq_of_se(back)->rt_nr_running; + + for (rt_se = back; rt_se; rt_se = rt_se->back) { + if (on_rt_rq(rt_se)) + __dequeue_rt_entity(rt_se, flags); + } ++ ++ dequeue_top_rt_rq(rt_rq_of_se(back), rt_nr_running); + } + + static void enqueue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flags) +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 1ca64a9296d0d..d2f9146d1ad74 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -173,6 +173,7 @@ static int trace_define_generic_fields(void) + + __generic_field(int, CPU, FILTER_CPU); + __generic_field(int, cpu, FILTER_CPU); ++ __generic_field(int, common_cpu, FILTER_CPU); + __generic_field(char *, COMM, FILTER_COMM); + __generic_field(char *, comm, FILTER_COMM); + +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index e99c3ce7aa654..d85ee1778b99a 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -361,7 +361,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t, + } + } else + ret = -EINVAL; +- } else if (strcmp(arg, "comm") == 0) { ++ } else if (strcmp(arg, "comm") == 0 || strcmp(arg, "COMM") == 0) { + if (strcmp(t->name, "string") != 0 && + strcmp(t->name, "string_size") != 0) + return -EINVAL; +@@ -544,7 +544,7 @@ int traceprobe_parse_probe_arg(char *arg, ssize_t *size, + * The default type of $comm should be "string", and it can't be + * dereferenced. + */ +- if (!t && strcmp(arg, "$comm") == 0) ++ if (!t && (strcmp(arg, "$comm") == 0 || strcmp(arg, "$COMM") == 0)) + t = "string"; + parg->type = find_fetch_type(t, ftbl); + if (!parg->type) { +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 6d60701dc6361..44096c4f4d60f 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -561,7 +561,7 @@ int lockup_detector_offline_cpu(unsigned int cpu) + return 0; + } + +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -581,6 +581,13 @@ static void lockup_detector_reconfigure(void) + __lockup_detector_cleanup(); + } + ++void lockup_detector_reconfigure(void) ++{ ++ mutex_lock(&watchdog_mutex); ++ __lockup_detector_reconfigure(); ++ mutex_unlock(&watchdog_mutex); ++} ++ + /* + * Create the watchdog thread infrastructure and configure the detector(s). + * +@@ -601,13 +608,13 @@ static __init void lockup_detector_setup(void) + return; + + mutex_lock(&watchdog_mutex); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + softlockup_initialized = true; + mutex_unlock(&watchdog_mutex); + } + + #else /* CONFIG_SOFTLOCKUP_DETECTOR */ +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -615,9 +622,13 @@ static void lockup_detector_reconfigure(void) + watchdog_nmi_start(); + cpus_read_unlock(); + } ++void lockup_detector_reconfigure(void) ++{ ++ __lockup_detector_reconfigure(); ++} + static inline void lockup_detector_setup(void) + { +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ + +@@ -657,7 +668,7 @@ static void proc_watchdog_update(void) + { + /* Remove impossible cpus to keep sysctl output clean. */ + cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + + /* +diff --git a/lib/list_debug.c b/lib/list_debug.c +index 5d5424b51b746..413daa72a3d83 100644 +--- a/lib/list_debug.c ++++ b/lib/list_debug.c +@@ -20,7 +20,11 @@ + bool __list_add_valid(struct list_head *new, struct list_head *prev, + struct list_head *next) + { +- if (CHECK_DATA_CORRUPTION(next->prev != prev, ++ if (CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_add corruption. prev is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next == NULL, ++ "list_add corruption. next is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next->prev != prev, + "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", + prev, next->prev, next) || + CHECK_DATA_CORRUPTION(prev->next != next, +@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) + prev = entry->prev; + next = entry->next; + +- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1, ++ if (CHECK_DATA_CORRUPTION(next == NULL, ++ "list_del corruption, %px->next is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_del corruption, %px->prev is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(next == LIST_POISON1, + "list_del corruption, %px->next is LIST_POISON1 (%px)\n", + entry, LIST_POISON1) || + CHECK_DATA_CORRUPTION(prev == LIST_POISON2, +diff --git a/mm/mmap.c b/mm/mmap.c +index bb8ba32589459..590840c3a3b5f 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1821,7 +1821,6 @@ unmap_and_free_vma: + + /* Undo any partial mapping done by a device driver. */ + unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); +- charged = 0; + if (vm_flags & VM_SHARED) + mapping_unmap_writable(file->f_mapping); + allow_write_and_free_vma: +diff --git a/net/9p/client.c b/net/9p/client.c +index bb0a43b8a6b0f..98301add20f49 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -908,16 +908,13 