[gentoo-commits] proj/linux-patches:4.17 commit in: /

[Mike Pagano]

commit:     003f68bb0343eec1d19eec6a761fae1405ddad26
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 25 10:28:04 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 25 10:28:04 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=003f68bb

Linux patch 4.17.10

 0000_README              |    4 +
 1009_linux-4.17.10.patch | 2457 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2461 insertions(+)

diff --git a/0000_README b/0000_README
index 378d9da..148c985 100644
--- a/0000_README
+++ b/0000_README
@@ -79,6 +79,10 @@ Patch:  1008_linux-4.17.9.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.17.9
 
+Patch:  1009_linux-4.17.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.17.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1009_linux-4.17.10.patch b/1009_linux-4.17.10.patch
new file mode 100644
index 0000000..dc09395
--- /dev/null
+++ b/1009_linux-4.17.10.patch
@@ -0,0 +1,2457 @@
+diff --git a/Makefile b/Makefile
+index 693fde3aa317..0ab689c38e82 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 17
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Merciless Moray
+ 
+diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
+index 89faa6f4de47..6a92843c0699 100644
+--- a/arch/alpha/kernel/osf_sys.c
++++ b/arch/alpha/kernel/osf_sys.c
+@@ -1183,13 +1183,10 @@ SYSCALL_DEFINE2(osf_getrusage, int, who, struct rusage32 __user *, ru)
+ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
+ 		struct rusage32 __user *, ur)
+ {
+-	unsigned int status = 0;
+ 	struct rusage r;
+-	long err = kernel_wait4(pid, &status, options, &r);
++	long err = kernel_wait4(pid, ustatus, options, &r);
+ 	if (err <= 0)
+ 		return err;
+-	if (put_user(status, ustatus))
+-		return -EFAULT;
+ 	if (!ur)
+ 		return err;
+ 	if (put_tv_to_tv32(&ur->ru_utime, &r.ru_utime))
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index d76bf4a83740..bc0bcf01ec98 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -408,7 +408,7 @@ config ARC_HAS_DIV_REM
+ 
+ config ARC_HAS_ACCL_REGS
+ 	bool "Reg Pair ACCL:ACCH (FPU and/or MPY > 6)"
+-	default n
++	default y
+ 	help
+ 	  Depending on the configuration, CPU can contain accumulator reg-pair
+ 	  (also referred to as r58:r59). These can also be used by gcc as GPR so
+diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
+index 09f85154c5a4..a635ea972304 100644
+--- a/arch/arc/configs/axs101_defconfig
++++ b/arch/arc/configs/axs101_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
+index 09fed3ef22b6..aa507e423075 100644
+--- a/arch/arc/configs/axs103_defconfig
++++ b/arch/arc/configs/axs103_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
+index ea2f6d817d1a..eba07f468654 100644
+--- a/arch/arc/configs/axs103_smp_defconfig
++++ b/arch/arc/configs/axs103_smp_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
+index ab231c040efe..098b19fbaa51 100644
+--- a/arch/arc/configs/haps_hs_defconfig
++++ b/arch/arc/configs/haps_hs_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_EXPERT=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_COMPAT_BRK is not set
+diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
+index cf449cbf440d..0104c404d897 100644
+--- a/arch/arc/configs/haps_hs_smp_defconfig
++++ b/arch/arc/configs/haps_hs_smp_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
+index 1b54c72f4296..6491be0ddbc9 100644
+--- a/arch/arc/configs/hsdk_defconfig
++++ b/arch/arc/configs/hsdk_defconfig
+@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
+index 31c2c70b34a1..99e05cf63fca 100644
+--- a/arch/arc/configs/nsim_700_defconfig
++++ b/arch/arc/configs/nsim_700_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
+ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
+index a578c721d50f..0dc4f9b737e7 100644
+--- a/arch/arc/configs/nsim_hs_defconfig
++++ b/arch/arc/configs/nsim_hs_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
+ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
+index 37d7395f3272..be3c30a15e54 100644
+--- a/arch/arc/configs/nsim_hs_smp_defconfig
++++ b/arch/arc/configs/nsim_hs_smp_defconfig
+@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
+ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
+index 1e1470e2a7f0..3a74b9b21772 100644
+--- a/arch/arc/configs/nsimosci_defconfig
++++ b/arch/arc/configs/nsimosci_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
+ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
+index 084a6e42685b..ea2834b4dc1d 100644
+--- a/arch/arc/configs/nsimosci_hs_defconfig
++++ b/arch/arc/configs/nsimosci_hs_defconfig
+@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
+ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
+index f36d47990415..80a5a1b4924b 100644
+--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
+@@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_COMPAT_BRK is not set
+ CONFIG_KPROBES=y
+diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
+index 109baa06831c..09ddddf71cc5 100644
+--- a/arch/arc/include/asm/page.h
++++ b/arch/arc/include/asm/page.h
+@@ -105,7 +105,7 @@ typedef pte_t * pgtable_t;
+ #define virt_addr_valid(kaddr)  pfn_valid(virt_to_pfn(kaddr))
+ 
+ /* Default Permissions for stack/heaps pages (Non Executable) */
+-#define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE)
++#define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define WANT_PAGE_VIRTUAL   1
+ 
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index 08fe33830d4b..77676e18da69 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -379,7 +379,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address,
+ 
+ /* Decode a PTE containing swap "identifier "into constituents */
+ #define __swp_type(pte_lookalike)	(((pte_lookalike).val) & 0x1f)
+-#define __swp_offset(pte_lookalike)	((pte_lookalike).val << 13)
++#define __swp_offset(pte_lookalike)	((pte_lookalike).val >> 13)
+ 
+ /* NOPs, to keep generic kernel happy */
+ #define __pte_to_swp_entry(pte)	((swp_entry_t) { pte_val(pte) })
+diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
+index 19ab3cf98f0f..fcc9a9e27e9c 100644
+--- a/arch/arc/plat-hsdk/Kconfig
++++ b/arch/arc/plat-hsdk/Kconfig
+@@ -7,5 +7,7 @@
+ 
+ menuconfig ARC_SOC_HSDK
+ 	bool "ARC HS Development Kit SOC"
++	depends on ISA_ARCV2
++	select ARC_HAS_ACCL_REGS
+ 	select CLK_HSDK
+ 	select RESET_HSDK
+diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
+index e734f6e45abc..689306118b48 100644
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -144,7 +144,9 @@ power9_restore_additional_sprs:
+ 	mtspr	SPRN_MMCR1, r4
+ 
+ 	ld	r3, STOP_MMCR2(r13)
++	ld	r4, PACA_SPRG_VDSO(r13)
+ 	mtspr	SPRN_MMCR2, r3
++	mtspr	SPRN_SPRG3, r4
+ 	blr
+ 
+ /*
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 8a10a045b57b..8cf03f101938 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -408,9 +408,11 @@ static int alloc_bts_buffer(int cpu)
+ 	ds->bts_buffer_base = (unsigned long) cea;
+ 	ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL);
+ 	ds->bts_index = ds->bts_buffer_base;
+-	max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE);
+-	ds->bts_absolute_maximum = ds->bts_buffer_base + max;
+-	ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16);
++	max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE;
++	ds->bts_absolute_maximum = ds->bts_buffer_base +
++					max * BTS_RECORD_SIZE;
++	ds->bts_interrupt_threshold = ds->bts_absolute_maximum -
++					(max / 16) * BTS_RECORD_SIZE;
+ 	return 0;
+ }
+ 
+diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
+index c356098b6fb9..4d4015ddcf26 100644
+--- a/arch/x86/include/asm/apm.h
++++ b/arch/x86/include/asm/apm.h
+@@ -7,8 +7,6 @@
+ #ifndef _ASM_X86_MACH_DEFAULT_APM_H
+ #define _ASM_X86_MACH_DEFAULT_APM_H
+ 
+-#include <asm/nospec-branch.h>
+-
+ #ifdef APM_ZERO_SEGS
+ #	define APM_DO_ZERO_SEGS \
+ 		"pushl %%ds\n\t" \
+@@ -34,7 +32,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
+ 	 * N.B. We do NOT need a cld after the BIOS call
+ 	 * because we always save and restore the flags.
+ 	 */
+-	firmware_restrict_branch_speculation_start();
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+@@ -47,7 +44,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
+ 		  "=S" (*esi)
+ 		: "a" (func), "b" (ebx_in), "c" (ecx_in)
+ 		: "memory", "cc");
+-	firmware_restrict_branch_speculation_end();
+ }
+ 
+ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
+@@ -60,7 +56,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
+ 	 * N.B. We do NOT need a cld after the BIOS call
+ 	 * because we always save and restore the flags.
