[gentoo-commits] proj/linux-patches:5.4 commit in: /

[Mike Pagano]

commit:     51ba13cea055f3e6f4021f30f2d6a813139afb4f
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 29 13:07:12 2021 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 29 13:07:12 2021 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=51ba13ce

Linux patch 5.4.169

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1168_linux-5.4.169.patch | 1471 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1475 insertions(+)

diff --git a/0000_README b/0000_README
index e5039e81..d8d56e36 100644
--- a/0000_README
+++ b/0000_README
@@ -715,6 +715,10 @@ Patch:  1167_linux-5.4.168.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.4.168
 
+Patch:  1168_linux-5.4.169.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.4.169
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1168_linux-5.4.169.patch b/1168_linux-5.4.169.patch
new file mode 100644
index 00000000..4d1e8296
--- /dev/null
+++ b/1168_linux-5.4.169.patch
@@ -0,0 +1,1471 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index b11e1fd95ee5f..e7f71df9daf1c 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2112,8 +2112,12 @@
+ 			Default is 1 (enabled)
+ 
+ 	kvm-intel.emulate_invalid_guest_state=
+-			[KVM,Intel] Enable emulation of invalid guest states
+-			Default is 0 (disabled)
++			[KVM,Intel] Disable emulation of invalid guest state.
++			Ignored if kvm-intel.enable_unrestricted_guest=1, as
++			guest state is never invalid for unrestricted guests.
++			This param doesn't apply to nested guests (L2), as KVM
++			never emulates invalid L2 guest state.
++			Default is 1 (enabled)
+ 
+ 	kvm-intel.flexpriority=
+ 			[KVM,Intel] Disable FlexPriority feature (TPR shadow).
+diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst
+index 953315987c06e..03851cbe637ce 100644
+--- a/Documentation/hwmon/lm90.rst
++++ b/Documentation/hwmon/lm90.rst
+@@ -123,6 +123,18 @@ Supported chips:
+ 
+ 	       http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497
+ 
++  * Maxim MAX6654
++
++    Prefix: 'max6654'
++
++    Addresses scanned: I2C 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
++
++			   0x4c, 0x4d and 0x4e
++
++    Datasheet: Publicly available at the Maxim website
++
++	       https://www.maximintegrated.com/en/products/sensors/MAX6654.html
++
+   * Maxim MAX6657
+ 
+     Prefix: 'max6657'
+@@ -253,6 +265,16 @@ Supported chips:
+ 
+ 	       http://www.ti.com/litv/pdf/sbos686
+ 
++  * Texas Instruments TMP461
++
++    Prefix: 'tmp461'
++
++    Addresses scanned: I2C 0x48 through 0x4F
++
++    Datasheet: Publicly available at TI website
++
++	       https://www.ti.com/lit/gpn/tmp461
++
+ Author: Jean Delvare <jdelvare@××××.de>
+ 
+ 
+@@ -301,6 +323,13 @@ ADT7461, ADT7461A, NCT1008:
+   * Extended temperature range (breaks compatibility)
+   * Lower resolution for remote temperature
+ 
++MAX6654:
++  * Better local resolution
++  * Selectable address
++  * Remote sensor type selection
++  * Extended temperature range
++  * Extended resolution only available when conversion rate <= 1 Hz
++
+ MAX6657 and MAX6658:
+   * Better local resolution
+   * Remote sensor type selection
+@@ -336,8 +365,8 @@ SA56004X:
+ 
+ All temperature values are given in degrees Celsius. Resolution
+ is 1.0 degree for the local temperature, 0.125 degree for the remote
+-temperature, except for the MAX6657, MAX6658 and MAX6659 which have a
+-resolution of 0.125 degree for both temperatures.
++temperature, except for the MAX6654, MAX6657, MAX6658 and MAX6659 which have
++a resolution of 0.125 degree for both temperatures.
+ 
+ Each sensor has its own high and low limits, plus a critical limit.
+ Additionally, there is a relative hysteresis value common to both critical
+diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
+index e3abfbd32f71e..b020e6ce6dd49 100644
+--- a/Documentation/networking/bonding.txt
++++ b/Documentation/networking/bonding.txt
+@@ -191,11 +191,12 @@ ad_actor_sys_prio
+ ad_actor_system
+ 
+ 	In an AD system, this specifies the mac-address for the actor in
+-	protocol packet exchanges (LACPDUs). The value cannot be NULL or
+-	multicast. It is preferred to have the local-admin bit set for this
+-	mac but driver does not enforce it. If the value is not given then
+-	system defaults to using the masters' mac address as actors' system
+-	address.
++	protocol packet exchanges (LACPDUs). The value cannot be a multicast
++	address. If the all-zeroes MAC is specified, bonding will internally
++	use the MAC of the bond itself. It is preferred to have the
++	local-admin bit set for this mac but driver does not enforce it. If
++	the value is not given then system defaults to using the masters'
++	mac address as actors' system address.
+ 
+ 	This parameter has effect only in 802.3ad mode and is available through
+ 	SysFs interface.
