diff options
| author |   Alice Ferrazzi <alicef@gentoo.org> | 2021-07-21 00:34:22 +0900 |
|---|---|---|
| committer | Alice Ferrazzi <alicef@gentoo.org> | 2021-07-21 00:34:43 +0900 |
| commit | d699a021908d23b71bb8c3c9552996776db2013f (patch) | |
| tree | 649d1af6a00fd524f47d17618e5b4eb2f59987cc | |
| parent | Update Homepage for CPU Optimization patch (diff) | |
| download | linux-patches-d699a021908d23b71bb8c3c9552996776db2013f.tar.gz linux-patches-d699a021908d23b71bb8c3c9552996776db2013f.tar.bz2 linux-patches-d699a021908d23b71bb8c3c9552996776db2013f.zip | |
Linux patch 4.19.1984.19-197
Signed-off-by: Alice Ferrazzi <alicef@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1197_linux-4.19.198.patch | 11953 |
2 files changed, 11957 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 3dc1cd29..c6a05320 100644 --- a/0000_README +++ b/0000_README @@ -827,6 +827,10 @@ Patch: 1196_linux-4.19.197.patch From: https://www.kernel.org Desc: Linux 4.19.197 +Patch: 1197_linux-4.19.198.patch +From: https://www.kernel.org +Desc: Linux 4.19.198 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1197_linux-4.19.198.patch b/1197_linux-4.19.198.patch new file mode 100644 index 00000000..9ca735a8 --- /dev/null +++ b/1197_linux-4.19.198.patch @@ -0,0 +1,11953 @@ +diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm +index 201d10319fa18..1df1177df68ad 100644 +--- a/Documentation/ABI/testing/evm ++++ b/Documentation/ABI/testing/evm +@@ -42,8 +42,30 @@ Description: + modification of EVM-protected metadata and + disable all further modification of policy + +- Note that once a key has been loaded, it will no longer be +- possible to enable metadata modification. ++ Echoing a value is additive, the new value is added to the ++ existing initialization flags. ++ ++ For example, after:: ++ ++ echo 2 ><securityfs>/evm ++ ++ another echo can be performed:: ++ ++ echo 1 ><securityfs>/evm ++ ++ and the resulting value will be 3. ++ ++ Note that once an HMAC key has been loaded, it will no longer ++ be possible to enable metadata modification. Signaling that an ++ HMAC key has been loaded will clear the corresponding flag. ++ For example, if the current value is 6 (2 and 4 set):: ++ ++ echo 1 ><securityfs>/evm ++ ++ will set the new value to 3 (4 cleared). ++ ++ Loading an HMAC key is the only way to disable metadata ++ modification. + + Until key loading has been signaled EVM can not create + or validate the 'security.evm' xattr, but returns +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 558332df02a84..6795e9d187d05 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -558,6 +558,12 @@ + loops can be debugged more effectively on production + systems. + ++ clocksource.max_cswd_read_retries= [KNL] ++ Number of clocksource_watchdog() retries due to ++ external delays before the clock will be marked ++ unstable. Defaults to three retries, that is, ++ four attempts to read the clock under test. ++ + clearcpuid=BITNUM[,BITNUM...] [X86] + Disable CPUID feature X for the kernel. See + arch/x86/include/asm/cpufeatures.h for the valid bit +diff --git a/Makefile b/Makefile +index 42073a4c6e2e3..09688ffc3f004 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 197 ++SUBLEVEL = 198 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/boot/dts/am335x-cm-t335.dts b/arch/arm/boot/dts/am335x-cm-t335.dts +index 947c81b7aaafb..56a04d3086c32 100644 +--- a/arch/arm/boot/dts/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/am335x-cm-t335.dts +@@ -552,7 +552,7 @@ status = "okay"; + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_pins>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + /* WLS1271 WiFi */ + wlcore: wlcore@1 { + compatible = "ti,wl1271"; +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index b6950eee550b2..02bbdfb3f2582 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -839,7 +839,7 @@ + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&spi0_pins_default>; + pinctrl-1 = <&spi0_pins_sleep>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + }; + + &spi1 { +@@ -847,7 +847,7 @@ + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&spi1_pins_default>; + pinctrl-1 = <&spi1_pins_sleep>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + }; + + &usb2_phy1 { +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index c91716d5980c3..fa3422c4caec1 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -451,27 +451,27 @@ + <0x1811b408 0x004>, + <0x180293a0 0x01c>; + reg-names = "mspi", "bspi", "intr_regs", "intr_status_reg"; +- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>, +- <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>; +- interrupt-names = "spi_lr_fullness_reached", ++ <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>; ++ interrupt-names = "mspi_done", ++ "mspi_halted", ++ "spi_lr_fullness_reached", + "spi_lr_session_aborted", + "spi_lr_impatient", + "spi_lr_session_done", +- "spi_lr_overhead", +- "mspi_done", +- "mspi_halted"; ++ "spi_lr_overread"; + clocks = <&iprocmed>; + clock-names = "iprocmed"; + num-cs = <2>; + #address-cells = <1>; + #size-cells = <0>; + +- spi_nor: spi-nor@0 { ++ spi_nor: flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <20000000>; +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index 8f332be143f7b..abc6fb7d27259 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -22,7 +22,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +index 122174ea9e0a3..cb00513b9dd71 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +@@ -24,7 +24,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +diff --git a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +index 56acd832f0b3c..16e1087ec7172 100644 +--- a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi ++++ b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +@@ -22,7 +22,7 @@ + * Green LED is much brighter than the others + * so limit its max brightness + */ +- max_brightness = <127>; ++ max-brightness = <127>; + linux,default-trigger = "mmc0"; + }; + +@@ -30,7 +30,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +index 8d4a4cd01e07b..d5161c34a4b1c 100644 +--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +@@ -97,30 +97,40 @@ + reg = <0>; + max-speed = <100>; + reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>; +- reset-delay-us = <1000>; +- reset-post-delay-us = <1000>; ++ reset-assert-us = <1000>; ++ reset-deassert-us = <1000>; ++ smsc,disable-energy-detect; /* Make plugin detection reliable */ + }; + }; + }; + + &i2c1 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c1>; ++ pinctrl-1 = <&pinctrl_i2c1_gpio>; ++ scl-gpios = <&gpio3 21 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio3 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + }; + + &i2c2 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c2>; ++ pinctrl-1 = <&pinctrl_i2c2_gpio>; ++ scl-gpios = <&gpio4 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio4 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + }; + + &i2c3 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c3>; ++ pinctrl-1 = <&pinctrl_i2c3_gpio>; ++ scl-gpios = <&gpio1 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + + ltc3676: pmic@3c { +@@ -286,6 +296,13 @@ + >; + }; + ++ pinctrl_i2c1_gpio: i2c1-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_EIM_D21__GPIO3_IO21 0x4001b8b1 ++ MX6QDL_PAD_EIM_D28__GPIO3_IO28 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_i2c2: i2c2-grp { + fsl,pins = < + MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1 +@@ -293,6 +310,13 @@ + >; + }; + ++ pinctrl_i2c2_gpio: i2c2-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_KEY_COL3__GPIO4_IO12 0x4001b8b1 ++ MX6QDL_PAD_KEY_ROW3__GPIO4_IO13 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_i2c3: i2c3-grp { + fsl,pins = < + MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1 +@@ -300,6 +324,13 @@ + >; + }; + ++ pinctrl_i2c3_gpio: i2c3-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_GPIO_3__GPIO1_IO03 0x4001b8b1 ++ MX6QDL_PAD_GPIO_6__GPIO1_IO06 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_pmic_hw300: pmic-hw300-grp { + fsl,pins = < + MX6QDL_PAD_EIM_A25__GPIO5_IO02 0x1B0B0 +diff --git a/arch/arm/boot/dts/r8a7779-marzen.dts b/arch/arm/boot/dts/r8a7779-marzen.dts +index a4d0038363f00..84e30ed235b53 100644 +--- a/arch/arm/boot/dts/r8a7779-marzen.dts ++++ b/arch/arm/boot/dts/r8a7779-marzen.dts +@@ -146,7 +146,7 @@ + status = "okay"; + + clocks = <&mstp1_clks R8A7779_CLK_DU>, <&x3_clk>; +- clock-names = "du", "dclkin.0"; ++ clock-names = "du.0", "dclkin.0"; + + ports { + port@0 { +diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi +index f1c9b2bc542c5..c9695f31002a4 100644 +--- a/arch/arm/boot/dts/r8a7779.dtsi ++++ b/arch/arm/boot/dts/r8a7779.dtsi +@@ -437,6 +437,7 @@ + reg = <0xfff80000 0x40000>; + interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&mstp1_clks R8A7779_CLK_DU>; ++ clock-names = "du.0"; + power-domains = <&sysc R8A7779_PD_ALWAYS_ON>; + status = "disabled"; + +diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi +index 92a35a1942b6a..1f1d5c0559c16 100644 +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -1388,7 +1388,7 @@ + 0xffffffff 0x3ffcfe7c 0x1c010101 /* pioA */ + 0x7fffffff 0xfffccc3a 0x3f00cc3a /* pioB */ + 0xffffffff 0x3ff83fff 0xff00ffff /* pioC */ +- 0x0003ff00 0x8002a800 0x00000000 /* pioD */ ++ 0xb003ff00 0x8002a800 0x00000000 /* pioD */ + 0xffffffff 0x7fffffff 0x76fff1bf /* pioE */ + >; + +diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c +index a4fb0f8b8f84a..443f7aed29f72 100644 +--- a/arch/arm/kernel/perf_event_v7.c ++++ b/arch/arm/kernel/perf_event_v7.c +@@ -773,10 +773,10 @@ static inline void armv7pmu_write_counter(struct perf_event *event, u64 value) + pr_err("CPU%u writing wrong counter %d\n", + smp_processor_id(), idx); + } else if (idx == ARMV7_IDX_CYCLE_COUNTER) { +- asm volatile("mcr p15, 0, %0, c9, c13, 0" : : "r" (value)); ++ asm volatile("mcr p15, 0, %0, c9, c13, 0" : : "r" ((u32)value)); + } else { + armv7_pmnc_select_counter(idx); +- asm volatile("mcr p15, 0, %0, c9, c13, 2" : : "r" (value)); ++ asm volatile("mcr p15, 0, %0, c9, c13, 2" : : "r" ((u32)value)); + } + } + +diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c +index b683b4517458c..4254391f39064 100644 +--- a/arch/arm/probes/kprobes/test-thumb.c ++++ b/arch/arm/probes/kprobes/test-thumb.c +@@ -444,21 +444,21 @@ void kprobe_thumb32_test_cases(void) + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,"]", ++ TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,"]", ++ TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RRX("tbh [r",1,9f, ", r",14,1,"]", ++ TEST_RRX("tbh [r",1,9f, ", r",14,1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" +@@ -471,10 +471,10 @@ void kprobe_thumb32_test_cases(void) + + TEST_UNSUPPORTED("strexb r0, r1, [r2]") + TEST_UNSUPPORTED("strexh r0, r1, [r2]") +- TEST_UNSUPPORTED("strexd r0, r1, [r2]") ++ TEST_UNSUPPORTED("strexd r0, r1, r2, [r2]") + TEST_UNSUPPORTED("ldrexb r0, [r1]") + TEST_UNSUPPORTED("ldrexh r0, [r1]") +- TEST_UNSUPPORTED("ldrexd r0, [r1]") ++ TEST_UNSUPPORTED("ldrexd r0, r1, [r1]") + + TEST_GROUP("Data-processing (shifted register) and (modified immediate)") + +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index 3a611250f598d..1844fb8605f03 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -121,7 +121,7 @@ + + uart0: serial@12000 { + compatible = "marvell,armada-3700-uart"; +- reg = <0x12000 0x200>; ++ reg = <0x12000 0x18>; + clocks = <&xtalclk>; + interrupts = + <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, +diff --git a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts +index 8eac8ca6550b8..d8768c6bdfee3 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts +@@ -24,7 +24,7 @@ + memory@48000000 { + device_type = "memory"; + /* first 128MB is reserved for secure area. */ +- reg = <0x0 0x48000000 0x0 0x38000000>; ++ reg = <0x0 0x48000000 0x0 0x78000000>; + }; + + osc5_clk: osc5-clock { +diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S +index ad69d181c9393..757f9554118e8 100644 +--- a/arch/hexagon/kernel/vmlinux.lds.S ++++ b/arch/hexagon/kernel/vmlinux.lds.S +@@ -73,13 +73,8 @@ SECTIONS + + _end = .; + +- /DISCARD/ : { +- EXIT_TEXT +- EXIT_DATA +- EXIT_CALL +- } +- + STABS_DEBUG + DWARF_DEBUG + ++ DISCARDS + } +diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c +index dfe40cbdf3b39..06419a95af309 100644 +--- a/arch/ia64/kernel/mca_drv.c ++++ b/arch/ia64/kernel/mca_drv.c +@@ -343,7 +343,7 @@ init_record_index_pools(void) + + /* - 2 - */ + sect_min_size = sal_log_sect_min_sizes[0]; +- for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++) ++ for (i = 1; i < ARRAY_SIZE(sal_log_sect_min_sizes); i++) + if (sect_min_size > sal_log_sect_min_sizes[i]) + sect_min_size = sal_log_sect_min_sizes[i]; + +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index 378cbfb31ee70..1d6ebbc2a5d02 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -33,7 +33,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \ + KCOV_INSTRUMENT := n + + # decompressor objects (linked with vmlinuz) +-vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o ++vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o $(obj)/bswapsi.o + + ifdef CONFIG_DEBUG_ZBOOT + vmlinuzobjs-$(CONFIG_DEBUG_ZBOOT) += $(obj)/dbg.o +@@ -47,7 +47,7 @@ extra-y += uart-ath79.c + $(obj)/uart-ath79.c: $(srctree)/arch/mips/ath79/early_printk.c + $(call cmd,shipped) + +-vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o $(obj)/bswapsi.o ++vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o + + extra-y += ashldi3.c + $(obj)/ashldi3.c: $(obj)/%.c: $(srctree)/lib/%.c FORCE +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index 40218be0b7ce8..6403a65f30b9d 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -11,6 +11,8 @@ + * option) any later version. + */ + ++#define DISABLE_BRANCH_PROFILING ++ + #include <linux/types.h> + #include <linux/kernel.h> + #include <linux/string.h> +diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h +index 982bc06853302..4747a46946699 100644 +--- a/arch/mips/include/asm/hugetlb.h ++++ b/arch/mips/include/asm/hugetlb.h +@@ -67,7 +67,13 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, + static inline void huge_ptep_clear_flush(struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) + { +- flush_tlb_page(vma, addr & huge_page_mask(hstate_vma(vma))); ++ /* ++ * clear the huge pte entry firstly, so that the other smp threads will ++ * not get old pte entry after finishing flush_tlb_page and before ++ * setting new huge pte entry ++ */ ++ huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); ++ flush_tlb_page(vma, addr); + } + + static inline int huge_pte_none(pte_t pte) +diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h +index f9a7c137be9f2..c8333782a6706 100644 +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -1986,7 +1986,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) + ({ int __res; \ + __asm__ __volatile__( \ + ".set\tpush\n\t" \ +- ".set\tmips32r2\n\t" \ ++ ".set\tmips32r5\n\t" \ + _ASM_SET_VIRT \ + "mfgc0\t%0, " #source ", %1\n\t" \ + ".set\tpop" \ +@@ -1999,7 +1999,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) + ({ unsigned long long __res; \ + __asm__ __volatile__( \ + ".set\tpush\n\t" \ +- ".set\tmips64r2\n\t" \ ++ ".set\tmips64r5\n\t" \ + _ASM_SET_VIRT \ + "dmfgc0\t%0, " #source ", %1\n\t" \ + ".set\tpop" \ +@@ -2012,7 +2012,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) + do { \ + __asm__ __volatile__( \ + ".set\tpush\n\t" \ +- ".set\tmips32r2\n\t" \ ++ ".set\tmips32r5\n\t" \ + _ASM_SET_VIRT \ + "mtgc0\t%z0, " #register ", %1\n\t" \ + ".set\tpop" \ +@@ -2024,7 +2024,7 @@ do { \ + do { \ + __asm__ __volatile__( \ + ".set\tpush\n\t" \ +- ".set\tmips64r2\n\t" \ ++ ".set\tmips64r5\n\t" \ + _ASM_SET_VIRT \ + "dmtgc0\t%z0, " #register ", %1\n\t" \ + ".set\tpop" \ +diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h +index 39b9f311c4ef4..f800872f867b2 100644 +--- a/arch/mips/include/asm/pgalloc.h ++++ b/arch/mips/include/asm/pgalloc.h +@@ -93,11 +93,15 @@ do { \ + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address) + { +- pmd_t *pmd; ++ pmd_t *pmd = NULL; ++ struct page *pg; + +- pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER); +- if (pmd) ++ pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER); ++ if (pg) { ++ pgtable_pmd_page_ctor(pg); ++ pmd = (pmd_t *)page_address(pg); + pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table); ++ } + return pmd; + } + +diff --git a/arch/mips/vdso/vdso.h b/arch/mips/vdso/vdso.h +index cfb1be441decc..921589b45bc20 100644 +--- a/arch/mips/vdso/vdso.h ++++ b/arch/mips/vdso/vdso.h +@@ -81,7 +81,7 @@ static inline const union mips_vdso_data *get_vdso_data(void) + + static inline void __iomem *get_gic(const union mips_vdso_data *data) + { +- return (void __iomem *)data - PAGE_SIZE; ++ return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE; + } + + #endif /* CONFIG_CLKSRC_MIPS_GIC */ +diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c +index a7e21a35c03af..27c84b82b588e 100644 +--- a/arch/powerpc/boot/devtree.c ++++ b/arch/powerpc/boot/devtree.c +@@ -17,6 +17,7 @@ + #include "string.h" + #include "stdio.h" + #include "ops.h" ++#include "of.h" + + void dt_fixup_memory(u64 start, u64 size) + { +@@ -27,21 +28,25 @@ void dt_fixup_memory(u64 start, u64 size) + root = finddevice("/"); + if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0) + naddr = 2; ++ else ++ naddr = be32_to_cpu(naddr); + if (naddr < 1 || naddr > 2) + fatal("Can't cope with #address-cells == %d in /\n\r", naddr); + + if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0) + nsize = 1; ++ else ++ nsize = be32_to_cpu(nsize); + if (nsize < 1 || nsize > 2) + fatal("Can't cope with #size-cells == %d in /\n\r", nsize); + + i = 0; + if (naddr == 2) +- memreg[i++] = start >> 32; +- memreg[i++] = start & 0xffffffff; ++ memreg[i++] = cpu_to_be32(start >> 32); ++ memreg[i++] = cpu_to_be32(start & 0xffffffff); + if (nsize == 2) +- memreg[i++] = size >> 32; +- memreg[i++] = size & 0xffffffff; ++ memreg[i++] = cpu_to_be32(size >> 32); ++ memreg[i++] = cpu_to_be32(size & 0xffffffff); + + memory = finddevice("/memory"); + if (! memory) { +@@ -49,9 +54,9 @@ void dt_fixup_memory(u64 start, u64 size) + setprop_str(memory, "device_type", "memory"); + } + +- printf("Memory <- <0x%x", memreg[0]); ++ printf("Memory <- <0x%x", be32_to_cpu(memreg[0])); + for (i = 1; i < (naddr + nsize); i++) +- printf(" 0x%x", memreg[i]); ++ printf(" 0x%x", be32_to_cpu(memreg[i])); + printf("> (%ldMB)\n\r", (unsigned long)(size >> 20)); + + setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32)); +@@ -69,10 +74,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus) + printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus)); + + while ((devp = find_node_by_devtype(devp, "cpu"))) { +- setprop_val(devp, "clock-frequency", cpu); +- setprop_val(devp, "timebase-frequency", tb); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(cpu)); ++ setprop_val(devp, "timebase-frequency", cpu_to_be32(tb)); + if (bus > 0) +- setprop_val(devp, "bus-frequency", bus); ++ setprop_val(devp, "bus-frequency", cpu_to_be32(bus)); + } + + timebase_period_ns = 1000000000 / tb; +@@ -84,7 +89,7 @@ void dt_fixup_clock(const char *path, u32 freq) + + if (devp) { + printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq)); +- setprop_val(devp, "clock-frequency", freq); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(freq)); + } + } + +@@ -137,8 +142,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize) + { + if (getprop(node, "#address-cells", naddr, 4) != 4) + *naddr = 2; ++ else ++ *naddr = be32_to_cpu(*naddr); + if (getprop(node, "#size-cells", nsize, 4) != 4) + *nsize = 1; ++ else ++ *nsize = be32_to_cpu(*nsize); + } + + static void copy_val(u32 *dest, u32 *src, int naddr) +@@ -167,9 +176,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr) + int i, carry = 0; + + for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) { +- u64 tmp = (u64)reg[i] + add[i] + carry; ++ u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry; + carry = tmp >> 32; +- reg[i] = (u32)tmp; ++ reg[i] = cpu_to_be32((u32)tmp); + } + + return !carry; +@@ -184,18 +193,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize) + u32 end; + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- if (reg[i] < range[i]) ++ if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i])) + return 0; +- if (reg[i] > range[i]) ++ if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i])) + break; + } + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- end = range[i] + rangesize[i]; ++ end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]); + +- if (reg[i] < end) ++ if (be32_to_cpu(reg[i]) < end) + break; +- if (reg[i] > end) ++ if (be32_to_cpu(reg[i]) > end) + return 0; + } + +@@ -244,7 +253,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + return 0; + + dt_get_reg_format(parent, &naddr, &nsize); +- + if (nsize > 2) + return 0; + +@@ -256,10 +264,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + copy_val(last_addr, prop_buf + offset, naddr); + +- ret_size = prop_buf[offset + naddr]; ++ ret_size = be32_to_cpu(prop_buf[offset + naddr]); + if (nsize == 2) { + ret_size <<= 32; +- ret_size |= prop_buf[offset + naddr + 1]; ++ ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]); + } + + for (;;) { +@@ -282,7 +290,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + offset = find_range(last_addr, prop_buf, prev_naddr, + naddr, prev_nsize, buflen / 4); +- + if (offset < 0) + return 0; + +@@ -300,8 +307,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + if (naddr > 2) + return 0; + +- ret_addr = ((u64)last_addr[2] << 32) | last_addr[3]; +- ++ ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]); + if (sizeof(void *) == 4 && + (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL || + ret_addr + ret_size > 0x100000000ULL)) +@@ -354,11 +360,14 @@ int dt_is_compatible(void *node, const char *compat) + int dt_get_virtual_reg(void *node, void **addr, int nres) + { + unsigned long xaddr; +- int n; ++ int n, i; + + n = getprop(node, "virtual-reg", addr, nres * 4); +- if (n > 0) ++ if (n > 0) { ++ for (i = 0; i < n/4; i ++) ++ ((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]); + return n / 4; ++ } + + for (n = 0; n < nres; n++) { + if (!dt_xlate_reg(node, n, &xaddr, NULL)) +diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c +index b0da4466d4198..f16d2be1d0f31 100644 +--- a/arch/powerpc/boot/ns16550.c ++++ b/arch/powerpc/boot/ns16550.c +@@ -15,6 +15,7 @@ + #include "stdio.h" + #include "io.h" + #include "ops.h" ++#include "of.h" + + #define UART_DLL 0 /* Out: Divisor Latch Low */ + #define UART_DLM 1 /* Out: Divisor Latch High */ +@@ -58,16 +59,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp) + int n; + u32 reg_offset; + +- if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) ++ if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) { ++ printf("virt reg parse fail...\r\n"); + return -1; ++ } + + n = getprop(devp, "reg-offset", ®_offset, sizeof(reg_offset)); + if (n == sizeof(reg_offset)) +- reg_base += reg_offset; ++ reg_base += be32_to_cpu(reg_offset); + + n = getprop(devp, "reg-shift", ®_shift, sizeof(reg_shift)); + if (n != sizeof(reg_shift)) + reg_shift = 0; ++ else ++ reg_shift = be32_to_cpu(reg_shift); + + scdp->open = ns16550_open; + scdp->putc = ns16550_putc; +diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h +index fbe8df4330190..dc953d22e3c68 100644 +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -44,6 +44,8 @@ + # define SMPWMB eieio + #endif + ++/* clang defines this macro for a builtin, which will not work with runtime patching */ ++#undef __lwsync + #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") + #define dma_rmb() __lwsync() + #define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory") +diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h +index 17ee719e799fa..013d24d246d63 100644 +--- a/arch/powerpc/include/asm/ps3.h ++++ b/arch/powerpc/include/asm/ps3.h +@@ -83,6 +83,7 @@ struct ps3_dma_region_ops; + * @bus_addr: The 'translated' bus address of the region. + * @len: The length in bytes of the region. + * @offset: The offset from the start of memory of the region. ++ * @dma_mask: Device dma_mask. + * @ioid: The IOID of the device who owns this region + * @chunk_list: Opaque variable used by the ioc page manager. + * @region_ops: struct ps3_dma_region_ops - dma region operations +@@ -97,6 +98,7 @@ struct ps3_dma_region { + enum ps3_dma_region_type region_type; + unsigned long len; + unsigned long offset; ++ u64 dma_mask; + + /* driver variables (set by ps3_dma_region_create) */ + unsigned long bus_addr; +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index a9ec4467705ca..14adfeacfa46e 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -570,6 +570,8 @@ static void nmi_stop_this_cpu(struct pt_regs *regs) + /* + * IRQs are already hard disabled by the smp_handle_nmi_ipi. + */ ++ set_cpu_online(smp_processor_id(), false); ++ + spin_begin(); + while (1) + spin_cpu_relax(); +@@ -585,6 +587,15 @@ void smp_send_stop(void) + static void stop_this_cpu(void *dummy) + { + hard_irq_disable(); ++ ++ /* ++ * Offlining CPUs in stop_this_cpu can result in scheduler warnings, ++ * (see commit de6e5d38417e), but printk_safe_flush_on_panic() wants ++ * to know other CPUs are offline before it breaks locks to flush ++ * printk buffers, in case we panic()ed while holding the lock. ++ */ ++ set_cpu_online(smp_processor_id(), false); ++ + spin_begin(); + while (1) + spin_cpu_relax(); +diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c +index e2c50b55138f8..23b5f755e419b 100644 +--- a/arch/powerpc/kernel/stacktrace.c ++++ b/arch/powerpc/kernel/stacktrace.c +@@ -19,6 +19,7 @@ + #include <asm/ptrace.h> + #include <asm/processor.h> + #include <linux/ftrace.h> ++#include <linux/delay.h> + #include <asm/kprobes.h> + + #include <asm/paca.h> +@@ -204,17 +205,31 @@ static void handle_backtrace_ipi(struct pt_regs *regs) + + static void raise_backtrace_ipi(cpumask_t *mask) + { ++ struct paca_struct *p; + unsigned int cpu; ++ u64 delay_us; + + for_each_cpu(cpu, mask) { +- if (cpu == smp_processor_id()) ++ if (cpu == smp_processor_id()) { + handle_backtrace_ipi(NULL); +- else +- smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, 5 * USEC_PER_SEC); +- } ++ continue; ++ } + +- for_each_cpu(cpu, mask) { +- struct paca_struct *p = paca_ptrs[cpu]; ++ delay_us = 5 * USEC_PER_SEC; ++ ++ if (smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, delay_us)) { ++ // Now wait up to 5s for the other CPU to do its backtrace ++ while (cpumask_test_cpu(cpu, mask) && delay_us) { ++ udelay(1); ++ delay_us--; ++ } ++ ++ // Other CPU cleared itself from the mask ++ if (delay_us) ++ continue; ++ } ++ ++ p = paca_ptrs[cpu]; + + cpumask_clear_cpu(cpu, mask); + +diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c +index 894f62d77a777..12ed80850a436 100644 +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -18,6 +18,7 @@ + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + ++#include <linux/dma-mapping.h> + #include <linux/kernel.h> + #include <linux/export.h> + #include <linux/memblock.h> +@@ -1130,6 +1131,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + enum ps3_dma_region_type region_type, void *addr, unsigned long len) + { + unsigned long lpar_addr; ++ int result; + + lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0; + +@@ -1141,6 +1143,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + r->offset -= map.r1.offset; + r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size); + ++ dev->core.dma_mask = &r->dma_mask; ++ ++ result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32)); ++ ++ if (result < 0) { ++ dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n", ++ __func__, __LINE__, result); ++ return result; ++ } ++ + switch (dev->dev_type) { + case PS3_DEVICE_TYPE_SB: + r->region_ops = (USE_DYNAMIC_DMA) +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index 9a9c7a6fe9259..ce4c3b659f70c 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -867,7 +867,7 @@ config CMM_IUCV + config APPLDATA_BASE + def_bool n + prompt "Linux - VM Monitor Stream, base infrastructure" +- depends on PROC_FS ++ depends on PROC_SYSCTL + help + This provides a kernel interface for creating and updating z/VM APPLDATA + monitor records. The monitor records are updated at certain time +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 4bda9055daefa..e8bfd29bb1f9f 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -141,7 +141,7 @@ static void __init set_preferred_console(void) + else if (CONSOLE_IS_3270) + add_preferred_console("tty3270", 0, NULL); + else if (CONSOLE_IS_VT220) +- add_preferred_console("ttyS", 1, NULL); ++ add_preferred_console("ttysclp", 0, NULL); + else if (CONSOLE_IS_HVC) + add_preferred_console("hvc", 0, NULL); + } +diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c +index 9cffbbb15c569..669124d5290b8 100644 +--- a/arch/um/drivers/chan_user.c ++++ b/arch/um/drivers/chan_user.c +@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, + goto out_close; + } + +- if (os_set_fd_block(*fd_out, 0)) { ++ err = os_set_fd_block(*fd_out, 0); ++ if (err) { + printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd " + "non-blocking.\n"); + goto out_close; +diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c +index 0d6b66c64a813..76d155631c5d7 100644 +--- a/arch/um/drivers/slip_user.c ++++ b/arch/um/drivers/slip_user.c +@@ -145,7 +145,8 @@ static int slip_open(void *data) + } + sfd = err; + +- if (set_up_tty(sfd)) ++ err = set_up_tty(sfd); ++ if (err) + goto out_close2; + + pri->slave = sfd; +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index fa2c93cb42a27..b8c935033d210 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -103,6 +103,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx) + } + extern void fpstate_sanitize_xstate(struct fpu *fpu); + ++/* Returns 0 or the negated trap number, which results in -EFAULT for #PF */ + #define user_insn(insn, output, input...) \ + ({ \ + int err; \ +@@ -110,14 +111,14 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu); + might_fault(); \ + \ + asm volatile(ASM_STAC "\n" \ +- "1:" #insn "\n\t" \ ++ "1: " #insn "\n" \ + "2: " ASM_CLAC "\n" \ + ".section .fixup,\"ax\"\n" \ +- "3: movl $-1,%[err]\n" \ ++ "3: negl %%eax\n" \ + " jmp 2b\n" \ + ".previous\n" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err), output \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err), output \ + : "0"(0), input); \ + err; \ + }) +@@ -221,16 +222,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f" + #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f" + ++/* ++ * After this @err contains 0 on success or the negated trap number when ++ * the operation raises an exception. For faults this results in -EFAULT. ++ */ + #define XSTATE_OP(op, st, lmask, hmask, err) \ + asm volatile("1:" op "\n\t" \ + "xor %[err], %[err]\n" \ + "2:\n\t" \ + ".pushsection .fixup,\"ax\"\n\t" \ +- "3: movl $-2,%[err]\n\t" \ ++ "3: negl %%eax\n\t" \ + "jmp 2b\n\t" \ + ".popsection\n\t" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err) \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err) \ + : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ + : "memory") + +diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c +index bc02f5144b958..621d249ded0b9 100644 +--- a/arch/x86/kernel/fpu/regset.c ++++ b/arch/x86/kernel/fpu/regset.c +@@ -128,7 +128,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, + /* + * A whole standard-format XSAVE buffer is needed: + */ +- if ((pos != 0) || (count < fpu_user_xstate_size)) ++ if (pos != 0 || count != fpu_user_xstate_size) + return -EFAULT; + + xsave = &fpu->state.xsave; +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 1fe9ccabc082a..097eef712cdc0 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -666,8 +666,14 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + unsigned virt_as = max((entry->eax >> 8) & 0xff, 48U); + unsigned phys_as = entry->eax & 0xff; + +- if (!g_phys_as) ++ /* ++ * Use bare metal's MAXPHADDR if the CPU doesn't report guest ++ * MAXPHYADDR separately, or if TDP (NPT) is disabled, as the ++ * guest version "applies only to guests using nested paging". ++ */ ++ if (!g_phys_as || !tdp_enabled) + g_phys_as = phys_as; ++ + entry->eax = g_phys_as | (virt_as << 8); + entry->edx = 0; + /* +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 435e74e1f2e54..43fb4e296d8de 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7772,6 +7772,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) + set_debugreg(vcpu->arch.eff_db[3], 3); + set_debugreg(vcpu->arch.dr6, 6); + vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD; ++ } else if (unlikely(hw_breakpoint_active())) { ++ set_debugreg(0, 7); + } + + kvm_x86_ops->run(vcpu); +diff --git a/block/blk-wbt.c b/block/blk-wbt.c +index 50f2abfa1a60e..880a41adde8f4 100644 +--- a/block/blk-wbt.c ++++ b/block/blk-wbt.c +@@ -76,7 +76,8 @@ enum { + + static inline bool rwb_enabled(struct rq_wb *rwb) + { +- return rwb && rwb->wb_normal != 0; ++ return rwb && rwb->enable_state != WBT_STATE_OFF_DEFAULT && ++ rwb->wb_normal != 0; + } + + static void wb_timestamp(struct rq_wb *rwb, unsigned long *var) +@@ -703,9 +704,13 @@ void wbt_set_write_cache(struct request_queue *q, bool write_cache_on) + void wbt_enable_default(struct request_queue *q) + { + struct rq_qos *rqos = wbt_rq_qos(q); ++ + /* Throttling already enabled? */ +- if (rqos) ++ if (rqos) { ++ if (RQWB(rqos)->enable_state == WBT_STATE_OFF_DEFAULT) ++ RQWB(rqos)->enable_state = WBT_STATE_ON_DEFAULT; + return; ++ } + + /* Queue not registered? Maybe shutting down... */ + if (!blk_queue_registered(q)) +@@ -764,7 +769,7 @@ void wbt_disable_default(struct request_queue *q) + rwb = RQWB(rqos); + if (rwb->enable_state == WBT_STATE_ON_DEFAULT) { + blk_stat_deactivate(rwb->cb); +- rwb->wb_normal = 0; ++ rwb->enable_state = WBT_STATE_OFF_DEFAULT; + } + } + EXPORT_SYMBOL_GPL(wbt_disable_default); +diff --git a/block/blk-wbt.h b/block/blk-wbt.h +index f47218d5b3b20..dd0d0f297d1e0 100644 +--- a/block/blk-wbt.h ++++ b/block/blk-wbt.h +@@ -34,6 +34,7 @@ enum { + enum { + WBT_STATE_ON_DEFAULT = 1, + WBT_STATE_ON_MANUAL = 2, ++ WBT_STATE_OFF_DEFAULT + }; + + struct rq_wb { +diff --git a/crypto/shash.c b/crypto/shash.c +index a04145e5306a5..55e7a2f63b340 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -25,12 +25,24 @@ + + static const struct crypto_type crypto_shash_type; + +-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen) ++static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen) + { + return -ENOSYS; + } +-EXPORT_SYMBOL_GPL(shash_no_setkey); ++ ++/* ++ * Check whether an shash algorithm has a setkey function. ++ * ++ * For CFI compatibility, this must not be an inline function. This is because ++ * when CFI is enabled, modules won't get the same address for shash_no_setkey ++ * (if it were exported, which inlining would require) as the core kernel will. ++ */ ++bool crypto_shash_alg_has_setkey(struct shash_alg *alg) ++{ ++ return alg->setkey != shash_no_setkey; ++} ++EXPORT_SYMBOL_GPL(crypto_shash_alg_has_setkey); + + static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + unsigned int keylen) +diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile +index 6d59aa109a91a..93f667140d8a7 100644 +--- a/drivers/acpi/Makefile ++++ b/drivers/acpi/Makefile +@@ -8,6 +8,11 @@ ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT + # + # ACPI Boot-Time Table Parsing + # ++ifeq ($(CONFIG_ACPI_CUSTOM_DSDT),y) ++tables.o: $(src)/../../include/$(subst $\",,$(CONFIG_ACPI_CUSTOM_DSDT_FILE)) ; ++ ++endif ++ + obj-$(CONFIG_ACPI) += tables.o + obj-$(CONFIG_X86) += blacklist.o + +diff --git a/drivers/acpi/acpi_amba.c b/drivers/acpi/acpi_amba.c +index 7f77c071709a7..eb09ee71ceb2e 100644 +--- a/drivers/acpi/acpi_amba.c ++++ b/drivers/acpi/acpi_amba.c +@@ -70,6 +70,7 @@ static int amba_handler_attach(struct acpi_device *adev, + case IORESOURCE_MEM: + if (!address_found) { + dev->res = *rentry->res; ++ dev->res.name = dev_name(&dev->dev); + address_found = true; + } + break; +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 1a23e7aa74df7..ac54fc03cf819 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -556,6 +556,15 @@ static const struct dmi_system_id video_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"), + }, + }, ++ { ++ .callback = video_set_report_key_events, ++ .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS), ++ .ident = "Dell Vostro 3350", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"), ++ }, ++ }, + /* + * Some machines change the brightness themselves when a brightness + * hotkey gets pressed, despite us telling them not to. In this case +diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c +index a3bd6280882c3..4c8ce483805d8 100644 +--- a/drivers/acpi/acpica/nsrepair2.c ++++ b/drivers/acpi/acpica/nsrepair2.c +@@ -375,6 +375,13 @@ acpi_ns_repair_CID(struct acpi_evaluate_info *info, + + (*element_ptr)->common.reference_count = + original_ref_count; ++ ++ /* ++ * The original_element holds a reference from the package object ++ * that represents _HID. Since a new element was created by _HID, ++ * remove the reference from the _CID package. ++ */ ++ acpi_ut_remove_reference(original_element); + } + + element_ptr++; +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index d60e57d14c859..d9dc9d2f38d56 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1240,6 +1240,7 @@ static int __init acpi_init(void) + init_acpi_device_notify(); + result = acpi_bus_init(); + if (result) { ++ kobject_put(acpi_kobj); + disable_acpi(); + return result; + } +diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c +index b3b92c54cba8d..f792b149a5745 100644 +--- a/drivers/acpi/device_sysfs.c ++++ b/drivers/acpi/device_sysfs.c +@@ -452,7 +452,7 @@ static ssize_t description_show(struct device *dev, + (wchar_t *)acpi_dev->pnp.str_obj->buffer.pointer, + acpi_dev->pnp.str_obj->buffer.length, + UTF16_LITTLE_ENDIAN, buf, +- PAGE_SIZE); ++ PAGE_SIZE - 1); + + buf[result++] = '\n'; + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 9415a0041aaf7..e3df3dda03321 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1904,6 +1904,22 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GL702VMK"),}, NULL}, + { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BA", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BA"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BP", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BP"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BA", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BA"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BP", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BP"),}, NULL}, ++ { + ec_honor_ecdt_gpe, "ASUS X550VXK", { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X550VXK"),}, NULL}, +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index abb559cd28d79..d80010ac2a43a 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -29,6 +29,7 @@ + #include <linux/acpi.h> + #include <linux/dmi.h> + #include <linux/sched.h> /* need_resched() */ ++#include <linux/sort.h> + #include <linux/tick.h> + #include <linux/cpuidle.h> + #include <linux/cpu.h> +@@ -544,10 +545,37 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr, + return; + } + ++static int acpi_cst_latency_cmp(const void *a, const void *b) ++{ ++ const struct acpi_processor_cx *x = a, *y = b; ++ ++ if (!(x->valid && y->valid)) ++ return 0; ++ if (x->latency > y->latency) ++ return 1; ++ if (x->latency < y->latency) ++ return -1; ++ return 0; ++} ++static void acpi_cst_latency_swap(void *a, void *b, int n) ++{ ++ struct acpi_processor_cx *x = a, *y = b; ++ u32 tmp; ++ ++ if (!(x->valid && y->valid)) ++ return; ++ tmp = x->latency; ++ x->latency = y->latency; ++ y->latency = tmp; ++} ++ + static int acpi_processor_power_verify(struct acpi_processor *pr) + { + unsigned int i; + unsigned int working = 0; ++ unsigned int last_latency = 0; ++ unsigned int last_type = 0; ++ bool buggy_latency = false; + + pr->power.timer_broadcast_on_state = INT_MAX; + +@@ -571,12 +599,24 @@ static int acpi_processor_power_verify(struct acpi_processor *pr) + } + if (!cx->valid) + continue; ++ if (cx->type >= last_type && cx->latency < last_latency) ++ buggy_latency = true; ++ last_latency = cx->latency; ++ last_type = cx->type; + + lapic_timer_check_state(i, pr, cx); + tsc_check_state(cx->type); + working++; + } + ++ if (buggy_latency) { ++ pr_notice("FW issue: working around C-state latencies out of order\n"); ++ sort(&pr->power.states[1], max_cstate, ++ sizeof(struct acpi_processor_cx), ++ acpi_cst_latency_cmp, ++ acpi_cst_latency_swap); ++ } ++ + lapic_timer_propagate_broadcast(pr); + + return (working); +diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c +index 631610b72aa58..64141d10e07f7 100644 +--- a/drivers/ata/ahci_sunxi.c ++++ b/drivers/ata/ahci_sunxi.c +@@ -165,7 +165,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap) + } + + static const struct ata_port_info ahci_sunxi_port_info = { +- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ, ++ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM, + .pio_mask = ATA_PIO4, + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_platform_ops, +diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c +index cc6d06c1b2c70..7ce62cdb63a5d 100644 +--- a/drivers/ata/pata_ep93xx.c ++++ b/drivers/ata/pata_ep93xx.c +@@ -927,7 +927,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev) + /* INT[3] (IRQ_EP93XX_EXT3) line connected as pull down */ + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +- err = -ENXIO; ++ err = irq; + goto err_rel_gpio; + } + +diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c +index d3d851b014a37..ac3b1fda820ff 100644 +--- a/drivers/ata/pata_octeon_cf.c ++++ b/drivers/ata/pata_octeon_cf.c +@@ -898,10 +898,11 @@ static int octeon_cf_probe(struct platform_device *pdev) + return -EINVAL; + } + +- irq_handler = octeon_cf_interrupt; + i = platform_get_irq(dma_dev, 0); +- if (i > 0) ++ if (i > 0) { + irq = i; ++ irq_handler = octeon_cf_interrupt; ++ } + } + of_node_put(dma_node); + } +diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c +index 653b9a0bf7274..0416a390b94c8 100644 +--- a/drivers/ata/pata_rb532_cf.c ++++ b/drivers/ata/pata_rb532_cf.c +@@ -120,10 +120,12 @@ static int rb532_pata_driver_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + dev_err(&pdev->dev, "no IRQ resource found\n"); +- return -ENOENT; ++ return irq; + } ++ if (!irq) ++ return -EINVAL; + + pdata = dev_get_platdata(&pdev->dev); + if (!pdata) { +diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c +index e67815b896fcc..1dd47a05b34bc 100644 +--- a/drivers/ata/sata_highbank.c ++++ b/drivers/ata/sata_highbank.c +@@ -483,10 +483,12 @@ static int ahci_highbank_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + dev_err(dev, "no irq\n"); +- return -EINVAL; ++ return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL); + if (!hpriv) { +diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c +index 008905d4152a3..827c6d5e61774 100644 +--- a/drivers/atm/iphase.c ++++ b/drivers/atm/iphase.c +@@ -3301,7 +3301,7 @@ static void __exit ia_module_exit(void) + { + pci_unregister_driver(&ia_driver); + +- del_timer(&ia_timer); ++ del_timer_sync(&ia_timer); + } + + module_init(ia_module_init); +diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c +index 0d3754a4ac209..78e72b86dc041 100644 +--- a/drivers/atm/nicstar.c ++++ b/drivers/atm/nicstar.c +@@ -296,7 +296,7 @@ static void __exit nicstar_cleanup(void) + { + XPRINTK("nicstar: nicstar_cleanup() called.