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt) + struct p9_fid *fid; + + p9_debug(P9_DEBUG_FID, "clnt %p\n", clnt); +- fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL); ++ fid = kzalloc(sizeof(struct p9_fid), GFP_KERNEL); + if (!fid) + return NULL; + +- memset(&fid->qid, 0, sizeof(struct p9_qid)); + fid->mode = -1; + fid->uid = current_fsuid(); + fid->clnt = clnt; +- fid->rdir = NULL; +- fid->fid = 0; + + idr_preload(GFP_KERNEL); + spin_lock_irq(&clnt->lock); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 709cceef67288..0dfc47adccb17 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1804,11 +1804,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, + bdaddr_t *dst, + u8 link_type) + { +- struct l2cap_chan *c, *c1 = NULL; ++ struct l2cap_chan *c, *tmp, *c1 = NULL; + + read_lock(&chan_list_lock); + +- list_for_each_entry(c, &chan_list, global_l) { ++ list_for_each_entry_safe(c, tmp, &chan_list, global_l) { + if (state && c->state != state) + continue; + +@@ -1827,11 +1827,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, + dst_match = !bacmp(&c->dst, dst); + if (src_match && dst_match) { + c = l2cap_chan_hold_unless_zero(c); +- if (!c) +- continue; +- +- read_unlock(&chan_list_lock); +- return c; ++ if (c) { ++ read_unlock(&chan_list_lock); ++ return c; ++ } + } + + /* Closest match */ +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index 43733accf58eb..dbbcf50aea35d 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -769,11 +769,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + lock_sock(sk); + +- if (dccp_qpolicy_full(sk)) { +- rc = -EAGAIN; +- goto out_release; +- } +- + timeo = sock_sndtimeo(sk, noblock); + + /* +@@ -792,6 +787,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_release; + ++ if (dccp_qpolicy_full(sk)) { ++ rc = -EAGAIN; ++ goto out_discard; ++ } ++ + if (sk->sk_state == DCCP_CLOSED) { + rc = -ENOTCONN; + goto out_discard; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3090b61e4edd1..35bf585992231 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2856,7 +2856,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + struct tcp_sock *tp = tcp_sk(sk); + unsigned int cur_mss; + int diff, len, err; +- ++ int avail_wnd; + + /* Inconclusive MTU probe */ + if (icsk->icsk_mtup.probe_size) +@@ -2886,17 +2886,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + return -EHOSTUNREACH; /* Routing failure or similar. */ + + cur_mss = tcp_current_mss(sk); ++ avail_wnd = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq; + + /* If receiver has shrunk his window, and skb is out of + * new window, do not retransmit it. The exception is the + * case, when window is shrunk to zero. In this case +- * our retransmit serves as a zero window probe. ++ * our retransmit of one segment serves as a zero window probe. + */ +- if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) && +- TCP_SKB_CB(skb)->seq != tp->snd_una) +- return -EAGAIN; ++ if (avail_wnd <= 0) { ++ if (TCP_SKB_CB(skb)->seq != tp->snd_una) ++ return -EAGAIN; ++ avail_wnd = cur_mss; ++ } + + len = cur_mss * segs; ++ if (len > avail_wnd) { ++ len = rounddown(avail_wnd, cur_mss); ++ if (!len) ++ len = avail_wnd; ++ } + if (skb->len > len) { + if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len, + cur_mss, GFP_ATOMIC)) +@@ -2910,8 +2918,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + diff -= tcp_skb_pcount(skb); + if (diff) + tcp_adjust_pcount(sk, skb, diff); +- if (skb->len < cur_mss) +- tcp_retrans_try_collapse(sk, skb, cur_mss); ++ avail_wnd = min_t(int, avail_wnd, cur_mss); ++ if (skb->len < avail_wnd) ++ tcp_retrans_try_collapse(sk, skb, avail_wnd); + } + + /* RFC3168, section 6.1.1.1. ECN fallback */ +@@ -3070,11 +3079,12 @@ void tcp_xmit_retransmit_queue(struct sock *sk) + */ + void sk_forced_mem_schedule(struct sock *sk, int size) + { +- int amt; ++ int delta, amt; + +- if (size <= sk->sk_forward_alloc) ++ delta = size - sk->sk_forward_alloc; ++ if (delta <= 0) + return; +- amt = sk_mem_pages(size); ++ amt = sk_mem_pages(delta); + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; + sk_memory_allocated_add(sk, amt); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ab68076d2cba3..079f768496937 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -96,6 +96,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, + if (trans == NULL) + return NULL; + ++ INIT_LIST_HEAD(&trans->list); + trans->msg_type = msg_type; + trans->ctx = *ctx; + +@@ -3039,6 +3040,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, + } + + static struct nft_set *nft_set_lookup_byid(const struct net *net, ++ const struct nft_table *table, + const struct nlattr *nla, u8 genmask) + { + struct nft_trans *trans; +@@ -3049,6 +3051,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, + struct nft_set *set = nft_trans_set(trans); + + if (id == nft_trans_set_id(trans) && ++ set->table == table && + nft_active_genmask(set, genmask)) + return set; + } +@@ -3069,7 +3072,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, + if (!nla_set_id) + return set; + +- set = nft_set_lookup_byid(net, nla_set_id, genmask); ++ set = nft_set_lookup_byid(net, table, nla_set_id, genmask); + } + return set; + } +@@ -3095,7 +3098,7 @@ cont: + list_for_each_entry(i, &ctx->table->sets, list) { + int tmp; + +- if (!nft_is_active_next(ctx->net, set)) ++ if (!nft_is_active_next(ctx->net, i)) + continue; + if (!sscanf(i->name, name, &tmp)) + continue; +diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c +index 2f16146e4ec94..18e0e3cba1acf 100644 +--- a/net/rds/ib_recv.c ++++ b/net/rds/ib_recv.c +@@ -362,6 +362,7 @@ static int acquire_refill(struct rds_connection *conn) + static void release_refill(struct rds_connection *conn) + { + clear_bit(RDS_RECV_REFILL, &conn->c_flags); ++ smp_mb__after_atomic(); + + /* We don't use wait_on_bit()/wake_up_bit() because our waking is in a + * hot path and finding waiters is very rare. We don't want to walk +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index d00a0ef39a56b..03a1ee221112e 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -194,6 +194,7 @@ static void rose_kill_by_device(struct net_device *dev) + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); + if (rose->neighbour) + rose->neighbour->use--; ++ dev_put(rose->device); + rose->device = NULL; + } + } +@@ -594,6 +595,8 @@ static struct sock *rose_make_new(struct sock *osk) + rose->idle = orose->idle; + rose->defer = orose->defer; + rose->device = orose->device; ++ if (rose->device) ++ dev_hold(rose->device); + rose->qbitincl = orose->qbitincl; + + return sk; +@@ -647,6 +650,7 @@ static int rose_release(struct socket *sock) + break; + } + ++ dev_put(rose->device); + sock->sk = NULL; + release_sock(sk); + sock_put(sk); +@@ -721,7 +725,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + struct rose_sock *rose = rose_sk(sk); + struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr; + unsigned char cause, diagnostic; +- struct net_device *dev; + ax25_uid_assoc *user; + int n, err = 0; + +@@ -778,9 +781,12 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + } + + if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in this may or may not work */ ++ struct net_device *dev; ++ + sock_reset_flag(sk, SOCK_ZAPPED); + +- if ((dev = rose_dev_first()) == NULL) { ++ dev = rose_dev_first(); ++ if (!dev) { + err = -ENETUNREACH; + goto out_release; + } +@@ -788,6 +794,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + user = ax25_findbyuid(current_euid()); + if (!user) { + err = -EINVAL; ++ dev_put(dev); + goto out_release; + } + +diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c +index 46ae92d703247..5671853bef83a 100644 +--- a/net/rose/rose_route.c ++++ b/net/rose/rose_route.c +@@ -616,6 +616,8 @@ struct net_device *rose_dev_first(void) + if (first == NULL || strncmp(dev->name, first->name, 3) < 0) + first = dev; + } ++ if (first) ++ dev_hold(first); + rcu_read_unlock(); + + return first; +diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c +index 0256777b838e6..4c7fa1cfd8e38 100644 +--- a/net/sched/cls_route.c ++++ b/net/sched/cls_route.c +@@ -427,6 +427,11 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp, + return -EINVAL; + } + ++ if (!nhandle) { ++ NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid"); ++ return -EINVAL; ++ } ++ + h1 = to_hash(nhandle); + b = rtnl_dereference(head->table[h1]); + if (!b) { +@@ -480,6 +485,11 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, + int err; + bool new = true; + ++ if (!handle) { ++ NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid"); ++ return -EINVAL; ++ } ++ + if (opt == NULL) + return handle ? -EINVAL : 0; + +@@ -528,7 +538,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, + rcu_assign_pointer(f->next, f1); + rcu_assign_pointer(*fp, f); + +- if (fold && fold->handle && f->handle != fold->handle) { ++ if (fold) { + th = to_hash(fold->handle); + h = from_hash(fold->handle >> 16); + b = rtnl_dereference(head->table[th]); +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index 3c15a99b97003..e41427e1740da 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -69,6 +69,17 @@ static void xprt_free_allocation(struct rpc_rqst *req) + kfree(req); + } + ++static void xprt_bc_reinit_xdr_buf(struct xdr_buf *buf) ++{ ++ buf->head[0].iov_len = PAGE_SIZE; ++ buf->tail[0].iov_len = 0; ++ buf->pages = NULL; ++ buf->page_len = 0; ++ buf->flags = 0; ++ buf->len = 0; ++ buf->buflen = PAGE_SIZE; ++} ++ + static int xprt_alloc_xdr_buf(struct xdr_buf *buf, gfp_t