+ 	 */
+-	firmware_restrict_branch_speculation_start();
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+@@ -73,7 +68,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
+ 		  "=S" (si)
+ 		: "a" (func), "b" (ebx_in), "c" (ecx_in)
+ 		: "memory", "cc");
+-	firmware_restrict_branch_speculation_end();
+ 	return error;
+ }
+ 
+diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
+index dfcbe6924eaf..3dd661dcc3f7 100644
+--- a/arch/x86/kernel/apm_32.c
++++ b/arch/x86/kernel/apm_32.c
+@@ -240,6 +240,7 @@
+ #include <asm/olpc.h>
+ #include <asm/paravirt.h>
+ #include <asm/reboot.h>
++#include <asm/nospec-branch.h>
+ 
+ #if defined(CONFIG_APM_DISPLAY_BLANK) && defined(CONFIG_VT)
+ extern int (*console_blank_hook)(int);
+@@ -614,11 +615,13 @@ static long __apm_bios_call(void *_call)
+ 	gdt[0x40 / 8] = bad_bios_desc;
+ 
+ 	apm_irq_save(flags);
++	firmware_restrict_branch_speculation_start();
+ 	APM_DO_SAVE_SEGS;
+ 	apm_bios_call_asm(call->func, call->ebx, call->ecx,
+ 			  &call->eax, &call->ebx, &call->ecx, &call->edx,
+ 			  &call->esi);
+ 	APM_DO_RESTORE_SEGS;
++	firmware_restrict_branch_speculation_end();
+ 	apm_irq_restore(flags);
+ 	gdt[0x40 / 8] = save_desc_40;
+ 	put_cpu();
+@@ -690,10 +693,12 @@ static long __apm_bios_call_simple(void *_call)
+ 	gdt[0x40 / 8] = bad_bios_desc;
+ 
+ 	apm_irq_save(flags);
++	firmware_restrict_branch_speculation_start();
+ 	APM_DO_SAVE_SEGS;
+ 	error = apm_bios_call_simple_asm(call->func, call->ebx, call->ecx,
+ 					 &call->eax);
+ 	APM_DO_RESTORE_SEGS;
++	firmware_restrict_branch_speculation_end();
+ 	apm_irq_restore(flags);
+ 	gdt[0x40 / 8] = save_desc_40;
+ 	put_cpu();
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 6f7eda9d5297..79ae1423b619 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -2147,9 +2147,6 @@ static ssize_t store_int_with_restart(struct device *s,
+ 	if (check_interval == old_check_interval)
+ 		return ret;
+ 
+-	if (check_interval < 1)
+-		check_interval = 1;
+-
+ 	mutex_lock(&mce_sysfs_mutex);
+ 	mce_restart();
+ 	mutex_unlock(&mce_sysfs_mutex);
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 8b26c9e01cc4..d79a18b4cf9d 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -319,6 +319,8 @@ void __init kvmclock_init(void)
+ 	printk(KERN_INFO "kvm-clock: Using msrs %x and %x",
+ 		msr_kvm_system_time, msr_kvm_wall_clock);
+ 
++	pvclock_set_pvti_cpu0_va(hv_clock);
++
+ 	if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
+ 		pvclock_set_flags(PVCLOCK_TSC_STABLE_BIT);
+ 
+@@ -366,14 +368,11 @@ int __init kvm_setup_vsyscall_timeinfo(void)
+ 	vcpu_time = &hv_clock[cpu].pvti;
+ 	flags = pvclock_read_flags(vcpu_time);
+ 
+-	if (!(flags & PVCLOCK_TSC_STABLE_BIT)) {
+-		put_cpu();
+-		return 1;
+-	}
+-
+-	pvclock_set_pvti_cpu0_va(hv_clock);
+ 	put_cpu();
+ 
++	if (!(flags & PVCLOCK_TSC_STABLE_BIT))
++		return 1;
++
+ 	kvm_clock.archdata.vclock_mode = VCLOCK_PVCLOCK;
+ #endif
+ 	return 0;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index dd4366edc200..a3bbac8ef4d0 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2376,6 +2376,7 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ #ifdef CONFIG_X86_64
+ 	int cpu = raw_smp_processor_id();
++	unsigned long fs_base, kernel_gs_base;
+ #endif
+ 	int i;
+ 
+@@ -2391,12 +2392,20 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
+ 	vmx->host_state.gs_ldt_reload_needed = vmx->host_state.ldt_sel;
+ 
+ #ifdef CONFIG_X86_64
+-	save_fsgs_for_kvm();
+-	vmx->host_state.fs_sel = current->thread.fsindex;
+-	vmx->host_state.gs_sel = current->thread.gsindex;
+-#else
+-	savesegment(fs, vmx->host_state.fs_sel);
+-	savesegment(gs, vmx->host_state.gs_sel);
++	if (likely(is_64bit_mm(current->mm))) {
++		save_fsgs_for_kvm();
++		vmx->host_state.fs_sel = current->thread.fsindex;
++		vmx->host_state.gs_sel = current->thread.gsindex;
++		fs_base = current->thread.fsbase;
++		kernel_gs_base = current->thread.gsbase;
++	} else {
++#endif
++		savesegment(fs, vmx->host_state.fs_sel);
++		savesegment(gs, vmx->host_state.gs_sel);
++#ifdef CONFIG_X86_64
++		fs_base = read_msr(MSR_FS_BASE);
++		kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
++	}
+ #endif
+ 	if (!(vmx->host_state.fs_sel & 7)) {
+ 		vmcs_write16(HOST_FS_SELECTOR, vmx->host_state.fs_sel);
+@@ -2416,10 +2425,10 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
+ 	savesegment(ds, vmx->host_state.ds_sel);
+ 	savesegment(es, vmx->host_state.es_sel);
+ 
+-	vmcs_writel(HOST_FS_BASE, current->thread.fsbase);
++	vmcs_writel(HOST_FS_BASE, fs_base);
+ 	vmcs_writel(HOST_GS_BASE, cpu_kernelmode_gs_base(cpu));
+ 
+-	vmx->msr_host_kernel_gs_base = current->thread.gsbase;
++	vmx->msr_host_kernel_gs_base = kernel_gs_base;
+ 	if (is_long_mode(&vmx->vcpu))
+ 		wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+ #else
+@@ -4110,11 +4119,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 	vmcs_conf->order = get_order(vmcs_conf->size);
+ 	vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
+ 
+-	/* KVM supports Enlightened VMCS v1 only */
+-	if (static_branch_unlikely(&enable_evmcs))
+-		vmcs_conf->revision_id = KVM_EVMCS_VERSION;
+-	else
+-		vmcs_conf->revision_id = vmx_msr_low;
++	vmcs_conf->revision_id = vmx_msr_low;
+ 
+ 	vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+ 	vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
+@@ -4184,7 +4189,13 @@ static struct vmcs *alloc_vmcs_cpu(int cpu)
+ 		return NULL;
+ 	vmcs = page_address(pages);
+ 	memset(vmcs, 0, vmcs_config.size);
+-	vmcs->revision_id = vmcs_config.revision_id; /* vmcs revision id */
++
++	/* KVM supports Enlightened VMCS v1 only */
++	if (static_branch_unlikely(&enable_evmcs))
++		vmcs->revision_id = KVM_EVMCS_VERSION;
++	else
++		vmcs->revision_id = vmcs_config.revision_id;
++
+ 	return vmcs;
+ }
+ 
+@@ -4343,6 +4354,19 @@ static __init int alloc_kvm_area(void)
+ 			return -ENOMEM;
+ 		}
+ 
++		/*
++		 * When eVMCS is enabled, alloc_vmcs_cpu() sets
++		 * vmcs->revision_id to KVM_EVMCS_VERSION instead of
++		 * revision_id reported by MSR_IA32_VMX_BASIC.
++		 *
++		 * However, even though not explictly documented by
++		 * TLFS, VMXArea passed as VMXON argument should
++		 * still be marked with revision_id reported by
++		 * physical CPU.
++		 */
++		if (static_branch_unlikely(&enable_evmcs))
++			vmcs->revision_id = vmcs_config.revision_id;
++
+ 		per_cpu(vmxarea, cpu) = vmcs;
+ 	}
+ 	return 0;
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index bd3f0a9d5e60..b357f81bfba6 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2179,6 +2179,18 @@ static bool __init intel_pstate_no_acpi_pss(void)
+ 	return true;
+ }
+ 
++static bool __init intel_pstate_no_acpi_pcch(void)
++{
++	acpi_status status;
++	acpi_handle handle;
++
++	status = acpi_get_handle(NULL, "\\_SB", &handle);
++	if (ACPI_FAILURE(status))
++		return true;
++
++	return !acpi_has_method(handle, "PCCH");
++}
++
+ static bool __init intel_pstate_has_acpi_ppc(void)
+ {
+ 	int i;
+@@ -2238,7 +2250,10 @@ static bool __init intel_pstate_platform_pwr_mgmt_exists(void)
+ 
+ 	switch (plat_info[idx].data) {
+ 	case PSS:
+-		return intel_pstate_no_acpi_pss();
++		if (!intel_pstate_no_acpi_pss())
++			return false;
++
++		return intel_pstate_no_acpi_pcch();
+ 	case PPC:
+ 		return intel_pstate_has_acpi_ppc() && !force_load;
+ 	}
+diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
+index 3f0ce2ae35ee..0c56c9759672 100644
+--- a/drivers/cpufreq/pcc-cpufreq.c
++++ b/drivers/cpufreq/pcc-cpufreq.c
+@@ -580,6 +580,10 @@ static int __init pcc_cpufreq_init(void)
+ {
+ 	int ret;
+ 
++	/* Skip initialization if another cpufreq driver is there. */
++	if (cpufreq_get_current_driver())
++		return 0;
++
+ 	if (acpi_disabled)
+ 		return 0;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index dc34b50e6b29..b11e9659e312 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -925,6 +925,10 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
+ 		r = amdgpu_bo_vm_update_pte(p);
+ 		if (r)
+ 			return r;
++
++		r = reservation_object_reserve_shared(vm->root.base.bo->tbo.resv);
++		if (r)
++			return r;
+ 	}
+ 
+ 	return amdgpu_cs_sync_rings(p);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 4304d9e408b8..ace9ad578ca0 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -83,22 +83,21 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
+ 	enum i2c_mot_mode mot = (msg->request & DP_AUX_I2C_MOT) ?