+diff --git a/Makefile b/Makefile
+index c23f5b17d239f..151fd24540125 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 4
+-SUBLEVEL = 168
++SUBLEVEL = 169
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index b62d74a2c73a5..4937d514318ec 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -596,11 +596,9 @@ call_fpe:
+ 	tstne	r0, #0x04000000			@ bit 26 set on both ARM and Thumb-2
+ 	reteq	lr
+ 	and	r8, r0, #0x00000f00		@ mask out CP number
+- THUMB(	lsr	r8, r8, #8		)
+ 	mov	r7, #1
+-	add	r6, r10, #TI_USED_CP
+- ARM(	strb	r7, [r6, r8, lsr #8]	)	@ set appropriate used_cp[]
+- THUMB(	strb	r7, [r6, r8]		)	@ set appropriate used_cp[]
++	add	r6, r10, r8, lsr #8		@ add used_cp[] array offset first
++	strb	r7, [r6, #TI_USED_CP]		@ set appropriate used_cp[]
+ #ifdef CONFIG_IWMMXT
+ 	@ Test if we need to give access to iWMMXt coprocessors
+ 	ldr	r5, [r10, #TI_FLAGS]
+@@ -609,7 +607,7 @@ call_fpe:
+ 	bcs	iwmmxt_task_enable
+ #endif
+  ARM(	add	pc, pc, r8, lsr #6	)
+- THUMB(	lsl	r8, r8, #2		)
++ THUMB(	lsr	r8, r8, #6		)
+  THUMB(	add	pc, r8			)
+ 	nop
+ 
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+index db6ea7b58999b..19f930f43936e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+@@ -72,7 +72,7 @@
+ 	pinctrl-0 = <&emac_rgmii_pins>;
+ 	phy-supply = <&reg_gmac_3v3>;
+ 	phy-handle = <&ext_rgmii_phy>;
+-	phy-mode = "rgmii";
++	phy-mode = "rgmii-id";
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index a37814cb66c76..8b616aada6492 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -478,7 +478,7 @@ lws_start:
+ 	extrd,u	%r1,PSW_W_BIT,1,%r1
+ 	/* sp must be aligned on 4, so deposit the W bit setting into
+ 	 * the bottom of sp temporarily */
+-	or,ev	%r1,%r30,%r30
++	or,od	%r1,%r30,%r30
+ 
+ 	/* Clip LWS number to a 32-bit value for 32-bit processes */
+ 	depdi	0, 31, 32, %r20
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index ea85f23d9e227..1ae7c20f54691 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -1375,8 +1375,8 @@ static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd)
+ #endif
+ #endif
+ 
+-#define PKRU_AD_BIT 0x1
+-#define PKRU_WD_BIT 0x2
++#define PKRU_AD_BIT 0x1u
++#define PKRU_WD_BIT 0x2u
+ #define PKRU_BITS_PER_PKEY 2
+ 
+ #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 8a93d5a494fff..ad2e6d55d4a59 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -2938,7 +2938,7 @@ cleanup_bmc_device(struct kref *ref)
+ 	 * with removing the device attributes while reading a device
+ 	 * attribute.
+ 	 */
+-	schedule_work(&bmc->remove_work);
++	queue_work(remove_work_wq, &bmc->remove_work);
+ }
+ 
+ /*
+@@ -5156,22 +5156,27 @@ static int ipmi_init_msghandler(void)
+ 	if (initialized)
+ 		goto out;
+ 
+-	init_srcu_struct(&ipmi_interfaces_srcu);
+-
+-	timer_setup(&ipmi_timer, ipmi_timeout, 0);
+-	mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+-
+-	atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++	rv = init_srcu_struct(&ipmi_interfaces_srcu);
++	if (rv)
++		goto out;
+ 
+ 	remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");
+ 	if (!remove_work_wq) {
+ 		pr_err("unable to create ipmi-msghandler-remove-wq workqueue");
+ 		rv = -ENOMEM;
+-		goto out;
++		goto out_wq;
+ 	}
+ 
++	timer_setup(&ipmi_timer, ipmi_timeout, 0);
++	mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
++
++	atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++
+ 	initialized = true;
+ 
++out_wq:
++	if (rv)
++		cleanup_srcu_struct(&ipmi_interfaces_srcu);
+ out:
+ 	mutex_unlock(&ipmi_interfaces_mutex);
+ 	return rv;
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 8ac390c2b5147..bb42a1c92cae5 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -1704,6 +1704,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 		}
+ 	}
+ 
++	ssif_info->client = client;
++	i2c_set_clientdata(client, ssif_info);
++
+ 	rv = ssif_check_and_remove(client, ssif_info);
+ 	/* If rv is 0 and addr source is not SI_ACPI, continue probing */
+ 	if (!rv && ssif_info->addr_source == SI_ACPI) {
+@@ -1724,9 +1727,6 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 		ipmi_addr_src_to_str(ssif_info->addr_source),
+ 		client->addr, client->adapter->name, slave_addr);
+ 
+-	ssif_info->client = client;
+-	i2c_set_clientdata(client, ssif_info);
+-
+ 	/* Now check for system interface capabilities */
+ 	msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+ 	msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD;
+@@ -1926,6 +1926,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 
+ 		dev_err(&ssif_info->client->dev,
+ 			"Unable to start IPMI SSIF: %d\n", rv);
++		i2c_set_clientdata(client, NULL);
+ 		kfree(ssif_info);
+ 	}
+ 	kfree(resp);
+diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
+index b7172c48ef9f0..7c907939bfae1 100644
+--- a/drivers/hid/hid-holtek-mouse.c
++++ b/drivers/hid/hid-holtek-mouse.c
+@@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static int holtek_mouse_probe(struct hid_device *hdev,
+ 			      const struct hid_device_id *id)
+ {
++	int ret;
++
+ 	if (!hid_is_usb(hdev))
+ 		return -EINVAL;
++
++	ret = hid_parse(hdev);
++	if (ret) {
++		hid_err(hdev, "hid parse failed: %d\n", ret);
++		return ret;
++	}
++
++	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++	if (ret) {
++		hid_err(hdev, "hw start failed: %d\n", ret);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 13a6b4afb4b36..049563d503b68 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1132,10 +1132,11 @@ config SENSORS_LM90
+ 	help
+ 	  If you say yes here you get support for National Semiconductor LM90,
+ 	  LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
+-	  Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+-	  MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
+-	  Winbond/Nuvoton W83L771W/G/AWG/ASG, Philips SA56004, GMT G781, and
+-	  Texas Instruments TMP451 sensor chips.
++	  Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658,
++	  MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696,
++	  ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG,
++	  Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461
++	  sensor chips.
+ 
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called lm90.
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 9b3c9f390ef81..9abb4507f572b 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -35,6 +35,15 @@
+  * explicitly as max6659, or if its address is not 0x4c.
+  * These chips lack the remote temperature offset feature.
+  *
++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be
++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar
++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature
++ * limits. Extended range is available by setting the configuration register
++ * accordingly, and is done during initialization. Extended precision is only
++ * available at conversion rates of 1 Hz and slower. Note that extended
++ * precision is not enabled by default, as this driver initializes all chips
++ * to 2 Hz by design.