gfp_flags) + { + struct page *page; +@@ -291,6 +302,9 @@ void xprt_free_bc_rqst(struct rpc_rqst *req) + */ + spin_lock_bh(&xprt->bc_pa_lock); + if (xprt_need_to_requeue(xprt)) { ++ xprt_bc_reinit_xdr_buf(&req->rq_snd_buf); ++ xprt_bc_reinit_xdr_buf(&req->rq_rcv_buf); ++ req->rq_rcv_buf.len = PAGE_SIZE; + list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list); + xprt->bc_alloc_count++; + req = NULL; +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 22931a5f62bc6..d55a47858d6d3 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1118,6 +1118,7 @@ static void vsock_connect_timeout(struct work_struct *work) + if (sk->sk_state == TCP_SYN_SENT && + (sk->sk_shutdown != SHUTDOWN_MASK)) { + sk->sk_state = TCP_CLOSE; ++ sk->sk_socket->state = SS_UNCONNECTED; + sk->sk_err = ETIMEDOUT; + sk->sk_error_report(sk); + vsock_transport_cancel_pkt(vsk); +@@ -1215,7 +1216,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + * timeout fires. + */ + sock_hold(sk); +- schedule_delayed_work(&vsk->connect_work, timeout); ++ ++ /* If the timeout function is already scheduled, ++ * reschedule it, then ungrab the socket refcount to ++ * keep it balanced. ++ */ ++ if (mod_delayed_work(system_wq, &vsk->connect_work, ++ timeout)) ++ sock_put(sk); + + /* Skip ahead to preserve error code set above. */ + goto out_wait; +diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins +index 93ca13e4f8f95..66bbe77ed7570 100644 +--- a/scripts/Makefile.gcc-plugins ++++ b/scripts/Makefile.gcc-plugins +@@ -6,7 +6,7 @@ gcc-plugin-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) += latent_entropy_plugin.so + gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) \ + += -DLATENT_ENTROPY_PLUGIN + ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY +- DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable ++ DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable -ULATENT_ENTROPY_PLUGIN + endif + export DISABLE_LATENT_ENTROPY_PLUGIN + +diff --git a/scripts/faddr2line b/scripts/faddr2line +index 2571caac3156c..70f8c3ecd5559 100755 +--- a/scripts/faddr2line ++++ b/scripts/faddr2line +@@ -112,7 +112,9 @@ __faddr2line() { + # section offsets. + local file_type=$(${READELF} --file-header $objfile | + ${AWK} '$1 == "Type:" { print $2; exit }') +- [[ $file_type = "EXEC" ]] && is_vmlinux=1 ++ if [[ $file_type = "EXEC" ]] || [[ $file_type == "DYN" ]]; then ++ is_vmlinux=1 ++ fi + + # Go through each of the object's symbols which match the func name. + # In rare cases there might be duplicates, in which case we print all +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index 900c865b9e5ff..8868c475205ff 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -403,7 +403,7 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf, + + data->size = copy_size; + if (copy_from_user(data->data, userbuf, copy_size)) { +- kvfree(data); ++ aa_put_loaddata(data); + return ERR_PTR(-EFAULT); + } + +diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c +index 70b9730c0be6a..86ce3ec18a8aa 100644 +--- a/security/apparmor/audit.c ++++ b/security/apparmor/audit.c +@@ -143,7 +143,7 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa, + } + if (AUDIT_MODE(profile) == AUDIT_QUIET || + (type == AUDIT_APPARMOR_DENIED && +- AUDIT_MODE(profile) == AUDIT_QUIET)) ++ AUDIT_MODE(profile) == AUDIT_QUIET_DENIED)) + return aad(sa)->error; + + if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED) +diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c +index 13b33490e0792..dad704825294d 100644 +--- a/security/apparmor/domain.c ++++ b/security/apparmor/domain.c +@@ -464,7 +464,7 @@ restart: + * xattrs, or a longer match + */ + candidate = profile; +- candidate_len = profile->xmatch_len; ++ candidate_len = max(count, profile->xmatch_len); + candidate_xattrs = ret; + conflict = false; + } +diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h +index 6505e1ad9e230..a6d747dc148d0 100644 +--- a/security/apparmor/include/lib.h ++++ b/security/apparmor/include/lib.h +@@ -25,6 +25,11 @@ + */ + + #define DEBUG_ON (aa_g_debug) ++/* ++ * split individual debug cases out in preparation for finer grained ++ * debug controls in the future. ++ */ ++#define AA_DEBUG_LABEL DEBUG_ON + #define dbg_printk(__fmt, __args...) pr_debug(__fmt, ##__args) + #define AA_DEBUG(fmt, args...) \ + do { \ +diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h +index 28c098fb6208b..92fa4f6102120 100644 +--- a/security/apparmor/include/policy.h ++++ b/security/apparmor/include/policy.h +@@ -139,7 +139,7 @@ struct aa_profile { + + const char *attach; + struct aa_dfa *xmatch; +- int xmatch_len; ++ unsigned int xmatch_len; + enum audit_mode audit; + long mode; + u32 path_flags; +diff --git a/security/apparmor/label.c b/security/apparmor/label.c +index 5a80a16a7f751..fed6bd75fcc1c 100644 +--- a/security/apparmor/label.c ++++ b/security/apparmor/label.c +@@ -1641,9 +1641,9 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, + AA_BUG(!str && size != 0); + AA_BUG(!label); + +- if (flags & FLAG_ABS_ROOT) { ++ if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) { + ns = root_ns; +- len = snprintf(str, size, "="); ++ len = snprintf(str, size, "_"); + update_for_len(total, len, size, str); + } else if (!ns) { + ns = labels_ns(label); +@@ -1754,7 +1754,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, + if (!use_label_hname(ns, label, flags) || + display_mode(ns, label, flags)) { + len = aa_label_asxprint(&name, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1782,7 +1782,7 @@ void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, + int len; + + len = aa_label_asxprint(&str, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1805,7 +1805,7 @@ void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, + int len; + + len = aa_label_asxprint(&str, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1905,7 +1905,8 @@ struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, + AA_BUG(!str); + + str = skipn_spaces(str, n); +- if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label)) ++ if (str == NULL || (AA_DEBUG_LABEL && *str == '_' && ++ base != &root_ns->unconfined->label)) + return ERR_PTR(-EINVAL); + + len = label_count_strn_entries(str, end - str); +diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c +index c1da22482bfbb..85dc8a548c4ba 100644 +--- a/security/apparmor/mount.c ++++ b/security/apparmor/mount.c +@@ -232,7 +232,8 @@ static const char * const mnt_info_table[] = { + "failed srcname match", + "failed type match", + "failed flags match", +- "failed data match" ++ "failed data match", ++ "failed perms check" + }; + + /* +@@ -287,8 +288,8 @@ static int do_match_mnt(struct aa_dfa *dfa, unsigned int start, + return 0; + } + +- /* failed at end of flags match */ +- return 4; ++ /* failed at perms check, don't confuse with flags match */ ++ return 6; + } + + +@@ -685,6 +686,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path, + aa_put_label(target); + goto out; + } ++ aa_put_label(target); + } else + /* already audited error */ + error = PTR_ERR(target); +diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h +index 215f8f30ac5a5..2a479785ebd41 100644 +--- a/security/selinux/ss/policydb.h ++++ b/security/selinux/ss/policydb.h +@@ -360,6 +360,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic + { + size_t len = bytes * num; + ++ if (len > fp->len) ++ return -EINVAL; + memcpy(fp->data, buf, len); + fp->data += len; + fp->len -= len; +diff --git a/sound/core/info.c b/sound/core/info.c +index 3fa8336794f82..2ac656db0b1c1 100644 +--- a/sound/core/info.c ++++ b/sound/core/info.c +@@ -127,9 +127,9 @@ static loff_t snd_info_entry_llseek(struct file *file, loff_t offset, int orig) + entry = data->entry; + mutex_lock(&entry->access); + if (entry->c.ops->llseek) { +- offset = entry->c.ops->llseek(entry, +- data->file_private_data, +- file, offset, orig); ++ ret = entry->c.ops->llseek(entry, ++ data->file_private_data, ++ file, offset, orig); + goto out; + } + +diff --git a/sound/core/misc.c b/sound/core/misc.c +index 0f818d593c9ee..d100feba26b5c 100644 +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -25,6 +25,7 @@ + #include <linux/time.h> + #include <linux/slab.h> + #include <linux/ioport.h> ++#include <linux/fs.h> + #include <sound/core.h> + + #ifdef CONFIG_SND_DEBUG +@@ -160,3 +161,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list) + } + EXPORT_SYMBOL(snd_pci_quirk_lookup); + #endif ++ ++/* ++ * Deferred async signal helpers ++ * ++ * Below are a few helper functions to wrap the async signal handling ++ * in the deferred work. The main purpose is to avoid the messy deadlock ++ * around tasklist_lock and co at the kill_fasync() invocation. ++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() ++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has ++ * to be called at releasing the relevant file object. ++ */ ++struct snd_fasync { ++ struct fasync_struct *fasync; ++ int signal; ++ int poll; ++ int on; ++ struct list_head list; ++}; ++ ++static DEFINE_SPINLOCK(snd_fasync_lock); ++static LIST_HEAD(snd_fasync_list); ++ ++static void snd_fasync_work_fn(struct work_struct *work) ++{ ++ struct snd_fasync *fasync; ++ ++ spin_lock_irq(&snd_fasync_lock); ++ while (!list_empty(&snd_fasync_list)) { ++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); ++ list_del_init(&fasync->list); ++ spin_unlock_irq(&snd_fasync_lock); ++ if (fasync->on) ++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ spin_lock_irq(&snd_fasync_lock); ++ } ++ spin_unlock_irq(&snd_fasync_lock); ++} ++ ++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp) ++{ ++ struct snd_fasync *fasync = NULL; ++ ++ if (on) { ++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL); ++ if (!fasync) ++ return -ENOMEM; ++ INIT_LIST_HEAD(&fasync->list); ++ } ++ ++ spin_lock_irq(&snd_fasync_lock); ++ if (*fasyncp) { ++ kfree(fasync); ++ fasync = *fasyncp; ++ } else { ++ if (!fasync) { ++ spin_unlock_irq(&snd_fasync_lock); ++ return 0; ++ } ++ *fasyncp = fasync; ++ } ++ fasync->on = on; ++ spin_unlock_irq(&snd_fasync_lock); ++ return fasync_helper(fd, file, on, &fasync->fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_helper); ++ ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) ++{ ++ unsigned long flags; ++ ++ if (!fasync || !fasync->on) ++ return; ++ spin_lock_irqsave(&snd_fasync_lock, flags); ++ fasync->signal = signal; ++ fasync->poll = poll; ++ list_move(&fasync->list, &snd_fasync_list); ++ schedule_work(&snd_fasync_work); ++ spin_unlock_irqrestore(&snd_fasync_lock, flags); ++} ++EXPORT_SYMBOL_GPL(snd_kill_fasync); ++ ++void snd_fasync_free(struct snd_fasync *fasync) ++{ ++ if (!fasync) ++ return; ++ fasync->on = 0; ++ flush_work(&snd_fasync_work); ++ kfree(fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_free); +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 4920ec4f45948..f0e8b98f346ea 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -75,7 +75,7 @@ struct snd_timer_user { + unsigned int filter; + struct timespec tstamp; /* trigger tstamp */ + wait_queue_head_t qchange_sleep; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + struct mutex ioctl_lock; + }; + +@@ -1306,7 +1306,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, + } + __wake: + spin_unlock(&tu->qlock); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1343,7 +1343,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + spin_lock_irqsave(&tu->qlock, flags); + snd_timer_user_append_to_tqueue(tu, &r1); + spin_unlock_irqrestore(&tu->qlock, flags); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1410,7 +1410,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + spin_unlock(&tu->qlock); + if (append == 0) + return; +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1476,6 +1476,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) + if (tu->timeri) + snd_timer_close(tu->timeri); + mutex_unlock(&tu->ioctl_lock); ++ snd_fasync_free(tu->fasync); + kfree(tu->queue); + kfree(tu->tqueue); + kfree(tu); +@@ -2027,7 +2028,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on) + struct snd_timer_user *tu; + + tu = file->private_data; +- return fasync_helper(fd, file, on, &tu->fasync); ++ return snd_fasync_helper(fd, file, on, &tu->fasync); + } + + static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index a7f91be451946..5bd7b9b0e568d 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -409,6 +409,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = { + + /* codec SSID */ + SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122), ++ SND_PCI_QUIRK(0x106b, 0x0900, "iMac 12,1", CS420X_IMAC27_122), + SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81), + SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122), + SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101), +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index b4cd42643e1ef..b1a8ee8cf17e8 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -210,6 +210,7 @@ enum { + CXT_PINCFG_LEMOTE_A1205, + CXT_PINCFG_COMPAQ_CQ60, + CXT_FIXUP_STEREO_DMIC, ++ CXT_PINCFG_LENOVO_NOTEBOOK, + CXT_FIXUP_INC_MIC_BOOST, + CXT_FIXUP_HEADPHONE_MIC_PIN, + CXT_FIXUP_HEADPHONE_MIC, +@@ -750,6 +751,14 @@ static const struct hda_fixup cxt_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_stereo_dmic, + }, ++ [CXT_PINCFG_LENOVO_NOTEBOOK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1a, 0x05d71030 }, ++ { } ++ }, ++ .chain_id = CXT_FIXUP_STEREO_DMIC, ++ }, + [CXT_FIXUP_INC_MIC_BOOST] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt5066_increase_mic_boost, +@@ -943,7 +952,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), +diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c +index e172913d04a4a..efc5049c0796e 100644 +--- a/sound/soc/codecs/da7210.c ++++ b/sound/soc/codecs/da7210.c +@@ -1333,6 +1333,8 @@ static int __init da7210_modinit(void) + int ret = 0; + #if IS_ENABLED(CONFIG_I2C) + ret = i2c_add_driver(&da7210_i2c_driver); ++ if (ret) ++ return ret; + #endif + #if defined(CONFIG_SPI_MASTER) + ret = spi_register_driver(&da7210_spi_driver); +diff --git a/sound/soc/mediatek/mt6797/mt6797-mt6351.c b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +index b1558c57b9ca7..0c49e1a9a8971 100644 +--- a/sound/soc/mediatek/mt6797/mt6797-mt6351.c ++++ b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +@@ -179,7 +179,8 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for (i = 0; i < card->num_links; i++) { + if (mt6797_mt6351_dai_links[i].codec_name) +@@ -192,6 +193,9 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +index 242f99716c619..c37c962173d98 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +@@ -245,14 +245,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_codecs[1].of_node = + of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1); + if (!mt8173_rt5650_rt5676_codecs[1].