diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2019-12-21 09:51:35 -0500 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2019-12-21 09:51:35 -0500 |
| commit | 534c857143b094887cd8279fc88228a9efdfd4cd (patch) | |
| tree | d88a012ac1dd08dbbce72b40df525649b45a50ab | |
| parent | Linux patch 4.4.206 (diff) | |
| download | linux-patches-534c857143b094887cd8279fc88228a9efdfd4cd.tar.gz linux-patches-534c857143b094887cd8279fc88228a9efdfd4cd.tar.bz2 linux-patches-534c857143b094887cd8279fc88228a9efdfd4cd.zip | |
Linux patch 4.4.2074.4-208
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 8 | ||||
| -rw-r--r-- | 1206_linux-4.4.207.patch | 4561 |
2 files changed, 4567 insertions, 2 deletions
diff --git a/0000_README b/0000_README index 56d20ec5..b0c84185 100644 --- a/0000_README +++ b/0000_README @@ -861,11 +861,15 @@ Desc: Linux 4.4.204 Patch: 1204_linux-4.4.205.patch From: http://www.kernel.org -Desc: Linux 4.4.204 +Desc: Linux 4.4.205 Patch: 1205_linux-4.4.206.patch From: http://www.kernel.org -Desc: Linux 4.4.204 +Desc: Linux 4.4.206 + +Patch: 1206_linux-4.4.207.patch +From: http://www.kernel.org +Desc: Linux 4.4.207 Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 diff --git a/1206_linux-4.4.207.patch b/1206_linux-4.4.207.patch new file mode 100644 index 00000000..c524fff5 --- /dev/null +++ b/1206_linux-4.4.207.patch @@ -0,0 +1,4561 @@ +diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +index be789685a1c2..18b892d010d8 100644 +--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt ++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +@@ -27,4 +27,4 @@ and valid to enable charging: + + - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V) + - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output +- resistor, the other values are in ohm. ++ resistor, the other values are in kOhm. +diff --git a/Makefile b/Makefile +index eb4f5b889a1c..4857306a8e4c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 206 ++SUBLEVEL = 207 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -1424,9 +1424,6 @@ else # KBUILD_EXTMOD + + # We are always building modules + KBUILD_MODULES := 1 +-PHONY += crmodverdir +-crmodverdir: +- $(cmd_crmodverdir) + + PHONY += $(objtree)/Module.symvers + $(objtree)/Module.symvers: +@@ -1438,7 +1435,7 @@ $(objtree)/Module.symvers: + + module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD)) + PHONY += $(module-dirs) modules +-$(module-dirs): crmodverdir $(objtree)/Module.symvers ++$(module-dirs): prepare $(objtree)/Module.symvers + $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) + + modules: $(module-dirs) +@@ -1478,7 +1475,8 @@ help: + + # Dummies... + PHONY += prepare scripts +-prepare: ; ++prepare: ++ $(cmd_crmodverdir) + scripts: ; + endif # KBUILD_EXTMOD + +@@ -1602,17 +1600,14 @@ endif + + # Modules + /: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + # Make sure the latest headers are built for Documentation + Documentation/: headers_install + %/: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + %.ko: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) $(@:.ko=.o) + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost +diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi +index e81a27214188..cbe3507e6e24 100644 +--- a/arch/arm/boot/dts/exynos3250.dtsi ++++ b/arch/arm/boot/dts/exynos3250.dtsi +@@ -325,7 +325,7 @@ + }; + + hsotg: hsotg@12480000 { +- compatible = "snps,dwc2"; ++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2"; + reg = <0x12480000 0x20000>; + interrupts = <0 141 0>; + clocks = <&cmu CLK_USBOTG>; +diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi +index 47e5b63339d1..e95deed6a797 100644 +--- a/arch/arm/boot/dts/mmp2.dtsi ++++ b/arch/arm/boot/dts/mmp2.dtsi +@@ -180,7 +180,7 @@ + clocks = <&soc_clocks MMP2_CLK_GPIO>; + resets = <&soc_clocks MMP2_CLK_GPIO>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + ranges; + + gcb0: gpio@d4019000 { +diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi +index ae5dbbd9d569..4f10204c0994 100644 +--- a/arch/arm/boot/dts/omap3-tao3530.dtsi ++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi +@@ -225,7 +225,7 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + vmmc_aux-supply = <&vsim>; +- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; + bus-width = <8>; + }; + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 4448505e34d3..e1a8466b77a4 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -27,7 +27,7 @@ + clocks = <&clks CLK_NONE>; + }; + +- pxa27x_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi +index 5e5af078b9b5..7343115c6d55 100644 +--- a/arch/arm/boot/dts/pxa2xx.dtsi ++++ b/arch/arm/boot/dts/pxa2xx.dtsi +@@ -117,13 +117,6 @@ + status = "disabled"; + }; + +- usb0: ohci@4c000000 { +- compatible = "marvell,pxa-ohci"; +- reg = <0x4c000000 0x10000>; +- interrupts = <3>; +- status = "disabled"; +- }; +- + mmc0: mmc@41100000 { + compatible = "marvell,pxa-mmc"; + reg = <0x41100000 0x1000>; +diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi +index fec47bcd8292..c714e583e5c7 100644 +--- a/arch/arm/boot/dts/pxa3xx.dtsi ++++ b/arch/arm/boot/dts/pxa3xx.dtsi +@@ -88,7 +88,7 @@ + status = "disabled"; + }; + +- pxa3xx_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index a25debb50401..61716fa07dcc 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -167,6 +167,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/boot/dts/s3c6410-smdk6410.dts b/arch/arm/boot/dts/s3c6410-smdk6410.dts +index ecf35ec466f7..7ade1a0686d2 100644 +--- a/arch/arm/boot/dts/s3c6410-smdk6410.dts ++++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts +@@ -71,6 +71,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi +index b6ad7850fac6..698970d0281f 100644 +--- a/arch/arm/boot/dts/sun6i-a31.dtsi ++++ b/arch/arm/boot/dts/sun6i-a31.dtsi +@@ -167,7 +167,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>, +diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi +index e02eb720c4fc..a7b4dbda1a87 100644 +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -167,7 +167,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>; + }; +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 9ae610bf5234..61479ebb9869 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -387,6 +387,13 @@ do { \ + #define __get_user_asm_byte(x, addr, err) \ + __get_user_asm(x, addr, err, ldrb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __get_user_asm_half(x, addr, err) \ ++ __get_user_asm(x, addr, err, ldrh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __get_user_asm_half(x, __gu_addr, err) \ + ({ \ +@@ -405,6 +412,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __get_user_asm_word(x, addr, err) \ + __get_user_asm(x, addr, err, ldr) + #endif +@@ -480,6 +489,13 @@ do { \ + #define __put_user_asm_byte(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, strb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __put_user_asm_half(x, __pu_addr, err) \ ++ __put_user_asm(x, __pu_addr, err, strh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __put_user_asm_half(x, __pu_addr, err) \ + ({ \ +@@ -496,6 +512,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __put_user_asm_word(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, str) + +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index 746e7801dcdf..b2e4bc3a635e 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1) + + ENTRY(__get_user_2) + check_uaccess r0, 2, r1, r2, __get_user_bad ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(ldrh) r2, [r0] ++ ++#else ++ + #ifdef CONFIG_CPU_USE_DOMAINS + rb .req ip + 2: ldrbt r2, [r0], #1 +@@ -56,6 +62,9 @@ rb .req r0 + #else + orr r2, rb, r2, lsl #8 + #endif ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + mov r0, #0 + ret lr + ENDPROC(__get_user_2) +@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8) + .pushsection __ex_table, "a" + .long 1b, __get_user_bad + .long 2b, __get_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __get_user_bad ++#endif + .long 4b, __get_user_bad + .long 5b, __get_user_bad8 + .long 6b, __get_user_bad8 +diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S +index 38d660d3705f..515eeaa9975c 100644 +--- a/arch/arm/lib/putuser.S ++++ b/arch/arm/lib/putuser.S +@@ -41,16 +41,13 @@ ENDPROC(__put_user_1) + + ENTRY(__put_user_2) + check_uaccess r0, 2, r1, ip, __put_user_bad +- mov ip, r2, lsr #8 +-#ifdef CONFIG_THUMB2_KERNEL +-#ifndef __ARMEB__ +-2: TUSER(strb) r2, [r0] +-3: TUSER(strb) ip, [r0, #1] ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(strh) r2, [r0] ++ + #else +-2: TUSER(strb) ip, [r0] +-3: TUSER(strb) r2, [r0, #1] +-#endif +-#else /* !CONFIG_THUMB2_KERNEL */ ++ ++ mov ip, r2, lsr #8 + #ifndef __ARMEB__ + 2: TUSER(strb) r2, [r0], #1 + 3: TUSER(strb) ip, [r0] +@@ -58,7 +55,8 @@ ENTRY(__put_user_2) + 2: TUSER(strb) ip, [r0], #1 + 3: TUSER(strb) r2, [r0] + #endif +-#endif /* CONFIG_THUMB2_KERNEL */ ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ + mov r0, #0 + ret lr + ENDPROC(__put_user_2) +@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad) + .pushsection __ex_table, "a" + .long 1b, __put_user_bad + .long 2b, __put_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __put_user_bad ++#endif + .long 4b, __put_user_bad + .long 5b, __put_user_bad + .long 6b, __put_user_bad +diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c +index 52de382fc804..7e49dfda3d2f 100644 +--- a/arch/arm/mach-omap1/id.c ++++ b/arch/arm/mach-omap1/id.c +@@ -200,10 +200,10 @@ void __init omap_check_revision(void) + printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type); + } + +- printk(KERN_INFO "OMAP%04x", omap_revision >> 16); ++ pr_info("OMAP%04x", omap_revision >> 16); + if ((omap_revision >> 8) & 0xff) +- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff); +- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n", ++ pr_cont("%x", (omap_revision >> 8) & 0xff); ++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n", + die_rev, omap_revision & 0xff, system_serial_low, + system_serial_high); + } +diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c +index 8a2ae82cb227..9651872a9e09 100644 +--- a/arch/arm/mach-omap2/id.c ++++ b/arch/arm/mach-omap2/id.c +@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void) + + pr_info("%s", soc_name); + if ((omap_rev() >> 8) & 0x0f) +- pr_info("%s", soc_rev); +- pr_info("\n"); ++ pr_cont("%s", soc_rev); ++ pr_cont("\n"); + } + + #define OMAP3_SHOW_FEATURE(feat) \ +diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S +index e3070fdab80b..3fe4ae654047 100644 +--- a/arch/arm/mach-tegra/reset-handler.S ++++ b/arch/arm/mach-tegra/reset-handler.S +@@ -56,16 +56,16 @@ ENTRY(tegra_resume) + cmp r6, #TEGRA20 + beq 1f @ Yes + /* Clear the flow controller flags for this CPU. */ +- cpu_to_csr_reg r1, r0 ++ cpu_to_csr_reg r3, r0 + mov32 r2, TEGRA_FLOW_CTRL_BASE +- ldr r1, [r2, r1] ++ ldr r1, [r2, r3] + /* Clear event & intr flag */ + orr r1, r1, \ + #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG + movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps + @ & ext flags for CPU power mgnt + bic r1, r1, r0 +- str r1, [r2] ++ str r1, [r2, r3] + 1: + + mov32 r9, 0xc09 +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 422624ca0132..596cbda9cb3d 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -773,6 +773,7 @@ config SIBYTE_LITTLESUR + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_SUPPORTS_HIGHMEM + select SYS_SUPPORTS_LITTLE_ENDIAN ++ select ZONE_DMA32 if 64BIT + + config SIBYTE_SENTOSA + bool "Sibyte BCM91250E-Sentosa" +diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +index 8241fc6aa17d..3839feba68f2 100644 +--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c ++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id) + } else { + union cvmx_pko_mem_debug8 debug8; + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- return debug8.cn58xx.doorbell; ++ return debug8.cn50xx.doorbell; + } + case CVMX_CMD_QUEUE_ZIP: + case CVMX_CMD_QUEUE_DFA: +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 6df3a4ea77fc..a56620cb7cad 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -485,7 +485,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr) + if (phy_addr >= 256 && alt_phy > 0) { + const struct fdt_property *phy_prop; + struct fdt_property *alt_prop; +- u32 phy_handle_name; ++ fdt32_t phy_handle_name; + + /* Use the alt phy node instead.*/ + phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL); +diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h +index 5f47f76ed510..20eb9c46a75a 100644 +--- a/arch/mips/include/asm/octeon/cvmx-pko.h ++++ b/arch/mips/include/asm/octeon/cvmx-pko.h +@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear, + pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num); + cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64); + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- status->doorbell = debug8.cn58xx.doorbell; ++ status->doorbell = debug8.cn50xx.doorbell; + } + } + +diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h +index d89beaba26ff..8b957aabb826 100644 +--- a/arch/powerpc/include/asm/sfp-machine.h ++++ b/arch/powerpc/include/asm/sfp-machine.h +@@ -213,30 +213,18 @@ + * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow + * (i.e. carry out) is not stored anywhere, and is lost. + */ +-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ ++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ + else \ +- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \ + } while (0) + + /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to +@@ -248,44 +236,24 @@ + * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere, + * and is lost. + */ +-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ ++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (ah) && (ah) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ + else if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ + else \ +- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \ + } while (0) + + /* asm fragments for mul and div */ +@@ -294,13 +262,10 @@ + * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype + * word product in HIGH_PROD and LOW_PROD. + */ +-#define umul_ppmm(ph, pl, m0, m1) \ ++#define umul_ppmm(ph, pl, m0, m1) \ + do { \ + USItype __m0 = (m0), __m1 = (m1); \ +- __asm__ ("mulhwu %0,%1,%2" \ +- : "=r" ((USItype)(ph)) \ +- : "%r" (__m0), \ +- "r" (__m1)); \ ++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \ + (pl) = __m0 * __m1; \ + } while (0) + +@@ -312,9 +277,10 @@ + * significant bit of DENOMINATOR must be 1, then the pre-processor symbol + * UDIV_NEEDS_NORMALIZATION is defined to 1. + */ +-#define udiv_qrnnd(q, r, n1, n0, d) \ ++#define udiv_qrnnd(q, r, n1, n0, d) \ + do { \ +- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \ ++ UWtype __d1, __d0, __q1, __q0; \ ++ UWtype __r1, __r0, __m; \ + __d1 = __ll_highpart (d); \ + __d0 = __ll_lowpart (d); \ + \ +@@ -325,7 +291,7 @@ + if (__r1 < __m) \ + { \ + __q1--, __r1 += (d); \ +- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \ ++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\ + if (__r1 < __m) \ + __q1--, __r1 += (d); \ + } \ +diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h +index b73a8199f161..5c2e1a28a981 100644 +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -86,6 +86,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +@@ -107,6 +108,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 dcache_block_size; /* L1 d-cache block size */ + __u32 icache_block_size; /* L1 i-cache block size */ +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index de3c29c51503..b9ab319bf2bd 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -398,6 +398,7 @@ int main(void) + DEFINE(WTOM_CLOCK_NSEC, offsetof(struct vdso_data, wtom_clock_nsec)); + DEFINE(STAMP_XTIME, offsetof(struct vdso_data, stamp_xtime)); + DEFINE(STAMP_SEC_FRAC, offsetof(struct vdso_data, stamp_sec_fraction)); ++ DEFINE(CLOCK_HRTIMER_RES, offsetof(struct vdso_data, hrtimer_res)); + DEFINE(CFG_ICACHE_BLOCKSZ, offsetof(struct vdso_data, icache_block_size)); + DEFINE(CFG_DCACHE_BLOCKSZ, offsetof(struct vdso_data, dcache_block_size)); + DEFINE(CFG_ICACHE_LOGBLOCKSZ, offsetof(struct vdso_data, icache_log_block_size)); +@@ -426,7 +427,6 @@ int main(void) + DEFINE(CLOCK_REALTIME, CLOCK_REALTIME); + DEFINE(CLOCK_MONOTONIC, CLOCK_MONOTONIC); + DEFINE(NSEC_PER_SEC, NSEC_PER_SEC); +- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC); + + #ifdef CONFIG_BUG + DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry)); +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 9baba9576e99..2e9cae5f8d17 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -829,6 +829,7 @@ void update_vsyscall_old(struct timespec *wall_time, struct timespec *wtm, + vdso_data->wtom_clock_nsec = wtm->tv_nsec; + vdso_data->stamp_xtime = *wall_time; + vdso_data->stamp_sec_fraction = frac_sec; ++ vdso_data->hrtimer_res = hrtimer_resolution; + smp_wmb(); + ++(vdso_data->tb_update_count); + } +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index 7b341b86216c..9b24466570c8 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -160,12 +160,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl __get_datapage@local /* get data page */ ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpli cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + stw r3,TSPC32_TV_SEC(r4) + stw r5,TSPC32_TV_NSEC(r4) + blr +diff --git a/arch/powerpc/kernel/vdso64/cacheflush.S b/arch/powerpc/kernel/vdso64/cacheflush.S +index 69c5af2b3c96..228a4a2383d6 100644 +--- a/arch/powerpc/kernel/vdso64/cacheflush.S ++++ b/arch/powerpc/kernel/vdso64/cacheflush.S +@@ -39,7 +39,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +@@ -56,7 +56,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index 09b2a49f6dd5..c973378e1f2b 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -145,12 +145,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl V_LOCAL_FUNC(__get_datapage) ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + std r3,TSPC64_TV_SEC(r4) + std r5,TSPC64_TV_NSEC(r4) + blr +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index be3d4dcf3a10..4dcf71c26d64 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1298,16 +1298,21 @@ void setup_local_APIC(void) + apic->init_apic_ldr(); + + #ifdef CONFIG_X86_32 +- /* +- * APIC LDR is initialized. If logical_apicid mapping was +- * initialized during get_smp_config(), make sure it matches the +- * actual value. +- */ +- i = early_per_cpu(x86_cpu_to_logical_apicid, cpu); +- WARN_ON(i != BAD_APICID && i != logical_smp_processor_id()); +- /* always use the value from LDR */ +- early_per_cpu(x86_cpu_to_logical_apicid, cpu) = +- logical_smp_processor_id(); ++ if (apic->dest_logical) { ++ int logical_apicid, ldr_apicid; ++ ++ /* ++ * APIC LDR is initialized. If logical_apicid mapping was ++ * initialized during get_smp_config(), make sure it matches ++ * the actual value. ++ */ ++ logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu); ++ ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR)); ++ if (logical_apicid != BAD_APICID) ++ WARN_ON(logical_apicid != ldr_apicid); ++ /* Always use the value from LDR. */ ++ early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid; ++ } + #endif + + /* +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 4b9cfdcc3aaa..605395bbf0d8 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1536,11 +1536,10 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c) + mce_flags.overflow_recov = 1; + + /* +- * Turn off MC4_MISC thresholding banks on those models since ++ * Turn off MC4_MISC thresholding banks on all models since + * they're not supported there. + */ +- if (c->x86 == 0x15 && +- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) { ++ if (c->x86 == 0x15) { + int i; + u64 hwcr; + bool need_toggle; +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 40e415fedcee..f4795f5c579d 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -373,7 +373,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + + r = -E2BIG; + +- if (*nent >= maxnent) ++ if (WARN_ON(*nent >= maxnent)) + goto out; + + do_cpuid_1_ent(entry, function, index); +@@ -669,6 +669,9 @@ out: + static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func, + u32 idx, int *nent, int maxnent, unsigned int type) + { ++ if (*nent >= maxnent) ++ return -E2BIG; ++ + if (type == KVM_GET_EMULATED_CPUID) + return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent); + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 3b711cd261d7..df7ccee4e3fd 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -260,13 +260,14 @@ int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) + struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); + int err; + +- if (((value ^ smsr->values[slot].curr) & mask) == 0) ++ value = (value & mask) | (smsr->values[slot].host & ~mask); ++ if (value == smsr->values[slot].curr) + return 0; +- smsr->values[slot].curr = value; + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); + if (err) + return 1; + ++ smsr->values[slot].curr = value; + if (!smsr->registered) { + smsr->urn.on_user_return = kvm_on_user_return; + user_return_notifier_register(&smsr->urn); +@@ -1023,10 +1024,15 @@ u64 kvm_get_arch_capabilities(void) + * If TSX is disabled on the system, guests are also mitigated against + * TAA and clear CPU buffer mitigation is not required for guests. + */ +- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && +- (data & ARCH_CAP_TSX_CTRL_MSR)) ++ if (!boot_cpu_has(X86_FEATURE_RTM)) ++ data &= ~ARCH_CAP_TAA_NO; ++ else if (!boot_cpu_has_bug(X86_BUG_TAA)) ++ data |= ARCH_CAP_TAA_NO; ++ else if (data & ARCH_CAP_TSX_CTRL_MSR) + data &= ~ARCH_CAP_MDS_NO; + ++ /* KVM does not emulate MSR_IA32_TSX_CTRL. */ ++ data &= ~ARCH_CAP_TSX_CTRL_MSR; + return data; + } + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 89f90549c6a8..c05b57e2edb0 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -541,6 +541,17 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); + ++/* ++ * Device [1022:7914] ++ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device. ++ */ ++static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n"); ++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme); ++ + /* + * Broadwell EP Home Agent BARs erroneously return non-zero values when read. + * +diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c +index 5ece856c5725..23d634916de9 100644 +--- a/arch/xtensa/mm/tlb.c ++++ b/arch/xtensa/mm/tlb.c +@@ -218,6 +218,8 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + unsigned tlbidx = w | (e << PAGE_SHIFT); + unsigned r0 = dtlb ? + read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx); ++ unsigned r1 = dtlb ? ++ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx); + unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT); + unsigned pte = get_pte_for_vaddr(vpn); + unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK; +@@ -233,8 +235,6 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + } + + if (tlb_asid == mm_asid) { +- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) : +- read_itlb_translation(tlbidx); + if ((pte ^ r1) & PAGE_MASK) { + pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n", + dtlb ? 'D' : 'I', w, e, r0, r1, pte); +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 1cf18784c5cf..36a43ed75c9a 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -231,20 +231,25 @@ static ssize_t blk_mq_hw_sysfs_active_show(struct blk_mq_hw_ctx *hctx, char *pag + + static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) + { ++ const size_t size = PAGE_SIZE - 1; + unsigned int i, first = 1; +- ssize_t ret = 0; ++ int ret = 0, pos = 0; + + for_each_cpu(i, hctx->cpumask) { + if (first) +- ret += sprintf(ret + page, "%u", i); ++ ret = snprintf(pos + page, size - pos, "%u", i); + else +- ret += sprintf(ret + page, ", %u", i); ++ ret = snprintf(pos + page, size - pos, ", %u", i); ++ ++ if (ret >= size - pos) ++ break; + + first = 0; ++ pos += ret; + } + +- ret += sprintf(ret + page, "\n"); +- return ret; ++ ret = snprintf(pos + page, size + 1 - pos, "\n"); ++ return pos + ret; + } + + static struct blk_mq_ctx_sysfs_entry blk_mq_sysfs_dispatched = { +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index f18dc2d045c2..b6ea45367f38 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -249,8 +249,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, + drop_alg: + crypto_mod_put(alg); + +- if (err) ++ if (err) { ++ kfree_skb(skb); + return err; ++ } + + return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); + } +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index ca4f28432d87..521d1b28760c 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -154,7 +154,7 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data) + { + acpi_status status; + +- if (!*data) ++ if (!data) + return -EINVAL; + + status = acpi_get_data(handle, acpi_bus_private_data_handler, data); +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index 08a02cdc737c..829b20a3bb0a 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -1094,9 +1094,19 @@ static void acpi_dev_pm_detach(struct device *dev, bool power_off) + */ + int acpi_dev_pm_attach(struct device *dev, bool power_on) + { ++ /* ++ * Skip devices whose ACPI companions match the device IDs below, ++ * because they require special power management handling incompatible ++ * with the generic ACPI PM domain. ++ */ ++ static const struct acpi_device_id special_pm_ids[] = { ++ {"PNP0C0B", }, /* Generic ACPI fan */ ++ {"INT3404", }, /* Fan */ ++ {} ++ }; + struct acpi_device *adev = ACPI_COMPANION(dev); + +- if (!adev) ++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids)) + return -ENODEV; + + if (dev->pm_domain) +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index e59f50576f2a..37ee2af0c156 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -424,24 +424,27 @@ acpi_os_map_memory(acpi_physical_address phys, acpi_size size) + } + EXPORT_SYMBOL_GPL(acpi_os_map_memory); + +-static void acpi_os_drop_map_ref(struct acpi_ioremap *map) ++/* Must be called with mutex_lock(&acpi_ioremap_lock) */ ++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) + { +- if (!--map->refcount) ++ unsigned long refcount = --map->refcount; ++ ++ if (!refcount) + list_del_rcu(&map->list); ++ return refcount; + } + + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { +- if (!map->refcount) { +- synchronize_rcu_expedited(); +- acpi_unmap(map->phys, map->virt); +- kfree(map); +- } ++ synchronize_rcu_expedited(); ++ acpi_unmap(map->phys, map->virt); ++ kfree(map); + } + + void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + { + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (!acpi_gbl_permanent_mmap) { + __acpi_unmap_table(virt, size); +@@ -455,10 +458,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); + +@@ -499,6 +503,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + { + u64 addr; + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) + return; +@@ -514,10 +519,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + mutex_unlock(&acpi_ioremap_lock); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL(acpi_os_unmap_generic_address); + +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index d8b2488aaade..620a3a67cdd5 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -1028,8 +1028,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) + + cancel_work_sync(&card->event_work); + ++ destroy_workqueue(card->event_wq); + rsxx_destroy_dev(card); + rsxx_dma_destroy(card); ++ destroy_workqueue(card->creg_ctrl.creg_wq); + + spin_lock_irqsave(&card->irq_lock, flags); + rsxx_disable_ier_and_isr(card, CR_INTR_ALL); +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index fe728f8dcbe4..4051782b6f84 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -329,8 +329,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + RK2928_CLKGATE_CON(2), 5, GFLAGS), + MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT, + RK2928_CLKSEL_CON(21), 4, 1, MFLAGS), +- GATE(0, "sclk_mac_lbtest", "sclk_macref", +- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS), ++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0, ++ RK2928_CLKGATE_CON(2), 12, GFLAGS), + + COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0, + RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS, +@@ -360,8 +360,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + * Clock-Architecture Diagram 4 + */ + +- GATE(SCLK_SMC, "sclk_smc", "hclk_peri", +- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS), ++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0, ++ RK2928_CLKGATE_CON(2), 4, GFLAGS), + + COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0, + RK2928_CLKSEL_CON(25), 0, 7, DFLAGS, +diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c +index 389ade4572be..2ab396fe8b47 100644 +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -60,24 +60,23 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv) + * __cpuidle_set_driver - set per CPU driver variables for the given driver. + * @drv: a valid pointer to a struct cpuidle_driver + * +- * For each CPU in the driver's cpumask, unset the registered driver per CPU +- * to @drv. +- * +- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. ++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver ++ * different from drv already. + */ + static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) + { + int cpu; + + for_each_cpu(cpu, drv->cpumask) { ++ struct cpuidle_driver *old_drv; + +- if (__cpuidle_get_cpu_driver(cpu)) { +- __cpuidle_unset_driver(drv); ++ old_drv = __cpuidle_get_cpu_driver(cpu); ++ if (old_drv && old_drv != drv) + return -EBUSY; +- } ++ } + ++ for_each_cpu(cpu, drv->cpumask) + per_cpu(cpuidle_drivers, cpu) = drv; +- } + + return 0; + } +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 78d0722feacb..3027600378de 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -399,12 +399,8 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) + dma_alloc_coherent(dev->core_dev->device, + dev->scatter_buffer_size * PPC4XX_NUM_SD, + &dev->scatter_buffer_pa, GFP_ATOMIC); +- if (!dev->scatter_buffer_va) { +- dma_free_coherent(dev->core_dev->device, +- sizeof(struct ce_sd) * PPC4XX_NUM_SD, +- dev->sdr, dev->sdr_pa); ++ if (!dev->scatter_buffer_va) + return -ENOMEM; +- } + + sd_array = dev->sdr; + +diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c +index c340ca9bd2b5..4746fee4cd48 100644 +--- a/drivers/dma/coh901318.c ++++ b/drivers/dma/coh901318.c +@@ -1810,13 +1810,10 @@ static struct dma_chan *coh901318_xlate(struct of_phandle_args *dma_spec, + static int coh901318_config(struct coh901318_chan *cohc, + struct coh901318_params *param) + { +- unsigned long flags; + const struct coh901318_params *p; + int channel = cohc->id; + void __iomem *virtbase = cohc->base->virtbase; + +- spin_lock_irqsave(&cohc->lock, flags); +- + if (param) + p = param; + else +@@ -1836,8 +1833,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + coh901318_set_conf(cohc, p->config); + coh901318_set_ctrl(cohc, p->ctrl_lli_last); + +- spin_unlock_irqrestore(&cohc->lock, flags); +- + return 0; + } + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index b2b13b3dce14..3d6b42f61f56 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -320,12 +320,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info, + { + int ret = 0; + +- if (usb_type == MAX8997_USB_HOST) { +- ret = max8997_muic_set_path(info, info->path_usb, attached); +- if (ret < 0) { +- dev_err(info->dev, "failed to update muic register\n"); +- return ret; +- } ++ ret = max8997_muic_set_path(info, info->path_usb, attached); ++ if (ret < 0) { ++ dev_err(info->dev, "failed to update muic register\n"); ++ return ret; + } + + switch (usb_type) { +diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c +index d91856779beb..70de29f4e2b4 100644 +--- a/drivers/gpu/drm/i810/i810_dma.c ++++ b/drivers/gpu/drm/i810/i810_dma.c +@@ -723,7 +723,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev, + if (nbox > I810_NR_SAREA_CLIPRECTS) + nbox = I810_NR_SAREA_CLIPRECTS; + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + if (sarea_priv->dirty) +@@ -1043,7 +1043,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in + if (u != I810_BUF_CLIENT) + DRM_DEBUG("MC found buffer that isn't mine!