++ *
+  * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
+  * MAX6692 chips made by Maxim.  These are again similar to the LM86,
+  * but they use unsigned temperature values and can report temperatures
+@@ -61,10 +70,10 @@
+  * This driver also supports the G781 from GMT. This device is compatible
+  * with the ADM1032.
+  *
+- * This driver also supports TMP451 from Texas Instruments. This device is
+- * supported in both compatibility and extended mode. It's mostly compatible
+- * with ADT7461 except for local temperature low byte register and max
+- * conversion rate.
++ * This driver also supports TMP451 and TMP461 from Texas Instruments.
++ * Those devices are supported in both compatibility and extended mode.
++ * They are mostly compatible with ADT7461 except for local temperature
++ * low byte register and max conversion rate.
+  *
+  * Since the LM90 was the first chipset supported by this driver, most
+  * comments will refer to this chipset, but are actually general and
+@@ -94,8 +103,8 @@
+  * have address 0x4d.
+  * MAX6647 has address 0x4e.
+  * MAX6659 can have address 0x4c, 0x4d or 0x4e.
+- * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
+- * 0x4c, 0x4d or 0x4e.
++ * MAX6654, MAX6680, and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29,
++ * 0x2a, 0x2b, 0x4c, 0x4d or 0x4e.
+  * SA56004 can have address 0x48 through 0x4F.
+  */
+ 
+@@ -104,7 +113,7 @@ static const unsigned short normal_i2c[] = {
+ 	0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
+ 
+ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+-	max6646, w83l771, max6696, sa56004, g781, tmp451 };
++	max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 };
+ 
+ /*
+  * The LM90 registers
+@@ -145,7 +154,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_REG_R_TCRIT_HYST		0x21
+ #define LM90_REG_W_TCRIT_HYST		0x21
+ 
+-/* MAX6646/6647/6649/6657/6658/6659/6695/6696 registers */
++/* MAX6646/6647/6649/6654/6657/6658/6659/6695/6696 registers */
+ 
+ #define MAX6657_REG_R_LOCAL_TEMPL	0x11
+ #define MAX6696_REG_R_STATUS2		0x12
+@@ -160,8 +169,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ 
+ #define LM90_MAX_CONVRATE_MS	16000	/* Maximum conversion rate in ms */
+ 
+-/* TMP451 registers */
++/* TMP451/TMP461 registers */
+ #define TMP451_REG_R_LOCAL_TEMPL	0x15
++#define TMP451_REG_CONALERT		0x22
++
++#define TMP461_REG_CHEN			0x16
++#define TMP461_REG_DFC			0x24
+ 
+ /*
+  * Device flags
+@@ -174,7 +187,10 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm		*/
+ #define LM90_HAVE_TEMP3		(1 << 6) /* 3rd temperature sensor	*/
+ #define LM90_HAVE_BROKEN_ALERT	(1 << 7) /* Broken alert		*/
+-#define LM90_PAUSE_FOR_CONFIG	(1 << 8) /* Pause conversion for config	*/
++#define LM90_HAVE_EXTENDED_TEMP	(1 << 8) /* extended temperature support*/
++#define LM90_PAUSE_FOR_CONFIG	(1 << 9) /* Pause conversion for config	*/
++#define LM90_HAVE_CRIT		(1 << 10)/* Chip supports CRIT/OVERT register	*/
++#define LM90_HAVE_CRIT_ALRM_SWP	(1 << 11)/* critical alarm bits swapped	*/
+ 
+ /* LM90 status */
+ #define LM90_STATUS_LTHRM	(1 << 0) /* local THERM limit tripped */
+@@ -184,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_STATUS_RHIGH	(1 << 4) /* remote high temp limit tripped */
+ #define LM90_STATUS_LLOW	(1 << 5) /* local low temp limit tripped */
+ #define LM90_STATUS_LHIGH	(1 << 6) /* local high temp limit tripped */
++#define LM90_STATUS_BUSY	(1 << 7) /* conversion is ongoing */
+ 
+ #define MAX6696_STATUS2_R2THRM	(1 << 1) /* remote2 THERM limit tripped */
+ #define MAX6696_STATUS2_R2OPEN	(1 << 2) /* remote2 is an open circuit */
+@@ -209,6 +226,7 @@ static const struct i2c_device_id lm90_id[] = {
+ 	{ "max6646", max6646 },
+ 	{ "max6647", max6646 },
+ 	{ "max6649", max6646 },
++	{ "max6654", max6654 },
+ 	{ "max6657", max6657 },
+ 	{ "max6658", max6657 },
+ 	{ "max6659", max6659 },
+@@ -220,6 +238,7 @@ static const struct i2c_device_id lm90_id[] = {
+ 	{ "w83l771", w83l771 },
+ 	{ "sa56004", sa56004 },
+ 	{ "tmp451", tmp451 },
++	{ "tmp461", tmp461 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(i2c, lm90_id);
+@@ -269,6 +288,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
+ 		.compatible = "dallas,max6649",
+ 		.data = (void *)max6646
+ 	},
++	{
++		.compatible = "dallas,max6654",
++		.data = (void *)max6654
++	},
+ 	{
+ 		.compatible = "dallas,max6657",
+ 		.data = (void *)max6657
+@@ -313,6 +336,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
+ 		.compatible = "ti,tmp451",
+ 		.data = (void *)tmp451
+ 	},
++	{
++		.compatible = "ti,tmp461",
++		.data = (void *)tmp461
++	},
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(of, lm90_of_match);
+@@ -331,80 +358,98 @@ struct lm90_params {
+ static const struct lm90_params lm90_params[] = {
+ 	[adm1032] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 10,
+ 	},
+ 	[adt7461] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 10,
+ 	},
+ 	[g781] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 	},
+ 	[lm86] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[lm90] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[lm99] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 	},
+ 	[max6646] = {
++		.flags = LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
++	[max6654] = {
++		.alert_alarms = 0x7c,
++		.max_convrate = 7,
++		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
++	},
+ 	[max6657] = {
+-		.flags = LM90_PAUSE_FOR_CONFIG,
++		.flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[max6659] = {
+-		.flags = LM90_HAVE_EMERGENCY,
++		.flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[max6680] = {
+-		.flags = LM90_HAVE_OFFSET,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT
++		  | LM90_HAVE_CRIT_ALRM_SWP,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 7,
+ 	},
+ 	[max6696] = {
+ 		.flags = LM90_HAVE_EMERGENCY