\n"); + +- del_timer(&ns_timer); ++ del_timer_sync(&ns_timer); + + pci_unregister_driver(&nicstar_driver); + +@@ -524,6 +524,15 @@ static int ns_init_card(int i, struct pci_dev *pcidev) + /* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */ + writel(0x00000000, card->membase + VPM); + ++ card->intcnt = 0; ++ if (request_irq ++ (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) { ++ pr_err("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq); ++ error = 9; ++ ns_init_card_error(card, error); ++ return error; ++ } ++ + /* Initialize TSQ */ + card->tsq.org = dma_alloc_coherent(&card->pcidev->dev, + NS_TSQSIZE + NS_TSQ_ALIGNMENT, +@@ -750,15 +759,6 @@ static int ns_init_card(int i, struct pci_dev *pcidev) + + card->efbie = 1; + +- card->intcnt = 0; +- if (request_irq +- (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) { +- printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq); +- error = 9; +- ns_init_card_error(card, error); +- return error; +- } +- + /* Register device */ + card->atmdev = atm_dev_register("nicstar", &card->pcidev->dev, &atm_ops, + -1, NULL); +@@ -836,10 +836,12 @@ static void ns_init_card_error(ns_dev *card, int error) + dev_kfree_skb_any(hb); + } + if (error >= 12) { +- kfree(card->rsq.org); ++ dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT, ++ card->rsq.org, card->rsq.dma); + } + if (error >= 11) { +- kfree(card->tsq.org); ++ dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT, ++ card->tsq.org, card->tsq.dma); + } + if (error >= 10) { + free_irq(card->pcidev->irq, card); +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index c2d9459ec5d12..dac1769146d7f 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -944,6 +944,8 @@ static int virtblk_freeze(struct virtio_device *vdev) + blk_mq_quiesce_queue(vblk->disk->queue); + + vdev->config->del_vqs(vdev); ++ kfree(vblk->vqs); ++ + return 0; + } + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 1b0adf5c23760..7188f0fb2e050 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2595,6 +2595,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev, + sent += size; + count -= size; + ++ /* ep2 need time to switch from function acl to function dfu, ++ * so we add 20ms delay here. ++ */ ++ msleep(20); ++ + while (count) { + size = min_t(size_t, count, QCA_DFU_PACKET_LEN); + +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index ca1c5c5109f04..f016d54b25929 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -366,16 +366,18 @@ static int __ipmi_set_timeout(struct ipmi_smi_msg *smi_msg, + data[0] = 0; + WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS); + +- if ((ipmi_version_major > 1) +- || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { +- /* This is an IPMI 1.5-only feature. */ +- data[0] |= WDOG_DONT_STOP_ON_SET; +- } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { +- /* +- * In ipmi 1.0, setting the timer stops the watchdog, we +- * need to start it back up again. +- */ +- hbnow = 1; ++ if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { ++ if ((ipmi_version_major > 1) || ++ ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { ++ /* This is an IPMI 1.5-only feature. */ ++ data[0] |= WDOG_DONT_STOP_ON_SET; ++ } else { ++ /* ++ * In ipmi 1.0, setting the timer stops the watchdog, we ++ * need to start it back up again. ++ */ ++ hbnow = 1; ++ } + } + + data[1] = 0; +diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c +index a219964cb7700..cdc72db29ae04 100644 +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + io_read_num_rec_bytes(iobase, &num_bytes_read); + if (num_bytes_read >= 4) { + DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read); ++ if (num_bytes_read > 4) { ++ rc = -EIO; ++ goto exit_setprotocol; ++ } + break; + } + mdelay(10); +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index ca71ee939533f..cdf441942bae4 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -488,7 +488,7 @@ static struct port_buffer *get_inbuf(struct port *port) + + buf = virtqueue_get_buf(port->in_vq, &len); + if (buf) { +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + port->stats.bytes_received += len; + } +@@ -1738,7 +1738,7 @@ static void control_work_handler(struct work_struct *work) + while ((buf = virtqueue_get_buf(vq, &len))) { + spin_unlock(&portdev->c_ivq_lock); + +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + + handle_control_message(vq->vdev, portdev, buf); +diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c +index 9e16931e6f28a..e0011db4f2018 100644 +--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c +@@ -73,6 +73,7 @@ static const struct cpg_core_clk r8a77995_core_clks[] __initconst = { + DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1, 2, 1), + + /* Core Clock Outputs */ ++ DEF_FIXED("za2", R8A77995_CLK_ZA2, CLK_PLL0D3, 2, 1), + DEF_FIXED("z2", R8A77995_CLK_Z2, CLK_PLL0D3, 1, 1), + DEF_FIXED("ztr", R8A77995_CLK_ZTR, CLK_PLL1, 6, 1), + DEF_FIXED("zt", R8A77995_CLK_ZT, CLK_PLL1, 4, 1), +diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c +index dc87866233b94..ed3b725ff1029 100644 +--- a/drivers/clk/tegra/clk-pll.c ++++ b/drivers/clk/tegra/clk-pll.c +@@ -1091,7 +1091,8 @@ static int clk_pllu_enable(struct clk_hw *hw) + if (pll->lock) + spin_lock_irqsave(pll->lock, flags); + +- _clk_pll_enable(hw); ++ if (!clk_pll_is_enabled(hw)) ++ _clk_pll_enable(hw); + + ret = clk_pll_wait_for_lock(pll); + if (ret < 0) +@@ -1708,7 +1709,8 @@ static int clk_pllu_tegra114_enable(struct clk_hw *hw) + if (pll->lock) + spin_lock_irqsave(pll->lock, flags); + +- _clk_pll_enable(hw); ++ if (!clk_pll_is_enabled(hw)) ++ _clk_pll_enable(hw); + + ret = clk_pll_wait_for_lock(pll); + if (ret < 0) +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index e67ab217eef41..8642504b7e51f 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -334,7 +334,7 @@ static u64 notrace arm64_858921_read_cntvct_el0(void) + do { \ + _val = read_sysreg(reg); \ + _retries--; \ +- } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \ ++ } while (((_val + 1) & GENMASK(8, 0)) <= 1 && _retries); \ + \ + WARN_ON_ONCE(!_retries); \ + _val; \ +diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c +index 7da93e9bebed8..9b2742212ea88 100644 +--- a/drivers/crypto/ccp/sp-pci.c ++++ b/drivers/crypto/ccp/sp-pci.c +@@ -216,7 +216,7 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (ret) { + dev_err(dev, "dma_set_mask_and_coherent failed (%d)\n", + ret); +- goto e_err; ++ goto free_irqs; + } + } + +@@ -224,12 +224,14 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + ret = sp_init(sp); + if (ret) +- goto e_err; ++ goto free_irqs; + + dev_notice(dev, "enabled\n"); + + return 0; + ++free_irqs: ++ sp_free_irqs(sp); + e_err: + dev_notice(dev, "initialization failed\n"); + return ret; +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index 9b7b8558db31d..abb84996f2ca4 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -332,7 +332,7 @@ static void free_buf_chain(struct device *dev, struct buffer_desc *buf,u32 phys) + + buf1 = buf->next; + phys1 = buf->phys_next; +- dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir); ++ dma_unmap_single(dev, buf->phys_addr, buf->buf_len, buf->dir); + dma_pool_free(buffer_pool, buf, phys); + buf = buf1; + phys = phys1; +diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c +index 66869976cfa2b..41f4950c9fc65 100644 +--- a/drivers/crypto/nx/nx-842-pseries.c ++++ b/drivers/crypto/nx/nx-842-pseries.c +@@ -553,13 +553,15 @@ static int nx842_OF_set_defaults(struct nx842_devdata *devdata) + * The status field indicates if the device is enabled when the status + * is 'okay'. Otherwise the device driver will be disabled. + * +- * @prop - struct property point containing the maxsyncop for the update ++ * @devdata: struct nx842_devdata to use for dev_info ++ * @prop: struct property point containing the maxsyncop for the update + * + * Returns: + * 0 - Device is available + * -ENODEV - Device is not available + */ +-static int nx842_OF_upd_status(struct property *prop) ++static int nx842_OF_upd_status(struct nx842_devdata *devdata, ++ struct property *prop) + { + const char *status = (const char *)prop->value; + +@@ -773,7 +775,7 @@ static int nx842_OF_upd(struct property *new_prop) + goto out; + + /* Perform property updates */ +- ret = nx842_OF_upd_status(status); ++ ret = nx842_OF_upd_status(new_devdata, status); + if (ret) + goto error_out; + +@@ -1086,6 +1088,7 @@ static const struct vio_device_id nx842_vio_driver_ids[] = { + {"ibm,compression-v1", "ibm,compression"}, + {"", ""}, + }; ++MODULE_DEVICE_TABLE(vio, nx842_vio_driver_ids); + + static struct vio_driver nx842_vio_driver = { + .name = KBUILD_MODNAME, +diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c +index dac130bb807ae..eda692271f0c7 100644 +--- a/drivers/crypto/qat/qat_common/qat_hal.c ++++ b/drivers/crypto/qat/qat_common/qat_hal.c +@@ -1256,7 +1256,11 @@ static int qat_hal_put_rel_wr_xfer(struct icp_qat_fw_loader_handle *handle, + pr_err("QAT: bad xfrAddr=0x%x\n", xfr_addr); + return -EINVAL; + } +- qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval); ++ status = qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval); ++ if (status) { ++ pr_err("QAT: failed to read register"); ++ return status; ++ } + gpr_addr = qat_hal_get_reg_addr(ICP_GPB_REL, gprnum); + data16low = 0xffff & data; + data16hi = 0xffff & (data >> 0x10); +diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c +index aeb03081415cb..9542423bb7ca5 100644 +--- a/drivers/crypto/qat/qat_common/qat_uclo.c ++++ b/drivers/crypto/qat/qat_common/qat_uclo.c +@@ -385,7 +385,6 @@ static int qat_uclo_init_umem_seg(struct icp_qat_fw_loader_handle *handle, + return 0; + } + +-#define ICP_DH895XCC_PESRAM_BAR_SIZE 0x80000 + static int qat_uclo_init_ae_memory(struct icp_qat_fw_loader_handle *handle, + struct icp_qat_uof_initmem *init_mem) + { +diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c +index a0bb8a6eec3fd..18ef5b8cc18a7 100644 +--- a/drivers/crypto/ux500/hash/hash_core.c ++++ b/drivers/crypto/ux500/hash/hash_core.c +@@ -1007,6 +1007,7 @@ static int hash_hw_final(struct ahash_request *req) + goto out; + } + } else if (req->nbytes == 0 && ctx->keylen > 0) { ++ ret = -EPERM; + dev_err(device_data->dev, "%s: Empty message with keylength > 0, NOT supported\n", + __func__); + goto out; +diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c +index 3247689467435..9ab9fa0a911bd 100644 +--- a/drivers/edac/ti_edac.c ++++ b/drivers/edac/ti_edac.c +@@ -197,6 +197,7 @@ static const struct of_device_id ti_edac_of_match[] = { + { .compatible = "ti,emif-dra7xx", .data = (void *)EMIF_TYPE_DRA7 }, + {}, + }; ++MODULE_DEVICE_TABLE(of, ti_edac_of_match); + + static int _emif_get_id(struct device_node *node) + { +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 7a767b66dd865..98285eb8dd79d 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -783,3 +783,4 @@ module_platform_driver(max8997_muic_driver); + MODULE_DESCRIPTION("Maxim MAX8997 Extcon driver"); + MODULE_AUTHOR("Donggeun Kim <dg77.kim@samsung.com>"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS("platform:max8997-muic"); +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index 2efcd94f74fc6..59ec4c3e7c4d9 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -92,7 +92,6 @@ static struct reg_data sm5502_reg_data[] = { + | SM5502_REG_INTM2_MHL_MASK, + .invert = true, + }, +- { } + }; + + /* List of detectable cables */ +diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c +index 6945c3c966375..59db70fb45614 100644 +--- a/drivers/firmware/qemu_fw_cfg.c ++++ b/drivers/firmware/qemu_fw_cfg.c +@@ -296,15 +296,13 @@ static int fw_cfg_do_platform_probe(struct platform_device *pdev) + return 0; + } + +-static ssize_t fw_cfg_showrev(struct kobject *k, struct attribute *a, char *buf) ++static ssize_t fw_cfg_showrev(struct kobject *k, struct kobj_attribute *a, ++ char *buf) + { + return sprintf(buf, "%u\n", fw_cfg_rev); + } + +-static const struct { +- struct attribute attr; +- ssize_t (*show)(struct kobject *k, struct attribute *a, char *buf); +-} fw_cfg_rev_attr = { ++static const struct kobj_attribute fw_cfg_rev_attr = { + .attr = { .name = "rev", .mode = S_IRUSR }, + .show = fw_cfg_showrev, + }; +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index bd62236d3f975..5b4ca6142270e 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -726,7 +726,7 @@ static ssize_t cfam_read(struct file *filep, char __user *buf, size_t count, + rc = count; + fail: + *offset = off; +- return count; ++ return rc; + } + + static ssize_t cfam_write(struct file *filep, const char __user *buf, +@@ -763,7 +763,7 @@ static ssize_t cfam_write(struct file *filep, const char __user *buf, + rc = count; + fail: + *offset = off; +- return count; ++ return rc; + } + + static loff_t cfam_llseek(struct file *file, loff_t offset, int whence) +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index 9fa3959e08554..ace42cd2915e2 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -325,7 +325,8 @@ static int sbefifo_up_write(struct sbefifo *sbefifo, __be32 word) + static int sbefifo_request_reset(struct sbefifo *sbefifo) + { + struct device *dev = &sbefifo->fsi_dev->dev; +- u32 status, timeout; ++ unsigned long end_time; ++ u32 status; + int rc; + + dev_dbg(dev, "Requesting FIFO reset\n"); +@@ -341,7 +342,8 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo) + } + + /* Wait for it to complete */ +- for (timeout = 0; timeout < SBEFIFO_RESET_TIMEOUT; timeout++) { ++ end_time = jiffies + msecs_to_jiffies(SBEFIFO_RESET_TIMEOUT); ++ while (!time_after(jiffies, end_time)) { + rc = sbefifo_regr(sbefifo, SBEFIFO_UP | SBEFIFO_STS, &status); + if (rc) { + dev_err(dev, "Failed to read UP fifo status during reset" +@@ -355,7 +357,7 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo) + return 0; + } + +- msleep(1); ++ cond_resched(); + } + dev_err(dev, "FIFO reset timed out\n"); + +@@ -400,7 +402,7 @@ static int sbefifo_cleanup_hw(struct sbefifo *sbefifo) + /* The FIFO already contains a reset request from the SBE ? */ + if (down_status & SBEFIFO_STS_RESET_REQ) { + dev_info(dev, "Cleanup: FIFO reset request set, resetting\n"); +- rc = sbefifo_regw(sbefifo, SBEFIFO_UP, SBEFIFO_PERFORM_RESET); ++ rc = sbefifo_regw(sbefifo, SBEFIFO_DOWN, SBEFIFO_PERFORM_RESET); + if (rc) { + sbefifo->broken = true; + dev_err(dev, "Cleanup: Reset reg write failed, rc=%d\n", rc); +diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c +index fdc0e458dbaaf..6a48b3144410f 100644 +--- a/drivers/fsi/fsi-scom.c ++++ b/drivers/fsi/fsi-scom.c +@@ -47,9 +47,10 @@ + #define SCOM_STATUS_PIB_RESP_MASK 0x00007000 + #define SCOM_STATUS_PIB_RESP_SHIFT 12 + +-#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_PROTECTION | \ +- SCOM_STATUS_PARITY | \ +- SCOM_STATUS_PIB_ABORT | \ ++#define SCOM_STATUS_FSI2PIB_ERROR (SCOM_STATUS_PROTECTION | \ ++ SCOM_STATUS_PARITY | \ ++ SCOM_STATUS_PIB_ABORT) ++#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_FSI2PIB_ERROR | \ + SCOM_STATUS_PIB_RESP_MASK) + /* SCOM address encodings */ + #define XSCOM_ADDR_IND_FLAG BIT_ULL(63) +@@ -249,13 +250,14 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status) + { + uint32_t dummy = -1; + +- if (status & SCOM_STATUS_PROTECTION) +- return -EPERM; +- if (status & SCOM_STATUS_PARITY) { ++ if (status & SCOM_STATUS_FSI2PIB_ERROR) + fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy, + sizeof(uint32_t)); ++ ++ if (status & SCOM_STATUS_PROTECTION) ++ return -EPERM; ++ if (status & SCOM_STATUS_PARITY) + return -EIO; +- } + /* Return -EBUSY on PIB abort to force a retry */ + if (status & SCOM_STATUS_PIB_ABORT) + return -EBUSY; +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 0232c25a15864..dc4088a47ab2d 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -980,6 +980,7 @@ static const struct of_device_id pca953x_dt_ids[] = { + { .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), }, + + { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), }, ++ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), }, + + { .compatible = "exar,xra1202", .data = OF_953X( 8, 0), }, + { } +diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c +index 5dec96155814b..c2279b28bcb9c 100644 +--- a/drivers/gpio/gpio-zynq.c ++++ b/drivers/gpio/gpio-zynq.c +@@ -919,8 +919,11 @@ err_pm_dis: + static int zynq_gpio_remove(struct platform_device *pdev) + { + struct zynq_gpio *gpio = platform_get_drvdata(pdev); ++ int ret; + +- pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret < 0) ++ dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n"); + gpiochip_remove(&gpio->chip); + clk_disable_unprepare(gpio->clk); + device_set_wakeup_capable(&pdev->dev, 0); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 7f6af421d3e98..102b05b8f0c2b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2069,7 +2069,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev) + AMD_IP_BLOCK_TYPE_IH, + }; + +- for (i = 0; i < ARRAY_SIZE(ip_order); i++) { ++ for (i = 0; i < adev->num_ip_blocks; i++) { + int j; + struct amdgpu_ip_block *block; + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c +index 321af9af95e86..8f5246308d263 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c +@@ -476,10 +476,13 @@ static enum lb_memory_config dpp1_dscl_find_lb_memory_config(struct dcn10_dpp *d + int vtaps_c = scl_data->taps.v_taps_c; + int ceil_vratio = dc_fixpt_ceil(scl_data->ratios.vert); + int ceil_vratio_c = dc_fixpt_ceil(scl_data->ratios.vert_c); +- enum lb_memory_config mem_cfg = LB_MEMORY_CONFIG_0; + +- if (dpp->base.ctx->dc->debug.use_max_lb) +- return mem_cfg; ++ if (dpp->base.ctx->dc->debug.use_max_lb) { ++ if (scl_data->format == PIXEL_FORMAT_420BPP8 ++ || scl_data->format == PIXEL_FORMAT_420BPP10) ++ return LB_MEMORY_CONFIG_3; ++ return LB_MEMORY_CONFIG_0; ++ } + + dpp->base.caps->dscl_calc_lb_num_partitions( + scl_data, LB_MEMORY_CONFIG_1, &num_part_y, &num_part_c); +diff --git a/drivers/gpu/drm/amd/display/dc/irq_types.h b/drivers/gpu/drm/amd/display/dc/irq_types.h +index 0b5f3a278c227..24c38dac597ba 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq_types.h ++++ b/drivers/gpu/drm/amd/display/dc/irq_types.h +@@ -155,7 +155,7 @@ enum irq_type + }; + + #define DAL_VALID_IRQ_SRC_NUM(src) \ +- ((src) <= DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID) ++ ((src) < DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID) + + /* Number of Page Flip IRQ Sources. */ + #define DAL_PFLIP_IRQ_SRC_NUM \ +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +index 44d1cda56974d..9b2b8fa76f94f 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +@@ -96,8 +96,6 @@ static int mdp4_hw_init(struct msm_kms *kms) + if (mdp4_kms->rev > 1) + mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1); + +- dev->mode_config.allow_fb_modifiers = true; +- + out: + pm_runtime_put_sync(dev->dev); + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c +index 79ff653d8081e..f4dacd3b43111 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c +@@ -356,6 +356,12 @@ enum mdp4_pipe mdp4_plane_pipe(struct drm_plane *plane) + return mdp4_plane->pipe; + } + ++static const uint64_t supported_format_modifiers[] = { ++ DRM_FORMAT_MOD_SAMSUNG_64_32_TILE, ++ DRM_FORMAT_MOD_LINEAR, ++ DRM_FORMAT_MOD_INVALID ++}; ++ + /* initialize plane */ + struct drm_plane *mdp4_plane_init(struct drm_device *dev, + enum mdp4_pipe pipe_id, bool private_plane) +@@ -384,7 +390,7 @@ struct drm_plane *mdp4_plane_init(struct drm_device *dev, + type = private_plane ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY; + ret = drm_universal_plane_init(dev, plane, 0xff, &mdp4_plane_funcs, + mdp4_plane->formats, mdp4_plane->nformats, +- NULL, type, NULL); ++ supported_format_modifiers, type, NULL); + if (ret) + goto fail; + +diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig +index e9a8d90e67234..3ed6849d63cba 100644 +--- a/drivers/gpu/drm/mxsfb/Kconfig ++++ b/drivers/gpu/drm/mxsfb/Kconfig +@@ -9,7 +9,6 @@ config DRM_MXSFB + depends on COMMON_CLK + select DRM_MXS + select DRM_KMS_HELPER +- select DRM_KMS_FB_HELPER + select DRM_KMS_CMA_HELPER + select DRM_PANEL + help +diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c +index c666b89eed5d1..e89491b5155fc 100644 +--- a/drivers/gpu/drm/qxl/qxl_dumb.c ++++ b/drivers/gpu/drm/qxl/qxl_dumb.c +@@ -57,6 +57,8 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, + surf.height = args->height; + surf.stride = pitch; + surf.format = format; ++ surf.data = 0; ++ + r = qxl_gem_object_create_with_handle(qdev, file_priv, + QXL_GEM_DOMAIN_VRAM, + args->size, &surf, &qobj, +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 3f0f3a578ddf0..5985efc5a1f34 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1327,6 +1327,7 @@ radeon_user_framebuffer_create(struct drm_device *dev, + /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ + if (obj->import_attach) { + DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ drm_gem_object_put(obj); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c +index 8ad0d773dc33a..3feab563e50a7 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c +@@ -81,6 +81,7 @@ static int cdn_dp_grf_write(struct cdn_dp_device *dp, + ret = regmap_write(dp->grf, reg, val); + if (ret) { + DRM_DEV_ERROR(dp->dev, "Could not write to GRF: %d\n", ret); ++ clk_disable_unprepare(dp->grf_clk); + return ret; + } + +diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c +index 22397a23780c0..d7555991d1af9 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_kms.c ++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c +@@ -237,6 +237,7 @@ err_ttm: + err_vbufs: + vgdev->vdev->config->del_vqs(vgdev->vdev); + err_vqs: ++ dev->dev_private = NULL; + kfree(vgdev); + return ret; + } +diff --git a/drivers/gpu/drm/zte/Kconfig b/drivers/gpu/drm/zte/Kconfig +index 5b36421ef3e55..75b70126d2d30 100644 +--- a/drivers/gpu/drm/zte/Kconfig ++++ b/drivers/gpu/drm/zte/Kconfig +@@ -2,7 +2,6 @@ config DRM_ZTE + tristate "DRM Support for ZTE SoCs" + depends on DRM && ARCH_ZX + select DRM_KMS_CMA_HELPER +- select DRM_KMS_FB_HELPER + select DRM_KMS_HELPER + select SND_SOC_HDMI_CODEC if SND_SOC + select VIDEOMODE_HELPERS +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index acbbc21e62338..4549fbb741563 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2124,12 +2124,8 @@ static int hid_device_remove(struct device *dev) + { + struct hid_device *hdev = to_hid_device(dev); + struct hid_driver *hdrv; +- int ret = 0; + +- if (down_interruptible(&hdev->driver_input_lock)) { +- ret = -EINTR; +- goto end; +- } ++ down(&hdev->driver_input_lock); + hdev->io_started = false; + + hdrv = hdev->driver; +@@ -2144,8 +2140,8 @@ static int hid_device_remove(struct device *dev) + + if (!hdev->io_started) + up(&hdev->driver_input_lock); +-end: +- return ret; ++ ++ return 0; + } + + static ssize_t modalias_show(struct device *dev, struct device_attribute *a, +diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h +index 46da97162ef43..0abed1e5b5260 100644 +--- a/drivers/hid/wacom_wac.h ++++ b/drivers/hid/wacom_wac.h +@@ -126,7 +126,7 @@ + #define WACOM_HID_WD_TOUCHONOFF (WACOM_HID_UP_WACOMDIGITIZER | 0x0454) + #define WACOM_HID_WD_BATTERY_LEVEL (WACOM_HID_UP_WACOMDIGITIZER | 0x043b) + #define WACOM_HID_WD_EXPRESSKEY00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0910) +-#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0950) ++#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0940) + #define WACOM_HID_WD_MODE_CHANGE (WACOM_HID_UP_WACOMDIGITIZER | 0x0980) + #define WACOM_HID_WD_MUTE_DEVICE (WACOM_HID_UP_WACOMDIGITIZER | 0x0981) + #define WACOM_HID_WD_CONTROLPANEL (WACOM_HID_UP_WACOMDIGITIZER | 0x0982) +diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c +index 423205077bf64..2003314dcfbe7 100644 +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -548,8 +548,8 @@ static int hv_timesync_init(struct hv_util_service *srv) + */ + hv_ptp_clock = ptp_clock_register(&ptp_hyperv_info, NULL); + if (IS_ERR_OR_NULL(hv_ptp_clock)) { +- pr_err("cannot register PTP clock: %ld\n", +- PTR_ERR(hv_ptp_clock)); ++ pr_err("cannot register PTP clock: %d\n", ++ PTR_ERR_OR_ZERO(hv_ptp_clock)); + hv_ptp_clock = NULL; + } + +diff --git a/drivers/hwmon/max31722.c b/drivers/hwmon/max31722.c +index 30a100e70a0d0..877c3d7dca012 100644 +--- a/drivers/hwmon/max31722.c ++++ b/drivers/hwmon/max31722.c +@@ -9,7 +9,6 @@ + * directory of this archive for more details. + */ + +-#include <linux/acpi.h> + #include <linux/hwmon.h> + #include <linux/hwmon-sysfs.h> + #include <linux/kernel.h> +@@ -138,20 +137,12 @@ static const struct spi_device_id max31722_spi_id[] = { + {"max31723", 0}, + {} + }; +- +-static const struct acpi_device_id __maybe_unused max31722_acpi_id[] = { +- {"MAX31722", 0}, +- {"MAX31723", 0}, +- {} +-}; +- + MODULE_DEVICE_TABLE(spi, max31722_spi_id); + + static struct spi_driver max31722_driver = { + .driver = { + .name = "max31722", + .pm = &max31722_pm_ops, +- .acpi_match_table = ACPI_PTR(max31722_acpi_id), + }, + .probe = max31722_probe, + .remove = max31722_remove, +diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c +index 281491cca5103..66cf772de7d29 100644 +--- a/drivers/hwmon/max31790.c ++++ b/drivers/hwmon/max31790.c +@@ -179,7 +179,7 @@ static int max31790_read_fan(struct device *dev, u32 attr, int channel, + + switch (attr) { + case hwmon_fan_input: +- sr = get_tach_period(data->fan_dynamics[channel]); ++ sr = get_tach_period(data->fan_dynamics[channel % NR_CHANNEL]); + rpm = RPM_FROM_REG(data->tach[channel], sr); + *val = rpm; + return 0; +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 29dc2eac5b065..7f87e2c3b4828 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -470,7 +470,7 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev, + buf_ptr = buf->data_pages[cur] + offset; + *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); + +- if (lost && *barrier) { ++ if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { + *buf_ptr = *barrier; + barrier++; + } +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index 6c723b57dfc07..be2f02e35067f 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -215,6 +215,22 @@ static ssize_t port_show(struct device *dev, struct device_attribute *attr, + + static DEVICE_ATTR_RO(port); + ++static void intel_th_trace_prepare(struct intel_th_device *thdev) ++{ ++ struct intel_th_device *hub = to_intel_th_hub(thdev); ++ struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver); ++ ++ if (hub->type != INTEL_TH_SWITCH) ++ return; ++ ++ if (thdev->type != INTEL_TH_OUTPUT) ++ return; ++ ++ pm_runtime_get_sync(&thdev->dev); ++ hubdrv->prepare(hub, &thdev->output); ++ pm_runtime_put(&thdev->dev); ++} ++ + static int intel_th_output_activate(struct intel_th_device *thdev) + { + struct intel_th_driver *thdrv = +@@ -235,6 +251,7 @@ static int intel_th_output_activate(struct intel_th_device *thdev) + if (ret) + goto fail_put; + ++ intel_th_trace_prepare(thdev); + if (thdrv->activate) + ret = thdrv->activate(thdev); + else +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index 5041fe7fee9ed..ef2751556fd77 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -513,6 +513,21 @@ static void gth_tscu_resync(struct gth_device *gth) + iowrite32(reg, gth->base + REG_TSCU_TSUCTRL); + } + ++static void intel_th_gth_prepare(struct intel_th_device *thdev, ++ struct intel_th_output *output) ++{ ++ struct gth_device *gth = dev_get_drvdata(&thdev->dev); ++ int count; ++ ++ /* ++ * Wait until the output port is in reset before we start ++ * programming it. ++ */ ++ for (count = GTH_PLE_WAITLOOP_DEPTH; ++ count && !(gth_output_get(gth, output->port) & BIT(5)); count--) ++ cpu_relax(); ++} ++ + /** + * intel_th_gth_enable() - enable tracing to an output device + * @thdev: GTH device +@@ -734,6 +749,7 @@ static struct intel_th_driver intel_th_gth_driver = { + .assign = intel_th_gth_assign, + .unassign = intel_th_gth_unassign, + .set_output = intel_th_gth_set_output, ++ .prepare = intel_th_gth_prepare, + .enable = intel_th_gth_enable, + .disable = intel_th_gth_disable, + .driver = { +diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h +index 780206dc9012c..6b5473f3c16f0 100644 +--- a/drivers/hwtracing/intel_th/intel_th.h ++++ b/drivers/hwtracing/intel_th/intel_th.h +@@ -134,6 +134,7 @@ intel_th_output_assigned(struct intel_th_device *thdev) + * @remove: remove method + * @assign: match a given output type device against available outputs + * @unassign: deassociate an output type device from an output port ++ * @prepare: prepare output port for tracing + * @enable: enable tracing for a given output device + * @disable: disable tracing for a given output device + * @irq: interrupt callback +@@ -155,6 +156,8 @@ struct intel_th_driver { + struct intel_th_device *othdev); + void (*unassign)(struct intel_th_device *thdev, + struct intel_th_device *othdev); ++ void (*prepare)(struct intel_th_device *thdev, ++ struct intel_th_output *output); + void (*enable)(struct intel_th_device *thdev, + struct intel_th_output *output); + void (*disable)(struct intel_th_device *thdev, +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 39be53b6f9838..2a43f4e46af04 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -32,6 +32,7 @@ + #include <linux/i2c-smbus.h> + #include <linux/idr.h> + #include <linux/init.h> ++#include <linux/interrupt.h> + #include <linux/irqflags.h> + #include <linux/jump_label.h> + #include <linux/kernel.h> +@@ -457,6 +458,8 @@ static void i2c_device_shutdown(struct device *dev) + driver = to_i2c_driver(dev->driver); + if (driver->shutdown) + driver->shutdown(client); ++ else if (client->irq > 0) ++ disable_irq(client->irq); + } + + static void i2c_client_dev_release(struct device *dev) +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index cb9765a3de607..4bedf48d662a5 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -121,7 +121,11 @@ struct bma180_data { + int scale; + int bw; + bool pmode; +- u8 buff[16]; /* 3x 16-bit + 8-bit + padding + timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chan[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + enum bma180_chan { +@@ -667,12 +671,12 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p) + mutex_unlock(&data->mutex); + goto err; + } +- ((s16 *)data->buff)[i++] = ret; ++ data->scan.chan[i++] = ret; + } + + mutex_unlock(&data->mutex); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buff, time_ns); ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, time_ns); + err: + iio_trigger_notify_done(indio_dev->trig); + +diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c +index e25d91c017ed2..a548dc11e7c7b 100644 +--- a/drivers/iio/accel/bma220_spi.c ++++ b/drivers/iio/accel/bma220_spi.c +@@ -76,7 +76,11 @@ static const int bma220_scale_table[][4] = { + struct bma220_data { + struct spi_device *spi_device; + struct mutex lock; +- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 8x8 timestamp */ ++ struct { ++ s8 chans[3]; ++ /* Ensure timestamp is naturally aligned. */ ++ s64 timestamp __aligned(8); ++ } scan; + u8 tx_buf[2] ____cacheline_aligned; + }; + +@@ -107,12 +111,12 @@ static irqreturn_t bma220_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + data->tx_buf[0] = BMA220_REG_ACCEL_X | BMA220_READ_MASK; +- ret = spi_write_then_read(spi, data->tx_buf, 1, data->buffer, ++ ret = spi_write_then_read(spi, data->tx_buf, 1, &data->scan.chans, + ARRAY_SIZE(bma220_channels) - 1); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + mutex_unlock(&data->lock); +diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c +index 38ff374a3ca45..32d5438d45194 100644 +--- a/drivers/iio/accel/hid-sensor-accel-3d.c ++++ b/drivers/iio/accel/hid-sensor-accel-3d.c +@@ -42,8 +42,11 @@ struct accel_3d_state { + struct hid_sensor_hub_callbacks callbacks; + struct hid_sensor_common common_attributes; + struct hid_sensor_hub_attribute_info accel[ACCEL_3D_CHANNEL_MAX]; +- /* Reserve for 3 channels + padding + timestamp */ +- u32 accel_val[ACCEL_3D_CHANNEL_MAX + 3]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u32 accel_val[3]; ++ s64 timestamp __aligned(8); ++ } scan; + int scale_pre_decml; + int scale_post_decml; + int scale_precision; +@@ -254,8 +257,8 @@ static int accel_3d_proc_event(struct hid_sensor_hub_device *hsdev, + accel_state->timestamp = iio_get_time_ns(indio_dev); + + hid_sensor_push_data(indio_dev, +- accel_state->accel_val, +- sizeof(accel_state->accel_val), ++ &accel_state->scan, ++ sizeof(accel_state->scan), + accel_state->timestamp); + + accel_state->timestamp = 0; +@@ -280,7 +283,7 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev, + case HID_USAGE_SENSOR_ACCEL_Y_AXIS: + case HID_USAGE_SENSOR_ACCEL_Z_AXIS: + offset = usage_id - HID_USAGE_SENSOR_ACCEL_X_AXIS; +- accel_state->accel_val[CHANNEL_SCAN_INDEX_X + offset] = ++ accel_state->scan.accel_val[CHANNEL_SCAN_INDEX_X + offset] = + *(u32 *)raw_data; + ret = 0; + break; +diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c +index c22afc9792067..0ca6f9de51923 100644 +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -140,12 +140,23 @@ enum kx_acpi_type { + ACPI_KIOX010A, + }; + ++enum kxcjk1013_axis { ++ AXIS_X, ++ AXIS_Y, ++ AXIS_Z, ++ AXIS_MAX ++}; ++ + struct kxcjk1013_data { + struct i2c_client *client; + struct iio_trigger *dready_trig; + struct iio_trigger *motion_trig; + struct mutex mutex; +- s16 buffer[8]; ++ /* Ensure timestamp naturally aligned */ ++ struct { ++ s16 chans[AXIS_MAX]; ++ s64 timestamp __aligned(8); ++ } scan; + u8 odr_bits; + u8 range; + int wake_thres; +@@ -159,13 +170,6 @@ struct kxcjk1013_data { + enum kx_acpi_type acpi_type; + }; + +-enum kxcjk1013_axis { +- AXIS_X, +- AXIS_Y, +- AXIS_Z, +- AXIS_MAX, +-}; +- + enum kxcjk1013_mode { + STANDBY, + OPERATION, +@@ -1086,12 +1090,12 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data_or_emulated(data->client, + KXCJK1013_REG_XOUT_L, + AXIS_MAX * 2, +- (u8 *)data->buffer); ++ (u8 *)data->scan.chans); + mutex_unlock(&data->mutex); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + data->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/accel/stk8312.c b/drivers/iio/accel/stk8312.c +index cacc0da2f874e..52c33addf47b5 100644 +--- a/drivers/iio/accel/stk8312.c ++++ b/drivers/iio/accel/stk8312.c +@@ -106,7 +106,11 @@ struct stk8312_data { + u8 mode; + struct iio_trigger *dready_trig; + bool dready_trigger_on; +- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s8 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static IIO_CONST_ATTR(in_accel_scale_available, STK8312_SCALE_AVAIL); +@@ -441,7 +445,7 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data(data->client, + STK8312_REG_XOUT, + STK8312_ALL_CHANNEL_SIZE, +- data->buffer); ++ data->scan.chans); + if (ret < STK8312_ALL_CHANNEL_SIZE) { + dev_err(&data->client->dev, "register read failed\n"); + mutex_unlock(&data->lock); +@@ -455,12 +459,12 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p) + mutex_unlock(&data->lock); + goto err; + } +- data->buffer[i++] = ret; ++ data->scan.chans[i++] = ret; + } + } + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/accel/stk8ba50.c b/drivers/iio/accel/stk8ba50.c +index 576b6b140f080..0d9067d3ccc48 100644 +--- a/drivers/iio/accel/stk8ba50.c ++++ b/drivers/iio/accel/stk8ba50.c +@@ -94,12 +94,11 @@ struct stk8ba50_data { + u8 sample_rate_idx; + struct iio_trigger *dready_trig; + bool dready_trigger_on; +- /* +- * 3 x 16-bit channels (10-bit data, 6-bit padding) + +- * 1 x 16 padding + +- * 4 x 16 64-bit timestamp +- */ +- s16 buffer[8]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chans[3]; ++ s64 timetamp __aligned(8); ++ } scan; + }; + + #define STK8BA50_ACCEL_CHANNEL(index, reg, axis) { \ +@@ -327,7 +326,7 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data(data->client, + STK8BA50_REG_XOUT, + STK8BA50_ALL_CHANNEL_SIZE, +- (u8 *)data->buffer); ++ (u8 *)data->scan.chans); + if (ret < STK8BA50_ALL_CHANNEL_SIZE) { + dev_err(&data->client->dev, "register read failed\n"); + goto err; +@@ -340,10 +339,10 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p) + if (ret < 0) + goto err; + +- data->buffer[i++] = ret; ++ data->scan.chans[i++] = ret; + } + } +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + mutex_unlock(&data->lock); +diff --git a/drivers/iio/adc/hx711.c b/drivers/iio/adc/hx711.c +index 6c5d81a89aec9..0dc487dd16749 100644 +--- a/drivers/iio/adc/hx711.c ++++ b/drivers/iio/adc/hx711.c +@@ -94,9 +94,9 @@ struct hx711_data { + struct mutex lock; + /* + * triggered buffer +- * 2x32-bit channel + 64-bit timestamp ++ * 2x32-bit channel + 64-bit naturally aligned timestamp + */ +- u32 buffer[4]; ++ u32 buffer[4] __aligned(8); + /* + * delay after a rising edge on SCK until the data is ready DOUT + * this is dependent on the hx711 where the datasheet tells a +diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c +index c627513d9f0f2..fc8b70d8d64c9 100644 +--- a/drivers/iio/adc/mxs-lradc-adc.c ++++ b/drivers/iio/adc/mxs-lradc-adc.c +@@ -124,7 +124,8 @@ struct mxs_lradc_adc { + struct device *dev; + + void __iomem *base; +- u32 buffer[10]; ++ /* Maximum of 8 channels + 8 byte ts */ ++ u32 buffer[10] __aligned(8); + struct iio_trigger *trig; + struct completion completion; + spinlock_t lock; +diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c +index dc8d859e4b92c..b1cccc3eeea61 100644 +--- a/drivers/iio/adc/ti-ads1015.c ++++ b/drivers/iio/adc/ti-ads1015.c +@@ -391,10 +391,14 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; + struct ads1015_data *data = iio_priv(indio_dev); +- s16 buf[8]; /* 1x s16 ADC val + 3x s16 padding + 4x s16 timestamp */ ++ /* Ensure natural alignment of timestamp */ ++ struct { ++ s16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + int chan, ret, res; + +- memset(buf, 0, sizeof(buf)); ++ memset(&scan, 0, sizeof(scan)); + + mutex_lock(&data->lock); + chan = find_first_bit(indio_dev->active_scan_mask, +@@ -405,10 +409,10 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) + goto err; + } + +- buf[0] = res; ++ scan.chan = res; + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, buf, ++ iio_push_to_buffers_with_timestamp(indio_dev, &scan, + iio_get_time_ns(indio_dev)); + + err: +diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c +index 7f16c77b99fb4..9bcb05897c9da 100644 +--- a/drivers/iio/adc/ti-ads8688.c ++++ b/drivers/iio/adc/ti-ads8688.c +@@ -386,7 +386,8 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p) + { + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; +- u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)]; ++ /* Ensure naturally aligned timestamp */ ++ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8); + int i, j = 0; + + for (i = 0; i < indio_dev->masklength; i++) { +diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c +index bbcb7a4d7edfd..3e480244ad9a0 100644 +--- a/drivers/iio/adc/vf610_adc.c ++++ b/drivers/iio/adc/vf610_adc.c +@@ -180,7 +180,11 @@ struct vf610_adc { + u32 sample_freq_avail[5]; + + struct completion completion; +- u16 buffer[8]; ++ /* Ensure the timestamp is naturally aligned */ ++ struct { ++ u16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 }; +@@ -592,9 +596,9 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id) + if (coco & VF610_ADC_HS_COCO0) { + info->value = vf610_adc_read_data(info); + if (iio_buffer_enabled(indio_dev)) { +- info->buffer[0] = info->value; ++ info->scan.chan = info->value; + iio_push_to_buffers_with_timestamp(indio_dev, +- info->buffer, ++ &info->scan, + iio_get_time_ns(indio_dev)); + iio_trigger_notify_done(indio_dev->trig); + } else +diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c +index 92c07ab826eb3..ef8ef96201f62 100644 +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -103,7 +103,11 @@ struct bmg160_data { + struct iio_trigger *dready_trig; + struct iio_trigger *motion_trig; + struct mutex mutex; +- s16 buffer[8]; ++ /* Ensure naturally aligned timestamp */ ++ struct { ++ s16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + u32 dps_range; + int ev_enable_state; + int slope_thres; +@@ -872,12 +876,12 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p) + + mutex_lock(&data->mutex); + ret = regmap_bulk_read(data->regmap, BMG160_REG_XOUT_L, +- data->buffer, AXIS_MAX * 2); ++ data->scan.chans, AXIS_MAX * 2); + mutex_unlock(&data->mutex); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c +index 7d8669dc6547c..b09bd0b39c9c9 100644 +--- a/drivers/iio/humidity/am2315.c ++++ b/drivers/iio/humidity/am2315.c +@@ -36,7 +36,11 @@ + struct am2315_data { + struct i2c_client *client; + struct mutex lock; +- s16 buffer[8]; /* 2x16-bit channels + 2x16 padding + 4x16 timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chans[2]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + struct am2315_sensor_data { +@@ -170,20 +174,20 @@ static irqreturn_t am2315_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + if (*(indio_dev->active_scan_mask) == AM2315_ALL_CHANNEL_MASK) { +- data->buffer[0] = sensor_data.hum_data; +- data->buffer[1] = sensor_data.temp_data; ++ data->scan.chans[0] = sensor_data.hum_data; ++ data->scan.chans[1] = sensor_data.temp_data; + } else { + i = 0; + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->masklength) { +- data->buffer[i] = (bit ? sensor_data.temp_data : +- sensor_data.hum_data); ++ data->scan.chans[i] = (bit ? sensor_data.temp_data : ++ sensor_data.hum_data); + i++; + } + } + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c +index e59d0438de732..bde68462b5ed2 100644 +--- a/drivers/iio/imu/adis_buffer.c ++++ b/drivers/iio/imu/adis_buffer.c +@@ -83,9 +83,6 @@ static irqreturn_t adis_trigger_handler(int irq, void *p) + struct adis *adis = iio_device_get_drvdata(indio_dev); + int ret; + +- if (!adis->buffer) +- return -ENOMEM; +- + if (adis->data->has_paging) { + mutex_lock(&adis->txrx_lock); + if (adis->current_page != 0) { +diff --git a/drivers/iio/light/isl29125.c b/drivers/iio/light/isl29125.c +index ed38edcd5efe7..d0f5fd42c0ece 100644 +--- a/drivers/iio/light/isl29125.c ++++ b/drivers/iio/light/isl29125.c +@@ -54,7 +54,11 @@ + struct isl29125_data { + struct i2c_client *client; + u8 conf1; +- u16 buffer[8]; /* 3x 16-bit, padding, 8 bytes timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + #define ISL29125_CHANNEL(_color, _si) { \ +@@ -187,10 +191,10 @@ static irqreturn_t isl29125_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c +index 947f17588024a..f3fb79c231be6 100644 +--- a/drivers/iio/light/ltr501.c ++++ b/drivers/iio/light/ltr501.c +@@ -35,9 +35,12 @@ + #define LTR501_PART_ID 0x86 + #define LTR501_MANUFAC_ID 0x87 + #define LTR501_ALS_DATA1 0x88 /* 16-bit, little endian */ ++#define LTR501_ALS_DATA1_UPPER 0x89 /* upper 8 bits of LTR501_ALS_DATA1 */ + #define LTR501_ALS_DATA0 0x8a /* 16-bit, little endian */ ++#define LTR501_ALS_DATA0_UPPER 0x8b /* upper 8 bits of LTR501_ALS_DATA0 */ + #define LTR501_ALS_PS_STATUS 0x8c + #define LTR501_PS_DATA 0x8d /* 16-bit, little endian */ ++#define LTR501_PS_DATA_UPPER 0x8e /* upper 8 bits of LTR501_PS_DATA */ + #define LTR501_INTR 0x8f /* output mode, polarity, mode */ + #define LTR501_PS_THRESH_UP 0x90 /* 11 bit, ps upper threshold */ + #define LTR501_PS_THRESH_LOW 0x92 /* 11 bit, ps lower threshold */ +@@ -408,18 +411,19 @@ static int ltr501_read_als(struct ltr501_data *data, __le16 buf[2]) + + static int ltr501_read_ps(struct ltr501_data *data) + { +- int ret, status; ++ __le16 status; ++ int ret; + + ret = ltr501_drdy(data, LTR501_STATUS_PS_RDY); + if (ret < 0) + return ret; + + ret = regmap_bulk_read(data->regmap, LTR501_PS_DATA, +- &status, 2); ++ &status, sizeof(status)); + if (ret < 0) + return ret; + +- return status; ++ return le16_to_cpu(status); + } + + static int ltr501_read_intr_prst(struct ltr501_data *data, +@@ -1207,7 +1211,7 @@ static struct ltr501_chip_info ltr501_chip_info_tbl[] = { + .als_gain_tbl_size = ARRAY_SIZE(ltr559_als_gain_tbl), + .ps_gain = ltr559_ps_gain_tbl, + .ps_gain_tbl_size = ARRAY_SIZE(ltr559_ps_gain_tbl), +- .als_mode_active = BIT(1), ++ .als_mode_active = BIT(0), + .als_gain_mask = BIT(2) | BIT(3) | BIT(4), + .als_gain_shift = 2, + .info = <r501_info, +@@ -1356,9 +1360,12 @@ static bool ltr501_is_volatile_reg(struct device *dev, unsigned int reg) + { + switch (reg) { + case LTR501_ALS_DATA1: ++ case LTR501_ALS_DATA1_UPPER: + case LTR501_ALS_DATA0: ++ case LTR501_ALS_DATA0_UPPER: + case LTR501_ALS_PS_STATUS: + case LTR501_PS_DATA: ++ case LTR501_PS_DATA_UPPER: + return true; + default: + return false; +diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c +index 205e5659ce6b5..c525420e7c62e 100644 +--- a/drivers/iio/light/tcs3414.c ++++ b/drivers/iio/light/tcs3414.c +@@ -56,7 +56,11 @@ struct tcs3414_data { + u8 control; + u8 gain; + u8 timing; +- u16 buffer[8]; /* 4x 16-bit + 8 bytes timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + #define TCS3414_CHANNEL(_color, _si, _addr) { \ +@@ -212,10 +216,10 @@ static irqreturn_t tcs3414_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +diff --git a/drivers/iio/light/tcs3472.c b/drivers/iio/light/tcs3472.c +index e7923b514d7ac..82204414c7a1d 100644 +--- a/drivers/iio/light/tcs3472.c ++++ b/drivers/iio/light/tcs3472.c +@@ -67,7 +67,11 @@ struct tcs3472_data { + u8 control; + u8 atime; + u8 apers; +- u16 buffer[8]; /* 4 16-bit channels + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const struct iio_event_spec tcs3472_events[] = { +@@ -389,10 +393,10 @@ static irqreturn_t tcs3472_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +@@ -535,7 +539,8 @@ static int tcs3472_probe(struct i2c_client *client, + return 0; + + free_irq: +- free_irq(client->irq, indio_dev); ++ if (client->irq) ++ free_irq(client->irq, indio_dev); + buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); + return ret; +@@ -563,7 +568,8 @@ static int tcs3472_remove(struct i2c_client *client) + struct iio_dev *indio_dev = i2c_get_clientdata(client); + + iio_device_unregister(indio_dev); +- free_irq(client->irq, indio_dev); ++ if (client->irq) ++ free_irq(client->irq, indio_dev); + iio_triggered_buffer_cleanup(indio_dev); + tcs3472_powerdown(iio_priv(indio_dev)); + +diff --git a/drivers/iio/potentiostat/lmp91000.c b/drivers/iio/potentiostat/lmp91000.c +index 90e895adf9975..68f4f6fa27da3 100644 +--- a/drivers/iio/potentiostat/lmp91000.c ++++ b/drivers/iio/potentiostat/lmp91000.c +@@ -71,8 +71,8 @@ struct lmp91000_data { + + struct completion completion; + u8 chan_select; +- +- u32 buffer[4]; /* 64-bit data + 64-bit timestamp */ ++ /* 64-bit data + 64-bit naturally aligned timestamp */ ++ u32 buffer[4] __aligned(8); + }; + + static const struct iio_chan_spec lmp91000_channels[] = { +diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c +index f130388a16a0c..9069eec46093c 100644 +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -61,7 +61,11 @@ struct as3935_state { + unsigned long noise_tripped; + u32 tune_cap; + u32 nflwdth_reg; +- u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u8 chan; ++ s64 timestamp __aligned(8); ++ } scan; + u8 buf[2] ____cacheline_aligned; + }; + +@@ -227,8 +231,8 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private) + if (ret) + goto err_read; + +- st->buffer[0] = val & AS3935_DATA_MASK; +- iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer, ++ st->scan.chan = val & AS3935_DATA_MASK; ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->scan, + iio_get_time_ns(indio_dev)); + err_read: + iio_trigger_notify_done(indio_dev->trig); +diff --git a/drivers/iio/proximity/isl29501.c b/drivers/iio/proximity/isl29501.c +index e5e94540f404d..a99d26023ef7b 100644 +--- a/drivers/iio/proximity/isl29501.c ++++ b/drivers/iio/proximity/isl29501.c +@@ -946,7 +946,7 @@ static irqreturn_t isl29501_trigger_handler(int irq, void *p) + struct iio_dev *indio_dev = pf->indio_dev; + struct isl29501_private *isl29501 = iio_priv(indio_dev); + const unsigned long *active_mask = indio_dev->active_scan_mask; +- u32 buffer[4] = {}; /* 1x16-bit + ts */ ++ u32 buffer[4] __aligned(8) = {}; /* 1x16-bit + naturally aligned ts */ + + if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask)) + isl29501_register_read(isl29501, REG_DISTANCE, buffer); +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index 67f85268b63db..0c76170224071 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -43,7 +43,11 @@ struct lidar_data { + int (*xfer)(struct lidar_data *data, u8 reg, u8 *val, int len); + int i2c_enabled; + +- u16 buffer[8]; /* 2 byte distance + 8 byte timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const struct iio_chan_spec lidar_channels[] = { +@@ -228,9 +232,9 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private) + struct lidar_data *data = iio_priv(indio_dev); + int ret; + +- ret = lidar_get_measurement(data, data->buffer); ++ ret = lidar_get_measurement(data, &data->scan.chan); + if (!ret) { +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + } else if (ret != -EINVAL) { + dev_err(&data->client->dev, "cannot read LIDAR measurement"); +diff --git a/drivers/iio/proximity/srf08.c b/drivers/iio/proximity/srf08.c +index f2bf783f829a0..5e8d3707738b3 100644 +--- a/drivers/iio/proximity/srf08.c ++++ b/drivers/iio/proximity/srf08.c +@@ -66,11 +66,11 @@ struct srf08_data { + int range_mm; + struct mutex lock; + +- /* +- * triggered buffer +- * 1x16-bit channel + 3x16 padding + 4x16 timestamp +- */ +- s16 buffer[8]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + + /* Sensor-Type */ + enum srf08_sensor_type sensor_type; +@@ -193,9 +193,9 @@ static irqreturn_t srf08_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + +- data->buffer[0] = sensor_data; ++ data->scan.chan = sensor_data; + iio_push_to_buffers_with_timestamp(indio_dev, +- data->buffer, pf->timestamp); ++ &data->scan, pf->timestamp); + + mutex_unlock(&data->lock); + err: +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 8cdf933310d15..842a30947bdc0 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2558,7 +2558,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) + + cma_init_resolve_route_work(work, id_priv); + +- route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); ++ if (!route->path_rec) ++ route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) { + ret = -ENOMEM; + goto err1; +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index caa6a502c37e2..20e3128f59b14 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -295,6 +295,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, + if (user && (!wq->sq.bar2_pa || (need_rq && !wq->rq.bar2_pa))) { + pr_warn("%s: sqid %u or rqid %u not in BAR2 range\n", + pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid); ++ ret = -EINVAL; + goto free_dma; + } + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 13513466df01f..1688c06d5c3c7 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -5374,8 +5374,6 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + port->mp.mpi = NULL; + +- list_add_tail(&mpi->list, &mlx5_ib_unaffiliated_port_list); +- + spin_unlock(&port->mp.mpi_lock); + + err = mlx5_nic_vport_unaffiliate_multiport(mpi->mdev); +@@ -5524,6 +5522,8 @@ static void mlx5_ib_cleanup_multiport_master(struct mlx5_ib_dev *dev) + dev->port[i].mp.mpi = NULL; + } else { + mlx5_ib_dbg(dev, "unbinding port_num: %d\n", i + 1); ++ list_add_tail(&dev->port[i].mp.mpi->list, ++ &mlx5_ib_unaffiliated_port_list); + mlx5_ib_unbind_slave_port(dev, dev->port[i].mp.mpi); + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 2cca89ca08cd4..375e5520865e5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -175,7 +175,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start, + if (IS_ERR(umem)) { + pr_warn("err %d from rxe_umem_get\n", + (int)PTR_ERR(umem)); +- err = -EINVAL; ++ err = PTR_ERR(umem); + goto err1; + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 04bfc36cc8d76..5874e8e8253d6 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -290,10 +290,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, + + /* Create UDP socket */ + err = udp_sock_create(net, &udp_cfg, &sock); +- if (err < 0) { +- pr_err("failed to create udp socket. err = %d\n", err); ++ if (err < 0) + return ERR_PTR(err); +- } + + tnl_cfg.encap_type = 1; + tnl_cfg.encap_rcv = rxe_udp_encap_recv; +@@ -717,6 +715,12 @@ static int rxe_net_ipv6_init(void) + + recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net, + htons(ROCE_V2_UDP_DPORT), true); ++ if (PTR_ERR(recv_sockets.sk6) == -EAFNOSUPPORT) { ++ recv_sockets.sk6 = NULL; ++ pr_warn("IPv6 is not supported, can not create a UDPv6 socket\n"); ++ return 0; ++ } ++ + if (IS_ERR(recv_sockets.sk6)) { + recv_sockets.sk6 = NULL; + pr_err("Failed to create IPv6 UDP tunnel\n"); +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 41c9ede98c265..4798b718b085b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -151,7 +151,6 @@ static void free_rd_atomic_resources(struct rxe_qp *qp) + void free_rd_atomic_resource(struct rxe_qp *qp, struct resp_res *res) + { + if (res->type == RXE_ATOMIC_MASK) { +- rxe_drop_ref(qp); + kfree_skb(res->atomic.skb); + } else if (res->type == RXE_READ_MASK) { + if (res->read.mr) +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 9078cfd3b8bdd..b36d364f0fb54 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -999,8 +999,6 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt, + goto out; + } + +- rxe_add_ref(qp); +- + res = &qp->resp.resources[qp->resp.res_head]; + free_rd_atomic_resource(qp, res); + rxe_advance_resp_resource(qp); +diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c +index 7ef6e1c165e35..9123799365e63 100644 +--- a/drivers/input/joydev.c ++++ b/drivers/input/joydev.c +@@ -504,7 +504,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, + memcpy(joydev->keypam, keypam, len); + + for (i = 0; i < joydev->nkey; i++) +- joydev->keymap[keypam[i] - BTN_MISC] = i; ++ joydev->keymap[joydev->keypam[i] - BTN_MISC] = i; + + out: + kfree(keypam); +diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c +index bb29a7c9a1c0c..54afb38601b9f 100644 +--- a/drivers/input/keyboard/hil_kbd.c ++++ b/drivers/input/keyboard/hil_kbd.c +@@ -512,6 +512,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv) + HIL_IDD_NUM_AXES_PER_SET(*idd)) { + printk(KERN_INFO PREFIX + "combo devices are not supported.