+ 		I2C_MOT_TRUE : I2C_MOT_FALSE;
+ 	enum ddc_result res;
+-	uint32_t read_bytes = msg->size;
++	ssize_t read_bytes;
+ 
+ 	if (WARN_ON(msg->size > 16))
+ 		return -E2BIG;
+ 
+ 	switch (msg->request & ~DP_AUX_I2C_MOT) {
+ 	case DP_AUX_NATIVE_READ:
+-		res = dal_ddc_service_read_dpcd_data(
++		read_bytes = dal_ddc_service_read_dpcd_data(
+ 				TO_DM_AUX(aux)->ddc_service,
+ 				false,
+ 				I2C_MOT_UNDEF,
+ 				msg->address,
+ 				msg->buffer,
+-				msg->size,
+-				&read_bytes);
+-		break;
++				msg->size);
++		return read_bytes;
+ 	case DP_AUX_NATIVE_WRITE:
+ 		res = dal_ddc_service_write_dpcd_data(
+ 				TO_DM_AUX(aux)->ddc_service,
+@@ -109,15 +108,14 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
+ 				msg->size);
+ 		break;
+ 	case DP_AUX_I2C_READ:
+-		res = dal_ddc_service_read_dpcd_data(
++		read_bytes = dal_ddc_service_read_dpcd_data(
+ 				TO_DM_AUX(aux)->ddc_service,
+ 				true,
+ 				mot,
+ 				msg->address,
+ 				msg->buffer,
+-				msg->size,
+-				&read_bytes);
+-		break;
++				msg->size);
++		return read_bytes;
+ 	case DP_AUX_I2C_WRITE:
+ 		res = dal_ddc_service_write_dpcd_data(
+ 				TO_DM_AUX(aux)->ddc_service,
+@@ -139,9 +137,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
+ 		 r == DDC_RESULT_SUCESSFULL);
+ #endif
+ 
+-	if (res != DDC_RESULT_SUCESSFULL)
+-		return -EIO;
+-	return read_bytes;
++	return msg->size;
+ }
+ 
+ static enum drm_connector_status
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+index ae48d603ebd6..49c2face1e7a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+@@ -629,14 +629,13 @@ bool dal_ddc_service_query_ddc_data(
+ 	return ret;
+ }
+ 
+-enum ddc_result dal_ddc_service_read_dpcd_data(
++ssize_t dal_ddc_service_read_dpcd_data(
+ 	struct ddc_service *ddc,
+ 	bool i2c,
+ 	enum i2c_mot_mode mot,
+ 	uint32_t address,
+ 	uint8_t *data,
+-	uint32_t len,
+-	uint32_t *read)
++	uint32_t len)
+ {
+ 	struct aux_payload read_payload = {
+ 		.i2c_over_aux = i2c,
+@@ -653,8 +652,6 @@ enum ddc_result dal_ddc_service_read_dpcd_data(
+ 		.mot = mot
+ 	};
+ 
+-	*read = 0;
+-
+ 	if (len > DEFAULT_AUX_MAX_DATA_SIZE) {
+ 		BREAK_TO_DEBUGGER();
+ 		return DDC_RESULT_FAILED_INVALID_OPERATION;
+@@ -664,8 +661,7 @@ enum ddc_result dal_ddc_service_read_dpcd_data(
+ 		ddc->ctx->i2caux,
+ 		ddc->ddc_pin,
+ 		&command)) {
+-		*read = command.payloads->length;
+-		return DDC_RESULT_SUCESSFULL;
++		return (ssize_t)command.payloads->length;
+ 	}
+ 
+ 	return DDC_RESULT_FAILED_OPERATION;
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
+index 30b3a08b91be..090b7a8dd67b 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
+@@ -102,14 +102,13 @@ bool dal_ddc_service_query_ddc_data(
+ 		uint8_t *read_buf,
+ 		uint32_t read_size);
+ 
+-enum ddc_result dal_ddc_service_read_dpcd_data(
++ssize_t dal_ddc_service_read_dpcd_data(
+ 		struct ddc_service *ddc,
+ 		bool i2c,
+ 		enum i2c_mot_mode mot,
+ 		uint32_t address,
+ 		uint8_t *data,
+-		uint32_t len,
+-		uint32_t *read);
++		uint32_t len);
+ 
+ enum ddc_result dal_ddc_service_write_dpcd_data(
+ 		struct ddc_service *ddc,
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index d345563fdff3..ce281d651ae8 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -553,24 +553,13 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ 
+ 	/* Clone the lessor file to create a new file for us */
+ 	DRM_DEBUG_LEASE("Allocating lease file\n");
+-	path_get(&lessor_file->f_path);
+-	lessee_file = alloc_file(&lessor_file->f_path,
+-				 lessor_file->f_mode,
+-				 fops_get(lessor_file->f_inode->i_fop));
+-
++	lessee_file = filp_clone_open(lessor_file);
+ 	if (IS_ERR(lessee_file)) {
+ 		ret = PTR_ERR(lessee_file);
+ 		goto out_lessee;
+ 	}
+ 
+-	/* Initialize the new file for DRM */
+-	DRM_DEBUG_LEASE("Initializing the file with %p\n", lessee_file->f_op->open);
+-	ret = lessee_file->f_op->open(lessee_file->f_inode, lessee_file);
+-	if (ret)
+-		goto out_lessee_file;
+-
+ 	lessee_priv = lessee_file->private_data;
+-
+ 	/* Change the file to a master one */
+ 	drm_master_put(&lessee_priv->master);
+ 	lessee_priv->master = lessee;
+@@ -588,9 +577,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
+ 	return 0;
+ 
+-out_lessee_file:
+-	fput(lessee_file);
+-
+ out_lessee:
+ 	drm_master_put(&lessee);
+ 
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index b25cc5aa8fbe..d793b2bbd6c2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1967,10 +1967,38 @@ static void valleyview_pipestat_irq_handler(struct drm_i915_private *dev_priv,
+ 
+ static u32 i9xx_hpd_irq_ack(struct drm_i915_private *dev_priv)
+ {
+-	u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
++	u32 hotplug_status = 0, hotplug_status_mask;
++	int i;
++
++	if (IS_G4X(dev_priv) ||
++	    IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
++		hotplug_status_mask = HOTPLUG_INT_STATUS_G4X |
++			DP_AUX_CHANNEL_MASK_INT_STATUS_G4X;
++	else
++		hotplug_status_mask = HOTPLUG_INT_STATUS_I915;
+ 
+-	if (hotplug_status)
++	/*
++	 * We absolutely have to clear all the pending interrupt
++	 * bits in PORT_HOTPLUG_STAT. Otherwise the ISR port
++	 * interrupt bit won't have an edge, and the i965/g4x
++	 * edge triggered IIR will not notice that an interrupt
++	 * is still pending. We can't use PORT_HOTPLUG_EN to
++	 * guarantee the edge as the act of toggling the enable
++	 * bits can itself generate a new hotplug interrupt :(
++	 */
++	for (i = 0; i < 10; i++) {
++		u32 tmp = I915_READ(PORT_HOTPLUG_STAT) & hotplug_status_mask;
++
++		if (tmp == 0)
++			return hotplug_status;
++
++		hotplug_status |= tmp;
+ 		I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
++	}
++
++	WARN_ONCE(1,
++		  "PORT_HOTPLUG_STAT did not clear (0x%08x)\n",
++		  I915_READ(PORT_HOTPLUG_STAT));
+ 
+ 	return hotplug_status;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+index debbbf0fd4bd..408b955e5c39 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+@@ -267,6 +267,7 @@ nouveau_backlight_init(struct drm_device *dev)
+ 	struct nouveau_drm *drm = nouveau_drm(dev);
+ 	struct nvif_device *device = &drm->client.device;
+ 	struct drm_connector *connector;
++	struct drm_connector_list_iter conn_iter;
+ 
+ 	INIT_LIST_HEAD(&drm->bl_connectors);
+ 
+@@ -275,7 +276,8 @@ nouveau_backlight_init(struct drm_device *dev)
+ 		return 0;
+ 	}
+ 
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++	drm_connector_list_iter_begin(dev, &conn_iter);
++	drm_for_each_connector_iter(connector, &conn_iter) {
+ 		if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
+ 		    connector->connector_type != DRM_MODE_CONNECTOR_eDP)
+ 			continue;
+@@ -292,7 +294,7 @@ nouveau_backlight_init(struct drm_device *dev)
+ 			break;
+ 		}
+ 	}
+-
++	drm_connector_list_iter_end(&conn_iter);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 6ed9cb053dfa..359fecce8cc0 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -1208,14 +1208,19 @@ nouveau_connector_create(struct drm_device *dev, int index)
+ 	struct nouveau_display *disp = nouveau_display(dev);
+ 	struct nouveau_connector *nv_connector = NULL;
+ 	struct drm_connector *connector;
++	struct drm_connector_list_iter conn_iter;
+ 	int type, ret = 0;
+ 	bool dummy;
+ 
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++	drm_connector_list_iter_begin(dev, &conn_iter);
++	nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+ 		nv_connector = nouveau_connector(connector);
+-		if (nv_connector->index == index)
++		if (nv_connector->index == index) {
++			drm_connector_list_iter_end(&conn_iter);
+ 			return connector;
++		}
+ 	}
++	drm_connector_list_iter_end(&conn_iter);
+ 
+ 	nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL);
+ 	if (!nv_connector)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
+index a4d1a059bd3d..dc7454e7f19a 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
+@@ -33,6 +33,7 @@
+ #include <drm/drm_encoder.h>
+ #include <drm/drm_dp_helper.h>
+ #include "nouveau_crtc.h"
++#include "nouveau_encoder.h"
+ 
+ struct nvkm_i2c_port;
+ 
+@@ -60,19 +61,46 @@ static inline struct nouveau_connector *nouveau_connector(
+ 	return container_of(con, struct nouveau_connector, base);
+ }
+ 
++static inline bool
++nouveau_connector_is_mst(struct drm_connector *connector)
++{
++	const struct nouveau_encoder *nv_encoder;
++	const struct drm_encoder *encoder;
++
++	if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
++		return false;
++
++	nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY);
++	if (!nv_encoder)
++		return false;
++
++	encoder = &nv_encoder->base.base;
++	return encoder->encoder_type == DRM_MODE_ENCODER_DPMST;
++}
++
++#define nouveau_for_each_non_mst_connector_iter(connector, iter) \
++	drm_for_each_connector_iter(connector, iter) \
++		for_each_if(!nouveau_connector_is_mst(connector))
++
+ static inline struct nouveau_connector *
+ nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
+ {
+ 	struct drm_device *dev = nv_crtc->base.dev;
+ 	struct drm_connector *connector;
++	struct drm_connector_list_iter conn_iter;
++	struct nouveau_connector *nv_connector = NULL;
+ 	struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
+ 
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+-		if (connector->encoder && connector->encoder->crtc == crtc)
+-			return nouveau_connector(connector);
++	drm_connector_list_iter_begin(dev, &conn_iter);
++	nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
++		if (connector->encoder && connector->encoder->crtc == crtc) {
++			nv_connector = nouveau_connector(connector);
++			break;
++		}
+ 	}
++	drm_connector_list_iter_end(&conn_iter);
+ 
+-	return NULL;
++	return nv_connector;
+ }
+ 
+ struct drm_connector *
+diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
+index 009713404cc4..4cba117e81fc 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_display.c
++++ b/drivers/gpu/drm/nouveau/nouveau_display.c
+@@ -406,6 +406,7 @@ nouveau_display_init(struct drm_device *dev)
+ 	struct nouveau_display *disp = nouveau_display(dev);
+ 	struct nouveau_drm *drm = nouveau_drm(dev);
