Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.9 commit in: /
Date: Thu, 29 Oct 2020 11:17:09
Message-Id: 1603970207.6e84ca64436fdb9090ceadca1ae9361d26cdec07.mpagano@gentoo
1 commit: 6e84ca64436fdb9090ceadca1ae9361d26cdec07
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Thu Oct 29 11:16:47 2020 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Thu Oct 29 11:16:47 2020 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6e84ca64
7
8 Linux patch 4.9.241
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1240_linux-4.9.241.patch | 3852 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 3856 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index 62aaf96..66150b0 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -1003,6 +1003,10 @@ Patch: 1239_linux-4.9.240.patch
21 From: http://www.kernel.org
22 Desc: Linux 4.9.240
23
24 +Patch: 1240_linux-4.9.241.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 4.9.241
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1240_linux-4.9.241.patch b/1240_linux-4.9.241.patch
33 new file mode 100644
34 index 0000000..c7a81de
35 --- /dev/null
36 +++ b/1240_linux-4.9.241.patch
37 @@ -0,0 +1,3852 @@
38 +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
39 +index 49935d5bb5c6b..a374412610ba3 100644
40 +--- a/Documentation/networking/ip-sysctl.txt
41 ++++ b/Documentation/networking/ip-sysctl.txt
42 +@@ -887,12 +887,14 @@ icmp_ratelimit - INTEGER
43 + icmp_msgs_per_sec - INTEGER
44 + Limit maximal number of ICMP packets sent per second from this host.
45 + Only messages whose type matches icmp_ratemask (see below) are
46 +- controlled by this limit.
47 ++ controlled by this limit. For security reasons, the precise count
48 ++ of messages per second is randomized.
49 + Default: 1000
50 +
51 + icmp_msgs_burst - INTEGER
52 + icmp_msgs_per_sec controls number of ICMP packets sent per second,
53 + while icmp_msgs_burst controls the burst size of these packets.
54 ++ For security reasons, the precise burst size is randomized.
55 + Default: 50
56 +
57 + icmp_ratemask - INTEGER
58 +diff --git a/Makefile b/Makefile
59 +index a6a9d494dc18f..c4f3d2ea9b43e 100644
60 +--- a/Makefile
61 ++++ b/Makefile
62 +@@ -1,6 +1,6 @@
63 + VERSION = 4
64 + PATCHLEVEL = 9
65 +-SUBLEVEL = 240
66 ++SUBLEVEL = 241
67 + EXTRAVERSION =
68 + NAME = Roaring Lionus
69 +
70 +diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
71 +index d1870c777c6e2..3a465bfa7d4a2 100644
72 +--- a/arch/arm/mm/cache-l2x0.c
73 ++++ b/arch/arm/mm/cache-l2x0.c
74 +@@ -1252,20 +1252,28 @@ static void __init l2c310_of_parse(const struct device_node *np,
75 +
76 + ret = of_property_read_u32(np, "prefetch-data", &val);
77 + if (ret == 0) {
78 +- if (val)
79 ++ if (val) {
80 + prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH;
81 +- else
82 ++ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH;
83 ++ } else {
84 + prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
85 ++ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
86 ++ }
87 ++ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
88 + } else if (ret != -EINVAL) {
89 + pr_err("L2C-310 OF prefetch-data property value is missing\n");
90 + }
91 +
92 + ret = of_property_read_u32(np, "prefetch-instr", &val);
93 + if (ret == 0) {
94 +- if (val)
95 ++ if (val) {
96 + prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
97 +- else
98 ++ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
99 ++ } else {
100 + prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
101 ++ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
102 ++ }
103 ++ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
104 + } else if (ret != -EINVAL) {
105 + pr_err("L2C-310 OF prefetch-instr property value is missing\n");
106 + }
107 +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
108 +index 08b88f6791beb..fb5001a6879c7 100644
109 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
110 ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
111 +@@ -715,7 +715,7 @@
112 + reg-names = "mdp_phys";
113 +
114 + interrupt-parent = <&mdss>;
115 +- interrupts = <0 0>;
116 ++ interrupts = <0>;
117 +
118 + clocks = <&gcc GCC_MDSS_AHB_CLK>,
119 + <&gcc GCC_MDSS_AXI_CLK>,
120 +@@ -745,7 +745,7 @@
121 + reg-names = "dsi_ctrl";
122 +
123 + interrupt-parent = <&mdss>;
124 +- interrupts = <4 0>;
125 ++ interrupts = <4>;
126 +
127 + assigned-clocks = <&gcc BYTE0_CLK_SRC>,
128 + <&gcc PCLK0_CLK_SRC>;
129 +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
130 +index 54dc28351c8cb..b9ff697987338 100644
131 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
132 ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
133 +@@ -175,7 +175,7 @@
134 + };
135 +
136 + i2c0: i2c@ff020000 {
137 +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
138 ++ compatible = "cdns,i2c-r1p14";
139 + status = "disabled";
140 + interrupt-parent = <&gic>;
141 + interrupts = <0 17 4>;
142 +@@ -185,7 +185,7 @@
143 + };
144 +
145 + i2c1: i2c@ff030000 {
146 +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
147 ++ compatible = "cdns,i2c-r1p14";
148 + status = "disabled";
149 + interrupt-parent = <&gic>;
150 + interrupts = <0 18 4>;
151 +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
152 +index 26aeeaad32678..a36ef27155bc2 100644
153 +--- a/arch/powerpc/include/asm/reg.h
154 ++++ b/arch/powerpc/include/asm/reg.h
155 +@@ -683,7 +683,7 @@
156 + #define THRM1_TIN (1 << 31)
157 + #define THRM1_TIV (1 << 30)
158 + #define THRM1_THRES(x) ((x&0x7f)<<23)
159 +-#define THRM3_SITV(x) ((x&0x3fff)<<1)
160 ++#define THRM3_SITV(x) ((x & 0x1fff) << 1)
161 + #define THRM1_TID (1<<2)
162 + #define THRM1_TIE (1<<1)
163 + #define THRM1_V (1<<0)
164 +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
165 +index a753b72efbc0c..70c9d134a9d44 100644
166 +--- a/arch/powerpc/kernel/tau_6xx.c
167 ++++ b/arch/powerpc/kernel/tau_6xx.c
168 +@@ -37,8 +37,6 @@ static struct tau_temp
169 +
170 + struct timer_list tau_timer;
171 +
172 +-#undef DEBUG
173 +-
174 + /* TODO: put these in a /proc interface, with some sanity checks, and maybe
175 + * dynamic adjustment to minimize # of interrupts */
176 + /* configurable values for step size and how much to expand the window when
177 +@@ -71,47 +69,33 @@ void set_thresholds(unsigned long cpu)
178 +
179 + void TAUupdate(int cpu)
180 + {
181 +- unsigned thrm;
182 +-
183 +-#ifdef DEBUG
184 +- printk("TAUupdate ");
185 +-#endif
186 ++ u32 thrm;
187 ++ u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V;
188 +
189 + /* if both thresholds are crossed, the step_sizes cancel out
190 + * and the window winds up getting expanded twice. */
191 +- if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */
192 +- if(thrm & THRM1_TIN){ /* crossed low threshold */
193 +- if (tau[cpu].low >= step_size){
194 +- tau[cpu].low -= step_size;
195 +- tau[cpu].high -= (step_size - window_expand);
196 +- }
197 +- tau[cpu].grew = 1;
198 +-#ifdef DEBUG
199 +- printk("low threshold crossed ");
200 +-#endif
201 ++ thrm = mfspr(SPRN_THRM1);
202 ++ if ((thrm & bits) == bits) {
203 ++ mtspr(SPRN_THRM1, 0);
204 ++
205 ++ if (tau[cpu].low >= step_size) {
206 ++ tau[cpu].low -= step_size;
207 ++ tau[cpu].high -= (step_size - window_expand);
208 + }
209 ++ tau[cpu].grew = 1;
210 ++ pr_debug("%s: low threshold crossed\n", __func__);
211 + }
212 +- if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */
213 +- if(thrm & THRM1_TIN){ /* crossed high threshold */
214 +- if (tau[cpu].high <= 127-step_size){
215 +- tau[cpu].low += (step_size - window_expand);
216 +- tau[cpu].high += step_size;
217 +- }
218 +- tau[cpu].grew = 1;
219 +-#ifdef DEBUG
220 +- printk("high threshold crossed ");
221 +-#endif
222 ++ thrm = mfspr(SPRN_THRM2);
223 ++ if ((thrm & bits) == bits) {
224 ++ mtspr(SPRN_THRM2, 0);
225 ++
226 ++ if (tau[cpu].high <= 127 - step_size) {
227 ++ tau[cpu].low += (step_size - window_expand);
228 ++ tau[cpu].high += step_size;
229 + }
230 ++ tau[cpu].grew = 1;
231 ++ pr_debug("%s: high threshold crossed\n", __func__);
232 + }
233 +-
234 +-#ifdef DEBUG
235 +- printk("grew = %d\n", tau[cpu].grew);
236 +-#endif
237 +-
238 +-#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */
239 +- set_thresholds(cpu);
240 +-#endif
241 +-
242 + }
243 +
244 + #ifdef CONFIG_TAU_INT
245 +@@ -136,18 +120,18 @@ void TAUException(struct pt_regs * regs)
246 + static void tau_timeout(void * info)
247 + {
248 + int cpu;
249 +- unsigned long flags;
250 + int size;
251 + int shrink;
252 +
253 +- /* disabling interrupts *should* be okay */
254 +- local_irq_save(flags);
255 + cpu = smp_processor_id();
256 +
257 + #ifndef CONFIG_TAU_INT
258 + TAUupdate(cpu);
259 + #endif
260 +
261 ++ /* Stop thermal sensor comparisons and interrupts */
262 ++ mtspr(SPRN_THRM3, 0);
263 ++
264 + size = tau[cpu].high - tau[cpu].low;
265 + if (size > min_window && ! tau[cpu].grew) {
266 + /* do an exponential shrink of half the amount currently over size */
267 +@@ -169,22 +153,12 @@ static void tau_timeout(void * info)
268 +
269 + set_thresholds(cpu);
270 +
271 +- /*
272 +- * Do the enable every time, since otherwise a bunch of (relatively)
273 +- * complex sleep code needs to be added. One mtspr every time
274 +- * tau_timeout is called is probably not a big deal.
275 +- *
276 +- * Enable thermal sensor and set up sample interval timer
277 +- * need 20 us to do the compare.. until a nice 'cpu_speed' function
278 +- * call is implemented, just assume a 500 mhz clock. It doesn't really
279 +- * matter if we take too long for a compare since it's all interrupt
280 +- * driven anyway.
281 +- *
282 +- * use a extra long time.. (60 us @ 500 mhz)
283 ++ /* Restart thermal sensor comparisons and interrupts.
284 ++ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
285 ++ * recommends that "the maximum value be set in THRM3 under all
286 ++ * conditions."
287 + */
288 +- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E);
289 +-
290 +- local_irq_restore(flags);
291 ++ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
292 + }
293 +
294 + static void tau_timeout_smp(unsigned long unused)
295 +diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h
296 +index acd17648cd188..5ea24d16a74a1 100644
297 +--- a/arch/powerpc/perf/hv-gpci-requests.h
298 ++++ b/arch/powerpc/perf/hv-gpci-requests.h
299 +@@ -94,7 +94,7 @@ REQUEST(__field(0, 8, partition_id)
300 +
301 + #define REQUEST_NAME system_performance_capabilities
302 + #define REQUEST_NUM 0x40
303 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
304 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
305 + #include I(REQUEST_BEGIN)
306 + REQUEST(__field(0, 1, perf_collect_privileged)
307 + __field(0x1, 1, capability_mask)
308 +@@ -222,7 +222,7 @@ REQUEST(__field(0, 2, partition_id)
309 +
310 + #define REQUEST_NAME system_hypervisor_times
311 + #define REQUEST_NUM 0xF0
312 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
313 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
314 + #include I(REQUEST_BEGIN)
315 + REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
316 + __count(0x8, 8, time_spent_processing_virtual_processor_timers)
317 +@@ -233,7 +233,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
318 +
319 + #define REQUEST_NAME system_tlbie_count_and_time
320 + #define REQUEST_NUM 0xF4
321 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
322 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
323 + #include I(REQUEST_BEGIN)
324 + REQUEST(__count(0, 8, tlbie_instructions_issued)
325 + /*
326 +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
327 +index 6143c99f3ec50..7592a6491a9a2 100644
328 +--- a/arch/powerpc/perf/isa207-common.c
329 ++++ b/arch/powerpc/perf/isa207-common.c
330 +@@ -51,6 +51,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
331 +
332 + mask |= CNST_PMC_MASK(pmc);
333 + value |= CNST_PMC_VAL(pmc);
334 ++
335 ++ /*
336 ++ * PMC5 and PMC6 are used to count cycles and instructions and
337 ++ * they do not support most of the constraint bits. Add a check
338 ++ * to exclude PMC5/6 from most of the constraints except for
339 ++ * EBB/BHRB.
340 ++ */
341 ++ if (pmc >= 5)
342 ++ goto ebb_bhrb;
343 + }
344 +
345 + if (pmc <= 4) {
346 +@@ -111,6 +120,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
347 + value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT);
348 + }
349 +
350 ++ebb_bhrb:
351 + if (!pmc && ebb)
352 + /* EBB events must specify the PMC */
353 + return -1;
354 +diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
355 +index fbdae8377b714..a7ba4c61d8e93 100644
356 +--- a/arch/powerpc/platforms/Kconfig
357 ++++ b/arch/powerpc/platforms/Kconfig
358 +@@ -242,7 +242,7 @@ config TAU
359 + temp is actually what /proc/cpuinfo says it is.
360 +
361 + config TAU_INT
362 +- bool "Interrupt driven TAU driver (DANGEROUS)"
363 ++ bool "Interrupt driven TAU driver (EXPERIMENTAL)"
364 + depends on TAU
365 + ---help---
366 + The TAU supports an interrupt driven mode which causes an interrupt
367 +@@ -250,12 +250,7 @@ config TAU_INT
368 + to get notified the temp has exceeded a range. With this option off,
369 + a timer is used to re-check the temperature periodically.
370 +
371 +- However, on some cpus it appears that the TAU interrupt hardware
372 +- is buggy and can cause a situation which would lead unexplained hard
373 +- lockups.
374 +-
375 +- Unless you are extending the TAU driver, or enjoy kernel/hardware
376 +- debugging, leave this option off.
377 ++ If in doubt, say N here.
378 +
379 + config TAU_AVERAGE
380 + bool "Average high and low temp"
381 +diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
382 +index 4c827826c05eb..e21e2c0af69d2 100644
383 +--- a/arch/powerpc/platforms/powernv/opal-dump.c
384 ++++ b/arch/powerpc/platforms/powernv/opal-dump.c
385 +@@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj,
386 + return count;
387 + }
388 +
389 +-static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
390 +- uint32_t type)
391 ++static void create_dump_obj(uint32_t id, size_t size, uint32_t type)
392 + {
393 + struct dump_obj *dump;
394 + int rc;
395 +
396 + dump = kzalloc(sizeof(*dump), GFP_KERNEL);
397 + if (!dump)
398 +- return NULL;
399 ++ return;
400 +
401 + dump->kobj.kset = dump_kset;
402 +
403 +@@ -347,21 +346,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
404 + rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id);
405 + if (rc) {
406 + kobject_put(&dump->kobj);
407 +- return NULL;
408 ++ return;
409 + }
410 +
411 ++ /*
412 ++ * As soon as the sysfs file for this dump is created/activated there is
413 ++ * a chance the opal_errd daemon (or any userspace) might read and
414 ++ * acknowledge the dump before kobject_uevent() is called. If that
415 ++ * happens then there is a potential race between
416 ++ * dump_ack_store->kobject_put() and kobject_uevent() which leads to a
417 ++ * use-after-free of a kernfs object resulting in a kernel crash.
418 ++ *
419 ++ * To avoid that, we need to take a reference on behalf of the bin file,
420 ++ * so that our reference remains valid while we call kobject_uevent().
421 ++ * We then drop our reference before exiting the function, leaving the
422 ++ * bin file to drop the last reference (if it hasn't already).