+-		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
++		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x1c7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[w83l771] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 8,
+ 	},
+ 	[sa56004] = {
+-		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7b,
+ 		.max_convrate = 9,
+ 		.reg_local_ext = SA56004_REG_R_LOCAL_TEMPL,
+ 	},
+ 	[tmp451] = {
+ 		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+-		  | LM90_HAVE_BROKEN_ALERT,
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
++		.alert_alarms = 0x7c,
++		.max_convrate = 9,
++		.reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
++	},
++	[tmp461] = {
++		.flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
++		  | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
+ 		.alert_alarms = 0x7c,
+ 		.max_convrate = 9,
+ 		.reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
+@@ -632,20 +677,22 @@ static int lm90_update_limits(struct device *dev)
+ 	struct i2c_client *client = data->client;
+ 	int val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
+-	if (val < 0)
+-		return val;
+-	data->temp8[LOCAL_CRIT] = val;
++	if (data->flags & LM90_HAVE_CRIT) {
++		val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
++		if (val < 0)
++			return val;
++		data->temp8[LOCAL_CRIT] = val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
+-	if (val < 0)
+-		return val;
+-	data->temp8[REMOTE_CRIT] = val;
++		val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
++		if (val < 0)
++			return val;
++		data->temp8[REMOTE_CRIT] = val;
+ 
+-	val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
+-	if (val < 0)
+-		return val;
+-	data->temp_hyst = val;
++		val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
++		if (val < 0)
++			return val;
++		data->temp_hyst = val;
++	}
+ 
+ 	val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH);
+ 	if (val < 0)
+@@ -773,7 +820,7 @@ static int lm90_update_device(struct device *dev)
+ 		val = lm90_read_reg(client, LM90_REG_R_STATUS);
+ 		if (val < 0)
+ 			return val;
+-		data->alarms = val;	/* lower 8 bit of alarms */
++		data->alarms = val & ~LM90_STATUS_BUSY;
+ 
+ 		if (data->kind == max6696) {
+ 			val = lm90_select_remote_channel(data, 1);
+@@ -979,7 +1026,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index)
+ 	s16 temp11 = data->temp11[index];
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u16_adt7461(data, temp11);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u16(temp11);
+@@ -1013,7 +1060,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val)
+ 	if (data->kind == lm99 && index <= 2)
+ 		val -= 16000;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		data->temp11[index] = temp_to_u16_adt7461(data, val);
+ 	else if (data->kind == max6646)
+ 		data->temp11[index] = temp_to_u8(val) << 8;
+@@ -1040,7 +1087,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index)
+ 	s8 temp8 = data->temp8[index];
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, temp8);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(temp8);
+@@ -1073,7 +1120,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val)
+ 	if (data->kind == lm99 && index == 3)
+ 		val -= 16000;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		data->temp8[index] = temp_to_u8_adt7461(data, val);
+ 	else if (data->kind == max6646)
+ 		data->temp8[index] = temp_to_u8(val);
+@@ -1091,7 +1138,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index)
+ {
+ 	int temp;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, data->temp8[index]);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(data->temp8[index]);
+@@ -1111,7 +1158,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)
+ 	int temp;
+ 	int err;
+ 
+-	if (data->kind == adt7461 || data->kind == tmp451)
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP)
+ 		temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]);
+ 	else if (data->kind == max6646)
+ 		temp = temp_from_u8(data->temp8[LOCAL_CRIT]);
+@@ -1147,6 +1194,7 @@ static const u8 lm90_temp_emerg_index[3] = {
+ static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 };
+ static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 };
+ static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 };
++static const u8 lm90_crit_alarm_bits_swapped[3] = { 1, 0, 9 };
+ static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 };
+ static const u8 lm90_fault_bits[3] = { 0, 2, 10 };
+ 
+@@ -1172,7 +1220,10 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val)
+ 		*val = (data->alarms >> lm90_max_alarm_bits[channel]) & 1;
+ 		break;
+ 	case hwmon_temp_crit_alarm:
+-		*val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
++		if (data->flags & LM90_HAVE_CRIT_ALRM_SWP)
++			*val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) & 1;
++		else
++			*val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
+ 		break;
+ 	case hwmon_temp_emergency_alarm:
+ 		*val = (data->alarms >> lm90_emergency_alarm_bits[channel]) & 1;
+@@ -1420,12 +1471,11 @@ static int lm90_detect(struct i2c_client *client,
+ 	if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0)
+ 		return -ENODEV;
+ 
+-	if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) {
++	if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) {
+ 		config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2);
+ 		if (config2 < 0)
+ 			return -ENODEV;
+-	} else
+-		config2 = 0;		/* Make compiler happy */
++	}
+ 
+ 	if ((address == 0x4C || address == 0x4D)
+ 	 && man_id == 0x01) { /* National Semiconductor */
+@@ -1557,6 +1607,16 @@ static int lm90_detect(struct i2c_client *client,
+ 		 && (config1 & 0x3f) == 0x00
+ 		 && convrate <= 0x07) {
+ 			name = "max6646";
++		} else
++		/*
++		 * The chip_id of the MAX6654 holds the revision of the chip.
++		 * The lowest 3 bits of the config1 register are unused and
++		 * should return zero when read.