+ 	struct drm_connector *connector;
++	struct drm_connector_list_iter conn_iter;
+ 	int ret;
+ 
+ 	ret = disp->init(dev);
+@@ -413,10 +414,12 @@ nouveau_display_init(struct drm_device *dev)
+ 		return ret;
+ 
+ 	/* enable hotplug interrupts */
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++	drm_connector_list_iter_begin(dev, &conn_iter);
++	nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+ 		struct nouveau_connector *conn = nouveau_connector(connector);
+ 		nvif_notify_get(&conn->hpd);
+ 	}
++	drm_connector_list_iter_end(&conn_iter);
+ 
+ 	/* enable flip completion events */
+ 	nvif_notify_get(&drm->flip);
+@@ -429,6 +432,7 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
+ 	struct nouveau_display *disp = nouveau_display(dev);
+ 	struct nouveau_drm *drm = nouveau_drm(dev);
+ 	struct drm_connector *connector;
++	struct drm_connector_list_iter conn_iter;
+ 
+ 	if (!suspend) {
+ 		if (drm_drv_uses_atomic_modeset(dev))
+@@ -441,10 +445,12 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
+ 	nvif_notify_put(&drm->flip);
+ 
+ 	/* disable hotplug interrupts */
+-	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++	drm_connector_list_iter_begin(dev, &conn_iter);
++	nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+ 		struct nouveau_connector *conn = nouveau_connector(connector);
+ 		nvif_notify_put(&conn->hpd);
+ 	}
++	drm_connector_list_iter_end(&conn_iter);
+ 
+ 	drm_kms_helper_poll_disable(dev);
+ 	disp->fini(dev);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index bbbf353682e1..0bffeb95b072 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -866,22 +866,11 @@ nouveau_pmops_runtime_resume(struct device *dev)
+ static int
+ nouveau_pmops_runtime_idle(struct device *dev)
+ {
+-	struct pci_dev *pdev = to_pci_dev(dev);
+-	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+-	struct nouveau_drm *drm = nouveau_drm(drm_dev);
+-	struct drm_crtc *crtc;
+-
+ 	if (!nouveau_pmops_runtime()) {
+ 		pm_runtime_forbid(dev);
+ 		return -EBUSY;
+ 	}
+ 
+-	list_for_each_entry(crtc, &drm->dev->mode_config.crtc_list, head) {
+-		if (crtc->enabled) {
+-			DRM_DEBUG_DRIVER("failing to power off - crtc active\n");
+-			return -EBUSY;
+-		}
+-	}
+ 	pm_runtime_mark_last_busy(dev);
+ 	pm_runtime_autosuspend(dev);
+ 	/* we don't want the main rpm_idle to call suspend - we want to autosuspend */
+diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
+index 753b1a698fc4..6b16946f9b05 100644
+--- a/drivers/misc/cxl/api.c
++++ b/drivers/misc/cxl/api.c
+@@ -103,15 +103,15 @@ static struct file *cxl_getfile(const char *name,
+ 	d_instantiate(path.dentry, inode);
+ 
+ 	file = alloc_file(&path, OPEN_FMODE(flags), fops);
+-	if (IS_ERR(file))
+-		goto err_dput;
++	if (IS_ERR(file)) {
++		path_put(&path);
++		goto err_fs;
++	}
+ 	file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
+ 	file->private_data = priv;
+ 
+ 	return file;
+ 
+-err_dput:
+-	path_put(&path);
+ err_inode:
+ 	iput(inode);
+ err_fs:
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+index fc7383106946..91eb8910b1c9 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+@@ -63,8 +63,6 @@
+ 
+ #define AQ_CFG_NAPI_WEIGHT     64U
+ 
+-#define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
+-
+ /*#define AQ_CFG_MAC_ADDR_PERMANENT {0x30, 0x0E, 0xE3, 0x12, 0x34, 0x56}*/
+ 
+ #define AQ_NIC_FC_OFF    0U
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+index a2d416b24ffc..2c6ebd91a9f2 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+@@ -98,6 +98,8 @@ struct aq_stats_s {
+ #define AQ_HW_MEDIA_TYPE_TP    1U
+ #define AQ_HW_MEDIA_TYPE_FIBRE 2U
+ 
++#define AQ_HW_MULTICAST_ADDRESS_MAX     32U
++
+ struct aq_hw_s {
+ 	atomic_t flags;
+ 	u8 rbl_enabled:1;
+@@ -177,7 +179,7 @@ struct aq_hw_ops {
+ 				    unsigned int packet_filter);
+ 
+ 	int (*hw_multicast_list_set)(struct aq_hw_s *self,
+-				     u8 ar_mac[AQ_CFG_MULTICAST_ADDRESS_MAX]
++				     u8 ar_mac[AQ_HW_MULTICAST_ADDRESS_MAX]
+ 				     [ETH_ALEN],
+ 				     u32 count);
+ 
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index ba5fe8c4125d..e3ae29e523f0 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -135,17 +135,10 @@ static int aq_ndev_set_mac_address(struct net_device *ndev, void *addr)
+ static void aq_ndev_set_multicast_settings(struct net_device *ndev)
+ {
+ 	struct aq_nic_s *aq_nic = netdev_priv(ndev);
+-	int err = 0;
+ 
+-	err = aq_nic_set_packet_filter(aq_nic, ndev->flags);
+-	if (err < 0)
+-		return;
++	aq_nic_set_packet_filter(aq_nic, ndev->flags);
+ 
+-	if (netdev_mc_count(ndev)) {
+-		err = aq_nic_set_multicast_list(aq_nic, ndev);
+-		if (err < 0)
+-			return;
+-	}
++	aq_nic_set_multicast_list(aq_nic, ndev);
+ }
+ 
+ static const struct net_device_ops aq_ndev_ops = {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 1a1a6380c128..7a22d0257e04 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -563,34 +563,41 @@ int aq_nic_set_packet_filter(struct aq_nic_s *self, unsigned int flags)
+ 
+ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ {
++	unsigned int packet_filter = self->packet_filter;
+ 	struct netdev_hw_addr *ha = NULL;
+ 	unsigned int i = 0U;
+ 
+-	self->mc_list.count = 0U;
+-
+-	netdev_for_each_mc_addr(ha, ndev) {
+-		ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+-		++self->mc_list.count;
++	self->mc_list.count = 0;
++	if (netdev_uc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
++		packet_filter |= IFF_PROMISC;
++	} else {
++		netdev_for_each_uc_addr(ha, ndev) {
++			ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+ 
+-		if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX)
+-			break;
++			if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
++				break;
++		}
+ 	}
+ 
+-	if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) {
+-		/* Number of filters is too big: atlantic does not support this.
+-		 * Force all multi filter to support this.
+-		 * With this we disable all UC filters and setup "all pass"
+-		 * multicast mask
+-		 */
+-		self->packet_filter |= IFF_ALLMULTI;
+-		self->aq_nic_cfg.mc_list_count = 0;
+-		return self->aq_hw_ops->hw_packet_filter_set(self->aq_hw,
+-							     self->packet_filter);
++	if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
++		packet_filter |= IFF_ALLMULTI;
+ 	} else {
+-		return self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+-						    self->mc_list.ar,
+-						    self->mc_list.count);
++		netdev_for_each_mc_addr(ha, ndev) {
++			ether_addr_copy(self->mc_list.ar[i++], ha->addr);
++
++			if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
++				break;
++		}
++	}
++
++	if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
++		packet_filter |= IFF_MULTICAST;
++		self->mc_list.count = i;
++		self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
++						       self->mc_list.ar,
++						       self->mc_list.count);
+ 	}
++	return aq_nic_set_packet_filter(self, packet_filter);
+ }
+ 
+ int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+index faa533a0ec47..fecfc401f95d 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+@@ -75,7 +75,7 @@ struct aq_nic_s {
+ 	struct aq_hw_link_status_s link_status;
+ 	struct {
+ 		u32 count;
+-		u8 ar[AQ_CFG_MULTICAST_ADDRESS_MAX][ETH_ALEN];
++		u8 ar[AQ_HW_MULTICAST_ADDRESS_MAX][ETH_ALEN];
+ 	} mc_list;
+ 
+ 	struct pci_dev *pdev;
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index 67e2f9fb9402..8cc6abadc03b 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -765,7 +765,7 @@ static int hw_atl_a0_hw_packet_filter_set(struct aq_hw_s *self,
+ 
+ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
+ 					   u8 ar_mac
+-					   [AQ_CFG_MULTICAST_ADDRESS_MAX]
++					   [AQ_HW_MULTICAST_ADDRESS_MAX]
+ 					   [ETH_ALEN],
+ 					   u32 count)
+ {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 819f6bcf9b4e..956860a69797 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -784,7 +784,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
+ 
+ static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
+ 					   u8 ar_mac
+-					   [AQ_CFG_MULTICAST_ADDRESS_MAX]
++					   [AQ_HW_MULTICAST_ADDRESS_MAX]
+ 					   [ETH_ALEN],
+ 					   u32 count)
+ {
+@@ -812,7 +812,7 @@ static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
+ 
+ 		hw_atl_rpfl2_uc_flr_en_set(self,
+ 					   (self->aq_nic_cfg->is_mc_list_enabled),
+-				    HW_ATL_B0_MAC_MIN + i);
++					   HW_ATL_B0_MAC_MIN + i);
+ 	}
+ 
+ 	err = aq_hw_err_from_flags(self);
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index f33b25fbca63..7db072fe5f22 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1946,8 +1946,8 @@ static int bcm_sysport_open(struct net_device *dev)
+ 	if (!priv->is_lite)
+ 		priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
+ 	else
+-		priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
+-				   GIB_FCS_STRIP);
++		priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
++				  GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
+ 
+ 	phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
+ 				0, priv->phy_interface);
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
+index d6e5d0cbf3a3..cf440b91fd04 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.h
++++ b/drivers/net/ethernet/broadcom/bcmsysport.h
+@@ -278,7 +278,8 @@ struct bcm_rsb {
+ #define  GIB_GTX_CLK_EXT_CLK		(0 << GIB_GTX_CLK_SEL_SHIFT)
+ #define  GIB_GTX_CLK_125MHZ		(1 << GIB_GTX_CLK_SEL_SHIFT)
+ #define  GIB_GTX_CLK_250MHZ		(2 << GIB_GTX_CLK_SEL_SHIFT)
+-#define  GIB_FCS_STRIP			(1 << 6)
++#define  GIB_FCS_STRIP_SHIFT		6
++#define  GIB_FCS_STRIP			(1 << GIB_FCS_STRIP_SHIFT)
+ #define  GIB_LCL_LOOP_EN		(1 << 7)
+ #define  GIB_LCL_LOOP_TXEN		(1 << 8)
+ #define  GIB_RMT_LOOP_EN		(1 << 9)
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 9f59b1270a7c..3e0e7f18ecf9 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -9289,6 +9289,15 @@ static int tg3_chip_reset(struct tg3 *tp)
+ 
+ 	tg3_restore_clk(tp);
+ 
++	/* Increase the core clock speed to fix tx timeout issue for 5762
++	 * with 100Mbps link speed.