\n"); + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + sarea_priv->dirty = 0x7f; +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c +index 9e7e2bf03b81..d2ecdce38fec 100644 +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -1826,8 +1826,8 @@ static int r100_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE) + track->textures[i].tex_coord_type = 2; +diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c +index c70e6d5bcd19..8aa3772e935f 100644 +--- a/drivers/gpu/drm/radeon/r200.c ++++ b/drivers/gpu/drm/radeon/r200.c +@@ -476,8 +476,8 @@ int r200_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE) + track->textures[i].lookup_disable = true; +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index cf1b57a054d0..d121c5732d7d 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1076,7 +1076,8 @@ static int i2c_imx_probe(struct platform_device *pdev) + /* Get I2C clock */ + i2c_imx->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(i2c_imx->clk)) { +- dev_err(&pdev->dev, "can't get I2C clock\n"); ++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "can't get I2C clock\n"); + return PTR_ERR(i2c_imx->clk); + } + +diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c +index dc5e7e70f951..7731e0f1e104 100644 +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -215,7 +215,7 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev, + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 100; ++ *val = 100000; + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index 778a46247f8d..eeed374ebc6c 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = { + .write_raw = &adis16480_write_raw, + .update_scan_mode = adis_update_scan_mode, + .driver_module = THIS_MODULE, ++ .debugfs_reg_access = adis_debugfs_reg_access, + }; + + static int adis16480_stop_device(struct iio_dev *indio_dev) +diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c +index 69fb5ba94d0f..19caacd26f61 100644 +--- a/drivers/infiniband/hw/mlx4/sysfs.c ++++ b/drivers/infiniband/hw/mlx4/sysfs.c +@@ -352,16 +352,12 @@ err: + + static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max) + { +- char base_name[9]; +- +- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */ +- strlcpy(name, pci_name(dev->dev->persist->pdev), max); +- strncpy(base_name, name, 8); /*till xxxx:yy:*/ +- base_name[8] = '\0'; +- /* with no ARI only 3 last bits are used so when the fn is higher than 8 ++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n ++ * with no ARI only 3 last bits are used so when the fn is higher than 8 + * need to add it to the dev num, so count in the last number will be + * modulo 8 */ +- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8)); ++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev), ++ i / 8, i % 8); + } + + struct mlx4_port { +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 81f56cdff2bc..3ae82202cdb5 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -301,6 +301,9 @@ static ssize_t qib_portattr_show(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->show) ++ return -EIO; ++ + return pattr->show(ppd, buf); + } + +@@ -312,6 +315,9 @@ static ssize_t qib_portattr_store(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->store) ++ return -EIO; ++ + return pattr->store(ppd, buf, len); + } + +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index 5ed31057430c..6e904048d1cb 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + /* get sysinfo */ + md->si = &cd->sysinfo; +- if (!md->si) { +- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", +- __func__, md->si); +- goto error_get_sysinfo; +- } + + rc = cyttsp4_setup_input_device(cd); + if (rc) +@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + error_init_input: + input_free_device(md->input); +-error_get_sysinfo: +- input_set_drvdata(md->input, NULL); + error_alloc_failed: + dev_err(dev, "%s failed.\n", __func__); + return rc; +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 7bf2597ce44c..67cadda13ab1 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -68,6 +68,15 @@ static const unsigned long goodix_irq_flags[] = { + */ + static const struct dmi_system_id rotated_screen[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ .ident = "Teclast X89", ++ .matches = { ++ /* tPAD is too generic, also match on bios date */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), ++ }, ++ }, + { + .ident = "WinBook TW100", + .matches = { +diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c +index 5f306e2eece5..aee4880f972f 100644 +--- a/drivers/isdn/gigaset/usb-gigaset.c ++++ b/drivers/isdn/gigaset/usb-gigaset.c +@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cardstate *cs) + { + struct usb_cardstate *ucs; + +- cs->hw.usb = ucs = +- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL); ++ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL); + if (!ucs) { + pr_err("out of memory\n"); + return -ENOMEM; +@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cardstate *cs) + ucs->bchars[3] = 0; + ucs->bchars[4] = 0x11; + ucs->bchars[5] = 0x13; +- ucs->bulk_out_buffer = NULL; +- ucs->bulk_out_urb = NULL; +- ucs->read_urb = NULL; + tasklet_init(&cs->write_tasklet, + gigaset_modem_fill, (unsigned long) cs); + +@@ -688,6 +684,11 @@ static int gigaset_probe(struct usb_interface *interface, + return -ENODEV; + } + ++ if (hostif->desc.bNumEndpoints < 2) { ++ dev_err(&interface->dev, "missing endpoints\n"); ++ return -ENODEV; ++ } ++ + dev_info(&udev->dev, "%s: Device matched ... !\n", __func__); + + /* allocate memory for our device state and initialize it */ +@@ -707,6 +708,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[0].desc; + ++ if (!usb_endpoint_is_bulk_out(endpoint)) { ++ dev_err(&interface->dev, "missing bulk-out endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + ucs->bulk_out_size = buffer_size; + ucs->bulk_out_epnum = usb_endpoint_num(endpoint); +@@ -726,6 +733,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[1].desc; + ++ if (!usb_endpoint_is_int_in(endpoint)) { ++ dev_err(&interface->dev, "missing int-in endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + ucs->busy = 0; + + ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL); +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index 21ea537bd55e..eff04fa23dfa 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -203,7 +203,13 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + struct btree_node *right = r->n; + uint32_t nr_left = le32_to_cpu(left->header.nr_entries); + uint32_t nr_right = le32_to_cpu(right->header.nr_entries); +- unsigned threshold = 2 * merge_threshold(left) + 1; ++ /* ++ * Ensure the number of entries in each child will be greater ++ * than or equal to (max_entries / 3 + 1), so no matter which ++ * child is used for removal, the number will still be not ++ * less than (max_entries / 3). ++ */ ++ unsigned int threshold = 2 * (merge_threshold(left) + 1); + + if (nr_left + nr_right < threshold) { + /* +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index a0d267e017f6..a00dfaa1b945 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -652,8 +652,7 @@ static int bdisp_release(struct file *file) + + dev_dbg(bdisp->dev, "%s\n", __func__); + +- if (mutex_lock_interruptible(&bdisp->lock)) +- return -ERESTARTSYS; ++ mutex_lock(&bdisp->lock); + + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + +diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c +index a93f681aa9d6..6426b07510a7 100644 +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1149,8 +1149,7 @@ static int wl1273_fm_fops_release(struct file *file) + if (radio->rds_users > 0) { + radio->rds_users--; + if (radio->rds_users == 0) { +- if (mutex_lock_interruptible(&core->lock)) +- return -EINTR; ++ mutex_lock(&core->lock); + + radio->irq_flags &= ~WL1273_RDS_EVENT; + +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index f53e217e963f..494e263daa74 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size, + key_ptr = &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])]; +- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) && +- (key != NULL)) { ++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) { + status = 0; + + value_ptr = &p[note_strings + +diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c +index 64c7458344d4..ddf296666fb1 100644 +--- a/drivers/mtd/devices/spear_smi.c ++++ b/drivers/mtd/devices/spear_smi.c +@@ -595,6 +595,26 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len, + return 0; + } + ++/* ++ * The purpose of this function is to ensure a memcpy_toio() with byte writes ++ * only. Its structure is inspired from the ARM implementation of _memcpy_toio() ++ * which also does single byte writes but cannot be used here as this is just an ++ * implementation detail and not part of the API. Not mentioning the comment ++ * stating that _memcpy_toio() should be optimized. ++ */ ++static void spear_smi_memcpy_toio_b(volatile void __iomem *dest, ++ const void *src, size_t len) ++{ ++ const unsigned char *from = src; ++ ++ while (len) { ++ len--; ++ writeb(*from, dest); ++ from++; ++ dest++; ++ } ++} ++ + static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + void __iomem *dest, const void *src, size_t len) + { +@@ -617,7 +637,23 @@ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + ctrlreg1 = readl(dev->io_base + SMI_CR1); + writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1); + +- memcpy_toio(dest, src, len); ++ /* ++ * In Write Burst mode (WB_MODE), the specs states that writes must be: ++ * - incremental ++ * - of the same size ++ * The ARM implementation of memcpy_toio() will optimize the number of ++ * I/O by using as much 4-byte writes as possible, surrounded by ++ * 2-byte/1-byte access if: ++ * - the destination is not 4-byte aligned ++ * - the length is not a multiple of 4-byte. ++ * Avoid this alternance of write access size by using our own 'byte ++ * access' helper if at least one of the two conditions above is true. ++ */ ++ if (IS_ALIGNED(len, sizeof(u32)) && ++ IS_ALIGNED((uintptr_t)dest, sizeof(u32))) ++ memcpy_toio(dest, src, len); ++ else ++ spear_smi_memcpy_toio_b(dest, src, len); + + writel(ctrlreg1, dev->io_base + SMI_CR1); + +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c +index 9b9dfa167ffb..8a226cc05c10 100644 +--- a/drivers/net/can/slcan.c ++++ b/drivers/net/can/slcan.c +@@ -613,6 +613,7 @@ err_free_chan: + sl->tty = NULL; + tty->disc_data = NULL; + clear_bit(SLF_INUSE, &sl->flags); ++ slc_free_netdev(sl->dev); + free_netdev(sl->dev); + + err_exit: +diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c +index de9f7c97d916..796ee362ad70 100644 +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -776,6 +776,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + { + struct net_device *dev; + struct ep93xx_priv *ep; ++ struct resource *mem; + + dev = platform_get_drvdata(pdev); + if (dev == NULL) +@@ -791,8 +792,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + iounmap(ep->base_addr); + + if (ep->res != NULL) { +- release_resource(ep->res); +- kfree(ep->res); ++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ release_mem_region(mem->start, resource_size(mem)); + } + + free_netdev(dev); +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index 068789e694c9..93c29094ceff 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic) + + fw = e100_request_firmware(nic); + /* If it's NULL, then no ucode is required */ +- if (!fw || IS_ERR(fw)) +- return PTR_ERR(fw); ++ if (IS_ERR_OR_NULL(fw)) ++ return PTR_ERR_OR_ZERO(fw); + + if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode))) + netif_err(nic, probe, nic->netdev, +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index 623c6ed8764a..803df6a32ba9 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -301,7 +301,7 @@ struct dma_features { + struct stmmac_desc_ops { + /* DMA RX descriptor ring initialization */ + void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode, +- int end); ++ int end, int bfsize); + /* DMA TX descriptor ring initialization */ + void (*init_tx_desc) (struct dma_desc *p, int mode, int end); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +index 6f2cc78c5cf5..6b83fc8e6fbe 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +@@ -33,9 +33,10 @@ + /* Specific functions used for Ring mode */ + + /* Enhanced descriptors */ +-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end) ++static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize) + { +- p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1; ++ if (bfsize == BUF_SIZE_16KiB) ++ p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1; + if (end) + p->des01.erx.end_ring = 1; + } +@@ -61,9 +62,14 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len) + } + + /* Normal descriptors */ +-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end) ++static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize) + { +- p->des01.rx.buffer2_size = BUF_SIZE_2KiB - 1; ++ int size; ++ ++ if (bfsize >= BUF_SIZE_2KiB) { ++ size = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1); ++ p->des01.rx.buffer2_size = size; ++ } + if (end) + p->des01.rx.end_ring = 1; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index 7d944449f5ef..9ecb3a948f86 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -238,16 +238,20 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, + } + + static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, +- int mode, int end) ++ int mode, int end, int bfsize) + { ++ int bfsize1; ++ + p->des01.all_flags = 0; + p->des01.erx.own = 1; +- p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1; ++ ++ bfsize1 = min(bfsize, BUF_SIZE_8KiB - 1); ++ p->des01.erx.buffer1_size = bfsize1; + + if (mode == STMMAC_CHAIN_MODE) + ehn_desc_rx_set_on_chain(p, end); + else +- ehn_desc_rx_set_on_ring(p, end); ++ ehn_desc_rx_set_on_ring(p, end, bfsize); + + if (disable_rx_ic) + p->des01.erx.disable_ic = 1; +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index 48c3456445b2..07e0c03cfb10 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -121,16 +121,20 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x, + } + + static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode, +- int end) ++ int end, int bfsize) + { ++ int bfsize1; ++ + p->des01.all_flags = 0; + p->des01.rx.own = 1; +- p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1; ++ ++ bfsize1 = min(bfsize, (BUF_SIZE_2KiB - 1)); ++ p->des01.rx.buffer1_size = bfsize1; + + if (mode == STMMAC_CHAIN_MODE) + ndesc_rx_set_on_chain(p, end); + else +- ndesc_rx_set_on_ring(p, end); ++ ndesc_rx_set_on_ring(p, end, bfsize); + + if (disable_rx_ic) + p->des01.rx.disable_ic = 1; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index f4d6512f066c..28a6b7764044 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -964,11 +964,11 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv) + if (priv->extend_desc) + priv->hw->desc->init_rx_desc(&priv->dma_erx[i].basic, + priv->use_riwt, priv->mode, +- (i == rxsize - 1)); ++ (i == rxsize - 1), priv->dma_buf_sz); + else + priv->hw->desc->init_rx_desc(&priv->dma_rx[i], + priv->use_riwt, priv->mode, +- (i == rxsize - 1)); ++ (i == rxsize - 1), priv->dma_buf_sz); + for (i = 0; i < txsize; i++) + if (priv->extend_desc) + priv->hw->desc->init_tx_desc(&priv->dma_etx[i].basic, +@@ -2176,8 +2176,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv) + static int stmmac_rx(struct stmmac_priv *priv, int limit) + { + unsigned int rxsize = priv->dma_rx_size; +- unsigned int entry = priv->cur_rx % rxsize; +- unsigned int next_entry; ++ unsigned int next_entry = priv->cur_rx % rxsize; + unsigned int count = 0; + int coe = priv->hw->rx_csum; + +@@ -2189,9 +2188,11 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit) + stmmac_display_ring((void *)priv->dma_rx, rxsize, 0); + } + while (count < limit) { +- int status; ++ int status, entry; + struct dma_desc *p; + ++ entry = next_entry; ++ + if (priv->extend_desc) + p = (struct dma_desc *)(priv->dma_erx + entry); + else +@@ -2239,7 +2240,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit) + /* check if frame_len fits the preallocated memory */ + if (frame_len > priv->dma_buf_sz) { + priv->dev->stats.rx_length_errors++; +- break; ++ continue; + } + + /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3 +@@ -2260,7 +2261,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit) + pr_err("%s: Inconsistent Rx descriptor chain\n", + priv->dev->name); + priv->dev->stats.rx_dropped++; +- break; ++ continue; + } + prefetch(skb->data - NET_IP_ALIGN); + priv->rx_skbuff[entry] = NULL; +@@ -2291,7 +2292,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit) + priv->dev->stats.rx_packets++; + priv->dev->stats.rx_bytes += frame_len; + } +- entry = next_entry; + } + + stmmac_rx_refill(priv); +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c1217a87d535..9a9cb6b11e4c 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -777,8 +777,8 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id) + { + struct cpsw_priv *priv = dev_id; + +- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); + writel(0, &priv->wr_regs->rx_en); ++ cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); + + if (priv->quirk_irq) { + disable_irq_nosync(priv->irqs_table[0]); +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 3b343c63aa52..5bf22057459e 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, + + if (flags & AR5523_CMD_FLAG_MAGIC) + hdr->magic = cpu_to_be32(1 << 24); +- memcpy(hdr + 1, idata, ilen); ++ if (ilen) ++ memcpy(hdr + 1, idata, ilen); + + cmd->odata = odata; + cmd->olen = olen; +diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +index 7b2a7d848a56..ca498b1f1f56 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -741,6 +741,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, + !ieee80211_is_action(hdr->frame_control))) + sta = NULL; + ++ /* If there is no sta, and it's not offchannel - send