++		 */
++		if (chip_id == 0x08
++		 && (config1 & 0x07) == 0x00
++		 && convrate <= 0x07) {
++			name = "max6654";
+ 		}
+ 	} else
+ 	if (address == 0x4C
+@@ -1589,18 +1649,26 @@ static int lm90_detect(struct i2c_client *client,
+ 		 && convrate <= 0x08)
+ 			name = "g781";
+ 	} else
+-	if (address == 0x4C
+-	 && man_id == 0x55) { /* Texas Instruments */
+-		int local_ext;
++	if (man_id == 0x55 && chip_id == 0x00 &&
++	    (config1 & 0x1B) == 0x00 && convrate <= 0x09) {
++		int local_ext, conalert, chen, dfc;
+ 
+ 		local_ext = i2c_smbus_read_byte_data(client,
+ 						     TMP451_REG_R_LOCAL_TEMPL);
+-
+-		if (chip_id == 0x00 /* TMP451 */
+-		 && (config1 & 0x1B) == 0x00
+-		 && convrate <= 0x09
+-		 && (local_ext & 0x0F) == 0x00)
+-			name = "tmp451";
++		conalert = i2c_smbus_read_byte_data(client,
++						    TMP451_REG_CONALERT);
++		chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN);
++		dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC);
++
++		if ((local_ext & 0x0F) == 0x00 &&
++		    (conalert & 0xf1) == 0x01 &&
++		    (chen & 0xfc) == 0x00 &&
++		    (dfc & 0xfc) == 0x00) {
++			if (address == 0x4c && !(chen & 0x03))
++				name = "tmp451";
++			else if (address >= 0x48 && address <= 0x4f)
++				name = "tmp461";
++		}
+ 	}
+ 
+ 	if (!name) { /* identification failed */
+@@ -1647,7 +1715,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
+ 	lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
+ 
+ 	/* Check Temperature Range Select */
+-	if (data->kind == adt7461 || data->kind == tmp451) {
++	if (data->flags & LM90_HAVE_EXTENDED_TEMP) {
+ 		if (config & 0x04)
+ 			data->flags |= LM90_FLAG_ADT7461_EXT;
+ 	}
+@@ -1660,6 +1728,15 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
+ 	if (data->kind == max6680)
+ 		config |= 0x18;
+ 
++	/*
++	 * Put MAX6654 into extended range (0x20, extend minimum range from
++	 * 0 degrees to -64 degrees). Note that extended resolution is not
++	 * possible on the MAX6654 unless conversion rate is set to 1 Hz or
++	 * slower, which is intentionally not done by default.
++	 */
++	if (data->kind == max6654)
++		config |= 0x20;
++
+ 	/*
+ 	 * Select external channel 0 for max6695/96
+ 	 */
+@@ -1806,11 +1883,14 @@ static int lm90_probe(struct i2c_client *client,
+ 	info->config = data->channel_config;
+ 
+ 	data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-		HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-		HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM;
++		HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM;
+ 	data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
+-		HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
+-		HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT;
++		HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT;
++
++	if (data->flags & LM90_HAVE_CRIT) {
++		data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++		data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
++	}
+ 
+ 	if (data->flags & LM90_HAVE_OFFSET)
+ 		data->channel_config[1] |= HWMON_T_OFFSET;
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index 5fd28574124fb..fde848b00202b 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ 					       &addrlimit) ||
+ 			    addrlimit > type_max(typeof(pkt->addrlimit))) {
+ 				ret = -EINVAL;
+-				goto free_pbc;
++				goto free_pkt;
+ 			}
+ 			pkt->addrlimit = addrlimit;
+ 
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 0b5ed963cb0e1..3e78c26025815 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {
+  */
+ static int elantech_change_report_id(struct psmouse *psmouse)
+ {
+-	unsigned char param[2] = { 0x10, 0x03 };
++	/*
++	 * NOTE: the code is expecting to receive param[] as an array of 3
++	 * items (see __ps2_command()), even if in this case only 2 are
++	 * actually needed. Make sure the array size is 3 to avoid potential
++	 * stack out-of-bound accesses.
++	 */
++	unsigned char param[3] = { 0x10, 0x03 };
+ 
+ 	if (elantech_write_reg_params(psmouse, 0x7, param) ||
+ 	    elantech_read_reg_params(psmouse, 0x7, param) ||
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index ae60442efda0d..fb31a9d43162b 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -1794,7 +1794,7 @@ static int mxt_read_info_block(struct mxt_data *data)
+ 	if (error) {
+ 		dev_err(&client->dev, "Error %d parsing object table\n", error);
+ 		mxt_free_object_table(data);
+-		goto err_free_mem;
++		return error;
+ 	}
+ 
+ 	data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 8f94c25395080..d7bda1fa0a6e2 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2364,7 +2364,7 @@ void mmc_start_host(struct mmc_host *host)
+ 	_mmc_detect_change(host, 0, false);
+ }
+ 
+-void mmc_stop_host(struct mmc_host *host)
++void __mmc_stop_host(struct mmc_host *host)
+ {
+ 	if (host->slot.cd_irq >= 0) {
+ 		mmc_gpio_set_cd_wake(host, false);
+@@ -2373,6 +2373,11 @@ void mmc_stop_host(struct mmc_host *host)
+ 
+ 	host->rescan_disable = 1;
+ 	cancel_delayed_work_sync(&host->detect);
++}
++
++void mmc_stop_host(struct mmc_host *host)
++{
++	__mmc_stop_host(host);
+ 
+ 	/* clear pm flags now and let card drivers set them as needed */
+ 	host->pm_flags = 0;
+diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
+index db3c9c68875d8..a6c814fdbf0a9 100644
+--- a/drivers/mmc/core/core.h
++++ b/drivers/mmc/core/core.h
+@@ -69,6 +69,7 @@ static inline void mmc_delay(unsigned int ms)
+ 
+ void mmc_rescan(struct work_struct *work);
+ void mmc_start_host(struct mmc_host *host);
++void __mmc_stop_host(struct mmc_host *host);
+ void mmc_stop_host(struct mmc_host *host);
+ 
+ void _mmc_detect_change(struct mmc_host *host, unsigned long delay,
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index f7339590a84c8..e955f1ef25643 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -76,9 +76,18 @@ static void mmc_host_classdev_release(struct device *dev)
+ 	kfree(host);
+ }
+ 
++static int mmc_host_classdev_shutdown(struct device *dev)
++{
++	struct mmc_host *host = cls_dev_to_mmc_host(dev);
++
++	__mmc_stop_host(host);
++	return 0;
++}
++
+ static struct class mmc_host_class = {
+ 	.name		= "mmc_host",
+ 	.dev_release	= mmc_host_classdev_release,
++	.shutdown_pre	= mmc_host_classdev_shutdown,
+ 	.pm		= MMC_HOST_CLASS_DEV_PM_OPS,
+ };
+ 
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index c105356ad4cb7..65dfe75120ed6 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -340,23 +340,6 @@ static void tegra_sdhci_set_tap(struct sdhci_host *host, unsigned int tap)
+ 	}
+ }
+ 
+-static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
+-					      struct mmc_ios *ios)
+-{
+-	struct sdhci_host *host = mmc_priv(mmc);
+-	u32 val;
+-
+-	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
+-
+-	if (ios->enhanced_strobe)
+-		val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
+-	else
+-		val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
+-
+-	sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
+-
+-}
+-
+ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+@@ -768,6 +751,32 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock)
+ 	}
+ }
+ 
++static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
++					      struct mmc_ios *ios)
++{
++	struct sdhci_host *host = mmc_priv(mmc);
++	u32 val;
++
++	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
++
++	if (ios->enhanced_strobe) {
++		val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
++		/*
++		 * When CMD13 is sent from mmc_select_hs400es() after
++		 * switching to HS400ES mode, the bus is operating at
++		 * either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR.