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_codec_conf[0].of_node = + mt8173_rt5650_rt5676_codecs[1].of_node; +@@ -265,7 +267,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S].codec_of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + + card->dev = &pdev->dev; +@@ -275,6 +278,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_node: + of_node_put(platform_node); + return ret; + } +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +index 14011a70bcc41..8b613f8627fab 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +@@ -260,7 +260,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + mt8173_rt5650_codecs[1].of_node = mt8173_rt5650_codecs[0].of_node; + +@@ -272,7 +273,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "%s codec_capture_dai name fail %d\n", + __func__, ret); +- return ret; ++ goto put_platform_node; + } + mt8173_rt5650_codecs[1].dai_name = codec_capture_dai; + } +@@ -293,7 +294,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S].codec_of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + card->dev = &pdev->dev; + +@@ -302,6 +304,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_platform_node: + of_node_put(platform_node); + return ret; + } +diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c +index 932c3ebfd2524..01f9127daf5c8 100644 +--- a/sound/soc/qcom/qdsp6/q6adm.c ++++ b/sound/soc/qcom/qdsp6/q6adm.c +@@ -218,7 +218,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx) + idx = find_first_zero_bit(&adm->copp_bitmap[port_idx], + MAX_COPPS_PER_PORT); + +- if (idx > MAX_COPPS_PER_PORT) ++ if (idx >= MAX_COPPS_PER_PORT) + return ERR_PTR(-EBUSY); + + c = kzalloc(sizeof(*c), GFP_ATOMIC); +diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c +index d6c8b29fe430b..bdab5426aa170 100644 +--- a/sound/usb/bcd2000/bcd2000.c ++++ b/sound/usb/bcd2000/bcd2000.c +@@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k) + static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k, + struct usb_interface *interface) + { +- /* usb_kill_urb not necessary, urb is aborted automatically */ ++ usb_kill_urb(bcd2k->midi_out_urb); ++ usb_kill_urb(bcd2k->midi_in_urb); + + usb_free_urb(bcd2k->midi_out_urb); + usb_free_urb(bcd2k->midi_in_urb); +diff --git a/tools/build/feature/test-libcrypto.c b/tools/build/feature/test-libcrypto.c +index a98174e0569c8..bc34a5bbb5049 100644 +--- a/tools/build/feature/test-libcrypto.c ++++ b/tools/build/feature/test-libcrypto.c +@@ -1,16 +1,23 @@ + // SPDX-License-Identifier: GPL-2.0 ++#include <openssl/evp.h> + #include <openssl/sha.h> + #include <openssl/md5.h> + + int main(void) + { +- MD5_CTX context; ++ EVP_MD_CTX *mdctx; + unsigned char md[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH]; + unsigned char dat[] = "12345"; ++ unsigned int digest_len; + +- MD5_Init(&context); +- MD5_Update(&context, &dat[0], sizeof(dat)); +- MD5_Final(&md[0], &context); ++ mdctx = EVP_MD_CTX_new(); ++ if (!mdctx) ++ return 0; ++ ++ EVP_DigestInit_ex(mdctx, EVP_md5(), NULL); ++ EVP_DigestUpdate(mdctx, &dat[0], sizeof(dat)); ++ EVP_DigestFinal_ex(mdctx, &md[0], &digest_len); ++ EVP_MD_CTX_free(mdctx); + + SHA1(&dat[0], sizeof(dat), &md[0]); + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 249fa8d7376e3..76cf63705c86a 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1060,7 +1060,7 @@ static int bpf_map_find_btf_info(struct bpf_map *map, const struct btf *btf) + int bpf_map__reuse_fd(struct bpf_map *map, int fd) + { + struct bpf_map_info info = {}; +- __u32 len = sizeof(info); ++ __u32 len = sizeof(info), name_len; + int new_fd, err; + char *new_name; + +@@ -1068,7 +1068,12 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + if (err) + return err; + +- new_name = strdup(info.name); ++ name_len = strlen(info.name); ++ if (name_len == BPF_OBJ_NAME_LEN - 1 && strncmp(map->name, info.name, name_len) == 0) ++ new_name = strdup(map->name); ++ else ++ new_name = strdup(info.name); ++ + if (!new_name) + return -errno; + +diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c +index aafbe54fd3fae..afb8fe3a8e353 100644 +--- a/tools/perf/util/genelf.c ++++ b/tools/perf/util/genelf.c +@@ -35,7 +35,11 @@ + + #define BUILD_ID_URANDOM /* different uuid for each run */ + +-#ifdef