++	 */
++	if (tg3_asic_rev(tp) == ASIC_REV_5762) {
++		val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
++		tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
++		     TG3_CPMU_MAC_ORIDE_ENABLE);
++	}
++
+ 	/* Reprobe ASF enable state.  */
+ 	tg3_flag_clear(tp, ENABLE_ASF);
+ 	tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index 5c613c6663da..2ca0f1dad54c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -474,10 +474,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
+ {
+ 	const struct mlx4_en_frag_info *frag_info = priv->frag_info;
+ 	unsigned int truesize = 0;
++	bool release = true;
+ 	int nr, frag_size;
+ 	struct page *page;
+ 	dma_addr_t dma;
+-	bool release;
+ 
+ 	/* Collect used fragments while replacing them in the HW descriptors */
+ 	for (nr = 0;; frags++) {
+@@ -500,7 +500,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
+ 			release = page_count(page) != 1 ||
+ 				  page_is_pfmemalloc(page) ||
+ 				  page_to_nid(page) != numa_mem_id();
+-		} else {
++		} else if (!priv->rx_headroom) {
++			/* rx_headroom for non XDP setup is always 0.
++			 * When XDP is set, the above condition will
++			 * guarantee page is always released.
++			 */
+ 			u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
+ 
+ 			frags->page_offset += sz_align;
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index c418113c6b20..c10ca3c20b36 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1291,6 +1291,7 @@ int netvsc_poll(struct napi_struct *napi, int budget)
+ 	struct hv_device *device = netvsc_channel_to_device(channel);
+ 	struct net_device *ndev = hv_get_drvdata(device);
+ 	int work_done = 0;
++	int ret;
+ 
+ 	/* If starting a new interval */
+ 	if (!nvchan->desc)
+@@ -1302,16 +1303,18 @@ int netvsc_poll(struct napi_struct *napi, int budget)
+ 		nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
+ 	}
+ 
+-	/* If send of pending receive completions suceeded
+-	 *   and did not exhaust NAPI budget this time
+-	 *   and not doing busy poll
++	/* Send any pending receive completions */
++	ret = send_recv_completions(ndev, net_device, nvchan);
++
++	/* If it did not exhaust NAPI budget this time
++	 *  and not doing busy poll
+ 	 * then re-enable host interrupts
+-	 *     and reschedule if ring is not empty.
++	 *  and reschedule if ring is not empty
++	 *   or sending receive completion failed.
+ 	 */
+-	if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
+-	    work_done < budget &&
++	if (work_done < budget &&
+ 	    napi_complete_done(napi, work_done) &&
+-	    hv_end_read(&channel->inbound) &&
++	    (ret || hv_end_read(&channel->inbound)) &&
+ 	    napi_schedule_prep(napi)) {
+ 		hv_begin_read(&channel->inbound);
+ 		__napi_schedule(napi);
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 9e4ba8e80a18..5aa081fda447 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1720,11 +1720,8 @@ EXPORT_SYMBOL(genphy_loopback);
+ 
+ static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
+ {
+-	/* The default values for phydev->supported are provided by the PHY
+-	 * driver "features" member, we want to reset to sane defaults first
+-	 * before supporting higher speeds.
+-	 */
+-	phydev->supported &= PHY_DEFAULT_FEATURES;
++	phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
++			       PHY_10BT_FEATURES);
+ 
+ 	switch (max_speed) {
+ 	default:
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index 3d4f7959dabb..b1b3d8f7e67d 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
+ 				     priv->presvd_phy_advertise);
+ 
+ 		/* Restore BMCR */
++		if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
++			priv->presvd_phy_bmcr |= BMCR_ANRESTART;
++
+ 		asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
+ 				     priv->presvd_phy_bmcr);
+ 
+-		mii_nway_restart(&dev->mii);
+ 		priv->presvd_phy_advertise = 0;
+ 		priv->presvd_phy_bmcr = 0;
+ 	}
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 04c22f508ed9..f8f90d77cf0f 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1253,6 +1253,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},	/* SIMCom 7230E */
+ 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
+ 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)},	/* Quectel EC21 Mini PCIe */
++	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)},	/* Quectel EG91 */
+ 	{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},	/* Quectel BG96 */
+ 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)},	/* Quectel EP06 Mini PCIe */
+ 
+diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
+index 767c485af59b..522719b494f3 100644
+--- a/drivers/ptp/ptp_chardev.c
++++ b/drivers/ptp/ptp_chardev.c
+@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
+ 	case PTP_PF_PHYSYNC:
+ 		if (chan != 0)
+ 			return -EINVAL;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index eb2ec1fb07cb..209de7cd9358 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -361,6 +361,8 @@ struct ct_arg {
+ 	dma_addr_t	rsp_dma;
+ 	u32		req_size;
+ 	u32		rsp_size;
++	u32		req_allocated_size;
++	u32		rsp_allocated_size;
+ 	void		*req;
+ 	void		*rsp;
+ 	port_id_t	id;
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 05abe5aaab7f..cbfbab5d9a59 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -556,7 +556,7 @@ static void qla2x00_async_sns_sp_done(void *s, int rc)
+ 		/* please ignore kernel warning. otherwise, we have mem leak. */
+ 		if (sp->u.iocb_cmd.u.ctarg.req) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-			    sizeof(struct ct_sns_pkt),
++			    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 			    sp->u.iocb_cmd.u.ctarg.req,
+ 			    sp->u.iocb_cmd.u.ctarg.req_dma);
+ 			sp->u.iocb_cmd.u.ctarg.req = NULL;
+@@ -564,7 +564,7 @@ static void qla2x00_async_sns_sp_done(void *s, int rc)
+ 
+ 		if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-			    sizeof(struct ct_sns_pkt),
++			    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 			    sp->u.iocb_cmd.u.ctarg.rsp,
+ 			    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -617,6 +617,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
+ 	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 		ql_log(ql_log_warn, vha, 0xd041,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -627,6 +628,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
+ 	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		ql_log(ql_log_warn, vha, 0xd042,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -712,6 +714,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
+ 	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 		ql_log(ql_log_warn, vha, 0xd041,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -722,6 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
+ 	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		ql_log(ql_log_warn, vha, 0xd042,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -802,6 +806,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
+ 	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 		ql_log(ql_log_warn, vha, 0xd041,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -812,6 +817,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
+ 	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		ql_log(ql_log_warn, vha, 0xd042,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -909,6 +915,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
+ 	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 		ql_log(ql_log_warn, vha, 0xd041,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -919,6 +926,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
+ 	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
+ 	    GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		ql_log(ql_log_warn, vha, 0xd042,
+ 		    "%s: Failed to allocate ct_sns request.\n",
+@@ -3392,14 +3400,14 @@ void qla24xx_sp_unmap(scsi_qla_host_t *vha, srb_t *sp)
+ {
+ 	if (sp->u.iocb_cmd.u.ctarg.req) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-			sizeof(struct ct_sns_pkt),
++			sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 			sp->u.iocb_cmd.u.ctarg.req,
+ 			sp->u.iocb_cmd.u.ctarg.req_dma);
+ 		sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 	}
+ 	if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-			sizeof(struct ct_sns_pkt),
++			sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 			sp->u.iocb_cmd.u.ctarg.rsp,
+ 			sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -3600,14 +3608,14 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res)
+ 		/* please ignore kernel warning. otherwise, we have mem leak. */
+ 		if (sp->u.iocb_cmd.u.ctarg.req) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-				sizeof(struct ct_sns_pkt),
++				sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 				sp->u.iocb_cmd.u.ctarg.req,
+ 				sp->u.iocb_cmd.u.ctarg.req_dma);
+ 			sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 		}
+ 		if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-				sizeof(struct ct_sns_pkt),
++				sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 				sp->u.iocb_cmd.u.ctarg.rsp,
+ 				sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -3658,6 +3666,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
+ 	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 		sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
+ 		GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 		ql_log(ql_log_warn, vha, 0xd041,
+ 		    "Failed to allocate ct_sns request.\n");
+@@ -3667,6 +3676,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
+ 	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
+ 		sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
+ 		GFP_KERNEL);
++	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 	if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		ql_log(ql_log_warn, vha, 0xd042,
+ 		    "Failed to allocate ct_sns request.\n");
+@@ -4125,14 +4135,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+ 			 */
+ 			if (sp->u.iocb_cmd.u.ctarg.req) {
+ 				dma_free_coherent(&vha->hw->pdev->dev,
+-				    sizeof(struct ct_sns_pkt),
++				    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 				    sp->u.iocb_cmd.u.ctarg.req,
+ 				    sp->u.iocb_cmd.u.ctarg.req_dma);
+ 				sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 			}