\n"); ++ error = -EINVAL; + goto bail1; + } + +diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c +index f1cd4dd9a4a34..d7775db0b7114 100644 +--- a/drivers/input/touchscreen/hideep.c ++++ b/drivers/input/touchscreen/hideep.c +@@ -364,13 +364,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts) + return -EIO; + } + +-static void hideep_nvm_unlock(struct hideep_ts *ts) ++static int hideep_nvm_unlock(struct hideep_ts *ts) + { + u32 unmask_code; ++ int error; + + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE); +- hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); ++ error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); ++ if (error) ++ return error; + + /* make it unprotected code */ + unmask_code &= ~HIDEEP_PROT_MODE; +@@ -387,6 +390,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts) + NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask); + SET_FLASH_HWCONTROL(); + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); ++ ++ return 0; + } + + static int hideep_check_status(struct hideep_ts *ts) +@@ -465,7 +470,9 @@ static int hideep_program_nvm(struct hideep_ts *ts, + u32 addr = 0; + int error; + +- hideep_nvm_unlock(ts); ++ error = hideep_nvm_unlock(ts); ++ if (error) ++ return error; + + while (ucode_len > 0) { + xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE); +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index d939c17985182..3f556af80bc56 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -264,7 +264,7 @@ static int e2i_init(struct usbtouch_usb *usbtouch) + int ret; + struct usb_device *udev = interface_to_usbdev(usbtouch->interface); + +- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), ++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + 0x01, 0x02, 0x0000, 0x0081, + NULL, 0, USB_CTRL_SET_TIMEOUT); + +@@ -544,7 +544,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch) + if (ret) + return ret; + +- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), ++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + MTOUCHUSB_RESET, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); +@@ -556,7 +556,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch) + msleep(150); + + for (i = 0; i < 3; i++) { +- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), ++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + MTOUCHUSB_ASYNC_REPORT, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 1, 1, NULL, 0, USB_CTRL_SET_TIMEOUT); +@@ -735,7 +735,7 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch) + } + + /* start sending data */ +- ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), ++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), + TSC10_CMD_DATA1, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); +diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c +index b5eec18ad59a5..7895320e50c1e 100644 +--- a/drivers/ipack/carriers/tpci200.c ++++ b/drivers/ipack/carriers/tpci200.c +@@ -599,8 +599,11 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + + out_err_bus_register: + tpci200_uninstall(tpci200); ++ /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ ++ tpci200->info->cfg_regs = NULL; + out_err_install: +- iounmap(tpci200->info->cfg_regs); ++ if (tpci200->info->cfg_regs) ++ iounmap(tpci200->info->cfg_regs); + out_err_ioremap: + pci_release_region(pdev, TPCI200_CFG_MEM_BAR); + out_err_pci_request: +diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c +index ebb3fa2e1d00f..53349850f8669 100644 +--- a/drivers/isdn/hardware/mISDN/hfcpci.c ++++ b/drivers/isdn/hardware/mISDN/hfcpci.c +@@ -2348,7 +2348,7 @@ static void __exit + HFC_cleanup(void) + { + if (timer_pending(&hfc_tl)) +- del_timer(&hfc_tl); ++ del_timer_sync(&hfc_tl); + + pci_unregister_driver(&hfc_driver); + } +diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c +index f883616d9e606..821944379f2cf 100644 +--- a/drivers/leds/leds-as3645a.c ++++ b/drivers/leds/leds-as3645a.c +@@ -565,6 +565,7 @@ static int as3645a_parse_node(struct as3645a *flash, + if (!flash->indicator_node) { + dev_warn(&flash->client->dev, + "can't find indicator node\n"); ++ rval = -ENODEV; + goto out_err; + } + +diff --git a/drivers/leds/leds-ktd2692.c b/drivers/leds/leds-ktd2692.c +index 45296aaca9daa..02738b5b1dbf2 100644 +--- a/drivers/leds/leds-ktd2692.c ++++ b/drivers/leds/leds-ktd2692.c +@@ -259,6 +259,17 @@ static void ktd2692_setup(struct ktd2692_context *led) + | KTD2692_REG_FLASH_CURRENT_BASE); + } + ++static void regulator_disable_action(void *_data) ++{ ++ struct device *dev = _data; ++ struct ktd2692_context *led = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = regulator_disable(led->regulator); ++ if (ret) ++ dev_err(dev, "Failed to disable supply: %d\n", ret); ++} ++ + static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev, + struct ktd2692_led_config_data *cfg) + { +@@ -289,8 +300,14 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev, + + if (led->regulator) { + ret = regulator_enable(led->regulator); +- if (ret) ++ if (ret) { + dev_err(dev, "Failed to enable supply: %d\n", ret); ++ } else { ++ ret = devm_add_action_or_reset(dev, ++ regulator_disable_action, dev); ++ if (ret) ++ return ret; ++ } + } + + child_node = of_get_next_available_child(np, NULL); +@@ -380,17 +397,9 @@ static int ktd2692_probe(struct platform_device *pdev) + static int ktd2692_remove(struct platform_device *pdev) + { + struct ktd2692_context *led = platform_get_drvdata(pdev); +- int ret; + + led_classdev_flash_unregister(&led->fled_cdev); + +- if (led->regulator) { +- ret = regulator_disable(led->regulator); +- if (ret) +- dev_err(&pdev->dev, +- "Failed to disable supply: %d\n", ret); +- } +- + mutex_destroy(&led->lock); + + return 0; +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index eff04fa23dfad..9e4d1212f4c16 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, + delete_at(n, index); + } + +- *new_root = shadow_root(&spine); ++ if (!r) ++ *new_root = shadow_root(&spine); + exit_shadow_spine(&spine); + + return r; +diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c +index bf4c5e2ccb6ff..e0acae7a3815d 100644 +--- a/drivers/md/persistent-data/dm-space-map-disk.c ++++ b/drivers/md/persistent-data/dm-space-map-disk.c +@@ -171,6 +171,14 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b) + * Any block we allocate has to be free in both the old and current ll. + */ + r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b); ++ if (r == -ENOSPC) { ++ /* ++ * There's no free block between smd->begin and the end of the metadata device. ++ * We search before smd->begin in case something has been freed. ++ */ ++ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b); ++ } ++ + if (r) + return r; + +@@ -199,7 +207,6 @@ static int sm_disk_commit(struct dm_space_map *sm) + return r; + + memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll)); +- smd->begin = 0; + smd->nr_allocated_this_transaction = 0; + + r = sm_disk_get_nr_free(sm, &nr_free); +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index 9e3c64ec2026f..da439ac857963 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -452,6 +452,14 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b) + * Any block we allocate has to be free in both the old and current ll. + */ + r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b); ++ if (r == -ENOSPC) { ++ /* ++ * There's no free block between smm->begin and the end of the metadata device. ++ * We search before smm->begin in case something has been freed. ++ */ ++ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b); ++ } ++ + if (r) + return r; + +@@ -503,7 +511,6 @@ static int sm_metadata_commit(struct dm_space_map *sm) + return r; + + memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll)); +- smm->begin = 0; + smm->allocated_this_transaction = 0; + + return 0; +diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c +index 3b02cb570a6ea..661920dd84d12 100644 +--- a/drivers/media/common/siano/smscoreapi.c ++++ b/drivers/media/common/siano/smscoreapi.c +@@ -916,7 +916,7 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, + void *buffer, size_t size) + { + struct sms_firmware *firmware = (struct sms_firmware *) buffer; +- struct sms_msg_data4 *msg; ++ struct sms_msg_data5 *msg; + u32 mem_address, calc_checksum = 0; + u32 i, *ptr; + u8 *payload = firmware->payload; +@@ -997,24 +997,20 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, + goto exit_fw_download; + + if (coredev->mode == DEVICE_MODE_NONE) { +- struct sms_msg_data *trigger_msg = +- (struct sms_msg_data *) msg; +- + pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n"); + SMS_INIT_MSG(&msg->x_msg_header, + MSG_SMS_SWDOWNLOAD_TRIGGER_REQ, +- sizeof(struct sms_msg_hdr) + +- sizeof(u32) * 5); ++ sizeof(*msg)); + +- trigger_msg->msg_data[0] = firmware->start_address; ++ msg->msg_data[0] = firmware->start_address; + /* Entry point */ +- trigger_msg->msg_data[1] = 6; /* Priority */ +- trigger_msg->msg_data[2] = 0x200; /* Stack size */ +- trigger_msg->msg_data[3] = 0; /* Parameter */ +- trigger_msg->msg_data[4] = 4; /* Task ID */ ++ msg->msg_data[1] = 6; /* Priority */ ++ msg->msg_data[2] = 0x200; /* Stack size */ ++ msg->msg_data[3] = 0; /* Parameter */ ++ msg->msg_data[4] = 4; /* Task ID */ + +- rc = smscore_sendrequest_and_wait(coredev, trigger_msg, +- trigger_msg->x_msg_header.msg_length, ++ rc = smscore_sendrequest_and_wait(coredev, msg, ++ msg->x_msg_header.msg_length, + &coredev->trigger_done); + } else { + SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_EXEC_REQ, +diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h +index eb58853008c9b..4de4d257c6b6e 100644 +--- a/drivers/media/common/siano/smscoreapi.h ++++ b/drivers/media/common/siano/smscoreapi.h +@@ -640,9 +640,9 @@ struct sms_msg_data2 { + u32 msg_data[2]; + }; + +-struct sms_msg_data4 { ++struct sms_msg_data5 { + struct sms_msg_hdr x_msg_header; +- u32 msg_data[4]; ++ u32 msg_data[5]; + }; + + struct sms_data_download { +diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c +index afca47b97c2a2..637ace7a2b5c7 100644 +--- a/drivers/media/common/siano/smsdvb-main.c ++++ b/drivers/media/common/siano/smsdvb-main.c +@@ -1187,6 +1187,10 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, + return 0; + + media_graph_error: ++ mutex_lock(&g_smsdvb_clientslock); ++ list_del(&client->entry); ++ mutex_unlock(&g_smsdvb_clientslock); ++ + smsdvb_debugfs_release(client); + + client_error: +diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c +index 10f78109bb3fc..3f154755bbc63 100644 +--- a/drivers/media/dvb-core/dvb_net.c ++++ b/drivers/media/dvb-core/dvb_net.c +@@ -56,6 +56,7 @@ + #include <linux/module.h> + #include <linux/kernel.h> + #include <linux/netdevice.h> ++#include <linux/nospec.h> + #include <linux/etherdevice.h> + #include <linux/dvb/net.h> + #include <linux/uio.h> +@@ -1473,14 +1474,20 @@ static int dvb_net_do_ioctl(struct file *file, + struct net_device *netdev; + struct dvb_net_priv *priv_data; + struct dvb_net_if *dvbnetif = parg; ++ int if_num = dvbnetif->if_num; + +- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || +- !dvbnet->state[dvbnetif->if_num]) { ++ if (if_num >= DVB_NET_DEVICES_MAX) { + ret = -EINVAL; + goto ioctl_error; + } ++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); + +- netdev = dvbnet->device[dvbnetif->if_num]; ++ if (!dvbnet->state[if_num]) { ++ ret = -EINVAL; ++ goto ioctl_error; ++ } ++ ++ netdev = dvbnet->device[if_num]; + + priv_data = netdev_priv(netdev); + dvbnetif->pid=priv_data->pid; +@@ -1533,14 +1540,20 @@ static int dvb_net_do_ioctl(struct file *file, + struct net_device *netdev; + struct dvb_net_priv *priv_data; + struct __dvb_net_if_old *dvbnetif = parg; ++ int if_num = dvbnetif->if_num; ++ ++ if (if_num >= DVB_NET_DEVICES_MAX) { ++ ret = -EINVAL; ++ goto ioctl_error; ++ } ++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); + +- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || +- !dvbnet->state[dvbnetif->if_num]) { ++ if (!dvbnet->state[if_num]) { + ret = -EINVAL; + goto ioctl_error; + } + +- netdev = dvbnet->device[dvbnetif->if_num]; ++ netdev = dvbnet->device[if_num]; + + priv_data = netdev_priv(netdev); + dvbnetif->pid=priv_data->pid; +diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c +index a14a74e6b986e..19ff9cb08e884 100644 +--- a/drivers/media/i2c/ir-kbd-i2c.c ++++ b/drivers/media/i2c/ir-kbd-i2c.c +@@ -688,8 +688,8 @@ static int zilog_tx(struct rc_dev *rcdev, unsigned int *txbuf, + goto out_unlock; + } + +- i = i2c_master_recv(ir->tx_c, buf, 1); +- if (i != 1) { ++ ret = i2c_master_recv(ir->tx_c, buf, 1); ++ if (ret != 1) { + dev_err(&ir->rc->dev, "i2c_master_recv failed with %d\n", ret); + ret = -EIO; + goto out_unlock; +diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c +index ce196b60f9170..37cb2f82c36b0 100644 +--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c ++++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c +@@ -1394,7 +1394,7 @@ static int __s5c73m3_power_on(struct s5c73m3 *state) + s5c73m3_gpio_deassert(state, STBY); + usleep_range(100, 200); + +- s5c73m3_gpio_deassert(state, RST); ++ s5c73m3_gpio_deassert(state, RSET); + usleep_range(50, 100); + + return 0; +@@ -1409,7 +1409,7 @@ static int __s5c73m3_power_off(struct s5c73m3 *state) + { + int i, ret; + +- if (s5c73m3_gpio_assert(state, RST)) ++ if (s5c73m3_gpio_assert(state, RSET)) + usleep_range(10, 50); + + if (s5c73m3_gpio_assert(state, STBY)) +@@ -1614,7 +1614,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state) + + state->mclk_frequency = pdata->mclk_frequency; + state->gpio[STBY] = pdata->gpio_stby; +- state->gpio[RST] = pdata->gpio_reset; ++ state->gpio[RSET] = pdata->gpio_reset; + return 0; + } + +diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h +index 653f68e7ea07b..e267b2522149a 100644 +--- a/drivers/media/i2c/s5c73m3/s5c73m3.h ++++ b/drivers/media/i2c/s5c73m3/s5c73m3.h +@@ -361,7 +361,7 @@ struct s5c73m3_ctrls { + + enum s5c73m3_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +diff --git a/drivers/media/i2c/s5k4ecgx.c b/drivers/media/i2c/s5k4ecgx.c +index 6ebcf254989a5..75fb13a33eab3 100644 +--- a/drivers/media/i2c/s5k4ecgx.c ++++ b/drivers/media/i2c/s5k4ecgx.c +@@ -177,7 +177,7 @@ static const char * const s5k4ecgx_supply_names[] = { + + enum s5k4ecgx_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +@@ -482,7 +482,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv) + if (s5k4ecgx_gpio_set_value(priv, STBY, priv->gpio[STBY].level)) + usleep_range(30, 50); + +- if (s5k4ecgx_gpio_set_value(priv, RST, priv->gpio[RST].level)) ++ if (s5k4ecgx_gpio_set_value(priv, RSET, priv->gpio[RSET].level)) + usleep_range(30, 50); + + return 0; +@@ -490,7 +490,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv) + + static int __s5k4ecgx_power_off(struct s5k4ecgx *priv) + { +- if (s5k4ecgx_gpio_set_value(priv, RST, !priv->gpio[RST].level)) ++ if (s5k4ecgx_gpio_set_value(priv, RSET, !priv->gpio[RSET].level)) + usleep_range(30, 50); + + if (s5k4ecgx_gpio_set_value(priv, STBY, !priv->gpio[STBY].level)) +@@ -878,7 +878,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv, + int ret; + + priv->gpio[STBY].gpio = -EINVAL; +- priv->gpio[RST].gpio = -EINVAL; ++ priv->gpio[RSET].gpio = -EINVAL; + + ret = s5k4ecgx_config_gpio(gpio->gpio, gpio->level, "S5K4ECGX_STBY"); + +@@ -897,7 +897,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv, + s5k4ecgx_free_gpios(priv); + return ret; + } +- priv->gpio[RST] = *gpio; ++ priv->gpio[RSET] = *gpio; + if (gpio_is_valid(gpio->gpio)) + gpio_set_value(gpio->gpio, 0); + +diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c +index 5007c9659342d..de3329f04fdf6 100644 +--- a/drivers/media/i2c/s5k5baf.c ++++ b/drivers/media/i2c/s5k5baf.c +@@ -238,7 +238,7 @@ struct s5k5baf_gpio { + + enum s5k5baf_gpio_id { + STBY, +- RST, ++ RSET, + NUM_GPIOS, + }; + +@@ -973,7 +973,7 @@ static int s5k5baf_power_on(struct s5k5baf *state) + + s5k5baf_gpio_deassert(state, STBY); + usleep_range(50, 100); +- s5k5baf_gpio_deassert(state, RST); ++ s5k5baf_gpio_deassert(state, RSET); + return 0; + + err_reg_dis: +@@ -991,7 +991,7 @@ static int s5k5baf_power_off(struct s5k5baf *state) + state->apply_cfg = 0; + state->apply_crop = 0; + +- s5k5baf_gpio_assert(state, RST); ++ s5k5baf_gpio_assert(state, RSET); + s5k5baf_gpio_assert(state, STBY); + + if (!IS_ERR(state->clock)) +diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c +index 13c10b5e2b451..e9c6e41cd44d9 100644 +--- a/drivers/media/i2c/s5k6aa.c ++++ b/drivers/media/i2c/s5k6aa.c +@@ -181,7 +181,7 @@ static const char * const s5k6aa_supply_names[] = { + + enum s5k6aa_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +@@ -845,7 +845,7 @@ static int __s5k6aa_power_on(struct s5k6aa *s5k6aa) + ret = s5k6aa->s_power(1); + usleep_range(4000, 5000); + +- if (s5k6aa_gpio_deassert(s5k6aa, RST)) ++ if (s5k6aa_gpio_deassert(s5k6aa, RSET)) + msleep(20); + + return ret; +@@ -855,7 +855,7 @@ static int __s5k6aa_power_off(struct s5k6aa *s5k6aa) + { + int ret; + +- if (s5k6aa_gpio_assert(s5k6aa, RST)) ++ if (s5k6aa_gpio_assert(s5k6aa, RSET)) + usleep_range(100, 150); + + if (s5k6aa->s_power) { +@@ -1514,7 +1514,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa, + int ret; + + s5k6aa->gpio[STBY].gpio = -EINVAL; +- s5k6aa->gpio[RST].gpio = -EINVAL; ++ s5k6aa->gpio[RSET].gpio = -EINVAL; + + gpio = &pdata->gpio_stby; + if (gpio_is_valid(gpio->gpio)) { +@@ -1537,7 +1537,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa, + if (ret < 0) + return ret; + +- s5k6aa->gpio[RST] = *gpio; ++ s5k6aa->gpio[RSET] = *gpio; + } + + return 0; +diff --git a/drivers/media/i2c/saa6588.c b/drivers/media/i2c/saa6588.c +index 33d2987f9555e..c074e51834e93 100644 +--- a/drivers/media/i2c/saa6588.c ++++ b/drivers/media/i2c/saa6588.c +@@ -392,7 +392,7 @@ static void saa6588_configure(struct saa6588 *s) + + /* ---------------------------------------------------------------------- */ + +-static long saa6588_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg) ++static long saa6588_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg) + { + struct saa6588 *s = to_saa6588(sd); + struct saa6588_command *a = arg; +@@ -445,7 +445,7 @@ static int saa6588_s_tuner(struct v4l2_subdev *sd, const struct v4l2_tuner *vt) + /* ----------------------------------------------------------------------- */ + + static const struct v4l2_subdev_core_ops saa6588_core_ops = { +- .ioctl = saa6588_ioctl, ++ .command = saa6588_command, + }; + + static const struct v4l2_subdev_tuner_ops saa6588_tuner_ops = { +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 041b16965b967..079b8db4bc48b 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -1972,6 +1972,7 @@ static int tc358743_probe_of(struct tc358743_state *state) + bps_pr_lane = 2 * endpoint->link_frequencies[0]; + if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) { + dev_err(dev, "unsupported bps per lane: %u bps\n", bps_pr_lane); ++ ret = -EINVAL; + goto disable_clk; + } + +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index f5f87e03f94bb..855f8dc2a4ee0 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -494,6 +494,9 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + btwrite(0, BT878_AINT_MASK); + bt878_num++; + ++ if (!bt->tasklet.func) ++ tasklet_disable(&bt->tasklet); ++ + return 0; + + fail2: +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 4c042ba6de918..2a9d25431d733 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -3243,7 +3243,7 @@ static int radio_release(struct file *file) + + btv->radio_user--; + +- bttv_call_all(btv, core, ioctl, SAA6588_CMD_CLOSE, &cmd); ++ bttv_call_all(btv, core, command, SAA6588_CMD_CLOSE, &cmd); + + if (btv->radio_user == 0) + btv->has_radio_tuner = 0; +@@ -3324,7 +3324,7 @@ static ssize_t radio_read(struct file *file, char __user *data, + cmd.result = -ENODEV; + radio_enable(btv); + +- bttv_call_all(btv, core, ioctl, SAA6588_CMD_READ, &cmd); ++ bttv_call_all(btv, core, command, SAA6588_CMD_READ, &cmd); + + return cmd.result; + } +@@ -3345,7 +3345,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait) + cmd.instance = file; + cmd.event_list = wait; + cmd.poll_mask = res; +- bttv_call_all(btv, core, ioctl, SAA6588_CMD_POLL, &cmd); ++ bttv_call_all(btv, core, command, SAA6588_CMD_POLL, &cmd); + + return cmd.poll_mask; + } +diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c +index 4885e833c0522..f422558e63920 100644 +--- a/drivers/media/pci/cobalt/cobalt-driver.c ++++ b/drivers/media/pci/cobalt/cobalt-driver.c +@@ -675,6 +675,7 @@ static int cobalt_probe(struct pci_dev *pci_dev, + return -ENOMEM; + cobalt->pci_dev = pci_dev; + cobalt->instance = i; ++ mutex_init(&cobalt->pci_lock); + + retval = v4l2_device_register(&pci_dev->dev, &cobalt->v4l2_dev); + if (retval) { +diff --git a/drivers/media/pci/cobalt/cobalt-driver.h b/drivers/media/pci/cobalt/cobalt-driver.h +index 429bee4ef79c5..883093e5adea9 100644 +--- a/drivers/media/pci/cobalt/cobalt-driver.h ++++ b/drivers/media/pci/cobalt/cobalt-driver.h +@@ -250,6 +250,8 @@ struct cobalt { + int instance; + struct pci_dev *pci_dev; + struct v4l2_device v4l2_dev; ++ /* serialize PCI access in cobalt_s_bit_sysctrl() */ ++ struct mutex pci_lock; + + void __iomem *bar0, *bar1; + +@@ -319,10 +321,13 @@ static inline u32 cobalt_g_sysctrl(struct cobalt *cobalt) + static inline void cobalt_s_bit_sysctrl(struct cobalt *cobalt, + int bit, int val) + { +- u32 ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE); ++ u32 ctrl; + ++ mutex_lock(&cobalt->pci_lock); ++ ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE); + cobalt_write_bar1(cobalt, COBALT_SYS_CTRL_BASE, + (ctrl & ~(1UL << bit)) | (val << bit)); ++ mutex_unlock(&cobalt->pci_lock); + } + + static inline u32 cobalt_g_sysstat(struct cobalt *cobalt) +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index 1a50ec9d084f3..079219288af7b 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -1202,7 +1202,7 @@ static int video_release(struct file *file) + + saa_call_all(dev, tuner, standby); + if (vdev->vfl_type == VFL_TYPE_RADIO) +- saa_call_all(dev, core, ioctl, SAA6588_CMD_CLOSE, &cmd); ++ saa_call_all(dev, core, command, SAA6588_CMD_CLOSE, &cmd); + mutex_unlock(&dev->lock); + + return 0; +@@ -1221,7 +1221,7 @@ static ssize_t radio_read(struct file *file, char __user *data, + cmd.result = -ENODEV; + + mutex_lock(&dev->lock); +- saa_call_all(dev, core, ioctl, SAA6588_CMD_READ, &cmd); ++ saa_call_all(dev, core, command, SAA6588_CMD_READ, &cmd); + mutex_unlock(&dev->lock); + + return cmd.result; +@@ -1237,7 +1237,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait) + cmd.event_list = wait; + cmd.poll_mask = 0; + mutex_lock(&dev->lock); +- saa_call_all(dev, core, ioctl, SAA6588_CMD_POLL, &cmd); ++ saa_call_all(dev, core, command, SAA6588_CMD_POLL, &cmd); + mutex_unlock(&dev->lock); + + return rc | cmd.poll_mask; +diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c +index 6f82693524331..2a073a6d83e39 100644 +--- a/drivers/media/platform/davinci/vpbe_display.c ++++ b/drivers/media/platform/davinci/vpbe_display.c +@@ -60,7 +60,7 @@ static int venc_is_second_field(struct vpbe_display *disp_dev) + + ret = v4l2_subdev_call(vpbe_dev->venc, + core, +- ioctl, ++ command, + VENC_GET_FLD, + &val); + if (ret < 0) { +diff --git a/drivers/media/platform/davinci/vpbe_venc.c b/drivers/media/platform/davinci/vpbe_venc.c +index ddcad7b3e76c2..c2cfaa9c69577 100644 +--- a/drivers/media/platform/davinci/vpbe_venc.c ++++ b/drivers/media/platform/davinci/vpbe_venc.c +@@ -534,9 +534,7 @@ static int venc_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, + return ret; + } + +-static long venc_ioctl(struct v4l2_subdev *sd, +- unsigned int cmd, +- void *arg) ++static long venc_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg) + { + u32 val; + +@@ -555,7 +553,7 @@ static long venc_ioctl(struct v4l2_subdev *sd, + } + + static const struct v4l2_subdev_core_ops venc_core_ops = { +- .ioctl = venc_ioctl, ++ .command = venc_command, + }; + + static const struct v4l2_subdev_video_ops venc_video_ops = { +diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c +index 39340abefd14d..c9ef74ee476a4 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -308,17 +308,20 @@ static int isp_video_release(struct file *file) + struct fimc_is_video *ivc = &isp->video_capture; + struct media_entity *entity = &ivc->ve.vdev.entity; + struct media_device *mdev = entity->graph_obj.mdev; ++ bool is_singular_file; + + mutex_lock(&isp->video_lock); + +- if (v4l2_fh_is_singular_file(file) && ivc->streaming) { ++ is_singular_file = v4l2_fh_is_singular_file(file); ++ ++ if (is_singular_file && ivc->streaming) { + media_pipeline_stop(entity); + ivc->streaming = 0; + } + + _vb2_fop_release(file, NULL); + +- if (v4l2_fh_is_singular_file(file)) { ++ if (is_singular_file) { + fimc_pipeline_call(&ivc->ve, close); + + mutex_lock(&mdev->graph_mutex); +diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c +index 8837e2678bdeb..3032247c63a51 100644 +--- a/drivers/media/platform/s5p-cec/s5p_cec.c ++++ b/drivers/media/platform/s5p-cec/s5p_cec.c +@@ -55,7 +55,7 @@ static int s5p_cec_adap_enable(struct cec_adapter *adap, bool enable) + } else { + s5p_cec_mask_tx_interrupts(cec); + s5p_cec_mask_rx_interrupts(cec); +- pm_runtime_disable(cec->dev); ++ pm_runtime_put(cec->dev); + } + + return 0; +diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c +index 1f58574d0b965..4cf5b559420f6 100644 +--- a/drivers/media/platform/s5p-g2d/g2d.c ++++ b/drivers/media/platform/s5p-g2d/g2d.c +@@ -285,6 +285,9 @@ static int g2d_release(struct file *file) + struct g2d_dev *dev = video_drvdata(file); + struct g2d_ctx *ctx = fh2ctx(file->private_data); + ++ mutex_lock(&dev->mutex); ++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); ++ mutex_unlock(&dev->mutex); + v4l2_ctrl_handler_free(&ctx->ctrl_handler); + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c +index d826c011c0952..6b852b0bb15ab 100644 +--- a/drivers/media/platform/sti/hva/hva-hw.c ++++ b/drivers/media/platform/sti/hva/hva-hw.c +@@ -130,8 +130,7 @@ static irqreturn_t hva_hw_its_irq_thread(int irq, void *arg) + ctx_id = (hva->sts_reg & 0xFF00) >> 8; + if (ctx_id >= HVA_MAX_INSTANCES) { + dev_err(dev, "%s %s: bad context identifier: %d\n", +- ctx->name, __func__, ctx_id); +- ctx->hw_err = true; ++ HVA_PREFIX, __func__, ctx_id); + goto out; + } + +diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c +index 8b97fd1f0ceaf..5a0e26e47f59a 100644 +--- a/drivers/media/rc/bpf-lirc.c ++++ b/drivers/media/rc/bpf-lirc.c +@@ -295,7 +295,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr) + } + + if (attr->query.prog_cnt != 0 && prog_ids && cnt) +- ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt); ++ ret = bpf_prog_array_copy_to_user(progs, prog_ids, ++ attr->query.prog_cnt); + + unlock: + mutex_unlock(&ir_raw_handler_lock); +diff --git a/drivers/media/usb/cpia2/cpia2.h b/drivers/media/usb/cpia2/cpia2.h +index ab238ac8bfc06..50c952250dc9b 100644 +--- a/drivers/media/usb/cpia2/cpia2.h ++++ b/drivers/media/usb/cpia2/cpia2.h +@@ -438,6 +438,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd); + int cpia2_do_command(struct camera_data *cam, + unsigned int command, + unsigned char direction, unsigned char param); ++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf); + struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf); + int cpia2_init_camera(struct camera_data *cam); + int cpia2_allocate_buffers(struct camera_data *cam); +diff --git a/drivers/media/usb/cpia2/cpia2_core.c b/drivers/media/usb/cpia2/cpia2_core.c +index 3dfbb545c0e38..42cce7e94101b 100644 +--- a/drivers/media/usb/cpia2/cpia2_core.c ++++ b/drivers/media/usb/cpia2/cpia2_core.c +@@ -2172,6 +2172,18 @@ static void reset_camera_struct(struct camera_data *cam) + cam->height = cam->params.roi.height; + } + ++/****************************************************************************** ++ * ++ * cpia2_init_camera_struct ++ * ++ * Deinitialize camera struct ++ *****************************************************************************/ ++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf) ++{ ++ v4l2_device_unregister(&cam->v4l2_dev); ++ kfree(cam); ++} ++ + /****************************************************************************** + * + * cpia2_init_camera_struct +diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c +index 4c191fcd3a7f5..8392175740695 100644 +--- a/drivers/media/usb/cpia2/cpia2_usb.c ++++ b/drivers/media/usb/cpia2/cpia2_usb.c +@@ -853,15 +853,13 @@ static int cpia2_usb_probe(struct usb_interface *intf, + ret = set_alternate(cam, USBIF_CMDONLY); + if (ret < 0) { + ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + + + if((ret = cpia2_init_camera(cam)) < 0) { + ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + LOG(" CPiA Version: %d.%02d (%d.%d)\n", + cam->params.version.firmware_revision_hi, +@@ -881,11 +879,14 @@ static int cpia2_usb_probe(struct usb_interface *intf, + ret = cpia2_register_camera(cam); + if (ret < 0) { + ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + + return 0; ++ ++alt_err: ++ cpia2_deinit_camera_struct(cam, intf); ++ return ret; + } + + /****************************************************************************** +diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c +index 6131aa7914a9a..fb59dda7547a5 100644 +--- a/drivers/media/usb/dvb-usb/cinergyT2-core.c ++++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c +@@ -88,6 +88,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap) + + ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0); + if (ret < 0) { ++ if (adap->fe_adap[0].fe) ++ adap->fe_adap[0].fe->ops.release(adap->fe_adap[0].fe); + deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep state info\n"); + } + mutex_unlock(&d->data_mutex); +diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c +index 5400ec99986fc..0c9f12d4ac284 100644 +--- a/drivers/media/usb/dvb-usb/cxusb.c ++++ b/drivers/media/usb/dvb-usb/cxusb.c +@@ -1659,7 +1659,7 @@ static struct dvb_usb_device_properties cxusb_bluebird_lgz201_properties = { + + .size_of_priv = sizeof(struct cxusb_state), + +- .num_adapters = 2, ++ .num_adapters = 1, + .adapter = { + { + .num_frontends = 1, +diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c +index 2fa2abd3e7263..07fd0bbf9b802 100644 +--- a/drivers/media/usb/dvb-usb/dtv5100.c ++++ b/drivers/media/usb/dvb-usb/dtv5100.c +@@ -35,6 +35,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, + u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen) + { + struct dtv5100_state *st = d->priv; ++ unsigned int pipe; + u8 request; + u8 type; + u16 value; +@@ -43,6 +44,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, + switch (wlen) { + case 1: + /* write { reg }, read { value } */ ++ pipe = usb_rcvctrlpipe(d->udev, 0); + request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_READ : + DTV5100_TUNER_READ); + type = USB_TYPE_VENDOR | USB_DIR_IN; +@@ -50,6 +52,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, + break; + case 2: + /* write { reg, value } */ ++ pipe = usb_sndctrlpipe(d->udev, 0); + request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_WRITE : + DTV5100_TUNER_WRITE); + type = USB_TYPE_VENDOR | USB_DIR_OUT; +@@ -63,7 +66,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, + + memcpy(st->data, rbuf, rlen); + msleep(1); /* avoid I2C errors */ +- return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request, ++ return usb_control_msg(d->udev, pipe, request, + type, value, index, st->data, rlen, + DTV5100_USB_TIMEOUT); + } +@@ -150,7 +153,7 @@ static int dtv5100_probe(struct usb_interface *intf, + + /* initialize non qt1010/zl10353 part? */ + for (i = 0; dtv5100_init[i].request; i++) { +- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), ++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + dtv5100_init[i].request, + USB_TYPE_VENDOR | USB_DIR_OUT, + dtv5100_init[i].value, +diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c +index f84a1208d5d32..3612f0d730ddd 100644 +--- a/drivers/media/usb/em28xx/em28xx-input.c ++++ b/drivers/media/usb/em28xx/em28xx-input.c +@@ -736,7 +736,8 @@ static int em28xx_ir_init(struct em28xx *dev) + dev->board.has_ir_i2c = 0; + dev_warn(&dev->intf->dev, + "No i2c IR remote control device found.\n"); +- return -ENODEV; ++ err = -ENODEV; ++ goto ref_put; + } + } + +@@ -751,7 +752,7 @@ static int em28xx_ir_init(struct em28xx *dev) + + ir = kzalloc(sizeof(*ir), GFP_KERNEL); + if (!ir) +- return -ENOMEM; ++ goto ref_put; + rc = rc_allocate_device(RC_DRIVER_SCANCODE); + if (!rc) + goto error; +@@ -862,6 +863,9 @@ error: + dev->ir = NULL; + rc_free_device(rc); + kfree(ir); ++ref_put: ++ em28xx_shutdown_buttons(dev); ++ kref_put(&dev->ref, em28xx_free_device); + return err; + } + +diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c +index 262200af76a34..7da437e7785f1 100644 +--- a/drivers/media/usb/gspca/gl860/gl860.c ++++ b/drivers/media/usb/gspca/gl860/gl860.c +@@ -573,8 +573,8 @@ int gl860_RTx(struct gspca_dev *gspca_dev, + len, 400 + 200 * (len > 1)); + memcpy(pdata, gspca_dev->usb_buf, len); + } else { +- r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), +- req, pref, val, index, NULL, len, 400); ++ gspca_err(gspca_dev, "zero-length read request\n"); ++ r = -EINVAL; + } + } + +diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c +index 13676af42cfc7..dc3caf1b36e7d 100644 +--- a/drivers/media/usb/gspca/sq905.c ++++ b/drivers/media/usb/gspca/sq905.c +@@ -125,7 +125,7 @@ static int sq905_command(struct gspca_dev *gspca_dev, u16 index) + } + + ret = usb_control_msg(gspca_dev->dev, +- usb_sndctrlpipe(gspca_dev->dev, 0), ++ usb_rcvctrlpipe(gspca_dev->dev, 0), + USB_REQ_SYNCH_FRAME, /* request */ + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + SQ905_PING, 0, gspca_dev->usb_buf, 1, +diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c +index 26eae69a2562f..15e9d0de4208a 100644 +--- a/drivers/media/usb/gspca/sunplus.c ++++ b/drivers/media/usb/gspca/sunplus.c +@@ -251,6 +251,10 @@ static void reg_r(struct gspca_dev *gspca_dev, + gspca_err(gspca_dev, "reg_r: buffer overflow\n"); + return; + } ++ if (len == 0) { ++ gspca_err(gspca_dev, "reg_r: zero-length read\n"); ++ return; ++ } + if (gspca_dev->usb_err < 0) + return; + ret = usb_control_msg(gspca_dev->dev, +@@ -259,7 +263,7 @@ static void reg_r(struct gspca_dev *gspca_dev, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0, /* value */ + index, +- len ? gspca_dev->usb_buf : NULL, len, ++ gspca_dev->usb_buf, len, + 500); + if (ret < 0) { + pr_err("reg_r err %d\n", ret); +@@ -736,7 +740,7 @@ static int sd_start(struct gspca_dev *gspca_dev) + case MegaImageVI: + reg_w_riv(gspca_dev, 0xf0, 0, 0); + spca504B_WaitCmdStatus(gspca_dev); +- reg_r(gspca_dev, 0xf0, 4, 0); ++ reg_w_riv(gspca_dev, 0xf0, 4, 0); + spca504B_WaitCmdStatus(gspca_dev); + break; + default: +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index fcb201a40920e..d1bbfe4000ddc 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -2668,9 +2668,8 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw) + pvr2_stream_destroy(hdw->vid_stream); + hdw->vid_stream = NULL; + } +- pvr2_i2c_core_done(hdw); + v4l2_device_unregister(&hdw->v4l2_dev); +- pvr2_hdw_remove_usb_stuff(hdw); ++ pvr2_hdw_disconnect(hdw); + mutex_lock(&pvr2_unit_mtx); + do { + if ((hdw->unit_number >= 0) && +@@ -2697,6 +2696,7 @@ void pvr2_hdw_disconnect(struct pvr2_hdw *hdw) + { + pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_disconnect(hdw=%p)",hdw); + LOCK_TAKE(hdw->big_lock); ++ pvr2_i2c_core_done(hdw); + LOCK_TAKE(hdw->ctl_lock); + pvr2_hdw_remove_usb_stuff(hdw); + LOCK_GIVE(hdw->ctl_lock); +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index ffffb66d51a00..56b058d60a0dc 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -129,10 +129,37 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit, + static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl) + { ++ static const struct usb_device_id elgato_cam_link_4k = { ++ USB_DEVICE(0x0fd9, 0x0066) ++ }; + struct uvc_format *format = NULL; + struct uvc_frame *frame = NULL; + unsigned int i; + ++ /* ++ * The response of the Elgato Cam Link 4K is incorrect: The second byte ++ * contains bFormatIndex (instead of being the second byte of bmHint). ++ * The first byte is always zero. The third byte is always 1. ++ * ++ * The UVC 1.5 class specification defines the first five bits in the ++ * bmHint bitfield. The remaining bits are reserved and should be zero. ++ * Therefore a valid bmHint will be less than 32. ++ * ++ * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix. ++ * MCU: 20.02.19, FPGA: 67 ++ */ ++ if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) && ++ ctrl->bmHint > 255) { ++ u8 corrected_format_index = ctrl->bmHint >> 8; ++ ++ /* uvc_dbg(stream->dev, VIDEO, ++ "Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n", ++ ctrl->bmHint, ctrl->bFormatIndex, ++ 1, corrected_format_index); */ ++ ctrl->bmHint = 1; ++ ctrl->bFormatIndex = corrected_format_index; ++ } ++ + for (i = 0; i < stream->nformats; ++i) { + if (stream->format[i].index == ctrl->bFormatIndex) { + format = &stream->format[i]; +diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c +index 501030bb2e7d0..f92d7688b07ad 100644 +--- a/drivers/media/usb/zr364xx/zr364xx.c ++++ b/drivers/media/usb/zr364xx/zr364xx.c +@@ -1058,6 +1058,7 @@ static int zr364xx_start_readpipe(struct zr364xx_camera *cam) + DBG("submitting URB %p\n", pipe_info->stream_urb); + retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL); + if (retval) { ++ usb_free_urb(pipe_info->stream_urb); + printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n"); + return retval; + } +diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c +index c91a7bd3ecfc7..ac8282d059fca 100644 +--- a/drivers/media/v4l2-core/v4l2-fh.c ++++ b/drivers/media/v4l2-core/v4l2-fh.c +@@ -104,6 +104,7 @@ int v4l2_fh_release(struct file *filp) + v4l2_fh_del(fh); + v4l2_fh_exit(fh); + kfree(fh); ++ filp->private_data = NULL; + } + return 0; + } +diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c +index b907865d4664d..2b9283d4fcb1e 100644 +--- a/drivers/memory/atmel-ebi.c ++++ b/drivers/memory/atmel-ebi.c +@@ -579,8 +579,10 @@ static int atmel_ebi_probe(struct platform_device *pdev) + child); + + ret = atmel_ebi_dev_disable(ebi, child); +- if (ret) ++ if (ret) { ++ of_node_put(child); + return ret; ++ } + } + } + +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index 1b182b117f9cf..38b945eb410f3 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev) + iounmap(ctrl->gregs); + + dev_set_drvdata(&dev->dev, NULL); +- kfree(ctrl); + + return 0; + } +@@ -221,7 +220,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + + dev_info(&dev->dev, "Freescale Integrated Flash Controller\n"); + +- fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL); ++ fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev), ++ GFP_KERNEL); + if (!fsl_ifc_ctrl_dev) + return -ENOMEM; + +@@ -231,8 +231,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0); + if (!fsl_ifc_ctrl_dev->gregs) { + dev_err(&dev->dev, "failed to get memory region\n"); +- ret = -ENODEV; +- goto err; ++ return -ENODEV; + } + + if (of_property_read_bool(dev->dev.of_node, "little-endian")) { +@@ -308,6 +307,7 @@ err_irq: + free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); + irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); + err: ++ iounmap(fsl_ifc_ctrl_dev->gregs); + return ret; + } + +diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c +index 578e881067a58..4094f97ec7dc7 100644 +--- a/drivers/mfd/da9052-i2c.c ++++ b/drivers/mfd/da9052-i2c.c +@@ -118,6 +118,7 @@ static const struct i2c_device_id da9052_i2c_id[] = { + {"da9053-bc", DA9053_BC}, + {} + }; ++MODULE_DEVICE_TABLE(i2c, da9052_i2c_id); + + #ifdef CONFIG_OF + static const struct of_device_id dialog_dt_ids[] = { +diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c +index 863c39a3353c9..d284df25c76ba 100644 +--- a/drivers/mfd/stmpe-i2c.c ++++ b/drivers/mfd/stmpe-i2c.c +@@ -109,7 +109,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = { + { "stmpe2403", STMPE2403 }, + { } + }; +-MODULE_DEVICE_TABLE(i2c, stmpe_id); ++MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id); + + static struct i2c_driver stmpe_i2c_driver = { + .driver = { +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 8a4659518c33b..5879ba82c7186 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1128,11 +1128,10 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev) + + device_for_each_child_node(dev, fwnode) { + ee_id = idt_ee_match_id(fwnode); +- if (!ee_id) { +- dev_warn(dev, "Skip unsupported EEPROM device"); +- continue; +- } else ++ if (ee_id) + break; ++ ++ dev_warn(dev, "Skip unsupported EEPROM device %pfw\n", fwnode); + } + + /* If there is no fwnode EEPROM device, then set zero size */ +@@ -1163,6 +1162,7 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev) + else /* if (!fwnode_property_read_bool(node, "read-only")) */ + pdev->eero = false; + ++ fwnode_handle_put(fwnode); + dev_info(dev, "EEPROM of %d bytes found by 0x%x", + pdev->eesize, pdev->eeaddr); + } +diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c +index e914b8c809433..9f8344169845c 100644 +--- a/drivers/misc/ibmasm/module.c ++++ b/drivers/misc/ibmasm/module.c +@@ -125,7 +125,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + result = ibmasm_init_remote_input_dev(sp); + if (result) { + dev_err(sp->dev, "Failed to initialize remote queue\n"); +- goto error_send_message; ++ goto error_init_remote; + } + + result = ibmasm_send_driver_vpd(sp); +@@ -145,8 +145,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + error_send_message: +- disable_sp_interrupts(sp->base_address); + ibmasm_free_remote_input_dev(sp); ++error_init_remote: ++ disable_sp_interrupts(sp->base_address); + free_irq(sp->irq, (void *)sp); + error_request_irq: + iounmap(sp->base_address); +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index c2c45c148ae76..7b2bb32e35554 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1054,6 +1054,12 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) + + switch (mq_rq->drv_op) { + case MMC_DRV_OP_IOCTL: ++ if (card->ext_csd.cmdq_en) { ++ ret = mmc_cmdq_disable(card); ++ if (ret) ++ break; ++ } ++ /* fallthrough */ + case MMC_DRV_OP_IOCTL_RPMB: + idata = mq_rq->drv_op_data; + for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) { +@@ -1064,6 +1070,8 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) + /* Always switch back to main area after RPMB access */ + if (rpmb_ioctl) + mmc_blk_part_switch(card, 0); ++ else if (card->reenable_cmdq && !card->ext_csd.cmdq_en) ++ mmc_cmdq_enable(card); + break; + case MMC_DRV_OP_BOOT_WP: + ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP, +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 798bcb65b4df4..e340791a8eab3 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -980,11 +980,14 @@ int mmc_execute_tuning(struct mmc_card *card) + + err = host->ops->execute_tuning(host, opcode); + +- if (err) ++ if (err) { + pr_err("%s: tuning execution failed: %d\n", + mmc_hostname(host), err); +- else ++ } else { ++ host->retune_now = 0; ++ host->need_retune = 0; + mmc_retune_enable(host); ++ } + + return err; + } +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index aa3de584b90cd..c179c4984e311 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -781,11 +781,13 @@ try_again: + return err; + + /* +- * In case CCS and S18A in the response is set, start Signal Voltage +- * Switch procedure. SPI mode doesn't support CMD11. ++ * In case the S18A bit is set in the response, let's start the signal ++ * voltage switch procedure. SPI mode doesn't support CMD11. ++ * Note that, according to the spec, the S18A bit is not valid unless ++ * the CCS bit is set as well. We deliberately deviate from the spec in ++ * regards to this, which allows UHS-I to be supported for SDSC cards. + */ +- if (!mmc_host_is_spi(host) && rocr && +- ((*rocr & 0x41000000) == 0x41000000)) { ++ if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) { + err = mmc_set_uhs_voltage(host, pocr); + if (err == -EAGAIN) { + retries--; +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 499a3d2a8e315..5cb7c2cc501af 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1371,6 +1371,10 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host) + u16 preset = 0; + + switch (host->timing) { ++ case MMC_TIMING_MMC_HS: ++ case MMC_TIMING_SD_HS: ++ preset = sdhci_readw(host, SDHCI_PRESET_FOR_HIGH_SPEED); ++ break; + case MMC_TIMING_UHS_SDR12: + preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12); + break; +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index c0372e3443fdf..2959fed39a385 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -252,6 +252,7 @@ + + /* 60-FB reserved */ + ++#define SDHCI_PRESET_FOR_HIGH_SPEED 0x64 + #define SDHCI_PRESET_FOR_SDR12 0x66 + #define SDHCI_PRESET_FOR_SDR25 0x68 + #define SDHCI_PRESET_FOR_SDR50 0x6A +diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c +index ef3aa8b520787..b88728b686e8a 100644 +--- a/drivers/mmc/host/usdhi6rol0.c ++++ b/drivers/mmc/host/usdhi6rol0.c +@@ -1809,6 +1809,7 @@ static int usdhi6_probe(struct platform_device *pdev) + + version = usdhi6_read(host, USDHI6_VERSION); + if ((version & 0xfff) != 0xa0d) { ++ ret = -EPERM; + dev_err(dev, "Version not recognized %x\n", version); + goto e_clk_off; + } +diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c +index 9fdb92729c28b..1b66466d2ed45 100644 +--- a/drivers/mmc/host/via-sdmmc.c ++++ b/drivers/mmc/host/via-sdmmc.c +@@ -865,6 +865,9 @@ static void via_sdc_data_isr(struct via_crdr_mmc_host *host, u16 intmask) + { + BUG_ON(intmask == 0); + ++ if (!host->data) ++ return; ++ + if (intmask & VIA_CRDR_SDSTS_DT) + host->data->error = -ETIMEDOUT; + else if (intmask & (VIA_CRDR_SDSTS_RC | VIA_CRDR_SDSTS_WC)) +diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c +index 1fe68137a30f2..a004f2ee15b1e 100644 +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -2289,7 +2289,7 @@ static int vub300_probe(struct usb_interface *interface, + if (retval < 0) + goto error5; + retval = +- usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0), ++ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_ROM_WAIT_STATES, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + firmware_rom_wait_states, 0x0000, NULL, 0, HZ); +diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c +index 00b1adcfad86d..07bd41dd43563 100644 +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -2880,8 +2880,10 @@ static int __maybe_unused marvell_nfc_resume(struct device *dev) + return ret; + + ret = clk_prepare_enable(nfc->reg_clk); +- if (ret < 0) ++ if (ret < 0) { ++ clk_disable_unprepare(nfc->core_clk); + return ret; ++ } + + /* + * Reset nfc->selected_chip so the next command will cause the timing +diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c +index 4bc5d522c74bb..2d73667ea259a 100644 +--- a/drivers/net/can/peak_canfd/peak_canfd.c ++++ b/drivers/net/can/peak_canfd/peak_canfd.c +@@ -346,8 +346,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv, + return err; + } + +- /* start network queue (echo_skb array is empty) */ +- netif_start_queue(ndev); ++ /* wake network queue up (echo_skb array is empty) */ ++ netif_wake_queue(ndev); + + return 0; + } +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index b7dfd4109d24e..16b96f978aae7 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -1065,7 +1065,6 @@ static void ems_usb_disconnect(struct usb_interface *intf) + + if (dev) { + unregister_netdev(dev->netdev); +- free_candev(dev->netdev); + + unlink_all_urbs(dev); + +@@ -1073,6 +1072,8 @@ static void ems_usb_disconnect(struct usb_interface *intf) + + kfree(dev->intr_in_buffer); + kfree(dev->tx_msg_buffer); ++ ++ free_candev(dev->netdev); + } + } + +diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c +index 4309be3724ad4..a20e95b39cf79 100644 +--- a/drivers/net/ethernet/aeroflex/greth.c ++++ b/drivers/net/ethernet/aeroflex/greth.c +@@ -1546,10 +1546,11 @@ static int greth_of_remove(struct platform_device *of_dev) + mdiobus_unregister(greth->mdio); + + unregister_netdev(ndev); +- free_netdev(ndev); + + of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0])); + ++ free_netdev(ndev); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index c3e824f5e50e8..1546a9bd9203c 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3750,3 +3750,4 @@ MODULE_AUTHOR("Broadcom Corporation"); + MODULE_DESCRIPTION("Broadcom GENET Ethernet controller driver"); + MODULE_ALIAS("platform:bcmgenet"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: mdio-bcm-unimac"); +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index a5049d637791d..494601c39b847 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -428,6 +428,10 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv) + int id, ret; + + pres = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!pres) { ++ dev_err(&pdev->dev, "Invalid resource\n"); ++ return -EINVAL; ++ } + memset(&res, 0, sizeof(res)); + memset(&ppd, 0, sizeof(ppd)); + +diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c +index 659f1ad37e96a..70ccbd11b9e7e 100644 +--- a/drivers/net/ethernet/ezchip/nps_enet.c ++++ b/drivers/net/ethernet/ezchip/nps_enet.c +@@ -623,7 +623,7 @@ static s32 nps_enet_probe(struct platform_device *pdev) + + /* Get IRQ number */ + priv->irq = platform_get_irq(pdev, 0); +- if (!priv->irq) { ++ if (priv->irq < 0) { + dev_err(dev, "failed to retrieve <irq Rx-Tx> value from device tree\n"); + err = -ENODEV; + goto out_netdev; +@@ -658,8 +658,8 @@ static s32 nps_enet_remove(struct platform_device *pdev) + struct nps_enet_priv *priv = netdev_priv(ndev); + + unregister_netdev(ndev); +- free_netdev(ndev); + netif_napi_del(&priv->napi); ++ free_netdev(ndev); + + return 0; + } +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 0f799e8e093cd..5a1fe49030b11 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -2636,10 +2636,8 @@ static int ehea_restart_qps(struct net_device *dev) + u16 dummy16 = 0; + + cb0 = (void *)get_zeroed_page(GFP_KERNEL); +- if (!cb0) { +- ret = -ENOMEM; +- goto out; +- } ++ if (!cb0) ++ return -ENOMEM; + + for (i = 0; i < (port->num_def_qps); i++) { + struct ehea_port_res *pr = &port->port_res[i]; +@@ -2659,6 +2657,7 @@ static int ehea_restart_qps(struct net_device *dev) + cb0); + if (hret != H_SUCCESS) { + netdev_err(dev, "query_ehea_qp failed (1)\n"); ++ ret = -EFAULT; + goto out; + } + +@@ -2671,6 +2670,7 @@ static int ehea_restart_qps(struct net_device *dev) + &dummy64, &dummy16, &dummy16); + if (hret != H_SUCCESS) { + netdev_err(dev, "modify_ehea_qp failed (1)\n"); ++ ret = -EFAULT; + goto out; + } + +@@ -2679,6 +2679,7 @@ static int ehea_restart_qps(struct net_device *dev) + cb0); + if (hret != H_SUCCESS) { + netdev_err(dev, "query_ehea_qp failed (2)\n"); ++ ret = -EFAULT; + goto out; + } + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 9f72cd3b1d244..4008007c2e340 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -698,8 +698,11 @@ static int init_tx_pools(struct net_device *netdev) + + adapter->tso_pool = kcalloc(tx_subcrqs, + sizeof(struct ibmvnic_tx_pool), GFP_KERNEL); +- if (!adapter->tso_pool) ++ if (!adapter->tso_pool) { ++ kfree(adapter->tx_pool); ++ adapter->tx_pool = NULL; + return -1; ++ } + + adapter->num_active_tx_pools = tx_subcrqs; + +@@ -1099,6 +1102,11 @@ static int __ibmvnic_open(struct net_device *netdev) + + netif_tx_start_all_queues(netdev); + ++ if (prev_state == VNIC_CLOSED) { ++ for (i = 0; i < adapter->req_rx_queues; i++) ++ napi_schedule(&adapter->napi[i]); ++ } ++ + adapter->state = VNIC_OPEN; + return rc; + } +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index 78b44d7876386..bf64fab383851 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -1398,7 +1398,7 @@ static int e100_phy_check_without_mii(struct nic *nic) + u8 phy_type; + int without_mii; + +- phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f; ++ phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f; + + switch (phy_type) { + case NoSuchPhy: /* Non-MII PHY; UNTESTED! */ +@@ -1518,7 +1518,7 @@ static int e100_phy_init(struct nic *nic) + mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr); + } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) && + (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) && +- (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) { ++ (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) { + /* enable/disable MDI/MDI-X auto-switching. */ + mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG, + nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH); +@@ -2264,9 +2264,9 @@ static int e100_asf(struct nic *nic) + { + /* ASF can be enabled from eeprom */ + return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) && +- (nic->eeprom[eeprom_config_asf] & eeprom_asf) && +- !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) && +- ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE); ++ (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) && ++ !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) && ++ ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE); + } + + static int e100_up(struct nic *nic) +@@ -2922,7 +2922,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* Wol magic packet can be enabled from eeprom */ + if ((nic->mac >= mac_82558_D101_A4) && +- (nic->eeprom[eeprom_id] & eeprom_id_wol)) { ++ (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) { + nic->flags |= wol_magic; + device_set_wakeup_enable(&pdev->dev, true); + } +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 9148d93c5c63c..4c7c1998f358d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -948,8 +948,7 @@ static int i40e_set_link_ksettings(struct net_device *netdev, + if (ethtool_link_ksettings_test_link_mode(&safe_ks, + supported, + Autoneg) && +- hw->phy.link_info.phy_type != +- I40E_PHY_TYPE_10GBASE_T) { ++ hw->phy.media_type != I40E_MEDIA_TYPE_BASET) { + netdev_info(netdev, "Autoneg cannot be disabled on this phy\n"); + err = -EINVAL; + goto done; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index fa0e7582159ff..1b101b526ed35 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7743,6 +7743,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi) + dev_driver_string(&pf->pdev->dev), + dev_name(&pf->pdev->dev)); + err = i40e_vsi_request_irq(vsi, int_name); ++ if (err) ++ goto err_setup_rx; + + } else { + err = -EINVAL; +diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h +index 5ca9d684429d1..8105f11f01990 100644 +--- a/drivers/net/ethernet/intel/ice/ice_type.h ++++ b/drivers/net/ethernet/intel/ice/ice_type.h +@@ -41,7 +41,7 @@ enum ice_aq_res_ids { + /* FW update timeout definitions are in milliseconds */ + #define ICE_NVM_TIMEOUT 180000 + #define ICE_CHANGE_LOCK_TIMEOUT 1000 +-#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000 ++#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 5000 + + enum ice_aq_res_access_type { + ICE_RES_READ = 1, +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index bc5cfe062b10e..52fdb200a0c79 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -5157,6 +5157,10 @@ static int mvpp2_probe(struct platform_device *pdev) + return PTR_ERR(priv->lms_base); + } else { + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) { ++ dev_err(&pdev->dev, "Invalid resource\n"); ++ return -EINVAL; ++ } + if (has_acpi_companion(&pdev->dev)) { + /* In case the MDIO memory region is declared in + * the ACPI, it can already appear as 'in-use' +@@ -5314,6 +5318,8 @@ static int mvpp2_probe(struct platform_device *pdev) + return 0; + + err_port_probe: ++ fwnode_handle_put(port_fwnode); ++ + i = 0; + fwnode_for_each_available_child_node(fwnode, port_fwnode) { + if (priv->port_list[i]) +diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c +index e3d7c74d47bb0..5282c5754ac17 100644 +--- a/drivers/net/ethernet/micrel/ks8842.c ++++ b/drivers/net/ethernet/micrel/ks8842.c +@@ -1150,6 +1150,10 @@ static int ks8842_probe(struct platform_device *pdev) + unsigned i; + + iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!iomem) { ++ dev_err(&pdev->dev, "Invalid resource\n"); ++ return -EINVAL; ++ } + if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME)) + goto err_mem_region; + +diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +index 3a4225837049a..5a45648e31245 100644 +--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c ++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +@@ -118,7 +118,7 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid) + { + u8 *data = skb->data; + unsigned int offset; +- u16 *hi, *id; ++ u16 hi, id; + u32 lo; + + if (ptp_classify_raw(skb) == PTP_CLASS_NONE) +@@ -129,14 +129,11 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid) + if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid)) + return 0; + +- hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID); +- id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID); ++ hi = get_unaligned_be16(data + offset + OFF_PTP_SOURCE_UUID + 0); ++ lo = get_unaligned_be32(data + offset + OFF_PTP_SOURCE_UUID + 2); ++ id = get_unaligned_be16(data + offset + OFF_PTP_SEQUENCE_ID); + +- memcpy(&lo, &hi[1], sizeof(lo)); +- +- return (uid_hi == *hi && +- uid_lo == lo && +- seqid == *id); ++ return (uid_hi == hi && uid_lo == lo && seqid == id); + } + + static void +@@ -146,7 +143,6 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb) + struct pci_dev *pdev; + u64 ns; + u32 hi, lo, val; +- u16 uid, seq; + + if (!adapter->hwts_rx_en) + return; +@@ -162,10 +158,7 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb) + lo = pch_src_uuid_lo_read(pdev); + hi = pch_src_uuid_hi_read(pdev); + +- uid = hi & 0xffff; +- seq = (hi >> 16) & 0xffff; +- +- if (!pch_ptp_match(skb, htons(uid), htonl(lo), htons(seq))) ++ if (!pch_ptp_match(skb, hi, lo, hi >> 16)) + goto out; + + ns = pch_rx_snap_read(pdev); +@@ -2546,9 +2539,13 @@ static int pch_gbe_probe(struct pci_dev *pdev, + adapter->pdev = pdev; + adapter->hw.back = adapter; + adapter->hw.reg = pcim_iomap_table(pdev)[PCH_GBE_PCI_BAR]; ++ + adapter->pdata = (struct pch_gbe_privdata *)pci_id->driver_data; +- if (adapter->pdata && adapter->pdata->platform_init) +- adapter->pdata->platform_init(pdev); ++ if (adapter->pdata && adapter->pdata->platform_init) { ++ ret = adapter->pdata->platform_init(pdev); ++ if (ret) ++ goto err_free_netdev; ++ } + + adapter->ptp_pdev = + pci_get_domain_bus_and_slot(pci_domain_nr(adapter->pdev->bus), +@@ -2643,7 +2640,7 @@ err_free_netdev: + */ + static int pch_gbe_minnow_platform_init(struct pci_dev *pdev) + { +- unsigned long flags = GPIOF_DIR_OUT | GPIOF_INIT_HIGH | GPIOF_EXPORT; ++ unsigned long flags = GPIOF_OUT_INIT_HIGH; + unsigned gpio = MINNOW_PHY_RESET_GPIO; + int ret; + +diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c +index 3d76fd1504c2b..f074986a13b1a 100644 +--- a/drivers/net/ethernet/sfc/ef10_sriov.c ++++ b/drivers/net/ethernet/sfc/ef10_sriov.c +@@ -406,12 +406,17 @@ fail1: + return rc; + } + ++/* Disable SRIOV and remove VFs ++ * If some VFs are attached to a guest (using Xen, only) nothing is ++ * done if force=false, and vports are freed if force=true (for the non ++ * attachedc ones, only) but SRIOV is not disabled and VFs are not ++ * removed in either case. ++ */ + static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + { + struct pci_dev *dev = efx->pci_dev; +- unsigned int vfs_assigned = 0; +- +- vfs_assigned = pci_vfs_assigned(dev); ++ unsigned int vfs_assigned = pci_vfs_assigned(dev); ++ int rc = 0; + + if (vfs_assigned && !force) { + netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; " +@@ -421,10 +426,12 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + + if (!vfs_assigned) + pci_disable_sriov(dev); ++ else ++ rc = -EBUSY; + + efx_ef10_sriov_free_vf_vswitching(efx); + efx->vf_count = 0; +- return 0; ++ return rc; + } + + int efx_ef10_sriov_configure(struct efx_nic *efx, int num_vfs) +@@ -443,7 +450,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx) + void efx_ef10_sriov_fini(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; +- unsigned int i; + int rc; + + if (!nic_data->vf) { +@@ -453,14 +459,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx) + return; + } + +- /* Remove any VFs in the host */ +- for (i = 0; i < efx->vf_count; ++i) { +- struct efx_nic *vf_efx = nic_data->vf[i].efx; +- +- if (vf_efx) +- vf_efx->pci_dev->driver->remove(vf_efx->pci_dev); +- } +- ++ /* Disable SRIOV and remove any VFs in the host */ + rc = efx_ef10_pci_sriov_disable(efx, true); + if (rc) + netif_dbg(efx, drv, efx->net_dev, +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 1979f8f8dac72..778d3729f460a 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -1277,6 +1277,10 @@ static int fjes_probe(struct platform_device *plat_dev) + adapter->interrupt_watch_enable = false; + + res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0); ++ if (!res) { ++ err = -EINVAL; ++ goto err_free_control_wq; ++ } + hw->hw_res.start = res->start; + hw->hw_res.size = resource_size(res); + hw->hw_res.irq = platform_get_irq(plat_dev, 0); +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index be1f1a86bcd61..06aadebc2d5ba 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -496,7 +496,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) + struct hwsim_edge *e; + u32 v0, v1; + +- if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] && ++ if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] || + !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) + return -EINVAL; + +@@ -734,6 +734,8 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy) + + return 0; + ++sub_fail: ++ hwsim_edge_unsubscribe_me(phy); + me_fail: + rcu_read_lock(); + list_for_each_entry_rcu(e, &phy->edges, list) { +@@ -741,8 +743,6 @@ me_fail: + hwsim_free_edge(e); + } + rcu_read_unlock(); +-sub_fail: +- hwsim_edge_unsubscribe_me(phy); + return -ENOMEM; + } + +@@ -843,12 +843,17 @@ err_pib: + static void hwsim_del(struct hwsim_phy *phy) + { + struct hwsim_pib *pib; ++ struct hwsim_edge *e; + + hwsim_edge_unsubscribe_me(phy); + + list_del(&phy->list); + + rcu_read_lock(); ++ list_for_each_entry_rcu(e, &phy->edges, list) { ++ list_del_rcu(&e->list); ++ hwsim_free_edge(e); ++ } + pib = rcu_dereference(phy->pib); + rcu_read_unlock(); + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 0b1c6a8906b99..5e8b406302861 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1506,6 +1506,8 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + struct virtnet_info *vi = sq->vq->vdev->priv; + unsigned int index = vq2txq(sq->vq); + struct netdev_queue *txq; ++ int opaque; ++ bool done; + + if (unlikely(is_xdp_raw_buffer_queue(vi, index))) { + /* We don't need to enable cb for XDP */ +@@ -1515,10 +1517,28 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + + txq = netdev_get_tx_queue(vi->dev, index); + __netif_tx_lock(txq, raw_smp_processor_id()); ++ virtqueue_disable_cb(sq->vq); + free_old_xmit_skbs(sq, true); ++ ++ opaque = virtqueue_enable_cb_prepare(sq->vq); ++ ++ done = napi_complete_done(napi, 0); ++ ++ if (!done) ++ virtqueue_disable_cb(sq->vq); ++ + __netif_tx_unlock(txq); + +- virtqueue_napi_complete(napi, sq->vq, 0); ++ if (done) { ++ if (unlikely(virtqueue_poll(sq->vq, opaque))) { ++ if (napi_schedule_prep(napi)) { ++ __netif_tx_lock(txq, raw_smp_processor_id()); ++ virtqueue_disable_cb(sq->vq); ++ __netif_tx_unlock(txq); ++ __napi_schedule(napi); ++ } ++ } ++ } + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) + netif_tx_wake_queue(txq); +@@ -1550,7 +1570,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) + if (virtio_net_hdr_from_skb(skb, &hdr->hdr, + virtio_is_little_endian(vi->vdev), false, + 0)) +- BUG(); ++ return -EPROTO; + + if (vi->mergeable_rx_bufs) + hdr->num_buffers = 0; +@@ -3199,8 +3219,11 @@ static __maybe_unused int virtnet_restore(struct virtio_device *vdev) + virtnet_set_queues(vi, vi->curr_queue_pairs); + + err = virtnet_cpu_notif_add(vi); +- if (err) ++ if (err) { ++ virtnet_freeze_down(vdev); ++ remove_vq_common(vi); + return err; ++ } + + return 0; + } +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 49e8c6d42cda4..eacc1e32d5478 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -1682,6 +1682,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) + struct neighbour *n; + struct nd_msg *msg; + ++ rcu_read_lock(); + in6_dev = __in6_dev_get(dev); + if (!in6_dev) + goto out; +@@ -1733,6 +1734,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) + } + + out: ++ rcu_read_unlock(); + consume_skb(skb); + return NETDEV_TX_OK; + } +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index f32d35e03708f..8102d684be594 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5125,6 +5125,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, + + if (arvif->nohwcrypt && + !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) { ++ ret = -EINVAL; + ath10k_warn(ar, "cryptmode module param needed for sw crypto\n"); + goto err; + } +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 3e92b88045a53..e929020d7c9cb 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -304,6 +304,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan) + hchan = ah->curchan; + } + ++ if (!hchan) { ++ fastcc = false; ++ hchan = ath9k_cmn_get_channel(sc->hw, ah, &sc->cur_chan->chandef); ++ } ++ + if (!ath_prepare_reset(sc)) + fastcc = false; + +diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig +index 2e34baeaf7649..2b782db20fde4 100644 +--- a/drivers/net/wireless/ath/carl9170/Kconfig ++++ b/drivers/net/wireless/ath/carl9170/Kconfig +@@ -15,13 +15,11 @@ config CARL9170 + + config CARL9170_LEDS + bool "SoftLED Support" +- depends on CARL9170 +- select MAC80211_LEDS +- select LEDS_CLASS +- select NEW_LEDS + default y ++ depends on CARL9170 ++ depends on MAC80211_LEDS + help +- This option is necessary, if you want your device' LEDs to blink ++ This option is necessary, if you want your device's LEDs to blink. + + Say Y, unless you need the LEDs for firmware debugging. + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 46ae4ec4ad47d..556ba3c6c5d8e 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -293,23 +293,16 @@ static int wcn36xx_start(struct ieee80211_hw *hw) + goto out_free_dxe_pool; + } + +- wcn->hal_buf = kmalloc(WCN36XX_HAL_BUF_SIZE, GFP_KERNEL); +- if (!wcn->hal_buf) { +- wcn36xx_err("Failed to allocate smd buf\n"); +- ret = -ENOMEM; +- goto out_free_dxe_ctl; +- } +- + ret = wcn36xx_smd_load_nv(wcn); + if (ret) { + wcn36xx_err("Failed to push NV to chip\n"); +- goto out_free_smd_buf; ++ goto out_free_dxe_ctl; + } + + ret = wcn36xx_smd_start(wcn); + if (ret) { + wcn36xx_err("Failed to start chip\n"); +- goto out_free_smd_buf; ++ goto out_free_dxe_ctl; + } + + if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) { +@@ -336,8 +329,6 @@ static int wcn36xx_start(struct ieee80211_hw *hw) + + out_smd_stop: + wcn36xx_smd_stop(wcn); +-out_free_smd_buf: +- kfree(wcn->hal_buf); + out_free_dxe_ctl: + wcn36xx_dxe_free_ctl_blks(wcn); + out_free_dxe_pool: +@@ -374,8 +365,6 @@ static void wcn36xx_stop(struct ieee80211_hw *hw) + + wcn36xx_dxe_free_mem_pools(wcn); + wcn36xx_dxe_free_ctl_blks(wcn); +- +- kfree(wcn->hal_buf); + } + + static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed) +@@ -1322,6 +1311,12 @@ static int wcn36xx_probe(struct platform_device *pdev) + mutex_init(&wcn->hal_mutex); + mutex_init(&wcn->scan_lock); + ++ wcn->hal_buf = devm_kmalloc(wcn->dev, WCN36XX_HAL_BUF_SIZE, GFP_KERNEL); ++ if (!wcn->hal_buf) { ++ ret = -ENOMEM; ++ goto out_wq; ++ } ++ + ret = dma_set_mask_and_coherent(wcn->dev, DMA_BIT_MASK(32)); + if (ret < 0) { + wcn36xx_err("failed to set DMA mask: %d\n", ret); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 96dc9e5ab23f4..75790b13c9621 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -2543,8 +2543,9 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + struct brcmf_sta_info_le sta_info_le; + u32 sta_flags; + u32 is_tdls_peer; +- s32 total_rssi; +- s32 count_rssi; ++ s32 total_rssi_avg = 0; ++ s32 total_rssi = 0; ++ s32 count_rssi = 0; + int rssi; + u32 i; + +@@ -2610,25 +2611,27 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES); + sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes); + } +- total_rssi = 0; +- count_rssi = 0; + for (i = 0; i < BRCMF_ANT_MAX; i++) { +- if (sta_info_le.rssi[i]) { +- sinfo->chain_signal_avg[count_rssi] = +- sta_info_le.rssi[i]; +- sinfo->chain_signal[count_rssi] = +- sta_info_le.rssi[i]; +- total_rssi += sta_info_le.rssi[i]; +- count_rssi++; +- } ++ if (sta_info_le.rssi[i] == 0 || ++ sta_info_le.rx_lastpkt_rssi[i] == 0) ++ continue; ++ sinfo->chains |= BIT(count_rssi); ++ sinfo->chain_signal[count_rssi] = ++ sta_info_le.rx_lastpkt_rssi[i]; ++ sinfo->chain_signal_avg[count_rssi] = ++ sta_info_le.rssi[i]; ++ total_rssi += sta_info_le.rx_lastpkt_rssi[i]; ++ total_rssi_avg += sta_info_le.rssi[i]; ++ count_rssi++; + } + if (count_rssi) { +- sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL); +- sinfo->chains = count_rssi; +- + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL); +- total_rssi /= count_rssi; +- sinfo->signal = total_rssi; ++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG); ++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL); ++ sinfo->filled |= ++ BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG); ++ sinfo->signal = total_rssi / count_rssi; ++ sinfo->signal_avg = total_rssi_avg / count_rssi; + } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED, + &ifp->vif->sme_state)) { + memset(&scb_val, 0, sizeof(scb_val)); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +index 6188275b17e5a..288d4d4d44548 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +@@ -1223,6 +1223,7 @@ static int brcms_bcma_probe(struct bcma_device *pdev) + { + struct brcms_info *wl; + struct ieee80211_hw *hw; ++ int ret; + + dev_info(&pdev->dev, "mfg %x core %x rev %d class %d irq %d\n", + pdev->id.manuf, pdev->id.id, pdev->id.rev, pdev->id.class, +@@ -1247,11 +1248,16 @@ static int brcms_bcma_probe(struct bcma_device *pdev) + wl = brcms_attach(pdev); + if (!wl) { + pr_err("%s: brcms_attach failed!\n", __func__); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_free_ieee80211; + } + brcms_led_register(wl); + + return 0; ++ ++err_free_ieee80211: ++ ieee80211_free_hw(hw); ++ return ret; + } + + static int brcms_suspend(struct bcma_device *pdev) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 2fad20c845b47..697a66acba9ce 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -3496,6 +3496,7 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw, + struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); + struct cfg80211_chan_def chandef; + struct iwl_mvm_phy_ctxt *phy_ctxt; ++ bool band_change_removal; + int ret, i; + + IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value, +@@ -3565,19 +3566,30 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw, + cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT); + + /* +- * Change the PHY context configuration as it is currently referenced +- * only by the P2P Device MAC ++ * Check if the remain-on-channel is on a different band and that ++ * requires context removal, see iwl_mvm_phy_ctxt_changed(). If ++ * so, we'll need to release and then re-configure here, since we ++ * must not remove a PHY context that's part of a binding. + */ +- if (mvmvif->phy_ctxt->ref == 1) { ++ band_change_removal = ++ fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT) && ++ mvmvif->phy_ctxt->channel->band != chandef.chan->band; ++ ++ if (mvmvif->phy_ctxt->ref == 1 && !band_change_removal) { ++ /* ++ * Change the PHY context configuration as it is currently ++ * referenced only by the P2P Device MAC (and we can modify it) ++ */ + ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt, + &chandef, 1, 1); + if (ret) + goto out_unlock; + } else { + /* +- * The PHY context is shared with other MACs. Need to remove the +- * P2P Device from the binding, allocate an new PHY context and +- * create a new binding ++ * The PHY context is shared with other MACs (or we're trying to ++ * switch bands), so remove the P2P Device from the binding, ++ * allocate an new PHY context and create a new binding. + */ + phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm); + if (!phy_ctxt) { +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +index a1cecf4a0e820..addf786fbcaf9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +@@ -63,7 +63,6 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, + struct iwl_prph_scratch *prph_scratch; + struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl; + struct iwl_prph_info *prph_info; +- void *iml_img; + u32 control_flags = 0; + int ret; + +@@ -157,14 +156,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, + trans_pcie->prph_scratch = prph_scratch; + + /* Allocate IML */ +- iml_img = dma_alloc_coherent(trans->dev, trans->iml_len, +- &trans_pcie->iml_dma_addr, GFP_KERNEL); +- if (!iml_img) { ++ trans_pcie->iml = dma_alloc_coherent(trans->dev, trans->iml_len, ++ &trans_pcie->iml_dma_addr, ++ GFP_KERNEL); ++ if (!trans_pcie->iml) { + ret = -ENOMEM; + goto err_free_ctxt_info; + } + +- memcpy(iml_img, trans->iml, trans->iml_len); ++ memcpy(trans_pcie->iml, trans->iml, trans->iml_len); + + iwl_enable_fw_load_int_ctx_info(trans); + +@@ -212,6 +212,11 @@ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans) + trans_pcie->ctxt_info_dma_addr = 0; + trans_pcie->ctxt_info_gen3 = NULL; + ++ dma_free_coherent(trans->dev, trans->iml_len, trans_pcie->iml, ++ trans_pcie->iml_dma_addr); ++ trans_pcie->iml_dma_addr = 0; ++ trans_pcie->iml = NULL; ++ + iwl_pcie_ctxt_info_free_fw_img(trans); + + dma_free_coherent(trans->dev, sizeof(*trans_pcie->prph_scratch), +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +index e9d67ba3e56dd..f581822b2a7df 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +@@ -447,6 +447,8 @@ struct iwl_self_init_dram { + * Context information addresses will be taken from here. + * This is driver's local copy for keeping track of size and + * count for allocating and freeing the memory. ++ * @iml: image loader image virtual address ++ * @iml_dma_addr: image loader image DMA address + * @trans: pointer to the generic transport area + * @scd_base_addr: scheduler sram base address in SRAM + * @scd_bc_tbls: pointer to the byte count table of the scheduler +@@ -492,6 +494,7 @@ struct iwl_trans_pcie { + }; + struct iwl_prph_info *prph_info; + struct iwl_prph_scratch *prph_scratch; ++ void *iml; + dma_addr_t ctxt_info_dma_addr; + dma_addr_t prph_info_dma_addr; + dma_addr_t prph_scratch_dma_addr; +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 5907b34037c24..2f0141c964e25 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1084,7 +1084,7 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter) + static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + { + struct pcie_service_card *card = adapter->card; +- u32 tmp; ++ u32 *cookie; + + card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32), + &card->sleep_cookie_pbase); +@@ -1093,13 +1093,11 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + "pci_alloc_consistent failed!\n"); + return -ENOMEM; + } ++ cookie = (u32 *)card->sleep_cookie_vbase; + /* Init val of Sleep Cookie */ +- tmp = FW_AWAKE_COOKIE; +- put_unaligned(tmp, card->sleep_cookie_vbase); ++ *cookie = FW_AWAKE_COOKIE; + +- mwifiex_dbg(adapter, INFO, +- "alloc_scook: sleep cookie=0x%x\n", +- get_unaligned(card->sleep_cookie_vbase)); ++ mwifiex_dbg(adapter, INFO, "alloc_scook: sleep cookie=0x%x\n", *cookie); + + return 0; + } +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 47c2bfe06d030..bd28deff9b8c6 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -861,15 +861,10 @@ struct rtl8192eu_efuse { + u8 usb_optional_function; + u8 res9[2]; + u8 mac_addr[ETH_ALEN]; /* 0xd7 */ +- u8 res10[2]; +- u8 vendor_name[7]; +- u8 res11[2]; +- u8 device_name[0x0b]; /* 0xe8 */ +- u8 res12[2]; +- u8 serial[0x0b]; /* 0xf5 */ +- u8 res13[0x30]; ++ u8 device_info[80]; ++ u8 res11[3]; + u8 unknown[0x0d]; /* 0x130 */ +- u8 res14[0xc3]; ++ u8 res12[0xc3]; + }; + + struct rtl8xxxu_reg8val { +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +index 380e86f9e00be..837a1b9d189df 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +@@ -562,9 +562,43 @@ rtl8192e_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40) + } + } + ++static void rtl8192eu_log_next_device_info(struct rtl8xxxu_priv *priv, ++ char *record_name, ++ char *device_info, ++ unsigned int *record_offset) ++{ ++ char *record = device_info + *record_offset; ++ ++ /* A record is [ total length | 0x03 | value ] */ ++ unsigned char l = record[0]; ++ ++ /* ++ * The whole device info section seems to be 80 characters, make sure ++ * we don't read further. ++ */ ++ if (*record_offset + l > 80) { ++ dev_warn(&priv->udev->dev, ++ "invalid record length %d while parsing \"%s\" at offset %u.\n", ++ l, record_name, *record_offset); ++ return; ++ } ++ ++ if (l >= 2) { ++ char value[80]; ++ ++ memcpy(value, &record[2], l - 2); ++ value[l - 2] = '\0'; ++ dev_info(&priv->udev->dev, "%s: %s\n", record_name, value); ++ *record_offset = *record_offset + l; ++ } else { ++ dev_info(&priv->udev->dev, "%s not available.\n", record_name); ++ } ++} ++ + static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) + { + struct rtl8192eu_efuse *efuse = &priv->efuse_wifi.efuse8192eu; ++ unsigned int record_offset; + int i; + + if (efuse->rtl_id != cpu_to_le16(0x8129)) +@@ -612,12 +646,25 @@ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) + priv->has_xtalk = 1; + priv->xtalk = priv->efuse_wifi.efuse8192eu.xtal_k & 0x3f; + +- dev_info(&priv->udev->dev, "Vendor: %.7s\n", efuse->vendor_name); +- dev_info(&priv->udev->dev, "Product: %.11s\n", efuse->device_name); +- if (memchr_inv(efuse->serial, 0xff, 11)) +- dev_info(&priv->udev->dev, "Serial: %.11s\n", efuse->serial); +- else +- dev_info(&priv->udev->dev, "Serial not available.\n"); ++ /* ++ * device_info section seems to be laid out as records ++ * [ total length | 0x03 | value ] so: ++ * - vendor length + 2 ++ * - 0x03 ++ * - vendor string (not null terminated) ++ * - product length + 2 ++ * - 0x03 ++ * - product string (not null terminated) ++ * Then there is one or 2 0x00 on all the 4 devices I own or found ++ * dumped online. ++ * As previous version of the code handled an optional serial ++ * string, I now assume there may be a third record if the ++ * length is not 0. ++ */ ++ record_offset = 0; ++ rtl8192eu_log_next_device_info(priv, "Vendor", efuse->device_info, &record_offset); ++ rtl8192eu_log_next_device_info(priv, "Product", efuse->device_info, &record_offset); ++ rtl8192eu_log_next_device_info(priv, "Serial", efuse->device_info, &record_offset); + + if (rtl8xxxu_debug & RTL8XXXU_DEBUG_EFUSE) { + unsigned char *raw = priv->efuse_wifi.raw; +diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c +index 0da95777f1c15..c0301cd10209c 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -193,7 +193,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb) + wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE); + + if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) && +- (common->secinfo.security_enable)) { ++ info->control.hw_key) { + if (rsi_is_cipher_wep(common)) + ieee80211_size += 4; + else +@@ -464,9 +464,9 @@ int rsi_prepare_beacon(struct rsi_common *common, struct sk_buff *skb) + } + + if (common->band == NL80211_BAND_2GHZ) +- bcn_frm->bbp_info |= cpu_to_le16(RSI_RATE_1); ++ bcn_frm->rate_info |= cpu_to_le16(RSI_RATE_1); + else +- bcn_frm->bbp_info |= cpu_to_le16(RSI_RATE_6); ++ bcn_frm->rate_info |= cpu_to_le16(RSI_RATE_6); + + if (mac_bcn->data[tim_offset + 2] == 0) + bcn_frm->frame_info |= cpu_to_le16(RSI_DATA_DESC_DTIM_BEACON); +diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c +index be59d66585d6d..bf52091b79182 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c +@@ -959,7 +959,6 @@ static int rsi_mac80211_set_key(struct ieee80211_hw *hw, + mutex_lock(&common->mutex); + switch (cmd) { + case SET_KEY: +- secinfo->security_enable = true; + status = rsi_hal_key_config(hw, vif, key, sta); + if (status) { + mutex_unlock(&common->mutex); +@@ -978,8 +977,6 @@ static int rsi_mac80211_set_key(struct ieee80211_hw *hw, + break; + + case DISABLE_KEY: +- if (vif->type == NL80211_IFTYPE_STATION) +- secinfo->security_enable = false; + rsi_dbg(ERR_ZONE, "%s: RSI del key\n", __func__); + memset(key, 0, sizeof(struct ieee80211_key_conf)); + status = rsi_hal_key_config(hw, vif, key, sta); +diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +index 1a3a5235cfb8d..934550a66732c 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +@@ -1615,8 +1615,7 @@ int rsi_send_wowlan_request(struct rsi_common *common, u16 flags, + RSI_WIFI_MGMT_Q); + cmd_frame->desc.desc_dword0.frame_type = WOWLAN_CONFIG_PARAMS; + cmd_frame->host_sleep_status = sleep_status; +- if (common->secinfo.security_enable && +- common->secinfo.gtk_cipher) ++ if (common->secinfo.gtk_cipher) + flags |= RSI_WOW_GTK_REKEY; + if (sleep_status) + cmd_frame->wow_flags = flags; +diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h +index a084f224bb030..a245559abe7c8 100644 +--- a/drivers/net/wireless/rsi/rsi_main.h ++++ b/drivers/net/wireless/rsi/rsi_main.h +@@ -147,7 +147,6 @@ enum edca_queue { + }; + + struct security_info { +- bool security_enable; + u32 ptk_cipher; + u32 gtk_cipher; + }; +diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c +index 1037ec62659d7..ee86436bf152e 100644 +--- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c ++++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c +@@ -63,6 +63,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = { + { SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) }, + { /* end: all zeroes */ }, + }; ++MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids); + + /* hwbus_ops implemetation */ + +diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c +index 9547aea01b0fb..ea0215246c5c8 100644 +--- a/drivers/net/wireless/ti/wl1251/cmd.c ++++ b/drivers/net/wireless/ti/wl1251/cmd.c +@@ -466,9 +466,12 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len, + cmd->channels[i].channel = channels[i]->hw_value; + } + +- cmd->params.ssid_len = ssid_len; +- if (ssid) +- memcpy(cmd->params.ssid, ssid, ssid_len); ++ if (ssid) { ++ int len = clamp_val(ssid_len, 0, IEEE80211_MAX_SSID_LEN); ++ ++ cmd->params.ssid_len = len; ++ memcpy(cmd->params.ssid, ssid, len); ++ } + + ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd)); + if (ret < 0) { +diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c +index e10fff42751ef..b88c413f96aca 100644 +--- a/drivers/net/wireless/ti/wl12xx/main.c ++++ b/drivers/net/wireless/ti/wl12xx/main.c +@@ -1517,6 +1517,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl) + u32 mac1, mac2; + int ret; + ++ /* Device may be in ELP from the bootloader or kexec */ ++ ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL); ++ if (ret < 0) ++ goto out; ++ ++ usleep_range(500000, 700000); ++ + ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]); + if (ret < 0) + goto out; +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 800ad252cf9c6..1eb6af6439ad6 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -576,11 +576,11 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, + + if (size && + early_init_dt_reserve_memory_arch(base, size, nomap) == 0) +- pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + else +- pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + + len -= t_len; + if (first) { +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index 19f95552da4d8..ff230ee2423fb 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -154,9 +154,9 @@ static int __init __reserved_mem_alloc_size(unsigned long node, + ret = early_init_dt_alloc_reserved_memory_arch(size, + align, start, end, nomap, &base); + if (ret == 0) { +- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n", ++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n", + uname, &base, +- (unsigned long)size / SZ_1M); ++ (unsigned long)(size / SZ_1M)); + break; + } + len -= t_len; +@@ -166,8 +166,8 @@ static int __init __reserved_mem_alloc_size(unsigned long node, + ret = early_init_dt_alloc_reserved_memory_arch(size, align, + 0, 0, nomap, &base); + if (ret == 0) +- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + } + + if (base == 0) { +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 0235b6e7dcd13..74aa9da85aa26 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -54,7 +54,7 @@ + #define PIO_COMPLETION_STATUS_UR 1 + #define PIO_COMPLETION_STATUS_CRS 2 + #define PIO_COMPLETION_STATUS_CA 4 +-#define PIO_NON_POSTED_REQ BIT(0) ++#define PIO_NON_POSTED_REQ BIT(10) + #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8) + #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc) + #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10) +@@ -166,7 +166,8 @@ + (PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn)) | \ + PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where)) + +-#define PIO_TIMEOUT_MS 1 ++#define PIO_RETRY_CNT 500 ++#define PIO_RETRY_DELAY 2 /* 2 us*/ + + #define LINK_WAIT_MAX_RETRIES 10 + #define LINK_WAIT_USLEEP_MIN 90000 +@@ -369,20 +370,19 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) + static int advk_pcie_wait_pio(struct advk_pcie *pcie) + { + struct device *dev = &pcie->pdev->dev; +- unsigned long timeout; ++ int i; + +- timeout = jiffies + msecs_to_jiffies(PIO_TIMEOUT_MS); +- +- while (time_before(jiffies, timeout)) { ++ for (i = 0; i < PIO_RETRY_CNT; i++) { + u32 start, isr; + + start = advk_readl(pcie, PIO_START); + isr = advk_readl(pcie, PIO_ISR); + if (!start && isr) + return 0; ++ udelay(PIO_RETRY_DELAY); + } + +- dev_err(dev, "config read/write timed out\n"); ++ dev_err(dev, "PIO read/write transfer time out\n"); + return -ETIMEDOUT; + } + +@@ -395,6 +395,35 @@ static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus, + return true; + } + ++static bool advk_pcie_pio_is_running(struct advk_pcie *pcie) ++{ ++ struct device *dev = &pcie->pdev->dev; ++ ++ /* ++ * Trying to start a new PIO transfer when previous has not completed ++ * cause External Abort on CPU which results in kernel panic: ++ * ++ * SError Interrupt on CPU0, code 0xbf000002 -- SError ++ * Kernel panic - not syncing: Asynchronous SError Interrupt ++ * ++ * Functions advk_pcie_rd_conf() and advk_pcie_wr_conf() are protected ++ * by raw_spin_lock_irqsave() at pci_lock_config() level to prevent ++ * concurrent calls at the same time. But because PIO transfer may take ++ * about 1.5s when link is down or card is disconnected, it means that ++ * advk_pcie_wait_pio() does