423 ++ */
424 ++
425 ++ /* Take a reference for the bin file */
426 ++ kobject_get(&dump->kobj);
427 + rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr);
428 +- if (rc) {
429 ++ if (rc == 0) {
430 ++ kobject_uevent(&dump->kobj, KOBJ_ADD);
431 ++
432 ++ pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
433 ++ __func__, dump->id, dump->size);
434 ++ } else {
435 ++ /* Drop reference count taken for bin file */
436 + kobject_put(&dump->kobj);
437 +- return NULL;
438 + }
439 +
440 +- pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
441 +- __func__, dump->id, dump->size);
442 +-
443 +- kobject_uevent(&dump->kobj, KOBJ_ADD);
444 +-
445 +- return dump;
446 ++ /* Drop our reference */
447 ++ kobject_put(&dump->kobj);
448 ++ return;
449 + }
450 +
451 + static irqreturn_t process_dump(int irq, void *data)
452 +diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
453 +index 31ca557af60bc..262b8c5e1b9d0 100644
454 +--- a/arch/powerpc/platforms/pseries/rng.c
455 ++++ b/arch/powerpc/platforms/pseries/rng.c
456 +@@ -40,6 +40,7 @@ static __init int rng_init(void)
457 +
458 + ppc_md.get_random_seed = pseries_get_random_long;
459 +
460 ++ of_node_put(dn);
461 + return 0;
462 + }
463 + machine_subsys_initcall(pseries, rng_init);
464 +diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c
465 +index e7fa26c4ff73e..d3a0322ee3276 100644
466 +--- a/arch/powerpc/sysdev/xics/icp-hv.c
467 ++++ b/arch/powerpc/sysdev/xics/icp-hv.c
468 +@@ -179,6 +179,7 @@ int icp_hv_init(void)
469 +
470 + icp_ops = &icp_hv_ops;
471 +
472 ++ of_node_put(np);
473 + return 0;
474 + }
475 +
476 +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
477 +index da3cd734dee10..d455221d958fc 100644
478 +--- a/arch/x86/kvm/emulate.c
479 ++++ b/arch/x86/kvm/emulate.c
480 +@@ -3536,7 +3536,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt)
481 + u64 tsc_aux = 0;
482 +
483 + if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux))
484 +- return emulate_gp(ctxt, 0);
485 ++ return emulate_ud(ctxt);
486 + ctxt->dst.val = tsc_aux;
487 + return X86EMUL_CONTINUE;
488 + }
489 +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
490 +index 73055b8e411f4..5cbc6591fa1d3 100644
491 +--- a/arch/x86/kvm/mmu.c
492 ++++ b/arch/x86/kvm/mmu.c
493 +@@ -5321,6 +5321,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm)
494 + cond_resched_lock(&kvm->mmu_lock);
495 + }
496 + }
497 ++ kvm_mmu_commit_zap_page(kvm, &invalid_list);
498 +
499 + spin_unlock(&kvm->mmu_lock);
500 + srcu_read_unlock(&kvm->srcu, rcu_idx);
501 +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
502 +index d38f098350f65..ba818a738f9a5 100644
503 +--- a/crypto/algif_aead.c
504 ++++ b/crypto/algif_aead.c
505 +@@ -455,7 +455,7 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
506 + memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
507 + aead_request_set_tfm(req, tfm);
508 + aead_request_set_ad(req, ctx->aead_assoclen);
509 +- aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
510 ++ aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
511 + aead_async_cb, req);
512 + used -= ctx->aead_assoclen;
513 +
514 +@@ -925,7 +925,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)
515 + ask->private = ctx;
516 +
517 + aead_request_set_tfm(&ctx->aead_req, aead);
518 +- aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
519 ++ aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_SLEEP,
520 + af_alg_complete, &ctx->completion);
521 +
522 + sk->sk_destruct = aead_sock_destruct;
523 +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
524 +index 90988e7a5b47f..2e7da9b379d48 100644
525 +--- a/drivers/clk/at91/clk-main.c
526 ++++ b/drivers/clk/at91/clk-main.c
527 +@@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index)
528 + return -EINVAL;
529 +
530 + regmap_read(regmap, AT91_CKGR_MOR, &tmp);
531 +- tmp &= ~MOR_KEY_MASK;
532 +
533 + if (index && !(tmp & AT91_PMC_MOSCSEL))
534 +- regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL);
535 ++ tmp = AT91_PMC_MOSCSEL;
536 + else if (!index && (tmp & AT91_PMC_MOSCSEL))
537 +- regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL);
538 ++ tmp = 0;
539 ++ else
540 ++ return 0;
541 ++
542 ++ regmap_update_bits(regmap, AT91_CKGR_MOR,
543 ++ AT91_PMC_MOSCSEL | MOR_KEY_MASK,
544 ++ tmp | AT91_PMC_KEY);
545 +
546 + while (!clk_sam9x5_main_ready(regmap))
547 + cpu_relax();
548 +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
549 +index 2b5075298cdc0..3f16b553982d1 100644
550 +--- a/drivers/clk/bcm/clk-bcm2835.c
551 ++++ b/drivers/clk/bcm/clk-bcm2835.c
552 +@@ -1177,8 +1177,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
553 + pll->hw.init = &init;
554 +
555 + ret = devm_clk_hw_register(cprman->dev, &pll->hw);
556 +- if (ret)
557 ++ if (ret) {
558 ++ kfree(pll);
559 + return NULL;
560 ++ }
561 + return &pll->hw;
562 + }
563 +
564 +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
565 +index c3b05676e0dbe..8d18264794252 100644
566 +--- a/drivers/cpufreq/powernv-cpufreq.c
567 ++++ b/drivers/cpufreq/powernv-cpufreq.c
568 +@@ -784,12 +784,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb,
569 + unsigned long action, void *unused)
570 + {
571 + int cpu;
572 +- struct cpufreq_policy cpu_policy;
573 ++ struct cpufreq_policy *cpu_policy;
574 +
575 + rebooting = true;
576 + for_each_online_cpu(cpu) {
577 +- cpufreq_get_policy(&cpu_policy, cpu);
578 +- powernv_cpufreq_target_index(&cpu_policy, get_nominal_index());
579 ++ cpu_policy = cpufreq_cpu_get(cpu);
580 ++ if (!cpu_policy)
581 ++ continue;
582 ++ powernv_cpufreq_target_index(cpu_policy, get_nominal_index());
583 ++ cpufreq_cpu_put(cpu_policy);
584 + }
585 +
586 + return NOTIFY_DONE;
587 +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
588 +index c3f13d6505e15..0aa18c1164bfb 100644
589 +--- a/drivers/crypto/ccp/ccp-ops.c
590 ++++ b/drivers/crypto/ccp/ccp-ops.c
591 +@@ -1195,7 +1195,7 @@ static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
592 + break;
593 + default:
594 + ret = -EINVAL;
595 +- goto e_ctx;
596 ++ goto e_data;
597 + }
598 + } else {
599 + /* Stash the context */
600 +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
601 +index b54af97a20bb3..a54de1299e9ef 100644
602 +--- a/drivers/crypto/ixp4xx_crypto.c
603 ++++ b/drivers/crypto/ixp4xx_crypto.c
604 +@@ -532,7 +532,7 @@ static void release_ixp_crypto(struct device *dev)
605 +
606 + if (crypt_virt) {
607 + dma_free_coherent(dev,
608 +- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl),
609 ++ NPE_QLEN * sizeof(struct crypt_ctl),
610 + crypt_virt, crypt_phys);
611 + }
612 + return;
613 +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
614 +index e7ca922a45e13..4adcf89add252 100644
615 +--- a/drivers/crypto/omap-sham.c
616 ++++ b/drivers/crypto/omap-sham.c
617 +@@ -454,6 +454,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length,
618 + struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req);
619 + u32 val, mask;
620 +
621 ++ if (likely(ctx->digcnt))
622 ++ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt);
623 ++
624 + /*
625 + * Setting ALGO_CONST only for the first iteration and
626 + * CLOSE_HASH only for the last one. Note that flags mode bits
627 +diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
628 +index c655162caf08f..599038edd90d3 100644
629 +--- a/drivers/edac/i5100_edac.c
630 ++++ b/drivers/edac/i5100_edac.c
631 +@@ -1073,16 +1073,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
632 + PCI_DEVICE_ID_INTEL_5100_19, 0);
633 + if (!einj) {
634 + ret = -ENODEV;
635 +- goto bail_einj;
636 ++ goto bail_mc_free;
637 + }
638 +
639 + rc = pci_enable_device(einj);
640 + if (rc < 0) {
641 + ret = rc;
642 +- goto bail_disable_einj;
643 ++ goto bail_einj;
644 + }
645 +
646 +-
647 + mci->pdev = &pdev->dev;
648 +
649 + priv = mci->pvt_info;
650 +@@ -1149,14 +1148,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
651 + bail_scrub:
652 + priv->scrub_enable = 0;
653 + cancel_delayed_work_sync(&(priv->i5100_scrubbing));
654 +- edac_mc_free(mci);
655 +-
656 +-bail_disable_einj:
657 + pci_disable_device(einj);
658 +
659 + bail_einj:
660 + pci_dev_put(einj);
661 +
662 ++bail_mc_free:
663 ++ edac_mc_free(mci);
664 ++
665 + bail_disable_ch1:
666 + pci_disable_device(ch1mm);
667 +
668 +diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
669 +index c52f9adf5e04c..7ec4e3fbafd8c 100644
670 +--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
671 ++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
672 +@@ -2121,7 +2121,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
673 + intel_dp->dpcd,
674 + sizeof(intel_dp->dpcd));
675 + cdv_intel_edp_panel_vdd_off(gma_encoder);
676 +- if (ret == 0) {
677 ++ if (ret <= 0) {
678 + /* if this fails, presume the device is a ghost */
679 + DRM_INFO("failed to retrieve link info, disabling eDP\n");
680 + cdv_intel_dp_encoder_destroy(encoder);
681 +diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
682 +index 036b0fbae0fb7..ba7855da7c7f6 100644
683 +--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
684 ++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
685 +@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
686 + vgdev->capsets[i].id > 0, 5 * HZ);
687 + if (ret == 0) {
688 + DRM_ERROR("timed out waiting for cap set %d\n", i);
689 ++ spin_lock(&vgdev->display_info_lock);
690 + kfree(vgdev->capsets);
691 + vgdev->capsets = NULL;
692 ++ spin_unlock(&vgdev->display_info_lock);
693 + return;
694 + }
695 + DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
696 +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
697 +index 772a5a3b0ce1a..18e8fcad6690b 100644
698 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
699 ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
700 +@@ -596,9 +596,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
701 + int i = le32_to_cpu(cmd->capset_index);
702 +
703 + spin_lock(&vgdev->display_info_lock);
704 +- vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
705 +- vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
706 +- vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
707 ++ if (vgdev->capsets) {
708 ++ vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
709 ++ vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
710 ++ vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
711 ++ } else {
712 ++ DRM_ERROR("invalid capset memory.");
713 ++ }
714 + spin_unlock(&vgdev->display_info_lock);
715 + wake_up(&vgdev->resp_wq);
716 + }
717 +diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
718 +index bf4675a273965..9be8c31f613fd 100644
719 +--- a/drivers/hid/hid-roccat-kone.c
720 ++++ b/drivers/hid/hid-roccat-kone.c
721 +@@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj,
722 + struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev));
723 + struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
724 + int retval = 0, difference, old_profile;
725 ++ struct kone_settings *settings = (struct kone_settings *)buf;
726 +
727 + /* I need to get my data in one piece */
728 + if (off != 0 || count != sizeof(struct kone_settings))
729 + return -EINVAL;
730 +
731 + mutex_lock(&kone->kone_lock);
732 +- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings));
733 ++ difference = memcmp(settings, &kone->settings,
734 ++ sizeof(struct kone_settings));
735 + if (difference) {
736 +- retval = kone_set_settings(usb_dev,
737 +- (struct kone_settings const *)buf);
738 +- if (retval) {
739 +- mutex_unlock(&kone->kone_lock);
740 +- return retval;
741 ++ if (settings->startup_profile < 1 ||
742 ++ settings->startup_profile > 5) {
743 ++ retval = -EINVAL;
744 ++ goto unlock;
745 + }
746 +
747 ++ retval = kone_set_settings(usb_dev, settings);
748 ++ if (retval)
749 ++ goto unlock;
750 ++
751 + old_profile = kone->settings.startup_profile;
752 +- memcpy(&kone->settings, buf, sizeof(struct kone_settings));
753 ++ memcpy(&kone->settings, settings, sizeof(struct kone_settings));
754 +
755 + kone_profile_activated(kone, kone->settings.startup_profile);
756 +
757 + if (kone->settings.startup_profile != old_profile)
758 + kone_profile_report(kone, kone->settings.startup_profile);
759 + }
760 ++unlock:
761 + mutex_unlock(&kone->kone_lock);
762 +
763 ++ if (retval)
764 ++ return retval;
765 ++
766 + return sizeof(struct kone_settings);
767 + }
768 + static BIN_ATTR(settings, 0660, kone_sysfs_read_settings,
769 +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
770 +index 20ec34761b39b..29cd059c01f1c 100644
771 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
772 ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
773 +@@ -231,7 +231,6 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
774 + ps_opcode = HNS_ROCE_WQE_OPCODE_SEND;
775 + break;
776 + case IB_WR_LOCAL_INV:
777 +- break;
778 + case IB_WR_ATOMIC_CMP_AND_SWP:
779 + case IB_WR_ATOMIC_FETCH_AND_ADD:
780 + case IB_WR_LSO:
781 +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
782 +index 5dc920fe13269..c8c586c78d071 100644
783 +--- a/drivers/infiniband/hw/mlx4/cm.c
784 ++++ b/drivers/infiniband/hw/mlx4/cm.c
785 +@@ -309,6 +309,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id)
786 + if (!sriov->is_going_down) {
787 + id->scheduled_delete = 1;
788 + schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
789 ++ } else if (id->scheduled_delete) {
790 ++ /* Adjust timeout if already scheduled */
791 ++ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
792 + }
793 + spin_unlock_irqrestore(&sriov->going_down_lock, flags);
794 + spin_unlock(&sriov->id_map_lock);
795 +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
796 +index f32ffd74ec476..bf4e0d7a3ec21 100644
797 +--- a/drivers/infiniband/hw/mlx4/mad.c
798 ++++ b/drivers/infiniband/hw/mlx4/mad.c
799 +@@ -1276,6 +1276,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg)
800 + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
801 + }
802 +
803 ++static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg)
804 ++{
805 ++ unsigned long flags;
806 ++ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context;
807 ++ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev);
808 ++
809 ++ spin_lock_irqsave(&dev->sriov.going_down_lock, flags);
810 ++ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE)
811 ++ queue_work(ctx->wi_wq, &ctx->work);
812 ++ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
813 ++}
814 ++
815 + static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx,
816 + struct mlx4_ib_demux_pv_qp *tun_qp,
817 + int index)
818 +@@ -1978,7 +1990,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
819 + cq_size *= 2;
820 +
821 + cq_attr.cqe = cq_size;
822 +- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler,
823 ++ ctx->cq = ib_create_cq(ctx->ib_dev,
824 ++ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler,
825 + NULL, ctx, &cq_attr);
826 + if (IS_ERR(ctx->cq)) {
827 + ret = PTR_ERR(ctx->cq);
828 +@@ -2015,6 +2028,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
829 + INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker);
830 +
831 + ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq;
832 ++ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq;
833 +
834 + ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP);
835 + if (ret) {
836 +@@ -2158,7 +2172,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
837 + goto err_mcg;
838 + }
839 +
840 +- snprintf(name, sizeof name, "mlx4_ibt%d", port);
841 ++ snprintf(name, sizeof(name), "mlx4_ibt%d", port);
842 + ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
843 + if (!ctx->wq) {
844 + pr_err("Failed to create tunnelling WQ for port %d\n", port);
845 +@@ -2166,7 +2180,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
846 + goto err_wq;
847 + }
848 +
849 +- snprintf(name, sizeof name, "mlx4_ibud%d", port);
850 ++ snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
851 ++ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
852 ++ if (!ctx->wi_wq) {
853 ++ pr_err("Failed to create wire WQ for port %d\n", port);
854 ++ ret = -ENOMEM;
855 ++ goto err_wiwq;
856 ++ }
857 ++
858 ++ snprintf(name, sizeof(name), "mlx4_ibud%d", port);
859 + ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
860 + if (!ctx->ud_wq) {
861 + pr_err("Failed to create up/down WQ for port %d\n", port);
862 +@@ -2177,6 +2199,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
863 + return 0;
864 +
865 + err_udwq:
866 ++ destroy_workqueue(ctx->wi_wq);
867 ++ ctx->wi_wq = NULL;
868 ++
869 ++err_wiwq:
870 + destroy_workqueue(ctx->wq);
871 + ctx->wq = NULL;
872 +
873 +@@ -2224,12 +2250,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx)
874 + ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING;
875 + }
876 + flush_workqueue(ctx->wq);
877 ++ flush_workqueue(ctx->wi_wq);
878 + for (i = 0; i < dev->dev->caps.sqp_demux; i++) {
879 + destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0);
880 + free_pv_object(dev, i, ctx->port);
881 + }
882 + kfree(ctx->tun);
883 + destroy_workqueue(ctx->ud_wq);
884 ++ destroy_workqueue(ctx->wi_wq);
885 + destroy_workqueue(ctx->wq);
886 + }
887 + }
888 +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
889 +index 35141f451e5c7..91c89ef6ce04f 100644
890 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
891 ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
892 +@@ -439,6 +439,7 @@ struct mlx4_ib_demux_pv_ctx {
893 + struct ib_pd *pd;
894 + struct work_struct work;
895 + struct workqueue_struct *wq;
896 ++ struct workqueue_struct *wi_wq;
897 + struct mlx4_ib_demux_pv_qp qp[2];
898 + };
899 +
900 +@@ -446,6 +447,7 @@ struct mlx4_ib_demux_ctx {
901 + struct ib_device *ib_dev;
902 + int port;
903 + struct workqueue_struct *wq;
904 ++ struct workqueue_struct *wi_wq;