++		 * To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI
++		 * interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host
++		 * controller CAR clock and the interface clock are rate matched.
++		 */
++		tegra_sdhci_set_clock(host, MMC_HS200_MAX_DTR);
++	} else {
++		val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
++	}
++
++	sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
++}
++
+ static unsigned int tegra_sdhci_get_max_clock(struct sdhci_host *host)
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index 215c109232893..933087d85549a 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1452,7 +1452,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond,
+ 		mac = (u8 *)&newval->value;
+ 	}
+ 
+-	if (!is_valid_ether_addr(mac))
++	if (is_multicast_ether_addr(mac))
+ 		goto err;
+ 
+ 	netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+index 5f327659efa7a..85b688f60b876 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *,
+ 				   struct qlcnic_info *, u16);
+ int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
+ bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);
+ void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,
+ 			      struct qlcnic_vf_info *, u16);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index f7c2f32237cb0..400bc2c3f222e 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ 					    struct qlcnic_cmd_args *cmd)
+ {
+ 	struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+-	int i, num_vlans;
++	int i, num_vlans, ret;
+ 	u16 *vlans;
+ 
+ 	if (sriov->allowed_vlans)
+@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ 	dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",
+ 		 sriov->num_allowed_vlans);
+ 
+-	qlcnic_sriov_alloc_vlans(adapter);
++	ret = qlcnic_sriov_alloc_vlans(adapter);
++	if (ret)
++		return ret;
+ 
+ 	if (!sriov->any_vlan)
+ 		return 0;
+@@ -2160,7 +2162,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)
+ 	return err;
+ }
+ 
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ {
+ 	struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+ 	struct qlcnic_vf_info *vf;
+@@ -2170,7 +2172,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ 		vf = &sriov->vf_info[i];
+ 		vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
+ 					  sizeof(*vf->sriov_vlans), GFP_KERNEL);
++		if (!vf->sriov_vlans)
++			return -ENOMEM;
+ 	}
++
++	return 0;
+ }
+ 
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+index 5632da05145a5..ed218ed2f466d 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,
+ 	if (err)
+ 		goto del_flr_queue;
+ 
+-	qlcnic_sriov_alloc_vlans(adapter);
++	err = qlcnic_sriov_alloc_vlans(adapter);
++	if (err)
++		goto del_flr_queue;
+ 
+ 	return err;
+ 
+diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c
+index 05ea3523890a9..d516f81ab37a7 100644
+--- a/drivers/net/ethernet/sfc/falcon/rx.c
++++ b/drivers/net/ethernet/sfc/falcon/rx.c
+@@ -726,7 +726,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx,
+ 					    efx->rx_bufs_per_page);
+ 	rx_queue->page_ring = kcalloc(page_ring_size,
+ 				      sizeof(*rx_queue->page_ring), GFP_KERNEL);
+-	rx_queue->page_ptr_mask = page_ring_size - 1;
++	if (!rx_queue->page_ring)
++		rx_queue->page_ptr_mask = 0;
++	else
++		rx_queue->page_ptr_mask = page_ring_size - 1;
+ }
+ 
+ void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue)
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index 7b65e79d6ae91..82ca29b6781b2 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -2069,6 +2069,11 @@ static int smc911x_drv_probe(struct platform_device *pdev)
+ 
+ 	ndev->dma = (unsigned char)-1;
+ 	ndev->irq = platform_get_irq(pdev, 0);
++	if (ndev->irq < 0) {
++		ret = ndev->irq;
++		goto release_both;
++	}
++
+ 	lp = netdev_priv(ndev);
+ 	lp->netdev = ndev;
+ #ifdef SMC_DYNAMIC_BUS_CONFIG
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index b89b4a3800a4d..bef0133696c31 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1269,6 +1269,11 @@ static int fjes_probe(struct platform_device *plat_dev)
+ 	hw->hw_res.start = res->start;
+ 	hw->hw_res.size = resource_size(res);
+ 	hw->hw_res.irq = platform_get_irq(plat_dev, 0);
++	if (hw->hw_res.irq < 0) {
++		err = hw->hw_res.irq;
++		goto err_free_control_wq;
++	}
++
+ 	err = fjes_hw_init(&adapter->hw);
+ 	if (err)
+ 		goto err_free_control_wq;
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 352f9e75954ce..d2eb33f53993b 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -793,13 +793,14 @@ static void mkiss_close(struct tty_struct *tty)
+ 	 */
+ 	netif_stop_queue(ax->dev);
+ 
+-	/* Free all AX25 frame buffers. */
++	unregister_netdev(ax->dev);
++
++	/* Free all AX25 frame buffers after unreg. */
+ 	kfree(ax->rbuff);
+ 	kfree(ax->xbuff);
+ 
+ 	ax->tty = NULL;
+ 
+-	unregister_netdev(ax->dev);
+ 	free_netdev(ax->dev);
+ }
+ 
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 2d98373f7a71d..ce3c8f476d75c 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -64,6 +64,8 @@
+ #define LAN7801_USB_PRODUCT_ID		(0x7801)
+ #define LAN78XX_EEPROM_MAGIC		(0x78A5)
+ #define LAN78XX_OTP_MAGIC		(0x78F3)
++#define AT29M2AF_USB_VENDOR_ID		(0x07C9)
++#define AT29M2AF_USB_PRODUCT_ID	(0x0012)
+ 
+ #define	MII_READ			1
+ #define	MII_WRITE			0
+@@ -4153,6 +4155,10 @@ static const struct usb_device_id products[] = {
+ 	/* LAN7801 USB Gigabit Ethernet Device */
+ 	USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID),
+ 	},
++	{
++	/* ATM2-AF USB Gigabit Ethernet Device */
++	USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID),
++	},
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, products);
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+index 20e1c890e73b3..c3e6f3c1b4743 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -236,8 +236,12 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n,
+ 	desc = (const struct mtk_pin_desc *)hw->soc->pins;
+ 	*gpio_chip = &hw->chip;
+ 
+-	/* Be greedy to guess first gpio_n is equal to eint_n */
+-	if (desc[eint_n].eint.eint_n == eint_n)
++	/*
++	 * Be greedy to guess first gpio_n is equal to eint_n.