not always have to wait for completion. ++ * ++ * Some versions of ARM Trusted Firmware handles this External Abort at ++ * EL3 level and mask it to prevent kernel panic. Relevant TF-A commit: ++ * https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50 ++ */ ++ if (advk_readl(pcie, PIO_START)) { ++ dev_err(dev, "Previous PIO read/write transfer is still running\n"); ++ return true; ++ } ++ ++ return false; ++} ++ + static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + int where, int size, u32 *val) + { +@@ -407,9 +436,10 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + return PCIBIOS_DEVICE_NOT_FOUND; + } + +- /* Start PIO */ +- advk_writel(pcie, 0, PIO_START); +- advk_writel(pcie, 1, PIO_ISR); ++ if (advk_pcie_pio_is_running(pcie)) { ++ *val = 0xffffffff; ++ return PCIBIOS_SET_FAILED; ++ } + + /* Program the control register */ + reg = advk_readl(pcie, PIO_CTRL); +@@ -428,7 +458,8 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + /* Program the data strobe */ + advk_writel(pcie, 0xf, PIO_WR_DATA_STRB); + +- /* Start the transfer */ ++ /* Clear PIO DONE ISR and start the transfer */ ++ advk_writel(pcie, 1, PIO_ISR); + advk_writel(pcie, 1, PIO_START); + + ret = advk_pcie_wait_pio(pcie); +@@ -462,9 +493,8 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, + if (where % size) + return PCIBIOS_SET_FAILED; + +- /* Start PIO */ +- advk_writel(pcie, 0, PIO_START); +- advk_writel(pcie, 1, PIO_ISR); ++ if (advk_pcie_pio_is_running(pcie)) ++ return PCIBIOS_SET_FAILED; + + /* Program the control register */ + reg = advk_readl(pcie, PIO_CTRL); +@@ -491,7 +521,8 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, + /* Program the data strobe */ + advk_writel(pcie, data_strobe, PIO_WR_DATA_STRB); + +- /* Start the transfer */ ++ /* Clear PIO DONE ISR and start the transfer */ ++ advk_writel(pcie, 1, PIO_ISR); + advk_writel(pcie, 1, PIO_START); + + ret = advk_pcie_wait_pio(pcie); +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 097c02197ec8f..1f8dd5ca02a91 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -2245,6 +2245,7 @@ static const struct of_device_id tegra_pcie_of_match[] = { + { .compatible = "nvidia,tegra20-pcie", .data = &tegra20_pcie }, + { }, + }; ++MODULE_DEVICE_TABLE(of, tegra_pcie_of_match); + + static void *tegra_pcie_ports_seq_start(struct seq_file *s, loff_t *pos) + { +diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c +index dc953c73cb56a..dc4d5a5907959 100644 +--- a/drivers/pci/controller/pcie-iproc-msi.c ++++ b/drivers/pci/controller/pcie-iproc-msi.c +@@ -171,7 +171,7 @@ static struct irq_chip iproc_msi_irq_chip = { + + static struct msi_domain_info iproc_msi_domain_info = { + .flags = MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS | +- MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX, ++ MSI_FLAG_PCI_MSIX, + .chip = &iproc_msi_irq_chip, + }; + +@@ -250,20 +250,23 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain, + struct iproc_msi *msi = domain->host_data; + int hwirq, i; + ++ if (msi->nr_cpus > 1 && nr_irqs > 1) ++ return -EINVAL; ++ + mutex_lock(&msi->bitmap_lock); + +- /* Allocate 'nr_cpus' number of MSI vectors each time */ +- hwirq = bitmap_find_next_zero_area(msi->bitmap, msi->nr_msi_vecs, 0, +- msi->nr_cpus, 0); +- if (hwirq < msi->nr_msi_vecs) { +- bitmap_set(msi->bitmap, hwirq, msi->nr_cpus); +- } else { +- mutex_unlock(&msi->bitmap_lock); +- return -ENOSPC; +- } ++ /* ++ * Allocate 'nr_irqs' multiplied by 'nr_cpus' number of MSI vectors ++ * each time ++ */ ++ hwirq = bitmap_find_free_region(msi->bitmap, msi->nr_msi_vecs, ++ order_base_2(msi->nr_cpus * nr_irqs)); + + mutex_unlock(&msi->bitmap_lock); + ++ if (hwirq < 0) ++ return -ENOSPC; ++ + for (i = 0; i < nr_irqs; i++) { + irq_domain_set_info(domain, virq + i, hwirq + i, + &iproc_msi_bottom_irq_chip, +@@ -284,7 +287,8 @@ static void iproc_msi_irq_domain_free(struct irq_domain *domain, + mutex_lock(&msi->bitmap_lock); + + hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq); +- bitmap_clear(msi->bitmap, hwirq, msi->nr_cpus); ++ bitmap_release_region(msi->bitmap, hwirq, ++ order_base_2(msi->nr_cpus * nr_irqs)); + + mutex_unlock(&msi->bitmap_lock); + +@@ -538,6 +542,9 @@ int iproc_msi_init(struct iproc_pcie *pcie, struct device_node *node) + mutex_init(&msi->bitmap_lock); + msi->nr_cpus = num_possible_cpus(); + ++ if (msi->nr_cpus == 1) ++ iproc_msi_domain_info.flags |= MSI_FLAG_MULTI_PCI_MSI; ++ + msi->nr_irqs = of_irq_count(node); + if (!msi->nr_irqs) { + dev_err(pcie->dev, "found no MSI GIC interrupt\n"); +diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c +index a5910f9428576..9fb4ef568f405 100644 +--- a/drivers/pci/pci-label.c ++++ b/drivers/pci/pci-label.c +@@ -162,7 +162,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf) + len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer, + obj->buffer.length, + UTF16_LITTLE_ENDIAN, +- buf, PAGE_SIZE); ++ buf, PAGE_SIZE - 1); + buf[len] = '\n'; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 576b5bb6b95f2..bfb22de693eb4 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -28,6 +28,7 @@ + #include <linux/nvme.h> + #include <linux/platform_data/x86/apple.h> + #include <linux/pm_runtime.h> ++#include <linux/suspend.h> + #include <linux/switchtec.h> + #include <asm/dma.h> /* isa_dma_bridge_buggy */ + #include "pci.h" +@@ -3573,6 +3574,16 @@ static void quirk_apple_poweroff_thunderbolt(struct pci_dev *dev) + return; + if (pci_pcie_type(dev) != PCI_EXP_TYPE_UPSTREAM) + return; ++ ++ /* ++ * SXIO/SXFP/SXLF turns off power to the Thunderbolt controller. ++ * We don't know how to turn it back on again, but firmware does, ++ * so we can only use SXIO/SXFP/SXLF if we're suspending via ++ * firmware. ++ */ ++ if (!pm_suspend_via_firmware()) ++ return; ++ + bridge = ACPI_HANDLE(&dev->dev); + if (!bridge) + return; +diff --git a/drivers/phy/ti/phy-dm816x-usb.c b/drivers/phy/ti/phy-dm816x-usb.c +index cbcce7cf0028e..2ed5fe20d7792 100644 +--- a/drivers/phy/ti/phy-dm816x-usb.c ++++ b/drivers/phy/ti/phy-dm816x-usb.c +@@ -246,19 +246,28 @@ static int dm816x_usb_phy_probe(struct platform_device *pdev) + + pm_runtime_enable(phy->dev); + generic_phy = devm_phy_create(phy->dev, NULL, &ops); +- if (IS_ERR(generic_phy)) +- return PTR_ERR(generic_phy); ++ if (IS_ERR(generic_phy)) { ++ error = PTR_ERR(generic_phy); ++ goto clk_unprepare; ++ } + + phy_set_drvdata(generic_phy, phy); + + phy_provider = devm_of_phy_provider_register(phy->dev, + of_phy_simple_xlate); +- if (IS_ERR(phy_provider)) +- return PTR_ERR(phy_provider); ++ if (IS_ERR(phy_provider)) { ++ error = PTR_ERR(phy_provider); ++ goto clk_unprepare; ++ } + + usb_add_phy_dev(&phy->phy); + + return 0; ++ ++clk_unprepare: ++ pm_runtime_disable(phy->dev); ++ clk_unprepare(phy->refclk); ++ return error; + } + + static int dm816x_usb_phy_remove(struct platform_device *pdev) +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index d9b9c11c7f8f2..8d2dbf607bd15 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -966,6 +966,7 @@ static int amd_gpio_remove(struct platform_device *pdev) + static const struct acpi_device_id amd_gpio_acpi_match[] = { + { "AMD0030", 0 }, + { "AMDI0030", 0}, ++ { "AMDI0031", 0}, + { }, + }; + MODULE_DEVICE_TABLE(acpi, amd_gpio_acpi_match); +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 5b5a4323ae63d..76d8a6099c7b1 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -458,6 +458,11 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) + if (mcp_read(mcp, MCP_INTF, &intf)) + goto unlock; + ++ if (intf == 0) { ++ /* There is no interrupt pending */ ++ goto unlock; ++ } ++ + if (mcp_read(mcp, MCP_INTCAP, &intcap)) + goto unlock; + +@@ -475,11 +480,6 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) + mcp->cached_gpio = gpio; + mutex_unlock(&mcp->lock); + +- if (intf == 0) { +- /* There is no interrupt pending */ +- return IRQ_HANDLED; +- } +- + dev_dbg(mcp->chip.parent, + "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n", + intcap, intf, gpio_orig, gpio); +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index 8c3e9bac4754c..bed2fd56a6d09 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -2853,6 +2853,7 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev) + + if (!dev->info_supported && !dev->system_event_supported) { + pr_warn("No hotkey query interface found\n"); ++ error = -EINVAL; + goto err_remove_filter; + } + +diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c +index 38206c39b3bff..5f2fa9c0f526f 100644 +--- a/drivers/power/reset/gpio-poweroff.c ++++ b/drivers/power/reset/gpio-poweroff.c +@@ -88,6 +88,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = { + { .compatible = "gpio-poweroff", }, + {}, + }; ++MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match); + + static struct platform_driver gpio_poweroff_driver = { + .probe = gpio_poweroff_probe, +diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig +index 76c699b5abdac..1d656aa2c6d64 100644 +--- a/drivers/power/supply/Kconfig ++++ b/drivers/power/supply/Kconfig +@@ -621,7 +621,8 @@ config BATTERY_GOLDFISH + + config BATTERY_RT5033 + tristate "RT5033 fuel gauge support" +- depends on MFD_RT5033 ++ depends on I2C ++ select REGMAP_I2C + help + This adds support for battery fuel gauge in Richtek RT5033 PMIC. + The fuelgauge calculates and determines the battery state of charge +diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c +index 708fd58cd62b2..0fd24577112eb 100644 +--- a/drivers/power/supply/ab8500_btemp.c ++++ b/drivers/power/supply/ab8500_btemp.c +@@ -1120,6 +1120,7 @@ static const struct of_device_id ab8500_btemp_match[] = { + { .compatible = "stericsson,ab8500-btemp", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_btemp_match); + + static struct platform_driver ab8500_btemp_driver = { + .probe = ab8500_btemp_probe, +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 98b335042ba6b..0f379fa3385e6 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -407,6 +407,14 @@ disable_otp: + static void ab8500_power_supply_changed(struct ab8500_charger *di, + struct power_supply *psy) + { ++ /* ++ * This happens if we get notifications or interrupts and ++ * the platform has been configured not to support one or ++ * other type of charging. ++ */ ++ if (!psy) ++ return; ++ + if (di->autopower_cfg) { + if (!di->usb.charger_connected && + !di->ac.charger_connected && +@@ -433,7 +441,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di, + if (!connected) + di->flags.vbus_drop_end = false; + +- sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present"); ++ /* ++ * Sometimes the platform is configured not to support ++ * USB charging and no psy has been created, but we still ++ * will get these notifications. ++ */ ++ if (di->usb_chg.psy) { ++ sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, ++ "present"); ++ } + + if (connected) { + mutex_lock(&di->charger_attached_mutex); +@@ -3623,6 +3639,7 @@ static const struct of_device_id ab8500_charger_match[] = { + { .compatible = "stericsson,ab8500-charger", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_charger_match); + + static struct platform_driver ab8500_charger_driver = { + .probe = ab8500_charger_probe, +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 8bb89c697c1eb..b0e77324b0167 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -3221,6 +3221,7 @@ static const struct of_device_id ab8500_fg_match[] = { + { .compatible = "stericsson,ab8500-fg", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_fg_match); + + static struct platform_driver ab8500_fg_driver = { + .probe = ab8500_fg_probe, +diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c +index 7ae983e37f648..eec79db9b750e 100644 +--- a/drivers/power/supply/charger-manager.c ++++ b/drivers/power/supply/charger-manager.c +@@ -1484,6 +1484,7 @@ static const struct of_device_id charger_manager_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, charger_manager_match); + + static struct charger_desc *of_cm_parse_desc(struct device *dev) + { +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index 1a568df383db8..00a3a581e0795 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -1083,7 +1083,7 @@ static int max17042_probe(struct i2c_client *client, + } + + if (client->irq) { +- unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT; ++ unsigned int flags = IRQF_ONESHOT; + + /* + * On ACPI systems the IRQ may be handled by ACPI-event code, +diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c +index bcdd830484929..9310b85f3405e 100644 +--- a/drivers/power/supply/rt5033_battery.c ++++ b/drivers/power/supply/rt5033_battery.c +@@ -167,9 +167,16 @@ static const struct i2c_device_id rt5033_battery_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, rt5033_battery_id); + ++static const struct of_device_id rt5033_battery_of_match[] = { ++ { .compatible = "richtek,rt5033-battery", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, rt5033_battery_of_match); ++ + static struct i2c_driver rt5033_battery_driver = { + .driver = { + .name = "rt5033-battery", ++ .of_match_table = rt5033_battery_of_match, + }, + .probe = rt5033_battery_probe, + .remove = rt5033_battery_remove, +diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c +index 6c6b44fd3f438..2d11ac277de8d 100644 +--- a/drivers/pwm/pwm-spear.c ++++ b/drivers/pwm/pwm-spear.c +@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev) + static int spear_pwm_remove(struct platform_device *pdev) + { + struct spear_pwm_chip *pc = platform_get_drvdata(pdev); +- int i; +- +- for (i = 0; i < NUM_PWM; i++) +- pwm_disable(&pc->chip.pwms[i]); + + /* clk was prepared in probe, hence unprepare it here */ + clk_unprepare(pc->clk); +diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c +index f8ebbece57b71..6be14e0f1dc34 100644 +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -245,7 +245,6 @@ static int tegra_pwm_probe(struct platform_device *pdev) + static int tegra_pwm_remove(struct platform_device *pdev) + { + struct tegra_pwm_chip *pc = platform_get_drvdata(pdev); +- unsigned int i; + int err; + + if (WARN_ON(!pc)) +@@ -255,18 +254,6 @@ static int tegra_pwm_remove(struct platform_device *pdev) + if (err < 0) + return err; + +- for (i = 0; i < pc->chip.npwm; i++) { +- struct pwm_device *pwm = &pc->chip.pwms[i]; +- +- if (!pwm_is_enabled(pwm)) +- if (clk_prepare_enable(pc->clk) < 0) +- continue; +- +- pwm_writel(pc, i, 0); +- +- clk_disable_unprepare(pc->clk); +- } +- + reset_control_assert(pc->rst); + clk_disable_unprepare(pc->clk); + +diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c +index 9ececfef42d67..bd91c95f73e0e 100644 +--- a/drivers/regulator/da9052-regulator.c ++++ b/drivers/regulator/da9052-regulator.c +@@ -258,7 +258,8 @@ static int da9052_regulator_set_voltage_time_sel(struct regulator_dev *rdev, + case DA9052_ID_BUCK3: + case DA9052_ID_LDO2: + case DA9052_ID_LDO3: +- ret = (new_sel - old_sel) * info->step_uV / 6250; ++ ret = DIV_ROUND_UP(abs(new_sel - old_sel) * info->step_uV, ++ 6250); + break; + } + +diff --git a/drivers/regulator/uniphier-regulator.c b/drivers/regulator/uniphier-regulator.c +index abf22acbd13e6..a2e3654b63320 100644 +--- a/drivers/regulator/uniphier-regulator.c ++++ b/drivers/regulator/uniphier-regulator.c +@@ -197,6 +197,7 @@ static const struct of_device_id uniphier_regulator_match[] = { + }, + { /* Sentinel */ }, + }; ++MODULE_DEVICE_TABLE(of, uniphier_regulator_match); + + static struct platform_driver uniphier_regulator_driver = { + .probe = uniphier_regulator_probe, +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index f7bf20493f23e..ccb97f4e31c38 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -428,7 +428,10 @@ static struct reset_control *__reset_control_get_internal( + if (!rstc) + return ERR_PTR(-ENOMEM); + +- try_module_get(rcdev->owner); ++ if (!try_module_get(rcdev->owner)) { ++ kfree(rstc); ++ return ERR_PTR(-ENODEV); ++ } + + rstc->rcdev = rcdev; + list_add(&rstc->list, &rcdev->reset_control_head); +diff --git a/drivers/reset/reset-a10sr.c b/drivers/reset/reset-a10sr.c +index 37496bd27fa2e..306fba5b35193 100644 +--- a/drivers/reset/reset-a10sr.c ++++ b/drivers/reset/reset-a10sr.c +@@ -129,6 +129,7 @@ static struct platform_driver a10sr_reset_driver = { + .probe = a10sr_reset_probe, + .driver = { + .name = "altr_a10sr_reset", ++ .of_match_table = a10sr_reset_of_match, + }, + }; + module_platform_driver(a10sr_reset_driver); +diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c +index a9dd9218fae21..b8c5b93102ce9 100644 +--- a/drivers/rtc/rtc-proc.c ++++ b/drivers/rtc/rtc-proc.c +@@ -26,8 +26,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc) + int size; + char name[NAME_SIZE]; + +- size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id); +- if (size > NAME_SIZE) ++ size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id); ++ if (size >= NAME_SIZE) + return false; + + return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE); +diff --git a/drivers/rtc/rtc-stm32.c b/drivers/rtc/rtc-stm32.c +index 8e6c9b3bcc29a..04bffc913ba1b 100644 +--- a/drivers/rtc/rtc-stm32.c ++++ b/drivers/rtc/rtc-stm32.c +@@ -760,7 +760,7 @@ static int stm32_rtc_probe(struct platform_device *pdev) + + ret = clk_prepare_enable(rtc->rtc_ck); + if (ret) +- goto err; ++ goto err_no_rtc_ck; + + if (rtc->data->need_dbp) + regmap_update_bits(rtc->dbp, rtc->dbp_reg, +@@ -837,10 +837,12 @@ static int stm32_rtc_probe(struct platform_device *pdev) + } + + return 0; ++ + err: ++ clk_disable_unprepare(rtc->rtc_ck); ++err_no_rtc_ck: + if (rtc->data->has_pclk) + clk_disable_unprepare(rtc->pclk); +- clk_disable_unprepare(rtc->rtc_ck); + + if (rtc->data->need_dbp) + regmap_update_bits(rtc->dbp, rtc->dbp_reg, rtc->dbp_mask, 0); +diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c +index 3f9a6ef650fac..3c2ed6d013873 100644 +--- a/drivers/s390/char/sclp_vt220.c ++++ b/drivers/s390/char/sclp_vt220.c +@@ -35,8 +35,8 @@ + #define SCLP_VT220_MINOR 65 + #define SCLP_VT220_DRIVER_NAME "sclp_vt220" + #define SCLP_VT220_DEVICE_NAME "ttysclp" +-#define SCLP_VT220_CONSOLE_NAME "ttyS" +-#define SCLP_VT220_CONSOLE_INDEX 1 /* console=ttyS1 */ ++#define SCLP_VT220_CONSOLE_NAME "ttysclp" ++#define SCLP_VT220_CONSOLE_INDEX 0 /* console=ttysclp0 */ + + /* Representation of a single write request */ + struct sclp_vt220_request { +diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c +index 51038ec309c12..1fd982b4d64bd 100644 +--- a/drivers/s390/cio/chp.c ++++ b/drivers/s390/cio/chp.c +@@ -255,6 +255,9 @@ static ssize_t chp_status_write(struct device *dev, + if (!num_args) + return count; + ++ /* Wait until previous actions have settled. */ ++ css_wait_for_slow_path(); ++ + if (!strncasecmp(cmd, "on", 2) || !strcmp(cmd, "1")) { + mutex_lock(&cp->lock); + error = s390_vary_chpid(cp->chpid, 1); +diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c +index a0baee25134c0..3f03163c7a58c 100644 +--- a/drivers/s390/cio/chsc.c ++++ b/drivers/s390/cio/chsc.c +@@ -770,8 +770,6 @@ int chsc_chp_vary(struct chp_id chpid, int on) + { + struct channel_path *chp = chpid_to_chp(chpid); + +- /* Wait until previous actions have settled. */ +- css_wait_for_slow_path(); + /* + * Redo PathVerification on the devices the chpid connects to + */ +diff --git a/drivers/scsi/FlashPoint.c b/drivers/scsi/FlashPoint.c +index 867b864f50479..4bca37d52bad8 100644 +--- a/drivers/scsi/FlashPoint.c ++++ b/drivers/scsi/FlashPoint.c +@@ -40,7 +40,7 @@ struct sccb_mgr_info { + u16 si_per_targ_ultra_nego; + u16 si_per_targ_no_disc; + u16 si_per_targ_wide_nego; +- u16 si_flags; ++ u16 si_mflags; + unsigned char si_card_family; + unsigned char si_bustype; + unsigned char si_card_model[3]; +@@ -1070,22 +1070,22 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + ScamFlg = + (unsigned char)FPT_utilEERead(ioport, SCAM_CONFIG / 2); + +- pCardInfo->si_flags = 0x0000; ++ pCardInfo->si_mflags = 0x0000; + + if (i & 0x01) +- pCardInfo->si_flags |= SCSI_PARITY_ENA; ++ pCardInfo->si_mflags |= SCSI_PARITY_ENA; + + if (!(i & 0x02)) +- pCardInfo->si_flags |= SOFT_RESET; ++ pCardInfo->si_mflags |= SOFT_RESET; + + if (i & 0x10) +- pCardInfo->si_flags |= EXTENDED_TRANSLATION; ++ pCardInfo->si_mflags |= EXTENDED_TRANSLATION; + + if (ScamFlg & SCAM_ENABLED) +- pCardInfo->si_flags |= FLAG_SCAM_ENABLED; ++ pCardInfo->si_mflags |= FLAG_SCAM_ENABLED; + + if (ScamFlg & SCAM_LEVEL2) +- pCardInfo->si_flags |= FLAG_SCAM_LEVEL2; ++ pCardInfo->si_mflags |= FLAG_SCAM_LEVEL2; + + j = (RD_HARPOON(ioport + hp_bm_ctrl) & ~SCSI_TERM_ENA_L); + if (i & 0x04) { +@@ -1101,7 +1101,7 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + + if (!(RD_HARPOON(ioport + hp_page_ctrl) & NARROW_SCSI_CARD)) + +- pCardInfo->si_flags |= SUPPORT_16TAR_32LUN; ++ pCardInfo->si_mflags |= SUPPORT_16TAR_32LUN; + + pCardInfo->si_card_family = HARPOON_FAMILY; + pCardInfo->si_bustype = BUSTYPE_PCI; +@@ -1137,15 +1137,15 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + + if (pCardInfo->si_card_model[1] == '3') { + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + } else if (pCardInfo->si_card_model[2] == '0') { + temp = RD_HARPOON(ioport + hp_xfer_pad); + WR_HARPOON(ioport + hp_xfer_pad, (temp & ~BIT(4))); + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + WR_HARPOON(ioport + hp_xfer_pad, (temp | BIT(4))); + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= HIGH_BYTE_TERM; ++ pCardInfo->si_mflags |= HIGH_BYTE_TERM; + WR_HARPOON(ioport + hp_xfer_pad, temp); + } else { + temp = RD_HARPOON(ioport + hp_ee_ctrl); +@@ -1163,9 +1163,9 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + WR_HARPOON(ioport + hp_ee_ctrl, temp); + WR_HARPOON(ioport + hp_xfer_pad, temp2); + if (!(temp3 & BIT(7))) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + if (!(temp3 & BIT(6))) +- pCardInfo->si_flags |= HIGH_BYTE_TERM; ++ pCardInfo->si_mflags |= HIGH_BYTE_TERM; + } + + ARAM_ACCESS(ioport); +@@ -1272,7 +1272,7 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info + WR_HARPOON(ioport + hp_arb_id, pCardInfo->si_id); + CurrCard->ourId = pCardInfo->si_id; + +- i = (unsigned char)pCardInfo->si_flags; ++ i = (unsigned char)pCardInfo->si_mflags; + if (i & SCSI_PARITY_ENA) + WR_HARPOON(ioport + hp_portctrl_1, (HOST_MODE8 | CHK_SCSI_P)); + +@@ -1286,14 +1286,14 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info + j |= SCSI_TERM_ENA_H; + WR_HARPOON(ioport + hp_ee_ctrl, j); + +- if (!(pCardInfo->si_flags & SOFT_RESET)) { ++ if (!(pCardInfo->si_mflags & SOFT_RESET)) { + + FPT_sresb(ioport, thisCard); + + FPT_scini(thisCard, pCardInfo->si_id, 0); + } + +- if (pCardInfo->si_flags & POST_ALL_UNDERRRUNS) ++ if (pCardInfo->si_mflags & POST_ALL_UNDERRRUNS) + CurrCard->globalFlags |= F_NO_FILTER; + + if (pCurrNvRam) { +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 3660059784f74..50e9b4b683574 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -423,7 +423,7 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev) + "beiscsi_hba_alloc - iscsi_host_alloc failed\n"); + return NULL; + } +- shost->max_id = BE2_MAX_SESSIONS; ++ shost->max_id = BE2_MAX_SESSIONS - 1; + shost->max_channel = 0; + shost->max_cmd_len = BEISCSI_MAX_CMD_LEN; + shost->max_lun = BEISCSI_NUM_MAX_LUN; +@@ -5336,7 +5336,7 @@ static int beiscsi_enable_port(struct beiscsi_hba *phba) + /* Re-enable UER. If different TPE occurs then it is recoverable. */ + beiscsi_set_uer_feature(phba); + +- phba->shost->max_id = phba->params.cxns_per_ctrl; ++ phba->shost->max_id = phba->params.cxns_per_ctrl - 1; + phba->shost->can_queue = phba->params.ios_per_ctrl; + ret = beiscsi_init_port(phba); + if (ret < 0) { +@@ -5764,6 +5764,7 @@ free_hba: + pci_disable_msix(phba->pcidev); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_disable_pcie_error_reporting(pcidev); + pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_release_regions(pcidev); +diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c +index 718a0335cfbb3..9a5795d5a347b 100644 +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -793,7 +793,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic) + return NULL; + shost->dma_boundary = cnic->pcidev->dma_mask; + shost->transportt = bnx2i_scsi_xport_template; +- shost->max_id = ISCSI_MAX_CONNS_PER_HBA; ++ shost->max_id = ISCSI_MAX_CONNS_PER_HBA - 1; + shost->max_channel = 0; + shost->max_lun = 512; + shost->max_cmd_len = 16; +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 559d8bda4cca7..01f5ebee32293 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -339,7 +339,7 @@ void cxgbi_hbas_remove(struct cxgbi_device *cdev) + EXPORT_SYMBOL_GPL(cxgbi_hbas_remove); + + int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun, +- unsigned int max_id, struct scsi_host_template *sht, ++ unsigned int max_conns, struct scsi_host_template *sht, + struct scsi_transport_template *stt) + { + struct cxgbi_hba *chba; +@@ -359,7 +359,7 @@ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun, + + shost->transportt = stt; + shost->max_lun = max_lun; +- shost->max_id = max_id; ++ shost->max_id = max_conns - 1; + shost->max_channel = 0; + shost->max_cmd_len = 16; + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index efd2b43125286..4cf7c3348bffe 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -522,7 +522,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + struct alua_port_group *tmp_pg; + int len, k, off, bufflen = ALUA_RTPG_SIZE; + unsigned char *desc, *buff; +- unsigned err, retval; ++ unsigned err; ++ int retval; + unsigned int tpg_desc_tbl_off; + unsigned char orig_transition_tmo; + unsigned long flags; +@@ -562,12 +563,12 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + kfree(buff); + return SCSI_DH_OK; + } +- if (!scsi_sense_valid(&sense_hdr)) { ++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) { + sdev_printk(KERN_INFO, sdev, + "%s: rtpg failed, result %d\n", + ALUA_DH_NAME, retval); + kfree(buff); +- if (driver_byte(retval) == DRIVER_ERROR) ++ if (retval < 0) + return SCSI_DH_DEV_TEMP_BUSY; + return SCSI_DH_IO; + } +@@ -789,11 +790,11 @@ static unsigned alua_stpg(struct scsi_device *sdev, struct alua_port_group *pg) + retval = submit_stpg(sdev, pg->group_id, &sense_hdr); + + if (retval) { +- if (!scsi_sense_valid(&sense_hdr)) { ++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) { + sdev_printk(KERN_INFO, sdev, + "%s: stpg failed, result %d", + ALUA_DH_NAME, retval); +- if (driver_byte(retval) == DRIVER_ERROR) ++ if (retval < 0) + return SCSI_DH_DEV_TEMP_BUSY; + } else { + sdev_printk(KERN_INFO, sdev, "%s: stpg failed\n", +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index fa03be813f2cb..f3194d634f7f2 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -218,6 +218,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + goto fail; + } + ++ shost->cmd_per_lun = min_t(short, shost->cmd_per_lun, ++ shost->can_queue); ++ + error = scsi_init_sense_cache(shost); + if (error) + goto fail; +@@ -497,6 +500,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) + shost_printk(KERN_WARNING, shost, + "error handler thread failed to spawn, error = %ld\n", + PTR_ERR(shost->ehandler)); ++ shost->ehandler = NULL; + goto fail; + } + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 81471c3049916..5607fe8541c3a 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -259,11 +259,11 @@ static int iscsi_prep_bidi_ahs(struct iscsi_task *task) + */ + static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + { +- struct iscsi_conn *conn = task->conn; +- struct iscsi_tm *tmf = &conn->tmhdr; ++ struct iscsi_session *session = task->conn->session; ++ struct iscsi_tm *tmf = &session->tmhdr; + u64 hdr_lun; + +- if (conn->tmf_state == TMF_INITIAL) ++ if (session->tmf_state == TMF_INITIAL) + return 0; + + if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC) +@@ -283,24 +283,19 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + * Fail all SCSI cmd PDUs + */ + if (opcode != ISCSI_OP_SCSI_DATA_OUT) { +- iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x itt " +- "0x%x/0x%x] " +- "rejected.\n", +- opcode, task->itt, +- task->hdr_itt); ++ iscsi_session_printk(KERN_INFO, session, ++ "task [op %x itt 0x%x/0x%x] rejected.\n", ++ opcode, task->itt, task->hdr_itt); + return -EACCES; + } + /* + * And also all data-out PDUs in response to R2T + * if fast_abort is set. + */ +- if (conn->session->fast_abort) { +- iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x itt " +- "0x%x/0x%x] fast abort.\n", +- opcode, task->itt, +- task->hdr_itt); ++ if (session->fast_abort) { ++ iscsi_session_printk(KERN_INFO, session, ++ "task [op %x itt 0x%x/0x%x] fast abort.\n", ++ opcode, task->itt, task->hdr_itt); + return -EACCES; + } + break; +@@ -313,7 +308,7 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + */ + if (opcode == ISCSI_OP_SCSI_DATA_OUT && + task->hdr_itt == tmf->rtt) { +- ISCSI_DBG_SESSION(conn->session, ++ ISCSI_DBG_SESSION(session, + "Preventing task %x/%x from sending " + "data-out due to abort task in " + "progress\n", task->itt, +@@ -970,20 +965,21 @@ iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr) + { + struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr; ++ struct iscsi_session *session = conn->session; + + conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1; + conn->tmfrsp_pdus_cnt++; + +- if (conn->tmf_state != TMF_QUEUED) ++ if (session->tmf_state != TMF_QUEUED) + return; + + if (tmf->response == ISCSI_TMF_RSP_COMPLETE) +- conn->tmf_state = TMF_SUCCESS; ++ session->tmf_state = TMF_SUCCESS; + else if (tmf->response == ISCSI_TMF_RSP_NO_TASK) +- conn->tmf_state = TMF_NOT_FOUND; ++ session->tmf_state = TMF_NOT_FOUND; + else +- conn->tmf_state = TMF_FAILED; +- wake_up(&conn->ehwait); ++ session->tmf_state = TMF_FAILED; ++ wake_up(&session->ehwait); + } + + static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) +@@ -1385,7 +1381,6 @@ void iscsi_session_failure(struct iscsi_session *session, + enum iscsi_err err) + { + struct iscsi_conn *conn; +- struct device *dev; + + spin_lock_bh(&session->frwd_lock); + conn = session->leadconn; +@@ -1394,10 +1389,8 @@ void iscsi_session_failure(struct iscsi_session *session, + return; + } + +- dev = get_device(&conn->cls_conn->dev); ++ iscsi_get_conn(conn->cls_conn); + spin_unlock_bh(&session->frwd_lock); +- if (!dev) +- return; + /* + * if the host is being removed bypass the connection + * recovery initialization because we are going to kill +@@ -1407,7 +1400,7 @@ void iscsi_session_failure(struct iscsi_session *session, + iscsi_conn_error_event(conn->cls_conn, err); + else + iscsi_conn_failure(conn, err); +- put_device(dev); ++ iscsi_put_conn(conn->cls_conn); + } + EXPORT_SYMBOL_GPL(iscsi_session_failure); + +@@ -1825,15 +1818,14 @@ EXPORT_SYMBOL_GPL(iscsi_target_alloc); + + static void iscsi_tmf_timedout(struct timer_list *t) + { +- struct iscsi_conn *conn = from_timer(conn, t, tmf_timer); +- struct iscsi_session *session = conn->session; ++ struct iscsi_session *session = from_timer(session, t, tmf_timer); + + spin_lock(&session->frwd_lock); +- if (conn->tmf_state == TMF_QUEUED) { +- conn->tmf_state = TMF_TIMEDOUT; ++ if (session->tmf_state == TMF_QUEUED) { ++ session->tmf_state = TMF_TIMEDOUT; + ISCSI_DBG_EH(session, "tmf timedout\n"); + /* unblock eh_abort() */ +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock(&session->frwd_lock); + } +@@ -1856,8 +1848,8 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn, + return -EPERM; + } + conn->tmfcmd_pdus_cnt++; +- conn->tmf_timer.expires = timeout * HZ + jiffies; +- add_timer(&conn->tmf_timer); ++ session->tmf_timer.expires = timeout * HZ + jiffies; ++ add_timer(&session->tmf_timer); + ISCSI_DBG_EH(session, "tmf set timeout\n"); + + spin_unlock_bh(&session->frwd_lock); +@@ -1871,12 +1863,12 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn, + * 3) session is terminated or restarted or userspace has + * given up on recovery + */ +- wait_event_interruptible(conn->ehwait, age != session->age || ++ wait_event_interruptible(session->ehwait, age != session->age || + session->state != ISCSI_STATE_LOGGED_IN || +- conn->tmf_state != TMF_QUEUED); ++ session->tmf_state != TMF_QUEUED); + if (signal_pending(current)) + flush_signals(current); +- del_timer_sync(&conn->tmf_timer); ++ del_timer_sync(&session->tmf_timer); + + mutex_lock(&session->eh_mutex); + spin_lock_bh(&session->frwd_lock); +@@ -2236,17 +2228,17 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + } + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto failed; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_abort_task_pdu(task, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, age, session->abort_timeout)) + goto failed; + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + spin_unlock_bh(&session->frwd_lock); + /* +@@ -2261,7 +2253,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + */ + spin_lock_bh(&session->frwd_lock); + fail_scsi_task(task, DID_ABORT); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + memset(hdr, 0, sizeof(*hdr)); + spin_unlock_bh(&session->frwd_lock); + iscsi_start_tx(conn); +@@ -2272,7 +2264,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + goto failed_unlocked; + case TMF_NOT_FOUND: + if (!sc->SCp.ptr) { +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + memset(hdr, 0, sizeof(*hdr)); + /* task completed before tmf abort response */ + ISCSI_DBG_EH(session, "sc completed while abort in " +@@ -2281,7 +2273,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + } + /* fall through */ + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto failed; + } + +@@ -2338,11 +2330,11 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + conn = session->leadconn; + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto unlock; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_lun_reset_pdu(sc, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age, +@@ -2351,7 +2343,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + goto unlock; + } + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + break; + case TMF_TIMEDOUT: +@@ -2359,7 +2351,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + goto done; + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto unlock; + } + +@@ -2371,7 +2363,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + spin_lock_bh(&session->frwd_lock); + memset(hdr, 0, sizeof(*hdr)); + fail_scsi_tasks(conn, sc->device->lun, DID_ERROR); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + spin_unlock_bh(&session->frwd_lock); + + iscsi_start_tx(conn); +@@ -2394,8 +2386,7 @@ void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session) + spin_lock_bh(&session->frwd_lock); + if (session->state != ISCSI_STATE_LOGGED_IN) { + session->state = ISCSI_STATE_RECOVERY_FAILED; +- if (session->leadconn) +- wake_up(&session->leadconn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock_bh(&session->frwd_lock); + } +@@ -2440,7 +2431,7 @@ failed: + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + + ISCSI_DBG_EH(session, "wait for relogin\n"); +- wait_event_interruptible(conn->ehwait, ++ wait_event_interruptible(session->ehwait, + session->state == ISCSI_STATE_TERMINATE || + session->state == ISCSI_STATE_LOGGED_IN || + session->state == ISCSI_STATE_RECOVERY_FAILED); +@@ -2501,11 +2492,11 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + conn = session->leadconn; + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto unlock; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_tgt_reset_pdu(sc, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age, +@@ -2514,7 +2505,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + goto unlock; + } + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + break; + case TMF_TIMEDOUT: +@@ -2522,7 +2513,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + goto done; + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto unlock; + } + +@@ -2534,7 +2525,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + spin_lock_bh(&session->frwd_lock); + memset(hdr, 0, sizeof(*hdr)); + fail_scsi_tasks(conn, -1, DID_ERROR); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + spin_unlock_bh(&session->frwd_lock); + + iscsi_start_tx(conn); +@@ -2839,7 +2830,10 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, + session->tt = iscsit; + session->dd_data = cls_session->dd_data + sizeof(*session); + ++ session->tmf_state = TMF_INITIAL; ++ timer_setup(&session->tmf_timer, iscsi_tmf_timedout, 0); + mutex_init(&session->eh_mutex); ++ + spin_lock_init(&session->frwd_lock); + spin_lock_init(&session->back_lock); + +@@ -2943,7 +2937,6 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, + conn->c_stage = ISCSI_CONN_INITIAL_STAGE; + conn->id = conn_idx; + conn->exp_statsn = 0; +- conn->tmf_state = TMF_INITIAL; + + timer_setup(&conn->transport_timer, iscsi_check_transport_timeouts, 0); + +@@ -2969,8 +2962,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, + goto login_task_data_alloc_fail; + conn->login_task->data = conn->data = data; + +- timer_setup(&conn->tmf_timer, iscsi_tmf_timedout, 0); +- init_waitqueue_head(&conn->ehwait); ++ init_waitqueue_head(&session->ehwait); + + return cls_conn; + +@@ -3005,7 +2997,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) + * leading connection? then give up on recovery. + */ + session->state = ISCSI_STATE_TERMINATE; +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock_bh(&session->frwd_lock); + +@@ -3080,7 +3072,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn) + * commands after successful recovery + */ + conn->stop_stage = 0; +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + session->age++; + if (session->age == 16) + session->age = 0; +@@ -3094,7 +3086,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn) + spin_unlock_bh(&session->frwd_lock); + + iscsi_unblock_session(session->cls_session); +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + return 0; + } + EXPORT_SYMBOL_GPL(iscsi_conn_start); +@@ -3180,7 +3172,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session, + spin_lock_bh(&session->frwd_lock); + fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED); + fail_mgmt_tasks(session, conn); +- memset(&conn->tmhdr, 0, sizeof(conn->tmhdr)); ++ memset(&session->tmhdr, 0, sizeof(session->tmhdr)); + spin_unlock_bh(&session->frwd_lock); + mutex_unlock(&session->eh_mutex); + } +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 6a4b496081e4a..c4428249d3d7e 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1176,6 +1176,15 @@ stop_rr_fcf_flogi: + phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } ++ } else if (vport->port_state > LPFC_FLOGI && ++ vport->fc_flag & FC_PT2PT) { ++ /* ++ * In a p2p topology, it is possible that discovery has ++ * already progressed, and this completion can be ignored. ++ * Recheck the indicated topology. ++ */ ++ if (!sp->cmn.fPort) ++ goto out; + } + + flogifail: +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index f4633c9f8183f..40d6537e64dd6 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -7281,7 +7281,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) + "0393 Error %d during rpi post operation\n", + rc); + rc = -ENODEV; +- goto out_destroy_queue; ++ goto out_free_iocblist; + } + lpfc_sli4_node_prep(phba); + +@@ -7406,8 +7406,9 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) + out_unset_queue: + /* Unset all the queues set up in this routine when error out */ + lpfc_sli4_queue_unset(phba); +-out_destroy_queue: ++out_free_iocblist: + lpfc_free_iocb_list(phba); ++out_destroy_queue: + lpfc_sli4_queue_destroy(phba); + out_stop_timers: + lpfc_stop_hba_timers(phba); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 5a5e5c3da6571..add699b01836f 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -5745,8 +5745,10 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + handle, parent_handle, (unsigned long long) + sas_expander->sas_address, sas_expander->num_phys); + +- if (!sas_expander->num_phys) ++ if (!sas_expander->num_phys) { ++ rc = -1; + goto out_fail; ++ } + sas_expander->phy = kcalloc(sas_expander->num_phys, + sizeof(struct _sas_phy), GFP_KERNEL); + if (!sas_expander->phy) { +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c +index 357a0acc5ed2f..b60b48f3b984f 100644 +--- a/drivers/scsi/qedi/qedi_fw.c ++++ b/drivers/scsi/qedi/qedi_fw.c +@@ -1466,7 +1466,7 @@ abort_ret: + + ldel_exit: + spin_lock_bh(&qedi_conn->tmf_work_lock); +- if (!qedi_cmd->list_tmf_work) { ++ if (qedi_cmd->list_tmf_work) { + list_del_init(&list_work->list); + qedi_cmd->list_tmf_work = NULL; + kfree(list_work); +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index fe26144d390a9..7665fd641886e 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -629,7 +629,7 @@ static struct qedi_ctx *qedi_host_alloc(struct pci_dev *pdev) + goto exit_setup_shost; + } + +- shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA; ++ shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA - 1; + shost->max_channel = 0; + shost->max_lun = ~0; + shost->max_cmd_len = 16; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index fe5ae2b221c19..0191708c9dd4e 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -872,6 +872,7 @@ static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result) + case 0x07: /* operation in progress */ + case 0x08: /* Long write in progress */ + case 0x09: /* self test in progress */ ++ case 0x11: /* notify (enable spinup) required */ + case 0x14: /* space allocation in progress */ + case 0x1a: /* start stop unit in progress */ + case 0x1b: /* sanitize in progress */ +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index e340b05278b63..2aaa5a2bd6135 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2306,6 +2306,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) + } + EXPORT_SYMBOL_GPL(iscsi_destroy_conn); + ++void iscsi_put_conn(struct iscsi_cls_conn *conn) ++{ ++ put_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_put_conn); ++ ++void iscsi_get_conn(struct iscsi_cls_conn *conn) ++{ ++ get_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_get_conn); ++ + /* + * iscsi interface functions + */ +diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c +index b9a7117b6dce3..85d3475915dda 100644 +--- a/drivers/spi/spi-loopback-test.c ++++ b/drivers/spi/spi-loopback-test.c +@@ -877,7 +877,7 @@ static int spi_test_run_iter(struct spi_device *spi, + test.transfers[i].len = len; + if (test.transfers[i].tx_buf) + test.transfers[i].tx_buf += tx_off; +- if (test.transfers[i].tx_buf) ++ if (test.transfers[i].rx_buf) + test.transfers[i].rx_buf += rx_off; + } + +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index 1eccdc4a45817..2eeb0fe2eed28 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -251,7 +251,7 @@ static int omap1_spi100k_setup_transfer(struct spi_device *spi, + else + word_len = spi->bits_per_word; + +- if (spi->bits_per_word > 32) ++ if (word_len > 32) + return -EINVAL; + cs->word_len = word_len; + +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index 21a22d42818c8..ef62366899ad8 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -301,6 +301,10 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + } + + sun6i_spi_write(sspi, SUN6I_CLK_CTL_REG, reg); ++ /* Finally enable the bus - doing so before might raise SCK to HIGH */ ++ reg = sun6i_spi_read(sspi, SUN6I_GBL_CTL_REG); ++ reg |= SUN6I_GBL_CTL_BUS_ENABLE; ++ sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, reg); + + /* Setup the transfer now... */ + if (sspi->tx_buf) +@@ -409,7 +413,7 @@ static int sun6i_spi_runtime_resume(struct device *dev) + } + + sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, +- SUN6I_GBL_CTL_BUS_ENABLE | SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP); ++ SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP); + + return 0; + +diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c +index 8a5966963834c..ef19e050612cd 100644 +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -584,8 +584,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw) + data->pkt_tx_buff = kzalloc(size, GFP_KERNEL); + if (data->pkt_tx_buff != NULL) { + data->pkt_rx_buff = kzalloc(size, GFP_KERNEL); +- if (!data->pkt_rx_buff) ++ if (!data->pkt_rx_buff) { + kfree(data->pkt_tx_buff); ++ data->pkt_tx_buff = NULL; ++ } + } + + if (!data->pkt_rx_buff) { +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index bbe33016d3718..49f592e433a8d 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1678,6 +1678,7 @@ of_register_spi_device(struct spi_controller *ctlr, struct device_node *nc) + /* Store a pointer to the node in the device structure */ + of_node_get(nc); + spi->dev.of_node = nc; ++ spi->dev.fwnode = of_fwnode_handle(nc); + + /* Register the new device */ + rc = spi_add_device(spi); +diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c +index 6ceee98ed6ff2..5c7e61cafd195 100644 +--- a/drivers/ssb/scan.c ++++ b/drivers/ssb/scan.c +@@ -325,6 +325,7 @@ int ssb_bus_scan(struct ssb_bus *bus, + if (bus->nr_devices > ARRAY_SIZE(bus->devices)) { + pr_err("More than %d ssb cores found (%d)\n", + SSB_MAX_NR_CORES, bus->nr_devices); ++ err = -EINVAL; + goto err_unmap; + } + if (bus->bustype == SSB_BUSTYPE_SSB) { +diff --git a/drivers/ssb/sdio.c b/drivers/ssb/sdio.c +index 7fe0afb42234f..66c5c2169704b 100644 +--- a/drivers/ssb/sdio.c ++++ b/drivers/ssb/sdio.c +@@ -411,7 +411,6 @@ static void ssb_sdio_block_write(struct ssb_device *dev, const void *buffer, + sdio_claim_host(bus->host_sdio); + if (unlikely(ssb_sdio_switch_core(bus, dev))) { + error = -EIO; +- memset((void *)buffer, 0xff, count); + goto err_out; + } + offset |= bus->sdio_sbaddr & 0xffff; +diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c +index 3c2aab7a921e8..3c537807f4d14 100644 +--- a/drivers/staging/gdm724x/gdm_lte.c ++++ b/drivers/staging/gdm724x/gdm_lte.c +@@ -611,10 +611,12 @@ static void gdm_lte_netif_rx(struct net_device *dev, char *buf, + * bytes (99,130,83,99 dec) + */ + } __packed; +- void *addr = buf + sizeof(struct iphdr) + +- sizeof(struct udphdr) + +- offsetof(struct dhcp_packet, chaddr); +- ether_addr_copy(nic->dest_mac_addr, addr); ++ int offset = sizeof(struct iphdr) + ++ sizeof(struct udphdr) + ++ offsetof(struct dhcp_packet, chaddr); ++ if (offset + ETH_ALEN > len) ++ return; ++ ether_addr_copy(nic->dest_mac_addr, buf + offset); + } + } + +@@ -677,6 +679,7 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len) + struct sdu *sdu = NULL; + u8 endian = phy_dev->get_endian(phy_dev->priv_dev); + u8 *data = (u8 *)multi_sdu->data; ++ int copied; + u16 i = 0; + u16 num_packet; + u16 hci_len; +@@ -688,6 +691,12 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len) + num_packet = gdm_dev16_to_cpu(endian, multi_sdu->num_packet); + + for (i = 0; i < num_packet; i++) { ++ copied = data - multi_sdu->data; ++ if (len < copied + sizeof(*sdu)) { ++ pr_err("rx prevent buffer overflow"); ++ return; ++ } ++ + sdu = (struct sdu *)data; + + cmd_evt = gdm_dev16_to_cpu(endian, sdu->cmd_evt); +@@ -698,7 +707,8 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len) + pr_err("rx sdu wrong hci %04x\n", cmd_evt); + return; + } +- if (hci_len < 12) { ++ if (hci_len < 12 || ++ len < copied + sizeof(*sdu) + (hci_len - 12)) { + pr_err("rx sdu invalid len %d\n", hci_len); + return; + } +diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c +index 0f8fdc347091b..c7df0ffb35108 100644 +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -730,9 +730,10 @@ static int csi_setup(struct csi_priv *priv) + + static int csi_start(struct csi_priv *priv) + { +- struct v4l2_fract *output_fi; ++ struct v4l2_fract *input_fi, *output_fi; + int ret; + ++ input_fi = &priv->frame_interval[CSI_SINK_PAD]; + output_fi = &priv->frame_interval[priv->active_output_pad]; + + /* start upstream */ +@@ -741,6 +742,17 @@ static int csi_start(struct csi_priv *priv) + if (ret) + return ret; + ++ /* Skip first few frames from a BT.656 source */ ++ if (priv->upstream_ep.bus_type == V4L2_MBUS_BT656) { ++ u32 delay_usec, bad_frames = 20; ++ ++ delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC * ++ input_fi->numerator * bad_frames, ++ input_fi->denominator); ++ ++ usleep_range(delay_usec, delay_usec + 1000); ++ } ++ + if (priv->dest == IPU_CSI_DEST_IDMAC) { + ret = csi_idmac_start(priv); + if (ret) +diff --git a/drivers/staging/mt7621-dts/mt7621.dtsi b/drivers/staging/mt7621-dts/mt7621.dtsi +index 2e837e60663ad..9891e53e7895e 100644 +--- a/drivers/staging/mt7621-dts/mt7621.dtsi ++++ b/drivers/staging/mt7621-dts/mt7621.dtsi +@@ -409,7 +409,7 @@ + + bus-range = <0 255>; + ranges = < +- 0x02000000 0 0x00000000 0x60000000 0 0x10000000 /* pci memory */ ++ 0x02000000 0 0x60000000 0x60000000 0 0x10000000 /* pci memory */ + 0x01000000 0 0x00000000 0x1e160000 0 0x00010000 /* io space */ + >; + +diff --git a/drivers/staging/rtl8723bs/hal/odm.h b/drivers/staging/rtl8723bs/hal/odm.h +index 23ab160ac2c8f..ff8e22d70d4cf 100644 +--- a/drivers/staging/rtl8723bs/hal/odm.h ++++ b/drivers/staging/rtl8723bs/hal/odm.h +@@ -197,10 +197,7 @@ typedef struct _ODM_RATE_ADAPTIVE { + + #define AVG_THERMAL_NUM 8 + #define IQK_Matrix_REG_NUM 8 +-#define IQK_Matrix_Settings_NUM (14 + 24 + 21) /* Channels_2_4G_NUM +- * + Channels_5G_20M_NUM +- * + Channels_5G +- */ ++#define IQK_Matrix_Settings_NUM 14 /* Channels_2_4G_NUM */ + + #define DM_Type_ByFW 0 + #define DM_Type_ByDriver 1 +diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c +index fed820e9ab9d7..f291f4b06b683 100644 +--- a/drivers/tty/nozomi.c ++++ b/drivers/tty/nozomi.c +@@ -1403,7 +1403,7 @@ static int nozomi_card_init(struct pci_dev *pdev, + NOZOMI_NAME, dc); + if (unlikely(ret)) { + dev_err(&pdev->dev, "can't request irq %d\n", pdev->irq); +- goto err_free_kfifo; ++ goto err_free_all_kfifo; + } + + DBG1("base_addr: %p", dc->base_addr); +@@ -1441,12 +1441,15 @@ static int nozomi_card_init(struct pci_dev *pdev, + return 0; + + err_free_tty: +- for (i = 0; i < MAX_PORT; ++i) { ++ for (i--; i >= 0; i--) { + tty_unregister_device(ntty_driver, dc->index_start + i); + tty_port_destroy(&dc->port[i].port); + } ++ free_irq(pdev->irq, dc); ++err_free_all_kfifo: ++ i = MAX_PORT; + err_free_kfifo: +- for (i = 0; i < MAX_PORT; i++) ++ for (i--; i >= PORT_MDM; i--) + kfifo_free(&dc->port[i].fifo_ul); + err_free_sbuf: + kfree(dc->send_buf); +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 60ca19eca1f63..56693dfe0f5b7 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -2646,6 +2646,21 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port, + struct ktermios *old) + { + unsigned int tolerance = port->uartclk / 100; ++ unsigned int min; ++ unsigned int max; ++ ++ /* ++ * Handle magic divisors for baud rates above baud_base on SMSC ++ * Super I/O chips. Enable custom rates of clk/4 and clk/8, but ++ * disable divisor values beyond 32767, which are unavailable. ++ */ ++ if (port->flags & UPF_MAGIC_MULTIPLIER) { ++ min = port->uartclk / 16 / UART_DIV_MAX >> 1; ++ max = (port->uartclk + tolerance) / 4; ++ } else { ++ min = port->uartclk / 16 / UART_DIV_MAX; ++ max = (port->uartclk + tolerance) / 16; ++ } + + /* + * Ask the core to calculate the divisor for us. +@@ -2653,9 +2668,7 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port, + * slower than nominal still match standard baud rates without + * causing transmission errors. + */ +- return uart_get_baud_rate(port, termios, old, +- port->uartclk / 16 / UART_DIV_MAX, +- (port->uartclk + tolerance) / 16); ++ return uart_get_baud_rate(port, termios, old, min, max); + } + + void +diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c +index c8186a05a453c..a05c2b652040c 100644 +--- a/drivers/tty/serial/8250/serial_cs.c ++++ b/drivers/tty/serial/8250/serial_cs.c +@@ -306,6 +306,7 @@ static int serial_resume(struct pcmcia_device *link) + static int serial_probe(struct pcmcia_device *link) + { + struct serial_info *info; ++ int ret; + + dev_dbg(&link->dev, "serial_attach()\n"); + +@@ -320,7 +321,15 @@ static int serial_probe(struct pcmcia_device *link) + if (do_sound) + link->config_flags |= CONF_ENABLE_SPKR; + +- return serial_config(link); ++ ret = serial_config(link); ++ if (ret) ++ goto free_info; ++ ++ return 0; ++ ++free_info: ++ kfree(info); ++ return ret; + } + + static void serial_detach(struct pcmcia_device *link) +@@ -780,6 +789,7 @@ static const struct pcmcia_device_id serial_ids[] = { + PCMCIA_DEVICE_PROD_ID12("Multi-Tech", "MT2834LT", 0x5f73be51, 0x4cd7c09e), + PCMCIA_DEVICE_PROD_ID12("OEM ", "C288MX ", 0xb572d360, 0xd2385b7a), + PCMCIA_DEVICE_PROD_ID12("Option International", "V34bis GSM/PSTN Data/Fax Modem", 0x9d7cd6f5, 0x5cb8bf41), ++ PCMCIA_DEVICE_PROD_ID12("Option International", "GSM-Ready 56K/ISDN", 0x9d7cd6f5, 0xb23844aa), + PCMCIA_DEVICE_PROD_ID12("PCMCIA ", "C336MX ", 0x99bcafe9, 0xaa25bcab), + PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "PCMCIA Dual RS-232 Serial Port Card", 0xc4420b35, 0x92abc92f), + PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "Dual RS-232 Serial Port PC Card", 0xc4420b35, 0x031a380d), +@@ -807,7 +817,6 @@ static const struct pcmcia_device_id serial_ids[] = { + PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "cis/COMpad4.cis"), + PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "cis/COMpad2.cis"), + PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "cis/RS-COM-2P.cis"), +- PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "cis/GLOBETROTTER.cis"), + PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL100 1.00.", 0x19ca78af, 0xf964f42b), + PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL100", 0x19ca78af, 0x71d98e83), + PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL232 1.00.", 0x19ca78af, 0x69fb7490), +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 4b9f422694779..deb9d4fa9cb09 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1992,6 +1992,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud, + + bd = lpuart32_read(&sport->port, UARTBAUD); + bd &= UARTBAUD_SBR_MASK; ++ if (!bd) ++ return; ++ + sbr = bd; + uartclk = clk_get_rate(sport->clk); + /* +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 0515b5e6326d7..f0107d5df99e9 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -72,6 +72,7 @@ + #define BRDV_BAUD_MASK 0x3FF + + #define UART_OSAMP 0x14 ++#define OSAMP_DEFAULT_DIVISOR 16 + + #define MVEBU_NR_UARTS 2 + +@@ -444,23 +445,28 @@ static void mvebu_uart_shutdown(struct uart_port *port) + static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud) + { + struct mvebu_uart *mvuart = to_mvuart(port); +- unsigned int baud_rate_div; ++ unsigned int d_divisor, m_divisor; + u32 brdv; + + if (IS_ERR(mvuart->clk)) + return -PTR_ERR(mvuart->clk); + + /* +- * The UART clock is divided by the value of the divisor to generate +- * UCLK_OUT clock, which is 16 times faster than the baudrate. +- * This prescaler can achieve all standard baudrates until 230400. +- * Higher baudrates could be achieved for the extended UART by using the +- * programmable oversampling stack (also called fractional divisor). ++ * The baudrate is derived from the UART clock thanks to two divisors: ++ * > D ("baud generator"): can divide the clock from 2 to 2^10 - 1. ++ * > M ("fractional divisor"): allows a better accuracy for ++ * baudrates higher than 230400. ++ * ++ * As the derivation of M is rather complicated, the code sticks to its ++ * default value (x16) when all the prescalers are zeroed, and only ++ * makes use of D to configure the desired baudrate. + */ +- baud_rate_div = DIV_ROUND_UP(port->uartclk, baud * 16); ++ m_divisor = OSAMP_DEFAULT_DIVISOR; ++ d_divisor = DIV_ROUND_CLOSEST(port->uartclk, baud * m_divisor); ++ + brdv = readl(port->membase + UART_BRDV); + brdv &= ~BRDV_BAUD_MASK; +- brdv |= baud_rate_div; ++ brdv |= d_divisor; + writel(brdv, port->membase + UART_BRDV); + + return 0; +@@ -471,7 +477,7 @@ static void mvebu_uart_set_termios(struct uart_port *port, + struct ktermios *old) + { + unsigned long flags; +- unsigned int baud; ++ unsigned int baud, min_baud, max_baud; + + spin_lock_irqsave(&port->lock, flags); + +@@ -490,16 +496,21 @@ static void mvebu_uart_set_termios(struct uart_port *port, + port->ignore_status_mask |= STAT_RX_RDY(port) | STAT_BRK_ERR; + + /* ++ * Maximal divisor is 1023 * 16 when using default (x16) scheme. + * Maximum achievable frequency with simple baudrate divisor is 230400. + * Since the error per bit frame would be of more than 15%, achieving + * higher frequencies would require to implement the fractional divisor + * feature. + */ +- baud = uart_get_baud_rate(port, termios, old, 0, 230400); ++ min_baud = DIV_ROUND_UP(port->uartclk, 1023 * 16); ++ max_baud = 230400; ++ ++ baud = uart_get_baud_rate(port, termios, old, min_baud, max_baud); + if (mvebu_uart_baud_rate_set(port, baud)) { + /* No clock available, baudrate cannot be changed */ + if (old) +- baud = uart_get_baud_rate(port, old, NULL, 0, 230400); ++ baud = uart_get_baud_rate(port, old, NULL, ++ min_baud, max_baud); + } else { + tty_termios_encode_baud_rate(termios, baud, baud); + uart_update_timeout(port, termios->c_cflag, baud); +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index bfbfe0d68d828..db5b11879910c 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -613,6 +613,14 @@ static void sci_stop_tx(struct uart_port *port) + ctrl &= ~SCSCR_TIE; + + serial_port_out(port, SCSCR, ctrl); ++ ++#ifdef CONFIG_SERIAL_SH_SCI_DMA ++ if (to_sci_port(port)->chan_tx && ++ !dma_submit_error(to_sci_port(port)->cookie_tx)) { ++ dmaengine_terminate_async(to_sci_port(port)->chan_tx); ++ to_sci_port(port)->cookie_tx = -EINVAL; ++ } ++#endif + } + + static void sci_start_rx(struct uart_port *port) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 738de8c9c354b..371aae41ed655 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -2000,6 +2000,11 @@ static const struct usb_device_id acm_ids[] = { + .driver_info = IGNORE_DEVICE, + }, + ++ /* Exclude Heimann Sensor GmbH USB appset demo */ ++ { USB_DEVICE(0x32a7, 0x0000), ++ .driver_info = IGNORE_DEVICE, ++ }, ++ + /* control interfaces without any protocol set */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, + USB_CDC_PROTO_NONE) }, +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index e223502eafca6..87e38a7534581 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1495,17 +1495,18 @@ static int dwc3_probe(struct platform_device *pdev) + } + + dwc3_check_params(dwc); ++ dwc3_debugfs_init(dwc); + + ret = dwc3_core_init_mode(dwc); + if (ret) + goto err5; + +- dwc3_debugfs_init(dwc); + pm_runtime_put(dev); + + return 0; + + err5: ++ dwc3_debugfs_exit(dwc); + dwc3_event_buffers_cleanup(dwc); + + usb_phy_shutdown(dwc->usb2_phy); +diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c +index bdd964ac9fa9a..dbfaebec24886 100644 +--- a/drivers/usb/gadget/function/f_eem.c ++++ b/drivers/usb/gadget/function/f_eem.c +@@ -30,6 +30,11 @@ struct f_eem { + u8 ctrl_id; + }; + ++struct in_context { ++ struct sk_buff *skb; ++ struct usb_ep *ep; ++}; ++ + static inline struct f_eem *func_to_eem(struct usb_function *f) + { + return container_of(f, struct f_eem, port.func); +@@ -323,9 +328,12 @@ fail: + + static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req) + { +- struct sk_buff *skb = (struct sk_buff *)req->context; ++ struct in_context *ctx = req->context; + +- dev_kfree_skb_any(skb); ++ dev_kfree_skb_any(ctx->skb); ++ kfree(req->buf); ++ usb_ep_free_request(ctx->ep, req); ++ kfree(ctx); + } + + /* +@@ -413,7 +421,9 @@ static int eem_unwrap(struct gether *port, + * b15: bmType (0 == data, 1 == command) + */ + if (header & BIT(15)) { +- struct usb_request *req = cdev->req; ++ struct usb_request *req; ++ struct in_context *ctx; ++ struct usb_ep *ep; + u16 bmEEMCmd; + + /* EEM command packet format: +@@ -442,11 +452,36 @@ static int eem_unwrap(struct gether *port, + skb_trim(skb2, len); + put_unaligned_le16(BIT(15) | BIT(11) | len, + skb_push(skb2, 2)); ++ ++ ep = port->in_ep; ++ req = usb_ep_alloc_request(ep, GFP_ATOMIC); ++ if (!req) { ++ dev_kfree_skb_any(skb2); ++ goto next; ++ } ++ ++ req->buf = kmalloc(skb2->len, GFP_KERNEL); ++ if (!req->buf) { ++ usb_ep_free_request(ep, req); ++ dev_kfree_skb_any(skb2); ++ goto next; ++ } ++ ++ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) { ++ kfree(req->buf); ++ usb_ep_free_request(ep, req); ++ dev_kfree_skb_any(skb2); ++ goto next; ++ } ++ ctx->skb = skb2; ++ ctx->ep = ep; ++ + skb_copy_bits(skb2, 0, req->buf, skb2->len); + req->length = skb2->len; + req->complete = eem_cmd_complete; + req->zero = 1; +- req->context = skb2; ++ req->context = ctx; + if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) + DBG(cdev, "echo response queue fail\n"); + break; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index f13ec86371e72..e6805492409f6 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -243,8 +243,8 @@ EXPORT_SYMBOL_GPL(ffs_lock); + static struct ffs_dev *_ffs_find_dev(const char *name); + static struct ffs_dev *_ffs_alloc_dev(void); + static void _ffs_free_dev(struct ffs_dev *dev); +-static void *ffs_acquire_dev(const char *dev_name); +-static void ffs_release_dev(struct ffs_data *ffs_data); ++static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data); ++static void ffs_release_dev(struct ffs_dev *ffs_dev); + static int ffs_ready(struct ffs_data *ffs); + static void ffs_closed(struct ffs_data *ffs); + +@@ -1515,7 +1515,6 @@ ffs_fs_mount(struct file_system_type *t, int flags, + }; + struct dentry *rv; + int ret; +- void *ffs_dev; + struct ffs_data *ffs; + + ENTER(); +@@ -1536,19 +1535,16 @@ ffs_fs_mount(struct file_system_type *t, int flags, + return ERR_PTR(-ENOMEM); + } + +- ffs_dev = ffs_acquire_dev(dev_name); +- if (IS_ERR(ffs_dev)) { ++ ret = ffs_acquire_dev(dev_name, ffs); ++ if (ret) { + ffs_data_put(ffs); +- return ERR_CAST(ffs_dev); ++ return ERR_PTR(ret); + } +- ffs->private_data = ffs_dev; + data.ffs_data = ffs; + + rv = mount_nodev(t, flags, &data, ffs_sb_fill); +- if (IS_ERR(rv) && data.ffs_data) { +- ffs_release_dev(data.ffs_data); ++ if (IS_ERR(rv) && data.ffs_data) + ffs_data_put(data.ffs_data); +- } + return rv; + } + +@@ -1558,10 +1554,8 @@ ffs_fs_kill_sb(struct super_block *sb) + ENTER(); + + kill_litter_super(sb); +- if (sb->s_fs_info) { +- ffs_release_dev(sb->s_fs_info); ++ if (sb->s_fs_info) + ffs_data_closed(sb->s_fs_info); +- } + } + + static struct file_system_type ffs_fs_type = { +@@ -1630,6 +1624,7 @@ static void ffs_data_put(struct ffs_data *ffs) + if (unlikely(refcount_dec_and_test(&ffs->ref))) { + pr_info("%s(): freeing\n", __func__); + ffs_data_clear(ffs); ++ ffs_release_dev(ffs->private_data); + BUG_ON(waitqueue_active(&ffs->ev.waitq) || + waitqueue_active(&ffs->ep0req_completion.wait) || + waitqueue_active(&ffs->wait)); +@@ -2934,6 +2929,7 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, + struct ffs_function *func = ffs_func_from_usb(f); + struct f_fs_opts *ffs_opts = + container_of(f->fi, struct f_fs_opts, func_inst); ++ struct ffs_data *ffs_data; + int ret; + + ENTER(); +@@ -2948,12 +2944,13 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, + if (!ffs_opts->no_configfs) + ffs_dev_lock(); + ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV; +- func->ffs = ffs_opts->dev->ffs_data; ++ ffs_data = ffs_opts->dev->ffs_data; + if (!ffs_opts->no_configfs) + ffs_dev_unlock(); + if (ret) + return ERR_PTR(ret); + ++ func->ffs = ffs_data; + func->conf = c; + func->gadget = c->cdev->gadget; + +@@ -3408,6 +3405,7 @@ static void ffs_free_inst(struct usb_function_instance *f) + struct f_fs_opts *opts; + + opts = to_f_fs_opts(f); ++ ffs_release_dev(opts->dev); + ffs_dev_lock(); + _ffs_free_dev(opts->dev); + ffs_dev_unlock(); +@@ -3595,47 +3593,48 @@ static void _ffs_free_dev(struct ffs_dev *dev) + { + list_del(&dev->entry); + +- /* Clear the private_data pointer to stop incorrect dev access */ +- if (dev->ffs_data) +- dev->ffs_data->private_data = NULL; +- + kfree(dev); + if (list_empty(&ffs_devices)) + functionfs_cleanup(); + } + +-static void *ffs_acquire_dev(const char *dev_name) ++static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data) + { ++ int ret = 0; + struct ffs_dev *ffs_dev; + + ENTER(); + ffs_dev_lock(); + + ffs_dev = _ffs_find_dev(dev_name); +- if (!ffs_dev) +- ffs_dev = ERR_PTR(-ENOENT); +- else if (ffs_dev->mounted) +- ffs_dev = ERR_PTR(-EBUSY); +- else if (ffs_dev->ffs_acquire_dev_callback && +- ffs_dev->ffs_acquire_dev_callback(ffs_dev)) +- ffs_dev = ERR_PTR(-ENOENT); +- else ++ if (!ffs_dev) { ++ ret = -ENOENT; ++ } else if (ffs_dev->mounted) { ++ ret = -EBUSY; ++ } else if (ffs_dev->ffs_acquire_dev_callback && ++ ffs_dev->ffs_acquire_dev_callback(ffs_dev)) { ++ ret = -ENOENT; ++ } else { + ffs_dev->mounted = true; ++ ffs_dev->ffs_data = ffs_data; ++ ffs_data->private_data = ffs_dev; ++ } + + ffs_dev_unlock(); +- return ffs_dev; ++ return ret; + } + +-static void ffs_release_dev(struct ffs_data *ffs_data) ++static void ffs_release_dev(struct ffs_dev *ffs_dev) + { +- struct ffs_dev *ffs_dev; +- + ENTER(); + ffs_dev_lock(); + +- ffs_dev = ffs_data->private_data; +- if (ffs_dev) { ++ if (ffs_dev && ffs_dev->mounted) { + ffs_dev->mounted = false; ++ if (ffs_dev->ffs_data) { ++ ffs_dev->ffs_data->private_data = NULL; ++ ffs_dev->ffs_data = NULL; ++ } + + if (ffs_dev->ffs_release_dev_callback) + ffs_dev->ffs_release_dev_callback(ffs_dev); +@@ -3663,7 +3662,6 @@ static int ffs_ready(struct ffs_data *ffs) + } + + ffs_obj->desc_ready = true; +- ffs_obj->ffs_data = ffs; + + if (ffs_obj->ffs_ready_callback) { + ret = ffs_obj->ffs_ready_callback(ffs); +@@ -3691,7 +3689,6 @@ static void ffs_closed(struct ffs_data *ffs) + goto done; + + ffs_obj->desc_ready = false; +- ffs_obj->ffs_data = NULL; + + if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && + ffs_obj->ffs_closed_callback) +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index bc0a693c3260d..fa8a8e04008ae 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -88,7 +88,7 @@ static struct usb_interface_descriptor hidg_interface_desc = { + static struct hid_descriptor hidg_desc = { + .bLength = sizeof hidg_desc, + .bDescriptorType = HID_DT_HID, +- .bcdHID = 0x0101, ++ .bcdHID = cpu_to_le16(0x0101), + .bCountryCode = 0x00, + .bNumDescriptors = 0x1, + /*.desc[0].bDescriptorType = DYNAMIC */ +diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c +index c4eda7fe7ab45..5b27d289443fe 100644 +--- a/drivers/usb/gadget/legacy/hid.c ++++ b/drivers/usb/gadget/legacy/hid.c +@@ -171,8 +171,10 @@ static int hid_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto put; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 2461be2a8748c..fb47caf929de5 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1929,6 +1929,7 @@ no_bw: + xhci->hw_ports = NULL; + xhci->rh_bw = NULL; + xhci->ext_caps = NULL; ++ xhci->port_caps = NULL; + + xhci->page_size = 0; + xhci->page_shift = 0; +diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c +index 1916ee1600b47..8dae6ff2377ce 100644 +--- a/drivers/usb/typec/class.c ++++ b/drivers/usb/typec/class.c +@@ -481,8 +481,10 @@ typec_register_altmode(struct device *parent, + int ret; + + alt = kzalloc(sizeof(*alt), GFP_KERNEL); +- if (!alt) ++ if (!alt) { ++ altmode_id_remove(parent, id); + return ERR_PTR(-ENOMEM); ++ } + + alt->adev.svid = desc->svid; + alt->adev.mode = desc->mode; +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index c48e1d84efb6b..51b791c750f1b 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -1359,6 +1359,7 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf) + { + struct vm_area_struct *vma = vmf->vma; + struct vfio_pci_device *vdev = vma->vm_private_data; ++ struct vfio_pci_mmap_vma *mmap_vma; + vm_fault_t ret = VM_FAULT_NOPAGE; + + mutex_lock(&vdev->vma_lock); +@@ -1366,24 +1367,36 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf) + + if (!__vfio_pci_memory_enabled(vdev)) { + ret = VM_FAULT_SIGBUS; +- mutex_unlock(&vdev->vma_lock); + goto up_out; + } + +- if (__vfio_pci_add_vma(vdev, vma)) { +- ret = VM_FAULT_OOM; +- mutex_unlock(&vdev->vma_lock); +- goto up_out; ++ /* ++ * We populate the whole vma on fault, so we need to test whether ++ * the vma has already been mapped, such as for concurrent faults ++ * to the same vma. io_remap_pfn_range() will trigger a BUG_ON if ++ * we ask it to fill the same range again. ++ */ ++ list_for_each_entry(mmap_vma, &vdev->vma_list, vma_next) { ++ if (mmap_vma->vma == vma) ++ goto up_out; + } + +- mutex_unlock(&vdev->vma_lock); +- + if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, +- vma->vm_end - vma->vm_start, vma->vm_page_prot)) ++ vma->vm_end - vma->vm_start, ++ vma->vm_page_prot)) { + ret = VM_FAULT_SIGBUS; ++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); ++ goto up_out; ++ } ++ ++ if (__vfio_pci_add_vma(vdev, vma)) { ++ ret = VM_FAULT_OOM; ++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); ++ } + + up_out: + up_read(&vdev->memory_lock); ++ mutex_unlock(&vdev->vma_lock); + return ret; + } + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index ef2553f452ca9..f17e5a8860fa7 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -184,7 +184,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -204,8 +204,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_a_get_brightness(struct backlight_device *bl) +@@ -261,7 +261,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -281,8 +281,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access REG_CTRL\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_b_get_brightness(struct backlight_device *bl) +diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c +index cb1eb7e05f871..5668cad86e374 100644 +--- a/drivers/visorbus/visorchipset.c ++++ b/drivers/visorbus/visorchipset.c +@@ -1561,7 +1561,7 @@ schedule_out: + + static int visorchipset_init(struct acpi_device *acpi_device) + { +- int err = -ENODEV; ++ int err = -ENOMEM; + struct visorchannel *controlvm_channel; + + chipset_dev = kzalloc(sizeof(*chipset_dev), GFP_KERNEL); +@@ -1584,8 +1584,10 @@ static int visorchipset_init(struct acpi_device *acpi_device) + "controlvm", + sizeof(struct visor_controlvm_channel), + VISOR_CONTROLVM_CHANNEL_VERSIONID, +- VISOR_CHANNEL_SIGNATURE)) ++ VISOR_CHANNEL_SIGNATURE)) { ++ err = -ENODEV; + goto error_delete_groups; ++ } + /* if booting in a crash kernel */ + if (is_kdump_kernel()) + INIT_DELAYED_WORK(&chipset_dev->periodic_controlvm_work, +diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c +index 7c4e33dbee4d5..b005dda9c6978 100644 +--- a/drivers/w1/slaves/w1_ds2438.c ++++ b/drivers/w1/slaves/w1_ds2438.c +@@ -64,13 +64,13 @@ static int w1_ds2438_get_page(struct w1_slave *sl, int pageno, u8 *buf) + if (w1_reset_select_slave(sl)) + continue; + w1_buf[0] = W1_DS2438_RECALL_MEMORY; +- w1_buf[1] = 0x00; ++ w1_buf[1] = (u8)pageno; + w1_write_block(sl->master, w1_buf, 2); + + if (w1_reset_select_slave(sl)) + continue; + w1_buf[0] = W1_DS2438_READ_SCRATCH; +- w1_buf[1] = 0x00; ++ w1_buf[1] = (u8)pageno; + w1_write_block(sl->master, w1_buf, 2); + + count = w1_read_block(sl->master, buf, DS2438_PAGE_SIZE + 1); +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index d84d6cbd96977..814041d4e287e 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -149,7 +149,7 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd, + + wdd->timeout = timeout; + +- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000); ++ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000); + + writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE); + writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART); +diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c +index 347f0389b0899..059c9eddb5468 100644 +--- a/drivers/watchdog/iTCO_wdt.c ++++ b/drivers/watchdog/iTCO_wdt.c +@@ -75,6 +75,8 @@ + #define TCOBASE(p) ((p)->tco_res->start) + /* SMI Control and Enable Register */ + #define SMI_EN(p) ((p)->smi_res->start) ++#define TCO_EN (1 << 13) ++#define GBL_SMI_EN (1 << 0) + + #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */ + #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/ +@@ -330,8 +332,12 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t) + + tmrval = seconds_to_ticks(p, t); + +- /* For TCO v1 the timer counts down twice before rebooting */ +- if (p->iTCO_version == 1) ++ /* ++ * If TCO SMIs are off, the timer counts down twice before rebooting. ++ * Otherwise, the BIOS generally reboots when the SMI triggers. ++ */ ++ if (p->smi_res && ++ (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN)) + tmrval /= 2; + + /* from the specs: */ +@@ -493,7 +499,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev) + * Disables TCO logic generating an SMI# + */ + val32 = inl(SMI_EN(p)); +- val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */ ++ val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */ + outl(val32, SMI_EN(p)); + } + +diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c +index 331cadb459ac5..48580b6406c25 100644 +--- a/drivers/watchdog/lpc18xx_wdt.c ++++ b/drivers/watchdog/lpc18xx_wdt.c +@@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) + struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); + + dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); +- del_timer(&lpc18xx_wdt->timer); ++ del_timer_sync(&lpc18xx_wdt->timer); + + watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); + clk_disable_unprepare(lpc18xx_wdt->wdt_clk); +diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c +index 87333a41f7538..1702df7f8c386 100644 +--- a/drivers/watchdog/sbc60xxwdt.c ++++ b/drivers/watchdog/sbc60xxwdt.c +@@ -152,7 +152,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + inb_p(wdt_stop); + pr_info("Watchdog timer is now disabled...\n"); + } +diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c +index 6aadb56e7faaa..809ebcaef51d9 100644 +--- a/drivers/watchdog/sc520_wdt.c ++++ b/drivers/watchdog/sc520_wdt.c +@@ -190,7 +190,7 @@ static int wdt_startup(void) + static int wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + /* Stop the watchdog */ + wdt_config(0); +diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c +index 05658ecc0aa4c..ec4641fc2d211 100644 +--- a/drivers/watchdog/w83877f_wdt.c ++++ b/drivers/watchdog/w83877f_wdt.c +@@ -170,7 +170,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + wdt_change(WDT_DISABLE); + +diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig +index 23537bc8c827c..7233127bb93ac 100644 +--- a/fs/btrfs/Kconfig ++++ b/fs/btrfs/Kconfig +@@ -12,6 +12,8 @@ config BTRFS_FS + select RAID6_PQ + select XOR_BLOCKS + select SRCU ++ depends on !PPC_256K_PAGES # powerpc ++ depends on !PAGE_SIZE_256KB # hexagon + + help + Btrfs is a general purpose copy-on-write filesystem with extents, +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index fea5ccfade5c6..1fbe2dee1e705 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1030,12 +1030,10 @@ static int __btrfs_update_delayed_inode(struct btrfs_trans_handle *trans, + nofs_flag = memalloc_nofs_save(); + ret = btrfs_lookup_inode(trans, root, path, &key, mod); + memalloc_nofs_restore(nofs_flag); +- if (ret > 0) { +- btrfs_release_path(path); +- return -ENOENT; +- } else if (ret < 0) { +- return ret; +- } ++ if (ret > 0) ++ ret = -ENOENT; ++ if (ret < 0) ++ goto out; + + leaf = path->nodes[0]; + inode_item = btrfs_item_ptr(leaf, path->slots[0], +@@ -1073,6 +1071,14 @@ err_out: + btrfs_delayed_inode_release_metadata(fs_info, node, (ret < 0)); + btrfs_release_delayed_inode(node); + ++ /* ++ * If we fail to update the delayed inode we need to abort the ++ * transaction, because we could leave the inode with the improper ++ * counts behind. ++ */ ++ if (ret && ret != -ENOENT) ++ btrfs_abort_transaction(trans, ret); ++ + return ret; + + search: +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 128398dde0816..1967d5fa681ad 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -4081,6 +4081,17 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move) + if (ret < 0) + goto out; + } else { ++ /* ++ * If we previously orphanized a directory that ++ * collided with a new reference that we already ++ * processed, recompute the current path because ++ * that directory may be part of the path. ++ */ ++ if (orphanized_dir) { ++ ret = refresh_ref_path(sctx, cur); ++ if (ret < 0) ++ goto out; ++ } + ret = send_unlink(sctx, cur->full_path); + if (ret < 0) + goto out; +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 1b52c960682d6..049535115c9dc 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1311,8 +1311,10 @@ int btrfs_defrag_root(struct btrfs_root *root) + + while (1) { + trans = btrfs_start_transaction(root, 0); +- if (IS_ERR(trans)) +- return PTR_ERR(trans); ++ if (IS_ERR(trans)) { ++ ret = PTR_ERR(trans); ++ break; ++ } + + ret = btrfs_defrag_leaves(trans, root); + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 93e59ce001742..3a7b7e9cb8896 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -5970,6 +5970,7 @@ next: + error: + if (wc.trans) + btrfs_end_transaction(wc.trans); ++ clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags); + btrfs_free_path(path); + return ret; + } +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index e59b2f53a81f6..de10899da837c 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -75,10 +75,6 @@ static int ceph_set_page_dirty(struct page *page) + struct inode *inode; + struct ceph_inode_info *ci; + struct ceph_snap_context *snapc; +- int ret; +- +- if (unlikely(!mapping)) +- return !TestSetPageDirty(page); + + if (PageDirty(page)) { + dout("%p set_page_dirty %p idx %lu -- already dirty\n", +@@ -124,11 +120,7 @@ static int ceph_set_page_dirty(struct page *page) + page->private = (unsigned long)snapc; + SetPagePrivate(page); + +- ret = __set_page_dirty_nobuffers(page); +- WARN_ON(!PageLocked(page)); +- WARN_ON(!page->mapping); +- +- return ret; ++ return __set_page_dirty_nobuffers(page); + } + + /* +diff --git a/fs/configfs/file.c b/fs/configfs/file.c +index 50b7c4c4310e0..38eb80e29715f 100644 +--- a/fs/configfs/file.c ++++ b/fs/configfs/file.c +@@ -496,13 +496,13 @@ static int configfs_release_bin_file(struct inode *inode, struct file *file) + buffer->bin_buffer_size); + } + up_read(&frag->frag_sem); +- /* vfree on NULL is safe */ +- vfree(buffer->bin_buffer); +- buffer->bin_buffer = NULL; +- buffer->bin_buffer_size = 0; +- buffer->needs_read_fill = 1; + } + ++ vfree(buffer->bin_buffer); ++ buffer->bin_buffer = NULL; ++ buffer->bin_buffer_size = 0; ++ buffer->needs_read_fill = 1; ++ + configfs_release(inode, file); + return 0; + } +diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c +index 17bb9a3fc0b01..052c137f1e70e 100644 +--- a/fs/crypto/fname.c ++++ b/fs/crypto/fname.c +@@ -275,13 +275,8 @@ int fscrypt_fname_disk_to_usr(struct inode *inode, + oname->name); + return 0; + } +- if (hash) { +- digested_name.hash = hash; +- digested_name.minor_hash = minor_hash; +- } else { +- digested_name.hash = 0; +- digested_name.minor_hash = 0; +- } ++ digested_name.hash = hash; ++ digested_name.minor_hash = minor_hash; + memcpy(digested_name.digest, + FSCRYPT_FNAME_DIGEST(iname->name, iname->len), + FSCRYPT_FNAME_DIGEST_SIZE); +diff --git a/fs/dlm/config.c b/fs/dlm/config.c +index f13d865244501..42b53e2a4e96d 100644 +--- a/fs/dlm/config.c ++++ b/fs/dlm/config.c +@@ -80,6 +80,9 @@ struct dlm_cluster { + unsigned int cl_new_rsb_count; + unsigned int cl_recover_callbacks; + char cl_cluster_name[DLM_LOCKSPACE_LEN]; ++ ++ struct dlm_spaces *sps; ++ struct dlm_comms *cms; + }; + + static struct dlm_cluster *config_item_to_cluster(struct config_item *i) +@@ -356,6 +359,9 @@ static struct config_group *make_cluster(struct config_group *g, + if (!cl || !sps || !cms) + goto fail; + ++ cl->sps = sps; ++ cl->cms = cms; ++ + config_group_init_type_name(&cl->group, name, &cluster_type); + config_group_init_type_name(&sps->ss_group, "spaces", &spaces_type); + config_group_init_type_name(&cms->cs_group, "comms", &comms_type); +@@ -405,6 +411,9 @@ static void drop_cluster(struct config_group *g, struct config_item *i) + static void release_cluster(struct config_item *i) + { + struct dlm_cluster *cl = config_item_to_cluster(i); ++ ++ kfree(cl->sps); ++ kfree(cl->cms); + kfree(cl); + } + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index a93ebffe84b38..f476a90e8aae1 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -609,7 +609,7 @@ static void close_connection(struct connection *con, bool and_other, + } + if (con->othercon && and_other) { + /* Will only re-enter once. */ +- close_connection(con->othercon, false, true, true); ++ close_connection(con->othercon, false, tx, rx); + } + if (con->rx_page) { + __free_page(con->rx_page); +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 093cb675841b0..2a45e0d3e593c 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -858,6 +858,7 @@ int ext4_ext_tree_init(handle_t *handle, struct inode *inode) + eh->eh_entries = 0; + eh->eh_magic = EXT4_EXT_MAGIC; + eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode, 0)); ++ eh->eh_generation = 0; + ext4_mark_inode_dirty(handle, inode); + return 0; + } +@@ -1114,6 +1115,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode, 0)); + neh->eh_magic = EXT4_EXT_MAGIC; + neh->eh_depth = 0; ++ neh->eh_generation = 0; + + /* move remainder of path[depth] to the new leaf */ + if (unlikely(path[depth].p_hdr->eh_entries != +@@ -1191,6 +1193,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + neh->eh_magic = EXT4_EXT_MAGIC; + neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode, 0)); + neh->eh_depth = cpu_to_le16(depth - i); ++ neh->eh_generation = 0; + fidx = EXT_FIRST_INDEX(neh); + fidx->ei_block = border; + ext4_idx_store_pblock(fidx, oldblock); +diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c +index c4e6fb15101b4..027c3e1b9f61a 100644 +--- a/fs/ext4/extents_status.c ++++ b/fs/ext4/extents_status.c +@@ -1080,11 +1080,9 @@ static unsigned long ext4_es_scan(struct shrinker *shrink, + ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt); + trace_ext4_es_shrink_scan_enter(sbi->s_sb, nr_to_scan, ret); + +- if (!nr_to_scan) +- return ret; +- + nr_shrunk = __es_shrink(sbi, nr_to_scan, NULL); + ++ ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt); + trace_ext4_es_shrink_scan_exit(sbi->s_sb, nr_shrunk, ret); + return nr_shrunk; + } +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 16abe23b1417a..5cb19fdf6450c 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -399,7 +399,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g, + * + * We always try to spread first-level directories. + * +- * If there are blockgroups with both free inodes and free blocks counts ++ * If there are blockgroups with both free inodes and free clusters counts + * not worse than average we return one with smallest directory count. + * Otherwise we simply return a random group. + * +@@ -408,7 +408,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g, + * It's OK to put directory into a group unless + * it has too many directories already (max_dirs) or + * it has too few free inodes left (min_inodes) or +- * it has too few free blocks left (min_blocks) or ++ * it has too few free clusters left (min_clusters) or + * Parent's group is preferred, if it doesn't satisfy these + * conditions we search cyclically through the rest. If none + * of the groups look good we just look for a group with more +@@ -424,7 +424,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent, + ext4_group_t real_ngroups = ext4_get_groups_count(sb); + int inodes_per_group = EXT4_INODES_PER_GROUP(sb); + unsigned int freei, avefreei, grp_free; +- ext4_fsblk_t freeb, avefreec; ++ ext4_fsblk_t freec, avefreec; + unsigned int ndirs; + int max_dirs, min_inodes; + ext4_grpblk_t min_clusters; +@@ -443,9 +443,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent, + + freei = percpu_counter_read_positive(&sbi->s_freeinodes_counter); + avefreei = freei / ngroups; +- freeb = EXT4_C2B(sbi, +- percpu_counter_read_positive(&sbi->s_freeclusters_counter)); +- avefreec = freeb; ++ freec = percpu_counter_read_positive(&sbi->s_freeclusters_counter); ++ avefreec = freec; + do_div(avefreec, ngroups); + ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter); + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index db47a06cfb74e..447aa17c804e2 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1542,10 +1542,11 @@ static int mb_find_extent(struct ext4_buddy *e4b, int block, + if (ex->fe_start + ex->fe_len > EXT4_CLUSTERS_PER_GROUP(e4b->bd_sb)) { + /* Should never happen! (but apparently sometimes does?!?) */ + WARN_ON(1); +- ext4_error(e4b->bd_sb, "corruption or bug in mb_find_extent " +- "block=%d, order=%d needed=%d ex=%u/%d/%d@%u", +- block, order, needed, ex->fe_group, ex->fe_start, +- ex->fe_len, ex->fe_logical); ++ ext4_grp_locked_error(e4b->bd_sb, e4b->bd_group, 0, 0, ++ "corruption or bug in mb_find_extent " ++ "block=%d, order=%d needed=%d ex=%u/%d/%d@%u", ++ block, order, needed, ex->fe_group, ex->fe_start, ++ ex->fe_len, ex->fe_logical); + ex->fe_len = 0; + ex->fe_start = 0; + ex->fe_group = 0; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 535ab6713732a..9ae3b6dd72fe8 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2689,8 +2689,15 @@ static void ext4_orphan_cleanup(struct super_block *sb, + inode_lock(inode); + truncate_inode_pages(inode->i_mapping, inode->i_size); + ret = ext4_truncate(inode); +- if (ret) ++ if (ret) { ++ /* ++ * We need to clean up the in-core orphan list ++ * manually if ext4_truncate() failed to get a ++ * transaction handle. ++ */ ++ ext4_orphan_del(NULL, inode); + ext4_std_error(inode->i_sb, ret); ++ } + inode_unlock(inode); + nr_truncates++; + } else { +@@ -4517,6 +4524,7 @@ no_journal: + ext4_msg(sb, KERN_ERR, + "unable to initialize " + "flex_bg meta info!"); ++ ret = -ENOMEM; + goto failed_mount6; + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 161ce0eb8891a..89fc8a4ce1497 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3373,4 +3373,5 @@ module_exit(exit_f2fs_fs) + MODULE_AUTHOR("Samsung Electronics's Praesto Team"); + MODULE_DESCRIPTION("Flash Friendly File System"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: crc32"); + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index a247cb4b00e2d..869a34a489587 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -512,9 +512,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + /* find and pin the new wb */ + rcu_read_lock(); + memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys); +- if (memcg_css) +- isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC); ++ if (memcg_css && !css_tryget(memcg_css)) ++ memcg_css = NULL; + rcu_read_unlock(); ++ if (!memcg_css) ++ goto out_free; ++ ++ isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC); ++ css_put(memcg_css); + if (!isw->new_wb) + goto out_free; + +@@ -2115,28 +2120,6 @@ int dirtytime_interval_handler(struct ctl_table *table, int write, + return ret; + } + +-static noinline void block_dump___mark_inode_dirty(struct inode *inode) +-{ +- if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) { +- struct dentry *dentry; +- const char *name = "?"; +- +- dentry = d_find_alias(inode); +- if (dentry) { +- spin_lock(&dentry->d_lock); +- name = (const char *) dentry->d_name.name; +- } +- printk(KERN_DEBUG +- "%s(%d): dirtied inode %lu (%s) on %s\n", +- current->comm, task_pid_nr(current), inode->i_ino, +- name, inode->i_sb->s_id); +- if (dentry) { +- spin_unlock(&dentry->d_lock); +- dput(dentry); +- } +- } +-} +- + /** + * __mark_inode_dirty - internal function + * +@@ -2196,9 +2179,6 @@ void __mark_inode_dirty(struct inode *inode, int flags) + (dirtytime && (inode->i_state & I_DIRTY_INODE))) + return; + +- if (unlikely(block_dump)) +- block_dump___mark_inode_dirty(inode); +- + spin_lock(&inode->i_lock); + if (dirtytime && (inode->i_state & I_DIRTY_INODE)) + goto out_unlock_inode; +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 1ff5a6b21db0b..8b22f8705dd48 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -1310,6 +1310,15 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, + goto restart; + } + spin_lock(&fpq->lock); ++ /* ++ * Must not put request on fpq->io queue after having been shut down by ++ * fuse_abort_conn() ++ */ ++ if (!fpq->connected) { ++ req->out.h.error = err = -ECONNABORTED; ++ goto out_end; ++ ++ } + list_add(&req->list, &fpq->io); + spin_unlock(&fpq->lock); + cs->req = req; +@@ -1887,7 +1896,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, + } + + err = -EINVAL; +- if (oh.error <= -1000 || oh.error > 0) ++ if (oh.error <= -512 || oh.error > 0) + goto err_finish; + + spin_lock(&fpq->lock); +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index 054cc761b426f..87b41edc800d0 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -161,7 +161,8 @@ void jfs_evict_inode(struct inode *inode) + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- diFree(inode); ++ if (JFS_SBI(inode->i_sb)->ipimap) ++ diFree(inode); + + /* + * Free the inode from the quota allocation. +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 6b68df3958924..356d1fcf71196 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -1338,6 +1338,7 @@ int lmLogInit(struct jfs_log * log) + } else { + if (memcmp(logsuper->uuid, log->uuid, 16)) { + jfs_warn("wrong uuid on JFS log device"); ++ rc = -EINVAL; + goto errout20; + } + log->size = le32_to_cpu(logsuper->size); +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index dc55ecc3bec46..2cdd8883b7c5d 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1038,6 +1038,7 @@ EXPORT_SYMBOL_GPL(nfs_inode_attach_open_context); + void nfs_file_set_open_context(struct file *filp, struct nfs_open_context *ctx) + { + filp->private_data = get_nfs_open_context(ctx); ++ set_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags); + if (list_empty(&ctx->list)) + nfs_inode_attach_open_context(ctx); + } +@@ -1057,6 +1058,8 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c + continue; + if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode) + continue; ++ if (!test_bit(NFS_CONTEXT_FILE_OPEN, &pos->flags)) ++ continue; + ctx = get_nfs_open_context(pos); + break; + } +@@ -1071,6 +1074,7 @@ void nfs_file_clear_open_context(struct file *filp) + if (ctx) { + struct inode *inode = d_inode(ctx->dentry); + ++ clear_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags); + /* + * We fatal error on write before. Try to writeback + * every page again. +diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c +index ec8a9efa268fe..e302f8370b9b8 100644 +--- a/fs/nfs/nfs3proc.c ++++ b/fs/nfs/nfs3proc.c +@@ -346,7 +346,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + + case NFS3_CREATE_UNCHECKED: +- goto out; ++ goto out_release_acls; + } + nfs_fattr_init(data->res.dir_attr); + nfs_fattr_init(data->res.fattr); +@@ -695,7 +695,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + default: + status = -EINVAL; +- goto out; ++ goto out_release_acls; + } + + status = nfs3_do_create(dir, dentry, data); +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index b5ce70c4ec87f..43659326b5191 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -191,8 +191,11 @@ void nfs40_shutdown_client(struct nfs_client *clp) + + struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + { +- int err; ++ char buf[INET6_ADDRSTRLEN + 1]; ++ const char *ip_addr = cl_init->ip_addr; + struct nfs_client *clp = nfs_alloc_client(cl_init); ++ int err; ++ + if (IS_ERR(clp)) + return clp; + +@@ -216,6 +219,44 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif + INIT_LIST_HEAD(&clp->pending_cb_stateids); ++ ++ if (cl_init->minorversion != 0) ++ __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); ++ __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); ++ __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); ++ ++ /* ++ * Set up the connection to the server before we add add to the ++ * global list. ++ */ ++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); ++ if (err == -EINVAL) ++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX); ++ if (err < 0) ++ goto error; ++ ++ /* If no clientaddr= option was specified, find a usable cb address */ ++ if (ip_addr == NULL) { ++ struct sockaddr_storage cb_addr; ++ struct sockaddr *sap = (struct sockaddr *)&cb_addr; ++ ++ err = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr)); ++ if (err < 0) ++ goto error; ++ err = rpc_ntop(sap, buf, sizeof(buf)); ++ if (err < 0) ++ goto error; ++ ip_addr = (const char *)buf; ++ } ++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); ++ ++ err = nfs_idmap_new(clp); ++ if (err < 0) { ++ dprintk("%s: failed to create idmapper. Error = %d\n", ++ __func__, err); ++ goto error; ++ } ++ __set_bit(NFS_CS_IDMAP, &clp->cl_res_state); + return clp; + + error: +@@ -368,8 +409,6 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp) + struct nfs_client *nfs4_init_client(struct nfs_client *clp, + const struct nfs_client_initdata *cl_init) + { +- char buf[INET6_ADDRSTRLEN + 1]; +- const char *ip_addr = cl_init->ip_addr; + struct nfs_client *old; + int error; + +@@ -377,43 +416,6 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp, + /* the client is initialised already */ + return clp; + +- /* Check NFS protocol revision and initialize RPC op vector */ +- clp->rpc_ops = &nfs_v4_clientops; +- +- if (clp->cl_minorversion != 0) +- __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); +- __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); +- __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); +- +- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); +- if (error == -EINVAL) +- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX); +- if (error < 0) +- goto error; +- +- /* If no clientaddr= option was specified, find a usable cb address */ +- if (ip_addr == NULL) { +- struct sockaddr_storage cb_addr; +- struct sockaddr *sap = (struct sockaddr *)&cb_addr; +- +- error = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr)); +- if (error < 0) +- goto error; +- error = rpc_ntop(sap, buf, sizeof(buf)); +- if (error < 0) +- goto error; +- ip_addr = (const char *)buf; +- } +- strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); +- +- error = nfs_idmap_new(clp); +- if (error < 0) { +- dprintk("%s: failed to create idmapper. Error = %d\n", +- __func__, error); +- goto error; +- } +- __set_bit(NFS_CS_IDMAP, &clp->cl_res_state); +- + error = nfs4_init_client_minor_version(clp); + if (error < 0) + goto error; +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index acfb52bc0007d..3f0c2436254ac 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -555,19 +555,16 @@ out: + } + EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_add); + +-static void nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds) ++static int nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds) + { + might_sleep(); +- wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, +- TASK_KILLABLE); ++ return wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, TASK_KILLABLE); + } + + static void nfs4_clear_ds_conn_bit(struct nfs4_pnfs_ds *ds) + { + smp_mb__before_atomic(); +- clear_bit(NFS4DS_CONNECTING, &ds->ds_state); +- smp_mb__after_atomic(); +- wake_up_bit(&ds->ds_state, NFS4DS_CONNECTING); ++ clear_and_wake_up_bit(NFS4DS_CONNECTING, &ds->ds_state); + } + + static struct nfs_client *(*get_v3_ds_connect)( +@@ -728,30 +725,33 @@ int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds, + { + int err; + +-again: +- err = 0; +- if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) { +- if (version == 3) { +- err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, +- retrans); +- } else if (version == 4) { +- err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, +- retrans, minor_version); +- } else { +- dprintk("%s: unsupported DS version %d\n", __func__, +- version); +- err = -EPROTONOSUPPORT; +- } ++ do { ++ err = nfs4_wait_ds_connect(ds); ++ if (err || ds->ds_clp) ++ goto out; ++ if (nfs4_test_deviceid_unavailable(devid)) ++ return -ENODEV; ++ } while (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) != 0); + +- nfs4_clear_ds_conn_bit(ds); +- } else { +- nfs4_wait_ds_connect(ds); ++ if (ds->ds_clp) ++ goto connect_done; + +- /* what was waited on didn't connect AND didn't mark unavail */ +- if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid)) +- goto again; ++ switch (version) { ++ case 3: ++ err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, retrans); ++ break; ++ case 4: ++ err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, retrans, ++ minor_version); ++ break; ++ default: ++ dprintk("%s: unsupported DS version %d\n", __func__, version); ++ err = -EPROTONOSUPPORT; + } + ++connect_done: ++ nfs4_clear_ds_conn_bit(ds); ++out: + /* + * At this point the ds->ds_clp should be ready, but it might have + * hit an error. +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index a2fb866ff76e8..e844b43f2eacf 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -502,7 +502,7 @@ err_corrupt_attr: + } + file_name_attr = (FILE_NAME_ATTR*)((u8*)attr + + le16_to_cpu(attr->data.resident.value_offset)); +- p2 = (u8*)attr + le32_to_cpu(attr->data.resident.value_length); ++ p2 = (u8 *)file_name_attr + le32_to_cpu(attr->data.resident.value_length); + if (p2 < (u8*)attr || p2 > p) + goto err_corrupt_attr; + /* This attribute is ok, but is it in the $Extend directory? */ +diff --git a/fs/ocfs2/filecheck.c b/fs/ocfs2/filecheck.c +index 1906cc962c4d9..345ca9e140289 100644 +--- a/fs/ocfs2/filecheck.c ++++ b/fs/ocfs2/filecheck.c +@@ -336,11 +336,7 @@ static ssize_t ocfs2_filecheck_attr_show(struct kobject *kobj, + ret = snprintf(buf + total, remain, "%lu\t\t%u\t%s\n", + p->fe_ino, p->fe_done, + ocfs2_filecheck_error(p->fe_status)); +- if (ret < 0) { +- total = ret; +- break; +- } +- if (ret == remain) { ++ if (ret >= remain) { + /* snprintf() didn't fit */ + total = -E2BIG; + break; +diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c +index c4b029c43464e..e7eb08ac42156 100644 +--- a/fs/ocfs2/stackglue.c ++++ b/fs/ocfs2/stackglue.c +@@ -510,11 +510,7 @@ static ssize_t ocfs2_loaded_cluster_plugins_show(struct kobject *kobj, + list_for_each_entry(p, &ocfs2_stack_list, sp_list) { + ret = snprintf(buf, remain, "%s\n", + p->sp_name); +- if (ret < 0) { +- total = ret; +- break; +- } +- if (ret == remain) { ++ if (ret >= remain) { + /* snprintf() didn't fit */ + total = -E2BIG; + break; +@@ -541,7 +537,7 @@ static ssize_t ocfs2_active_cluster_plugin_show(struct kobject *kobj, + if (active_stack) { + ret = snprintf(buf, PAGE_SIZE, "%s\n", + active_stack->sp_name); +- if (ret == PAGE_SIZE) ++ if (ret >= PAGE_SIZE) + ret = -E2BIG; + } + spin_unlock(&ocfs2_stack_lock); +diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c +index dfaee90d30bde..524fd95173b3a 100644 +--- a/fs/orangefs/super.c ++++ b/fs/orangefs/super.c +@@ -195,7 +195,7 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) + buf->f_bavail = (sector_t) new_op->downcall.resp.statfs.blocks_avail; + buf->f_files = (sector_t) new_op->downcall.resp.statfs.files_total; + buf->f_ffree = (sector_t) new_op->downcall.resp.statfs.files_avail; +- buf->f_frsize = sb->s_blocksize; ++ buf->f_frsize = 0; + + out_op_release: + op_release(new_op); +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 8a76f9d14bc66..78be6dbcd7627 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -2772,6 +2772,20 @@ int journal_init(struct super_block *sb, const char *j_dev_name, + goto free_and_return; + } + ++ /* ++ * Sanity check to see if journal first block is correct. ++ * If journal first block is invalid it can cause ++ * zeroing important superblock members. ++ */ ++ if (!SB_ONDISK_JOURNAL_DEVICE(sb) && ++ SB_ONDISK_JOURNAL_1st_BLOCK(sb) < SB_JOURNAL_1st_RESERVED_BLOCK(sb)) { ++ reiserfs_warning(sb, "journal-1393", ++ "journal 1st super block is invalid: 1st reserved block %d, but actual 1st block is %d", ++ SB_JOURNAL_1st_RESERVED_BLOCK(sb), ++ SB_ONDISK_JOURNAL_1st_BLOCK(sb)); ++ goto free_and_return; ++ } ++ + if (journal_init_dev(sb, journal, j_dev_name) != 0) { + reiserfs_warning(sb, "sh-462", + "unable to initialize journal device"); +diff --git a/fs/seq_file.c b/fs/seq_file.c +index 05e58b56f6202..e11f62b29be87 100644 +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -29,6 +29,9 @@ static void seq_set_overflow(struct seq_file *m) + + static void *seq_buf_alloc(unsigned long size) + { ++ if (unlikely(size > MAX_RW_COUNT)) ++ return NULL; ++ + return kvmalloc(size, GFP_KERNEL_ACCOUNT); + } + +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index 8fe2ee5462a0b..dbdf6a4230fbd 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -1354,7 +1354,10 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + goto out_release; + } + ++ spin_lock(&whiteout->i_lock); + whiteout->i_state |= I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + whiteout_ui = ubifs_inode(whiteout); + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); +@@ -1447,7 +1450,11 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + inc_nlink(whiteout); + mark_inode_dirty(whiteout); ++ ++ spin_lock(&whiteout->i_lock); + whiteout->i_state &= ~I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + iput(whiteout); + } + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 58cc2414992b6..9cfb555db1add 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -948,6 +948,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, + iinfo->i_location.partitionReferenceNum, + 0); + epos.bh = udf_tgetblk(sb, block); ++ if (unlikely(!epos.bh)) { ++ err = -ENOMEM; ++ goto out_no_entry; ++ } + lock_buffer(epos.bh); + memset(epos.bh->b_data, 0x00, bsize); + set_buffer_uptodate(epos.bh); +diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h +index a0b0ad9d585e6..64283c22f1eef 100644 +--- a/include/crypto/internal/hash.h ++++ b/include/crypto/internal/hash.h +@@ -82,13 +82,7 @@ int ahash_register_instance(struct crypto_template *tmpl, + struct ahash_instance *inst); + void ahash_free_instance(struct crypto_instance *inst); + +-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen); +- +-static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) +-{ +- return alg->setkey != shash_no_setkey; +-} ++bool crypto_shash_alg_has_setkey(struct shash_alg *alg); + + bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg); + +diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h +index 669894f434f5b..12c38054f7d1d 100644 +--- a/include/linux/mfd/abx500/ux500_chargalg.h ++++ b/include/linux/mfd/abx500/ux500_chargalg.h +@@ -15,7 +15,7 @@ + * - POWER_SUPPLY_TYPE_USB, + * because only them store as drv_data pointer to struct ux500_charger. + */ +-#define psy_to_ux500_charger(x) power_supply_get_drvdata(psy) ++#define psy_to_ux500_charger(x) power_supply_get_drvdata(x) + + /* Forward declaration */ + struct ux500_charger; +diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h +index 4c76fe2c84880..2a8105d204a96 100644 +--- a/include/linux/netdev_features.h ++++ b/include/linux/netdev_features.h +@@ -88,7 +88,7 @@ enum { + + /* + * Add your fresh new feature above and remember to update +- * netdev_features_strings[] in net/core/ethtool.c and maybe ++ * netdev_features_strings[] in net/ethtool/common.c and maybe + * some feature mask #defines below. Please also describe it + * in Documentation/networking/netdev-features.txt. + */ +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index a0831e9d19c9d..0ff7dd2bf8a4f 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -78,6 +78,7 @@ struct nfs_open_context { + #define NFS_CONTEXT_RESEND_WRITES (1) + #define NFS_CONTEXT_BAD (2) + #define NFS_CONTEXT_UNLOCK (3) ++#define NFS_CONTEXT_FILE_OPEN (4) + int error; + + struct list_head list; +diff --git a/include/linux/prandom.h b/include/linux/prandom.h +index cc1e71334e53c..e20339c78a84c 100644 +--- a/include/linux/prandom.h ++++ b/include/linux/prandom.h +@@ -93,7 +93,7 @@ static inline u32 __seed(u32 x, u32 m) + */ + static inline void prandom_seed_state(struct rnd_state *state, u64 seed) + { +- u32 i = (seed >> 32) ^ (seed << 10) ^ seed; ++ u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL; + + state->s1 = __seed(i, 2U); + state->s2 = __seed(i, 8U); +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index 444aa73037f19..4251cbfdb3c8c 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -42,7 +42,17 @@ extern int + tracepoint_probe_register_prio(struct tracepoint *tp, void *probe, void *data, + int prio); + extern int ++tracepoint_probe_register_prio_may_exist(struct tracepoint *tp, void *probe, void *data, ++ int prio); ++extern int + tracepoint_probe_unregister(struct tracepoint *tp, void *probe, void *data); ++static inline int ++tracepoint_probe_register_may_exist(struct tracepoint *tp, void *probe, ++ void *data) ++{ ++ return tracepoint_probe_register_prio_may_exist(tp, probe, data, ++ TRACEPOINT_DEFAULT_PRIO); ++} + extern void + for_each_kernel_tracepoint(void (*fct)(struct tracepoint *tp, void *priv), + void *priv); +diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h +index 9102d6ca566e0..eac37dd3e3bae 100644 +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -171,6 +171,9 @@ struct v4l2_subdev_io_pin_config { + * @s_gpio: set GPIO pins. Very simple right now, might need to be extended with + * a direction argument if needed. + * ++ * @command: called by in-kernel drivers in order to call functions internal ++ * to subdev drivers driver that have a separate callback. ++ * + * @ioctl: called at the end of ioctl() syscall handler at the V4L2 core. + * used to provide support for private ioctls used on the driver. + * +@@ -202,6 +205,7 @@ struct v4l2_subdev_core_ops { + int (*load_fw)(struct v4l2_subdev *sd); + int (*reset)(struct v4l2_subdev *sd, u32 val); + int (*s_gpio)(struct v4l2_subdev *sd, u32 val); ++ long (*command)(struct v4l2_subdev *sd, unsigned int cmd, void *arg); + long (*ioctl)(struct v4l2_subdev *sd, unsigned int cmd, void *arg); + #ifdef CONFIG_COMPAT + long (*compat_ioctl32)(struct v4l2_subdev *sd, unsigned int cmd, +diff --git a/include/net/ip.h b/include/net/ip.h +index aad003685c31d..e8fa25280cbfd 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -34,6 +34,7 @@ + #include <net/flow.h> + #include <net/flow_dissector.h> + #include <net/netns/hash.h> ++#include <net/lwtunnel.h> + + #define IPV4_MAX_PMTU 65535U /* RFC 2675, Section 5.1 */ + #define IPV4_MIN_MTU 68 /* RFC 791 */ +@@ -408,22 +409,25 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + + /* 'forwarding = true' case should always honour route mtu */ + mtu = dst_metric_raw(dst, RTAX_MTU); +- if (mtu) +- return mtu; ++ if (!mtu) ++ mtu = min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); + +- return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); ++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + + static inline unsigned int ip_skb_dst_mtu(struct sock *sk, + const struct sk_buff *skb) + { ++ unsigned int mtu; ++ + if (!sk || !sk_fullsock(sk) || ip_sk_use_pmtu(sk)) { + bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED; + + return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding); + } + +- return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); ++ mtu = min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); ++ return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); + } + + int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, int fc_mx_len, +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index 5e26d61867b21..5c38a80cee3a2 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -243,11 +243,18 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + + static inline int ip6_skb_dst_mtu(struct sk_buff *skb) + { ++ int mtu; ++ + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? + inet6_sk(skb->sk) : NULL; + +- return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ? +- skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb)); ++ if (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) { ++ mtu = READ_ONCE(skb_dst(skb)->dev->mtu); ++ mtu -= lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); ++ } else ++ mtu = dst_mtu(skb_dst(skb)); ++ ++ return mtu; + } + + static inline bool ip6_sk_accept_pmtu(const struct sock *sk) +@@ -288,7 +295,7 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) + if (dst_metric_locked(dst, RTAX_MTU)) { + mtu = dst_metric_raw(dst, RTAX_MTU); + if (mtu) +- return mtu; ++ goto out; + } + + mtu = IPV6_MIN_MTU; +@@ -298,7 +305,8 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) + mtu = idev->cnf.mtu6; + rcu_read_unlock(); + +- return mtu; ++out: ++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + + u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr, +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index 19f8d5881b08d..2882bc7a5b4b8 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -474,7 +474,7 @@ struct sctp_af { + int saddr); + void (*from_sk) (union sctp_addr *, + struct sock *sk); +- void (*from_addr_param) (union sctp_addr *, ++ bool (*from_addr_param) (union sctp_addr *, + union sctp_addr_param *, + __be16 port, int iif); + int (*to_addr_param) (const union sctp_addr *, +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index 1ee0f30ae190b..647f1e0e726c9 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -208,12 +208,6 @@ struct iscsi_conn { + unsigned long suspend_tx; /* suspend Tx */ + unsigned long suspend_rx; /* suspend Rx */ + +- /* abort */ +- wait_queue_head_t ehwait; /* used in eh_abort() */ +- struct iscsi_tm tmhdr; +- struct timer_list tmf_timer; +- int tmf_state; /* see TMF_INITIAL, etc.*/ +- + /* negotiated params */ + unsigned max_recv_dlength; /* initiator_max_recv_dsl*/ + unsigned max_xmit_dlength; /* target_max_recv_dsl */ +@@ -283,6 +277,11 @@ struct iscsi_session { + * and recv lock. + */ + struct mutex eh_mutex; ++ /* abort */ ++ wait_queue_head_t ehwait; /* used in eh_abort() */ ++ struct iscsi_tm tmhdr; ++ struct timer_list tmf_timer; ++ int tmf_state; /* see TMF_INITIAL, etc.*/ + + /* iSCSI session-wide sequencing */ + uint32_t cmdsn; +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index b266d2a3bcb1d..484e9787d817b 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -436,6 +436,8 @@ extern void iscsi_remove_session(struct iscsi_cls_session *session); + extern void iscsi_free_session(struct iscsi_cls_session *session); + extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, + int dd_size, uint32_t cid); ++extern void iscsi_put_conn(struct iscsi_cls_conn *conn); ++extern void iscsi_get_conn(struct iscsi_cls_conn *conn); + extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn); + extern void iscsi_unblock_session(struct iscsi_cls_session *session); + extern void iscsi_block_session(struct iscsi_cls_session *session); +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index fc21d3726b591..35b11c246aeb2 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -227,7 +227,7 @@ enum tunable_id { + ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */ + /* + * Add your fresh new tunable attribute above and remember to update +- * tunable_strings[] in net/core/ethtool.c ++ * tunable_strings[] in net/ethtool/common.c + */ + __ETHTOOL_TUNABLE_COUNT, + }; +@@ -261,7 +261,7 @@ enum phy_tunable_id { + ETHTOOL_PHY_DOWNSHIFT, + /* + * Add your fresh new phy tunable attribute above and remember to update +- * phy_tunable_strings[] in net/core/ethtool.c ++ * phy_tunable_strings[] in net/ethtool/common.c + */ + __ETHTOOL_PHY_TUNABLE_COUNT, + }; +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 9a39a24f60253..d6fd362afc81f 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -31,6 +31,7 @@ + #include <linux/relay.h> + #include <linux/slab.h> + #include <linux/percpu-rwsem.h> ++#include <linux/cpuset.h> + + #include <trace/events/power.h> + #define CREATE_TRACE_POINTS +@@ -775,6 +776,52 @@ void __init cpuhp_threads_init(void) + kthread_unpark(this_cpu_read(cpuhp_state.thread)); + } + ++/* ++ * ++ * Serialize hotplug trainwrecks outside of the cpu_hotplug_lock ++ * protected region. ++ * ++ * The operation is still serialized against concurrent CPU hotplug via ++ * cpu_add_remove_lock, i.e. CPU map protection. But it is _not_ ++ * serialized against other hotplug related activity like adding or ++ * removing of state callbacks and state instances, which invoke either the ++ * startup or the teardown callback of the affected state. ++ * ++ * This is required for subsystems which are unfixable vs. CPU hotplug and ++ * evade lock inversion problems by scheduling work which has to be ++ * completed _before_ cpu_up()/_cpu_down() returns. ++ * ++ * Don't even think about adding anything to this for any new code or even ++ * drivers. It's only purpose is to keep existing lock order trainwrecks ++ * working. ++ * ++ * For cpu_down() there might be valid reasons to finish cleanups which are ++ * not required to be done under cpu_hotplug_lock, but that's a different ++ * story and would be not invoked via this. ++ */ ++static void cpu_up_down_serialize_trainwrecks(bool tasks_frozen) ++{ ++ /* ++ * cpusets delegate hotplug operations to a worker to "solve" the ++ * lock order problems. Wait for the worker, but only if tasks are ++ * _not_ frozen (suspend, hibernate) as that would wait forever. ++ * ++ * The wait is required because otherwise the hotplug operation ++ * returns with inconsistent state, which could even be observed in ++ * user space when a new CPU is brought up. The CPU plug uevent ++ * would be delivered and user space reacting on it would fail to ++ * move tasks to the newly plugged CPU up to the point where the ++ * work has finished because up to that point the newly plugged CPU ++ * is not assignable in cpusets/cgroups. On unplug that's not ++ * necessarily a visible issue, but it is still inconsistent state, ++ * which is the real problem which needs to be "fixed". This can't ++ * prevent the transient state between scheduling the work and ++ * returning from waiting for it. ++ */ ++ if (!tasks_frozen) ++ cpuset_wait_for_hotplug(); ++} ++ + #ifdef CONFIG_HOTPLUG_CPU + #ifndef arch_clear_mm_cpumask_cpu + #define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm)) +@@ -1010,6 +1057,7 @@ out: + */ + lockup_detector_cleanup(); + arch_smt_update(); ++ cpu_up_down_serialize_trainwrecks(tasks_frozen); + return ret; + } + +@@ -1145,6 +1193,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target) + out: + cpus_write_unlock(); + arch_smt_update(); ++ cpu_up_down_serialize_trainwrecks(tasks_frozen); + return ret; + } + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index acb34e9df5515..9cdbc07bb70f3 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2940,7 +2940,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- (1) +- * \Sum grq->load.weight ++ * \Sum grq->load.weight + * + * Now, because computing that sum is prohibitively expensive to compute (been + * there, done that) we approximate it with this average stuff. The average +@@ -2954,7 +2954,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->avg.load_avg + * ge->load.weight = ------------------------------ (3) +- * tg->load_avg ++ * tg->load_avg + * + * Where: tg->load_avg ~= \Sum grq->avg.load_avg + * +@@ -2970,7 +2970,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- = tg->weight (4) +- * grp->load.weight ++ * grp->load.weight + * + * That is, the sum collapses because all other CPUs are idle; the UP scenario. + * +@@ -2989,7 +2989,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- (6) +- * tg_load_avg' ++ * tg_load_avg' + * + * Where: + * +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index f80bb104c41a7..221f8e7464c5d 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -142,6 +142,13 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating); + #define WATCHDOG_INTERVAL (HZ >> 1) + #define WATCHDOG_THRESHOLD (NSEC_PER_SEC >> 4) + ++/* ++ * Maximum permissible delay between two readouts of the watchdog ++ * clocksource surrounding a read of the clocksource being validated. ++ * This delay could be due to SMIs, NMIs, or to VCPU preemptions. ++ */ ++#define WATCHDOG_MAX_SKEW (100 * NSEC_PER_USEC) ++ + static void clocksource_watchdog_work(struct work_struct *work) + { + /* +@@ -202,12 +209,45 @@ void clocksource_mark_unstable(struct clocksource *cs) + spin_unlock_irqrestore(&watchdog_lock, flags); + } + ++static ulong max_cswd_read_retries = 3; ++module_param(max_cswd_read_retries, ulong, 0644); ++ ++static bool cs_watchdog_read(struct clocksource *cs, u64 *csnow, u64 *wdnow) ++{ ++ unsigned int nretries; ++ u64 wd_end, wd_delta; ++ int64_t wd_delay; ++ ++ for (nretries = 0; nretries <= max_cswd_read_retries; nretries++) { ++ local_irq_disable(); ++ *wdnow = watchdog->read(watchdog); ++ *csnow = cs->read(cs); ++ wd_end = watchdog->read(watchdog); ++ local_irq_enable(); ++ ++ wd_delta = clocksource_delta(wd_end, *wdnow, watchdog->mask); ++ wd_delay = clocksource_cyc2ns(wd_delta, watchdog->mult, ++ watchdog->shift); ++ if (wd_delay <= WATCHDOG_MAX_SKEW) { ++ if (nretries > 1 || nretries >= max_cswd_read_retries) { ++ pr_warn("timekeeping watchdog on CPU%d: %s retried %d times before success\n", ++ smp_processor_id(), watchdog->name, nretries); ++ } ++ return true; ++ } ++ } ++ ++ pr_warn("timekeeping watchdog on CPU%d: %s read-back delay of %lldns, attempt %d, marking unstable\n", ++ smp_processor_id(), watchdog->name, wd_delay, nretries); ++ return false; ++} ++ + static void clocksource_watchdog(struct timer_list *unused) + { +- struct clocksource *cs; + u64 csnow, wdnow, cslast, wdlast, delta; +- int64_t wd_nsec, cs_nsec; + int next_cpu, reset_pending; ++ int64_t wd_nsec, cs_nsec; ++ struct clocksource *cs; + + spin_lock(&watchdog_lock); + if (!watchdog_running) +@@ -224,10 +264,11 @@ static void clocksource_watchdog(struct timer_list *unused) + continue; + } + +- local_irq_disable(); +- csnow = cs->read(cs); +- wdnow = watchdog->read(watchdog); +- local_irq_enable(); ++ if (!cs_watchdog_read(cs, &csnow, &wdnow)) { ++ /* Clock readout unreliable, so give it up. */ ++ __clocksource_unstable(cs); ++ continue; ++ } + + /* Clocksource initialized ? */ + if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) || +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 83c4e76f513af..1cb13d6368f3f 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1221,7 +1221,8 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog * + if (prog->aux->max_ctx_offset > btp->num_args * sizeof(u64)) + return -EINVAL; + +- return tracepoint_probe_register(tp, (void *)btp->bpf_func, prog); ++ return tracepoint_probe_register_may_exist(tp, (void *)btp->bpf_func, ++ prog); + } + + int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog) +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 71bc808fe03a2..895026ccfea27 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1729,8 +1729,15 @@ void tracing_reset_all_online_cpus(void) + } + } + ++/* ++ * The tgid_map array maps from pid to tgid; i.e. the value stored at index i ++ * is the tgid last observed corresponding to pid=i. ++ */ + static int *tgid_map; + ++/* The maximum valid index into tgid_map. */ ++static size_t tgid_map_max; ++ + #define SAVED_CMDLINES_DEFAULT 128 + #define NO_CMDLINE_MAP UINT_MAX + static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED; +@@ -2003,24 +2010,41 @@ void trace_find_cmdline(int pid, char comm[]) + preempt_enable(); + } + ++static int *trace_find_tgid_ptr(int pid) ++{ ++ /* ++ * Pairs with the smp_store_release in set_tracer_flag() to ensure that ++ * if we observe a non-NULL tgid_map then we also observe the correct ++ * tgid_map_max. ++ */ ++ int *map = smp_load_acquire(&tgid_map); ++ ++ if (unlikely(!map || pid > tgid_map_max)) ++ return NULL; ++ ++ return &map[pid]; ++} ++ + int trace_find_tgid(int pid) + { +- if (unlikely(!tgid_map || !pid || pid > PID_MAX_DEFAULT)) +- return 0; ++ int *ptr = trace_find_tgid_ptr(pid); + +- return tgid_map[pid]; ++ return ptr ? *ptr : 0; + } + + static int trace_save_tgid(struct task_struct *tsk) + { ++ int *ptr; ++ + /* treat recording of idle task as a success */ + if (!tsk->pid) + return 1; + +- if (unlikely(!tgid_map || tsk->pid > PID_MAX_DEFAULT)) ++ ptr = trace_find_tgid_ptr(tsk->pid); ++ if (!ptr) + return 0; + +- tgid_map[tsk->pid] = tsk->tgid; ++ *ptr = tsk->tgid; + return 1; + } + +@@ -4355,6 +4379,8 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) + + int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + { ++ int *map; ++ + if ((mask == TRACE_ITER_RECORD_TGID) || + (mask == TRACE_ITER_RECORD_CMD)) + lockdep_assert_held(&event_mutex); +@@ -4377,10 +4403,19 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + trace_event_enable_cmd_record(enabled); + + if (mask == TRACE_ITER_RECORD_TGID) { +- if (!tgid_map) +- tgid_map = kvcalloc(PID_MAX_DEFAULT + 1, +- sizeof(*tgid_map), +- GFP_KERNEL); ++ if (!tgid_map) { ++ tgid_map_max = pid_max; ++ map = kvcalloc(tgid_map_max + 1, sizeof(*tgid_map), ++ GFP_KERNEL); ++ ++ /* ++ * Pairs with smp_load_acquire() in ++ * trace_find_tgid_ptr() to ensure that if it observes ++ * the tgid_map we just allocated then it also observes ++ * the corresponding tgid_map_max value. ++ */ ++ smp_store_release(&tgid_map, map); ++ } + if (!tgid_map) { + tr->trace_flags &= ~TRACE_ITER_RECORD_TGID; + return -ENOMEM; +@@ -4752,37 +4787,16 @@ static const struct file_operations tracing_readme_fops = { + + static void *saved_tgids_next(struct seq_file *m, void *v, loff_t *pos) + { +- int *ptr = v; ++ int pid = ++(*pos); + +- if (*pos || m->count) +- ptr++; +- +- (*pos)++; +- +- for (; ptr <= &tgid_map[PID_MAX_DEFAULT]; ptr++) { +- if (trace_find_tgid(*ptr)) +- return ptr; +- } +- +- return NULL; ++ return trace_find_tgid_ptr(pid); + } + + static void *saved_tgids_start(struct seq_file *m, loff_t *pos) + { +- void *v; +- loff_t l = 0; ++ int pid = *pos; + +- if (!tgid_map) +- return NULL; +- +- v = &tgid_map[0]; +- while (l <= *pos) { +- v = saved_tgids_next(m, v, &l); +- if (!v) +- return NULL; +- } +- +- return v; ++ return trace_find_tgid_ptr(pid); + } + + static void saved_tgids_stop(struct seq_file *m, void *v) +@@ -4791,9 +4805,14 @@ static void saved_tgids_stop(struct seq_file *m, void *v) + + static int saved_tgids_show(struct seq_file *m, void *v) + { +- int pid = (int *)v - tgid_map; ++ int *entry = (int *)v; ++ int pid = entry - tgid_map; ++ int tgid = *entry; ++ ++ if (tgid == 0) ++ return SEQ_SKIP; + +- seq_printf(m, "%d %d\n", pid, trace_find_tgid(pid)); ++ seq_printf(m, "%d %d\n", pid, tgid); + return 0; + } + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 3ed2d7f7e5712..28e4ff45cb4c5 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -2211,6 +2211,13 @@ static int contains_operator(char *str) + + switch (*op) { + case '-': ++ /* ++ * Unfortunately, the modifier ".sym-offset" ++ * can confuse things. ++ */ ++ if (op - str >= 4 && !strncmp(op - 4, ".sym-offset", 11)) ++ return FIELD_OP_NONE; ++ + if (*str == '-') + field_op = FIELD_OP_UNARY_MINUS; + else +@@ -2335,7 +2342,9 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, + if (WARN_ON_ONCE(!field)) + goto out; + +- if (is_string_field(field)) { ++ /* Pointers to strings are just pointers and dangerous to dereference */ ++ if (is_string_field(field) && ++ (field->filter_type != FILTER_PTR_STRING)) { + flags |= HIST_FIELD_FL_STRING; + + hist_field->size = MAX_FILTER_STR_VAL; +@@ -4735,8 +4744,6 @@ static inline void add_to_key(char *compound_key, void *key, + field = key_field->field; + if (field->filter_type == FILTER_DYN_STRING) + size = *(u32 *)(rec + field->offset) >> 16; +- else if (field->filter_type == FILTER_PTR_STRING) +- size = strlen(key); + else if (field->filter_type == FILTER_STATIC_STRING) + size = field->size; + +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c +index d5ce692319128..625297a9cae26 100644 +--- a/kernel/tracepoint.c ++++ b/kernel/tracepoint.c +@@ -284,7 +284,8 @@ static void *func_remove(struct tracepoint_func **funcs, + * Add the probe function to a tracepoint. + */ + static int tracepoint_add_func(struct tracepoint *tp, +- struct tracepoint_func *func, int prio) ++ struct tracepoint_func *func, int prio, ++ bool warn) + { + struct tracepoint_func *old, *tp_funcs; + int ret; +@@ -299,7 +300,7 @@ static int tracepoint_add_func(struct tracepoint *tp, + lockdep_is_held(&tracepoints_mutex)); + old = func_add(&tp_funcs, func, prio); + if (IS_ERR(old)) { +- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM); ++ WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); + return PTR_ERR(old); + } + +@@ -350,6 +351,32 @@ static int tracepoint_remove_func(struct tracepoint *tp, + return 0; + } + ++/** ++ * tracepoint_probe_register_prio_may_exist - Connect a probe to a tracepoint with priority ++ * @tp: tracepoint ++ * @probe: probe handler ++ * @data: tracepoint data ++ * @prio: priority of this function over other registered functions ++ * ++ * Same as tracepoint_probe_register_prio() except that it will not warn ++ * if the tracepoint is already registered. ++ */ ++int tracepoint_probe_register_prio_may_exist(struct tracepoint *tp, void *probe, ++ void *data, int prio) ++{ ++ struct tracepoint_func tp_func; ++ int ret; ++ ++ mutex_lock(&tracepoints_mutex); ++ tp_func.func = probe; ++ tp_func.data = data; ++ tp_func.prio = prio; ++ ret = tracepoint_add_func(tp, &tp_func, prio, false); ++ mutex_unlock(&tracepoints_mutex); ++ return ret; ++} ++EXPORT_SYMBOL_GPL(tracepoint_probe_register_prio_may_exist); ++ + /** + * tracepoint_probe_register_prio - Connect a probe to a tracepoint with priority + * @tp: tracepoint +@@ -373,7 +400,7 @@ int tracepoint_probe_register_prio(struct tracepoint *tp, void *probe, + tp_func.func = probe; + tp_func.data = data; + tp_func.prio = prio; +- ret = tracepoint_add_func(tp, &tp_func, prio); ++ ret = tracepoint_add_func(tp, &tp_func, prio, true); + mutex_unlock(&tracepoints_mutex); + return ret; + } +diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c +index 1b0baf3008ea3..b202aa864c48a 100644 +--- a/lib/decompress_unlz4.c ++++ b/lib/decompress_unlz4.c +@@ -115,6 +115,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + error("data corrupted"); + goto exit_2; + } ++ } else if (size < 4) { ++ /* empty or end-of-file */ ++ goto exit_3; + } + + chunksize = get_unaligned_le32(inp); +@@ -128,6 +131,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + continue; + } + ++ if (!fill && chunksize == 0) { ++ /* empty or end-of-file */ ++ goto exit_3; ++ } + + if (posp) + *posp += 4; +@@ -187,6 +194,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + } + } + ++exit_3: + ret = 0; + exit_2: + if (!input) +diff --git a/lib/iov_iter.c b/lib/iov_iter.c +index acd7b97c16f24..39e6e978029c1 100644 +--- a/lib/iov_iter.c ++++ b/lib/iov_iter.c +@@ -417,7 +417,7 @@ int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes) + int err; + struct iovec v; + +- if (!(i->type & (ITER_BVEC|ITER_KVEC))) { ++ if (iter_is_iovec(i)) { + iterate_iovec(i, bytes, v, iov, skip, ({ + err = fault_in_pages_readable(v.iov_base, v.iov_len); + if (unlikely(err)) +diff --git a/lib/kstrtox.c b/lib/kstrtox.c +index 661a1e807bd1a..1a02b87b19c7e 100644 +--- a/lib/kstrtox.c ++++ b/lib/kstrtox.c +@@ -39,20 +39,22 @@ const char *_parse_integer_fixup_radix(const char *s, unsigned int *base) + + /* + * Convert non-negative integer string representation in explicitly given radix +- * to an integer. ++ * to an integer. A maximum of max_chars characters will be converted. ++ * + * Return number of characters consumed maybe or-ed with overflow bit. + * If overflow occurs, result integer (incorrect) is still returned. + * + * Don't you dare use this function. + */ +-unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p) ++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *p, ++ size_t max_chars) + { + unsigned long long res; + unsigned int rv; + + res = 0; + rv = 0; +- while (1) { ++ while (max_chars--) { + unsigned int c = *s; + unsigned int lc = c | 0x20; /* don't tolower() this line */ + unsigned int val; +@@ -82,6 +84,11 @@ unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long + return rv; + } + ++unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p) ++{ ++ return _parse_integer_limit(s, base, p, INT_MAX); ++} ++ + static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res) + { + unsigned long long _res; +diff --git a/lib/kstrtox.h b/lib/kstrtox.h +index 3b4637bcd2540..158c400ca8658 100644 +--- a/lib/kstrtox.h ++++ b/lib/kstrtox.h +@@ -4,6 +4,8 @@ + + #define KSTRTOX_OVERFLOW (1U << 31) + const char *_parse_integer_fixup_radix(const char *s, unsigned int *base); ++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *res, ++ size_t max_chars); + unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *res); + + #endif +diff --git a/lib/seq_buf.c b/lib/seq_buf.c +index 6aabb609dd871..562e53c93b7b2 100644 +--- a/lib/seq_buf.c ++++ b/lib/seq_buf.c +@@ -228,8 +228,10 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem, + + WARN_ON(s->size == 0); + ++ BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS); ++ + while (len) { +- start_len = min(len, HEX_CHARS - 1); ++ start_len = min(len, MAX_MEMHEX_BYTES); + #ifdef __BIG_ENDIAN + for (i = 0, j = 0; i < start_len; i++) { + #else +@@ -242,12 +244,14 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem, + break; + + /* j increments twice per loop */ +- len -= j / 2; + hex[j++] = ' '; + + seq_buf_putmem(s, hex, j); + if (seq_buf_has_overflowed(s)) + return -1; ++ ++ len -= start_len; ++ data += start_len; + } + return 0; + } +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 812e59e13fe61..c2619510636eb 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -47,6 +47,31 @@ + #include <linux/string_helpers.h> + #include "kstrtox.h" + ++static unsigned long long simple_strntoull(const char *startp, size_t max_chars, ++ char **endp, unsigned int base) ++{ ++ const char *cp; ++ unsigned long long result = 0ULL; ++ size_t prefix_chars; ++ unsigned int rv; ++ ++ cp = _parse_integer_fixup_radix(startp, &base); ++ prefix_chars = cp - startp; ++ if (prefix_chars < max_chars) { ++ rv = _parse_integer_limit(cp, base, &result, max_chars - prefix_chars); ++ /* FIXME */ ++ cp += (rv & ~KSTRTOX_OVERFLOW); ++ } else { ++ /* Field too short for prefix + digit, skip over without converting */ ++ cp = startp + max_chars; ++ } ++ ++ if (endp) ++ *endp = (char *)cp; ++ ++ return result; ++} ++ + /** + * simple_strtoull - convert a string to an unsigned long long + * @cp: The start of the string +@@ -57,18 +82,7 @@ + */ + unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base) + { +- unsigned long long result; +- unsigned int rv; +- +- cp = _parse_integer_fixup_radix(cp, &base); +- rv = _parse_integer(cp, base, &result); +- /* FIXME */ +- cp += (rv & ~KSTRTOX_OVERFLOW); +- +- if (endp) +- *endp = (char *)cp; +- +- return result; ++ return simple_strntoull(cp, INT_MAX, endp, base); + } + EXPORT_SYMBOL(simple_strtoull); + +@@ -103,6 +117,21 @@ long simple_strtol(const char *cp, char **endp, unsigned int base) + } + EXPORT_SYMBOL(simple_strtol); + ++static long long simple_strntoll(const char *cp, size_t max_chars, char **endp, ++ unsigned int base) ++{ ++ /* ++ * simple_strntoull() safely handles receiving max_chars==0 in the ++ * case cp[0] == '-' && max_chars == 1. ++ * If max_chars == 0 we can drop through and pass it to simple_strntoull() ++ * and the content of *cp is irrelevant. ++ */ ++ if (*cp == '-' && max_chars > 0) ++ return -simple_strntoull(cp + 1, max_chars - 1, endp, base); ++ ++ return simple_strntoull(cp, max_chars, endp, base); ++} ++ + /** + * simple_strtoll - convert a string to a signed long long + * @cp: The start of the string +@@ -113,10 +142,7 @@ EXPORT_SYMBOL(simple_strtol); + */ + long long simple_strtoll(const char *cp, char **endp, unsigned int base) + { +- if (*cp == '-') +- return -simple_strtoull(cp + 1, endp, base); +- +- return simple_strtoull(cp, endp, base); ++ return simple_strntoll(cp, INT_MAX, endp, base); + } + EXPORT_SYMBOL(simple_strtoll); + +@@ -3117,25 +3143,13 @@ int vsscanf(const char *buf, const char *fmt, va_list args) + break; + + if (is_sign) +- val.s = qualifier != 'L' ? +- simple_strtol(str, &next, base) : +- simple_strtoll(str, &next, base); ++ val.s = simple_strntoll(str, ++ field_width >= 0 ? field_width : INT_MAX, ++ &next, base); + else +- val.u = qualifier != 'L' ? +- simple_strtoul(str, &next, base) : +- simple_strtoull(str, &next, base); +- +- if (field_width > 0 && next - str > field_width) { +- if (base == 0) +- _parse_integer_fixup_radix(str, &base); +- while (next - str > field_width) { +- if (is_sign) +- val.s = div_s64(val.s, base); +- else +- val.u = div_u64(val.u, base); +- --next; +- } +- } ++ val.u = simple_strntoull(str, ++ field_width >= 0 ? field_width : INT_MAX, ++ &next, base); + + switch (qualifier) { + case 'H': /* that's 'hh' in format */ +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 0a970be24a28d..2152e85891d1f 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -250,8 +250,8 @@ static int __init default_bdi_init(void) + { + int err; + +- bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_FREEZABLE | +- WQ_UNBOUND | WQ_SYSFS, 0); ++ bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_UNBOUND | ++ WQ_SYSFS, 0); + if (!bdi_wq) + return -ENOMEM; + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 4400957d8e4e2..800d7de32af8f 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1692,7 +1692,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, + * If other processes are mapping this page, we couldn't discard + * the page unless they all do MADV_FREE so let's skip the page. + */ +- if (page_mapcount(page) != 1) ++ if (total_mapcount(page) != 1) + goto out; + + if (!trylock_page(page)) +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 219cdbb476fb7..e9902bf0f137e 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1609,14 +1609,6 @@ int hci_dev_do_close(struct hci_dev *hdev) + + BT_DBG("%s %p", hdev->name, hdev); + +- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && +- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && +- test_bit(HCI_UP, &hdev->flags)) { +- /* Execute vendor specific shutdown routine */ +- if (hdev->shutdown) +- hdev->shutdown(hdev); +- } +- + cancel_delayed_work(&hdev->power_off); + + hci_request_cancel_all(hdev); +@@ -1690,6 +1682,14 @@ int hci_dev_do_close(struct hci_dev *hdev) + clear_bit(HCI_INIT, &hdev->flags); + } + ++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && ++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ test_bit(HCI_UP, &hdev->flags)) { ++ /* Execute vendor specific shutdown routine */ ++ if (hdev->shutdown) ++ hdev->shutdown(hdev); ++ } ++ + /* flush cmd work */ + flush_work(&hdev->cmd_work); + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 2e2cad58b6ccf..45cc864cf2b38 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4986,8 +4986,19 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb) + + BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); + +- if (ev->status) ++ if (ev->status) { ++ struct adv_info *adv; ++ ++ adv = hci_find_adv_instance(hdev, ev->handle); ++ if (!adv) ++ return; ++ ++ /* Remove advertising as it has been terminated */ ++ hci_remove_adv_instance(hdev, ev->handle); ++ mgmt_advertising_removed(NULL, hdev, ev->handle); ++ + return; ++ } + + conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle)); + if (conn) { +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 5340b1097afb7..d0ec0e3369096 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -219,12 +219,15 @@ static u8 mgmt_status_table[] = { + MGMT_STATUS_TIMEOUT, /* Instant Passed */ + MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ + MGMT_STATUS_FAILED, /* Transaction Collision */ ++ MGMT_STATUS_FAILED, /* Reserved for future use */ + MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ + MGMT_STATUS_REJECTED, /* QoS Rejected */ + MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ + MGMT_STATUS_REJECTED, /* Insufficient Security */ + MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ ++ MGMT_STATUS_FAILED, /* Reserved for future use */ + MGMT_STATUS_BUSY, /* Role Switch Pending */ ++ MGMT_STATUS_FAILED, /* Reserved for future use */ + MGMT_STATUS_FAILED, /* Slot Violation */ + MGMT_STATUS_FAILED, /* Role Switch Failed */ + MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ +@@ -6468,6 +6471,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, + for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { + cur_len = data[i]; + ++ if (!cur_len) ++ continue; ++ + if (data[i + 1] == EIR_FLAGS && + (!is_adv_data || flags_managed(adv_flags))) + return false; +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 6a362da211e1b..3504c3acd38f6 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1791,7 +1791,9 @@ static void br_multicast_pim(struct net_bridge *br, + pim_hdr_type(pimhdr) != PIM_TYPE_HELLO) + return; + ++ spin_lock(&br->multicast_lock); + br_multicast_mark_router(br, port); ++ spin_unlock(&br->multicast_lock); + } + + static int br_multicast_ipv4_rcv(struct net_bridge *br, +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 9f30d7b4389a8..e75d3fd7da4f9 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -828,6 +828,7 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh, + bcm_rx_handler, op); + + list_del(&op->list); ++ synchronize_rcu(); + bcm_remove_op(op); + return 1; /* done */ + } +@@ -1584,9 +1585,13 @@ static int bcm_release(struct socket *sock) + REGMASK(op->can_id), + bcm_rx_handler, op); + +- bcm_remove_op(op); + } + ++ synchronize_rcu(); ++ ++ list_for_each_entry_safe(op, next, &bo->rx_ops, list) ++ bcm_remove_op(op); ++ + #if IS_ENABLED(CONFIG_PROC_FS) + /* remove procfs entry */ + if (net->can.bcmproc_dir && bo->bcm_proc_read) +diff --git a/net/can/gw.c b/net/can/gw.c +index bd2161470e456..9c20663235292 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -494,6 +494,7 @@ static int cgw_notifier(struct notifier_block *nb, + if (gwj->src.dev == dev || gwj->dst.dev == dev) { + hlist_del(&gwj->list); + cgw_unregister_filter(net, gwj); ++ synchronize_rcu(); + kmem_cache_free(cgw_cache, gwj); + } + } +@@ -941,6 +942,7 @@ static void cgw_remove_all_jobs(struct net *net) + hlist_for_each_entry_safe(gwj, nx, &net->can.cgw_list, list) { + hlist_del(&gwj->list); + cgw_unregister_filter(net, gwj); ++ synchronize_rcu(); + kmem_cache_free(cgw_cache, gwj); + } + } +@@ -1010,6 +1012,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, + + hlist_del(&gwj->list); + cgw_unregister_filter(net, gwj); ++ synchronize_rcu(); + kmem_cache_free(cgw_cache, gwj); + err = 0; + break; +diff --git a/net/core/dev.c b/net/core/dev.c +index 7803bd9628dc2..722ae0b57f3fd 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5931,11 +5931,18 @@ EXPORT_SYMBOL(napi_schedule_prep); + * __napi_schedule_irqoff - schedule for receive + * @n: entry to schedule + * +- * Variant of __napi_schedule() assuming hard irqs are masked ++ * Variant of __napi_schedule() assuming hard irqs are masked. ++ * ++ * On PREEMPT_RT enabled kernels this maps to __napi_schedule() ++ * because the interrupt disabled assumption might not be true ++ * due to force-threaded interrupts and spinlock substitution. + */ + void __napi_schedule_irqoff(struct napi_struct *n) + { +- ____napi_schedule(this_cpu_ptr(&softnet_data), n); ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT)) ++ ____napi_schedule(this_cpu_ptr(&softnet_data), n); ++ else ++ __napi_schedule(n); + } + EXPORT_SYMBOL(__napi_schedule_irqoff); + +diff --git a/net/core/filter.c b/net/core/filter.c +index 01561268d2166..01496c7cb42d7 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2639,8 +2639,6 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb) + shinfo->gso_type |= SKB_GSO_TCPV6; + } + +- /* Due to IPv6 header, MSS needs to be downgraded. */ +- skb_decrease_gso_size(shinfo, len_diff); + /* Header must be checked, and gso_segs recomputed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; +@@ -2680,8 +2678,6 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb) + shinfo->gso_type |= SKB_GSO_TCPV4; + } + +- /* Due to IPv4 header, MSS can be upgraded. */ +- skb_increase_gso_size(shinfo, len_diff); + /* Header must be checked, and gso_segs recomputed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index b96aa88087be1..70e5e9e5d8351 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -353,6 +353,8 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, + fl4.flowi4_proto = 0; + fl4.fl4_sport = 0; + fl4.fl4_dport = 0; ++ } else { ++ swap(fl4.fl4_sport, fl4.fl4_dport); + } + + if (fib_lookup(net, &fl4, &res, 0)) +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index e411c42d84289..e63905f7f6f95 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -940,7 +940,7 @@ static int __ip_append_data(struct sock *sk, + unsigned int datalen; + unsigned int fraglen; + unsigned int fraggap; +- unsigned int alloclen; ++ unsigned int alloclen, alloc_extra; + unsigned int pagedlen; + struct sk_buff *skb_prev; + alloc_new_skb: +@@ -960,35 +960,39 @@ alloc_new_skb: + fraglen = datalen + fragheaderlen; + pagedlen = 0; + ++ alloc_extra = hh_len + 15; ++ alloc_extra += exthdrlen; ++ ++ /* The last fragment gets additional space at tail. ++ * Note, with MSG_MORE we overallocate on fragments, ++ * because we have no idea what fragment will be ++ * the last. ++ */ ++ if (datalen == length + fraggap) ++ alloc_extra += rt->dst.trailer_len; ++ + if ((flags & MSG_MORE) && + !