905 + struct workqueue_struct *ud_wq;
906 + spinlock_t ud_lock;
907 + atomic64_t subnet_prefix;
908 +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
909 +index f937873e93dfc..b95f1457c407d 100644
910 +--- a/drivers/infiniband/hw/qedr/main.c
911 ++++ b/drivers/infiniband/hw/qedr/main.c
912 +@@ -527,7 +527,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev)
913 + qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx);
914 +
915 + /* Part 2 - check capabilities */
916 +- page_size = ~dev->attr.page_size_caps + 1;
917 ++ page_size = ~qed_attr->page_size_caps + 1;
918 + if (page_size > PAGE_SIZE) {
919 + DP_ERR(dev,
920 + "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n",
921 +diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c
922 +index d430c2f7cec4c..1a1d7329fbb20 100644
923 +--- a/drivers/infiniband/sw/rdmavt/vt.c
924 ++++ b/drivers/infiniband/sw/rdmavt/vt.c
925 +@@ -96,9 +96,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports)
926 + if (!rdi)
927 + return rdi;
928 +
929 +- rdi->ports = kcalloc(nports,
930 +- sizeof(struct rvt_ibport **),
931 +- GFP_KERNEL);
932 ++ rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL);
933 + if (!rdi->ports)
934 + ib_dealloc_device(&rdi->ibdev);
935 +
936 +diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
937 +index f77b295e0123e..01788a78041b3 100644
938 +--- a/drivers/input/keyboard/ep93xx_keypad.c
939 ++++ b/drivers/input/keyboard/ep93xx_keypad.c
940 +@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev)
941 + }
942 +
943 + keypad->irq = platform_get_irq(pdev, 0);
944 +- if (!keypad->irq) {
945 +- err = -ENXIO;
946 ++ if (keypad->irq < 0) {
947 ++ err = keypad->irq;
948 + goto failed_free;
949 + }
950 +
951 +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
952 +index 3d2c60c8de830..c6a468dfdfb48 100644
953 +--- a/drivers/input/keyboard/omap4-keypad.c
954 ++++ b/drivers/input/keyboard/omap4-keypad.c
955 +@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev)
956 + }
957 +
958 + irq = platform_get_irq(pdev, 0);
959 +- if (!irq) {
960 +- dev_err(&pdev->dev, "no keyboard irq assigned\n");
961 +- return -EINVAL;
962 +- }
963 ++ if (irq < 0)
964 ++ return irq;
965 +
966 + keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL);
967 + if (!keypad_data) {
968 +diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
969 +index 323a0fb575a44..d87e7cd11ecb6 100644
970 +--- a/drivers/input/keyboard/twl4030_keypad.c
971 ++++ b/drivers/input/keyboard/twl4030_keypad.c
972 +@@ -63,7 +63,7 @@ struct twl4030_keypad {
973 + bool autorepeat;
974 + unsigned int n_rows;
975 + unsigned int n_cols;
976 +- unsigned int irq;
977 ++ int irq;
978 +
979 + struct device *dbg_dev;
980 + struct input_dev *input;
981 +@@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev)
982 + }
983 +
984 + kp->irq = platform_get_irq(pdev, 0);
985 +- if (!kp->irq) {
986 +- dev_err(&pdev->dev, "no keyboard irq assigned\n");
987 +- return -EINVAL;
988 +- }
989 ++ if (kp->irq < 0)
990 ++ return kp->irq;
991 +
992 + error = matrix_keypad_build_keymap(keymap_data, NULL,
993 + TWL4030_MAX_ROWS,
994 +diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c
995 +index 04b96fe393397..46512b4d686a8 100644
996 +--- a/drivers/input/serio/sun4i-ps2.c
997 ++++ b/drivers/input/serio/sun4i-ps2.c
998 +@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
999 + struct sun4i_ps2data *drvdata;
1000 + struct serio *serio;
1001 + struct device *dev = &pdev->dev;
1002 +- unsigned int irq;
1003 + int error;
1004 +
1005 + drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL);
1006 +@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
1007 + writel(0, drvdata->reg_base + PS2_REG_GCTL);
1008 +
1009 + /* Get IRQ for the device */
1010 +- irq = platform_get_irq(pdev, 0);
1011 +- if (!irq) {
1012 +- dev_err(dev, "no IRQ found\n");
1013 +- error = -ENXIO;
1014 ++ drvdata->irq = platform_get_irq(pdev, 0);
1015 ++ if (drvdata->irq < 0) {
1016 ++ error = drvdata->irq;
1017 + goto err_disable_clk;
1018 + }
1019 +
1020 +- drvdata->irq = irq;
1021 + drvdata->serio = serio;
1022 + drvdata->dev = dev;
1023 +
1024 +diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
1025 +index 8275267eac254..4be7ddc04af0f 100644
1026 +--- a/drivers/input/touchscreen/imx6ul_tsc.c
1027 ++++ b/drivers/input/touchscreen/imx6ul_tsc.c
1028 +@@ -490,20 +490,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev)
1029 +
1030 + mutex_lock(&input_dev->mutex);
1031 +
1032 +- if (input_dev->users) {
1033 +- retval = clk_prepare_enable(tsc->adc_clk);
1034 +- if (retval)
1035 +- goto out;
1036 +-
1037 +- retval = clk_prepare_enable(tsc->tsc_clk);
1038 +- if (retval) {
1039 +- clk_disable_unprepare(tsc->adc_clk);
1040 +- goto out;
1041 +- }
1042 ++ if (!input_dev->users)
1043 ++ goto out;
1044 +
1045 +- retval = imx6ul_tsc_init(tsc);
1046 ++ retval = clk_prepare_enable(tsc->adc_clk);
1047 ++ if (retval)
1048 ++ goto out;
1049 ++
1050 ++ retval = clk_prepare_enable(tsc->tsc_clk);
1051 ++ if (retval) {
1052 ++ clk_disable_unprepare(tsc->adc_clk);
1053 ++ goto out;
1054 + }
1055 +
1056 ++ retval = imx6ul_tsc_init(tsc);
1057 ++ if (retval) {
1058 ++ clk_disable_unprepare(tsc->tsc_clk);
1059 ++ clk_disable_unprepare(tsc->adc_clk);
1060 ++ goto out;
1061 ++ }
1062 + out:
1063 + mutex_unlock(&input_dev->mutex);
1064 + return retval;
1065 +diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
1066 +index 5d634706a7eaa..382f290c3f4d5 100644
1067 +--- a/drivers/media/firewire/firedtv-fw.c
1068 ++++ b/drivers/media/firewire/firedtv-fw.c
1069 +@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
1070 +
1071 + name_len = fw_csr_string(unit->directory, CSR_MODEL,
1072 + name, sizeof(name));
1073 +- if (name_len < 0)
1074 +- return name_len;
1075 ++ if (name_len < 0) {
1076 ++ err = name_len;
1077 ++ goto fail_free;
1078 ++ }
1079 + for (i = ARRAY_SIZE(model_names); --i; )
1080 + if (strlen(model_names[i]) <= name_len &&
1081 + strncmp(name, model_names[i], name_len) == 0)
1082 +diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
1083 +index acb804bceccbc..e1736777e6ccb 100644
1084 +--- a/drivers/media/i2c/m5mols/m5mols_core.c
1085 ++++ b/drivers/media/i2c/m5mols/m5mols_core.c
1086 +@@ -754,7 +754,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable)
1087 +
1088 + ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies);
1089 + if (ret) {
1090 +- info->set_power(&client->dev, 0);
1091 ++ if (info->set_power)
1092 ++ info->set_power(&client->dev, 0);
1093 + return ret;
1094 + }
1095 +
1096 +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
1097 +index 7ebcb9473956e..3e47b432d0f4e 100644
1098 +--- a/drivers/media/i2c/tc358743.c
1099 ++++ b/drivers/media/i2c/tc358743.c
1100 +@@ -1321,7 +1321,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
1101 + static irqreturn_t tc358743_irq_handler(int irq, void *dev_id)
1102 + {
1103 + struct tc358743_state *state = dev_id;
1104 +- bool handled;
1105 ++ bool handled = false;
1106 +
1107 + tc358743_isr(&state->sd, 0, &handled);
1108 +
1109 +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
1110 +index 97b91a9f9fa93..1d6173998a299 100644
1111 +--- a/drivers/media/pci/bt8xx/bttv-driver.c
1112 ++++ b/drivers/media/pci/bt8xx/bttv-driver.c
1113 +@@ -4059,11 +4059,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
1114 + btv->id = dev->device;
1115 + if (pci_enable_device(dev)) {
1116 + pr_warn("%d: Can't enable device\n", btv->c.nr);
1117 +- return -EIO;
1118 ++ result = -EIO;
1119 ++ goto free_mem;
1120 + }
1121 + if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) {
1122 + pr_warn("%d: No suitable DMA available\n", btv->c.nr);
1123 +- return -EIO;
1124 ++ result = -EIO;
1125 ++ goto free_mem;
1126 + }
1127 + if (!request_mem_region(pci_resource_start(dev,0),
1128 + pci_resource_len(dev,0),
1129 +@@ -4071,7 +4073,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
1130 + pr_warn("%d: can't request iomem (0x%llx)\n",
1131 + btv->c.nr,
1132 + (unsigned long long)pci_resource_start(dev, 0));
1133 +- return -EBUSY;
1134 ++ result = -EBUSY;
1135 ++ goto free_mem;
1136 + }
1137 + pci_set_master(dev);
1138 + pci_set_command(dev);
1139 +@@ -4257,6 +4260,10 @@ fail0:
1140 + release_mem_region(pci_resource_start(btv->c.pci,0),
1141 + pci_resource_len(btv->c.pci,0));
1142 + pci_disable_device(btv->c.pci);
1143 ++
1144 ++free_mem:
1145 ++ bttvs[btv->c.nr] = NULL;
1146 ++ kfree(btv);
1147 + return result;
1148 + }
1149 +
1150 +diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c
1151 +index 38f94b742e283..0b5d6f4994571 100644
1152 +--- a/drivers/media/pci/saa7134/saa7134-tvaudio.c
1153 ++++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c
1154 +@@ -697,7 +697,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value)
1155 + {
1156 + int err;
1157 +
1158 +- audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value);
1159 ++ audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n",
1160 ++ (reg << 2) & 0xffffffff, value);
1161 + err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR);
1162 + if (err < 0)
1163 + return err;
1164 +diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
1165 +index 8efe9160ab346..dbc4f57f34a52 100644
1166 +--- a/drivers/media/platform/exynos4-is/fimc-isp.c
1167 ++++ b/drivers/media/platform/exynos4-is/fimc-isp.c
1168 +@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on)
1169 +
1170 + if (on) {
1171 + ret = pm_runtime_get_sync(&is->pdev->dev);
1172 +- if (ret < 0)
1173 ++ if (ret < 0) {
1174 ++ pm_runtime_put(&is->pdev->dev);
1175 + return ret;
1176 ++ }
1177 + set_bit(IS_ST_PWR_ON, &is->state);
1178 +
1179 + ret = fimc_is_start_firmware(is);
1180 +diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
1181 +index b91abf1c4d43b..f1921e06ffe1b 100644
1182 +--- a/drivers/media/platform/exynos4-is/fimc-lite.c
1183 ++++ b/drivers/media/platform/exynos4-is/fimc-lite.c
1184 +@@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file)
1185 + set_bit(ST_FLITE_IN_USE, &fimc->state);
1186 + ret = pm_runtime_get_sync(&fimc->pdev->dev);
1187 + if (ret < 0)
1188 +- goto unlock;
1189 ++ goto err_pm;
1190 +
1191 + ret = v4l2_fh_open(file);
1192 + if (ret < 0)
1193 +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
1194 +index cdaf3a8e2555e..a1599659b88ba 100644
1195 +--- a/drivers/media/platform/exynos4-is/media-dev.c
1196 ++++ b/drivers/media/platform/exynos4-is/media-dev.c
1197 +@@ -477,8 +477,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
1198 + return -ENXIO;
1199 +
1200 + ret = pm_runtime_get_sync(fmd->pmf);
1201 +- if (ret < 0)
1202 ++ if (ret < 0) {
1203 ++ pm_runtime_put(fmd->pmf);
1204 + return ret;
1205 ++ }
1206 +
1207 + fmd->num_sensors = 0;
1208 +
1209 +@@ -1255,11 +1257,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
1210 + if (IS_ERR(pctl->state_default))
1211 + return PTR_ERR(pctl->state_default);
1212 +
1213 ++ /* PINCTRL_STATE_IDLE is optional */
1214 + pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
1215 + PINCTRL_STATE_IDLE);
1216 +- if (IS_ERR(pctl->state_idle))
1217 +- return PTR_ERR(pctl->state_idle);
1218 +-
1219 + return 0;
1220 + }
1221 +
1222 +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
1223 +index befd9fc0adc4a..dc87c9cfa52ff 100644
1224 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c
1225 ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c
1226 +@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable)
1227 + if (enable) {
1228 + s5pcsis_clear_counters(state);
1229 + ret = pm_runtime_get_sync(&state->pdev->dev);
1230 +- if (ret && ret != 1)
1231 ++ if (ret && ret != 1) {
1232 ++ pm_runtime_put_noidle(&state->pdev->dev);
1233 + return ret;
1234 ++ }
1235 + }
1236 +
1237 + mutex_lock(&state->lock);
1238 +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
1239 +index ce651d3ca1b82..a56863b090144 100644
1240 +--- a/drivers/media/platform/omap3isp/isp.c
1241 ++++ b/drivers/media/platform/omap3isp/isp.c
1242 +@@ -2273,8 +2273,10 @@ static int isp_probe(struct platform_device *pdev)
1243 + mem = platform_get_resource(pdev, IORESOURCE_MEM, i);
1244 + isp->mmio_base[map_idx] =
1245 + devm_ioremap_resource(isp->dev, mem);
1246 +- if (IS_ERR(isp->mmio_base[map_idx]))
1247 +- return PTR_ERR(isp->mmio_base[map_idx]);
1248 ++ if (IS_ERR(isp->mmio_base[map_idx])) {
1249 ++ ret = PTR_ERR(isp->mmio_base[map_idx]);
1250 ++ goto error;
1251 ++ }
1252 + }
1253 +
1254 + ret = isp_get_clocks(isp);
1255 +diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
1256 +index 8e9c3bd36d03e..5b5722e65e9b9 100644
1257 +--- a/drivers/media/platform/rcar-fcp.c
1258 ++++ b/drivers/media/platform/rcar-fcp.c
1259 +@@ -107,8 +107,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp)
1260 + return 0;
1261 +
1262 + ret = pm_runtime_get_sync(fcp->dev);
1263 +- if (ret < 0)
1264 ++ if (ret < 0) {
1265 ++ pm_runtime_put_noidle(fcp->dev);
1266 + return ret;
1267 ++ }
1268 +
1269 + return 0;
1270 + }
1271 +diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c
1272 +index ec40019703132..560e1ff236508 100644
1273 +--- a/drivers/media/platform/s3c-camif/camif-core.c
1274 ++++ b/drivers/media/platform/s3c-camif/camif-core.c
1275 +@@ -476,7 +476,7 @@ static int s3c_camif_probe(struct platform_device *pdev)
1276 +
1277 + ret = camif_media_dev_init(camif);
1278 + if (ret < 0)
1279 +- goto err_alloc;
1280 ++ goto err_pm;
1281 +
1282 + ret = camif_register_sensor(camif);
1283 + if (ret < 0)
1284 +@@ -510,10 +510,9 @@ err_sens:
1285 + media_device_unregister(&camif->media_dev);
1286 + media_device_cleanup(&camif->media_dev);
1287 + camif_unregister_media_entities(camif);
1288 +-err_alloc:
1289 ++err_pm:
1290 + pm_runtime_put(dev);
1291 + pm_runtime_disable(dev);
1292 +-err_pm:
1293 + camif_clk_put(camif);
1294 + err_clk:
1295 + s3c_camif_unregister_subdev(camif);
1296 +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1297 +index d88c9ba401b5d..bec4278401b2a 100644
1298 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1299 ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1300 +@@ -1366,7 +1366,7 @@ static int bdisp_probe(struct platform_device *pdev)
1301 + ret = pm_runtime_get_sync(dev);
1302 + if (ret < 0) {
1303 + dev_err(dev, "failed to set PM\n");
1304 +- goto err_dbg;
1305 ++ goto err_pm;
1306 + }
1307 +
1308 + /* Filters */
1309 +@@ -1394,7 +1394,6 @@ err_filter:
1310 + bdisp_hw_free_filters(bdisp->dev);
1311 + err_pm:
1312 + pm_runtime_put(dev);
1313 +-err_dbg:
1314 + bdisp_debugfs_remove(bdisp);
1315 + err_v4l2:
1316 + v4l2_device_unregister(&bdisp->v4l2_dev);
1317 +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
1318 +index cf2a8d8845367..c4d97fb80aaec 100644
1319 +--- a/drivers/media/platform/sti/hva/hva-hw.c
1320 ++++ b/drivers/media/platform/sti/hva/hva-hw.c
1321 +@@ -389,7 +389,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva)
1322 + ret = pm_runtime_get_sync(dev);
1323 + if (ret < 0) {
1324 + dev_err(dev, "%s failed to set PM\n", HVA_PREFIX);
1325 +- goto err_clk;
1326 ++ goto err_pm;
1327 + }
1328 +
1329 + /* check IP hardware version */
1330 +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
1331 +index dbb4829acc438..360a2ad14ce42 100644
1332 +--- a/drivers/media/platform/ti-vpe/vpe.c
1333 ++++ b/drivers/media/platform/ti-vpe/vpe.c
1334 +@@ -2133,6 +2133,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
1335 +
1336 + r = pm_runtime_get_sync(&pdev->dev);
1337 + WARN_ON(r < 0);
1338 ++ if (r)
1339 ++ pm_runtime_put_noidle(&pdev->dev);
1340 + return r < 0 ? r : 0;
1341 + }
1342 +
1343 +diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
1344 +index 4ac1ff482a0b3..fcb1838d670d4 100644
1345 +--- a/drivers/media/platform/vsp1/vsp1_drv.c
1346 ++++ b/drivers/media/platform/vsp1/vsp1_drv.c
1347 +@@ -487,7 +487,12 @@ int vsp1_device_get(struct vsp1_device *vsp1)
1348 + int ret;
1349 +
1350 + ret = pm_runtime_get_sync(vsp1->dev);
1351 +- return ret < 0 ? ret : 0;
1352 ++ if (ret < 0) {
1353 ++ pm_runtime_put_noidle(vsp1->dev);
1354 ++ return ret;
1355 ++ }
1356 ++
1357 ++ return 0;
1358 + }
1359 +
1360 + /*
1361 +@@ -727,12 +732,12 @@ static int vsp1_probe(struct platform_device *pdev)
1362 + /* Configure device parameters based on the version register. */
1363 + pm_runtime_enable(&pdev->dev);
1364 +
1365 +- ret = pm_runtime_get_sync(&pdev->dev);
1366 ++ ret = vsp1_device_get(vsp1);
1367 + if (ret < 0)
1368 + goto done;
1369 +
1370 + vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION);
1371 +- pm_runtime_put_sync(&pdev->dev);
1372 ++ vsp1_device_put(vsp1);
1373 +
1374 + for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) {
1375 + if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) ==
1376 +diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
1377 +index 9f5b59706741c..7f98db4bc0277 100644
1378 +--- a/drivers/media/rc/ati_remote.c
1379 ++++ b/drivers/media/rc/ati_remote.c
1380 +@@ -850,6 +850,10 @@ static int ati_remote_probe(struct usb_interface *interface,
1381 + err("%s: endpoint_in message size==0? \n", __func__);
1382 + return -ENODEV;
1383 + }
1384 ++ if (!usb_endpoint_is_int_out(endpoint_out)) {
1385 ++ err("%s: Unexpected endpoint_out\n", __func__);
1386 ++ return -ENODEV;
1387 ++ }
1388 +
1389 + ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL);
1390 + rc_dev = rc_allocate_device();
1391 +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
1392 +index 05eed4be25df2..5156c971c241c 100644
1393 +--- a/drivers/media/usb/uvc/uvc_v4l2.c
1394 ++++ b/drivers/media/usb/uvc/uvc_v4l2.c
1395 +@@ -257,11 +257,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
1396 + if (ret < 0)
1397 + goto done;
1398 +
1399 ++ /* After the probe, update fmt with the values returned from
1400 ++ * negotiation with the device.