through AP */ ++ if (info->control.vif->type == NL80211_IFTYPE_STATION && ++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) { ++ struct iwl_mvm_vif *mvmvif = ++ iwl_mvm_vif_from_mac80211(info->control.vif); ++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id); ++ ++ if (ap_sta_id < IWL_MVM_STATION_COUNT) { ++ /* mac80211 holds rcu read lock */ ++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]); ++ if (IS_ERR_OR_NULL(sta)) ++ goto drop; ++ } ++ } ++ + if (sta) { + if (iwl_mvm_defer_tx(mvm, sta, skb)) + return; +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +index f49b60d31450..1ad770155805 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +@@ -1206,6 +1206,7 @@ void rtl92de_enable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); ++ rtlpci->irq_enabled = true; + } + + void rtl92de_disable_interrupt(struct ieee80211_hw *hw) +@@ -1215,7 +1216,7 @@ void rtl92de_disable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED); + rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED); +- synchronize_irq(rtlpci->pdev->irq); ++ rtlpci->irq_enabled = false; + } + + static void _rtl92de_poweroff_adapter(struct ieee80211_hw *hw) +@@ -1386,7 +1387,7 @@ void rtl92de_set_beacon_related_registers(struct ieee80211_hw *hw) + + bcn_interval = mac->beacon_interval; + atim_window = 2; +- /*rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_ATIMWND, atim_window); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); + rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f); +@@ -1406,9 +1407,9 @@ void rtl92de_set_beacon_interval(struct ieee80211_hw *hw) + + RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG, + "beacon_interval:%d\n", bcn_interval); +- /* rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); +- /* rtl92de_enable_interrupt(hw); */ ++ rtl92de_enable_interrupt(hw); + } + + void rtl92de_update_interrupt_mask(struct ieee80211_hw *hw, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +index c6e09a19de1a..7b7c5a793f3e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +@@ -242,6 +242,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = { + .led_control = rtl92de_led_control, + .set_desc = rtl92de_set_desc, + .get_desc = rtl92de_get_desc, ++ .is_tx_desc_closed = rtl92de_is_tx_desc_closed, + .tx_polling = rtl92de_tx_polling, + .enable_hw_sec = rtl92de_enable_hw_security_config, + .set_key = rtl92de_set_key, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +index 1feaa629dd4f..1686d9ac6c19 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +@@ -843,13 +843,15 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) + break; + } + } else { +- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc; + switch (desc_name) { + case HW_DESC_OWN: +- ret = GET_RX_DESC_OWN(pdesc); ++ ret = GET_RX_DESC_OWN(p_desc); + break; + case HW_DESC_RXPKT_LEN: +- ret = GET_RX_DESC_PKT_LEN(pdesc); ++ ret = GET_RX_DESC_PKT_LEN(p_desc); ++ break; ++ case HW_DESC_RXBUFF_ADDR: ++ ret = GET_RX_DESC_BUFF_ADDR(p_desc); + break; + default: + RT_ASSERT(false, "ERR rxdesc :%d not process\n", +@@ -860,6 +862,23 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) + return ret; + } + ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index) ++{ ++ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); ++ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue]; ++ u8 *entry = (u8 *)(&ring->desc[ring->idx]); ++ u8 own = (u8)rtl92de_get_desc(entry, true, HW_DESC_OWN); ++ ++ /* a beacon packet will only use the first ++ * descriptor by defaut, and the own bit may not ++ * be cleared by the hardware ++ */ ++ if (own) ++ return false; ++ return true; ++} ++ + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +index fb5cf0634e8d..25209256f4b7 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +@@ -740,6 +740,8 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, + void rtl92de_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx, + u8 desc_name, u8 *val); + u32 rtl92de_get_desc(u8 *pdesc, bool istx, u8 desc_name); ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index); + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue); + void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, + bool b_firstseg, bool b_lastseg, +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 0b1122cb5d0c..b505a6e135b7 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -239,8 +239,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + + if (r == -EREMOTEIO) { + phy->hard_fault = r; +- skb = NULL; +- } else if (r < 0) { ++ if (info->mode == NXP_NCI_MODE_FW) ++ nxp_nci_fw_recv_frame(phy->ndev, NULL); ++ } ++ if (r < 0) { + nfc_err(&client->dev, "Read failed with error %d\n", r); + goto exit_irq_handled; + } +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 10a6a8e5db88..5d5e61d6c548 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -224,7 +224,7 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag) + return 0; + + mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT; +- if (flag) ++ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT) + mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT; + writel(mask_bits, desc->mask_base + offset); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 36c6f3702167..83ad32b07cc3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4038,7 +4038,7 @@ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags) + #define INTEL_BSPR_REG_BPPD (1 << 9) + + /* Upstream Peer Decode Configuration Register */ +-#define INTEL_UPDCR_REG 0x1114 ++#define INTEL_UPDCR_REG 0x1014 + /* 5:0 Peer Decode Enable bits */ + #define INTEL_UPDCR_REG_MASK 0x3f + +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +index b1e8a2d905ff..a0904e426c73 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -755,12 +755,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev) + goto unregister_pinctrl; + } + +- ret = gpiochip_add_pin_range(&pctrl->chip, +- dev_name(pctrl->dev), +- 0, 0, pctrl->chip.ngpio); +- if (ret) { +- dev_err(pctrl->dev, "failed to add pin range\n"); +- goto unregister_gpiochip; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), ++ 0, 0, pctrl->chip.ngpio); ++ if (ret) { ++ dev_err(pctrl->dev, "failed to add pin range\n"); ++ goto unregister_gpiochip; ++ } + } + + platform_set_drvdata(pdev, pctrl); +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +index 3d92f827da7a..0839b70a30ee 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +@@ -495,8 +495,10 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) + return -ENODEV; + + eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL); +- if (!eint_data) ++ if (!eint_data) { ++ of_node_put(eint_np); + return -ENOMEM; ++ } + + eint_data->drvdata = d; + +@@ -508,12 +510,14 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) + irq = irq_of_parse_and_map(eint_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint_np); + return -ENXIO; + } + + eint_data->parents[i] = irq; + irq_set_chained_handler_and_data(irq, handlers[i], eint_data); + } ++ of_node_put(eint_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +index 43407ab248f5..0cd9f3a7bb11 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +@@ -713,6 +713,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) { + dev_err(dev, "could not allocate memory for wkup eint data\n"); ++ of_node_put(eint0_np); + return -ENOMEM; + } + data->drvdata = d; +@@ -723,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + irq = irq_of_parse_and_map(eint0_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint0_np); + return -ENXIO; + } + +@@ -730,6 +732,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + s3c64xx_eint0_handlers[i], + data); + } ++ of_node_put(eint0_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index 3f622ccd8eab..2f5252d4663b 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -286,6 +286,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev, + &reserved_maps, num_maps); + if (ret < 0) { + samsung_dt_free_map(pctldev, *map, *num_maps); ++ of_node_put(np); + return ret; + } + } +@@ -753,8 +754,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( + if (!of_get_child_count(cfg_np)) { + ret = samsung_pinctrl_create_function(dev, drvdata, + cfg_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; +@@ -765,8 +768,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( + for_each_child_of_node(cfg_np, func_np) { + ret = samsung_pinctrl_create_function(dev, drvdata, + func_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(func_np); ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; +diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c +index db984d4bf952..4cce5bd448f6 100644 +--- a/drivers/rtc/rtc-max8997.c ++++ b/drivers/rtc/rtc-max8997.c +@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + + out: + mutex_unlock(&info->lock); +- return 0; ++ return ret; + } + + static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info) +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index b6caad0fee24..c53ea0ac5f46 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -93,11 +93,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req) + memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, + FSF_STATUS_QUALIFIER_SIZE); + +- if (req->fsf_command != FSF_QTCB_FCP_CMND) { +- rec->pl_len = q_head->log_length; +- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, +- rec->pl_len, "fsf_res", req->req_id); +- } ++ rec->pl_len = q_head->log_length; ++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, ++ rec->pl_len, "fsf_res", req->req_id); + + debug_event(dbf->hba, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->hba_lock, flags); +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index cc62d8cc8cfd..d5214c4eb9dd 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -178,9 +178,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, + adapter, ZFCP_STATUS_COMMON_ERP_FAILED); + } + break; +- default: +- need = 0; +- break; + } + + return need; +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index ceee9a3fd9e5..a1a9cb952414 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -867,7 +867,8 @@ struct lpfc_hba { + struct list_head port_list; + struct lpfc_vport *pport; /* physical lpfc_vport pointer */ + uint16_t max_vpi; /* Maximum virtual nports */ +-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */ ++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */ ++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */ + uint16_t max_vports; /* + * For IOV HBAs max_vpi can change + * after a reset. max_vports is max +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index f096766150bc..93092dfba293 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1213,6 +1213,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ? + (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0; + ++ /* Limit the max we support */ ++ if (max_vpi > LPFC_MAX_VPI) ++ max_vpi = LPFC_MAX_VPI; + if (mvpi) + *mvpi = max_vpi; + if (avpi) +@@ -1228,8 +1231,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + *axri = pmb->un.varRdConfig.avail_xri; + if (mvpi) + *mvpi = pmb->un.varRdConfig.max_vpi; +- if (avpi) +- *avpi = pmb->un.varRdConfig.avail_vpi; ++ if (avpi) { ++ /* avail_vpi is only valid if link is up and ready */ ++ if (phba->link_state == LPFC_HBA_READY) ++ *avpi = pmb->un.varRdConfig.avail_vpi; ++ else ++ *avpi = pmb->un.varRdConfig.max_vpi; ++ } + } + + mempool_free(pmboxq, phba->mbox_mem_pool); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 7e06fd6127cc..1a7ac17534d6 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -6890,6 +6890,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba) + bf_get(lpfc_mbx_rd_conf_xri_base, rd_config); + phba->sli4_hba.max_cfg_param.max_vpi = + bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config); ++ /* Limit the max we support */ ++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS) ++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS; + phba->sli4_hba.max_cfg_param.vpi_base = + bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config); + phba->sli4_hba.max_cfg_param.max_rpi = +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 31c29a5d1f38..b8765c55906c 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -760,7 +760,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + break; + } else { + /* Make sure FC side is not in reset */ +- qla2x00_wait_for_hba_online(vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != ++ QLA_SUCCESS); + + /* Issue MPI reset */ + scsi_block_requests(vha->host); +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index 2d5375d67736..68ec6695b48c 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -336,6 +336,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job) + dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, + bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + if (!req_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, ++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +@@ -343,6 +345,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job) + rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, + bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + if (!rsp_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, ++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +@@ -1739,8 +1743,8 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + uint16_t nextlid = 0; + uint32_t tot_dsds; + srb_t *sp = NULL; +- uint32_t req_data_len = 0; +- uint32_t rsp_data_len = 0; ++ uint32_t req_data_len; ++ uint32_t rsp_data_len; + + /* Check the type of the adapter */ + if (!IS_BIDI_CAPABLE(ha)) { +@@ -1845,6 +1849,9 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + goto done_unmap_sg; + } + ++ req_data_len = bsg_job->request_payload.payload_len; ++ rsp_data_len = bsg_job->reply_payload.payload_len; ++ + if (req_data_len != rsp_data_len) { + rval = EXT_STATUS_BUSY; + ql_log(ql_log_warn, vha, 0x70aa, +@@ -1852,10 +1859,6 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + goto done_unmap_sg; + } + +- req_data_len = bsg_job->request_payload.payload_len; +- rsp_data_len = bsg_job->reply_payload.payload_len; +- +- + /* Alloc SRB structure */ + sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL); + if (!sp) { +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 6c4f54aa60df..1d9f19e5e0f8 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -6026,7 +6026,8 @@ qlt_enable_vha(struct scsi_qla_host *vha) + } else { + set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags); + qla2xxx_wake_dpc(base_vha); +- qla2x00_wait_for_hba_online(base_vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) != ++ QLA_SUCCESS); + } + } + EXPORT_SYMBOL(qlt_enable_vha); +@@ -6056,7 +6057,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha) + + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); +- qla2x00_wait_for_hba_online(vha); ++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS) ++ ql_dbg(ql_dbg_tgt, vha, 0xe081, ++ "qla2x00_wait_for_hba_online() failed\n"); + } + + /* +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 44be6b593b30..691c04b3e5b6 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1209,10 +1209,8 @@ static int atmel_spi_setup(struct spi_device *spi) + as = spi_master_get_devdata(spi->master); + + /* see notes above re chipselect */ +- if (!atmel_spi_is_v2(as) +- && spi->chip_select == 0 +- && (spi->mode & SPI_CS_HIGH)) { +- dev_dbg(&spi->dev, "setup: can't be active-high\n"); ++ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) { ++ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n"); + return -EINVAL; + } + +diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c +index 78fe0b557280..fa1ef25d7a9a 100644 +--- a/drivers/staging/iio/addac/adt7316-i2c.c ++++ b/drivers/staging/iio/addac/adt7316-i2c.c +@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data) + return ret; + } + ++ *data = ret; ++ + return 0; + } + +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 951f22265105..5c802c2cb984 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -82,7 +82,7 @@ static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf) + phost_conf = pusbd->actconfig; + pconf_desc = &phost_conf->desc; + +- phost_iface = &usb_intf->altsetting[0]; ++ phost_iface = usb_intf->cur_altsetting; + piface_desc = &phost_iface->desc; + + pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces; +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index c71333fbe823..a6167cab0099 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -263,7 +263,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter) + + pdvobjpriv->padapter = padapter; + padapter->EepromAddressSize = 6; +- phost_iface = &pintf->altsetting[0]; ++ phost_iface = pintf->cur_altsetting; + piface_desc = &phost_iface->desc; + pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; + if (pusbd->speed == USB_SPEED_HIGH) { +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 929092fc25ef..a6df07786362 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -402,7 +402,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz, + mod_delayed_work(system_freezable_wq, &tz->poll_queue, + msecs_to_jiffies(delay)); + else +- cancel_delayed_work_sync(&tz->poll_queue); ++ cancel_delayed_work(&tz->poll_queue); + } + + static void monitor_thermal_zone(struct thermal_zone_device *tz) +@@ -2002,7 +2002,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) + + mutex_unlock(&thermal_list_lock); + +- thermal_zone_device_set_polling(tz, 0); ++ cancel_delayed_work_sync(&tz->poll_queue); + + if (tz->type[0]) + device_remove_file(&tz->device, &dev_attr_type); +diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c +index 0f23dda60011..7392f0315562 100644 +--- a/drivers/tty/serial/ifx6x60.c ++++ b/drivers/tty/serial/ifx6x60.c +@@ -1241,6 +1241,9 @@ static int ifx_spi_spi_remove(struct spi_device *spi) + struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi); + /* stop activity */ + tasklet_kill(&ifx_dev->io_work_tasklet); ++ ++ pm_runtime_disable(&spi->dev); ++ + /* free irq */ + free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev); + free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev); +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index f5f46c121ee3..d607cb2eb64e 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1784,7 +1784,7 @@ imx_console_setup(struct console *co, char *options) + + retval = clk_prepare(sport->clk_per); + if (retval) +- clk_disable_unprepare(sport->clk_ipg); ++ clk_unprepare(sport->clk_ipg); + + error_console: + return retval; +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index eaeb098b5d6a..03cac2183579 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -823,6 +823,7 @@ static unsigned int msm_get_mctrl(struct uart_port *port) + static void msm_reset(struct uart_port *port) + { + struct msm_port *msm_port = UART_TO_MSM(port); ++ unsigned int mr; + + /* reset everything */ + msm_write(port, UART_CR_CMD_RESET_RX, UART_CR); +@@ -830,7 +831,10 @@ static void msm_reset(struct uart_port *port) + msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR); + msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR); + msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR); +- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR); ++ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR); ++ mr = msm_read(port, UART_MR1); ++ mr &= ~UART_MR1_RX_RDY_CTL; ++ msm_write(port, mr, UART_MR1); + + /* Disable DM modes */ + if (msm_port->is_uartdm) +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index def5199ca004..54122db81de4 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1015,7 +1015,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state) + + mutex_lock(&port->mutex); + +- if (uport->type != PORT_UNKNOWN) ++ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl) + uport->ops->break_ctl(uport, break_state); + + mutex_unlock(&port->mutex); +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index fd92c842504d..fb43f8dc9246 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1460,7 +1460,7 @@ static void kbd_event(struct input_handle *handle, unsigned int event_type, + + if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev)) + kbd_rawcode(value); +- if (event_type == EV_KEY) ++ if (event_type == EV_KEY && event_code <= KEY_MAX) + kbd_keycode(event_code, value, HW_RAW(handle->dev)); + + spin_unlock(&kbd_event_lock); +diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c +index a2ae88dbda78..57f3c4bcd598 100644 +--- a/drivers/usb/atm/ueagle-atm.c ++++ b/drivers/usb/atm/ueagle-atm.c +@@ -2167,10 +2167,11 @@ resubmit: + /* + * Start the modem : init the data and start kernel thread + */ +-static int uea_boot(struct uea_softc *sc) ++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf) + { +- int ret, size; + struct intr_pkt *intr; ++ int ret = -ENOMEM; ++ int size; + + uea_enters(INS_TO_USBDEV(sc)); + +@@ -2195,6 +2196,11 @@ static int uea_boot(struct uea_softc *sc) + if (UEA_CHIP_VERSION(sc) == ADI930) + load_XILINX_firmware(sc); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ ret = -ENODEV; ++ goto err0; ++ } ++ + intr = kmalloc(size, GFP_KERNEL); + if (!intr) { + uea_err(INS_TO_USBDEV(sc), +@@ -2211,8 +2217,7 @@ static int uea_boot(struct uea_softc *sc) + usb_fill_int_urb(sc->urb_int, sc->usb_dev, + usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE), + intr, size, uea_intr, sc, +- sc->usb_dev->actconfig->interface[0]->altsetting[0]. +- endpoint[0].desc.bInterval); ++ intf->cur_altsetting->endpoint[0].desc.bInterval); + + ret = usb_submit_urb(sc->urb_int, GFP_KERNEL); + if (ret < 0) { +@@ -2227,6 +2232,7 @@ static int uea_boot(struct uea_softc *sc) + sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm"); + if (IS_ERR(sc->kthread)) { + uea_err(INS_TO_USBDEV(sc), "failed to create thread\n"); ++ ret = PTR_ERR(sc->kthread); + goto err2; + } + +@@ -2241,7 +2247,7 @@ err1: + kfree(intr); + err0: + uea_leaves(INS_TO_USBDEV(sc)); +- return -ENOMEM; ++ return ret; + } + + /* +@@ -2604,7 +2610,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, + if (ret < 0) + goto error; + +- ret = uea_boot(sc); ++ ret = uea_boot(sc, intf); + if (ret < 0) + goto error_rm_grp; + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 11881c5a1fb0..7805f3e535ec 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5554,7 +5554,7 @@ re_enumerate_no_bos: + + /** + * usb_reset_device - warn interface drivers and perform a USB port reset +- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) ++ * @udev: device to reset (not in NOTATTACHED state) + * + * Warns all drivers bound to registered interfaces (using their pre_reset + * method), performs the port reset, and then lets the drivers know that +@@ -5582,8 +5582,7 @@ int usb_reset_device(struct usb_device *udev) + struct usb_host_config *config = udev->actconfig; + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + +- if (udev->state == USB_STATE_NOTATTACHED || +- udev->state == USB_STATE_SUSPENDED) { ++ if (udev->state == USB_STATE_NOTATTACHED) { + dev_dbg(&udev->dev, "device reset not allowed in state %d\n", + udev->state); + return -EINVAL; +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c +index e43ef7d2d00e..d6fcead91b32 100644 +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -40,6 +40,7 @@ void usb_init_urb(struct urb *urb) + if (urb) { + memset(urb, 0, sizeof(*urb)); + kref_init(&urb->kref); ++ INIT_LIST_HEAD(&urb->urb_list); + INIT_LIST_HEAD(&urb->anchor_list); + } + } +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index f91a43140694..d193e95f5889 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1542,6 +1542,7 @@ static struct config_group *gadgets_make( + gi->composite.resume = NULL; + gi->composite.max_speed = USB_SPEED_SUPER; + ++ spin_lock_init(&gi->spinlock); + mutex_init(&gi->lock); + INIT_LIST_HEAD(&gi->string_list); + INIT_LIST_HEAD(&gi->available_func); +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index d73618475664..31e08bb3cb41 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1137,8 +1137,10 @@ int gserial_alloc_line(unsigned char *line_num) + __func__, port_num, PTR_ERR(tty_dev)); + + ret = PTR_ERR(tty_dev); ++ mutex_lock(&ports[port_num].lock); + port = ports[port_num].port; + ports[port_num].port = NULL; ++ mutex_unlock(&ports[port_num].lock); + gserial_free_port(port); + goto err; + } +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 421825b44202..40c95ed6afbf 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -704,7 +704,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + struct xhci_bus_state *bus_state, + __le32 __iomem **port_array, + u16 wIndex, u32 raw_port_status, +- unsigned long flags) ++ unsigned long *flags) + __releases(&xhci->lock) + __acquires(&xhci->lock) + { +@@ -736,6 +736,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + status |= USB_PORT_STAT_C_BH_RESET << 16; + if ((raw_port_status & PORT_CEC)) + status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; ++ ++ /* USB3 remote wake resume signaling completed */ ++ if (bus_state->port_remote_wakeup & (1 << wIndex) && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RECOVERY) { ++ bus_state->port_remote_wakeup &= ~(1 << wIndex); ++ usb_hcd_end_port_resume(&hcd->self, wIndex); ++ } + } + + if (hcd->speed < HCD_USB3) { +@@ -786,12 +794,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + xhci_set_link_state(xhci, port_array, wIndex, + XDEV_U0); + +- spin_unlock_irqrestore(&xhci->lock, flags); ++ spin_unlock_irqrestore(&xhci->lock, *flags); + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies( + XHCI_MAX_REXIT_TIMEOUT_MS)); +- spin_lock_irqsave(&xhci->lock, flags); ++ spin_lock_irqsave(&xhci->lock, *flags); + + if (time_left) { + slot_id = xhci_find_slot_id_by_port(hcd, +@@ -937,7 +945,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + break; + } + status = xhci_get_port_status(hcd, bus_state, port_array, +- wIndex, temp, flags); ++ wIndex, temp, &flags); + if (status == 0xffffffff) + goto error; + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 0ec809a35a3f..f274e7e4e659 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1928,10 +1928,14 @@ no_bw: + kfree(xhci->port_array); + kfree(xhci->rh_bw); + kfree(xhci->ext_caps); ++ kfree(xhci->usb2_rhub.psi); ++ kfree(xhci->usb3_rhub.psi); + + xhci->usb2_ports = NULL; + xhci->usb3_ports = NULL; + xhci->port_array = NULL; ++ xhci->usb2_rhub.psi = NULL; ++ xhci->usb3_rhub.psi = NULL; + xhci->rh_bw = NULL; + xhci->ext_caps = NULL; + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index d6e2199bcfe5..bda176fa6e48 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -446,6 +446,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + } + #endif /* CONFIG_PM */ + ++static void xhci_pci_shutdown(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); ++ ++ xhci_shutdown(hcd); ++ ++ /* Yet another workaround for spurious wakeups at shutdown with HSW */ ++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) ++ pci_set_power_state(pdev, PCI_D3hot); ++} ++ + /*-------------------------------------------------------------------------*/ + + /* PCI driver selection metadata; PCI hotplugging uses this */ +@@ -481,6 +493,7 @@ static int __init xhci_pci_init(void) + #ifdef CONFIG_PM + xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; + xhci_pci_hc_driver.pci_resume = xhci_pci_resume; ++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; + #endif + return pci_register_driver(&xhci_pci_driver); + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 80192698df87..536251c6149d 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1602,9 +1602,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + usb_hcd_resume_root_hub(hcd); + } + +- if (hcd->speed >= HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE) +- bus_state->port_remote_wakeup &= ~(1 << faked_port_index); +- + if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) { + xhci_dbg(xhci, "port resume event for port %d\n", port_id); + +@@ -1623,6 +1620,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + bus_state->port_remote_wakeup |= 1 << faked_port_index; + xhci_test_and_clear_bit(xhci, port_array, + faked_port_index, PORT_PLC); ++ usb_hcd_start_port_resume(&hcd->self, faked_port_index); + xhci_set_link_state(xhci, port_array, faked_port_index, + XDEV_U0); + /* Need to wait until the next link state change +@@ -1660,8 +1658,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + if (slot_id && xhci->devs[slot_id]) + xhci_ring_device(xhci, slot_id); + if (bus_state->port_remote_wakeup & (1 << faked_port_index)) { +- bus_state->port_remote_wakeup &= +- ~(1 << faked_port_index); + xhci_test_and_clear_bit(xhci, port_array, + faked_port_index, PORT_PLC); + usb_wakeup_notification(hcd->self.root_hub, +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 202c806b972a..af4e68152776 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -754,11 +754,8 @@ void xhci_shutdown(struct usb_hcd *hcd) + xhci_dbg_trace(xhci, trace_xhci_dbg_init, + "xhci_shutdown completed - status = %x", + readl(&xhci->op_regs->status)); +- +- /* Yet another workaround for spurious wakeups at shutdown with HSW */ +- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot); + } ++EXPORT_SYMBOL_GPL(xhci_shutdown); + + #ifdef CONFIG_PM + static void xhci_save_registers(struct xhci_hcd *xhci) +@@ -929,7 +926,7 @@ static bool xhci_pending_portevent(struct xhci_hcd *xhci) + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + { + int rc = 0; +- unsigned int delay = XHCI_MAX_HALT_USEC; ++ unsigned int delay = XHCI_MAX_HALT_USEC * 2; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + u32 command; + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index b57bee70cdef..0a3aa38b3c96 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -314,6 +314,7 @@ struct xhci_op_regs { + #define XDEV_U3 (0x3 << 5) + #define XDEV_INACTIVE (0x6 << 5) + #define XDEV_POLLING (0x7 << 5) ++#define XDEV_RECOVERY (0x8 << 5) + #define XDEV_COMP_MODE (0xa << 5) + #define XDEV_RESUME (0xf << 5) + /* true: port has power (see HCC_PPC) */ +@@ -1833,6 +1834,7 @@ int xhci_run(struct usb_hcd *hcd); + void xhci_stop(struct usb_hcd *hcd); + void xhci_shutdown(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); ++void xhci_shutdown(struct usb_hcd *hcd); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); + +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c +index 6d849e7dc842..ba5c0a4591ac 100644 +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -686,7 +686,7 @@ static int adu_probe(struct usb_interface *interface, + init_waitqueue_head(&dev->read_wait); + init_waitqueue_head(&dev->write_wait); + +- iface_desc = &interface->altsetting[0]; ++ iface_desc = &interface->cur_altsetting[0]; + + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { +diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c +index 6d4e75785710..066dce850cc6 100644 +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -342,7 +342,7 @@ static int idmouse_probe(struct usb_interface *interface, + int result; + + /* check if we have gotten the data or the hid interface */ +- iface_desc = &interface->altsetting[0]; ++ iface_desc = interface->cur_altsetting; + if (iface_desc->desc.bInterfaceClass != 0x0A) + return -ENODEV; + +diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c +index 251d123d9046..9f0b0bbe5767 100644 +--- a/drivers/usb/mon/mon_bin.c ++++ b/drivers/usb/mon/mon_bin.c +@@ -1035,12 +1035,18 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg + + mutex_lock(&rp->fetch_lock); + spin_lock_irqsave(&rp->b_lock, flags); +- mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); +- kfree(rp->b_vec); +- rp->b_vec = vec; +- rp->b_size = size; +- rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; +- rp->cnt_lost = 0; ++ if (rp->mmap_active) { ++ mon_free_buff(vec, size/CHUNK_SIZE); ++ kfree(vec); ++ ret = -EBUSY; ++ } else { ++ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); ++ kfree(rp->b_vec); ++ rp->b_vec = vec; ++ rp->b_size = size; ++ rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; ++ rp->cnt_lost = 0; ++ } + spin_unlock_irqrestore(&rp->b_lock, flags); + mutex_unlock(&rp->fetch_lock); + } +@@ -1212,13 +1218,21 @@ mon_bin_poll(struct file *file, struct poll_table_struct *wait) + static void mon_bin_vma_open(struct vm_area_struct *vma) + { + struct mon_reader_bin *rp = vma->vm_private_data; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active++; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + static void mon_bin_vma_close(struct vm_area_struct *vma) + { ++ unsigned long flags; ++ + struct mon_reader_bin *rp = vma->vm_private_data; ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active--; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + /* +@@ -1230,16 +1244,12 @@ static int mon_bin_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf) + unsigned long offset, chunk_idx; + struct page *pageptr; + +- mutex_lock(&rp->fetch_lock); + offset = vmf->pgoff << PAGE_SHIFT; +- if (offset >= rp->b_size) { +- mutex_unlock(&rp->fetch_lock); ++ if (offset >= rp->b_size) + return VM_FAULT_SIGBUS; +- } + chunk_idx = offset / CHUNK_SIZE; + pageptr = rp->b_vec[chunk_idx].pg; + get_page(pageptr); +- mutex_unlock(&rp->fetch_lock); + vmf->page = pageptr; + return 0; + } +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 6947985ccfb0..0de11898fee7 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2859,16 +2859,18 @@ static int edge_startup(struct usb_serial *serial) + response = 0; + + if (edge_serial->is_epic) { ++ struct usb_host_interface *alt; ++ ++ alt = serial->interface->cur_altsetting; ++ + /* EPIC thing, set up our interrupt polling now and our read + * urb, so that the device knows it really is connected. */ + interrupt_in_found = bulk_in_found = bulk_out_found = false; +- for (i = 0; i < serial->interface->altsetting[0] +- .desc.bNumEndpoints; ++i) { ++ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { + struct usb_endpoint_descriptor *endpoint; + int buffer_size; + +- endpoint = &serial->interface->altsetting[0]. +- endpoint[i].desc; ++ endpoint = &alt->endpoint[i].desc; + buffer_size = usb_endpoint_maxp(endpoint); + if (!interrupt_in_found && + (usb_endpoint_is_int_in(endpoint))) { +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 5c8f767b6368..f7d48661aa94 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -318,8 +318,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + return -EINVAL; + + if (vdev->ctx[vector].trigger) { +- free_irq(irq, vdev->ctx[vector].trigger); + irq_bypass_unregister_producer(&vdev->ctx[vector].producer); ++ free_irq(irq, vdev->ctx[vector].trigger); + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(vdev->ctx[vector].trigger); + vdev->ctx[vector].trigger = NULL; +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index b73520aaf697..2e325fea4446 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -1032,12 +1032,12 @@ static int hdmi_avi_infoframe_unpack(struct hdmi_avi_infoframe *frame, + if (ptr[0] & 0x10) + frame->active_aspect = ptr[1] & 0xf; + if (ptr[0] & 0x8) { +- frame->top_bar = (ptr[5] << 8) + ptr[6]; +- frame->bottom_bar = (ptr[7] << 8) + ptr[8]; ++ frame->top_bar = (ptr[6] << 8) | ptr[5]; ++ frame->bottom_bar = (ptr[8] << 8) | ptr[7]; + } + if (ptr[0] & 0x4) { +- frame->left_bar = (ptr[9] << 8) + ptr[10]; +- frame->right_bar = (ptr[11] << 8) + ptr[12]; ++ frame->left_bar = (ptr[10] << 8) | ptr[9]; ++ frame->right_bar = (ptr[12] << 8) | ptr[11]; + } + frame->scan_mode = ptr[0] & 0x3; + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index cbe9e2295752..b791b240ed41 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -468,6 +468,17 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + + get_page(newpage); /* balloon reference */ + ++ /* ++ * When we migrate a page to a different zone and adjusted the ++ * managed page count when inflating, we have to fixup the count of ++ * both involved zones. ++ */ ++ if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM) && ++ page_zone(page) != page_zone(newpage)) { ++ adjust_managed_page_count(page, 1); ++ adjust_managed_page_count(newpage, -1); ++ } ++ + /* balloon's page migration 1st step -- inflate "newpage" */ + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); + balloon_page_insert(vb_dev_info, newpage); +diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c +index 0d8b9c4f27f2..5124f06c32bc 100644 +--- a/fs/autofs4/expire.c ++++ b/fs/autofs4/expire.c +@@ -467,9 +467,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, + */ + flags &= ~AUTOFS_EXP_LEAVES; + found = should_expire(expired, mnt, timeout, how); +- if (!found || found != expired) +- /* Something has changed, continue */ ++ if (found != expired) { // something has changed, continue ++ dput(found); + goto next; ++ } + + if (expired != dentry) + dput(dentry); +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index d056060529f8..73b547f88bfc 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1525,6 +1525,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file, + } + + reserve_bytes = num_pages << PAGE_CACHE_SHIFT; ++ only_release_metadata = false; + + if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW | + BTRFS_INODE_PREALLOC)) && +@@ -1659,7 +1660,6 @@ again: + set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, + lockend, EXTENT_NORESERVE, NULL, + NULL, GFP_NOFS); +- only_release_metadata = false; + } + + btrfs_drop_pages(pages, num_pages); +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 6c0161284a9e..e5351d9a8dfb 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -391,6 +391,12 @@ static int io_ctl_prepare_pages(struct btrfs_io_ctl *io_ctl, struct inode *inode + if (uptodate && !PageUptodate(page)) { + btrfs_readpage(NULL, page); + lock_page(page); ++ if (page->mapping != inode->i_mapping) { ++ btrfs_err(BTRFS_I(inode)->root->fs_info, ++ "free space cache page truncated"); ++ io_ctl_drop_pages(io_ctl); ++ return -EIO; ++ } + if (!PageUptodate(page)) { + btrfs_err(BTRFS_I(inode)->root->fs_info, + "error reading free space cache"); +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index 7feac2d9da56..d24f3ceb0691 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -312,7 +312,6 @@ struct btrfs_bio { + u64 map_type; /* get from map_lookup->type */ + bio_end_io_t *end_io; + struct bio *orig_bio; +- unsigned long flags; + void *private; + atomic_t error; + int max_errors; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index c6bd820f9409..2ffdaedca7e9 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -312,9 +312,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- cifs_down_write(&cinode->lock_sem); +- list_add(&fdlocks->llist, &cinode->llist); +- up_write(&cinode->lock_sem); + + cfile->count = 1; + cfile->pid = current->tgid; +@@ -338,6 +335,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + oplock = 0; + } + ++ cifs_down_write(&cinode->lock_sem); ++ list_add(&fdlocks->llist, &cinode->llist); ++ up_write(&cinode->lock_sem); ++ + spin_lock(&tcon->open_file_lock); + if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock) + oplock = fid->pending_open->oplock; +@@ -702,6 +703,13 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (backup_cred(cifs_sb)) + create_options |= CREATE_OPEN_BACKUP_INTENT; + ++ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ ++ if (cfile->f_flags & O_SYNC) ++ create_options |= CREATE_WRITE_THROUGH; ++ ++ if (cfile->f_flags & O_DIRECT) ++ create_options |= CREATE_NO_BUFFER; ++ + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 0e62bf1ebbd7..44198b9a5315 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -582,10 +582,10 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp, &server->smb_ses_list) { + ses = list_entry(tmp, struct cifs_ses, smb_ses_list); ++ + list_for_each(tmp1, &ses->tcon_list) { + tcon = list_entry(tmp1, struct cifs_tcon, tcon_list); + +- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks); + spin_lock(&tcon->open_file_lock); + list_for_each(tmp2, &tcon->openFileList) { + cfile = list_entry(tmp2, struct cifsFileInfo, +@@ -597,6 +597,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + continue; + + cifs_dbg(FYI, "file id match, oplock break\n"); ++ cifs_stats_inc( ++ &tcon->stats.cifs_stats.num_oplock_brks); + cinode = CIFS_I(d_inode(cfile->dentry)); + spin_lock(&cfile->file_info_lock); + if (!CIFS_CACHE_WRITE(cinode) && +@@ -628,9 +630,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + return true; + } + spin_unlock(&tcon->open_file_lock); +- spin_unlock(&cifs_tcp_ses_lock); +- cifs_dbg(FYI, "No matching file for oplock break\n"); +- return true; + } + } + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 30e4e01db35a..b14bb2c46042 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -800,6 +800,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) + + dlm_delete_debug_file(ls); + ++ idr_destroy(&ls->ls_recover_idr); + kfree(ls->ls_recover_buf); + + /* +diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c +index 7cd24bccd4fe..37be29f21d04 100644 +--- a/fs/dlm/memory.c ++++ b/fs/dlm/memory.c +@@ -38,10 +38,8 @@ int __init dlm_memory_init(void) + + void dlm_memory_exit(void) + { +- if (lkb_cache) +- kmem_cache_destroy(lkb_cache); +- if (rsb_cache) +- kmem_cache_destroy(rsb_cache); ++ kmem_cache_destroy(lkb_cache); ++ kmem_cache_destroy(rsb_cache); + } + + char *dlm_allocate_lvb(struct dlm_ls *ls) +@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb) + struct dlm_user_args *ua; + ua = lkb->lkb_ua; + if (ua) { +- if (ua->lksb.sb_lvbptr) +- kfree(ua->lksb.sb_lvbptr); ++ kfree(ua->lksb.sb_lvbptr); + kfree(ua); + } + } +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index dd2b7416e40a..761d74a84f92 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -25,6 +25,7 @@ + #include "lvb_table.h" + #include "user.h" + #include "ast.h" ++#include "config.h" + + static const char name_prefix[] = "dlm"; + static const struct file_operations device_fops; +@@ -402,7 +403,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- error = dlm_new_lockspace(params->name, NULL, params->flags, ++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags, + DLM_USER_LVB_LEN, NULL, NULL, NULL, + &lockspace); + if (error) +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 7d7081619f6e..485a5531c68c 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -240,7 +240,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) + kfree(forget); + if (ret == -ENOMEM) + goto out; +- if (ret || (outarg.attr.mode ^ inode->i_mode) & S_IFMT) ++ if (ret || fuse_invalid_attr(&outarg.attr) || ++ (outarg.attr.mode ^ inode->i_mode) & S_IFMT) + goto invalid; + + fuse_change_attributes(inode, &outarg.attr, +@@ -282,6 +283,12 @@ int fuse_valid_type(int m) + S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m); + } + ++bool fuse_invalid_attr(struct fuse_attr *attr) ++{ ++ return !fuse_valid_type(attr->mode) || ++ attr->size > LLONG_MAX; ++} ++ + int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name, + struct fuse_entry_out *outarg, struct inode **inode) + { +@@ -313,7 +320,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name, + err = -EIO; + if (!outarg->nodeid) + goto out_put_forget; +- if (!fuse_valid_type(outarg->attr.mode)) ++ if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, +@@ -433,7 +440,8 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, + goto out_free_ff; + + err = -EIO; +- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) ++ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) || ++ fuse_invalid_attr(&outentry.attr)) + goto out_free_ff; + + ff->fh = outopen.fh; +@@ -539,7 +547,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, + goto out_put_forget_req; + + err = -EIO; +- if (invalid_nodeid(outarg.nodeid)) ++ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr)) + goto out_put_forget_req; + + if ((outarg.attr.mode ^ mode) & S_IFMT) +@@ -812,7 +820,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir, + + spin_lock(&fc->lock); + fi->attr_version = ++fc->attr_version; +- inc_nlink(inode); ++ if (likely(inode->i_nlink < UINT_MAX)) ++ inc_nlink(inode); + spin_unlock(&fc->lock); + fuse_invalidate_attr(inode); + fuse_update_ctime(inode); +@@ -892,7 +901,8 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, + args.out.args[0].value = &outarg; + err = fuse_simple_request(fc, &args); + if (!err) { +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + } else { +@@ -1197,7 +1207,7 @@ static int fuse_direntplus_link(struct file *file, + + if (invalid_nodeid(o->nodeid)) + return -EIO; +- if (!fuse_valid_type(o->attr.mode)) ++ if (fuse_invalid_attr(&o->attr)) + return -EIO; + + fc = get_fuse_conn(dir); +@@ -1669,7 +1679,8 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr, + goto error; + } + +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + goto error; +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index c6eb35a95fcc..88440072fa4f 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -887,6 +887,8 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc); + */ + int fuse_valid_type(int m); + ++bool fuse_invalid_attr(struct fuse_attr *attr); ++ + /** + * Is current process allowed to perform filesystem operation? + */ +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index e3d47091b191..2cb2e61cdbf6 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -655,7 +655,7 @@ struct cld_net { + struct cld_upcall { + struct list_head cu_list; + struct cld_net *cu_net; +- struct task_struct *cu_task; ++ struct completion cu_done; + struct cld_msg cu_msg; + }; + +@@ -664,23 +664,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg) + { + int ret; + struct rpc_pipe_msg msg; ++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg); + + memset(&msg, 0, sizeof(msg)); + msg.data = cmsg; + msg.len = sizeof(*cmsg); + +- /* +- * Set task state before we queue the upcall. That prevents +- * wake_up_process in the downcall from racing with schedule. +- */ +- set_current_state(TASK_UNINTERRUPTIBLE); + ret = rpc_queue_upcall(pipe, &msg); + if (ret < 0) { +- set_current_state(TASK_RUNNING); + goto out; + } + +- schedule(); ++ wait_for_completion(&cup->cu_done); + + if (msg.errno < 0) + ret = msg.errno; +@@ -747,7 +742,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (copy_from_user(&cup->cu_msg, src, mlen) != 0) + return -EFAULT; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + return mlen; + } + +@@ -762,7 +757,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) + if (msg->errno >= 0) + return; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + } + + static const struct rpc_pipe_ops cld_upcall_ops = { +@@ -893,7 +888,7 @@ restart_search: + goto restart_search; + } + } +- new->cu_task = current; ++ init_completion(&new->cu_done); + new->cu_msg.cm_vers = CLD_UPCALL_VERSION; + put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid); + new->cu_net = cn; +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 17138a97f306..7745d0a9029c 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -387,10 +387,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + bool get_write_count; + bool size_change = (iap->ia_valid & ATTR_SIZE); + +- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) ++ if (iap->ia_valid & ATTR_SIZE) { + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +- if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; ++ } ++ ++ /* ++ * If utimes(2) and friends are called with times not NULL, we should ++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission ++ * will return EACCESS, when the caller's effective UID does not match ++ * the owner of the file, and the caller is not privileged. In this ++ * situation, we should return EPERM(notify_change will return this). ++ */ ++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) { ++ accmode |= NFSD_MAY_OWNER_OVERRIDE; ++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET))) ++ accmode |= NFSD_MAY_WRITE; ++ } + + /* Callers that do fh_verify should do the fh_want_write: */ + get_write_count = !fhp->fh_dentry; +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index c93d67220887..3e5cfcfc8133 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -714,7 +714,7 @@ static int ocfs2_release_dquot(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out; + /* Running from downconvert thread? Postpone quota processing to wq */ + if (current == osb->dc_task) { +diff --git a/fs/proc/array.c b/fs/proc/array.c +index 60cbaa821164..6238f45eed02 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -425,9 +425,21 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, + mm = get_task_mm(task); + if (mm) { + vsize = task_vsize(mm); +- if (permitted) { +- eip = KSTK_EIP(task); +- esp = KSTK_ESP(task); ++ /* ++ * esp and eip are intentionally zeroed out. There is no ++ * non-racy way to read them without freezing the task. ++ * Programs that need reliable values can use ptrace(2). ++ * ++ * The only exception is if the task is core dumping because ++ * a program is not able to use ptrace(2) in that case. It is ++ * safe because the task has stopped executing permanently. ++ */ ++ if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) { ++ if (try_get_task_stack(task)) { ++ eip = KSTK_EIP(task); ++ esp = KSTK_ESP(task); ++ put_task_stack(task); ++ } + } + } + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 1cb1d02c5937..7430cb0e21a7 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -472,7 +472,7 @@ int dquot_release(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out_dqlock; + mutex_lock(&dqopt->dqio_mutex); + if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { +@@ -604,7 +604,7 @@ EXPORT_SYMBOL(dquot_scan_active); + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +- struct list_head *dirty; ++ struct list_head dirty; + struct dquot *dquot; + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +@@ -617,9 +617,10 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + if (!sb_has_quota_active(sb, cnt)) + continue; + spin_lock(&dq_list_lock); +- dirty = &dqopt->info[cnt].dqi_dirty_list; +- while (!list_empty(dirty)) { +- dquot = list_first_entry(dirty, struct dquot, ++ /* Move list away to avoid livelock. */ ++ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty); ++ while (!list_empty(&dirty)) { ++ dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + /* Dirty and inactive can be only bad dquot... */ + if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 6a30f1e03aa9..0bd0a9ad5455 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -75,7 +75,7 @@ static inline bool has_acpi_companion(struct device *dev) + static inline void acpi_preset_companion(struct device *dev, + struct acpi_device *parent, u64 addr) + { +- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL)); ++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false)); + } + + static inline const char *acpi_dev_name(struct acpi_device *adev) +diff --git a/include/linux/atalk.h b/include/linux/atalk.h +index af43ed404ff4..4be0e14b38fc 100644 +--- a/include/linux/atalk.h ++++ b/include/linux/atalk.h +@@ -107,7 +107,7 @@ static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb) + #define AARP_RESOLVE_TIME (10 * HZ) + + extern struct datalink_proto *ddp_dl, *aarp_dl; +-extern void aarp_proto_init(void); ++extern int aarp_proto_init(void); + + /* Inter module exports */ + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 2e551e2d2d03..62dd6676b7cc 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -151,8 +151,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev) + return SZ_64K; + } + +-static inline unsigned int dma_set_max_seg_size(struct device *dev, +- unsigned int size) ++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size) + { + if (dev->dma_parms) { + dev->dma_parms->max_segment_size = size; +diff --git a/include/linux/init_task.h b/include/linux/init_task.h +index 1c1ff7e4faa4..d25d3f70ee99 100644 +--- a/include/linux/init_task.h ++++ b/include/linux/init_task.h +@@ -15,6 +15,8 @@ + #include <net/net_namespace.h> + #include <linux/sched/rt.h> + ++#include <asm/thread_info.h> ++ + #ifdef CONFIG_SMP + # define INIT_PUSHABLE_TASKS(tsk) \ + .pushable_tasks = PLIST_NODE_INIT(tsk.pushable_tasks, MAX_PRIO), +@@ -183,12 +185,19 @@ extern struct task_group root_task_group; + # define INIT_KASAN(tsk) + #endif + ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++# define INIT_TASK_TI(tsk) .thread_info = INIT_THREAD_INFO(tsk), ++#else ++# define INIT_TASK_TI(tsk) ++#endif ++ + /* + * INIT_TASK is used to set up the first task table, touch at + * your own risk!. Base=0, limit=0x1fffff (=2MB) + */ + #define INIT_TASK(tsk) \ + { \ ++ INIT_TASK_TI(tsk) \ + .state = 0, \ + .stack = &init_thread_info, \ + .usage = ATOMIC_INIT(2), \ +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 65407f6c9120..00108208759d 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1440,7 +1440,7 @@ static inline int jbd2_space_needed(journal_t *journal) + static inline unsigned long jbd2_log_space_left(journal_t *journal) + { + /* Allow for rounding errors */ +- unsigned long free = journal->j_free - 32; ++ long free = journal->j_free - 32; + + if (journal->j_committing_transaction) { + unsigned long committing = atomic_read(&journal-> +@@ -1449,7 +1449,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal) + /* Transaction + control blocks */ + free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); + } +- return free; ++ return max_t(long, free, 0); + } + + /* +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 861b71377e5e..d999e503ba8a 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1617,6 +1617,11 @@ struct net_device { + unsigned char if_port; + unsigned char dma; + ++ /* Note : dev->mtu is often read without holding a lock. ++ * Writers usually hold RTNL. ++ * It is recommended to use READ_ONCE() to annotate the reads, ++ * and to use WRITE_ONCE() to annotate the writes. ++ */ + unsigned int mtu; + unsigned short type; + unsigned short hard_header_len; +diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h +index 1f350238445c..a946c4c1a77e 100644 +--- a/include/linux/quotaops.h ++++ b/include/linux/quotaops.h +@@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) + atomic_inc(&dquot->dq_count); + return dquot; + } ++ ++static inline bool dquot_is_busy(struct dquot *dquot) ++{ ++ if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ return true; ++ if (atomic_read(&dquot->dq_count) > 1) ++ return true; ++ return false; ++} ++ + void dqput(struct dquot *dquot); + int dquot_scan_active(struct super_block *sb, + int (*fn)(struct dquot *dquot, unsigned long priv), +diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h +index 9e0e76992be0..bf62713af290 100644 +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -485,7 +485,7 @@ static inline unsigned int regulator_get_mode(struct regulator *regulator) + + static inline int regulator_set_load(struct regulator *regulator, int load_uA) + { +- return REGULATOR_MODE_NORMAL; ++ return 0; + } + + static inline int regulator_allow_bypass(struct regulator *regulator, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 1218980f53de..761247c966a5 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1389,6 +1389,13 @@ struct tlbflush_unmap_batch { + }; + + struct task_struct { ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++ /* ++ * For reasons of header soup (see current_thread_info()), this ++ * must be the first element of task_struct. ++ */ ++ struct thread_info thread_info; ++#endif + volatile long state; /* -1 unrunnable, 0 runnable, >0 stopped */ + void *stack; + atomic_t usage; +@@ -1398,6 +1405,9 @@ struct task_struct { + #ifdef CONFIG_SMP + struct llist_node wake_entry; + int on_cpu; ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++ unsigned int cpu; /* current CPU */ ++#endif + unsigned int wakee_flips; + unsigned long wakee_flip_decay_ts; + struct task_struct *last_wakee; +@@ -2440,7 +2450,9 @@ extern void set_curr_task(int cpu, struct task_struct *p); + void yield(void); + + union thread_union { ++#ifndef CONFIG_THREAD_INFO_IN_TASK + struct thread_info thread_info; ++#endif + unsigned long stack[THREAD_SIZE/sizeof(long)]; + }; + +@@ -2840,10 +2852,34 @@ static inline void threadgroup_change_end(struct task_struct *tsk) + cgroup_threadgroup_change_end(tsk); + } + +-#ifndef __HAVE_THREAD_FUNCTIONS ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++ ++static inline struct thread_info *task_thread_info(struct task_struct *task) ++{ ++ return &task->thread_info; ++} ++ ++/* ++ * When accessing the stack of a non-current task that might exit, use ++ * try_get_task_stack() instead. task_stack_page will return a pointer ++ * that could get freed out from under you. ++ */ ++static inline void *task_stack_page(const struct task_struct *task) ++{ ++ return task->stack; ++} ++ ++#define setup_thread_stack(new,old) do { } while(0) ++ ++static inline unsigned long *end_of_stack(const struct task_struct *task) ++{ ++ return task->stack; ++} ++ ++#elif !defined(__HAVE_THREAD_FUNCTIONS) + + #define task_thread_info(task) ((struct thread_info *)(task)->stack) +-#define task_stack_page(task) ((task)->stack) ++#define task_stack_page(task) ((void *)(task)->stack) + + static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org) + { +@@ -2870,6 +2906,14 @@ static inline unsigned long *end_of_stack(struct task_struct *p) + } + + #endif ++ ++static inline void *try_get_task_stack(struct task_struct *tsk) ++{ ++ return task_stack_page(tsk); ++} ++ ++static inline void put_task_stack(struct task_struct *tsk) {} ++ + #define task_stack_end_corrupted(task) \ + (*(end_of_stack(task)) != STACK_END_MAGIC) + +@@ -3135,7 +3179,11 @@ static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume) + + static inline unsigned int task_cpu(const struct task_struct *p) + { ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++ return p->cpu; ++#else + return task_thread_info(p)->cpu; ++#endif + } + + static inline int task_node(const struct task_struct *p) +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 297d4fa1cfe5..b5b527efeea0 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -159,6 +159,7 @@ struct uart_port { + struct console *cons; /* struct console, if any */ + #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ) + unsigned long sysrq; /* sysrq timeout */ ++ unsigned int sysrq_ch; /* char for sysrq */ + #endif + + /* flags must be updated while holding port mutex */ +@@ -440,8 +441,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) + } + return 0; + } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) ++{ ++ if (port->sysrq) { ++ if (ch && time_before(jiffies, port->sysrq)) { ++ port->sysrq_ch = ch; ++ port->sysrq = 0; ++ return 1; ++ } ++ port->sysrq = 0; ++ } ++ return 0; ++} ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ int sysrq_ch; ++ ++ sysrq_ch = port->sysrq_ch; ++ port->sysrq_ch = 0; ++ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++ ++ if (sysrq_ch) ++ handle_sysrq(sysrq_ch); ++} + #else +-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; }) ++static inline int ++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++} + #endif + + /* +diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h +index 646891f3bc1e..897e835379d8 100644 +--- a/include/linux/thread_info.h ++++ b/include/linux/thread_info.h +@@ -13,6 +13,10 @@ + struct timespec; + struct compat_timespec; + ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++#define current_thread_info() ((struct thread_info *)current) ++#endif ++ + /* + * System call restart block. + */ +diff --git a/include/linux/time.h b/include/linux/time.h +index 297f09f23896..62cc50700004 100644 +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -262,4 +262,16 @@ static __always_inline void timespec_add_ns(struct timespec *a, u64 ns) + a->tv_nsec = ns; + } + ++/** ++ * time_between32 - check if a 32-bit timestamp is within a given time range ++ * @t: the time which may be within [l,h] ++ * @l: the lower bound of the range ++ * @h: the higher bound of the range ++ * ++ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are ++ * treated as 32-bit integers. ++ * ++ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)). ++ */ ++#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l)) + #endif +diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h +index 3f284bc03180..5650c1628383 100644 +--- a/include/math-emu/soft-fp.h ++++ b/include/math-emu/soft-fp.h +@@ -138,7 +138,7 @@ do { \ + _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \ + } while (0) + +-#define _FP_ROUND_ZERO(wc, X) 0 ++#define _FP_ROUND_ZERO(wc, X) (void)0 + + #define _FP_ROUND_PINF(wc, X) \ + do { \ +diff --git a/include/net/ip.h b/include/net/ip.h +index e2320f9e4d3e..6067b7a10ccd 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -596,4 +596,9 @@ extern int sysctl_icmp_msgs_burst; + int ip_misc_proc_init(void); + #endif + ++static inline bool inetdev_valid_mtu(unsigned int mtu) ++{ ++ return likely(mtu >= IPV4_MIN_MTU); ++} ++ + #endif /* _IP_H */ +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 4447195a0cd4..3bdd6ef95717 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -502,19 +502,27 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb); + */ + static inline void tcp_synq_overflow(const struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + unsigned long now = jiffies; + +- if (time_after(now, last_overflow + HZ)) +- tcp_sk(sk)->rx_opt.ts_recent_stamp = now; ++ if (!time_between32(now, last_overflow, last_overflow + HZ)) ++ WRITE_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp, now); + } + + /* syncookies: no recent synqueue overflow on this listening socket? */ + static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + +- return time_after(jiffies, last_overflow + TCP_SYNCOOKIE_VALID); ++ /* If last_overflow <= jiffies <= last_overflow + TCP_SYNCOOKIE_VALID, ++ * then we're under synflood. However, we have to use ++ * 'last_overflow - HZ' as lower bound. That's because a concurrent ++ * tcp_synq_overflow() could update .ts_recent_stamp after we read ++ * jiffies but before we store .ts_recent_stamp into last_overflow, ++ * which could lead to rejecting a valid syncookie. ++ */ ++ return !time_between32(jiffies, last_overflow - HZ, ++ last_overflow + TCP_SYNCOOKIE_VALID); + } + + static inline u32 tcp_cookie_time(void) +diff --git a/init/Kconfig b/init/Kconfig +index 47b0bdcf33c2..f9fb621c9562 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -26,6 +26,16 @@ config IRQ_WORK + config BUILDTIME_EXTABLE_SORT + bool + ++config THREAD_INFO_IN_TASK ++ bool ++ help ++ Select this to move thread_info off the stack into task_struct. To ++ make this work, an arch will need to remove all thread_info fields ++ except flags and fix any runtime bugs. ++ ++ One subtle change that will be needed is to use try_get_task_stack() ++ and put_task_stack() in save_thread_stack_tsk() and get_wchan(). ++ + menu "General setup" + + config BROKEN +diff --git a/init/init_task.c b/init/init_task.c +index ba0a7f362d9e..11f83be1fa79 100644 +--- a/init/init_task.c ++++ b/init/init_task.c +@@ -22,5 +22,8 @@ EXPORT_SYMBOL(init_task); + * Initial thread structure. Alignment of this is handled by a special + * linker map entry. + */ +-union thread_union init_thread_union __init_task_data = +- { INIT_THREAD_INFO(init_task) }; ++union thread_union init_thread_union __init_task_data = { ++#ifndef CONFIG_THREAD_INFO_IN_TASK ++ INIT_THREAD_INFO(init_task) ++#endif ++}; +diff --git a/kernel/cgroup_pids.c b/kernel/cgroup_pids.c +index b50d5a167fda..ea8cb03dbf72 100644 +--- a/kernel/cgroup_pids.c ++++ b/kernel/cgroup_pids.c +@@ -48,7 +48,7 @@ struct pids_cgroup { + * %PIDS_MAX = (%PID_MAX_LIMIT + 1). + */ + atomic64_t counter; +- int64_t limit; ++ atomic64_t limit; + }; + + static struct pids_cgroup *css_pids(struct cgroup_subsys_state *css) +@@ -70,8 +70,8 @@ pids_css_alloc(struct cgroup_subsys_state *parent) + if (!pids) + return ERR_PTR(-ENOMEM); + +- pids->limit = PIDS_MAX; + atomic64_set(&pids->counter, 0); ++ atomic64_set(&pids->limit, PIDS_MAX); + return &pids->css; + } + +@@ -142,13 +142,14 @@ static int pids_try_charge(struct pids_cgroup *pids, int num) + + for (p = pids; parent_pids(p); p = parent_pids(p)) { + int64_t new = atomic64_add_return(num, &p->counter); ++ int64_t limit = atomic64_read(&p->limit); + + /* + * Since new is capped to the maximum number of pid_t, if + * p->limit is %PIDS_MAX then we know that this test will never + * fail. + */ +- if (new > p->limit) ++ if (new > limit) + goto revert; + } + +@@ -262,7 +263,7 @@ set_limit: + * Limit updates don't need to be mutex'd, since it isn't + * critical that any racing fork()s follow the new limit. + */ +- pids->limit = limit; ++ atomic64_set(&pids->limit, limit); + return nbytes; + } + +@@ -270,7 +271,7 @@ static int pids_max_show(struct seq_file *sf, void *v) + { + struct cgroup_subsys_state *css = seq_css(sf); + struct pids_cgroup *pids = css_pids(css); +- int64_t limit = pids->limit; ++ int64_t limit = atomic64_read(&pids->limit); + + if (limit >= PIDS_MAX) + seq_printf(sf, "%s\n", PIDS_MAX_STR); +diff --git a/kernel/module.c b/kernel/module.c +index b940b2825b7b..2f695b6e1a3e 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1014,6 +1014,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, + strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module)); + + free_module(mod); ++ /* someone could wait for the module in add_unformed_module() */ ++ wake_up_all(&module_wq); + return 0; + out: + mutex_unlock(&module_mutex); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index d012681fb1ab..b42d2b8b283e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4055,20 +4055,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) + if (++count > 3) { + u64 new, old = ktime_to_ns(cfs_b->period); + +- new = (old * 147) / 128; /* ~115% */ +- new = min(new, max_cfs_quota_period); +- +- cfs_b->period = ns_to_ktime(new); +- +- /* since max is 1s, this is limited to 1e9^2, which fits in u64 */ +- cfs_b->quota *= new; +- cfs_b->quota = div64_u64(cfs_b->quota, old); +- +- pr_warn_ratelimited( +- "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n", +- smp_processor_id(), +- div_u64(new, NSEC_PER_USEC), +- div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ /* ++ * Grow period by a factor of 2 to avoid losing precision. ++ * Precision loss in the quota/period ratio can cause __cfs_schedulable ++ * to fail. ++ */ ++ new = old * 2; ++ if (new < max_cfs_quota_period) { ++ cfs_b->period = ns_to_ktime(new); ++ cfs_b->quota *= 2; ++ ++ pr_warn_ratelimited( ++ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us = %lld, cfs_quota_us = %lld)\n", ++ smp_processor_id(), ++ div_u64(new, NSEC_PER_USEC), ++ div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ } else { ++ pr_warn_ratelimited( ++ "cfs_period_timer[cpu%d]: period too short, but cannot scale up without losing precision (cfs_period_us = %lld, cfs_quota_us = %lld)\n", ++ smp_processor_id(), ++ div_u64(old, NSEC_PER_USEC), ++ div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ } + + /* reset count so we don't come right back in here */ + count = 0; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8b96df04ba78..8afd9d62c56e 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -978,7 +978,11 @@ static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu) + * per-task data have been completed by this moment. + */ + smp_wmb(); ++#ifdef CONFIG_THREAD_INFO_IN_TASK ++ p->cpu = cpu; ++#else + task_thread_info(p)->cpu = cpu; ++#endif + p->wake_cpu = cpu; + #endif + } +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index d8a2084b88db..3fb2d45c0b42 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -2308,8 +2308,14 @@ repeat: + */ + if (need_to_create_worker(pool)) { + spin_lock(&wq_mayday_lock); +- get_pwq(pwq); +- list_move_tail(&pwq->mayday_node, &wq->maydays); ++ /* ++ * Queue iff we aren't racing destruction ++ * and somebody else hasn't queued it already. ++ */ ++ if (wq->rescuer && list_empty(&pwq->mayday_node)) { ++ get_pwq(pwq); ++ list_add_tail(&pwq->mayday_node, &wq->maydays); ++ } + spin_unlock(&wq_mayday_lock); + } + } +@@ -3949,9 +3955,29 @@ void destroy_workqueue(struct workqueue_struct *wq) + struct pool_workqueue *pwq; + int node; + ++ /* ++ * Remove it from sysfs first so that sanity check failure doesn't ++ * lead to sysfs name conflicts. ++ */ ++ workqueue_sysfs_unregister(wq); ++ + /* drain it before proceeding with destruction */ + drain_workqueue(wq); + ++ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */ ++ if (wq->rescuer) { ++ struct worker *rescuer = wq->rescuer; ++ ++ /* this prevents new queueing */ ++ spin_lock_irq(&wq_mayday_lock); ++ wq->rescuer = NULL; ++ spin_unlock_irq(&wq_mayday_lock); ++ ++ /* rescuer will empty maydays list before exiting */ ++ kthread_stop(rescuer->task); ++ kfree(rescuer); ++ } ++ + /* sanity checks */ + mutex_lock(&wq->mutex); + for_each_pwq(pwq, wq) { +@@ -3981,11 +4007,6 @@ void destroy_workqueue(struct workqueue_struct *wq) + list_del_rcu(&wq->list); + mutex_unlock(&wq_pool_mutex); + +- workqueue_sysfs_unregister(wq); +- +- if (wq->rescuer) +- kthread_stop(wq->rescuer->task); +- + if (!