++	 * Only eint virtual eint number is greater than gpio number.
++	 */
++	if (hw->soc->npins > eint_n &&
++	    desc[eint_n].eint.eint_n == eint_n)
+ 		*gpio_n = eint_n;
+ 	else
+ 		*gpio_n = mtk_xt_find_eint_num(hw, eint_n);
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 138cbc012cd89..f9abd4364fbaa 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1186,10 +1186,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
+ 		bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK;
+ 		bank->gpio_chip.base = args.args[1];
+ 
+-		npins = args.args[2];
+-		while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3,
+-							 ++i, &args))
+-			npins += args.args[2];
++		/* get the last defined gpio line (offset + nb of pins) */
++		npins = args.args[0] + args.args[2];
++		while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args))
++			npins = max(npins, (int)(args.args[0] + args.args[2]));
+ 	} else {
+ 		bank_nr = pctl->nbanks;
+ 		bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
+diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
+index e450ee17787f0..4a4e2877414a1 100644
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -906,7 +906,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ error_clk:
+-	clk_disable_unprepare(spi->clk);
++	clk_unprepare(spi->clk);
+ error:
+ 	spi_master_put(master);
+ out:
+diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c
+index c41a9a501a6e9..fa75024f16f7f 100644
+--- a/drivers/tee/optee/shm_pool.c
++++ b/drivers/tee/optee/shm_pool.c
+@@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ 			goto err;
+ 		}
+ 
+-		for (i = 0; i < nr_pages; i++) {
+-			pages[i] = page;
+-			page++;
+-		}
++		for (i = 0; i < nr_pages; i++)
++			pages[i] = page + i;
+ 
+ 		shm->flags |= TEE_SHM_REGISTER;
+ 		rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
+diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
+index 31c91c2f8c6e7..e24161004ddc1 100644
+--- a/drivers/tty/serial/8250/8250_fintek.c
++++ b/drivers/tty/serial/8250/8250_fintek.c
+@@ -285,24 +285,6 @@ static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata)
+ 	}
+ }
+ 
+-static void fintek_8250_goto_highspeed(struct uart_8250_port *uart,
+-			      struct fintek_8250 *pdata)
+-{
+-	sio_write_reg(pdata, LDN, pdata->index);
+-
+-	switch (pdata->pid) {
+-	case CHIP_ID_F81866: /* set uart clock for high speed serial mode */
+-		sio_write_mask_reg(pdata, F81866_UART_CLK,
+-			F81866_UART_CLK_MASK,
+-			F81866_UART_CLK_14_769MHZ);
+-
+-		uart->port.uartclk = 921600 * 16;
+-		break;
+-	default: /* leave clock speed untouched */
+-		break;
+-	}
+-}
+-
+ static void fintek_8250_set_termios(struct uart_port *port,
+ 				    struct ktermios *termios,
+ 				    struct ktermios *old)
+@@ -422,7 +404,6 @@ static int probe_setup_port(struct fintek_8250 *pdata,
+ 
+ 				fintek_8250_set_irq_mode(pdata, level_mode);
+ 				fintek_8250_set_max_fifo(pdata);
+-				fintek_8250_goto_highspeed(uart, pdata);
+ 
+ 				fintek_8250_exit_key(addr[i]);
+ 
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 57da62e331848..271bd08f4a255 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -860,19 +860,23 @@ int gether_register_netdev(struct net_device *net)
+ {
+ 	struct eth_dev *dev;
+ 	struct usb_gadget *g;
+-	struct sockaddr sa;
+ 	int status;
+ 
+ 	if (!net->dev.parent)
+ 		return -EINVAL;
+ 	dev = netdev_priv(net);
+ 	g = dev->gadget;
++
++	memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
++	net->addr_assign_type = NET_ADDR_RANDOM;
++
+ 	status = register_netdev(net);
+ 	if (status < 0) {
+ 		dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
+ 		return status;
+ 	} else {
+ 		INFO(dev, "HOST MAC %pM\n", dev->host_mac);
++		INFO(dev, "MAC %pM\n", dev->dev_mac);
+ 
+ 		/* two kinds of host-initiated state changes:
+ 		 *  - iff DATA transfer is active, carrier is "on"
+@@ -880,15 +884,6 @@ int gether_register_netdev(struct net_device *net)
+ 		 */
+ 		netif_carrier_off(net);
+ 	}
+-	sa.sa_family = net->type;
+-	memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN);
+-	rtnl_lock();
+-	status = dev_set_mac_address(net, &sa, NULL);
+-	rtnl_unlock();
+-	if (status)
+-		pr_warn("cannot set self ethernet address: %d\n", status);
+-	else
+-		INFO(dev, "MAC %pM\n", dev->dev_mac);
+ 
+ 	return status;
+ }
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 296b3189448a4..cf1bfed1e6621 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -661,8 +661,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	}
+ 
+ 	last = here;
+-	while (!IS_XATTR_LAST_ENTRY(last))
++	while (!IS_XATTR_LAST_ENTRY(last)) {
++		if ((void *)(last) + sizeof(__u32) > last_base_addr ||
++			(void *)XATTR_NEXT_ENTRY(last) > last_base_addr) {
++			f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu",
++					inode->i_ino, ENTRY_SIZE(last));
++			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
++			error = -EFSCORRUPTED;
++			goto exit;
++		}
+ 		last = XATTR_NEXT_ENTRY(last);
++	}
+ 
+ 	newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size);
+ 
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index 04e87f4b9417c..a960de68ac69e 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -7,9 +7,27 @@
+ #include <uapi/linux/udp.h>
+ #include <uapi/linux/virtio_net.h>
+ 
++static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)
++{
++	switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
++	case VIRTIO_NET_HDR_GSO_TCPV4:
++		return protocol == cpu_to_be16(ETH_P_IP);
++	case VIRTIO_NET_HDR_GSO_TCPV6:
++		return protocol == cpu_to_be16(ETH_P_IPV6);
++	case VIRTIO_NET_HDR_GSO_UDP:
++		return protocol == cpu_to_be16(ETH_P_IP) ||
++		       protocol == cpu_to_be16(ETH_P_IPV6);
++	default:
++		return false;
++	}
++}
++
+ static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
+ 					   const struct virtio_net_hdr *hdr)
+ {
++	if (skb->protocol)
++		return 0;
++
+ 	switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+ 	case VIRTIO_NET_HDR_GSO_TCPV4:
+ 	case VIRTIO_NET_HDR_GSO_UDP:
+@@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 			if (!skb->protocol) {
+ 				__be16 protocol = dev_parse_header_protocol(skb);
+ 
+-				virtio_net_hdr_set_proto(skb, hdr);
+-				if (protocol && protocol != skb->protocol)
++				if (!protocol)
++					virtio_net_hdr_set_proto(skb, hdr);
++				else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type))
+ 					return -EINVAL;
++				else
++					skb->protocol = protocol;
+ 			}
+ retry:
+ 			if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 87d165923fee2..2c4082f71d258 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2143,8 +2143,9 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
+ 			 * memory as well.
+ 			 */
+ 			if (!page && (gfp & __GFP_DIRECT_RECLAIM))
+-				page = __alloc_pages_node(hpage_node,
+-						gfp | __GFP_NORETRY, order);
++				page = __alloc_pages_nodemask(gfp | __GFP_NORETRY,
++							order, hpage_node,
++							nmask);
+ 
+ 			goto out;
+ 		}
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 2fdb1b573e8c8..1f84d41e22c36 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct net_device *dev)
+ again:
+ 	ax25_for_each(s, &ax25_list) {
+ 		if (s->ax25_dev == ax25_dev) {
+-			s->ax25_dev = NULL;
+ 			spin_unlock_bh(&ax25_list_lock);
++			lock_sock(s->sk);
++			s->ax25_dev = NULL;
++			release_sock(s->sk);
+ 			ax25_disconnect(s, ENETUNREACH);
+ 			spin_lock_bh(&ax25_list_lock);
+ 
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 7ca2ca4bba055..b36af4741ad3c 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -557,7 +557,8 @@ __build_packet_message(struct nfnl_log_net *log,
+ 		goto nla_put_failure;
+ 
+ 	if (indev && skb->dev &&
+-	    skb->mac_header != skb->network_header) {
++	    skb_mac_header_was_set(skb) &&
++	    skb_mac_header_len(skb) != 0) {
+ 		struct nfulnl_msg_packet_hw phw;
+ 		int len;
+ 
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index a8cb562da3fea..ca21f8f4a47c1 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -562,7 +562,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ 		goto nla_put_failure;
+ 
+ 	if (indev && entskb->dev &&
+-	    skb_mac_header_was_set(entskb)) {
++	    skb_mac_header_was_set(entskb) &&
++	    skb_mac_header_len(entskb) != 0) {
+ 		struct nfqnl_msg_packet_hw phw;
+ 		int len;
+ 
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 4577e43cb7778..a07e13f63332c 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ 			ret =  -EBUSY;
+ 		else if (sk->sk_state == TCP_ESTABLISHED)
+ 			ret = -EISCONN;
++		else if (!pn->pn_sk.sobject)
++			ret = -EADDRNOTAVAIL;
+ 		else
+ 			ret = pep_sock_enable(sk, NULL, 0);
+ 		release_sock(sk);
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index fb26196571a7c..8b209750c7a9c 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -220,6 +220,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
+ 		return -ENOMEM;
+ 
+ 	jack->id = kstrdup(id, GFP_KERNEL);
++	if (jack->id == NULL) {
++		kfree(jack);
++		return -ENOMEM;
++	}
+ 
+ 	/* don't creat input device for phantom jack */
+ 	if (!phantom_jack) {
+diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
+index 280cc79870cf8..ce38ec09d4087 100644
+--- a/sound/drivers/opl3/opl3_midi.c
++++ b/sound/drivers/opl3/opl3_midi.c
+@@ -398,7 +398,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
+ 	}
+ 	if (instr_4op) {
+ 		vp2 = &opl3->voices[voice + 3];
+-		if (vp->state > 0) {
++		if (vp2->state > 0) {
+ 			opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK +
+ 					       voice_offset + 3);
+ 			reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9514db7c2a86d..022799479a722 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8101,6 +8101,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN),
+ 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
++	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ 	SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),