1401 ++ */
1402 ++ for (i = 0; i < stream->nformats; ++i) {
1403 ++ if (probe->bFormatIndex == stream->format[i].index) {
1404 ++ format = &stream->format[i];
1405 ++ break;
1406 ++ }
1407 ++ }
1408 ++
1409 ++ if (i == stream->nformats) {
1410 ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
1411 ++ probe->bFormatIndex);
1412 ++ return -EINVAL;
1413 ++ }
1414 ++
1415 ++ for (i = 0; i < format->nframes; ++i) {
1416 ++ if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
1417 ++ frame = &format->frame[i];
1418 ++ break;
1419 ++ }
1420 ++ }
1421 ++
1422 ++ if (i == format->nframes) {
1423 ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
1424 ++ probe->bFrameIndex);
1425 ++ return -EINVAL;
1426 ++ }
1427 ++
1428 + fmt->fmt.pix.width = frame->wWidth;
1429 + fmt->fmt.pix.height = frame->wHeight;
1430 + fmt->fmt.pix.field = V4L2_FIELD_NONE;
1431 + fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame);
1432 + fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize;
1433 ++ fmt->fmt.pix.pixelformat = format->fcc;
1434 + fmt->fmt.pix.colorspace = format->colorspace;
1435 + fmt->fmt.pix.priv = 0;
1436 +
1437 +diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c
1438 +index 662d050243bec..2fbf8d09af36b 100644
1439 +--- a/drivers/memory/fsl-corenet-cf.c
1440 ++++ b/drivers/memory/fsl-corenet-cf.c
1441 +@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev)
1442 + dev_set_drvdata(&pdev->dev, ccf);
1443 +
1444 + irq = platform_get_irq(pdev, 0);
1445 +- if (!irq) {
1446 +- dev_err(&pdev->dev, "%s: no irq\n", __func__);
1447 +- return -ENXIO;
1448 +- }
1449 ++ if (irq < 0)
1450 ++ return irq;
1451 +
1452 + ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf);
1453 + if (ret) {
1454 +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
1455 +index bf0fe0137dfed..a9d47c06f80f3 100644
1456 +--- a/drivers/memory/omap-gpmc.c
1457 ++++ b/drivers/memory/omap-gpmc.c
1458 +@@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base)
1459 + int ret;
1460 + u32 old_base, size;
1461 +
1462 +- if (cs > gpmc_cs_num) {
1463 ++ if (cs >= gpmc_cs_num) {
1464 + pr_err("%s: requested chip-select is disabled\n", __func__);
1465 + return -ENODEV;
1466 + }
1467 +@@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
1468 + struct resource *res = &gpmc->mem;
1469 + int r = -1;
1470 +
1471 +- if (cs > gpmc_cs_num) {
1472 ++ if (cs >= gpmc_cs_num) {
1473 + pr_err("%s: requested chip-select is disabled\n", __func__);
1474 + return -ENODEV;
1475 + }
1476 +diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
1477 +index 98029ee0959e3..be61f8606a045 100644
1478 +--- a/drivers/mfd/rtsx_pcr.c
1479 ++++ b/drivers/mfd/rtsx_pcr.c
1480 +@@ -1255,12 +1255,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
1481 + ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells,
1482 + ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL);
1483 + if (ret < 0)
1484 +- goto disable_irq;
1485 ++ goto free_slots;
1486 +
1487 + schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200));
1488 +
1489 + return 0;
1490 +
1491 ++free_slots:
1492 ++ kfree(pcr->slots);
1493 + disable_irq:
1494 + free_irq(pcr->irq, (void *)pcr);
1495 + disable_msi:
1496 +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
1497 +index 3270b8dbc9498..4ca245518a199 100644
1498 +--- a/drivers/mfd/sm501.c
1499 ++++ b/drivers/mfd/sm501.c
1500 +@@ -1425,8 +1425,14 @@ static int sm501_plat_probe(struct platform_device *dev)
1501 + goto err_claim;
1502 + }
1503 +
1504 +- return sm501_init_dev(sm);
1505 ++ ret = sm501_init_dev(sm);
1506 ++ if (ret)
1507 ++ goto err_unmap;
1508 ++
1509 ++ return 0;
1510 +
1511 ++ err_unmap:
1512 ++ iounmap(sm->regs);
1513 + err_claim:
1514 + release_resource(sm->regs_claim);
1515 + kfree(sm->regs_claim);
1516 +diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
1517 +index 5afe4cd165699..cd7e7e36907bc 100644
1518 +--- a/drivers/misc/eeprom/at25.c
1519 ++++ b/drivers/misc/eeprom/at25.c
1520 +@@ -355,7 +355,7 @@ static int at25_probe(struct spi_device *spi)
1521 + at25->nvmem_config.reg_read = at25_ee_read;
1522 + at25->nvmem_config.reg_write = at25_ee_write;
1523 + at25->nvmem_config.priv = at25;
1524 +- at25->nvmem_config.stride = 4;
1525 ++ at25->nvmem_config.stride = 1;
1526 + at25->nvmem_config.word_size = 1;
1527 + at25->nvmem_config.size = chip.byte_len;
1528 +
1529 +diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
1530 +index 32ab0f43f5061..4e2cfb6eea353 100644
1531 +--- a/drivers/misc/mic/scif/scif_rma.c
1532 ++++ b/drivers/misc/mic/scif/scif_rma.c
1533 +@@ -1401,6 +1401,8 @@ retry:
1534 + NULL);
1535 + up_write(&mm->mmap_sem);
1536 + if (nr_pages != pinned_pages->nr_pages) {
1537 ++ if (pinned_pages->nr_pages < 0)
1538 ++ pinned_pages->nr_pages = 0;
1539 + if (try_upgrade) {
1540 + if (ulimit)
1541 + __scif_dec_pinned_vm_lock(mm,
1542 +@@ -1421,7 +1423,6 @@ retry:
1543 +
1544 + if (pinned_pages->nr_pages < nr_pages) {
1545 + err = -EFAULT;
1546 +- pinned_pages->nr_pages = nr_pages;
1547 + goto dec_pinned;
1548 + }
1549 +
1550 +@@ -1434,7 +1435,6 @@ dec_pinned:
1551 + __scif_dec_pinned_vm_lock(mm, nr_pages, 0);
1552 + /* Something went wrong! Rollback */
1553 + error_unmap:
1554 +- pinned_pages->nr_pages = nr_pages;
1555 + scif_destroy_pinned_pages(pinned_pages);
1556 + *pages = NULL;
1557 + dev_dbg(scif_info.mdev.this_device,
1558 +diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
1559 +index 1a2b67f3183d5..f9da3150f80a2 100644
1560 +--- a/drivers/misc/mic/vop/vop_main.c
1561 ++++ b/drivers/misc/mic/vop/vop_main.c
1562 +@@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
1563 + /* First assign the vring's allocated in host memory */
1564 + vqconfig = _vop_vq_config(vdev->desc) + index;
1565 + memcpy_fromio(&config, vqconfig, sizeof(config));
1566 +- _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
1567 ++ _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4);
1568 + vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
1569 + va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address),
1570 + vr_size);
1571 +diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c
1572 +index fed992e2c2583..49e7a7240469c 100644
1573 +--- a/drivers/misc/mic/vop/vop_vringh.c
1574 ++++ b/drivers/misc/mic/vop/vop_vringh.c
1575 +@@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
1576 +
1577 + num = le16_to_cpu(vqconfig[i].num);
1578 + mutex_init(&vvr->vr_mutex);
1579 +- vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) +
1580 ++ vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) +
1581 + sizeof(struct _mic_vring_info));
1582 + vr->va = (void *)
1583 + __get_free_pages(GFP_KERNEL | __GFP_ZERO,
1584 +@@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
1585 + goto err;
1586 + }
1587 + vr->len = vr_size;
1588 +- vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
1589 ++ vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4);
1590 + vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i);
1591 + vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size,
1592 + DMA_BIDIRECTIONAL);
1593 +@@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,
1594 + size_t partlen;
1595 + bool dma = VOP_USE_DMA;
1596 + int err = 0;
1597 ++ size_t offset = 0;
1598 +
1599 + if (daddr & (dma_alignment - 1)) {
1600 + vdev->tx_dst_unaligned += len;
1601 +@@ -659,13 +660,20 @@ memcpy:
1602 + * We are copying to IO below and should ideally use something
1603 + * like copy_from_user_toio(..) if it existed.
1604 + */
1605 +- if (copy_from_user((void __force *)dbuf, ubuf, len)) {
1606 +- err = -EFAULT;
1607 +- dev_err(vop_dev(vdev), "%s %d err %d\n",
1608 +- __func__, __LINE__, err);
1609 +- goto err;
1610 ++ while (len) {
1611 ++ partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
1612 ++
1613 ++ if (copy_from_user(vvr->buf, ubuf + offset, partlen)) {
1614 ++ err = -EFAULT;
1615 ++ dev_err(vop_dev(vdev), "%s %d err %d\n",
1616 ++ __func__, __LINE__, err);
1617 ++ goto err;
1618 ++ }
1619 ++ memcpy_toio(dbuf + offset, vvr->buf, partlen);
1620 ++ offset += partlen;
1621 ++ vdev->out_bytes += partlen;
1622 ++ len -= partlen;
1623 + }
1624 +- vdev->out_bytes += len;
1625 + err = 0;
1626 + err:
1627 + vpdev->hw_ops->iounmap(vpdev, dbuf);
1628 +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
1629 +index 5927db046a87c..6ac3c59c9ae78 100644
1630 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
1631 ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
1632 +@@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
1633 + if (retval < (int)produce_q->kernel_if->num_pages) {
1634 + pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
1635 + retval);
1636 +- qp_release_pages(produce_q->kernel_if->u.h.header_page,
1637 +- retval, false);
1638 ++ if (retval > 0)
1639 ++ qp_release_pages(produce_q->kernel_if->u.h.header_page,
1640 ++ retval, false);
1641 + err = VMCI_ERROR_NO_MEM;
1642 + goto out;
1643 + }
1644 +@@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
1645 + if (retval < (int)consume_q->kernel_if->num_pages) {
1646 + pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
1647 + retval);
1648 +- qp_release_pages(consume_q->kernel_if->u.h.header_page,
1649 +- retval, false);
1650 ++ if (retval > 0)
1651 ++ qp_release_pages(consume_q->kernel_if->u.h.header_page,
1652 ++ retval, false);
1653 + qp_release_pages(produce_q->kernel_if->u.h.header_page,
1654 + produce_q->kernel_if->num_pages, false);
1655 + err = VMCI_ERROR_NO_MEM;
1656 +diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
1657 +index dcb3dee59fa5f..934c4816d78bf 100644
1658 +--- a/drivers/mmc/core/sdio_cis.c
1659 ++++ b/drivers/mmc/core/sdio_cis.c
1660 +@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
1661 + unsigned i, nr_strings;
1662 + char **buffer, *string;
1663 +
1664 ++ if (size < 2)
1665 ++ return 0;
1666 ++
1667 + /* Find all null-terminated (including zero length) strings in
1668 + the TPLLV1_INFO field. Trailing garbage is ignored. */
1669 + buf += 2;
1670 +diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c
1671 +index 2342277c9bcb0..5e36366d9b36d 100644
1672 +--- a/drivers/mtd/lpddr/lpddr2_nvm.c
1673 ++++ b/drivers/mtd/lpddr/lpddr2_nvm.c
1674 +@@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add,
1675 + return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK);
1676 + }
1677 +
1678 ++static const struct mtd_info lpddr2_nvm_mtd_info = {
1679 ++ .type = MTD_RAM,
1680 ++ .writesize = 1,
1681 ++ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
1682 ++ ._read = lpddr2_nvm_read,
1683 ++ ._write = lpddr2_nvm_write,
1684 ++ ._erase = lpddr2_nvm_erase,
1685 ++ ._unlock = lpddr2_nvm_unlock,
1686 ++ ._lock = lpddr2_nvm_lock,
1687 ++};
1688 ++
1689 + /*
1690 + * lpddr2_nvm driver probe method
1691 + */
1692 +@@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
1693 + .pfow_base = OW_BASE_ADDRESS,
1694 + .fldrv_priv = pcm_data,
1695 + };
1696 ++
1697 + if (IS_ERR(map->virt))
1698 + return PTR_ERR(map->virt);
1699 +
1700 +@@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
1701 + return PTR_ERR(pcm_data->ctl_regs);
1702 +
1703 + /* Populate mtd_info data structure */
1704 +- *mtd = (struct mtd_info) {
1705 +- .dev = { .parent = &pdev->dev },
1706 +- .name = pdev->dev.init_name,
1707 +- .type = MTD_RAM,
1708 +- .priv = map,
1709 +- .size = resource_size(add_range),
1710 +- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width,
1711 +- .writesize = 1,
1712 +- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width,
1713 +- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
1714 +- ._read = lpddr2_nvm_read,
1715 +- ._write = lpddr2_nvm_write,
1716 +- ._erase = lpddr2_nvm_erase,
1717 +- ._unlock = lpddr2_nvm_unlock,
1718 +- ._lock = lpddr2_nvm_lock,
1719 +- };
1720 ++ *mtd = lpddr2_nvm_mtd_info;
1721 ++ mtd->dev.parent = &pdev->dev;
1722 ++ mtd->name = pdev->dev.init_name;
1723 ++ mtd->priv = map;
1724 ++ mtd->size = resource_size(add_range);
1725 ++ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width;
1726 ++ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width;
1727 +
1728 + /* Verify the presence of the device looking for PFOW string */
1729 + if (!lpddr2_nvm_pfow_present(map)) {
1730 +diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
1731 +index 97bb8f6304d4f..09165eaac7a15 100644
1732 +--- a/drivers/mtd/mtdoops.c
1733 ++++ b/drivers/mtd/mtdoops.c
1734 +@@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper,
1735 + kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE,
1736 + record_size - MTDOOPS_HEADER_SIZE, NULL);
1737 +
1738 +- /* Panics must be written immediately */
1739 +- if (reason != KMSG_DUMP_OOPS)
1740 ++ if (reason != KMSG_DUMP_OOPS) {
1741 ++ /* Panics must be written immediately */
1742 + mtdoops_write(cxt, 1);
1743 +-
1744 +- /* For other cases, schedule work to write it "nicely" */
1745 +- schedule_work(&cxt->work_write);
1746 ++ } else {
1747 ++ /* For other cases, schedule work to write it "nicely" */
1748 ++ schedule_work(&cxt->work_write);
1749 ++ }
1750 + }
1751 +
1752 + static void mtdoops_notify_add(struct mtd_info *mtd)
1753 +diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
1754 +index 130f910e47854..b6ebcee40a0d4 100644
1755 +--- a/drivers/net/ethernet/cisco/enic/enic.h
1756 ++++ b/drivers/net/ethernet/cisco/enic/enic.h
1757 +@@ -163,6 +163,7 @@ struct enic {
1758 + u16 num_vfs;
1759 + #endif
1760 + spinlock_t enic_api_lock;
1761 ++ bool enic_api_busy;
1762 + struct enic_port_profile *pp;
1763 +
1764 + /* work queue cache line section */
1765 +diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c
1766 +index b161f24522b87..b028ea2dec2b9 100644
1767 +--- a/drivers/net/ethernet/cisco/enic/enic_api.c
1768 ++++ b/drivers/net/ethernet/cisco/enic/enic_api.c
1769 +@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf,
1770 + struct vnic_dev *vdev = enic->vdev;
1771 +
1772 + spin_lock(&enic->enic_api_lock);
1773 ++ while (enic->enic_api_busy) {
1774 ++ spin_unlock(&enic->enic_api_lock);
1775 ++ cpu_relax();
1776 ++ spin_lock(&enic->enic_api_lock);
1777 ++ }
1778 ++
1779 + spin_lock_bh(&enic->devcmd_lock);
1780 +
1781 + vnic_dev_cmd_proxy_by_index_start(vdev, vf);
1782 +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
1783 +index 96290b83dfde9..3a3f3a7d7a75f 100644
1784 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c
1785 ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
1786 +@@ -1938,8 +1938,6 @@ static int enic_dev_wait(struct vnic_dev *vdev,
1787 + int done;
1788 + int err;
1789 +
1790 +- BUG_ON(in_interrupt());
1791 +-
1792 + err = start(vdev, arg);
1793 + if (err)
1794 + return err;
1795 +@@ -2116,6 +2114,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic)
1796 + rss_hash_bits, rss_base_cpu, rss_enable);
1797 + }
1798 +
1799 ++static void enic_set_api_busy(struct enic *enic, bool busy)
1800 ++{
1801 ++ spin_lock(&enic->enic_api_lock);
1802 ++ enic->enic_api_busy = busy;
1803 ++ spin_unlock(&enic->enic_api_lock);
1804 ++}
1805 ++
1806 + static void enic_reset(struct work_struct *work)
1807 + {
1808 + struct enic *enic = container_of(work, struct enic, reset);
1809 +@@ -2125,7 +2130,9 @@ static void enic_reset(struct work_struct *work)
1810 +
1811 + rtnl_lock();
1812 +
1813 +- spin_lock(&enic->enic_api_lock);
1814 ++ /* Stop any activity from infiniband */
1815 ++ enic_set_api_busy(enic, true);
1816 ++
1817 + enic_stop(enic->netdev);
1818 + enic_dev_soft_reset(enic);
1819 + enic_reset_addr_lists(enic);
1820 +@@ -2133,7 +2140,10 @@ static void enic_reset(struct work_struct *work)
1821 + enic_set_rss_nic_cfg(enic);
1822 + enic_dev_set_ig_vlan_rewrite_mode(enic);
1823 + enic_open(enic->netdev);
1824 +- spin_unlock(&enic->enic_api_lock);
1825 ++
1826 ++ /* Allow infiniband to fiddle with the device again */
1827 ++ enic_set_api_busy(enic, false);
1828 ++
1829 + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
1830 +
1831 + rtnl_unlock();
1832 +@@ -2145,7 +2155,9 @@ static void enic_tx_hang_reset(struct work_struct *work)
1833 +
1834 + rtnl_lock();
1835 +
1836 +- spin_lock(&enic->enic_api_lock);
1837 ++ /* Stop any activity from infiniband */
1838 ++ enic_set_api_busy(enic, true);
1839 ++
1840 + enic_dev_hang_notify(enic);
1841 + enic_stop(enic->netdev);
1842 + enic_dev_hang_reset(enic);
1843 +@@ -2154,7 +2166,10 @@ static void enic_tx_hang_reset(struct work_struct *work)
1844 + enic_set_rss_nic_cfg(enic);
1845 + enic_dev_set_ig_vlan_rewrite_mode(enic);
1846 + enic_open(enic->netdev);
1847 +- spin_unlock(&enic->enic_api_lock);
1848 ++
1849 ++ /* Allow infiniband to fiddle with the device again */
1850 ++ enic_set_api_busy(enic, false);
1851 ++
1852 + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
1853 +
1854 + rtnl_unlock();
1855 +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
1856 +index de9897c8e9331..f5fd20dc8ab19 100644
1857 +--- a/drivers/net/ethernet/ibm/ibmveth.c
1858 ++++ b/drivers/net/ethernet/ibm/ibmveth.c
1859 +@@ -1256,6 +1256,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
1860 + int offset = ibmveth_rxq_frame_offset(adapter);
1861 + int csum_good = ibmveth_rxq_csum_good(adapter);
1862 + int lrg_pkt = ibmveth_rxq_large_packet(adapter);
1863 ++ __sum16 iph_check = 0;
1864 +
1865 + skb = ibmveth_rxq_get_buffer(adapter);
1866 +
1867 +@@ -1307,7 +1308,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
1868 + }
1869 + }
1870 +
1871 +- if (length > netdev->mtu + ETH_HLEN) {
1872 ++ /* PHYP without PLSO support places a -1 in the ip
1873 ++ * checksum for large send frames.