(rt->dst.dev->features&NETIF_F_SG)) + alloclen = mtu; +- else if (!paged) ++ else if (!paged && ++ (fraglen + alloc_extra < SKB_MAX_ALLOC || ++ !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { + alloclen = min_t(int, fraglen, MAX_HEADER); + pagedlen = fraglen - alloclen; + } + +- alloclen += exthdrlen; +- +- /* The last fragment gets additional space at tail. +- * Note, with MSG_MORE we overallocate on fragments, +- * because we have no idea what fragment will be +- * the last. +- */ +- if (datalen == length + fraggap) +- alloclen += rt->dst.trailer_len; ++ alloclen += alloc_extra; + + if (transhdrlen) { +- skb = sock_alloc_send_skb(sk, +- alloclen + hh_len + 15, ++ skb = sock_alloc_send_skb(sk, alloclen, + (flags & MSG_DONTWAIT), &err); + } else { + skb = NULL; + if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= + 2 * sk->sk_sndbuf) +- skb = alloc_skb(alloclen + hh_len + 15, ++ skb = alloc_skb(alloclen, + sk->sk_allocation); + if (unlikely(!skb)) + err = -ENOBUFS; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 484bd646df5fa..1491d239385e5 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1318,7 +1318,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + mtu = dst_metric_raw(dst, RTAX_MTU); + + if (mtu) +- return mtu; ++ goto out; + + mtu = READ_ONCE(dst->dev->mtu); + +@@ -1327,6 +1327,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + mtu = 576; + } + ++out: + mtu = min_t(unsigned int, mtu, IP_MAX_MTU); + + return mtu - lwtunnel_headroom(dst->lwtstate, mtu); +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 20291c2036fcd..fe2497ae4523f 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -138,18 +138,23 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + len -= 2; + + while (len > 0) { +- int optlen = nh[off + 1] + 2; +- int i; ++ int optlen, i; + +- switch (nh[off]) { +- case IPV6_TLV_PAD1: +- optlen = 1; ++ if (nh[off] == IPV6_TLV_PAD1) { + padlen++; + if (padlen > 7) + goto bad; +- break; ++ off++; ++ len--; ++ continue; ++ } ++ if (len < 2) ++ goto bad; ++ optlen = nh[off + 1] + 2; ++ if (optlen > len) ++ goto bad; + +- case IPV6_TLV_PADN: ++ if (nh[off] == IPV6_TLV_PADN) { + /* RFC 2460 states that the purpose of PadN is + * to align the containing header to multiples + * of 8. 7 is therefore the highest valid value. +@@ -166,12 +171,7 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + if (nh[off + i] != 0) + goto bad; + } +- break; +- +- default: /* Other TLV code so scan list */ +- if (optlen > len) +- goto bad; +- ++ } else { + tlv_count++; + if (tlv_count > max_count) + goto bad; +@@ -191,7 +191,6 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + return false; + + padlen = 0; +- break; + } + off += optlen; + len -= optlen; +@@ -309,7 +308,7 @@ fail_and_free: + #endif + + if (ip6_parse_tlv(tlvprocdestopt_lst, skb, +- init_net.ipv6.sysctl.max_dst_opts_cnt)) { ++ net->ipv6.sysctl.max_dst_opts_cnt)) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -848,7 +847,7 @@ fail_and_free: + + opt->flags |= IP6SKB_HOPBYHOP; + if (ip6_parse_tlv(tlvprochopopt_lst, skb, +- init_net.ipv6.sysctl.max_hbh_opts_cnt)) { ++ net->ipv6.sysctl.max_hbh_opts_cnt)) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index e1bb7db88483d..aa8f19f852cc7 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1394,7 +1394,7 @@ emsgsize: + unsigned int datalen; + unsigned int fraglen; + unsigned int fraggap; +- unsigned int alloclen; ++ unsigned int alloclen, alloc_extra; + unsigned int pagedlen; + alloc_new_skb: + /* There's no room in the current skb */ +@@ -1421,17 +1421,28 @@ alloc_new_skb: + fraglen = datalen + fragheaderlen; + pagedlen = 0; + ++ alloc_extra = hh_len; ++ alloc_extra += dst_exthdrlen; ++ alloc_extra += rt->dst.trailer_len; ++ ++ /* We just reserve space for fragment header. ++ * Note: this may be overallocation if the message ++ * (without MSG_MORE) fits into the MTU. ++ */ ++ alloc_extra += sizeof(struct frag_hdr); ++ + if ((flags & MSG_MORE) && + !(rt->dst.dev->features&NETIF_F_SG)) + alloclen = mtu; +- else if (!paged) ++ else if (!paged && ++ (fraglen + alloc_extra < SKB_MAX_ALLOC || ++ !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { + alloclen = min_t(int, fraglen, MAX_HEADER); + pagedlen = fraglen - alloclen; + } +- +- alloclen += dst_exthdrlen; ++ alloclen += alloc_extra; + + if (datalen != length + fraggap) { + /* +@@ -1441,30 +1452,21 @@ alloc_new_skb: + datalen += rt->dst.trailer_len; + } + +- alloclen += rt->dst.trailer_len; + fraglen = datalen + fragheaderlen; + +- /* +- * We just reserve space for fragment header. +- * Note: this may be overallocation if the message +- * (without MSG_MORE) fits into the MTU. +- */ +- alloclen += sizeof(struct frag_hdr); +- + copy = datalen - transhdrlen - fraggap - pagedlen; + if (copy < 0) { + err = -EINVAL; + goto error; + } + if (transhdrlen) { +- skb = sock_alloc_send_skb(sk, +- alloclen + hh_len, ++ skb = sock_alloc_send_skb(sk, alloclen, + (flags & MSG_DONTWAIT), &err); + } else { + skb = NULL; + if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= + 2 * sk->sk_sndbuf) +- skb = alloc_skb(alloclen + hh_len, ++ skb = alloc_skb(alloclen, + sk->sk_allocation); + if (unlikely(!skb)) + err = -ENOBUFS; +diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c +index 868ae23dbae19..3829b565c645d 100644 +--- a/net/ipv6/output_core.c ++++ b/net/ipv6/output_core.c +@@ -14,29 +14,11 @@ static u32 __ipv6_select_ident(struct net *net, + const struct in6_addr *dst, + const struct in6_addr *src) + { +- const struct { +- struct in6_addr dst; +- struct in6_addr src; +- } __aligned(SIPHASH_ALIGNMENT) combined = { +- .dst = *dst, +- .src = *src, +- }; +- u32 hash, id; +- +- /* Note the following code is not safe, but this is okay. */ +- if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key))) +- get_random_bytes(&net->ipv4.ip_id_key, +- sizeof(net->ipv4.ip_id_key)); +- +- hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key); +- +- /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve, +- * set the hight order instead thus minimizing possible future +- * collisions. +- */ +- id = ip_idents_reserve(hash, 1); +- if (unlikely(!id)) +- id = 1 << 31; ++ u32 id; ++ ++ do { ++ id = prandom_u32(); ++ } while (!id); + + return id; + } +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 71c6a462277fa..3a907ba7f7634 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -1344,11 +1344,6 @@ static void ieee80211_send_null_response(struct sta_info *sta, int tid, + struct ieee80211_tx_info *info; + struct ieee80211_chanctx_conf *chanctx_conf; + +- /* Don't send NDPs when STA is connected HE */ +- if (sdata->vif.type == NL80211_IFTYPE_STATION && +- !(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE)) +- return; +- + if (qos) { + fc = cpu_to_le16(IEEE80211_FTYPE_DATA | + IEEE80211_STYPE_QOS_NULLFUNC | +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index a940c9fd9045e..64e69d6683cab 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -45,6 +45,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, + unsigned int offset = 0; + int err; + ++ if (pkt->skb->protocol != htons(ETH_P_IPV6)) ++ goto err; ++ + err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); + if (priv->flags & NFT_EXTHDR_F_PRESENT) { + *dest = (err >= 0); +diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c +index a003533ff4d93..e259454b6a643 100644 +--- a/net/netfilter/nft_osf.c ++++ b/net/netfilter/nft_osf.c +@@ -22,6 +22,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs, + struct tcphdr _tcph; + const char *os_name; + ++ if (pkt->tprot != IPPROTO_TCP) { ++ regs->verdict.code = NFT_BREAK; ++ return; ++ } ++ + tcp = skb_header_pointer(skb, ip_hdrlen(skb), + sizeof(struct tcphdr), &_tcph); + if (!tcp) { +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index 95980154ef02c..b97ab1198b03f 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -30,6 +30,12 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr, + __be16 tport = 0; + struct sock *sk; + ++ if (pkt->tprot != IPPROTO_TCP && ++ pkt->tprot != IPPROTO_UDP) { ++ regs->verdict.code = NFT_BREAK; ++ return; ++ } ++ + hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); + if (!hp) { + regs->verdict.code = NFT_BREAK; +@@ -91,7 +97,8 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr, + + memset(&taddr, 0, sizeof(taddr)); + +- if (!pkt->tprot_set) { ++ if (pkt->tprot != IPPROTO_TCP && ++ pkt->tprot != IPPROTO_UDP) { + regs->verdict.code = NFT_BREAK; + return; + } +diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c +index 21e0095b1d142..71ba69cb50c9b 100644 +--- a/net/netlabel/netlabel_mgmt.c ++++ b/net/netlabel/netlabel_mgmt.c +@@ -90,6 +90,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = { + static int netlbl_mgmt_add_common(struct genl_info *info, + struct netlbl_audit *audit_info) + { ++ void *pmap = NULL; + int ret_val = -EINVAL; + struct netlbl_domaddr_map *addrmap = NULL; + struct cipso_v4_doi *cipsov4 = NULL; +@@ -189,6 +190,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + ret_val = -ENOMEM; + goto add_free_addrmap; + } ++ pmap = map; + map->list.addr = addr->s_addr & mask->s_addr; + map->list.mask = mask->s_addr; + map->list.valid = 1; +@@ -197,10 +199,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + map->def.cipso = cipsov4; + + ret_val = netlbl_af4list_add(&map->list, &addrmap->list4); +- if (ret_val != 0) { +- kfree(map); +- goto add_free_addrmap; +- } ++ if (ret_val != 0) ++ goto add_free_map; + + entry->family = AF_INET; + entry->def.type = NETLBL_NLTYPE_ADDRSELECT; +@@ -237,6 +237,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + ret_val = -ENOMEM; + goto add_free_addrmap; + } ++ pmap = map; + map->list.addr = *addr; + map->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; + map->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; +@@ -249,10 +250,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + map->def.calipso = calipso; + + ret_val = netlbl_af6list_add(&map->list, &addrmap->list6); +- if (ret_val != 0) { +- kfree(map); +- goto add_free_addrmap; +- } ++ if (ret_val != 0) ++ goto add_free_map; + + entry->family = AF_INET6; + entry->def.type = NETLBL_NLTYPE_ADDRSELECT; +@@ -262,10 +261,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + + ret_val = netlbl_domhsh_add(entry, audit_info); + if (ret_val != 0) +- goto add_free_addrmap; ++ goto add_free_map; + + return 0; + ++add_free_map: ++ kfree(pmap); + add_free_addrmap: + kfree(addrmap); + add_doi_put_def: +diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c +index e41bc5ecaa092..4070197f95439 100644 +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -276,7 +276,7 @@ static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp) + int i, err = 0; + + cp->perfect = kcalloc(cp->hash, sizeof(struct tcindex_filter_result), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (!cp->perfect) + return -ENOMEM; + +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index bb1a9c11fc549..a93402fe1a9f8 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -497,11 +497,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + + if (cl->qdisc != &noop_qdisc) + qdisc_hash_add(cl->qdisc, true); +- sch_tree_lock(sch); +- qdisc_class_hash_insert(&q->clhash, &cl->common); +- sch_tree_unlock(sch); +- +- qdisc_class_hash_grow(sch, &q->clhash); + + set_change_agg: + sch_tree_lock(sch); +@@ -519,8 +514,11 @@ set_change_agg: + } + if (existing) + qfq_deact_rm_from_agg(q, cl); ++ else ++ qdisc_class_hash_insert(&q->clhash, &cl->common); + qfq_add_to_agg(q, new_agg, cl); + sch_tree_unlock(sch); ++ qdisc_class_hash_grow(sch, &q->clhash); + + *arg = (unsigned long)cl; + return 0; +diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c +index 38d01cfb313e5..f8a2832456728 100644 +--- a/net/sctp/bind_addr.c ++++ b/net/sctp/bind_addr.c +@@ -285,22 +285,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, + rawaddr = (union sctp_addr_param *)raw_addr_list; + + af = sctp_get_af_specific(param_type2af(param->type)); +- if (unlikely(!af)) { ++ if (unlikely(!af) || ++ !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { + retval = -EINVAL; +- sctp_bind_addr_clean(bp); +- break; ++ goto out_err; + } + +- af->from_addr_param(&addr, rawaddr, htons(port), 0); + if (sctp_bind_addr_state(bp, &addr) != -1) + goto next; + retval = sctp_add_bind_addr(bp, &addr, sizeof(addr), + SCTP_ADDR_SRC, gfp); +- if (retval) { ++ if (retval) + /* Can't finish building the list, clean up. */ +- sctp_bind_addr_clean(bp); +- break; +- } ++ goto out_err; + + next: + len = ntohs(param->length); +@@ -309,6 +306,12 @@ next: + } + + return retval; ++ ++out_err: ++ if (retval) ++ sctp_bind_addr_clean(bp); ++ ++ return retval; + } + + /******************************************************************** +diff --git a/net/sctp/input.c b/net/sctp/input.c +index 3dd900e42b85c..203aaefd8d049 100644 +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -1088,7 +1088,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, + if (!af) + continue; + +- af->from_addr_param(paddr, params.addr, sh->source, 0); ++ if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) ++ continue; + + asoc = __sctp_lookup_association(net, laddr, paddr, transportp); + if (asoc) +@@ -1131,7 +1132,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( + if (unlikely(!af)) + return NULL; + +- af->from_addr_param(&paddr, param, peer_port, 0); ++ if (af->from_addr_param(&paddr, param, peer_port, 0)) ++ return NULL; + + return __sctp_lookup_association(net, laddr, &paddr, transportp); + } +@@ -1202,7 +1204,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, + + ch = (struct sctp_chunkhdr *)ch_end; + chunk_num++; +- } while (ch_end < skb_tail_pointer(skb)); ++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); + + return asoc; + } +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 4cc5739244935..fc82617b60765 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -542,15 +542,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) + } + + /* Initialize a sctp_addr from an address parameter. */ +-static void sctp_v6_from_addr_param(union sctp_addr *addr, ++static bool sctp_v6_from_addr_param(union sctp_addr *addr, + union sctp_addr_param *param, + __be16 port, int iif) + { ++ if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param)) ++ return false; ++ + addr->v6.sin6_family = AF_INET6; + addr->v6.sin6_port = port; + addr->v6.sin6_flowinfo = 0; /* BUG */ + addr->v6.sin6_addr = param->v6.addr; + addr->v6.sin6_scope_id = iif; ++ ++ return true; + } + + /* Initialize an address parameter from a sctp_addr and return the length +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index af054f38341b9..dd51256582556 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -268,14 +268,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) + } + + /* Initialize a sctp_addr from an address parameter. */ +-static void sctp_v4_from_addr_param(union sctp_addr *addr, ++static bool sctp_v4_from_addr_param(union sctp_addr *addr, + union sctp_addr_param *param, + __be16 port, int iif) + { ++ if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param)) ++ return false; ++ + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; + memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); ++ ++ return true; + } + + /* Initialize an address parameter from a sctp_addr and return the length +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index dc51e14f568ee..a1ca070e36b0a 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -2352,11 +2352,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk, + + /* Process the initialization parameters. */ + sctp_walk_params(param, peer_init, init_hdr.params) { +- if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS || +- param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { ++ if (!src_match && ++ (param.p->type == SCTP_PARAM_IPV4_ADDRESS || ++ param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { + af = sctp_get_af_specific(param_type2af(param.p->type)); +- af->from_addr_param(&addr, param.addr, +- chunk->sctp_hdr->source, 0); ++ if (!af->from_addr_param(&addr, param.addr, ++ chunk->sctp_hdr->source, 0)) ++ continue; + if (sctp_cmp_addr_exact(sctp_source(chunk), &addr)) + src_match = 1; + } +@@ -2537,7 +2539,8 @@ static int sctp_process_param(struct sctp_association *asoc, + break; + do_addr_param: + af = sctp_get_af_specific(param_type2af(param.p->type)); +- af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0)) ++ break; + scope = sctp_scope(peer_addr); + if (sctp_in_scope(net, &addr, scope)) + if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED)) +@@ -2634,15 +2637,13 @@ do_addr_param: + addr_param = param.v + sizeof(struct sctp_addip_param); + + af = sctp_get_af_specific(param_type2af(addr_param->p.type)); +- if (af == NULL) ++ if (!af) + break; + +- af->from_addr_param(&addr, addr_param, +- htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, addr_param, ++ htons(asoc->peer.port), 0)) ++ break; + +- /* if the address is invalid, we can't process it. +- * XXX: see spec for what to do. +- */ + if (!af->addr_valid(&addr, NULL, NULL)) + break; + +@@ -3059,7 +3060,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, + if (unlikely(!af)) + return SCTP_ERROR_DNS_FAILED; + +- af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0)) ++ return SCTP_ERROR_DNS_FAILED; + + /* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast + * or multicast address. +@@ -3336,7 +3338,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc, + + /* We have checked the packet before, so we do not check again. */ + af = sctp_get_af_specific(param_type2af(addr_param->p.type)); +- af->from_addr_param(&addr, addr_param, htons(bp->port), 0); ++ if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0)) ++ return; + + switch (asconf_param->param_hdr.type) { + case SCTP_PARAM_ADD_IP: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index e2808586c9e61..e339f8da1b0a7 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -498,11 +498,21 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q + struct list_head *q; + struct rpc_task *task; + ++ /* ++ * Service the privileged queue. ++ */ ++ q = &queue->tasks[RPC_NR_PRIORITY - 1]; ++ if (queue->maxpriority > RPC_PRIORITY_PRIVILEGED && !list_empty(q)) { ++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list); ++ goto out; ++ } ++ + /* + * Service a batch of tasks from a single owner. + */ + q = &queue->tasks[queue->priority]; +- if (!list_empty(q) && --queue->nr) { ++ if (!list_empty(q) && queue->nr) { ++ queue->nr--; + task = list_first_entry(q, struct rpc_task, u.tk_wait.list); + goto out; + } +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index aceafec612a8f..2d31fce5c2185 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1225,7 +1225,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + + if (signal_pending(current)) { + err = sock_intr_errno(timeout); +- sk->sk_state = TCP_CLOSE; ++ sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; + sock->state = SS_UNCONNECTED; + vsock_transport_cancel_pkt(vsk); + goto out_wait; +diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c +index 33bef22e44e95..b379a03716539 100644 +--- a/net/wireless/wext-spy.c ++++ b/net/wireless/wext-spy.c +@@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev, + return -EOPNOTSUPP; + + /* Just do it */ +- memcpy(&(spydata->spy_thr_low), &(threshold->low), +- 2 * sizeof(struct iw_quality)); ++ spydata->spy_thr_low = threshold->low; ++ spydata->spy_thr_high = threshold->high; + + /* Clear flag */ + memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under)); +@@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device * dev, + return -EOPNOTSUPP; + + /* Just do it */ +- memcpy(&(threshold->low), &(spydata->spy_thr_low), +- 2 * sizeof(struct iw_quality)); ++ threshold->low = spydata->spy_thr_low; ++ threshold->high = spydata->spy_thr_high; + + return 0; + } +@@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev, + memcpy(threshold.addr.sa_data, address, ETH_ALEN); + threshold.addr.sa_family = ARPHRD_ETHER; + /* Copy stats */ +- memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality)); ++ threshold.qual = *wstats; + /* Copy also thresholds */ +- memcpy(&(threshold.low), &(spydata->spy_thr_low), +- 2 * sizeof(struct iw_quality)); ++ threshold.low = spydata->spy_thr_low; ++ threshold.high = spydata->spy_thr_high; + + /* Send event to user space */ + wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold); +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 0b80c79077154..f94abe1fdd58f 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -579,6 +579,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, + + copy_from_user_state(x, p); + ++ if (attrs[XFRMA_ENCAP]) { ++ x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), ++ sizeof(*x->encap), GFP_KERNEL); ++ if (x->encap == NULL) ++ goto error; ++ } ++ ++ if (attrs[XFRMA_COADDR]) { ++ x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), ++ sizeof(*x->coaddr), GFP_KERNEL); ++ if (x->coaddr == NULL) ++ goto error; ++ } ++ + if (attrs[XFRMA_SA_EXTRA_FLAGS]) + x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); + +@@ -599,23 +613,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, + attrs[XFRMA_ALG_COMP]))) + goto error; + +- if (attrs[XFRMA_ENCAP]) { +- x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), +- sizeof(*x->encap), GFP_KERNEL); +- if (x->encap == NULL) +- goto error; +- } +- + if (attrs[XFRMA_TFCPAD]) + x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); + +- if (attrs[XFRMA_COADDR]) { +- x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), +- sizeof(*x->coaddr), GFP_KERNEL); +- if (x->coaddr == NULL) +- goto error; +- } +- + xfrm_mark_get(attrs, &x->mark); + + xfrm_smark_init(attrs, &x->props.smark); +diff --git a/samples/bpf/xdp_redirect_user.c b/samples/bpf/xdp_redirect_user.c +index 81a69e36cb788..0f96a26b6ec57 100644 +--- a/samples/bpf/xdp_redirect_user.c ++++ b/samples/bpf/xdp_redirect_user.c +@@ -146,5 +146,5 @@ int main(int argc, char **argv) + poll_stats(2, ifindex_out); + + out: +- return 0; ++ return ret; + } +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 651c0127c00de..d11a61f7b2009 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -523,7 +523,7 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) + } + + /* +- * evm_inode_init_security - initializes security.evm ++ * evm_inode_init_security - initializes security.evm HMAC value + */ + int evm_inode_init_security(struct inode *inode, + const struct xattr *lsm_xattr, +@@ -532,7 +532,8 @@ int evm_inode_init_security(struct inode *inode, + struct evm_ima_xattr_data *xattr_data; + int rc; + +- if (!evm_key_loaded() || !evm_protected_xattr(lsm_xattr->name)) ++ if (!(evm_initialized & EVM_INIT_HMAC) || ++ !evm_protected_xattr(lsm_xattr->name)) + return 0; + + xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS); +diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c +index f112ca593adc1..c5c44203a59c3 100644 +--- a/security/integrity/evm/evm_secfs.c ++++ b/security/integrity/evm/evm_secfs.c +@@ -71,12 +71,13 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf, + static ssize_t evm_write_key(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { +- int i, ret; ++ unsigned int i; ++ int ret; + + if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP_COMPLETE)) + return -EPERM; + +- ret = kstrtoint_from_user(buf, count, 0, &i); ++ ret = kstrtouint_from_user(buf, count, 0, &i); + + if (ret) + return ret; +@@ -85,12 +86,12 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, + if (!i || (i & ~EVM_INIT_MASK) != 0) + return -EINVAL; + +- /* Don't allow a request to freshly enable metadata writes if +- * keys are loaded. ++ /* ++ * Don't allow a request to enable metadata writes if ++ * an HMAC key is loaded. + */ + if ((i & EVM_ALLOW_METADATA_WRITES) && +- ((evm_initialized & EVM_KEY_MASK) != 0) && +- !(evm_initialized & EVM_ALLOW_METADATA_WRITES)) ++ (evm_initialized & EVM_INIT_HMAC) != 0) + return -EPERM; + + if (i & EVM_INIT_HMAC) { +diff --git a/security/selinux/avc.c b/security/selinux/avc.c +index d52be7b9f08c8..717a4be771ab0 100644 +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -366,26 +366,27 @@ static struct avc_xperms_decision_node + struct avc_xperms_decision_node *xpd_node; + struct extended_perms_decision *xpd; + +- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); ++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, ++ GFP_NOWAIT | __GFP_NOWARN); + if (!xpd_node) + return NULL; + + xpd = &xpd_node->xpd; + if (which & XPERMS_ALLOWED) { + xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_NOWAIT); ++ GFP_NOWAIT | __GFP_NOWARN); + if (!xpd->allowed) + goto error; + } + if (which & XPERMS_AUDITALLOW) { + xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_NOWAIT); ++ GFP_NOWAIT | __GFP_NOWARN); + if (!xpd->auditallow) + goto error; + } + if (which & XPERMS_DONTAUDIT) { + xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_NOWAIT); ++ GFP_NOWAIT | __GFP_NOWARN); + if (!xpd->dontaudit) + goto error; + } +@@ -413,7 +414,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) + { + struct avc_xperms_node *xp_node; + +- xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); ++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN); + if (!xp_node) + return xp_node; + INIT_LIST_HEAD(&xp_node->xpd_head); +@@ -569,7 +570,7 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc) + { + struct avc_node *node; + +- node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); ++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN); + if (!node) + goto out; + +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 4f8c1a272df07..009e83ee2d002 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -883,6 +883,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + if (format == SMK_FIXED24_FMT && + (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) + return -EINVAL; ++ if (count > PAGE_SIZE) ++ return -EINVAL; + + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) +diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c +index ca50ff4447964..d8b227e6d4cfd 100644 +--- a/sound/ac97/bus.c ++++ b/sound/ac97/bus.c +@@ -523,7 +523,7 @@ static int ac97_bus_remove(struct device *dev) + struct ac97_codec_driver *adrv = to_ac97_driver(dev->driver); + int ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index a2ed164d80b49..f7b26b1d7084e 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -37,7 +37,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.4 pro ++ * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC) + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -83,7 +83,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) and d.2 Pro ++ * Mackie d.2 (optional FireWire card with DM1000 ASIC) + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +@@ -109,6 +109,7 @@ config SND_BEBOB + * M-Audio Ozonic/NRV10/ProfireLightBridge + * M-Audio FireWire 1814/ProjectMix IO + * Digidesign Mbox 2 Pro ++ * ToneWeal FW66 + + To compile this driver as a module, choose M here: the module + will be called snd-bebob. +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 2bcfeee758538..eac3ff24e55d1 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -60,6 +60,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS); + #define VEN_MAUDIO1 0x00000d6c + #define VEN_MAUDIO2 0x000007f5 + #define VEN_DIGIDESIGN 0x00a07e ++#define OUI_SHOUYO 0x002327 + + #define MODEL_FOCUSRITE_SAFFIRE_BOTH 0x00000000 + #define MODEL_MAUDIO_AUDIOPHILE_BOTH 0x00010060 +@@ -414,7 +415,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). ++ // Mackie, d.2 (optional Firewire card with DM1000). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +@@ -513,6 +514,8 @@ static const struct ieee1394_device_id bebob_id_table[] = { + &maudio_special_spec), + /* Digidesign Mbox 2 Pro */ + SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal), ++ // Toneweal FW66. ++ SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal), + /* IDs are unknown but able to be supported */ + /* Apogee, Mini-ME Firewire */ + /* Apogee, Mini-DAC Firewire */ +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 3c9aa797747b0..59c05c5dc1cbf 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -400,7 +400,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.4 pro: Unknown ++ * d.2 pro/d.4 pro (built-in card): Unknown + * U.420: Unknown + * U.420d: Unknown + */ +diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c +index 6b8c46942efb4..75b3d76eb852e 100644 +--- a/sound/isa/cmi8330.c ++++ b/sound/isa/cmi8330.c +@@ -564,7 +564,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev) + } + if (acard->sb->hardware != SB_HW_16) { + snd_printk(KERN_ERR PFX "SB16 not found during probe\n"); +- return err; ++ return -ENODEV; + } + + snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */ +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 2e00b64ef13bf..b3eecde0b6125 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p) + card = p->chip->card; + + down_write(&card->controls_rwsem); +- if (p->qsound_switch) ++ if (p->qsound_switch) { + snd_ctl_remove(card, p->qsound_switch); +- if (p->qsound_space) ++ p->qsound_switch = NULL; ++ } ++ if (p->qsound_space) { + snd_ctl_remove(card, p->qsound_space); ++ p->qsound_space = NULL; ++ } + up_write(&card->controls_rwsem); + + /* cancel pending transfer of QSound parameters */ +diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c +index e85fb04ec7be6..b567c4bdae000 100644 +--- a/sound/pci/hda/hda_tegra.c ++++ b/sound/pci/hda/hda_tegra.c +@@ -363,6 +363,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev) + unsigned short gcap; + int irq_id = platform_get_irq(pdev, 0); + ++ if (irq_id < 0) ++ return irq_id; ++ + err = hda_tegra_init_chip(chip, pdev); + if (err) + return err; +diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c +index 33c6be9fb388e..7c70ba5e2540d 100644 +--- a/sound/ppc/powermac.c ++++ b/sound/ppc/powermac.c +@@ -90,7 +90,11 @@ static int snd_pmac_probe(struct platform_device *devptr) + sprintf(card->shortname, "PowerMac %s", name_ext); + sprintf(card->longname, "%s (Dev %d) Sub-frame %d", + card->shortname, chip->device_id, chip->subframe); +- if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0) ++ err = snd_pmac_tumbler_init(chip); ++ if (err < 0) ++ goto __error; ++ err = snd_pmac_tumbler_post_init(); ++ if (err < 0) + goto __error; + break; + case PMAC_AWACS: +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index d88c1d995036c..99cc731505769 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -211,6 +211,7 @@ struct atmel_i2s_dev { + unsigned int fmt; + const struct atmel_i2s_gck_param *gck_param; + const struct atmel_i2s_caps *caps; ++ int clk_use_no; + }; + + static irqreturn_t atmel_i2s_interrupt(int irq, void *dev_id) +@@ -332,9 +333,16 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream, + { + struct atmel_i2s_dev *dev = snd_soc_dai_get_drvdata(dai); + bool is_playback = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK); +- unsigned int mr = 0; ++ unsigned int mr = 0, mr_mask; + int ret; + ++ mr_mask = ATMEL_I2SC_MR_FORMAT_MASK | ATMEL_I2SC_MR_MODE_MASK | ++ ATMEL_I2SC_MR_DATALENGTH_MASK; ++ if (is_playback) ++ mr_mask |= ATMEL_I2SC_MR_TXMONO; ++ else ++ mr_mask |= ATMEL_I2SC_MR_RXMONO; ++ + switch (dev->fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: + mr |= ATMEL_I2SC_MR_FORMAT_I2S; +@@ -413,7 +421,7 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- return regmap_write(dev->regmap, ATMEL_I2SC_MR, mr); ++ return regmap_update_bits(dev->regmap, ATMEL_I2SC_MR, mr_mask, mr); + } + + static int atmel_i2s_switch_mck_generator(struct atmel_i2s_dev *dev, +@@ -506,18 +514,28 @@ static int atmel_i2s_trigger(struct snd_pcm_substream *substream, int cmd, + is_master = (mr & ATMEL_I2SC_MR_MODE_MASK) == ATMEL_I2SC_MR_MODE_MASTER; + + /* If master starts, enable the audio clock. */ +- if (is_master && mck_enabled) +- err = atmel_i2s_switch_mck_generator(dev, true); +- if (err) +- return err; ++ if (is_master && mck_enabled) { ++ if (!dev->clk_use_no) { ++ err = atmel_i2s_switch_mck_generator(dev, true); ++ if (err) ++ return err; ++ } ++ dev->clk_use_no++; ++ } + + err = regmap_write(dev->regmap, ATMEL_I2SC_CR, cr); + if (err) + return err; + + /* If master stops, disable the audio clock. */ +- if (is_master && !mck_enabled) +- err = atmel_i2s_switch_mck_generator(dev, false); ++ if (is_master && !mck_enabled) { ++ if (dev->clk_use_no == 1) { ++ err = atmel_i2s_switch_mck_generator(dev, false); ++ if (err) ++ return err; ++ } ++ dev->clk_use_no--; ++ } + + return err; + } +diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h +index bcaf4f22408d6..5a46e7d4f9a31 100644 +--- a/sound/soc/codecs/cs42l42.h ++++ b/sound/soc/codecs/cs42l42.h +@@ -81,7 +81,7 @@ + #define CS42L42_HP_PDN_SHIFT 3 + #define CS42L42_HP_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT) + #define CS42L42_ADC_PDN_SHIFT 2 +-#define CS42L42_ADC_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT) ++#define CS42L42_ADC_PDN_MASK (1 << CS42L42_ADC_PDN_SHIFT) + #define CS42L42_PDN_ALL_SHIFT 0 + #define CS42L42_PDN_ALL_MASK (1 << CS42L42_PDN_ALL_SHIFT) + +diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c +index 53344a3b7a608..864718ef874f1 100644 +--- a/sound/soc/hisilicon/hi6210-i2s.c ++++ b/sound/soc/hisilicon/hi6210-i2s.c +@@ -110,18 +110,15 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream, + + for (n = 0; n < i2s->clocks; n++) { + ret = clk_prepare_enable(i2s->clk[n]); +- if (ret) { +- while (n--) +- clk_disable_unprepare(i2s->clk[n]); +- return ret; +- } ++ if (ret) ++ goto err_unprepare_clk; + } + + ret = clk_set_rate(i2s->clk[CLK_I2S_BASE], 49152000); + if (ret) { + dev_err(i2s->dev, "%s: setting 49.152MHz base rate failed %d\n", + __func__, ret); +- return ret; ++ goto err_unprepare_clk; + } + + /* enable clock before frequency division */ +@@ -173,6 +170,11 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream, + hi6210_write_reg(i2s, HII2S_SW_RST_N, val); + + return 0; ++ ++err_unprepare_clk: ++ while (n--) ++ clk_disable_unprepare(i2s->clk[n]); ++ return ret; + } + + static void hi6210_i2s_shutdown(struct snd_pcm_substream *substream, +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index 549a137878a65..dc08260031ee0 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -318,7 +318,6 @@ static void rsnd_adg_set_ssi_clk(struct rsnd_mod *ssi_mod, u32 val) + int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate) + { + struct rsnd_adg *adg = rsnd_priv_to_adg(priv); +- struct clk *clk; + int i; + int sel_table[] = { + [CLKA] = 0x1, +@@ -331,10 +330,9 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate) + * find suitable clock from + * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI. + */ +- for_each_rsnd_clk(clk, adg, i) { ++ for (i = 0; i < CLKMAX; i++) + if (rate == adg->clk_rate[i]) + return sel_table[i]; +- } + + /* + * find divided clock from BRGA/BRGB +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 595fe20bbc6d3..8531b490f6f66 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3510,7 +3510,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card, + if (!routes) { + dev_err(card->dev, + "ASoC: Could not allocate DAPM route table\n"); +- return -EINVAL; ++ return -ENOMEM; + } + + for (i = 0; i < num_routes; i++) { +diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c +index 98d87801d57a7..6fea7417332e2 100644 +--- a/sound/soc/tegra/tegra_alc5632.c ++++ b/sound/soc/tegra/tegra_alc5632.c +@@ -137,6 +137,7 @@ static struct snd_soc_dai_link tegra_alc5632_dai = { + + static struct snd_soc_card snd_soc_tegra_alc5632 = { + .name = "tegra-alc5632", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_alc5632_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_max98090.c b/sound/soc/tegra/tegra_max98090.c +index cf142e2c7bd79..10998d703dcd1 100644 +--- a/sound/soc/tegra/tegra_max98090.c ++++ b/sound/soc/tegra/tegra_max98090.c +@@ -188,6 +188,7 @@ static struct snd_soc_dai_link tegra_max98090_dai = { + + static struct snd_soc_card snd_soc_tegra_max98090 = { + .name = "tegra-max98090", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_max98090_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c +index fc81b48aa9d6a..e0cbe85b6d461 100644 +--- a/sound/soc/tegra/tegra_rt5640.c ++++ b/sound/soc/tegra/tegra_rt5640.c +@@ -138,6 +138,7 @@ static struct snd_soc_dai_link tegra_rt5640_dai = { + + static struct snd_soc_card snd_soc_tegra_rt5640 = { + .name = "tegra-rt5640", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_rt5640_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_rt5677.c b/sound/soc/tegra/tegra_rt5677.c +index 7081f15302cc6..e285793d2b1ca 100644 +--- a/sound/soc/tegra/tegra_rt5677.c ++++ b/sound/soc/tegra/tegra_rt5677.c +@@ -181,6 +181,7 @@ static struct snd_soc_dai_link tegra_rt5677_dai = { + + static struct snd_soc_card snd_soc_tegra_rt5677 = { + .name = "tegra-rt5677", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_rt5677_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c +index 901457da25ec3..e6cbc89eaa920 100644 +--- a/sound/soc/tegra/tegra_sgtl5000.c ++++ b/sound/soc/tegra/tegra_sgtl5000.c +@@ -103,6 +103,7 @@ static struct snd_soc_dai_link tegra_sgtl5000_dai = { + + static struct snd_soc_card snd_soc_tegra_sgtl5000 = { + .name = "tegra-sgtl5000", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_sgtl5000_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_wm8753.c b/sound/soc/tegra/tegra_wm8753.c +index 23a810e3bacc0..3fa0e991308a6 100644 +--- a/sound/soc/tegra/tegra_wm8753.c ++++ b/sound/soc/tegra/tegra_wm8753.c +@@ -110,6 +110,7 @@ static struct snd_soc_dai_link tegra_wm8753_dai = { + + static struct snd_soc_card snd_soc_tegra_wm8753 = { + .name = "tegra-wm8753", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_wm8753_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c +index 301850df368d6..8edcd82038d8d 100644 +--- a/sound/soc/tegra/tegra_wm8903.c ++++ b/sound/soc/tegra/tegra_wm8903.c +@@ -226,6 +226,7 @@ static struct snd_soc_dai_link tegra_wm8903_dai = { + + static struct snd_soc_card snd_soc_tegra_wm8903 = { + .name = "tegra-wm8903", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_wm8903_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/tegra_wm9712.c b/sound/soc/tegra/tegra_wm9712.c +index 864a3345972e5..7175e6eea9113 100644 +--- a/sound/soc/tegra/tegra_wm9712.c ++++ b/sound/soc/tegra/tegra_wm9712.c +@@ -59,6 +59,7 @@ static struct snd_soc_dai_link tegra_wm9712_dai = { + + static struct snd_soc_card snd_soc_tegra_wm9712 = { + .name = "tegra-wm9712", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &tegra_wm9712_dai, + .num_links = 1, +diff --git a/sound/soc/tegra/trimslice.c b/sound/soc/tegra/trimslice.c +index 99bcdd979eb29..47ef6d6f4ae1c 100644 +--- a/sound/soc/tegra/trimslice.c ++++ b/sound/soc/tegra/trimslice.c +@@ -103,6 +103,7 @@ static struct snd_soc_dai_link trimslice_tlv320aic23_dai = { + + static struct snd_soc_card snd_soc_trimslice = { + .name = "tegra-trimslice", ++ .driver_name = "tegra", + .owner = THIS_MODULE, + .dai_link = &trimslice_tlv320aic23_dai, + .num_links = 1, +diff --git a/sound/usb/format.c b/sound/usb/format.c +index a3daf93c565aa..01ba7a939ac4b 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -206,9 +206,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof + continue; + /* C-Media CM6501 mislabels its 96 kHz altsetting */ + /* Terratec Aureon 7.1 USB C-Media 6206, too */ ++ /* Ozone Z90 USB C-Media, too */ + if (rate == 48000 && nr_rates == 1 && + (chip->usb_id == USB_ID(0x0d8c, 0x0201) || + chip->usb_id == USB_ID(0x0d8c, 0x0102) || ++ chip->usb_id == USB_ID(0x0d8c, 0x0078) || + chip->usb_id == USB_ID(0x0ccd, 0x00b1)) && + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 4ad6eeb43476b..6c8cdce8156be 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -3260,8 +3260,9 @@ static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer, + struct usb_mixer_elem_list *list) + { + struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); +- static const char * const val_types[] = {"BOOLEAN", "INV_BOOLEAN", +- "S8", "U8", "S16", "U16"}; ++ static const char * const val_types[] = { ++ "BOOLEAN", "INV_BOOLEAN", "S8", "U8", "S16", "U16", "S32", "U32", ++ }; + snd_iprintf(buffer, " Info: id=%i, control=%i, cmask=0x%x, " + "channels=%i, type=\"%s\"\n", cval->head.id, + cval->control, cval->cmask, cval->channels, +diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c +index d15a62be6cf0f..37610144f6b08 100644 +--- a/tools/bpf/bpftool/main.c ++++ b/tools/bpf/bpftool/main.c +@@ -291,8 +291,10 @@ static int do_batch(int argc, char **argv) + n_argc = make_args(buf, n_argv, BATCH_ARG_NB_MAX, lines); + if (!n_argc) + continue; +- if (n_argc < 0) ++ if (n_argc < 0) { ++ err = n_argc; + goto err_close; ++ } + + if (json_output) { + jsonw_start_object(json_wtr); +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index 2344d86cd7786..46ec9a1bb94cc 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -500,6 +500,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + goto errout; + } + ++ err = -ENOMEM; + if (asprintf(&pipe_template, "%s -emit-llvm | %s -march=bpf %s -filetype=obj -o -", + template, llc_path, opts) < 0) { + pr_err("ERROR:\tnot enough memory to setup command line\n"); +@@ -520,6 +521,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + + pr_debug("llvm compiling command template: %s\n", template); + ++ err = -ENOMEM; + if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0) + goto errout; + +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +index 8341d7778d5ed..87630d44fb4c7 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +@@ -50,8 +50,6 @@ static int no_handler_test(void) + + event_close(&event); + +- dump_ebb_state(); +- + /* The real test is that we never took an EBB at 0x0 */ + + return 0; +diff --git a/tools/testing/selftests/timers/rtcpie.c b/tools/testing/selftests/timers/rtcpie.c +index 47b5bad1b3933..4ef2184f15588 100644 +--- a/tools/testing/selftests/timers/rtcpie.c ++++ b/tools/testing/selftests/timers/rtcpie.c +@@ -18,6 +18,8 @@ + #include <stdlib.h> + #include <errno.h> + ++#include "../kselftest.h" ++ + /* + * This expects the new RTC class driver framework, working with + * clocks that will often not be clones of what the PC-AT had. +@@ -35,8 +37,14 @@ int main(int argc, char **argv) + switch (argc) { + case 2: + rtc = argv[1]; +- /* FALLTHROUGH */ ++ break; + case 1: ++ fd = open(default_rtc, O_RDONLY); ++ if (fd == -1) { ++ printf("Default RTC %s does not exist. Test Skipped!\n", default_rtc); ++ exit(KSFT_SKIP); ++ } ++ close(fd); + break; + default: + fprintf(stderr, "usage: rtctest [rtcdev] [d]\n"); +diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c +index b8778960da106..27661302a6985 100644 +--- a/tools/testing/selftests/x86/protection_keys.c ++++ b/tools/testing/selftests/x86/protection_keys.c +@@ -613,7 +613,6 @@ int alloc_random_pkey(void) + int nr_alloced = 0; + int random_index; + memset(alloced_pkeys, 0, sizeof(alloced_pkeys)); +- srand((unsigned int)time(NULL)); + + /* allocate every possible key and make a note of which ones we got */ + max_nr_pkey_allocs = NR_PKEYS; +@@ -1479,6 +1478,8 @@ int main(void) + { + int nr_iterations = 22; + ++ srand((unsigned int)time(NULL)); ++ + setup_handlers(); + + printf("has pku: %d\n", cpu_has_pku()); |