HAVE_LIBCRYPTO ++// FIXME, remove this and fix the deprecation warnings before its removed and ++// We'll break for good here... ++#pragma GCC diagnostic ignored "-Wdeprecated-declarations" ++ ++#ifdef HAVE_LIBCRYPTO_SUPPORT + + #define BUILD_ID_MD5 + #undef BUILD_ID_SHA /* does not seem to work well when linked with Java */ +diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c +index bfc974b4572d5..c18313a5f357b 100644 +--- a/tools/testing/selftests/timers/clocksource-switch.c ++++ b/tools/testing/selftests/timers/clocksource-switch.c +@@ -110,10 +110,10 @@ int run_tests(int secs) + + sprintf(buf, "./inconsistency-check -t %i", secs); + ret = system(buf); +- if (ret) +- return ret; ++ if (WIFEXITED(ret) && WEXITSTATUS(ret)) ++ return WEXITSTATUS(ret); + ret = system("./nanosleep"); +- return ret; ++ return WIFEXITED(ret) ? WEXITSTATUS(ret) : 0; + } + + +diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c +index 5397de708d3c2..48b9a803235a8 100644 +--- a/tools/testing/selftests/timers/valid-adjtimex.c ++++ b/tools/testing/selftests/timers/valid-adjtimex.c +@@ -40,7 +40,7 @@ + #define ADJ_SETOFFSET 0x0100 + + #include <sys/syscall.h> +-static int clock_adjtime(clockid_t id, struct timex *tx) ++int clock_adjtime(clockid_t id, struct timex *tx) + { + return syscall(__NR_clock_adjtime, id, tx); + } +diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c +index 18f523557983b..1b17cbc54c9d7 100644 +--- a/tools/thermal/tmon/sysfs.c ++++ b/tools/thermal/tmon/sysfs.c +@@ -22,6 +22,7 @@ + #include <stdint.h> + #include <dirent.h> + #include <libintl.h> ++#include <limits.h> + #include <ctype.h> + #include <time.h> + #include <syslog.h> +@@ -42,9 +43,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned long val) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "w"); + if (!fd) { +@@ -66,9 +67,9 @@ static int sysfs_get_ulong(char *path, char *filename, unsigned long *p_ulong) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -85,9 +86,9 @@ static int sysfs_get_string(char *path, char *filename, char *str) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -208,8 +209,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + { + unsigned long trip_instance = 0; + char cdev_name_linked[256]; +- char cdev_name[256]; +- char cdev_trip_name[256]; ++ char cdev_name[PATH_MAX]; ++ char cdev_trip_name[PATH_MAX]; + int cdev_id; + + if (nl->d_type == DT_LNK) { +@@ -222,7 +223,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + return -EINVAL; + } + /* find the link to real cooling device record binding */ +- snprintf(cdev_name, 256, "%s/%s", tz_name, nl->d_name); ++ snprintf(cdev_name, sizeof(cdev_name) - 2, "%s/%s", ++ tz_name, nl->d_name); + memset(cdev_name_linked, 0, sizeof(cdev_name_linked)); + if (readlink(cdev_name, cdev_name_linked, + sizeof(cdev_name_linked) - 1) != -1) { +@@ -235,8 +237,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + /* find the trip point in which the cdev is binded to + * in this tzone + */ +- snprintf(cdev_trip_name, 256, "%s%s", nl->d_name, +- "_trip_point"); ++ snprintf(cdev_trip_name, sizeof(cdev_trip_name) - 1, ++ "%s%s", nl->d_name, "_trip_point"); + sysfs_get_ulong(tz_name, cdev_trip_name, + &trip_instance); + /* validate trip point range, e.g. trip could return -1 +diff --git a/tools/thermal/tmon/tmon.h b/tools/thermal/tmon/tmon.h +index 9e3c49c547ac8..7b090a6c95b69 100644 +--- a/tools/thermal/tmon/tmon.h ++++ b/tools/thermal/tmon/tmon.h +@@ -36,6 +36,9 @@ + #define NR_LINES_TZDATA 1 + #define TMON_LOG_FILE "/var/tmp/tmon.log" + ++#include <sys/time.h> ++#include <pthread.h> ++ + extern unsigned long ticktime; + extern double time_elapsed; + extern unsigned long target_temp_user; +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 3d45ce1342278..6f9c0060a3e59 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2820,7 +2820,7 @@ static long kvm_vcpu_ioctl(struct file *filp, + struct kvm_fpu *fpu = NULL; + struct kvm_sregs *kvm_sregs = NULL; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) +@@ -3026,7 +3026,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp, + void __user *argp = compat_ptr(arg); + int r; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3081,7 +3081,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, + { + struct kvm_device *dev = filp->private_data; + +- if (dev->kvm->mm != current->mm) ++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3244,7 +3244,7 @@ static long kvm_vm_ioctl(struct file *filp, + void __user *argp = (void __user *)arg; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_CREATE_VCPU: +@@ -3422,7 +3422,7 @@ static long kvm_vm_compat_ioctl(struct file *filp, + struct kvm *kvm = filp->private_data; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_GET_DIRTY_LOG: { |