1874 ++ */
1875 ++ if (skb->protocol == cpu_to_be16(ETH_P_IP)) {
1876 ++ struct iphdr *iph = (struct iphdr *)skb->data;
1877 ++
1878 ++ iph_check = iph->check;
1879 ++ }
1880 ++
1881 ++ if ((length > netdev->mtu + ETH_HLEN) ||
1882 ++ lrg_pkt || iph_check == 0xffff) {
1883 + ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
1884 + adapter->rx_large_packets++;
1885 + }
1886 +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
1887 +index c051987aab830..cd8895838a04c 100644
1888 +--- a/drivers/net/ethernet/korina.c
1889 ++++ b/drivers/net/ethernet/korina.c
1890 +@@ -1188,7 +1188,7 @@ out:
1891 + return rc;
1892 +
1893 + probe_err_register:
1894 +- kfree(lp->td_ring);
1895 ++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
1896 + probe_err_td_ring:
1897 + iounmap(lp->tx_dma_regs);
1898 + probe_err_dma_tx:
1899 +@@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev)
1900 + iounmap(lp->eth_regs);
1901 + iounmap(lp->rx_dma_regs);
1902 + iounmap(lp->tx_dma_regs);
1903 ++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
1904 +
1905 + unregister_netdev(bif->dev);
1906 + free_netdev(bif->dev);
1907 +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
1908 +index 7a4393ffe98e2..3521e3a77556d 100644
1909 +--- a/drivers/net/ethernet/realtek/r8169.c
1910 ++++ b/drivers/net/ethernet/realtek/r8169.c
1911 +@@ -4476,6 +4476,58 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
1912 + rtl_unlock_work(tp);
1913 + }
1914 +
1915 ++static void rtl_init_rxcfg(struct rtl8169_private *tp)
1916 ++{
1917 ++ void __iomem *ioaddr = tp->mmio_addr;
1918 ++
1919 ++ switch (tp->mac_version) {
1920 ++ case RTL_GIGA_MAC_VER_01:
1921 ++ case RTL_GIGA_MAC_VER_02:
1922 ++ case RTL_GIGA_MAC_VER_03:
1923 ++ case RTL_GIGA_MAC_VER_04:
1924 ++ case RTL_GIGA_MAC_VER_05:
1925 ++ case RTL_GIGA_MAC_VER_06:
1926 ++ case RTL_GIGA_MAC_VER_10:
1927 ++ case RTL_GIGA_MAC_VER_11:
1928 ++ case RTL_GIGA_MAC_VER_12:
1929 ++ case RTL_GIGA_MAC_VER_13:
1930 ++ case RTL_GIGA_MAC_VER_14:
1931 ++ case RTL_GIGA_MAC_VER_15:
1932 ++ case RTL_GIGA_MAC_VER_16:
1933 ++ case RTL_GIGA_MAC_VER_17:
1934 ++ RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
1935 ++ break;
1936 ++ case RTL_GIGA_MAC_VER_18:
1937 ++ case RTL_GIGA_MAC_VER_19:
1938 ++ case RTL_GIGA_MAC_VER_20:
1939 ++ case RTL_GIGA_MAC_VER_21:
1940 ++ case RTL_GIGA_MAC_VER_22:
1941 ++ case RTL_GIGA_MAC_VER_23:
1942 ++ case RTL_GIGA_MAC_VER_24:
1943 ++ case RTL_GIGA_MAC_VER_34:
1944 ++ case RTL_GIGA_MAC_VER_35:
1945 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
1946 ++ break;
1947 ++ case RTL_GIGA_MAC_VER_40:
1948 ++ case RTL_GIGA_MAC_VER_41:
1949 ++ case RTL_GIGA_MAC_VER_42:
1950 ++ case RTL_GIGA_MAC_VER_43:
1951 ++ case RTL_GIGA_MAC_VER_44:
1952 ++ case RTL_GIGA_MAC_VER_45:
1953 ++ case RTL_GIGA_MAC_VER_46:
1954 ++ case RTL_GIGA_MAC_VER_47:
1955 ++ case RTL_GIGA_MAC_VER_48:
1956 ++ case RTL_GIGA_MAC_VER_49:
1957 ++ case RTL_GIGA_MAC_VER_50:
1958 ++ case RTL_GIGA_MAC_VER_51:
1959 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
1960 ++ break;
1961 ++ default:
1962 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
1963 ++ break;
1964 ++ }
1965 ++}
1966 ++
1967 + static int rtl_set_mac_address(struct net_device *dev, void *p)
1968 + {
1969 + struct rtl8169_private *tp = netdev_priv(dev);
1970 +@@ -4494,6 +4546,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
1971 +
1972 + pm_runtime_put_noidle(d);
1973 +
1974 ++ /* Reportedly at least Asus X453MA truncates packets otherwise */
1975 ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37)
1976 ++ rtl_init_rxcfg(tp);
1977 ++
1978 + return 0;
1979 + }
1980 +
1981 +@@ -4931,58 +4987,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp)
1982 + }
1983 + }
1984 +
1985 +-static void rtl_init_rxcfg(struct rtl8169_private *tp)
1986 +-{
1987 +- void __iomem *ioaddr = tp->mmio_addr;
1988 +-
1989 +- switch (tp->mac_version) {
1990 +- case RTL_GIGA_MAC_VER_01:
1991 +- case RTL_GIGA_MAC_VER_02:
1992 +- case RTL_GIGA_MAC_VER_03:
1993 +- case RTL_GIGA_MAC_VER_04:
1994 +- case RTL_GIGA_MAC_VER_05:
1995 +- case RTL_GIGA_MAC_VER_06:
1996 +- case RTL_GIGA_MAC_VER_10:
1997 +- case RTL_GIGA_MAC_VER_11:
1998 +- case RTL_GIGA_MAC_VER_12:
1999 +- case RTL_GIGA_MAC_VER_13:
2000 +- case RTL_GIGA_MAC_VER_14:
2001 +- case RTL_GIGA_MAC_VER_15:
2002 +- case RTL_GIGA_MAC_VER_16:
2003 +- case RTL_GIGA_MAC_VER_17:
2004 +- RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
2005 +- break;
2006 +- case RTL_GIGA_MAC_VER_18:
2007 +- case RTL_GIGA_MAC_VER_19:
2008 +- case RTL_GIGA_MAC_VER_20:
2009 +- case RTL_GIGA_MAC_VER_21:
2010 +- case RTL_GIGA_MAC_VER_22:
2011 +- case RTL_GIGA_MAC_VER_23:
2012 +- case RTL_GIGA_MAC_VER_24:
2013 +- case RTL_GIGA_MAC_VER_34:
2014 +- case RTL_GIGA_MAC_VER_35:
2015 +- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
2016 +- break;
2017 +- case RTL_GIGA_MAC_VER_40:
2018 +- case RTL_GIGA_MAC_VER_41:
2019 +- case RTL_GIGA_MAC_VER_42:
2020 +- case RTL_GIGA_MAC_VER_43:
2021 +- case RTL_GIGA_MAC_VER_44:
2022 +- case RTL_GIGA_MAC_VER_45:
2023 +- case RTL_GIGA_MAC_VER_46:
2024 +- case RTL_GIGA_MAC_VER_47:
2025 +- case RTL_GIGA_MAC_VER_48:
2026 +- case RTL_GIGA_MAC_VER_49:
2027 +- case RTL_GIGA_MAC_VER_50:
2028 +- case RTL_GIGA_MAC_VER_51:
2029 +- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
2030 +- break;
2031 +- default:
2032 +- RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
2033 +- break;
2034 +- }
2035 +-}
2036 +-
2037 + static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
2038 + {
2039 + tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;
2040 +diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
2041 +index 9bd4aa8083ce7..6061bff85523f 100644
2042 +--- a/drivers/net/wan/hdlc.c
2043 ++++ b/drivers/net/wan/hdlc.c
2044 +@@ -57,7 +57,15 @@ int hdlc_change_mtu(struct net_device *dev, int new_mtu)
2045 + static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
2046 + struct packet_type *p, struct net_device *orig_dev)
2047 + {
2048 +- struct hdlc_device *hdlc = dev_to_hdlc(dev);
2049 ++ struct hdlc_device *hdlc;
2050 ++
2051 ++ /* First make sure "dev" is an HDLC device */
2052 ++ if (!(dev->priv_flags & IFF_WAN_HDLC)) {
2053 ++ kfree_skb(skb);
2054 ++ return NET_RX_SUCCESS;
2055 ++ }
2056 ++
2057 ++ hdlc = dev_to_hdlc(dev);
2058 +
2059 + if (!net_eq(dev_net(dev), &init_net)) {
2060 + kfree_skb(skb);
2061 +diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
2062 +index 2f11836078ab5..1be781f8ffc1b 100644
2063 +--- a/drivers/net/wan/hdlc_raw_eth.c
2064 ++++ b/drivers/net/wan/hdlc_raw_eth.c
2065 +@@ -101,6 +101,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
2066 + old_qlen = dev->tx_queue_len;
2067 + ether_setup(dev);
2068 + dev->tx_queue_len = old_qlen;
2069 ++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
2070 + eth_hw_addr_random(dev);
2071 + call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
2072 + netif_dormant_off(dev);
2073 +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
2074 +index a3c2180475971..fce2064ebc469 100644
2075 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
2076 ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
2077 +@@ -100,6 +100,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
2078 + BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
2079 +
2080 + idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
2081 ++
2082 ++ if (idx < 0 || idx >= htt->rx_ring.size) {
2083 ++ ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n");
2084 ++ idx &= htt->rx_ring.size_mask;
2085 ++ ret = -ENOMEM;
2086 ++ goto fail;
2087 ++ }
2088 ++
2089 + while (num > 0) {
2090 + skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
2091 + if (!skb) {
2092 +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
2093 +index 2294ba311c47a..8b3fe88d1c4e7 100644
2094 +--- a/drivers/net/wireless/ath/ath10k/mac.c
2095 ++++ b/drivers/net/wireless/ath/ath10k/mac.c
2096 +@@ -6579,7 +6579,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
2097 + struct ieee80211_channel *channel)
2098 + {
2099 + int ret;
2100 +- enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
2101 ++ enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ;
2102 +
2103 + lockdep_assert_held(&ar->conf_mutex);
2104 +
2105 +diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
2106 +index 1af3fed5a72ca..1a68518279689 100644
2107 +--- a/drivers/net/wireless/ath/ath6kl/main.c
2108 ++++ b/drivers/net/wireless/ath/ath6kl/main.c
2109 +@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
2110 +
2111 + ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);
2112 +
2113 ++ if (aid < 1 || aid > AP_MAX_NUM_STA)
2114 ++ return;
2115 ++
2116 + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
2117 + struct ieee80211_mgmt *mgmt =
2118 + (struct ieee80211_mgmt *) assoc_info;
2119 +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
2120 +index 55609fc4e50e6..73eab12cb3bda 100644
2121 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c
2122 ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
2123 +@@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
2124 + return -EINVAL;
2125 + }
2126 +
2127 ++ if (tsid >= 16) {
2128 ++ ath6kl_err("invalid tsid: %d\n", tsid);
2129 ++ return -EINVAL;
2130 ++ }
2131 ++
2132 + skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
2133 + if (!skb)
2134 + return -ENOMEM;
2135 +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
2136 +index fb5b7ce3d2c3d..7c409cd43b709 100644
2137 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
2138 ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
2139 +@@ -447,10 +447,19 @@ static void hif_usb_stop(void *hif_handle)
2140 + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2141 +
2142 + /* The pending URBs have to be canceled. */
2143 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2144 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2145 + &hif_dev->tx.tx_pending, list) {
2146 ++ usb_get_urb(tx_buf->urb);
2147 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2148 + usb_kill_urb(tx_buf->urb);
2149 ++ list_del(&tx_buf->list);
2150 ++ usb_free_urb(tx_buf->urb);
2151 ++ kfree(tx_buf->buf);
2152 ++ kfree(tx_buf);
2153 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2154 + }
2155 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2156 +
2157 + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
2158 + }
2159 +@@ -760,27 +769,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
2160 + struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
2161 + unsigned long flags;
2162 +
2163 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2164 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2165 + &hif_dev->tx.tx_buf, list) {
2166 ++ usb_get_urb(tx_buf->urb);
2167 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2168 + usb_kill_urb(tx_buf->urb);
2169 + list_del(&tx_buf->list);
2170 + usb_free_urb(tx_buf->urb);
2171 + kfree(tx_buf->buf);
2172 + kfree(tx_buf);
2173 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2174 + }
2175 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2176 +
2177 + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2178 + hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
2179 + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2180 +
2181 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2182 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2183 + &hif_dev->tx.tx_pending, list) {
2184 ++ usb_get_urb(tx_buf->urb);
2185 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2186 + usb_kill_urb(tx_buf->urb);
2187 + list_del(&tx_buf->list);
2188 + usb_free_urb(tx_buf->urb);
2189 + kfree(tx_buf->buf);
2190 + kfree(tx_buf);
2191 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2192 + }
2193 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2194 +
2195 + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
2196 + }
2197 +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
2198 +index 1af216aa5adae..625823e45d8f0 100644
2199 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
2200 ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
2201 +@@ -346,6 +346,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
2202 +
2203 + if (skb) {
2204 + htc_hdr = (struct htc_frame_hdr *) skb->data;
2205 ++ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
2206 ++ goto ret;
2207 + endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
2208 + skb_pull(skb, sizeof(struct htc_frame_hdr));
2209 +
2210 +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
2211 +index ca8797c653125..86beadf0f2493 100644
2212 +--- a/drivers/net/wireless/ath/wcn36xx/main.c
2213 ++++ b/drivers/net/wireless/ath/wcn36xx/main.c
2214 +@@ -158,7 +158,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = {
2215 + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
2216 + .mcs = {
2217 + .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
2218 +- .rx_highest = cpu_to_le16(72),
2219 ++ .rx_highest = cpu_to_le16(150),
2220 + .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
2221 + }
2222 + }
2223 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2224 +index ab9f136c15937..e306e5a89dd4f 100644
2225 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2226 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2227 +@@ -1540,6 +1540,8 @@ fail:
2228 + BRCMF_TX_IOCTL_MAX_MSG_SIZE,
2229 + msgbuf->ioctbuf,
2230 + msgbuf->ioctbuf_handle);
2231 ++ if (msgbuf->txflow_wq)
2232 ++ destroy_workqueue(msgbuf->txflow_wq);
2233 + kfree(msgbuf);
2234 + }
2235 + return -ENOMEM;
2236 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2237 +index 93d4cde0eb313..c9f48ec46f4a1 100644
2238 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2239 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2240 +@@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
2241 + pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft;
2242 + pi->pi_fptr.detach = wlc_phy_detach_lcnphy;
2243 +
2244 +- if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
2245 ++ if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) {
2246 ++ kfree(pi->u.pi_lcnphy);
2247 + return false;
2248 ++ }
2249 +
2250 + if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
2251 + if (pi_lcn->lcnphy_tempsense_option == 3) {
2252 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2253 +index d91ab2b8d6671..d46efa8d70732 100644
2254 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2255 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2256 +@@ -3046,9 +3046,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
2257 + aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
2258 +
2259 + IWL_DEBUG_TE(mvm,
2260 +- "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
2261 +- channel->hw_value, req_dur, duration, delay,
2262 +- dtim_interval);
2263 ++ "ROC: Requesting to remain on channel %u for %ums\n",
2264 ++ channel->hw_value, req_dur);
2265 ++ IWL_DEBUG_TE(mvm,
2266 ++ "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
2267 ++ duration, delay, dtim_interval);
2268 ++
2269 + /* Set the node address */
2270 + memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
2271 +
2272 +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
2273 +index 5fde2e2f1fea8..422a8d31ed7f9 100644
2274 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c
2275 ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
2276 +@@ -1879,7 +1879,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
2277 + chan, CFG80211_BSS_FTYPE_UNKNOWN,
2278 + bssid, timestamp,
2279 + cap_info_bitmap, beacon_period,
2280 +- ie_buf, ie_len, rssi, GFP_KERNEL);
2281 ++ ie_buf, ie_len, rssi, GFP_ATOMIC);
2282 + if (bss) {
2283 + bss_priv = (struct mwifiex_bss_priv *)bss->priv;
2284 + bss_priv->band = band;
2285 +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
2286 +index 486b8c75cd1f9..679cc0035514e 100644
2287 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
2288 ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
2289 +@@ -2049,6 +2049,8 @@ error:
2290 + kfree(card->mpa_rx.buf);
2291 + card->mpa_tx.buf_size = 0;
2292 + card->mpa_rx.buf_size = 0;
2293 ++ card->mpa_tx.buf = NULL;
2294 ++ card->mpa_rx.buf = NULL;
2295 + }
2296 +
2297 + return ret;
2298 +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2299 +index 18d5984b78dab..e73613b9f2f59 100644
2300 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2301 ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2302 +@@ -5422,7 +5422,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
2303 + ret = usb_submit_urb(urb, GFP_KERNEL);
2304 + if (ret) {
2305 + usb_unanchor_urb(urb);
2306 +- usb_free_urb(urb);
2307 + goto error;
2308 + }
2309 +
2310 +@@ -5431,6 +5430,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
2311 + rtl8xxxu_write32(priv, REG_USB_HIMR, val32);
2312 +
2313 + error:
2314 ++ usb_free_urb(urb);
2315 + return ret;
2316 + }
2317 +
2318 +@@ -5756,6 +5756,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
2319 + struct rtl8xxxu_priv *priv = hw->priv;
2320 + struct rtl8xxxu_rx_urb *rx_urb;
2321 + struct rtl8xxxu_tx_urb *tx_urb;
2322 ++ struct sk_buff *skb;
2323 + unsigned long flags;
2324 + int ret, i;
2325 +
2326 +@@ -5806,6 +5807,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
2327 + rx_urb->hw = hw;
2328 +
2329 + ret = rtl8xxxu_submit_rx_urb(priv, rx_urb);
2330 ++ if (ret) {
2331 ++ if (ret != -ENOMEM) {
2332 ++ skb = (struct sk_buff *)rx_urb->urb.context;
2333 ++ dev_kfree_skb(skb);
2334 ++ }
2335 ++ rtl8xxxu_queue_rx_urb(priv, rx_urb);
2336 ++ }
2337 + }
2338 + exit:
2339 + /*
2340 +diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
2341 +index 6ccba0d862df7..927b574e5d596 100644
2342 +--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
2343 ++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
2344 +@@ -994,6 +994,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev,
2345 +
2346 + err_dma_mask:
2347 + pci_clear_master(pdev);
2348 ++ pci_release_regions(pdev);
2349 + err_pci_regions:
2350 + pci_disable_device(pdev);
2351 + err_pci_enable:
2352 +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
2353 +index 63b87a8472762..4b58f352c0c93 100644
2354 +--- a/drivers/nvme/target/core.c
2355 ++++ b/drivers/nvme/target/core.c
2356 +@@ -591,7 +591,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
2357 + * in case a host died before it enabled the controller. Hence, simply
2358 + * reset the keep alive timer when the controller is enabled.
2359 + */
2360 +- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
2361 ++ if (ctrl->kato)
2362 ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
2363 + }
2364 +
2365 + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
2366 +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
2367 +index ebe8e8dc46770..c246d3a2fc5f6 100644
2368 +--- a/drivers/rapidio/devices/rio_mport_cdev.c
2369 ++++ b/drivers/rapidio/devices/rio_mport_cdev.c
2370 +@@ -901,15 +901,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
2371 + if (pinned < 0) {
2372 + rmcd_error("get_user_pages err=%ld", pinned);
2373 + nr_pages = 0;
2374 +- } else
2375 ++ } else {
2376 + rmcd_error("pinned %ld out of %ld pages",
2377 + pinned, nr_pages);
2378 ++ /*
2379 ++ * Set nr_pages up to mean "how many pages to unpin, in
2380 ++ * the error handler:
2381 ++ */
2382 ++ nr_pages = pinned;
2383 ++ }
2384 + ret = -EFAULT;
2385 +- /*
2386 +- * Set nr_pages up to mean "how many pages to unpin, in
2387 +- * the error handler:
2388 +- */
2389 +- nr_pages = pinned;
2390 + goto err_pg;
2391 + }
2392 +
2393 +@@ -1739,6 +1740,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
2394 + struct rio_dev *rdev;
2395 + struct rio_switch *rswitch = NULL;
2396 + struct rio_mport *mport;
2397 ++ struct device *dev;
2398 + size_t size;
2399 + u32 rval;
2400 + u32 swpinfo = 0;
2401 +@@ -1753,8 +1755,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
2402 + rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
2403 + dev_info.comptag, dev_info.destid, dev_info.hopcount);
2404 +
2405 +- if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) {
2406 ++ dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name);
2407 ++ if (dev) {
2408 + rmcd_debug(RDEV, "device %s already exists", dev_info.name);
2409 ++ put_device(dev);
2410 + return -EEXIST;
2411 + }
2412 +
2413 +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
2414 +index 9355b65920ab4..0f730e4bf6bcb 100644
2415 +--- a/drivers/regulator/core.c
2416 ++++ b/drivers/regulator/core.c
2417 +@@ -4029,15 +4029,20 @@ regulator_register(const struct regulator_desc *regulator_desc,
2418 + else if (regulator_desc->supply_name)
2419 + rdev->supply_name = regulator_desc->supply_name;
2420 +
2421 +- /*
2422 +- * Attempt to resolve the regulator supply, if specified,
2423 +- * but don't return an error if we fail because we will try
2424 +- * to resolve it again later as more regulators are added.