+ 			if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 				dma_free_coherent(&vha->hw->pdev->dev,
+-				    sizeof(struct ct_sns_pkt),
++				    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 				    sp->u.iocb_cmd.u.ctarg.rsp,
+ 				    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 				sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -4162,14 +4172,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+ 		/* please ignore kernel warning. Otherwise, we have mem leak. */
+ 		if (sp->u.iocb_cmd.u.ctarg.req) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-			    sizeof(struct ct_sns_pkt),
++			    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 			    sp->u.iocb_cmd.u.ctarg.req,
+ 			    sp->u.iocb_cmd.u.ctarg.req_dma);
+ 			sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 		}
+ 		if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 			dma_free_coherent(&vha->hw->pdev->dev,
+-			    sizeof(struct ct_sns_pkt),
++			    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 			    sp->u.iocb_cmd.u.ctarg.rsp,
+ 			    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -4264,14 +4274,14 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
+ done_free_sp:
+ 	if (sp->u.iocb_cmd.u.ctarg.req) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-		    sizeof(struct ct_sns_pkt),
++		    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 		    sp->u.iocb_cmd.u.ctarg.req,
+ 		    sp->u.iocb_cmd.u.ctarg.req_dma);
+ 		sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 	}
+ 	if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-		    sizeof(struct ct_sns_pkt),
++		    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 		    sp->u.iocb_cmd.u.ctarg.rsp,
+ 		    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+@@ -4332,6 +4342,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+ 		sp->u.iocb_cmd.u.ctarg.req = dma_zalloc_coherent(
+ 			&vha->hw->pdev->dev, sizeof(struct ct_sns_pkt),
+ 			&sp->u.iocb_cmd.u.ctarg.req_dma, GFP_KERNEL);
++		sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
+ 		if (!sp->u.iocb_cmd.u.ctarg.req) {
+ 			ql_log(ql_log_warn, vha, 0xffff,
+ 			    "Failed to allocate ct_sns request.\n");
+@@ -4349,6 +4360,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+ 		sp->u.iocb_cmd.u.ctarg.rsp = dma_zalloc_coherent(
+ 			&vha->hw->pdev->dev, rspsz,
+ 			&sp->u.iocb_cmd.u.ctarg.rsp_dma, GFP_KERNEL);
++		sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
+ 		if (!sp->u.iocb_cmd.u.ctarg.rsp) {
+ 			ql_log(ql_log_warn, vha, 0xffff,
+ 			    "Failed to allocate ct_sns request.\n");
+@@ -4408,14 +4420,14 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+ done_free_sp:
+ 	if (sp->u.iocb_cmd.u.ctarg.req) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-		    sizeof(struct ct_sns_pkt),
++		    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+ 		    sp->u.iocb_cmd.u.ctarg.req,
+ 		    sp->u.iocb_cmd.u.ctarg.req_dma);
+ 		sp->u.iocb_cmd.u.ctarg.req = NULL;
+ 	}
+ 	if (sp->u.iocb_cmd.u.ctarg.rsp) {
+ 		dma_free_coherent(&vha->hw->pdev->dev,
+-		    sizeof(struct ct_sns_pkt),
++		    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+ 		    sp->u.iocb_cmd.u.ctarg.rsp,
+ 		    sp->u.iocb_cmd.u.ctarg.rsp_dma);
+ 		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 636960ad029a..0cb552268be3 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -591,12 +591,14 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ 				conflict_fcport =
+ 					qla2x00_find_fcport_by_wwpn(vha,
+ 					    e->port_name, 0);
+-				ql_dbg(ql_dbg_disc, vha, 0x20e6,
+-				    "%s %d %8phC post del sess\n",
+-				    __func__, __LINE__,
+-				    conflict_fcport->port_name);
+-				qlt_schedule_sess_for_deletion
+-					(conflict_fcport);
++				if (conflict_fcport) {
++					qlt_schedule_sess_for_deletion
++						(conflict_fcport);
++					ql_dbg(ql_dbg_disc, vha, 0x20e6,
++					    "%s %d %8phC post del sess\n",
++					    __func__, __LINE__,
++					    conflict_fcport->port_name);
++				}
+ 			}
+ 
+ 			/* FW already picked this loop id for another fcport */
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 15eaa6dded04..2b0816dfe9bd 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3180,6 +3180,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	    "req->req_q_in=%p req->req_q_out=%p rsp->rsp_q_in=%p rsp->rsp_q_out=%p.\n",
+ 	    req->req_q_in, req->req_q_out, rsp->rsp_q_in, rsp->rsp_q_out);
+ 
++	ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
++
+ 	if (ha->isp_ops->initialize_adapter(base_vha)) {
+ 		ql_log(ql_log_fatal, base_vha, 0x00d6,
+ 		    "Failed to initialize adapter - Adapter flags %x.\n",
+@@ -3216,8 +3218,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	    host->can_queue, base_vha->req,
+ 	    base_vha->mgmt_svr_loop_id, host->sg_tablesize);
+ 
+-	ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
+-
+ 	if (ha->mqenable) {
+ 		bool mq = false;
+ 		bool startit = false;
+diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
+index 210407cd2341..da868f6c9638 100644
+--- a/drivers/scsi/sd_zbc.c
++++ b/drivers/scsi/sd_zbc.c
+@@ -401,7 +401,8 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
+  * Check that all zones of the device are equal. The last zone can however
+  * be smaller. The zone size must also be a power of two number of LBAs.
+  *
+- * Returns the zone size in bytes upon success or an error code upon failure.
++ * Returns the zone size in number of blocks upon success or an error code
++ * upon failure.
+  */
+ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
+ {
+@@ -411,7 +412,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
+ 	unsigned char *rec;
+ 	unsigned int buf_len;
+ 	unsigned int list_length;
+-	int ret;
++	s64 ret;
+ 	u8 same;
+ 
+ 	/* Get a buffer */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 711da3306b14..61c3dc2f3be5 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -844,6 +844,41 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ }
+ 
++static bool xhci_pending_portevent(struct xhci_hcd *xhci)
++{
++	__le32 __iomem		**port_array;
++	int			port_index;
++	u32			status;
++	u32			portsc;
++
++	status = readl(&xhci->op_regs->status);
++	if (status & STS_EINT)
++		return true;
++	/*
++	 * Checking STS_EINT is not enough as there is a lag between a change
++	 * bit being set and the Port Status Change Event that it generated
++	 * being written to the Event Ring. See note in xhci 1.1 section 4.19.2.
++	 */
++
++	port_index = xhci->num_usb2_ports;
++	port_array = xhci->usb2_ports;
++	while (port_index--) {
++		portsc = readl(port_array[port_index]);
++		if (portsc & PORT_CHANGE_MASK ||
++		    (portsc & PORT_PLS_MASK) == XDEV_RESUME)
++			return true;
++	}
++	port_index = xhci->num_usb3_ports;
++	port_array = xhci->usb3_ports;
++	while (port_index--) {
++		portsc = readl(port_array[port_index]);
++		if (portsc & PORT_CHANGE_MASK ||
++		    (portsc & PORT_PLS_MASK) == XDEV_RESUME)
++			return true;
++	}
++	return false;
++}
++
+ /*
+  * Stop HC (not bus-specific)
+  *
+@@ -945,7 +980,7 @@ EXPORT_SYMBOL_GPL(xhci_suspend);
+  */
+ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ {
+-	u32			command, temp = 0, status;
++	u32			command, temp = 0;
+ 	struct usb_hcd		*hcd = xhci_to_hcd(xhci);
+ 	struct usb_hcd		*secondary_hcd;
+ 	int			retval = 0;
+@@ -1069,8 +1104,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+  done:
+ 	if (retval == 0) {
+ 		/* Resume root hubs only when have pending events. */
+-		status = readl(&xhci->op_regs->status);
+-		if (status & STS_EINT) {
++		if (xhci_pending_portevent(xhci)) {
+ 			usb_hcd_resume_root_hub(xhci->shared_hcd);
+ 			usb_hcd_resume_root_hub(hcd);
+ 		}
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6dfc4867dbcf..9751c1373fbb 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -382,6 +382,10 @@ struct xhci_op_regs {
+ #define PORT_PLC	(1 << 22)
+ /* port configure error change - port failed to configure its link partner */
+ #define PORT_CEC	(1 << 23)
++#define PORT_CHANGE_MASK	(PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
++				 PORT_RC | PORT_PLC | PORT_CEC)
++
++
+ /* Cold Attach Status - xHC can set this bit to report device attached during
+  * Sx state. Warm port reset should be perfomed to clear this bit and move port
+  * to connected state.
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index b423a309a6e0..125b58eff936 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -28,6 +28,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/vfio.h>
+ #include <linux/vgaarb.h>
++#include <linux/nospec.h>
+ 
+ #include "vfio_pci_private.h"
+ 
+@@ -727,6 +728,9 @@ static long vfio_pci_ioctl(void *device_data,
+ 			if (info.index >=
+ 			    VFIO_PCI_NUM_REGIONS + vdev->num_regions)
+ 				return -EINVAL;
++			info.index = array_index_nospec(info.index,
++							VFIO_PCI_NUM_REGIONS +
++							vdev->num_regions);
+ 
+ 			i = info.index - VFIO_PCI_NUM_REGIONS;
+ 
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 759a5bdd40e1..2da5f054257a 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -457,13 +457,13 @@ static void tce_iommu_unuse_page(struct tce_container *container,
+ }
+ 
+ static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container,
+-		unsigned long tce, unsigned long size,
++		unsigned long tce, unsigned long shift,
+ 		unsigned long *phpa, struct mm_iommu_table_group_mem_t **pmem)
+ {
+ 	long ret = 0;
+ 	struct mm_iommu_table_group_mem_t *mem;
+ 
+-	mem = mm_iommu_lookup(container->mm, tce, size);
++	mem = mm_iommu_lookup(container->mm, tce, 1ULL << shift);
+ 	if (!mem)
+ 		return -EINVAL;
+ 
+@@ -487,7 +487,7 @@ static void tce_iommu_unuse_page_v2(struct tce_container *container,
+ 	if (!pua)
+ 		return;
+ 
+-	ret = tce_iommu_prereg_ua_to_hpa(container, *pua, IOMMU_PAGE_SIZE(tbl),
++	ret = tce_iommu_prereg_ua_to_hpa(container, *pua, tbl->it_page_shift,
+ 			&hpa, &mem);
+ 	if (ret)
+ 		pr_debug("%s: tce %lx at #%lx was not cached, ret=%d\n",
+@@ -611,7 +611,7 @@ static long tce_iommu_build_v2(struct tce_container *container,
+ 				entry + i);
+ 
+ 		ret = tce_iommu_prereg_ua_to_hpa(container,
+-				tce, IOMMU_PAGE_SIZE(tbl), &hpa, &mem);
++				tce, tbl->it_page_shift, &hpa, &mem);
+ 		if (ret)