(wq->flags & WQ_UNBOUND)) { + /* + * The base ref is never dropped on per-cpu pwqs. Directly +@@ -4262,7 +4283,8 @@ static void show_pwq(struct pool_workqueue *pwq) + pr_info(" pwq %d:", pool->id); + pr_cont_pool_info(pool); + +- pr_cont(" active=%d/%d%s\n", pwq->nr_active, pwq->max_active, ++ pr_cont(" active=%d/%d refcnt=%d%s\n", ++ pwq->nr_active, pwq->max_active, pwq->refcnt, + !list_empty(&pwq->mayday_node) ? " MAYDAY" : ""); + + hash_for_each(pool->busy_hash, bkt, worker, hentry) { +diff --git a/lib/raid6/unroll.awk b/lib/raid6/unroll.awk +index c6aa03631df8..0809805a7e23 100644 +--- a/lib/raid6/unroll.awk ++++ b/lib/raid6/unroll.awk +@@ -13,7 +13,7 @@ BEGIN { + for (i = 0; i < rep; ++i) { + tmp = $0 + gsub(/\$\$/, i, tmp) +- gsub(/\$\#/, n, tmp) ++ gsub(/\$#/, n, tmp) + gsub(/\$\*/, "$", tmp) + print tmp + } +diff --git a/mm/shmem.c b/mm/shmem.c +index e40239bf6dfe..07abbdfb1d22 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2092,7 +2092,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + } + + shmem_falloc.waitq = &shmem_falloc_waitq; +- shmem_falloc.start = unmap_start >> PAGE_SHIFT; ++ shmem_falloc.start = (u64)unmap_start >> PAGE_SHIFT; + shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT; + spin_lock(&inode->i_lock); + inode->i_private = &shmem_falloc; +diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c +index 8ad3ec2610b6..b9e85a4751a6 100644 +--- a/net/appletalk/aarp.c ++++ b/net/appletalk/aarp.c +@@ -879,15 +879,24 @@ static struct notifier_block aarp_notifier = { + + static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 }; + +-void __init aarp_proto_init(void) ++int __init aarp_proto_init(void) + { ++ int rc; ++ + aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv); +- if (!aarp_dl) ++ if (!aarp_dl) { + printk(KERN_CRIT "Unable to register AARP with SNAP.\n"); ++ return -ENOMEM; ++ } + setup_timer(&aarp_timer, aarp_expire_timeout, 0); + aarp_timer.expires = jiffies + sysctl_aarp_expiry_time; + add_timer(&aarp_timer); +- register_netdevice_notifier(&aarp_notifier); ++ rc = register_netdevice_notifier(&aarp_notifier); ++ if (rc) { ++ del_timer_sync(&aarp_timer); ++ unregister_snap_client(aarp_dl); ++ } ++ return rc; + } + + /* Remove the AARP entries associated with a device. */ +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index e23bf739492c..ace94170f55e 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1911,9 +1911,6 @@ static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B }; + EXPORT_SYMBOL(atrtr_get_dev); + EXPORT_SYMBOL(atalk_find_dev_addr); + +-static const char atalk_err_snap[] __initconst = +- KERN_CRIT "Unable to register DDP with SNAP.\n"; +- + /* Called by proto.c on kernel start up */ + static int __init atalk_init(void) + { +@@ -1928,17 +1925,23 @@ static int __init atalk_init(void) + goto out_proto; + + ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv); +- if (!ddp_dl) +- printk(atalk_err_snap); ++ if (!ddp_dl) { ++ pr_crit("Unable to register DDP with SNAP.\n"); ++ rc = -ENOMEM; ++ goto out_sock; ++ } + + dev_add_pack(<alk_packet_type); + dev_add_pack(&ppptalk_packet_type); + + rc = register_netdevice_notifier(&ddp_notifier); + if (rc) +- goto out_sock; ++ goto out_snap; ++ ++ rc = aarp_proto_init(); ++ if (rc) ++ goto out_dev; + +- aarp_proto_init(); + rc = atalk_proc_init(); + if (rc) + goto out_aarp; +@@ -1952,11 +1955,13 @@ out_proc: + atalk_proc_exit(); + out_aarp: + aarp_cleanup_module(); ++out_dev: + unregister_netdevice_notifier(&ddp_notifier); +-out_sock: ++out_snap: + dev_remove_pack(&ppptalk_packet_type); + dev_remove_pack(<alk_packet_type); + unregister_snap_client(ddp_dl); ++out_sock: + sock_unregister(PF_APPLETALK); + out_proto: + proto_unregister(&ddp_proto); +diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c +index 2c8095a5d824..3d462fee9ed7 100644 +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -199,6 +199,12 @@ static int br_set_mac_address(struct net_device *dev, void *p) + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + ++ /* dev_set_mac_addr() can be called by a master device on bridge's ++ * NETDEV_UNREGISTER, but since it's being destroyed do nothing ++ */ ++ if (dev->reg_state != NETREG_REGISTERED) ++ return -EBUSY; ++ + spin_lock_bh(&br->lock); + if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) { + /* Mac address will be changed in br_stp_change_bridge_id(). */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 903c6242b449..108c32903a74 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6126,7 +6126,8 @@ static int __dev_set_mtu(struct net_device *dev, int new_mtu) + if (ops->ndo_change_mtu) + return ops->ndo_change_mtu(dev, new_mtu); + +- dev->mtu = new_mtu; ++ /* Pairs with all the lockless reads of dev->mtu in the stack */ ++ WRITE_ONCE(dev->mtu, new_mtu); + return 0; + } + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 4472329f5f47..dbbe6f051a92 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1364,11 +1364,6 @@ skip: + } + } + +-static bool inetdev_valid_mtu(unsigned int mtu) +-{ +- return mtu >= IPV4_MIN_MTU; +-} +- + static void inetdev_send_gratuitous_arp(struct net_device *dev, + struct in_device *in_dev) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 6d5a0a7ebe10..d940c9e0eb02 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1145,13 +1145,17 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, + rt = *rtp; + if (unlikely(!rt)) + return -EFAULT; +- /* +- * We steal reference to this route, caller should not release it +- */ +- *rtp = NULL; ++ + cork->fragsize = ip_sk_use_pmtu(sk) ? +- dst_mtu(&rt->dst) : rt->dst.dev->mtu; ++ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); ++ ++ if (!inetdev_valid_mtu(cork->fragsize)) ++ return -ENETUNREACH; ++ + cork->dst = &rt->dst; ++ /* We stole this route, caller should not release it. */ ++ *rtp = NULL; ++ + cork->length = 0; + cork->ttl = ipc->ttl; + cork->tos = ipc->tos; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 76ffce0c18ae..913c7fb51b18 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -710,8 +710,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb + min_t(unsigned int, eff_sacks, + (remaining - TCPOLEN_SACK_BASE_ALIGNED) / + TCPOLEN_SACK_PERBLOCK); +- size += TCPOLEN_SACK_BASE_ALIGNED + +- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; ++ if (likely(opts->num_sack_blocks)) ++ size += TCPOLEN_SACK_BASE_ALIGNED + ++ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; + } + + return size; +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 61359944acc7..710cde1a5a83 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -336,7 +336,7 @@ static void tcp_probe_timer(struct sock *sk) + return; + } + +- if (icsk->icsk_probes_out > max_probes) { ++ if (icsk->icsk_probes_out >= max_probes) { + abort: tcp_write_err(sk); + } else { + /* Only send another probe if we didn't close things up. */ +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index a8ab98b53a3a..570832949f91 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -54,9 +54,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) + h->last_refresh = now; + } + +-static inline int cache_is_valid(struct cache_head *h); +-static void cache_fresh_locked(struct cache_head *head, time_t expiry, +- struct cache_detail *detail); + static void cache_fresh_unlocked(struct cache_head *head, + struct cache_detail *detail); + +@@ -101,9 +98,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, + if (cache_is_expired(detail, tmp)) { + hlist_del_init(&tmp->cache_list); + detail->entries --; +- if (cache_is_valid(tmp) == -EAGAIN) +- set_bit(CACHE_NEGATIVE, &tmp->flags); +- cache_fresh_locked(tmp, 0, detail); + freeme = tmp; + break; + } +diff --git a/net/tipc/core.c b/net/tipc/core.c +index 35b376f58f21..1aa16b00f105 100644 +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -117,14 +117,6 @@ static int __init tipc_init(void) + TIPC_CRITICAL_IMPORTANCE; + sysctl_tipc_rmem[2] = TIPC_CONN_OVERLOAD_LIMIT; + +- err = tipc_netlink_start(); +- if (err) +- goto out_netlink; +- +- err = tipc_netlink_compat_start(); +- if (err) +- goto out_netlink_compat; +- + err = tipc_register_sysctl(); + if (err) + goto out_sysctl; +@@ -145,8 +137,21 @@ static int __init tipc_init(void) + if (err) + goto out_bearer; + ++ err = tipc_netlink_start(); ++ if (err) ++ goto out_netlink; ++ ++ err = tipc_netlink_compat_start(); ++ if (err) ++ goto out_netlink_compat; ++ + pr_info("Started in single node mode\n"); + return 0; ++ ++out_netlink_compat: ++ tipc_netlink_stop(); ++out_netlink: ++ tipc_bearer_cleanup(); + out_bearer: + unregister_pernet_device(&tipc_topsrv_net_ops); + out_pernet_topsrv: +@@ -156,22 +161,18 @@ out_socket: + out_pernet: + tipc_unregister_sysctl(); + out_sysctl: +- tipc_netlink_compat_stop(); +-out_netlink_compat: +- tipc_netlink_stop(); +-out_netlink: + pr_err("Unable to start in single node mode\n"); + return err; + } + + static void __exit tipc_exit(void) + { ++ tipc_netlink_compat_stop(); ++ tipc_netlink_stop(); + tipc_bearer_cleanup(); + unregister_pernet_device(&tipc_topsrv_net_ops); + tipc_socket_stop(); + unregister_pernet_device(&tipc_net_ops); +- tipc_netlink_stop(); +- tipc_netlink_compat_stop(); + tipc_unregister_sysctl(); + + pr_info("Deactivated\n"); +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 5dca42dbc737..f330475a87ff 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb, + } + + len = *skb->data; +- needed = 1 + (len >> 4) + (len & 0x0f); ++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2; + + if (!pskb_may_pull(skb, needed)) { + /* packet is too short to hold the addresses it claims +@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr, + sk_for_each(s, &x25_list) + if ((!strcmp(addr->x25_addr, + x25_sk(s)->source_addr.x25_addr) || +- !strcmp(addr->x25_addr, ++ !strcmp(x25_sk(s)->source_addr.x25_addr, + null_x25_address.x25_addr)) && + s->sk_state == TCP_LISTEN) { + /* +@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + +- len = strlen(addr->sx25_addr.x25_addr); +- for (i = 0; i < len; i++) { +- if (!isdigit(addr->sx25_addr.x25_addr[i])) { +- rc = -EINVAL; +- goto out; ++ /* check for the null_x25_address */ ++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { ++ ++ len = strlen(addr->sx25_addr.x25_addr); ++ for (i = 0; i < len; i++) { ++ if (!isdigit(addr->sx25_addr.x25_addr[i])) { ++ rc = -EINVAL; ++ goto out; ++ } + } + } + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 81b1c02a76fa..f27df7605999 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1156,6 +1156,14 @@ static const struct sectioncheck *section_mismatch( + * fromsec = text section + * refsymname = *.constprop.* + * ++ * Pattern 6: ++ * Hide section mismatch warnings for ELF local symbols. The goal ++ * is to eliminate false positive modpost warnings caused by ++ * compiler-generated ELF local symbol names such as ".LANCHOR1". ++ * Autogenerated symbol names bypass modpost's "Pattern 2" ++ * whitelisting, which relies on pattern-matching against symbol ++ * names to work. (One situation where gcc can autogenerate ELF ++ * local symbols is when "-fsection-anchors" is used.) + **/ + static int secref_whitelist(const struct sectioncheck *mismatch, + const char *fromsec, const char *fromsym, +@@ -1194,6 +1202,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + match(fromsym, optim_symbols)) + return 0; + ++ /* Check for pattern 6 */ ++ if (strstarts(fromsym, ".L")) ++ return 0; ++ + return 1; + } + +diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c +index 2045697f449d..797d838a2f9e 100644 +--- a/sound/core/oss/linear.c ++++ b/sound/core/oss/linear.c +@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + convert(plugin, src_channels, dst_channels, frames); + return frames; + } +diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c +index 7915564bd394..3788906421a7 100644 +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + data = (struct mulaw_priv *)plugin->extra_data; + data->func(plugin, src_channels, dst_channels, frames); + return frames; +diff --git a/sound/core/oss/route.c b/sound/core/oss/route.c +index c8171f5783c8..72dea04197ef 100644 +--- a/sound/core/oss/route.c ++++ b/sound/core/oss/route.c +@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin, + return -ENXIO; + if (frames == 0) + return 0; ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + + nsrcs = plugin->src_format.channels; + ndsts = plugin->dst_format.channels; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 3ce2b8771762..950730709d28 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1877,11 +1877,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + unsigned long flags; + +- if (PCM_RUNTIME_CHECK(substream)) ++ if (snd_BUG_ON(!substream)) + return; +- runtime = substream->runtime; + + snd_pcm_stream_lock_irqsave(substream, flags); ++ if (PCM_RUNTIME_CHECK(substream)) ++ goto _unlock; ++ runtime = substream->runtime; ++ + if (!snd_pcm_running(substream) || + snd_pcm_update_hw_ptr0(substream, 1) < 0) + goto _end; +@@ -1892,6 +1895,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + #endif + _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ _unlock: + snd_pcm_stream_unlock_irqrestore(substream, flags); + } + +diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c +index 7ea201c05e5d..d0d6dfbfcfdf 100644 +--- a/sound/pci/hda/hda_bind.c ++++ b/sound/pci/hda/hda_bind.c +@@ -42,6 +42,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) + { + struct hda_codec *codec = container_of(dev, struct hda_codec, core); + ++ /* ignore unsol events during shutdown */ ++ if (codec->bus->shutdown) ++ return; ++ + if (codec->patch_ops.unsol_event) + codec->patch_ops.unsol_event(codec, ev); + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index ef8955abd918..3e3277100f08 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1310,8 +1310,11 @@ static int azx_free(struct azx *chip) + static int azx_dev_disconnect(struct snd_device *device) + { + struct azx *chip = device->device_data; ++ struct hdac_bus *bus = azx_bus(chip); + + chip->bus.shutdown = 1; ++ cancel_work_sync(&bus->unsol_work); ++ + return 0; + } + +diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c +index fbaa1bb41102..00d7902ad427 100644 +--- a/sound/soc/soc-jack.c ++++ b/sound/soc/soc-jack.c +@@ -80,10 +80,9 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask) + unsigned int sync = 0; + int enable; + +- trace_snd_soc_jack_report(jack, mask, status); +- + if (!jack) + return; ++ trace_snd_soc_jack_report(jack, mask, status); + + dapm = &jack->card->dapm; + |