2425 +- */
2426 +- if (regulator_resolve_supply(rdev))
2427 +- rdev_dbg(rdev, "unable to resolve supply\n");
2428 +-
2429 + ret = set_machine_constraints(rdev, constraints);
2430 ++ if (ret == -EPROBE_DEFER) {
2431 ++ /* Regulator might be in bypass mode and so needs its supply
2432 ++ * to set the constraints */
2433 ++ /* FIXME: this currently triggers a chicken-and-egg problem
2434 ++ * when creating -SUPPLY symlink in sysfs to a regulator
2435 ++ * that is just being created */
2436 ++ ret = regulator_resolve_supply(rdev);
2437 ++ if (!ret)
2438 ++ ret = set_machine_constraints(rdev, constraints);
2439 ++ else
2440 ++ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
2441 ++ ERR_PTR(ret));
2442 ++ }
2443 + if (ret < 0)
2444 + goto wash;
2445 +
2446 +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
2447 +index 741cc96379cb7..04788e0b90236 100644
2448 +--- a/drivers/scsi/be2iscsi/be_main.c
2449 ++++ b/drivers/scsi/be2iscsi/be_main.c
2450 +@@ -3052,6 +3052,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
2451 + if (!eq_vaddress)
2452 + goto create_eq_error;
2453 +
2454 ++ mem->dma = paddr;
2455 + mem->va = eq_vaddress;
2456 + ret = be_fill_queue(eq, phba->params.num_eq_entries,
2457 + sizeof(struct be_eq_entry), eq_vaddress);
2458 +@@ -3061,7 +3062,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
2459 + goto create_eq_error;
2460 + }
2461 +
2462 +- mem->dma = paddr;
2463 + ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
2464 + phwi_context->cur_eqd);
2465 + if (ret) {
2466 +@@ -3116,6 +3116,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
2467 + if (!cq_vaddress)
2468 + goto create_cq_error;
2469 +
2470 ++ mem->dma = paddr;
2471 + ret = be_fill_queue(cq, phba->params.num_cq_entries,
2472 + sizeof(struct sol_cqe), cq_vaddress);
2473 + if (ret) {
2474 +@@ -3125,7 +3126,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
2475 + goto create_cq_error;
2476 + }
2477 +
2478 +- mem->dma = paddr;
2479 + ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
2480 + false, 0);
2481 + if (ret) {
2482 +diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
2483 +index dab195f04da78..06ca0495f3e8e 100644
2484 +--- a/drivers/scsi/csiostor/csio_hw.c
2485 ++++ b/drivers/scsi/csiostor/csio_hw.c
2486 +@@ -1973,7 +1973,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info,
2487 + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
2488 + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
2489 + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
2490 +- ret = EINVAL;
2491 ++ ret = -EINVAL;
2492 + goto bye;
2493 + }
2494 +
2495 +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
2496 +index 54dea767dfde9..04b3ac17531db 100644
2497 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c
2498 ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
2499 +@@ -4804,6 +4804,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
2500 + if (IS_ERR(vhost->work_thread)) {
2501 + dev_err(dev, "Couldn't create kernel thread: %ld\n",
2502 + PTR_ERR(vhost->work_thread));
2503 ++ rc = PTR_ERR(vhost->work_thread);
2504 + goto free_host_mem;
2505 + }
2506 +
2507 +diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
2508 +index 39285070f3b51..17ec51f9d9880 100644
2509 +--- a/drivers/scsi/mvumi.c
2510 ++++ b/drivers/scsi/mvumi.c
2511 +@@ -2476,6 +2476,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba)
2512 + if (IS_ERR(mhba->dm_thread)) {
2513 + dev_err(&mhba->pdev->dev,
2514 + "failed to create device scan thread\n");
2515 ++ ret = PTR_ERR(mhba->dm_thread);
2516 + mutex_unlock(&mhba->sas_discovery_mutex);
2517 + goto fail_create_thread;
2518 + }
2519 +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
2520 +index 3fda5836aac69..f10088a1d38c0 100644
2521 +--- a/drivers/scsi/qla4xxx/ql4_os.c
2522 ++++ b/drivers/scsi/qla4xxx/ql4_os.c
2523 +@@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len)
2524 + le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error);
2525 + exit_host_stats:
2526 + if (ql_iscsi_stats)
2527 +- dma_free_coherent(&ha->pdev->dev, host_stats_size,
2528 ++ dma_free_coherent(&ha->pdev->dev, stats_size,
2529 + ql_iscsi_stats, iscsi_stats_dma);
2530 +
2531 + ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n",
2532 +diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
2533 +index 3c4d7c2b4ade8..de05196738da5 100644
2534 +--- a/drivers/tty/hvc/hvcs.c
2535 ++++ b/drivers/tty/hvc/hvcs.c
2536 +@@ -1232,13 +1232,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
2537 +
2538 + tty_wait_until_sent(tty, HVCS_CLOSE_WAIT);
2539 +
2540 +- /*
2541 +- * This line is important because it tells hvcs_open that this
2542 +- * device needs to be re-configured the next time hvcs_open is
2543 +- * called.
2544 +- */
2545 +- tty->driver_data = NULL;
2546 +-
2547 + free_irq(irq, hvcsd);
2548 + return;
2549 + } else if (hvcsd->port.count < 0) {
2550 +@@ -1254,6 +1247,13 @@ static void hvcs_cleanup(struct tty_struct * tty)
2551 + {
2552 + struct hvcs_struct *hvcsd = tty->driver_data;
2553 +
2554 ++ /*
2555 ++ * This line is important because it tells hvcs_open that this
2556 ++ * device needs to be re-configured the next time hvcs_open is
2557 ++ * called.
2558 ++ */
2559 ++ tty->driver_data = NULL;
2560 ++
2561 + tty_port_put(&hvcsd->port);
2562 + }
2563 +
2564 +diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c
2565 +index c0dfb642383b2..dc7f4eb18e0a7 100644
2566 +--- a/drivers/tty/ipwireless/network.c
2567 ++++ b/drivers/tty/ipwireless/network.c
2568 +@@ -116,7 +116,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
2569 + skb->len,
2570 + notify_packet_sent,
2571 + network);
2572 +- if (ret == -1) {
2573 ++ if (ret < 0) {
2574 + skb_pull(skb, 2);
2575 + return 0;
2576 + }
2577 +@@ -133,7 +133,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
2578 + notify_packet_sent,
2579 + network);
2580 + kfree(buf);
2581 +- if (ret == -1)
2582 ++ if (ret < 0)
2583 + return 0;
2584 + }
2585 + kfree_skb(skb);
2586 +diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
2587 +index 2685d59d27245..4f9690442507f 100644
2588 +--- a/drivers/tty/ipwireless/tty.c
2589 ++++ b/drivers/tty/ipwireless/tty.c
2590 +@@ -217,7 +217,7 @@ static int ipw_write(struct tty_struct *linux_tty,
2591 + ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS,
2592 + buf, count,
2593 + ipw_write_packet_sent_callback, tty);
2594 +- if (ret == -1) {
2595 ++ if (ret < 0) {
2596 + mutex_unlock(&tty->ipw_tty_mutex);
2597 + return 0;
2598 + }
2599 +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
2600 +index 171130a9ecc87..8a063a036bc08 100644
2601 +--- a/drivers/tty/pty.c
2602 ++++ b/drivers/tty/pty.c
2603 +@@ -115,10 +115,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
2604 + spin_lock_irqsave(&to->port->lock, flags);
2605 + /* Stuff the data into the input queue of the other end */
2606 + c = tty_insert_flip_string(to->port, buf, c);
2607 ++ spin_unlock_irqrestore(&to->port->lock, flags);
2608 + /* And shovel */
2609 + if (c)
2610 + tty_flip_buffer_push(to->port);
2611 +- spin_unlock_irqrestore(&to->port->lock, flags);
2612 + }
2613 + return c;
2614 + }
2615 +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
2616 +index 25c1d7bc01004..7ea229cb1d864 100644
2617 +--- a/drivers/tty/serial/Kconfig
2618 ++++ b/drivers/tty/serial/Kconfig
2619 +@@ -9,6 +9,7 @@ menu "Serial drivers"
2620 +
2621 + config SERIAL_EARLYCON
2622 + bool
2623 ++ depends on SERIAL_CORE
2624 + help
2625 + Support for early consoles with the earlycon parameter. This enables
2626 + the console before standard serial driver is probed. The console is
2627 +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
2628 +index 2dc563b61b88a..726291c5562da 100644
2629 +--- a/drivers/usb/class/cdc-acm.c
2630 ++++ b/drivers/usb/class/cdc-acm.c
2631 +@@ -1178,9 +1178,21 @@ static int acm_probe(struct usb_interface *intf,
2632 + }
2633 + }
2634 + } else {
2635 ++ int class = -1;
2636 ++
2637 + data_intf_num = union_header->bSlaveInterface0;
2638 + control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
2639 + data_interface = usb_ifnum_to_if(usb_dev, data_intf_num);
2640 ++
2641 ++ if (control_interface)
2642 ++ class = control_interface->cur_altsetting->desc.bInterfaceClass;
2643 ++
2644 ++ if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) {
2645 ++ dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n");
2646 ++ combined_interfaces = 1;
2647 ++ control_interface = data_interface = intf;
2648 ++ goto look_for_collapsed_interface;
2649 ++ }
2650 + }
2651 +
2652 + if (!control_interface || !data_interface) {
2653 +@@ -1840,6 +1852,17 @@ static const struct usb_device_id acm_ids[] = {
2654 + .driver_info = IGNORE_DEVICE,
2655 + },
2656 +
2657 ++ /* Exclude ETAS ES58x */
2658 ++ { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */
2659 ++ .driver_info = IGNORE_DEVICE,
2660 ++ },
2661 ++ { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */
2662 ++ .driver_info = IGNORE_DEVICE,
2663 ++ },
2664 ++ { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */
2665 ++ .driver_info = IGNORE_DEVICE,
2666 ++ },
2667 ++
2668 + { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
2669 + .driver_info = SEND_ZERO_PACKET,
2670 + },
2671 +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
2672 +index 09337a973335c..f9d39c993f2f3 100644
2673 +--- a/drivers/usb/class/cdc-wdm.c
2674 ++++ b/drivers/usb/class/cdc-wdm.c
2675 +@@ -61,6 +61,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
2676 +
2677 + #define WDM_MAX 16
2678 +
2679 ++/* we cannot wait forever at flush() */
2680 ++#define WDM_FLUSH_TIMEOUT (30 * HZ)
2681 ++
2682 + /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
2683 + #define WDM_DEFAULT_BUFSIZE 256
2684 +
2685 +@@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb)
2686 + kfree(desc->outbuf);
2687 + desc->outbuf = NULL;
2688 + clear_bit(WDM_IN_USE, &desc->flags);
2689 +- wake_up(&desc->wait);
2690 ++ wake_up_all(&desc->wait);
2691 + }
2692 +
2693 + /* forward declaration */
2694 +@@ -402,6 +405,9 @@ static ssize_t wdm_write
2695 + if (test_bit(WDM_RESETTING, &desc->flags))
2696 + r = -EIO;
2697 +
2698 ++ if (test_bit(WDM_DISCONNECTING, &desc->flags))
2699 ++ r = -ENODEV;
2700 ++
2701 + if (r < 0) {
2702 + rv = r;
2703 + goto out_free_mem_pm;
2704 +@@ -433,6 +439,7 @@ static ssize_t wdm_write
2705 + if (rv < 0) {
2706 + desc->outbuf = NULL;
2707 + clear_bit(WDM_IN_USE, &desc->flags);
2708 ++ wake_up_all(&desc->wait); /* for wdm_wait_for_response() */
2709 + dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
2710 + rv = usb_translate_errors(rv);
2711 + goto out_free_mem_pm;
2712 +@@ -593,28 +600,58 @@ err:
2713 + return rv;
2714 + }
2715 +
2716 +-static int wdm_flush(struct file *file, fl_owner_t id)
2717 ++static int wdm_wait_for_response(struct file *file, long timeout)
2718 + {
2719 + struct wdm_device *desc = file->private_data;
2720 ++ long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */
2721 +
2722 +- wait_event(desc->wait,
2723 +- /*
2724 +- * needs both flags. We cannot do with one
2725 +- * because resetting it would cause a race
2726 +- * with write() yet we need to signal
2727 +- * a disconnect
2728 +- */
2729 +- !test_bit(WDM_IN_USE, &desc->flags) ||
2730 +- test_bit(WDM_DISCONNECTING, &desc->flags));
2731 +-
2732 +- /* cannot dereference desc->intf if WDM_DISCONNECTING */
2733 ++ /*
2734 ++ * Needs both flags. We cannot do with one because resetting it would
2735 ++ * cause a race with write() yet we need to signal a disconnect.
2736 ++ */
2737 ++ rv = wait_event_interruptible_timeout(desc->wait,
2738 ++ !test_bit(WDM_IN_USE, &desc->flags) ||
2739 ++ test_bit(WDM_DISCONNECTING, &desc->flags),
2740 ++ timeout);
2741 ++
2742 ++ /*
2743 ++ * To report the correct error. This is best effort.
2744 ++ * We are inevitably racing with the hardware.
2745 ++ */
2746 + if (test_bit(WDM_DISCONNECTING, &desc->flags))
2747 + return -ENODEV;
2748 +- if (desc->werr < 0)
2749 +- dev_err(&desc->intf->dev, "Error in flush path: %d\n",
2750 +- desc->werr);
2751 ++ if (!rv)
2752 ++ return -EIO;
2753 ++ if (rv < 0)
2754 ++ return -EINTR;
2755 +
2756 +- return usb_translate_errors(desc->werr);
2757 ++ spin_lock_irq(&desc->iuspin);
2758 ++ rv = desc->werr;
2759 ++ desc->werr = 0;
2760 ++ spin_unlock_irq(&desc->iuspin);
2761 ++
2762 ++ return usb_translate_errors(rv);
2763 ++
2764 ++}
2765 ++
2766 ++/*
2767 ++ * You need to send a signal when you react to malicious or defective hardware.
2768 ++ * Also, don't abort when fsync() returned -EINVAL, for older kernels which do
2769 ++ * not implement wdm_flush() will return -EINVAL.
2770 ++ */
2771 ++static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
2772 ++{
2773 ++ return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT);
2774 ++}
2775 ++
2776 ++/*
2777 ++ * Same with wdm_fsync(), except it uses finite timeout in order to react to
2778 ++ * malicious or defective hardware which ceased communication after close() was
2779 ++ * implicitly called due to process termination.
2780 ++ */
2781 ++static int wdm_flush(struct file *file, fl_owner_t id)
2782 ++{
2783 ++ return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT);
2784 + }
2785 +
2786 + static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
2787 +@@ -739,6 +776,7 @@ static const struct file_operations wdm_fops = {
2788 + .owner = THIS_MODULE,
2789 + .read = wdm_read,
2790 + .write = wdm_write,
2791 ++ .fsync = wdm_fsync,
2792 + .open = wdm_open,
2793 + .flush = wdm_flush,
2794 + .release = wdm_release,
2795 +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
2796 +index 56dcc0820898c..6785ebc078047 100644
2797 +--- a/drivers/usb/core/urb.c
2798 ++++ b/drivers/usb/core/urb.c
2799 +@@ -765,11 +765,12 @@ void usb_block_urb(struct urb *urb)
2800 + EXPORT_SYMBOL_GPL(usb_block_urb);
2801 +
2802 + /**
2803 +- * usb_kill_anchored_urbs - cancel transfer requests en masse
2804 ++ * usb_kill_anchored_urbs - kill all URBs associated with an anchor
2805 + * @anchor: anchor the requests are bound to
2806 + *
2807 +- * this allows all outstanding URBs to be killed starting
2808 +- * from the back of the queue
2809 ++ * This kills all outstanding URBs starting from the back of the queue,
2810 ++ * with guarantee that no completer callbacks will take place from the
2811 ++ * anchor after this function returns.
2812 + *
2813 + * This routine should not be called by a driver after its disconnect
2814 + * method has returned.