+ 			break;
+ 
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index ffbbf0520d9e..6aa49dcaa938 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -697,13 +697,21 @@ static void fat_set_state(struct super_block *sb,
+ 	brelse(bh);
+ }
+ 
++static void fat_reset_iocharset(struct fat_mount_options *opts)
++{
++	if (opts->iocharset != fat_default_iocharset) {
++		/* Note: opts->iocharset can be NULL here */
++		kfree(opts->iocharset);
++		opts->iocharset = fat_default_iocharset;
++	}
++}
++
+ static void delayed_free(struct rcu_head *p)
+ {
+ 	struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
+ 	unload_nls(sbi->nls_disk);
+ 	unload_nls(sbi->nls_io);
+-	if (sbi->options.iocharset != fat_default_iocharset)
+-		kfree(sbi->options.iocharset);
++	fat_reset_iocharset(&sbi->options);
+ 	kfree(sbi);
+ }
+ 
+@@ -1118,7 +1126,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
+ 	opts->fs_fmask = opts->fs_dmask = current_umask();
+ 	opts->allow_utime = -1;
+ 	opts->codepage = fat_default_codepage;
+-	opts->iocharset = fat_default_iocharset;
++	fat_reset_iocharset(opts);
+ 	if (is_vfat) {
+ 		opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
+ 		opts->rodir = 0;
+@@ -1275,8 +1283,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
+ 
+ 		/* vfat specific */
+ 		case Opt_charset:
+-			if (opts->iocharset != fat_default_iocharset)
+-				kfree(opts->iocharset);
++			fat_reset_iocharset(opts);
+ 			iocharset = match_strdup(&args[0]);
+ 			if (!iocharset)
+ 				return -ENOMEM;
+@@ -1867,8 +1874,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
+ 		iput(fat_inode);
+ 	unload_nls(sbi->nls_io);
+ 	unload_nls(sbi->nls_disk);
+-	if (sbi->options.iocharset != fat_default_iocharset)
+-		kfree(sbi->options.iocharset);
++	fat_reset_iocharset(&sbi->options);
+ 	sb->s_fs_info = NULL;
+ 	kfree(sbi);
+ 	return error;
+diff --git a/fs/internal.h b/fs/internal.h
+index 980d005b21b4..5645b4ebf494 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -127,7 +127,6 @@ int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
+ 
+ extern int open_check_o_direct(struct file *f);
+ extern int vfs_open(const struct path *, struct file *, const struct cred *);
+-extern struct file *filp_clone_open(struct file *);
+ 
+ /*
+  * inode.c
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 760d8da1b6c7..81fe0292a7ac 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2401,6 +2401,7 @@ extern struct file *filp_open(const char *, int, umode_t);
+ extern struct file *file_open_root(struct dentry *, struct vfsmount *,
+ 				   const char *, int, umode_t);
+ extern struct file * dentry_open(const struct path *, int, const struct cred *);
++extern struct file *filp_clone_open(struct file *);
+ extern int filp_close(struct file *, fl_owner_t id);
+ 
+ extern struct filename *getname_flags(const char __user *, int, int *);
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 5be31eb7b266..108ede99e533 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -75,7 +75,7 @@ extern long _do_fork(unsigned long, unsigned long, unsigned long, int __user *,
+ extern long do_fork(unsigned long, unsigned long, unsigned long, int __user *, int __user *);
+ struct task_struct *fork_idle(int);
+ extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
+-extern long kernel_wait4(pid_t, int *, int, struct rusage *);
++extern long kernel_wait4(pid_t, int __user *, int, struct rusage *);
+ 
+ extern void free_task(struct task_struct *tsk);
+ 
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 9065477ed255..15d8f9c84ca5 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -628,6 +628,7 @@ typedef unsigned char *sk_buff_data_t;
+  *	@hash: the packet hash
+  *	@queue_mapping: Queue mapping for multiqueue devices
+  *	@xmit_more: More SKBs are pending for this queue
++ *	@pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
+  *	@ndisc_nodetype: router type (from link layer)
+  *	@ooo_okay: allow the mapping of a socket to a queue to be changed
+  *	@l4_hash: indicate hash is a canonical 4-tuple hash over transport
+@@ -733,7 +734,7 @@ struct sk_buff {
+ 				peeked:1,
+ 				head_frag:1,
+ 				xmit_more:1,
+-				__unused:1; /* one bit hole */
++				pfmemalloc:1;
+ 
+ 	/* fields enclosed in headers_start/headers_end are copied
+ 	 * using a single memcpy() in __copy_skb_header()
+@@ -752,31 +753,30 @@ struct sk_buff {
+ 
+ 	__u8			__pkt_type_offset[0];
+ 	__u8			pkt_type:3;
+-	__u8			pfmemalloc:1;
+ 	__u8			ignore_df:1;
+-
+ 	__u8			nf_trace:1;
+ 	__u8			ip_summed:2;
+ 	__u8			ooo_okay:1;
++
+ 	__u8			l4_hash:1;
+ 	__u8			sw_hash:1;
+ 	__u8			wifi_acked_valid:1;
+ 	__u8			wifi_acked:1;
+-
+ 	__u8			no_fcs:1;
+ 	/* Indicates the inner headers are valid in the skbuff. */
+ 	__u8			encapsulation:1;
+ 	__u8			encap_hdr_csum:1;
+ 	__u8			csum_valid:1;
++
+ 	__u8			csum_complete_sw:1;
+ 	__u8			csum_level:2;
+ 	__u8			csum_not_inet:1;
+-
+ 	__u8			dst_pending_confirm:1;
+ #ifdef CONFIG_IPV6_NDISC_NODETYPE
+ 	__u8			ndisc_nodetype:2;
+ #endif
+ 	__u8			ipvs_property:1;
++
+ 	__u8			inner_protocol_type:1;
+ 	__u8			remcsum_offload:1;
+ #ifdef CONFIG_NET_SWITCHDEV
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index a406f2e8680a..aeebbbb9e0bd 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -829,7 +829,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
+ 	 * to minimize possbility that any useful information to an
+ 	 * attacker is leaked. Only lower 20 bits are relevant.
+ 	 */
+-	rol32(hash, 16);
++	hash = rol32(hash, 16);
+ 
+ 	flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
+ 
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 35498e613ff5..edfa9d0f6005 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -609,10 +609,15 @@ static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *
+ 	return t->dst;
+ }
+ 
++static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
++{
++	return SCTP_TRUNC4(max_t(__u32, dst_mtu(dst),
++				 SCTP_DEFAULT_MINSEGMENT));
++}
++
+ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+ {
+-	__u32 pmtu = max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
+-			   SCTP_DEFAULT_MINSEGMENT);
++	__u32 pmtu = sctp_dst_mtu(t->dst);
+ 
+ 	if (t->pathmtu == pmtu)
+ 		return true;
+diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
+index 64c0291b579c..2f6fa95de2d8 100644
+--- a/kernel/stop_machine.c
++++ b/kernel/stop_machine.c
+@@ -270,7 +270,11 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1,
+ 		goto retry;
+ 	}
+ 
+-	wake_up_q(&wakeq);
++	if (!err) {
++		preempt_disable();
++		wake_up_q(&wakeq);
++		preempt_enable();
++	}
+ 
+ 	return err;
+ }
+diff --git a/lib/rhashtable.c b/lib/rhashtable.c
+index 2b2b79974b61..240a8b864d5b 100644
+--- a/lib/rhashtable.c
++++ b/lib/rhashtable.c
+@@ -923,8 +923,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
+ 
+ static size_t rounded_hashtable_size(const struct rhashtable_params *params)
+ {
+-	return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
+-		   (unsigned long)params->min_size);
++	size_t retsize;
++
++	if (params->nelem_hint)
++		retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
++			      (unsigned long)params->min_size);
++	else
++		retsize = max(HASH_DEFAULT_SIZE,
++			      (unsigned long)params->min_size);
++
++	return retsize;
+ }
+ 
+ static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
+@@ -981,8 +989,6 @@ int rhashtable_init(struct rhashtable *ht,
+ 	struct bucket_table *tbl;
+ 	size_t size;
+ 
+-	size = HASH_DEFAULT_SIZE;
+-
+ 	if ((!params->key_len && !params->obj_hashfn) ||
+ 	    (params->obj_hashfn && !params->obj_cmpfn))
+ 		return -EINVAL;
+@@ -1009,8 +1015,7 @@ int rhashtable_init(struct rhashtable *ht,
+ 
+ 	ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE);
+ 
+-	if (params->nelem_hint)
+-		size = rounded_hashtable_size(&ht->p);
++	size = rounded_hashtable_size(&ht->p);
+ 
+ 	if (params->locks_mul)
+ 		ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
+@@ -1102,13 +1107,14 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
+ 				 void (*free_fn)(void *ptr, void *arg),
+ 				 void *arg)
+ {
+-	struct bucket_table *tbl;
++	struct bucket_table *tbl, *next_tbl;
+ 	unsigned int i;
+ 
+ 	cancel_work_sync(&ht->run_work);
+ 
+ 	mutex_lock(&ht->mutex);
+ 	tbl = rht_dereference(ht->tbl, ht);
++restart:
+ 	if (free_fn) {
+ 		for (i = 0; i < tbl->size; i++) {
+ 			struct rhash_head *pos, *next;
+@@ -1125,7 +1131,12 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
+ 		}
+ 	}
+ 
++	next_tbl = rht_dereference(tbl->future_tbl, ht);
+ 	bucket_table_free(tbl);
++	if (next_tbl) {
++		tbl = next_tbl;
++		goto restart;
++	}
+ 	mutex_unlock(&ht->mutex);
+ }
+ EXPORT_SYMBOL_GPL(rhashtable_free_and_destroy);
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index b9f3dbd885bd..327e12679dd5 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2087,6 +2087,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ 		if (vma_is_dax(vma))
+ 			return;
+ 		page = pmd_page(_pmd);
++		if (!PageDirty(page) && pmd_dirty(_pmd))
++			set_page_dirty(page);
+ 		if (!PageReferenced(page) && pmd_young(_pmd))
+ 			SetPageReferenced(page);
+ 		page_remove_rmap(page, true);
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 2bd3df3d101a..95c0980a6f7e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -850,7 +850,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+ 	int nid;
+ 	int i;
+ 
+-	while ((memcg = parent_mem_cgroup(memcg))) {
++	for (; memcg; memcg = parent_mem_cgroup(memcg)) {
+ 		for_each_node(nid) {
+ 			mz = mem_cgroup_nodeinfo(memcg, nid);
+ 			for (i = 0; i <= DEF_PRIORITY; i++) {
+diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
+index b2b2323bdc84..188d693cb251 100644
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
+ 		d->lock = lock;
+ 		spin_lock_bh(lock);
+ 	}
+-	if (d->tail)
+-		return gnet_stats_copy(d, type, NULL, 0, padattr);
++	if (d->tail) {
++		int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
++
++		/* The initial attribute added in gnet_stats_copy() may be
++		 * preceded by a padding attribute, in which case d->tail will
++		 * end up pointing at the padding instead of the real attribute.
++		 * Fix this so gnet_stats_finish_copy() adjusts the length of
++		 * the right attribute.