2815 +@@ -777,20 +778,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb);
2816 + void usb_kill_anchored_urbs(struct usb_anchor *anchor)
2817 + {
2818 + struct urb *victim;
2819 ++ int surely_empty;
2820 +
2821 +- spin_lock_irq(&anchor->lock);
2822 +- while (!list_empty(&anchor->urb_list)) {
2823 +- victim = list_entry(anchor->urb_list.prev, struct urb,
2824 +- anchor_list);
2825 +- /* we must make sure the URB isn't freed before we kill it*/
2826 +- usb_get_urb(victim);
2827 +- spin_unlock_irq(&anchor->lock);
2828 +- /* this will unanchor the URB */
2829 +- usb_kill_urb(victim);
2830 +- usb_put_urb(victim);
2831 ++ do {
2832 + spin_lock_irq(&anchor->lock);
2833 +- }
2834 +- spin_unlock_irq(&anchor->lock);
2835 ++ while (!list_empty(&anchor->urb_list)) {
2836 ++ victim = list_entry(anchor->urb_list.prev,
2837 ++ struct urb, anchor_list);
2838 ++ /* make sure the URB isn't freed before we kill it */
2839 ++ usb_get_urb(victim);
2840 ++ spin_unlock_irq(&anchor->lock);
2841 ++ /* this will unanchor the URB */
2842 ++ usb_kill_urb(victim);
2843 ++ usb_put_urb(victim);
2844 ++ spin_lock_irq(&anchor->lock);
2845 ++ }
2846 ++ surely_empty = usb_anchor_check_wakeup(anchor);
2847 ++
2848 ++ spin_unlock_irq(&anchor->lock);
2849 ++ cpu_relax();
2850 ++ } while (!surely_empty);
2851 + }
2852 + EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
2853 +
2854 +@@ -809,21 +816,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
2855 + void usb_poison_anchored_urbs(struct usb_anchor *anchor)
2856 + {
2857 + struct urb *victim;
2858 ++ int surely_empty;
2859 +
2860 +- spin_lock_irq(&anchor->lock);
2861 +- anchor->poisoned = 1;
2862 +- while (!list_empty(&anchor->urb_list)) {
2863 +- victim = list_entry(anchor->urb_list.prev, struct urb,
2864 +- anchor_list);
2865 +- /* we must make sure the URB isn't freed before we kill it*/
2866 +- usb_get_urb(victim);
2867 +- spin_unlock_irq(&anchor->lock);
2868 +- /* this will unanchor the URB */
2869 +- usb_poison_urb(victim);
2870 +- usb_put_urb(victim);
2871 ++ do {
2872 + spin_lock_irq(&anchor->lock);
2873 +- }
2874 +- spin_unlock_irq(&anchor->lock);
2875 ++ anchor->poisoned = 1;
2876 ++ while (!list_empty(&anchor->urb_list)) {
2877 ++ victim = list_entry(anchor->urb_list.prev,
2878 ++ struct urb, anchor_list);
2879 ++ /* make sure the URB isn't freed before we kill it */
2880 ++ usb_get_urb(victim);
2881 ++ spin_unlock_irq(&anchor->lock);
2882 ++ /* this will unanchor the URB */
2883 ++ usb_poison_urb(victim);
2884 ++ usb_put_urb(victim);
2885 ++ spin_lock_irq(&anchor->lock);
2886 ++ }
2887 ++ surely_empty = usb_anchor_check_wakeup(anchor);
2888 ++
2889 ++ spin_unlock_irq(&anchor->lock);
2890 ++ cpu_relax();
2891 ++ } while (!surely_empty);
2892 + }
2893 + EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs);
2894 +
2895 +@@ -963,14 +976,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
2896 + {
2897 + struct urb *victim;
2898 + unsigned long flags;
2899 ++ int surely_empty;
2900 ++
2901 ++ do {
2902 ++ spin_lock_irqsave(&anchor->lock, flags);
2903 ++ while (!list_empty(&anchor->urb_list)) {
2904 ++ victim = list_entry(anchor->urb_list.prev,
2905 ++ struct urb, anchor_list);
2906 ++ __usb_unanchor_urb(victim, anchor);
2907 ++ }
2908 ++ surely_empty = usb_anchor_check_wakeup(anchor);
2909 +
2910 +- spin_lock_irqsave(&anchor->lock, flags);
2911 +- while (!list_empty(&anchor->urb_list)) {
2912 +- victim = list_entry(anchor->urb_list.prev, struct urb,
2913 +- anchor_list);
2914 +- __usb_unanchor_urb(victim, anchor);
2915 +- }
2916 +- spin_unlock_irqrestore(&anchor->lock, flags);
2917 ++ spin_unlock_irqrestore(&anchor->lock, flags);
2918 ++ cpu_relax();
2919 ++ } while (!surely_empty);
2920 + }
2921 +
2922 + EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs);
2923 +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
2924 +index 0061bf130598e..4395ea07c1bb4 100644
2925 +--- a/drivers/usb/gadget/function/f_ncm.c
2926 ++++ b/drivers/usb/gadget/function/f_ncm.c
2927 +@@ -91,8 +91,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f)
2928 + /* peak (theoretical) bulk transfer rate in bits-per-second */
2929 + static inline unsigned ncm_bitrate(struct usb_gadget *g)
2930 + {
2931 +- if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
2932 +- return 13 * 1024 * 8 * 1000 * 8;
2933 ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
2934 ++ return 4250000000U;
2935 ++ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
2936 ++ return 3750000000U;
2937 + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
2938 + return 13 * 512 * 8 * 1000 * 8;
2939 + else
2940 +@@ -1546,7 +1548,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
2941 + fs_ncm_notify_desc.bEndpointAddress;
2942 +
2943 + status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
2944 +- ncm_ss_function, NULL);
2945 ++ ncm_ss_function, ncm_ss_function);
2946 + if (status)
2947 + goto fail;
2948 +
2949 +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
2950 +index 0de36cda6e410..d89b3046dd10b 100644
2951 +--- a/drivers/usb/gadget/function/f_printer.c
2952 ++++ b/drivers/usb/gadget/function/f_printer.c
2953 +@@ -35,6 +35,7 @@
2954 + #include <linux/types.h>
2955 + #include <linux/ctype.h>
2956 + #include <linux/cdev.h>
2957 ++#include <linux/kref.h>
2958 +
2959 + #include <asm/byteorder.h>
2960 + #include <linux/io.h>
2961 +@@ -69,7 +70,7 @@ struct printer_dev {
2962 + struct usb_gadget *gadget;
2963 + s8 interface;
2964 + struct usb_ep *in_ep, *out_ep;
2965 +-
2966 ++ struct kref kref;
2967 + struct list_head rx_reqs; /* List of free RX structs */
2968 + struct list_head rx_reqs_active; /* List of Active RX xfers */
2969 + struct list_head rx_buffers; /* List of completed xfers */
2970 +@@ -223,6 +224,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
2971 +
2972 + /*-------------------------------------------------------------------------*/
2973 +
2974 ++static void printer_dev_free(struct kref *kref)
2975 ++{
2976 ++ struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
2977 ++
2978 ++ kfree(dev);
2979 ++}
2980 ++
2981 + static struct usb_request *
2982 + printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
2983 + {
2984 +@@ -353,6 +361,7 @@ printer_open(struct inode *inode, struct file *fd)
2985 +
2986 + spin_unlock_irqrestore(&dev->lock, flags);
2987 +
2988 ++ kref_get(&dev->kref);
2989 + DBG(dev, "printer_open returned %x\n", ret);
2990 + return ret;
2991 + }
2992 +@@ -370,6 +379,7 @@ printer_close(struct inode *inode, struct file *fd)
2993 + dev->printer_status &= ~PRINTER_SELECTED;
2994 + spin_unlock_irqrestore(&dev->lock, flags);
2995 +
2996 ++ kref_put(&dev->kref, printer_dev_free);
2997 + DBG(dev, "printer_close\n");
2998 +
2999 + return 0;
3000 +@@ -1320,7 +1330,8 @@ static void gprinter_free(struct usb_function *f)
3001 + struct f_printer_opts *opts;
3002 +
3003 + opts = container_of(f->fi, struct f_printer_opts, func_inst);
3004 +- kfree(dev);
3005 ++
3006 ++ kref_put(&dev->kref, printer_dev_free);
3007 + mutex_lock(&opts->lock);
3008 + --opts->refcnt;
3009 + mutex_unlock(&opts->lock);
3010 +@@ -1389,6 +1400,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
3011 + return ERR_PTR(-ENOMEM);
3012 + }
3013 +
3014 ++ kref_init(&dev->kref);
3015 + ++opts->refcnt;
3016 + dev->minor = opts->minor;
3017 + dev->pnp_string = opts->pnp_string;
3018 +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
3019 +index d5fbc2352029b..589d1f5fb575a 100644
3020 +--- a/drivers/usb/gadget/function/u_ether.c
3021 ++++ b/drivers/usb/gadget/function/u_ether.c
3022 +@@ -97,7 +97,7 @@ struct eth_dev {
3023 + static inline int qlen(struct usb_gadget *gadget, unsigned qmult)
3024 + {
3025 + if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH ||
3026 +- gadget->speed == USB_SPEED_SUPER))
3027 ++ gadget->speed >= USB_SPEED_SUPER))
3028 + return qmult * DEFAULT_QLEN;
3029 + else
3030 + return DEFAULT_QLEN;
3031 +diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
3032 +index 17f1cf02ce342..2a14c71739d7d 100644
3033 +--- a/drivers/usb/host/ohci-hcd.c
3034 ++++ b/drivers/usb/host/ohci-hcd.c
3035 +@@ -665,20 +665,24 @@ retry:
3036 +
3037 + /* handle root hub init quirks ... */
3038 + val = roothub_a (ohci);
3039 +- val &= ~(RH_A_PSM | RH_A_OCPM);
3040 ++ /* Configure for per-port over-current protection by default */
3041 ++ val &= ~RH_A_NOCP;
3042 ++ val |= RH_A_OCPM;
3043 + if (ohci->flags & OHCI_QUIRK_SUPERIO) {
3044 +- /* NSC 87560 and maybe others */
3045 ++ /* NSC 87560 and maybe others.
3046 ++ * Ganged power switching, no over-current protection.
3047 ++ */
3048 + val |= RH_A_NOCP;
3049 +- val &= ~(RH_A_POTPGT | RH_A_NPS);
3050 +- ohci_writel (ohci, val, &ohci->regs->roothub.a);
3051 ++ val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM);
3052 + } else if ((ohci->flags & OHCI_QUIRK_AMD756) ||
3053 + (ohci->flags & OHCI_QUIRK_HUB_POWER)) {
3054 + /* hub power always on; required for AMD-756 and some
3055 +- * Mac platforms. ganged overcurrent reporting, if any.
3056 ++ * Mac platforms.
3057 + */
3058 + val |= RH_A_NPS;
3059 +- ohci_writel (ohci, val, &ohci->regs->roothub.a);
3060 + }
3061 ++ ohci_writel(ohci, val, &ohci->regs->roothub.a);
3062 ++
3063 + ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status);
3064 + ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM,
3065 + &ohci->regs->roothub.b);
3066 +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
3067 +index bdfdd506bc588..c989f777bf771 100644
3068 +--- a/drivers/vfio/pci/vfio_pci_intrs.c
3069 ++++ b/drivers/vfio/pci/vfio_pci_intrs.c
3070 +@@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
3071 + vdev->ctx[vector].producer.token = trigger;
3072 + vdev->ctx[vector].producer.irq = irq;
3073 + ret = irq_bypass_register_producer(&vdev->ctx[vector].producer);
3074 +- if (unlikely(ret))
3075 ++ if (unlikely(ret)) {
3076 + dev_info(&pdev->dev,
3077 + "irq bypass producer (token %p) registration fails: %d\n",
3078 + vdev->ctx[vector].producer.token, ret);
3079 +
3080 ++ vdev->ctx[vector].producer.token = NULL;
3081 ++ }
3082 + vdev->ctx[vector].trigger = trigger;
3083 +
3084 + return 0;
3085 +diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c
3086 +index d414c7a3acf5a..a2f77625b7170 100644
3087 +--- a/drivers/video/backlight/sky81452-backlight.c
3088 ++++ b/drivers/video/backlight/sky81452-backlight.c
3089 +@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt(
3090 + num_entry);
3091 + if (ret < 0) {
3092 + dev_err(dev, "led-sources node is invalid.\n");
3093 ++ of_node_put(np);
3094 + return ERR_PTR(-EINVAL);
3095 + }
3096 +
3097 +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
3098 +index dfe3eb769638b..fde27feae5d0c 100644
3099 +--- a/drivers/video/fbdev/sis/init.c
3100 ++++ b/drivers/video/fbdev/sis/init.c
3101 +@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
3102 +
3103 + i = 0;
3104 +
3105 ++ if (SiS_Pr->ChipType == SIS_730)
3106 ++ queuedata = &FQBQData730[0];
3107 ++ else
3108 ++ queuedata = &FQBQData[0];
3109 ++
3110 + if(ModeNo > 0x13) {
3111 +
3112 + /* Get VCLK */
3113 +@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
3114 + /* Get half colordepth */
3115 + colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
3116 +
3117 +- if(SiS_Pr->ChipType == SIS_730) {
3118 +- queuedata = &FQBQData730[0];
3119 +- } else {
3120 +- queuedata = &FQBQData[0];
3121 +- }
3122 +-
3123 + do {
3124 + templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
3125 +
3126 +diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
3127 +index ee6957a799bb6..aea8fd85cbf70 100644
3128 +--- a/drivers/video/fbdev/vga16fb.c
3129 ++++ b/drivers/video/fbdev/vga16fb.c
3130 +@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info)
3131 + }
3132 +
3133 + static void vga16fb_clock_chip(struct vga16fb_par *par,
3134 +- unsigned int pixclock,
3135 ++ unsigned int *pixclock,
3136 + const struct fb_info *info,
3137 + int mul, int div)
3138 + {
3139 +@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
3140 + { 0 /* bad */, 0x00, 0x00}};
3141 + int err;
3142 +
3143 +- pixclock = (pixclock * mul) / div;
3144 ++ *pixclock = (*pixclock * mul) / div;
3145 + best = vgaclocks;
3146 +- err = pixclock - best->pixclock;
3147 ++ err = *pixclock - best->pixclock;
3148 + if (err < 0) err = -err;
3149 + for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) {
3150 + int tmp;
3151 +
3152 +- tmp = pixclock - ptr->pixclock;
3153 ++ tmp = *pixclock - ptr->pixclock;
3154 + if (tmp < 0) tmp = -tmp;
3155 + if (tmp < err) {
3156 + err = tmp;
3157 +@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
3158 + }
3159 + par->misc |= best->misc;
3160 + par->clkdiv = best->seq_clock_mode;
3161 +- pixclock = (best->pixclock * div) / mul;
3162 ++ *pixclock = (best->pixclock * div) / mul;
3163 + }
3164 +
3165 + #define FAIL(X) return -EINVAL
3166 +@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var,
3167 +
3168 + if (mode & MODE_8BPP)
3169 + /* pixel clock == vga clock / 2 */
3170 +- vga16fb_clock_chip(par, var->pixclock, info, 1, 2);
3171 ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2);
3172 + else
3173 + /* pixel clock == vga clock */
3174 +- vga16fb_clock_chip(par, var->pixclock, info, 1, 1);
3175 ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1);
3176 +
3177 + var->red.offset = var->green.offset = var->blue.offset =
3178 + var->transp.offset = 0;
3179 +diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
3180 +index 732e9abdcf969..29b9680035258 100644
3181 +--- a/drivers/virt/fsl_hypervisor.c
3182 ++++ b/drivers/virt/fsl_hypervisor.c
3183 +@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3184 +
3185 + unsigned int i;
3186 + long ret = 0;
3187 +- int num_pinned; /* return value from get_user_pages() */
3188 ++ int num_pinned = 0; /* return value from get_user_pages_fast() */
3189 + phys_addr_t remote_paddr; /* The next address in the remote buffer */
3190 + uint32_t count; /* The number of bytes left to copy */
3191 +
3192 +@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3193 + return -EINVAL;
3194 +
3195 + /*
3196 +- * The array of pages returned by get_user_pages() covers only
3197 ++ * The array of pages returned by get_user_pages_fast() covers only
3198 + * page-aligned memory. Since the user buffer is probably not
3199 + * page-aligned, we need to handle the discrepancy.
3200 + *
3201 +@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3202 +
3203 + /*
3204 + * 'pages' is an array of struct page pointers that's initialized by
3205 +- * get_user_pages().
3206 ++ * get_user_pages_fast().
3207 + */
3208 + pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL);
3209 + if (!pages) {
3210 +@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3211 + if (!sg_list_unaligned) {
3212 + pr_debug("fsl-hv: could not allocate S/G list\n");
3213 + ret = -ENOMEM;
3214 +- goto exit;
3215 ++ goto free_pages;
3216 + }
3217 + sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list));
3218 +
3219 +@@ -253,7 +253,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3220 + up_read(&current->mm->mmap_sem);
3221 +
3222 + if (num_pinned != num_pages) {
3223 +- /* get_user_pages() failed */
3224 + pr_debug("fsl-hv: could not lock source buffer\n");
3225 + ret = (num_pinned < 0) ? num_pinned : -EFAULT;
3226 + goto exit;
3227 +@@ -295,13 +294,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
3228 + virt_to_phys(sg_list), num_pages);
3229 +
3230 + exit:
3231 +- if (pages) {
3232 +- for (i = 0; i < num_pages; i++)
3233 +- if (pages[i])
3234 +- put_page(pages[i]);
3235 ++ if (pages && (num_pinned > 0)) {
3236 ++ for (i = 0; i < num_pinned; i++)
3237 ++ put_page(pages[i]);
3238 + }
3239 +
3240 + kfree(sg_list_unaligned);
3241 ++free_pages:
3242 + kfree(pages);
3243 +
3244 + if (!ret)
3245 +diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
3246 +index a3b56544c21b9..ae1f2817bd6a6 100644
3247 +--- a/fs/cifs/asn1.c
3248 ++++ b/fs/cifs/asn1.c
3249 +@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
3250 + return 0;
3251 + } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
3252 + || (tag != ASN1_EOC)) {
3253 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
3254 +- cls, con, tag, end, *end);
3255 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
3256 ++ cls, con, tag, end);
3257 + return 0;
3258 + }
3259 +
3260 +@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
3261 + return 0;
3262 + } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
3263 + || (tag != ASN1_SEQ)) {
3264 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
3265 +- cls, con, tag, end, *end);
3266 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n",
3267 ++ cls, con, tag, end);
3268 + return 0;
3269 + }
3270 +
3271 +@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
3272 + return 0;
3273 + } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
3274 + || (tag != ASN1_EOC)) {
3275 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
3276 +- cls, con, tag, end, *end);
3277 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
3278 ++ cls, con, tag, end);
3279 + return 0;
3280 + }
3281 +
3282 +@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
3283 + return 0;
3284 + } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
3285 + || (tag != ASN1_SEQ)) {
3286 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
3287 +- cls, con, tag, end, *end);
3288 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n",
3289 ++ cls, con, tag, sequence_end);
3290 + return 0;
3291 + }
3292 +
3293 +diff --git a/fs/dlm/config.c b/fs/dlm/config.c
3294 +index df955d2209ce9..6def89d2209d3 100644
3295 +--- a/fs/dlm/config.c
3296 ++++ b/fs/dlm/config.c
3297 +@@ -218,6 +218,7 @@ struct dlm_space {
3298 + struct list_head members;
3299 + struct mutex members_lock;
3300 + int members_count;
3301 ++ struct dlm_nodes *nds;
3302 + };
3303 +
3304 + struct dlm_comms {
3305 +@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
3306 + INIT_LIST_HEAD(&sp->members);
3307 + mutex_init(&sp->members_lock);
3308 + sp->members_count = 0;
3309 ++ sp->nds = nds;
3310 + return &sp->group;
3311 +
3312 + fail:
3313 +@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
3314 + static void release_space(struct config_item *i)
3315 + {
3316 + struct dlm_space *sp = config_item_to_space(i);
3317 ++ kfree(sp->nds);
3318 + kfree(sp);
3319 + }
3320 +
3321 +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
3322 +index 7c410f8794124..2aa073b82d30f 100644
3323 +--- a/fs/ntfs/inode.c
3324 ++++ b/fs/ntfs/inode.c
3325 +@@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi)
3326 + brelse(bh);
3327 + }
3328 +
3329 ++ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
3330 ++ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
3331 ++ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
3332 ++ goto err_out;
3333 ++ }
3334 ++
3335 + /* Apply the mst fixups. */
3336 + if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
3337 + /* FIXME: Try to use the $MFTMirr now. */
3338 +diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
3339 +index ca71bf881ad1e..4a39bb98f8ab5 100644
3340 +--- a/fs/quota/quota_v2.c
3341 ++++ b/fs/quota/quota_v2.c
3342 +@@ -266,6 +266,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot)
3343 + d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
3344 + d->dqb_btime = cpu_to_le64(m->dqb_btime);
3345 + d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id));
3346 ++ d->dqb_pad = 0;
3347 + if (qtree_entry_unused(info, dp))
3348 + d->dqb_itime = cpu_to_le64(1);
3349 + }
3350 +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
3351 +index 897154e993800..f28999f717761 100644
3352 +--- a/fs/reiserfs/inode.c
3353 ++++ b/fs/reiserfs/inode.c
3354 +@@ -2166,7 +2166,8 @@ out_end_trans:
3355 + out_inserted_sd:
3356 + clear_nlink(inode);
3357 + th->t_trans_id = 0; /* so the caller can't use this handle later */
3358 +- unlock_new_inode(inode); /* OK to do even if we hadn't locked it */
3359 ++ if (inode->i_state & I_NEW)
3360 ++ unlock_new_inode(inode);
3361 + iput(inode);
3362 + return err;
3363 + }
3364 +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
3365 +index 677608a89b08d..c533d8715a6ca 100644
3366 +--- a/fs/reiserfs/super.c
3367 ++++ b/fs/reiserfs/super.c
3368 +@@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s,
3369 + "turned on.");
3370 + return 0;
3371 + }
3372 ++ if (qf_names[qtype] !=
3373 ++ REISERFS_SB(s)->s_qf_names[qtype])
3374 ++ kfree(qf_names[qtype]);
3375 ++ qf_names[qtype] = NULL;
3376 + if (*arg) { /* Some filename specified? */
3377 + if (REISERFS_SB(s)->s_qf_names[qtype]
3378 + && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
3379 +@@ -1263,10 +1267,6 @@ static int reiserfs_parse_options(struct super_block *s,
3380 + else
3381 + *mount_options |= 1 << REISERFS_GRPQUOTA;
3382 + } else {
3383 +- if (qf_names[qtype] !=
3384 +- REISERFS_SB(s)->s_qf_names[qtype])
3385 +- kfree(qf_names[qtype]);
3386 +- qf_names[qtype] = NULL;
3387 + if (qtype == USRQUOTA)
3388 + *mount_options &= ~(1 << REISERFS_USRQUOTA);
3389 + else
3390 +diff --git a/fs/udf/inode.c b/fs/udf/inode.c
3391 +index 9e66d85021fcb..149baf5f3d195 100644
3392 +--- a/fs/udf/inode.c
3393 ++++ b/fs/udf/inode.c
3394 +@@ -140,21 +140,24 @@ void udf_evict_inode(struct inode *inode)
3395 + struct udf_inode_info *iinfo = UDF_I(inode);
3396 + int want_delete = 0;
3397 +
3398 +- if (!inode->i_nlink && !is_bad_inode(inode)) {
3399 +- want_delete = 1;
3400 +- udf_setsize(inode, 0);
3401 +- udf_update_inode(inode, IS_SYNC(inode));
3402 ++ if (!is_bad_inode(inode)) {
3403 ++ if (!inode->i_nlink) {
3404 ++ want_delete = 1;
3405 ++ udf_setsize(inode, 0);
3406 ++ udf_update_inode(inode, IS_SYNC(inode));
3407 ++ }
3408 ++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
3409 ++ inode->i_size != iinfo->i_lenExtents) {
3410 ++ udf_warn(inode->i_sb,
3411 ++ "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
3412 ++ inode->i_ino, inode->i_mode,
3413 ++ (unsigned long long)inode->i_size,
3414 ++ (unsigned long long)iinfo->i_lenExtents);
3415 ++ }
3416 + }
3417 + truncate_inode_pages_final(&inode->i_data);
3418 + invalidate_inode_buffers(inode);
3419 + clear_inode(inode);
3420 +- if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
3421 +- inode->i_size != iinfo->i_lenExtents) {
3422 +- udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
3423 +- inode->i_ino, inode->i_mode,
3424 +- (unsigned long long)inode->i_size,
3425 +- (unsigned long long)iinfo->i_lenExtents);
3426 +- }
3427 + kfree(iinfo->i_ext.i_data);
3428 + iinfo->i_ext.i_data = NULL;
3429 + udf_clear_extent_cache(inode);
3430 +diff --git a/fs/udf/super.c b/fs/udf/super.c
3431 +index 4abdba453885e..c8c037e8e57b5 100644
3432 +--- a/fs/udf/super.c
3433 ++++ b/fs/udf/super.c
3434 +@@ -1391,6 +1391,12 @@ static int udf_load_sparable_map(struct super_block *sb,
3435 + (int)spm->numSparingTables);
3436 + return -EIO;
3437 + }
3438 ++ if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
3439 ++ udf_err(sb, "error loading logical volume descriptor: "
3440 ++ "Too big sparing table size (%u)\n",
3441 ++ le32_to_cpu(spm->sizeSparingTable));
3442 ++ return -EIO;
3443 ++ }
3444 +
3445 + for (i = 0; i < spm->numSparingTables; i++) {
3446 + loc = le32_to_cpu(spm->locSparingTable[i]);
3447 +diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
3448 +index 0d93d3c10fcc4..d812f84252d5b 100644
3449 +--- a/fs/xfs/xfs_rtalloc.c
3450 ++++ b/fs/xfs/xfs_rtalloc.c
3451 +@@ -257,6 +257,9 @@ xfs_rtallocate_extent_block(
3452 + end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
3453 + i <= end;
3454 + i++) {
3455 ++ /* Make sure we don't scan off the end of the rt volume. */
3456 ++ maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
3457 ++
3458 + /*
3459 + * See if there's a free extent of maxlen starting at i.
3460 + * If it's not so then next will contain the first non-free.
3461 +@@ -448,6 +451,14 @@ xfs_rtallocate_extent_near(
3462 + */
3463 + if (bno >= mp->m_sb.sb_rextents)
3464 + bno = mp->m_sb.sb_rextents - 1;
3465 ++
3466 ++ /* Make sure we don't run off the end of the rt volume. */
3467 ++ maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
3468 ++ if (maxlen < minlen) {
3469 ++ *rtblock = NULLRTBLOCK;
3470 ++ return 0;
3471 ++ }
3472 ++
3473 + /*
3474 + * Try the exact allocation first.
3475 + */
3476 +diff --git a/include/linux/overflow.h b/include/linux/overflow.h
3477 +index 40b48e2133cb8..38a47cc62cf3a 100644
3478 +--- a/include/linux/overflow.h
3479 ++++ b/include/linux/overflow.h
3480 +@@ -3,6 +3,7 @@
3481 + #define __LINUX_OVERFLOW_H
3482 +
3483 + #include <linux/compiler.h>
3484 ++#include <linux/limits.h>
3485 +
3486 + /*
3487 + * In the fallback code below, we need to compute the minimum and
3488 +diff --git a/include/net/ip.h b/include/net/ip.h
3489 +index d577fb5647c5d..f987eaf999004 100644
3490 +--- a/include/net/ip.h
3491 ++++ b/include/net/ip.h
3492 +@@ -342,12 +342,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
3493 + bool forwarding)
3494 + {
3495 + struct net *net = dev_net(dst->dev);
3496 ++ unsigned int mtu;
3497 +
3498 + if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
3499 + ip_mtu_locked(dst) ||
3500 + !forwarding)
3501 + return dst_mtu(dst);
3502 +
3503 ++ /* 'forwarding = true' case should always honour route mtu */
3504 ++ mtu = dst_metric_raw(dst, RTAX_MTU);
3505 ++ if (mtu)
3506 ++ return mtu;
3507 ++
3508 + return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
3509 + }
3510 +
3511 +diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
3512 +index 20bf7eaef05a0..d699fdc78cbb9 100644
3513 +--- a/include/scsi/scsi_common.h
3514 ++++ b/include/scsi/scsi_common.h
3515 +@@ -24,6 +24,13 @@ scsi_command_size(const unsigned char *cmnd)
3516 + scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]);
3517 + }
3518 +
3519 ++static inline unsigned char
3520 ++scsi_command_control(const unsigned char *cmnd)
3521 ++{
3522 ++ return (cmnd[0] == VARIABLE_LENGTH_CMD) ?
3523 ++ cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1];
3524 ++}
3525 ++
3526 + /* Returns a human-readable name for the device */
3527 + extern const char *scsi_device_type(unsigned type);
3528 +
3529 +diff --git a/include/trace/events/target.h b/include/trace/events/target.h
3530 +index 50fea660c0f89..d543e8b87e50a 100644
3531 +--- a/include/trace/events/target.h
3532 ++++ b/include/trace/events/target.h
3533 +@@ -139,6 +139,7 @@ TRACE_EVENT(target_sequencer_start,
3534 + __field( unsigned int, opcode )
3535 + __field( unsigned int, data_length )
3536 + __field( unsigned int, task_attribute )
3537 ++ __field( unsigned char, control )
3538 + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
3539 + __string( initiator, cmd->se_sess->se_node_acl->initiatorname )
3540 + ),
3541 +@@ -148,6 +149,7 @@ TRACE_EVENT(target_sequencer_start,
3542 + __entry->opcode = cmd->t_task_cdb[0];
3543 + __entry->data_length = cmd->data_length;
3544 + __entry->task_attribute = cmd->sam_task_attr;
3545 ++ __entry->control = scsi_command_control(cmd->t_task_cdb);
3546 + memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
3547 + __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
3548 + ),
3549 +@@ -157,9 +159,7 @@ TRACE_EVENT(target_sequencer_start,
3550 + show_opcode_name(__entry->opcode),
3551 + __entry->data_length, __print_hex(__entry->cdb, 16),
3552 + show_task_attribute_name(__entry->task_attribute),
3553 +- scsi_command_size(__entry->cdb) <= 16 ?
3554 +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
3555 +- __entry->cdb[1]
3556 ++ __entry->control
3557 + )
3558 + );
3559 +
3560 +@@ -174,6 +174,7 @@ TRACE_EVENT(target_cmd_complete,
3561 + __field( unsigned int, opcode )
3562 + __field( unsigned int, data_length )
3563 + __field( unsigned int, task_attribute )
3564 ++ __field( unsigned char, control )
3565 + __field( unsigned char, scsi_status )
3566 + __field( unsigned char, sense_length )
3567 + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
3568 +@@ -186,6 +187,7 @@ TRACE_EVENT(target_cmd_complete,
3569 + __entry->opcode = cmd->t_task_cdb[0];
3570 + __entry->data_length = cmd->data_length;
3571 + __entry->task_attribute = cmd->sam_task_attr;
3572 ++ __entry->control = scsi_command_control(cmd->t_task_cdb);
3573 + __entry->scsi_status = cmd->scsi_status;
3574 + __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ?
3575 + min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0;
3576 +@@ -202,9 +204,7 @@ TRACE_EVENT(target_cmd_complete,
3577 + show_opcode_name(__entry->opcode),
3578 + __entry->data_length, __print_hex(__entry->cdb, 16),
3579 + show_task_attribute_name(__entry->task_attribute),
3580 +- scsi_command_size(__entry->cdb) <= 16 ?
3581 +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
3582 +- __entry->cdb[1]
3583 ++ __entry->control
3584 + )
3585 + );
3586 +
3587 +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
3588 +index cc892a9e109d8..ae39b014b7d6c 100644
3589 +--- a/kernel/debug/kdb/kdb_io.c
3590 ++++ b/kernel/debug/kdb/kdb_io.c
3591 +@@ -683,12 +683,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap)
3592 + size_avail = sizeof(kdb_buffer) - len;
3593 + goto kdb_print_out;
3594 + }
3595 +- if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH)
3596 ++ if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) {
3597 + /*
3598 + * This was a interactive search (using '/' at more
3599 +- * prompt) and it has completed. Clear the flag.
3600 ++ * prompt) and it has completed. Replace the \0 with
3601 ++ * its original value to ensure multi-line strings
3602 ++ * are handled properly, and return to normal mode.
3603 + */
3604 ++ *cphold = replaced_byte;
3605 + kdb_grepping_flag = 0;
3606 ++ }
3607 + /*
3608 + * at this point the string is a full line and
3609 + * should be printed, up to the null.
3610 +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
3611 +index 3c775d6b7317f..7b393faf930f8 100644
3612 +--- a/kernel/power/hibernate.c
3613 ++++ b/kernel/power/hibernate.c
3614 +@@ -834,17 +834,6 @@ static int software_resume(void)
3615 +
3616 + /* Check if the device is there */
3617 + swsusp_resume_device = name_to_dev_t(resume_file);
3618 +-
3619 +- /*
3620 +- * name_to_dev_t is ineffective to verify parition if resume_file is in
3621 +- * integer format. (e.g. major:minor)
3622 +- */
3623 +- if (isdigit(resume_file[0]) && resume_wait) {
3624 +- int partno;
3625 +- while (!get_gendisk(swsusp_resume_device, &partno))
3626 +- msleep(10);
3627 +- }
3628 +-
3629 + if (!swsusp_resume_device) {
3630 + /*
3631 + * Some device discovery might still be in progress; we need
3632 +diff --git a/lib/crc32.c b/lib/crc32.c
3633 +index 7fbd1a112b9d2..0d450462b0bd5 100644
3634 +--- a/lib/crc32.c
3635 ++++ b/lib/crc32.c
3636 +@@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p,
3637 + return crc;
3638 + }
3639 +
3640 +-#if CRC_LE_BITS == 1
3641 ++#if CRC_BE_BITS == 1
3642 + u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len)
3643 + {
3644 + return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE);
3645 +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
3646 +index ab6b1788dbfc3..f46f59129bf39 100644
3647 +--- a/net/bluetooth/l2cap_sock.c
3648 ++++ b/net/bluetooth/l2cap_sock.c
3649 +@@ -1340,8 +1340,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
3650 +
3651 + parent = bt_sk(sk)->parent;
3652 +
3653 +- sock_set_flag(sk, SOCK_ZAPPED);
3654 +-
3655 + switch (chan->state) {
3656 + case BT_OPEN:
3657 + case BT_BOUND:
3658 +@@ -1368,8 +1366,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
3659 +
3660 + break;
3661 + }
3662 +-
3663 + release_sock(sk);
3664 ++
3665 ++ /* Only zap after cleanup to avoid use after free race */
3666 ++ sock_set_flag(sk, SOCK_ZAPPED);
3667 ++
3668 + }
3669 +
3670 + static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
3671 +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
3672 +index cc5c8d598e5e8..9a21080e24560 100644
3673 +--- a/net/ipv4/icmp.c
3674 ++++ b/net/ipv4/icmp.c
3675 +@@ -246,7 +246,7 @@ static struct {
3676 + /**
3677 + * icmp_global_allow - Are we allowed to send one more ICMP message ?
3678 + *
3679 +- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
3680 ++ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
3681 + * Returns false if we reached the limit and can not send another packet.
3682 + * Note: called with BH disabled
3683 + */
3684 +@@ -274,7 +274,10 @@ bool icmp_global_allow(void)
3685 + }
3686 + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
3687 + if (credit) {
3688 +- credit--;
3689 ++ /* We want to use a credit of one in average, but need to randomize
3690 ++ * it for security reasons.
3691 ++ */
3692 ++ credit = max_t(int, credit - prandom_u32_max(3), 0);
3693 + rc = true;
3694 + }
3695 + WRITE_ONCE(icmp_global.credit, credit);
3696 +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
3697 +index 23246d8a3eaea..d05135ea3c289 100644
3698 +--- a/net/ipv4/tcp_input.c
3699 ++++ b/net/ipv4/tcp_input.c
3700 +@@ -5598,6 +5598,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
3701 + tcp_data_snd_check(sk);
3702 + if (!inet_csk_ack_scheduled(sk))
3703 + goto no_ack;
3704 ++ } else {
3705 ++ tcp_update_wl(tp, TCP_SKB_CB(skb)->seq);
3706 + }
3707 +
3708 + __tcp_ack_snd_check(sk, 0);
3709 +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
3710 +index 33125fc009cfd..ba9e711f7e3d6 100644
3711 +--- a/net/netfilter/ipvs/ip_vs_ctl.c
3712 ++++ b/net/netfilter/ipvs/ip_vs_ctl.c
3713 +@@ -2424,6 +2424,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
3714 + /* Set timeout values for (tcp tcpfin udp) */
3715 + ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
3716 + goto out_unlock;
3717 ++ } else if (!len) {
3718 ++ /* No more commands with len == 0 below */
3719 ++ ret = -EINVAL;
3720 ++ goto out_unlock;
3721 + }
3722 +
3723 + usvc_compat = (struct ip_vs_service_user *)arg;
3724 +@@ -2500,9 +2504,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
3725 + break;
3726 + case IP_VS_SO_SET_DELDEST:
3727 + ret = ip_vs_del_dest(svc, &udest);
3728 +- break;
3729 +- default:
3730 +- ret = -EINVAL;
3731 + }
3732 +
3733 + out_unlock:
3734 +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
3735 +index e79a49fe61e88..0afae9f73ebb4 100644
3736 +--- a/net/nfc/netlink.c
3737 ++++ b/net/nfc/netlink.c
3738 +@@ -1227,7 +1227,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
3739 + u32 idx;
3740 + char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
3741 +
3742 +- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
3743 ++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME])
3744 + return -EINVAL;
3745 +
3746 + idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
3747 +diff --git a/net/tipc/msg.c b/net/tipc/msg.c
3748 +index ea554756a786d..41290fe810220 100644
3749 +--- a/net/tipc/msg.c
3750 ++++ b/net/tipc/msg.c
3751 +@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
3752 + if (fragid == FIRST_FRAGMENT) {
3753 + if (unlikely(head))
3754 + goto err;
3755 +- frag = skb_unshare(frag, GFP_ATOMIC);
3756 ++ if (skb_cloned(frag))
3757 ++ frag = skb_copy(frag, GFP_ATOMIC);
3758 + if (unlikely(!frag))
3759 + goto err;
3760 + head = *headbuf = frag;
3761 +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
3762 +index 1eb77161d5e64..5bd89f536720d 100644
3763 +--- a/net/wireless/nl80211.c
3764 ++++ b/net/wireless/nl80211.c
3765 +@@ -1749,7 +1749,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
3766 + * case we'll continue with more data in the next round,
3767 + * but break unconditionally so unsplit data stops here.
3768 + */
3769 +- state->split_start++;
3770 ++ if (state->split)
3771 ++ state->split_start++;
3772 ++ else
3773 ++ state->split_start = 0;
3774 + break;
3775 + case 9:
3776 + if (rdev->wiphy.extended_capabilities &&
3777 +diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c
3778 +index 49db1def1721c..84e583ab8fd0c 100644
3779 +--- a/samples/mic/mpssd/mpssd.c
3780 ++++ b/samples/mic/mpssd/mpssd.c
3781 +@@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd,
3782 +
3783 + static inline unsigned _vring_size(unsigned int num, unsigned long align)
3784 + {
3785 +- return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
3786 ++ return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
3787 + + align - 1) & ~(align - 1))
3788 +- + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num;
3789 ++ + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4);
3790 + }
3791 +
3792 + /*
3793 +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
3794 +index 5155c343406e0..170f12031ae5f 100644
3795 +--- a/security/integrity/ima/ima_crypto.c
3796 ++++ b/security/integrity/ima/ima_crypto.c
3797 +@@ -683,6 +683,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
3798 + ima_pcrread(i, pcr_i);
3799 + /* now accumulate with current aggregate */
3800 + rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
3801 ++ if (rc != 0)
3802 ++ return rc;
3803 + }
3804 + if (!rc)
3805 + crypto_shash_final(shash, digest);
3806 +diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
3807 +index 4b78979599131..ade880fe24a41 100644
3808 +--- a/sound/core/seq/oss/seq_oss.c
3809 ++++ b/sound/core/seq/oss/seq_oss.c
3810 +@@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
3811 + if (snd_BUG_ON(!dp))
3812 + return -ENXIO;
3813 +
3814 +- mutex_lock(&register_mutex);
3815 ++ if (cmd != SNDCTL_SEQ_SYNC &&
3816 ++ mutex_lock_interruptible(&register_mutex))
3817 ++ return -ERESTARTSYS;
3818 + rc = snd_seq_oss_ioctl(dp, cmd, arg);
3819 +- mutex_unlock(&register_mutex);
3820 ++ if (cmd != SNDCTL_SEQ_SYNC)
3821 ++ mutex_unlock(&register_mutex);
3822 + return rc;
3823 + }
3824 +
3825 +diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c
3826 +index ce731f4d8b4f5..733ba42e24622 100644
3827 +--- a/sound/firewire/bebob/bebob_hwdep.c
3828 ++++ b/sound/firewire/bebob/bebob_hwdep.c
3829 +@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
3830 + }
3831 +
3832 + memset(&event, 0, sizeof(event));
3833 ++ count = min_t(long, count, sizeof(event.lock_status));
3834 + if (bebob->dev_lock_changed) {
3835 + event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
3836 + event.lock_status.status = (bebob->dev_lock_count > 0);
3837 + bebob->dev_lock_changed = false;
3838 +-
3839 +- count = min_t(long, count, sizeof(event.lock_status));
3840 + }
3841 +
3842 + spin_unlock_irq(&bebob->lock);
3843 +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
3844 +index 420d200f9a053..eeed53cf325ac 100644
3845 +--- a/sound/soc/qcom/lpass-platform.c
3846 ++++ b/sound/soc/qcom/lpass-platform.c
3847 +@@ -68,7 +68,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
3848 + int ret, dma_ch, dir = substream->stream;
3849 + struct lpass_pcm_data *data;
3850 +
3851 +- data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
3852 ++ data = kzalloc(sizeof(*data), GFP_KERNEL);
3853 + if (!data)
3854 + return -ENOMEM;
3855 +
3856 +@@ -140,6 +140,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream)
3857 + if (v->free_dma_channel)
3858 + v->free_dma_channel(drvdata, dma_ch);
3859 +
3860 ++ kfree(data);
3861 + return 0;
3862 + }
3863 +
3864 +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
3865 +index 24c6621e2d951..54790a09d1582 100644
3866 +--- a/tools/perf/util/intel-pt.c
3867 ++++ b/tools/perf/util/intel-pt.c
3868 +@@ -873,6 +873,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt,
3869 +
3870 + if (queue->tid == -1 || pt->have_sched_switch) {
3871 + ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu);
3872 ++ if (ptq->tid == -1)
3873 ++ ptq->pid = -1;
3874 + thread__zput(ptq->thread);
3875 + }
3876 +
3877 +@@ -1732,10 +1734,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event,
3878 + tid = sample->tid;
3879 + }
3880 +
3881 +- if (tid == -1) {
3882 +- pr_err("context_switch event has no tid\n");
3883 +- return -EINVAL;
3884 +- }
3885 ++ if (tid == -1)
3886 ++ intel_pt_log("context_switch event has no tid\n");
3887 +
3888 + intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n",
3889 + cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time,