++		 */
++		if (ret == 0 && d->tail->nla_type == padattr)
++			d->tail = (struct nlattr *)((char *)d->tail +
++						    NLA_ALIGN(d->tail->nla_len));
++		return ret;
++	}
+ 
+ 	return 0;
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 345b51837ca8..a84d69c047ac 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -858,6 +858,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
+ 	n->cloned = 1;
+ 	n->nohdr = 0;
+ 	n->peeked = 0;
++	C(pfmemalloc);
+ 	n->destructor = NULL;
+ 	C(tail);
+ 	C(end);
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index e66172aaf241..511d6748ea5f 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -300,6 +300,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
+ 	if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+ 		struct flowi4 fl4 = {
+ 			.flowi4_iif = LOOPBACK_IFINDEX,
++			.flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ 			.daddr = ip_hdr(skb)->saddr,
+ 			.flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
+ 			.flowi4_scope = scope,
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 2f600f261690..61e42a3390ba 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -187,8 +187,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
+ 	if (write && ret == 0) {
+ 		low = make_kgid(user_ns, urange[0]);
+ 		high = make_kgid(user_ns, urange[1]);
+-		if (!gid_valid(low) || !gid_valid(high) ||
+-		    (urange[1] < urange[0]) || gid_lt(high, low)) {
++		if (!gid_valid(low) || !gid_valid(high))
++			return -EINVAL;
++		if (urange[1] < urange[0] || gid_lt(high, low)) {
+ 			low = make_kgid(&init_user_ns, 1);
+ 			high = make_kgid(&init_user_ns, 0);
+ 		}
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index c9d00ef54dec..58e316cf6607 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3524,8 +3524,7 @@ int tcp_abort(struct sock *sk, int err)
+ 			struct request_sock *req = inet_reqsk(sk);
+ 
+ 			local_bh_disable();
+-			inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
+-							  req);
++			inet_csk_reqsk_queue_drop(req->rsk_listener, req);
+ 			local_bh_enable();
+ 			return 0;
+ 		}
+diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
+index 11e4e80cf7e9..0efb914695ac 100644
+--- a/net/ipv6/Kconfig
++++ b/net/ipv6/Kconfig
+@@ -108,6 +108,7 @@ config IPV6_MIP6
+ config IPV6_ILA
+ 	tristate "IPv6: Identifier Locator Addressing (ILA)"
+ 	depends on NETFILTER
++	select DST_CACHE
+ 	select LWTUNNEL
+ 	---help---
+ 	  Support for IPv6 Identifier Locator Addressing (ILA).
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 458de353f5d9..1a4d6897d17f 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -927,7 +927,6 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
+ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ 					 struct net_device *dev)
+ {
+-	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ 	struct ip6_tnl *t = netdev_priv(dev);
+ 	struct dst_entry *dst = skb_dst(skb);
+ 	struct net_device_stats *stats;
+@@ -998,6 +997,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ 			goto tx_err;
+ 		}
+ 	} else {
++		struct ipv6hdr *ipv6h = ipv6_hdr(skb);
++
+ 		switch (skb->protocol) {
+ 		case htons(ETH_P_IP):
+ 			memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 525051a886bc..3ff9316616d8 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -811,7 +811,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
+ 			return;
+ 		}
+ 	}
+-	if (ndopts.nd_opts_nonce)
++	if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
+ 		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
+ 
+ 	inc = ipv6_addr_is_multicast(daddr);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index b94345e657f7..3ed4de230830 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4274,6 +4274,13 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
+ 			err_nh = nh;
+ 			goto add_errout;
+ 		}
++		if (!rt6_qualify_for_ecmp(rt)) {
++			err = -EINVAL;
++			NL_SET_ERR_MSG(extack,
++				       "Device only routes can not be added for IPv6 using the multipath API.");
++			dst_release_immediate(&rt->dst);
++			goto cleanup;
++		}
+ 
+ 		/* Because each route is added like a single route we remove
+ 		 * these flags after the first nexthop: if there is a collision,
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index 22fa13cf5d8b..846883907cd4 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -479,23 +479,27 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
+ 	q->cparams.mtu = psched_mtu(qdisc_dev(sch));
+ 
+ 	if (opt) {
+-		int err = fq_codel_change(sch, opt, extack);
++		err = fq_codel_change(sch, opt, extack);
+ 		if (err)
+-			return err;
++			goto init_failure;
+ 	}
+ 
+ 	err = tcf_block_get(&q->block, &q->filter_list, sch, extack);
+ 	if (err)
+-		return err;
++		goto init_failure;
+ 
+ 	if (!q->flows) {
+ 		q->flows = kvzalloc(q->flows_cnt *
+ 					   sizeof(struct fq_codel_flow), GFP_KERNEL);
+-		if (!q->flows)
+-			return -ENOMEM;
++		if (!q->flows) {
++			err = -ENOMEM;
++			goto init_failure;
++		}
+ 		q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL);
+-		if (!q->backlogs)
+-			return -ENOMEM;
++		if (!q->backlogs) {
++			err = -ENOMEM;
++			goto alloc_failure;
++		}
+ 		for (i = 0; i < q->flows_cnt; i++) {
+ 			struct fq_codel_flow *flow = q->flows + i;
+ 
+@@ -508,6 +512,13 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
+ 	else
+ 		sch->flags &= ~TCQ_F_CAN_BYPASS;
+ 	return 0;
++
++alloc_failure:
++	kvfree(q->flows);
++	q->flows = NULL;
++init_failure:
++	q->flows_cnt = 0;
++	return err;
+ }
+ 
+ static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index a47179da24e6..ef8adac1be83 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1446,11 +1446,9 @@ void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
+ 		return;
+ 
+ 	/* Get the lowest pmtu of all the transports. */
+-	list_for_each_entry(t, &asoc->peer.transport_addr_list,
+-				transports) {
++	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) {
+ 		if (t->pmtu_pending && t->dst) {
+-			sctp_transport_update_pmtu(
+-					t, SCTP_TRUNC4(dst_mtu(t->dst)));
++			sctp_transport_update_pmtu(t, sctp_dst_mtu(t->dst));
+ 			t->pmtu_pending = 0;
+ 		}
+ 		if (!pmtu || (t->pathmtu < pmtu))
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 03fc2c427aca..e890ceb55939 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -242,9 +242,9 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
+ 						&transport->fl, sk);
+ 	}
+ 
+-	if (transport->dst) {
+-		transport->pathmtu = SCTP_TRUNC4(dst_mtu(transport->dst));
+-	} else
++	if (transport->dst)
++		transport->pathmtu = sctp_dst_mtu(transport->dst);
++	else
+ 		transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+ }
+ 
+@@ -273,7 +273,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+ 
+ 	if (dst) {
+ 		/* Re-fetch, as under layers may have a higher minimum size */
+-		pmtu = SCTP_TRUNC4(dst_mtu(dst));
++		pmtu = sctp_dst_mtu(dst);
+ 		change = t->pathmtu != pmtu;
+ 	}
+ 	t->pathmtu = pmtu;
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 69616d00481c..b53026a72e73 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card,
+ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
+ 			      struct snd_rawmidi_params * params)
+ {
+-	char *newbuf;
++	char *newbuf, *oldbuf;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
+ 	
+ 	if (substream->append && substream->use_count > 1)
+@@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
+ 		return -EINVAL;
+ 	}
+ 	if (params->buffer_size != runtime->buffer_size) {
+-		newbuf = krealloc(runtime->buffer, params->buffer_size,
+-				  GFP_KERNEL);
++		newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
+ 		if (!newbuf)
+ 			return -ENOMEM;
++		spin_lock_irq(&runtime->lock);
++		oldbuf = runtime->buffer;
+ 		runtime->buffer = newbuf;
+ 		runtime->buffer_size = params->buffer_size;
+ 		runtime->avail = runtime->buffer_size;
++		runtime->appl_ptr = runtime->hw_ptr = 0;
++		spin_unlock_irq(&runtime->lock);
++		kfree(oldbuf);
+ 	}
+ 	runtime->avail_min = params->avail_min;
+ 	substream->active_sensing = !params->no_active_sensing;
+@@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params);
+ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
+ 			     struct snd_rawmidi_params * params)
+ {
+-	char *newbuf;
++	char *newbuf, *oldbuf;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
+ 
+ 	snd_rawmidi_drain_input(substream);
+@@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
+ 		return -EINVAL;
+ 	}
+ 	if (params->buffer_size != runtime->buffer_size) {
+-		newbuf = krealloc(runtime->buffer, params->buffer_size,
+-				  GFP_KERNEL);
++		newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
+ 		if (!newbuf)
+ 			return -ENOMEM;
++		spin_lock_irq(&runtime->lock);
++		oldbuf = runtime->buffer;
+ 		runtime->buffer = newbuf;
+ 		runtime->buffer_size = params->buffer_size;
++		runtime->appl_ptr = runtime->hw_ptr = 0;
++		spin_unlock_irq(&runtime->lock);
++		kfree(oldbuf);
+ 	}
+ 	runtime->avail_min = params->avail_min;
+ 	return 0;
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ba9a7e552183..88ce2f1022e1 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -965,6 +965,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
+ 	SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
+ 	SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
++	SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+ 	SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 066efe783fe8..7bba415cb850 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2363,6 +2363,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+ 	SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
++	SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ 	SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+ 	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ 	SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+@@ -6543,6 +6544,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
++	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
+index 6e865e8b5b10..fe6eb0fe07f6 100644
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work)
+ {
+ 	struct kvm_kernel_irqfd *irqfd =
+ 		container_of(work, struct kvm_kernel_irqfd, shutdown);
++	struct kvm *kvm = irqfd->kvm;
+ 	u64 cnt;
+ 
++	/* Make sure irqfd has been initalized in assign path. */
++	synchronize_srcu(&kvm->irq_srcu);
++
+ 	/*
+ 	 * Synchronize with the wait-queue and unhook ourselves to prevent
+ 	 * further events.
+@@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ 
+ 	idx = srcu_read_lock(&kvm->irq_srcu);
+ 	irqfd_update(kvm, irqfd);
+-	srcu_read_unlock(&kvm->irq_srcu, idx);
+ 
+ 	list_add_tail(&irqfd->list, &kvm->irqfds.items);
+ 
+@@ -402,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ 	if (events & EPOLLIN)
+ 		schedule_work(&irqfd->inject);
+ 
+-	/*
+-	 * do not drop the file until the irqfd is fully initialized, otherwise
+-	 * we might race against the EPOLLHUP
+-	 */
+-	fdput(f);
+ #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
+ 	if (kvm_arch_has_irq_bypass()) {
+ 		irqfd->consumer.token = (void *)irqfd->eventfd;
+@@ -421,6 +419,13 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ 	}
+ #endif
+ 
++	srcu_read_unlock(&kvm->irq_srcu, idx);
++
++	/*
++	 * do not drop the file until the irqfd is fully initialized, otherwise
++	 * we might race against the EPOLLHUP
++	 */
++	fdput(f);
+ 	return 0;
+ 
+ fail: