Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.19 commit in: /
Date: Sat, 04 Jan 2020 19:50:57
Message-Id: 1578167436.5881359b6134a81ccf0e7b0fd4ad9387926c6f5f.mpagano@gentoo
1 commit: 5881359b6134a81ccf0e7b0fd4ad9387926c6f5f
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Sat Jan 4 19:50:36 2020 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Sat Jan 4 19:50:36 2020 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5881359b
7
8 Linux patch 4.19.93
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1092_linux-4.19.93.patch | 4103 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 4107 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index af10ce2..bedb928 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -407,6 +407,10 @@ Patch: 1091_linux-4.19.92.patch
21 From: https://www.kernel.org
22 Desc: Linux 4.19.92
23
24 +Patch: 1092_linux-4.19.93.patch
25 +From: https://www.kernel.org
26 +Desc: Linux 4.19.93
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1092_linux-4.19.93.patch b/1092_linux-4.19.93.patch
33 new file mode 100644
34 index 0000000..c512142
35 --- /dev/null
36 +++ b/1092_linux-4.19.93.patch
37 @@ -0,0 +1,4103 @@
38 +diff --git a/Makefile b/Makefile
39 +index 080232ef6716..b3b166c93125 100644
40 +--- a/Makefile
41 ++++ b/Makefile
42 +@@ -1,7 +1,7 @@
43 + # SPDX-License-Identifier: GPL-2.0
44 + VERSION = 4
45 + PATCHLEVEL = 19
46 +-SUBLEVEL = 92
47 ++SUBLEVEL = 93
48 + EXTRAVERSION =
49 + NAME = "People's Front"
50 +
51 +diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
52 +index b36c0289a308..6a0f1f524466 100644
53 +--- a/arch/arm/boot/compressed/libfdt_env.h
54 ++++ b/arch/arm/boot/compressed/libfdt_env.h
55 +@@ -2,11 +2,13 @@
56 + #ifndef _ARM_LIBFDT_ENV_H
57 + #define _ARM_LIBFDT_ENV_H
58 +
59 ++#include <linux/limits.h>
60 + #include <linux/types.h>
61 + #include <linux/string.h>
62 + #include <asm/byteorder.h>
63 +
64 +-#define INT_MAX ((int)(~0U>>1))
65 ++#define INT32_MAX S32_MAX
66 ++#define UINT32_MAX U32_MAX
67 +
68 + typedef __be16 fdt16_t;
69 + typedef __be32 fdt32_t;
70 +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
71 +index 9a07916af8dd..a6554fdb56c5 100644
72 +--- a/arch/arm/mm/proc-v7-bugs.c
73 ++++ b/arch/arm/mm/proc-v7-bugs.c
74 +@@ -65,6 +65,9 @@ static void cpu_v7_spectre_init(void)
75 + break;
76 +
77 + #ifdef CONFIG_ARM_PSCI
78 ++ case ARM_CPU_PART_BRAHMA_B53:
79 ++ /* Requires no workaround */
80 ++ break;
81 + default:
82 + /* Other ARM CPUs require no workaround */
83 + if (read_cpuid_implementor() == ARM_CPU_IMP_ARM)
84 +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
85 +index dfcb698ec8f3..e43321f46a3b 100644
86 +--- a/arch/powerpc/Makefile
87 ++++ b/arch/powerpc/Makefile
88 +@@ -90,11 +90,13 @@ MULTIPLEWORD := -mmultiple
89 + endif
90 +
91 + ifdef CONFIG_PPC64
92 ++ifndef CONFIG_CC_IS_CLANG
93 + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1)
94 + cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc)
95 + aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1)
96 + aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2
97 + endif
98 ++endif
99 +
100 + ifneq ($(cc-name),clang)
101 + cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align
102 +@@ -134,6 +136,7 @@ endif
103 + endif
104 +
105 + CFLAGS-$(CONFIG_PPC64) := $(call cc-option,-mtraceback=no)
106 ++ifndef CONFIG_CC_IS_CLANG
107 + ifdef CONFIG_CPU_LITTLE_ENDIAN
108 + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc))
109 + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2)
110 +@@ -142,6 +145,7 @@ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1)
111 + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc)
112 + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1)
113 + endif
114 ++endif
115 + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
116 + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions)
117 +
118 +diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
119 +index 2abc8e83b95e..9757d4f6331e 100644
120 +--- a/arch/powerpc/boot/libfdt_env.h
121 ++++ b/arch/powerpc/boot/libfdt_env.h
122 +@@ -6,6 +6,8 @@
123 + #include <string.h>
124 +
125 + #define INT_MAX ((int)(~0U>>1))
126 ++#define UINT32_MAX ((u32)~0U)
127 ++#define INT32_MAX ((s32)(UINT32_MAX >> 1))
128 +
129 + #include "of.h"
130 +
131 +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
132 +index bfaf175db54d..685c72310f5d 100644
133 +--- a/arch/powerpc/include/asm/spinlock.h
134 ++++ b/arch/powerpc/include/asm/spinlock.h
135 +@@ -53,12 +53,10 @@
136 + #endif
137 +
138 + #ifdef CONFIG_PPC_PSERIES
139 +-DECLARE_STATIC_KEY_FALSE(shared_processor);
140 +-
141 + #define vcpu_is_preempted vcpu_is_preempted
142 + static inline bool vcpu_is_preempted(int cpu)
143 + {
144 +- if (!static_branch_unlikely(&shared_processor))
145 ++ if (!firmware_has_feature(FW_FEATURE_SPLPAR))
146 + return false;
147 + return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1);
148 + }
149 +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
150 +index a5c5940d970a..6a3dde9587cc 100644
151 +--- a/arch/powerpc/kernel/security.c
152 ++++ b/arch/powerpc/kernel/security.c
153 +@@ -134,32 +134,33 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha
154 +
155 + thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV);
156 +
157 +- if (rfi_flush || thread_priv) {
158 ++ if (rfi_flush) {
159 + struct seq_buf s;
160 + seq_buf_init(&s, buf, PAGE_SIZE - 1);
161 +
162 +- seq_buf_printf(&s, "Mitigation: ");
163 +-
164 +- if (rfi_flush)
165 +- seq_buf_printf(&s, "RFI Flush");
166 +-
167 +- if (rfi_flush && thread_priv)
168 +- seq_buf_printf(&s, ", ");
169 +-
170 ++ seq_buf_printf(&s, "Mitigation: RFI Flush");
171 + if (thread_priv)
172 +- seq_buf_printf(&s, "L1D private per thread");
173 ++ seq_buf_printf(&s, ", L1D private per thread");
174 +
175 + seq_buf_printf(&s, "\n");
176 +
177 + return s.len;
178 + }
179 +
180 ++ if (thread_priv)
181 ++ return sprintf(buf, "Vulnerable: L1D private per thread\n");
182 ++
183 + if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) &&
184 + !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR))
185 + return sprintf(buf, "Not affected\n");
186 +
187 + return sprintf(buf, "Vulnerable\n");
188 + }
189 ++
190 ++ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf)
191 ++{
192 ++ return cpu_show_meltdown(dev, attr, buf);
193 ++}
194 + #endif
195 +
196 + ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
197 +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
198 +index 8487ad686462..5449e76cf2df 100644
199 +--- a/arch/powerpc/kernel/time.c
200 ++++ b/arch/powerpc/kernel/time.c
201 +@@ -235,7 +235,7 @@ static u64 scan_dispatch_log(u64 stop_tb)
202 + * Accumulate stolen time by scanning the dispatch trace log.
203 + * Called on entry from user mode.
204 + */
205 +-void accumulate_stolen_time(void)
206 ++void notrace accumulate_stolen_time(void)
207 + {
208 + u64 sst, ust;
209 + unsigned long save_irq_soft_mask = irq_soft_mask_return();
210 +diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
211 +index b1007e9a31ba..8894c8f300ea 100644
212 +--- a/arch/powerpc/mm/hash_utils_64.c
213 ++++ b/arch/powerpc/mm/hash_utils_64.c
214 +@@ -296,10 +296,18 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
215 + ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot,
216 + HPTE_V_BOLTED, psize, psize,
217 + ssize);
218 +-
219 ++ if (ret == -1) {
220 ++ /* Try to remove a non bolted entry */
221 ++ ret = mmu_hash_ops.hpte_remove(hpteg);
222 ++ if (ret != -1)
223 ++ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot,
224 ++ HPTE_V_BOLTED, psize, psize,
225 ++ ssize);
226 ++ }
227 + if (ret < 0)
228 + break;
229 +
230 ++ cond_resched();
231 + #ifdef CONFIG_DEBUG_PAGEALLOC
232 + if (debug_pagealloc_enabled() &&
233 + (paddr >> PAGE_SHIFT) < linear_map_hash_count)
234 +diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c
235 +index 25427a48feae..502ebcc6c3cb 100644
236 +--- a/arch/powerpc/platforms/pseries/cmm.c
237 ++++ b/arch/powerpc/platforms/pseries/cmm.c
238 +@@ -425,6 +425,10 @@ static struct bus_type cmm_subsys = {
239 + .dev_name = "cmm",
240 + };
241 +
242 ++static void cmm_release_device(struct device *dev)
243 ++{
244 ++}
245 ++
246 + /**
247 + * cmm_sysfs_register - Register with sysfs
248 + *
249 +@@ -440,6 +444,7 @@ static int cmm_sysfs_register(struct device *dev)
250 +
251 + dev->id = 0;
252 + dev->bus = &cmm_subsys;
253 ++ dev->release = cmm_release_device;
254 +
255 + if ((rc = device_register(dev)))
256 + goto subsys_unregister;
257 +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
258 +index c2d318d1df02..67f49159ea70 100644
259 +--- a/arch/powerpc/platforms/pseries/setup.c
260 ++++ b/arch/powerpc/platforms/pseries/setup.c
261 +@@ -75,9 +75,6 @@
262 + #include "pseries.h"
263 + #include "../../../../drivers/pci/pci.h"
264 +
265 +-DEFINE_STATIC_KEY_FALSE(shared_processor);
266 +-EXPORT_SYMBOL_GPL(shared_processor);
267 +-
268 + int CMO_PrPSP = -1;
269 + int CMO_SecPSP = -1;
270 + unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K);
271 +@@ -764,10 +761,6 @@ static void __init pSeries_setup_arch(void)
272 +
273 + if (firmware_has_feature(FW_FEATURE_LPAR)) {
274 + vpa_init(boot_cpuid);
275 +-
276 +- if (lppaca_shared_proc(get_lppaca()))
277 +- static_branch_enable(&shared_processor);
278 +-
279 + ppc_md.power_save = pseries_lpar_idle;
280 + ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
281 + #ifdef CONFIG_PCI_IOV
282 +diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh
283 +index ec2d5c835170..d6c16e7faa38 100755
284 +--- a/arch/powerpc/tools/relocs_check.sh
285 ++++ b/arch/powerpc/tools/relocs_check.sh
286 +@@ -23,7 +23,7 @@ objdump="$1"
287 + vmlinux="$2"
288 +
289 + bad_relocs=$(
290 +-"$objdump" -R "$vmlinux" |
291 ++$objdump -R "$vmlinux" |
292 + # Only look at relocation lines.
293 + grep -E '\<R_' |
294 + # These relocations are okay
295 +diff --git a/arch/powerpc/tools/unrel_branch_check.sh b/arch/powerpc/tools/unrel_branch_check.sh
296 +index 1e972df3107e..77114755dc6f 100755
297 +--- a/arch/powerpc/tools/unrel_branch_check.sh
298 ++++ b/arch/powerpc/tools/unrel_branch_check.sh
299 +@@ -18,14 +18,14 @@ vmlinux="$2"
300 + #__end_interrupts should be located within the first 64K
301 +
302 + end_intr=0x$(
303 +-"$objdump" -R "$vmlinux" -d --start-address=0xc000000000000000 \
304 ++$objdump -R "$vmlinux" -d --start-address=0xc000000000000000 \
305 + --stop-address=0xc000000000010000 |
306 + grep '\<__end_interrupts>:' |
307 + awk '{print $1}'
308 + )
309 +
310 + BRANCHES=$(
311 +-"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \
312 ++$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \
313 + --stop-address=${end_intr} |
314 + grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" |
315 + grep -v '\<__start_initialization_multiplatform>' |
316 +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
317 +index df92c2af99b6..5c3fd9032b74 100644
318 +--- a/arch/s390/kernel/perf_cpum_sf.c
319 ++++ b/arch/s390/kernel/perf_cpum_sf.c
320 +@@ -193,7 +193,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
321 + unsigned long num_sdb, gfp_t gfp_flags)
322 + {
323 + int i, rc;
324 +- unsigned long *new, *tail;
325 ++ unsigned long *new, *tail, *tail_prev = NULL;
326 +
327 + if (!sfb->sdbt || !sfb->tail)
328 + return -EINVAL;
329 +@@ -232,6 +232,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
330 + sfb->num_sdbt++;
331 + /* Link current page to tail of chain */
332 + *tail = (unsigned long)(void *) new + 1;
333 ++ tail_prev = tail;
334 + tail = new;
335 + }
336 +
337 +@@ -241,10 +242,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
338 + * issue, a new realloc call (if required) might succeed.
339 + */
340 + rc = alloc_sample_data_block(tail, gfp_flags);
341 +- if (rc)
342 ++ if (rc) {
343 ++ /* Undo last SDBT. An SDBT with no SDB at its first
344 ++ * entry but with an SDBT entry instead can not be
345 ++ * handled by the interrupt handler code.
346 ++ * Avoid this situation.
347 ++ */
348 ++ if (tail_prev) {
349 ++ sfb->num_sdbt--;
350 ++ free_page((unsigned long) new);
351 ++ tail = tail_prev;
352 ++ }
353 + break;
354 ++ }
355 + sfb->num_sdb++;
356 + tail++;
357 ++ tail_prev = new = NULL; /* Allocated at least one SBD */
358 + }
359 +
360 + /* Link sampling buffer to its origin */
361 +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
362 +index 87ed8462a5c7..1f69b12d5bb8 100644
363 +--- a/arch/x86/kernel/cpu/mcheck/mce.c
364 ++++ b/arch/x86/kernel/cpu/mcheck/mce.c
365 +@@ -812,8 +812,8 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
366 + if (quirk_no_way_out)
367 + quirk_no_way_out(i, m, regs);
368 +
369 ++ m->bank = i;
370 + if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
371 +- m->bank = i;
372 + mce_read_aux(m, i);
373 + *msg = tmp;
374 + return 1;
375 +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
376 +index 933268b8d6a5..d3947388a3ef 100644
377 +--- a/drivers/cdrom/cdrom.c
378 ++++ b/drivers/cdrom/cdrom.c
379 +@@ -996,6 +996,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks)
380 + tracks->xa = 0;
381 + tracks->error = 0;
382 + cd_dbg(CD_COUNT_TRACKS, "entering cdrom_count_tracks\n");
383 ++
384 ++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) {
385 ++ tracks->error = CDS_NO_INFO;
386 ++ return;
387 ++ }
388 ++
389 + /* Grab the TOC header so we can see how many tracks there are */
390 + ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCHDR, &header);
391 + if (ret) {
392 +@@ -1162,7 +1168,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev,
393 + ret = open_for_data(cdi);
394 + if (ret)
395 + goto err;
396 +- cdrom_mmc3_profile(cdi);
397 ++ if (CDROM_CAN(CDC_GENERIC_PACKET))
398 ++ cdrom_mmc3_profile(cdi);
399 + if (mode & FMODE_WRITE) {
400 + ret = -EROFS;
401 + if (cdrom_open_write(cdi))
402 +@@ -2882,6 +2889,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written)
403 + it doesn't give enough information or fails. then we return
404 + the toc contents. */
405 + use_toc:
406 ++ if (!CDROM_CAN(CDC_PLAY_AUDIO))
407 ++ return -ENOSYS;
408 ++
409 + toc.cdte_format = CDROM_MSF;
410 + toc.cdte_track = CDROM_LEADOUT;
411 + if ((ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCENTRY, &toc)))
412 +diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
413 +index 40af4fbab4d2..af9cc00d2d92 100644
414 +--- a/drivers/clk/clk-gpio.c
415 ++++ b/drivers/clk/clk-gpio.c
416 +@@ -248,7 +248,7 @@ static int gpio_clk_driver_probe(struct platform_device *pdev)
417 + else
418 + clk = clk_register_gpio_gate(&pdev->dev, node->name,
419 + parent_names ? parent_names[0] : NULL, gpiod,
420 +- 0);
421 ++ CLK_SET_RATE_PARENT);
422 + if (IS_ERR(clk))
423 + return PTR_ERR(clk);
424 +
425 +diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c
426 +index d40b63e7bbce..b44c4cf8011a 100644
427 +--- a/drivers/clk/pxa/clk-pxa27x.c
428 ++++ b/drivers/clk/pxa/clk-pxa27x.c
429 +@@ -463,6 +463,7 @@ struct dummy_clk {
430 + };
431 + static struct dummy_clk dummy_clks[] __initdata = {
432 + DUMMY_CLK(NULL, "pxa27x-gpio", "osc_32_768khz"),
433 ++ DUMMY_CLK(NULL, "pxa-rtc", "osc_32_768khz"),
434 + DUMMY_CLK(NULL, "sa1100-rtc", "osc_32_768khz"),
435 + DUMMY_CLK("UARTCLK", "pxa2xx-ir", "STUART"),
436 + };
437 +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
438 +index 52208d4165f4..51b2388d80ac 100644
439 +--- a/drivers/clk/qcom/clk-rcg2.c
440 ++++ b/drivers/clk/qcom/clk-rcg2.c
441 +@@ -206,6 +206,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
442 + if (clk_flags & CLK_SET_RATE_PARENT) {
443 + rate = f->freq;
444 + if (f->pre_div) {
445 ++ if (!rate)
446 ++ rate = req->rate;
447 + rate /= 2;
448 + rate *= f->pre_div + 1;
449 + }
450 +diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
451 +index db9b2471ac40..bfb6d6065a90 100644
452 +--- a/drivers/clk/qcom/common.c
453 ++++ b/drivers/clk/qcom/common.c
454 +@@ -29,6 +29,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate)
455 + if (!f)
456 + return NULL;
457 +
458 ++ if (!f->freq)
459 ++ return f;
460 ++
461 + for (; f->freq; f++)
462 + if (rate <= f->freq)
463 + return f;
464 +diff --git a/drivers/clocksource/asm9260_timer.c b/drivers/clocksource/asm9260_timer.c
465 +index 38cd2feb87c4..0ce760776406 100644
466 +--- a/drivers/clocksource/asm9260_timer.c
467 ++++ b/drivers/clocksource/asm9260_timer.c
468 +@@ -198,6 +198,10 @@ static int __init asm9260_timer_init(struct device_node *np)
469 + }
470 +
471 + clk = of_clk_get(np, 0);
472 ++ if (IS_ERR(clk)) {
473 ++ pr_err("Failed to get clk!\n");
474 ++ return PTR_ERR(clk);
475 ++ }
476 +
477 + ret = clk_prepare_enable(clk);
478 + if (ret) {
479 +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
480 +index 06ed88a2a8a0..6e2cb3693ed8 100644
481 +--- a/drivers/clocksource/timer-of.c
482 ++++ b/drivers/clocksource/timer-of.c
483 +@@ -199,7 +199,7 @@ int __init timer_of_init(struct device_node *np, struct timer_of *to)
484 + }
485 +
486 + if (!to->clkevt.name)
487 +- to->clkevt.name = np->name;
488 ++ to->clkevt.name = np->full_name;
489 +
490 + to->np = np;
491 +
492 +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
493 +index 8aec137b4fca..d56b6b0e22a8 100644
494 +--- a/drivers/dma/xilinx/xilinx_dma.c
495 ++++ b/drivers/dma/xilinx/xilinx_dma.c
496 +@@ -1427,6 +1427,7 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan)
497 +
498 + chan->err = false;
499 + chan->idle = true;
500 ++ chan->desc_pendingcount = 0;
501 + chan->desc_submitcount = 0;
502 +
503 + return err;
504 +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
505 +index c8673a5d9412..3f10f9599f2c 100644
506 +--- a/drivers/gpio/gpio-mpc8xxx.c
507 ++++ b/drivers/gpio/gpio-mpc8xxx.c
508 +@@ -348,7 +348,8 @@ static int mpc8xxx_probe(struct platform_device *pdev)
509 + * It's assumed that only a single type of gpio controller is available
510 + * on the current machine, so overwriting global data is fine.
511 + */
512 +- mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type;
513 ++ if (devtype->irq_set_type)
514 ++ mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type;
515 +
516 + if (devtype->gpio_dir_out)
517 + gc->direction_output = devtype->gpio_dir_out;
518 +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
519 +index b0c8fae7f903..3a359716fb38 100644
520 +--- a/drivers/hid/hid-core.c
521 ++++ b/drivers/hid/hid-core.c
522 +@@ -780,6 +780,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage)
523 + if (usage == 0xff0000c5 && parser->global.report_count == 256 &&
524 + parser->global.report_size == 8)
525 + parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8;
526 ++
527 ++ if (usage == 0xff0000c6 && parser->global.report_count == 1 &&
528 ++ parser->global.report_size == 8)
529 ++ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8;
530 + }
531 +
532 + static void hid_scan_collection(struct hid_parser *parser, unsigned type)
533 +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
534 +index 02c263a4c083..1949d6fca53e 100644
535 +--- a/drivers/hid/hid-ids.h
536 ++++ b/drivers/hid/hid-ids.h
537 +@@ -563,6 +563,7 @@
538 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
539 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941
540 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641
541 ++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a 0x1f4a
542 +
543 + #define USB_VENDOR_ID_HUION 0x256c
544 + #define USB_DEVICE_ID_HUION_TABLET 0x006e
545 +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
546 +index 034c883e57fa..504e8917b06f 100644
547 +--- a/drivers/hid/hid-logitech-hidpp.c
548 ++++ b/drivers/hid/hid-logitech-hidpp.c
549 +@@ -978,6 +978,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp,
550 + ret = hidpp_send_fap_command_sync(hidpp, feature_index,
551 + CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS,
552 + NULL, 0, &response);
553 ++ /* Ignore these intermittent errors */
554 ++ if (ret == HIDPP_ERROR_RESOURCE_ERROR)
555 ++ return -EIO;
556 + if (ret > 0) {
557 + hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
558 + __func__, ret);
559 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
560 +index a407fd2399ff..57d6fe9ed416 100644
561 +--- a/drivers/hid/hid-quirks.c
562 ++++ b/drivers/hid/hid-quirks.c
563 +@@ -96,6 +96,7 @@ static const struct hid_device_id hid_quirks[] = {
564 + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
565 + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL },
566 + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
567 ++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL },
568 + { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
569 + { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
570 + { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
571 +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
572 +index 9e33165250a3..a5b6b2be9cda 100644
573 +--- a/drivers/hid/hid-rmi.c
574 ++++ b/drivers/hid/hid-rmi.c
575 +@@ -737,7 +737,8 @@ static void rmi_remove(struct hid_device *hdev)
576 + {
577 + struct rmi_data *hdata = hid_get_drvdata(hdev);
578 +
579 +- if (hdata->device_flags & RMI_DEVICE) {
580 ++ if ((hdata->device_flags & RMI_DEVICE)
581 ++ && test_bit(RMI_STARTED, &hdata->flags)) {
582 + clear_bit(RMI_STARTED, &hdata->flags);
583 + cancel_work_sync(&hdata->reset_work);
584 + rmi_unregister_transport_device(&hdata->xport);
585 +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
586 +index a7ace07e179e..e8f98de60df3 100644
587 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c
588 ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
589 +@@ -3162,6 +3162,8 @@ static int __maybe_unused mxt_suspend(struct device *dev)
590 +
591 + mutex_unlock(&input_dev->mutex);
592 +
593 ++ disable_irq(data->irq);
594 ++
595 + return 0;
596 + }
597 +
598 +@@ -3174,6 +3176,8 @@ static int __maybe_unused mxt_resume(struct device *dev)
599 + if (!input_dev)
600 + return 0;
601 +
602 ++ enable_irq(data->irq);
603 ++
604 + mutex_lock(&input_dev->mutex);
605 +
606 + if (input_dev->users)
607 +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
608 +index ad3e2b97469e..140b287e886c 100644
609 +--- a/drivers/iommu/rockchip-iommu.c
610 ++++ b/drivers/iommu/rockchip-iommu.c
611 +@@ -977,13 +977,13 @@ static struct iommu_domain *rk_iommu_domain_alloc(unsigned type)
612 + if (!dma_dev)
613 + return NULL;
614 +
615 +- rk_domain = devm_kzalloc(dma_dev, sizeof(*rk_domain), GFP_KERNEL);
616 ++ rk_domain = kzalloc(sizeof(*rk_domain), GFP_KERNEL);
617 + if (!rk_domain)
618 + return NULL;
619 +
620 + if (type == IOMMU_DOMAIN_DMA &&
621 + iommu_get_dma_cookie(&rk_domain->domain))
622 +- return NULL;
623 ++ goto err_free_domain;
624 +
625 + /*
626 + * rk32xx iommus use a 2 level pagetable.
627 +@@ -1018,6 +1018,8 @@ err_free_dt:
628 + err_put_cookie:
629 + if (type == IOMMU_DOMAIN_DMA)
630 + iommu_put_dma_cookie(&rk_domain->domain);
631 ++err_free_domain:
632 ++ kfree(rk_domain);
633 +
634 + return NULL;
635 + }
636 +@@ -1046,6 +1048,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain)
637 +
638 + if (domain->type == IOMMU_DOMAIN_DMA)
639 + iommu_put_dma_cookie(&rk_domain->domain);
640 ++ kfree(rk_domain);
641 + }
642 +
643 + static int rk_iommu_add_device(struct device *dev)
644 +diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
645 +index 121d3cb7ddd1..fa0ecb5e6380 100644
646 +--- a/drivers/iommu/tegra-smmu.c
647 ++++ b/drivers/iommu/tegra-smmu.c
648 +@@ -164,9 +164,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr)
649 + return (addr & smmu->pfn_mask) == addr;
650 + }
651 +
652 +-static dma_addr_t smmu_pde_to_dma(u32 pde)
653 ++static dma_addr_t smmu_pde_to_dma(struct tegra_smmu *smmu, u32 pde)
654 + {
655 +- return pde << 12;
656 ++ return (dma_addr_t)(pde & smmu->pfn_mask) << 12;
657 + }
658 +
659 + static void smmu_flush_ptc_all(struct tegra_smmu *smmu)
660 +@@ -551,6 +551,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova,
661 + dma_addr_t *dmap)
662 + {
663 + unsigned int pd_index = iova_pd_index(iova);
664 ++ struct tegra_smmu *smmu = as->smmu;
665 + struct page *pt_page;
666 + u32 *pd;
667 +
668 +@@ -559,7 +560,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova,
669 + return NULL;
670 +
671 + pd = page_address(as->pd);
672 +- *dmap = smmu_pde_to_dma(pd[pd_index]);
673 ++ *dmap = smmu_pde_to_dma(smmu, pd[pd_index]);
674 +
675 + return tegra_smmu_pte_offset(pt_page, iova);
676 + }
677 +@@ -601,7 +602,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova,
678 + } else {
679 + u32 *pd = page_address(as->pd);
680 +
681 +- *dmap = smmu_pde_to_dma(pd[pde]);
682 ++ *dmap = smmu_pde_to_dma(smmu, pd[pde]);
683 + }
684 +
685 + return tegra_smmu_pte_offset(as->pts[pde], iova);
686 +@@ -626,7 +627,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova)
687 + if (--as->count[pde] == 0) {
688 + struct tegra_smmu *smmu = as->smmu;
689 + u32 *pd = page_address(as->pd);
690 +- dma_addr_t pte_dma = smmu_pde_to_dma(pd[pde]);
691 ++ dma_addr_t pte_dma = smmu_pde_to_dma(smmu, pd[pde]);
692 +
693 + tegra_smmu_set_pde(as, iova, 0);
694 +
695 +diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
696 +index 0f6e30e9009d..f53dfc5aa7c5 100644
697 +--- a/drivers/irqchip/irq-bcm7038-l1.c
698 ++++ b/drivers/irqchip/irq-bcm7038-l1.c
699 +@@ -284,6 +284,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn,
700 + pr_err("failed to map parent interrupt %d\n", parent_irq);
701 + return -EINVAL;
702 + }
703 ++
704 ++ if (of_property_read_bool(dn, "brcm,irq-can-wake"))
705 ++ enable_irq_wake(parent_irq);
706 ++
707 + irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle,
708 + intc);
709 +
710 +diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
711 +index 2ff08986b536..be6923abf9a4 100644
712 +--- a/drivers/irqchip/irq-ingenic.c
713 ++++ b/drivers/irqchip/irq-ingenic.c
714 +@@ -117,6 +117,14 @@ static int __init ingenic_intc_of_init(struct device_node *node,
715 + goto out_unmap_irq;
716 + }
717 +
718 ++ domain = irq_domain_add_legacy(node, num_chips * 32,
719 ++ JZ4740_IRQ_BASE, 0,
720 ++ &irq_domain_simple_ops, NULL);
721 ++ if (!domain) {
722 ++ err = -ENOMEM;
723 ++ goto out_unmap_base;
724 ++ }
725 ++
726 + for (i = 0; i < num_chips; i++) {
727 + /* Mask all irqs */
728 + writel(0xffffffff, intc->base + (i * CHIP_SIZE) +
729 +@@ -143,14 +151,11 @@ static int __init ingenic_intc_of_init(struct device_node *node,
730 + IRQ_NOPROBE | IRQ_LEVEL);
731 + }
732 +
733 +- domain = irq_domain_add_legacy(node, num_chips * 32, JZ4740_IRQ_BASE, 0,
734 +- &irq_domain_simple_ops, NULL);
735 +- if (!domain)
736 +- pr_warn("unable to register IRQ domain\n");
737 +-
738 + setup_irq(parent_irq, &intc_cascade_action);
739 + return 0;
740 +
741 ++out_unmap_base:
742 ++ iounmap(intc->base);
743 + out_unmap_irq:
744 + irq_dispose_mapping(parent_irq);
745 + out_free:
746 +diff --git a/drivers/leds/leds-lm3692x.c b/drivers/leds/leds-lm3692x.c
747 +index 4f413a7c5f05..d79a66a73169 100644
748 +--- a/drivers/leds/leds-lm3692x.c
749 ++++ b/drivers/leds/leds-lm3692x.c
750 +@@ -337,9 +337,18 @@ static int lm3692x_probe_dt(struct lm3692x_led *led)
751 + return ret;
752 + }
753 +
754 +- led->regulator = devm_regulator_get(&led->client->dev, "vled");
755 +- if (IS_ERR(led->regulator))
756 ++ led->regulator = devm_regulator_get_optional(&led->client->dev, "vled");
757 ++ if (IS_ERR(led->regulator)) {
758 ++ ret = PTR_ERR(led->regulator);
759 ++ if (ret != -ENODEV) {
760 ++ if (ret != -EPROBE_DEFER)
761 ++ dev_err(&led->client->dev,
762 ++ "Failed to get vled regulator: %d\n",
763 ++ ret);
764 ++ return ret;
765 ++ }
766 + led->regulator = NULL;
767 ++ }
768 +
769 + child = device_get_next_child_node(&led->client->dev, child);
770 + if (!child) {
771 +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
772 +index 363d35d5e49d..2f47023cab2b 100644
773 +--- a/drivers/mailbox/imx-mailbox.c
774 ++++ b/drivers/mailbox/imx-mailbox.c
775 +@@ -214,8 +214,10 @@ static void imx_mu_shutdown(struct mbox_chan *chan)
776 + struct imx_mu_priv *priv = to_imx_mu_priv(chan->mbox);
777 + struct imx_mu_con_priv *cp = chan->con_priv;
778 +
779 +- if (cp->type == IMX_MU_TYPE_TXDB)
780 ++ if (cp->type == IMX_MU_TYPE_TXDB) {
781 + tasklet_kill(&cp->txdb_tasklet);
782 ++ return;
783 ++ }
784 +
785 + imx_mu_xcr_rmw(priv, 0,
786 + IMX_MU_xCR_TIEn(cp->idx) | IMX_MU_xCR_RIEn(cp->idx));
787 +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
788 +index 45f684689c35..bb40bd66a10e 100644
789 +--- a/drivers/md/bcache/btree.c
790 ++++ b/drivers/md/bcache/btree.c
791 +@@ -713,6 +713,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,
792 + * IO can always make forward progress:
793 + */
794 + nr /= c->btree_pages;
795 ++ if (nr == 0)
796 ++ nr = 1;
797 + nr = min_t(unsigned long, nr, mca_can_free(c));
798 +
799 + i = 0;
800 +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
801 +index 9b8143dca512..f57b86f1373d 100644
802 +--- a/drivers/net/bonding/bond_main.c
803 ++++ b/drivers/net/bonding/bond_main.c
804 +@@ -2223,9 +2223,6 @@ static void bond_miimon_commit(struct bonding *bond)
805 + } else if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
806 + /* make it immediately active */
807 + bond_set_active_slave(slave);
808 +- } else if (slave != primary) {
809 +- /* prevent it from being the active one */
810 +- bond_set_backup_slave(slave);
811 + }
812 +
813 + netdev_info(bond->dev, "link status definitely up for interface %s, %u Mbps %s duplex\n",
814 +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
815 +index b5d72815776c..e26c195fec83 100644
816 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
817 ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
818 +@@ -1197,8 +1197,8 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
819 + struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi);
820 + struct ena_ring *tx_ring, *rx_ring;
821 +
822 +- u32 tx_work_done;
823 +- u32 rx_work_done;
824 ++ int tx_work_done;
825 ++ int rx_work_done = 0;
826 + int tx_budget;
827 + int napi_comp_call = 0;
828 + int ret;
829 +@@ -1215,7 +1215,11 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
830 + }
831 +
832 + tx_work_done = ena_clean_tx_irq(tx_ring, tx_budget);
833 +- rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget);
834 ++ /* On netpoll the budget is zero and the handler should only clean the
835 ++ * tx completions.
836 ++ */
837 ++ if (likely(budget))
838 ++ rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget);
839 +
840 + /* If the device is about to reset or down, avoid unmask
841 + * the interrupt and return 0 so NAPI won't reschedule
842 +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
843 +index a50977ce4076..04bee450eb3d 100644
844 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
845 ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
846 +@@ -3341,7 +3341,7 @@ static int mvpp2_open(struct net_device *dev)
847 + valid = true;
848 + }
849 +
850 +- if (priv->hw_version == MVPP22 && port->link_irq && !port->phylink) {
851 ++ if (priv->hw_version == MVPP22 && port->link_irq) {
852 + err = request_irq(port->link_irq, mvpp2_link_status_isr, 0,
853 + dev->name, port);
854 + if (err) {
855 +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
856 +index 993cb5ba934e..b99169a386eb 100644
857 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
858 ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
859 +@@ -37,6 +37,7 @@
860 + #include <linux/kernel.h>
861 + #include <linux/module.h>
862 + #include <linux/netlink.h>
863 ++#include <linux/vmalloc.h>
864 + #include <linux/xz.h>
865 + #include "mlxfw_mfa2.h"
866 + #include "mlxfw_mfa2_file.h"
867 +@@ -579,7 +580,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file,
868 + comp_size = be32_to_cpu(comp->size);
869 + comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len;
870 +
871 +- comp_data = kmalloc(sizeof(*comp_data) + comp_buf_size, GFP_KERNEL);
872 ++ comp_data = vzalloc(sizeof(*comp_data) + comp_buf_size);
873 + if (!comp_data)
874 + return ERR_PTR(-ENOMEM);
875 + comp_data->comp.data_size = comp_size;
876 +@@ -601,7 +602,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file,
877 + comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len;
878 + return &comp_data->comp;
879 + err_out:
880 +- kfree(comp_data);
881 ++ vfree(comp_data);
882 + return ERR_PTR(err);
883 + }
884 +
885 +@@ -610,7 +611,7 @@ void mlxfw_mfa2_file_component_put(struct mlxfw_mfa2_component *comp)
886 + const struct mlxfw_mfa2_comp_data *comp_data;
887 +
888 + comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp);
889 +- kfree(comp_data);
890 ++ vfree(comp_data);
891 + }
892 +
893 + void mlxfw_mfa2_file_fini(struct mlxfw_mfa2_file *mfa2_file)
894 +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
895 +index c5979569fd60..94b46258e8ff 100644
896 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
897 ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
898 +@@ -118,6 +118,14 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
899 + struct device *dev = dwmac->dev;
900 + const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS];
901 + struct meson8b_dwmac_clk_configs *clk_configs;
902 ++ static const struct clk_div_table div_table[] = {
903 ++ { .div = 2, .val = 2, },
904 ++ { .div = 3, .val = 3, },
905 ++ { .div = 4, .val = 4, },
906 ++ { .div = 5, .val = 5, },
907 ++ { .div = 6, .val = 6, },
908 ++ { .div = 7, .val = 7, },
909 ++ };
910 +
911 + clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL);
912 + if (!clk_configs)
913 +@@ -152,9 +160,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
914 + clk_configs->m250_div.reg = dwmac->regs + PRG_ETH0;
915 + clk_configs->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
916 + clk_configs->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
917 +- clk_configs->m250_div.flags = CLK_DIVIDER_ONE_BASED |
918 +- CLK_DIVIDER_ALLOW_ZERO |
919 +- CLK_DIVIDER_ROUND_CLOSEST;
920 ++ clk_configs->m250_div.table = div_table;
921 ++ clk_configs->m250_div.flags = CLK_DIVIDER_ALLOW_ZERO |
922 ++ CLK_DIVIDER_ROUND_CLOSEST;
923 + clk = meson8b_dwmac_register_clk(dwmac, "m250_div", &parent_name, 1,
924 + &clk_divider_ops,
925 + &clk_configs->m250_div.hw);
926 +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
927 +index d178d5bad7e4..494f00b9c5ef 100644
928 +--- a/drivers/net/gtp.c
929 ++++ b/drivers/net/gtp.c
930 +@@ -42,7 +42,6 @@ struct pdp_ctx {
931 + struct hlist_node hlist_addr;
932 +
933 + union {
934 +- u64 tid;
935 + struct {
936 + u64 tid;
937 + u16 flow;
938 +@@ -545,7 +544,7 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
939 + mtu = dst_mtu(&rt->dst);
940 + }
941 +
942 +- rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu);
943 ++ rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false);
944 +
945 + if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
946 + mtu < ntohs(iph->tot_len)) {
947 +@@ -645,9 +644,16 @@ static void gtp_link_setup(struct net_device *dev)
948 + }
949 +
950 + static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
951 +-static void gtp_hashtable_free(struct gtp_dev *gtp);
952 + static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
953 +
954 ++static void gtp_destructor(struct net_device *dev)
955 ++{
956 ++ struct gtp_dev *gtp = netdev_priv(dev);
957 ++
958 ++ kfree(gtp->addr_hash);
959 ++ kfree(gtp->tid_hash);
960 ++}
961 ++
962 + static int gtp_newlink(struct net *src_net, struct net_device *dev,
963 + struct nlattr *tb[], struct nlattr *data[],
964 + struct netlink_ext_ack *extack)
965 +@@ -665,10 +671,13 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
966 + if (err < 0)
967 + return err;
968 +
969 +- if (!data[IFLA_GTP_PDP_HASHSIZE])
970 ++ if (!data[IFLA_GTP_PDP_HASHSIZE]) {
971 + hashsize = 1024;
972 +- else
973 ++ } else {
974 + hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
975 ++ if (!hashsize)
976 ++ hashsize = 1024;
977 ++ }
978 +
979 + err = gtp_hashtable_new(gtp, hashsize);
980 + if (err < 0)
981 +@@ -682,13 +691,15 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
982 +
983 + gn = net_generic(dev_net(dev), gtp_net_id);
984 + list_add_rcu(&gtp->list, &gn->gtp_dev_list);
985 ++ dev->priv_destructor = gtp_destructor;
986 +
987 + netdev_dbg(dev, "registered new GTP interface\n");
988 +
989 + return 0;
990 +
991 + out_hashtable:
992 +- gtp_hashtable_free(gtp);
993 ++ kfree(gtp->addr_hash);
994 ++ kfree(gtp->tid_hash);
995 + out_encap:
996 + gtp_encap_disable(gtp);
997 + return err;
998 +@@ -697,9 +708,14 @@ out_encap:
999 + static void gtp_dellink(struct net_device *dev, struct list_head *head)
1000 + {
1001 + struct gtp_dev *gtp = netdev_priv(dev);
1002 ++ struct pdp_ctx *pctx;
1003 ++ int i;
1004 ++
1005 ++ for (i = 0; i < gtp->hash_size; i++)
1006 ++ hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
1007 ++ pdp_context_delete(pctx);
1008 +
1009 + gtp_encap_disable(gtp);
1010 +- gtp_hashtable_free(gtp);
1011 + list_del_rcu(&gtp->list);
1012 + unregister_netdevice_queue(dev, head);
1013 + }
1014 +@@ -777,20 +793,6 @@ err1:
1015 + return -ENOMEM;
1016 + }
1017 +
1018 +-static void gtp_hashtable_free(struct gtp_dev *gtp)
1019 +-{
1020 +- struct pdp_ctx *pctx;
1021 +- int i;
1022 +-
1023 +- for (i = 0; i < gtp->hash_size; i++)
1024 +- hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
1025 +- pdp_context_delete(pctx);
1026 +-
1027 +- synchronize_rcu();
1028 +- kfree(gtp->addr_hash);
1029 +- kfree(gtp->tid_hash);
1030 +-}
1031 +-
1032 + static struct sock *gtp_encap_enable_socket(int fd, int type,
1033 + struct gtp_dev *gtp)
1034 + {
1035 +@@ -931,24 +933,31 @@ static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
1036 + }
1037 + }
1038 +
1039 +-static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
1040 +- struct genl_info *info)
1041 ++static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk,
1042 ++ struct genl_info *info)
1043 + {
1044 ++ struct pdp_ctx *pctx, *pctx_tid = NULL;
1045 + struct net_device *dev = gtp->dev;
1046 + u32 hash_ms, hash_tid = 0;
1047 +- struct pdp_ctx *pctx;
1048 ++ unsigned int version;
1049 + bool found = false;
1050 + __be32 ms_addr;
1051 +
1052 + ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
1053 + hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
1054 ++ version = nla_get_u32(info->attrs[GTPA_VERSION]);
1055 +
1056 +- hlist_for_each_entry_rcu(pctx, &gtp->addr_hash[hash_ms], hlist_addr) {
1057 +- if (pctx->ms_addr_ip4.s_addr == ms_addr) {
1058 +- found = true;
1059 +- break;
1060 +- }
1061 +- }
1062 ++ pctx = ipv4_pdp_find(gtp, ms_addr);
1063 ++ if (pctx)
1064 ++ found = true;
1065 ++ if (version == GTP_V0)
1066 ++ pctx_tid = gtp0_pdp_find(gtp,
1067 ++ nla_get_u64(info->attrs[GTPA_TID]));
1068 ++ else if (version == GTP_V1)
1069 ++ pctx_tid = gtp1_pdp_find(gtp,
1070 ++ nla_get_u32(info->attrs[GTPA_I_TEI]));
1071 ++ if (pctx_tid)
1072 ++ found = true;
1073 +
1074 + if (found) {
1075 + if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
1076 +@@ -956,6 +965,11 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
1077 + if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
1078 + return -EOPNOTSUPP;
1079 +
1080 ++ if (pctx && pctx_tid)
1081 ++ return -EEXIST;
1082 ++ if (!pctx)
1083 ++ pctx = pctx_tid;
1084 ++
1085 + ipv4_pdp_fill(pctx, info);
1086 +
1087 + if (pctx->gtp_version == GTP_V0)
1088 +@@ -1079,7 +1093,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
1089 + goto out_unlock;
1090 + }
1091 +
1092 +- err = ipv4_pdp_add(gtp, sk, info);
1093 ++ err = gtp_pdp_add(gtp, sk, info);
1094 +
1095 + out_unlock:
1096 + rcu_read_unlock();
1097 +@@ -1237,43 +1251,46 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
1098 + struct netlink_callback *cb)
1099 + {
1100 + struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
1101 ++ int i, j, bucket = cb->args[0], skip = cb->args[1];
1102 + struct net *net = sock_net(skb->sk);
1103 +- struct gtp_net *gn = net_generic(net, gtp_net_id);
1104 +- unsigned long tid = cb->args[1];
1105 +- int i, k = cb->args[0], ret;
1106 + struct pdp_ctx *pctx;
1107 ++ struct gtp_net *gn;
1108 ++
1109 ++ gn = net_generic(net, gtp_net_id);
1110 +
1111 + if (cb->args[4])
1112 + return 0;
1113 +
1114 ++ rcu_read_lock();
1115 + list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
1116 + if (last_gtp && last_gtp != gtp)
1117 + continue;
1118 + else
1119 + last_gtp = NULL;
1120 +
1121 +- for (i = k; i < gtp->hash_size; i++) {
1122 +- hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid) {
1123 +- if (tid && tid != pctx->u.tid)
1124 +- continue;
1125 +- else
1126 +- tid = 0;
1127 +-
1128 +- ret = gtp_genl_fill_info(skb,
1129 +- NETLINK_CB(cb->skb).portid,
1130 +- cb->nlh->nlmsg_seq,
1131 +- cb->nlh->nlmsg_type, pctx);
1132 +- if (ret < 0) {
1133 ++ for (i = bucket; i < gtp->hash_size; i++) {
1134 ++ j = 0;
1135 ++ hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i],
1136 ++ hlist_tid) {
1137 ++ if (j >= skip &&
1138 ++ gtp_genl_fill_info(skb,
1139 ++ NETLINK_CB(cb->skb).portid,
1140 ++ cb->nlh->nlmsg_seq,
1141 ++ cb->nlh->nlmsg_type, pctx)) {
1142 + cb->args[0] = i;
1143 +- cb->args[1] = pctx->u.tid;
1144 ++ cb->args[1] = j;
1145 + cb->args[2] = (unsigned long)gtp;
1146 + goto out;
1147 + }
1148 ++ j++;
1149 + }
1150 ++ skip = 0;
1151 + }
1152 ++ bucket = 0;
1153 + }
1154 + cb->args[4] = 1;
1155 + out:
1156 ++ rcu_read_unlock();
1157 + return skb->len;
1158 + }
1159 +
1160 +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
1161 +index 54e63ec04907..8c636c493227 100644
1162 +--- a/drivers/net/hamradio/6pack.c
1163 ++++ b/drivers/net/hamradio/6pack.c
1164 +@@ -654,10 +654,10 @@ static void sixpack_close(struct tty_struct *tty)
1165 + {
1166 + struct sixpack *sp;
1167 +
1168 +- write_lock_bh(&disc_data_lock);
1169 ++ write_lock_irq(&disc_data_lock);
1170 + sp = tty->disc_data;
1171 + tty->disc_data = NULL;
1172 +- write_unlock_bh(&disc_data_lock);
1173 ++ write_unlock_irq(&disc_data_lock);
1174 + if (!sp)
1175 + return;
1176 +
1177 +diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
1178 +index 13e4c1eff353..3b14e6e281d4 100644
1179 +--- a/drivers/net/hamradio/mkiss.c
1180 ++++ b/drivers/net/hamradio/mkiss.c
1181 +@@ -783,10 +783,10 @@ static void mkiss_close(struct tty_struct *tty)
1182 + {
1183 + struct mkiss *ax;
1184 +
1185 +- write_lock_bh(&disc_data_lock);
1186 ++ write_lock_irq(&disc_data_lock);
1187 + ax = tty->disc_data;
1188 + tty->disc_data = NULL;
1189 +- write_unlock_bh(&disc_data_lock);
1190 ++ write_unlock_irq(&disc_data_lock);
1191 +
1192 + if (!ax)
1193 + return;
1194 +diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
1195 +index 0360c015f658..75ae2c508a04 100644
1196 +--- a/drivers/nvdimm/btt.c
1197 ++++ b/drivers/nvdimm/btt.c
1198 +@@ -1260,11 +1260,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip,
1199 +
1200 + ret = btt_data_read(arena, page, off, postmap, cur_len);
1201 + if (ret) {
1202 +- int rc;
1203 +-
1204 + /* Media error - set the e_flag */
1205 +- rc = btt_map_write(arena, premap, postmap, 0, 1,
1206 +- NVDIMM_IO_ATOMIC);
1207 ++ if (btt_map_write(arena, premap, postmap, 0, 1, NVDIMM_IO_ATOMIC))
1208 ++ dev_warn_ratelimited(to_dev(arena),
1209 ++ "Error persistently tracking bad blocks at %#x\n",
1210 ++ premap);
1211 + goto out_rtt;
1212 + }
1213 +
1214 +diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
1215 +index cc860c5f7d26..a306cad70470 100644
1216 +--- a/drivers/pci/hotplug/rpaphp_core.c
1217 ++++ b/drivers/pci/hotplug/rpaphp_core.c
1218 +@@ -154,11 +154,11 @@ static enum pci_bus_speed get_max_bus_speed(struct slot *slot)
1219 + return speed;
1220 + }
1221 +
1222 +-static int get_children_props(struct device_node *dn, const int **drc_indexes,
1223 +- const int **drc_names, const int **drc_types,
1224 +- const int **drc_power_domains)
1225 ++static int get_children_props(struct device_node *dn, const __be32 **drc_indexes,
1226 ++ const __be32 **drc_names, const __be32 **drc_types,
1227 ++ const __be32 **drc_power_domains)
1228 + {
1229 +- const int *indexes, *names, *types, *domains;
1230 ++ const __be32 *indexes, *names, *types, *domains;
1231 +
1232 + indexes = of_get_property(dn, "ibm,drc-indexes", NULL);
1233 + names = of_get_property(dn, "ibm,drc-names", NULL);
1234 +@@ -194,8 +194,8 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name,
1235 + char *drc_type, unsigned int my_index)
1236 + {
1237 + char *name_tmp, *type_tmp;
1238 +- const int *indexes, *names;
1239 +- const int *types, *domains;
1240 ++ const __be32 *indexes, *names;
1241 ++ const __be32 *types, *domains;
1242 + int i, rc;
1243 +
1244 + rc = get_children_props(dn->parent, &indexes, &names, &types, &domains);
1245 +@@ -208,7 +208,7 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name,
1246 +
1247 + /* Iterate through parent properties, looking for my-drc-index */
1248 + for (i = 0; i < be32_to_cpu(indexes[0]); i++) {
1249 +- if ((unsigned int) indexes[i + 1] == my_index)
1250 ++ if (be32_to_cpu(indexes[i + 1]) == my_index)
1251 + break;
1252 +
1253 + name_tmp += (strlen(name_tmp) + 1);
1254 +@@ -239,6 +239,8 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
1255 + value = of_prop_next_u32(info, NULL, &entries);
1256 + if (!value)
1257 + return -EINVAL;
1258 ++ else
1259 ++ value++;
1260 +
1261 + for (j = 0; j < entries; j++) {
1262 + of_read_drc_info_cell(&info, &value, &drc);
1263 +@@ -246,9 +248,10 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
1264 + /* Should now know end of current entry */
1265 +
1266 + /* Found it */
1267 +- if (my_index <= drc.last_drc_index) {
1268 ++ if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) {
1269 ++ int index = my_index - drc.drc_index_start;
1270 + sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
1271 +- my_index);
1272 ++ drc.drc_name_suffix_start + index);
1273 + break;
1274 + }
1275 + }
1276 +@@ -265,7 +268,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
1277 + int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,
1278 + char *drc_type)
1279 + {
1280 +- const unsigned int *my_index;
1281 ++ const __be32 *my_index;
1282 +
1283 + my_index = of_get_property(dn, "ibm,my-drc-index", NULL);
1284 + if (!my_index) {
1285 +@@ -273,12 +276,12 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,
1286 + return -EINVAL;
1287 + }
1288 +
1289 +- if (firmware_has_feature(FW_FEATURE_DRC_INFO))
1290 ++ if (of_find_property(dn->parent, "ibm,drc-info", NULL))
1291 + return rpaphp_check_drc_props_v2(dn, drc_name, drc_type,
1292 +- *my_index);
1293 ++ be32_to_cpu(*my_index));
1294 + else
1295 + return rpaphp_check_drc_props_v1(dn, drc_name, drc_type,
1296 +- *my_index);
1297 ++ be32_to_cpu(*my_index));
1298 + }
1299 + EXPORT_SYMBOL_GPL(rpaphp_check_drc_props);
1300 +
1301 +@@ -309,10 +312,11 @@ static int is_php_type(char *drc_type)
1302 + * for built-in pci slots (even when the built-in slots are
1303 + * dlparable.)
1304 + */
1305 +-static int is_php_dn(struct device_node *dn, const int **indexes,
1306 +- const int **names, const int **types, const int **power_domains)
1307 ++static int is_php_dn(struct device_node *dn, const __be32 **indexes,
1308 ++ const __be32 **names, const __be32 **types,
1309 ++ const __be32 **power_domains)
1310 + {
1311 +- const int *drc_types;
1312 ++ const __be32 *drc_types;
1313 + int rc;
1314 +
1315 + rc = get_children_props(dn, indexes, names, &drc_types, power_domains);
1316 +@@ -347,7 +351,7 @@ int rpaphp_add_slot(struct device_node *dn)
1317 + struct slot *slot;
1318 + int retval = 0;
1319 + int i;
1320 +- const int *indexes, *names, *types, *power_domains;
1321 ++ const __be32 *indexes, *names, *types, *power_domains;
1322 + char *name, *type;
1323 +
1324 + if (!dn->name || strcmp(dn->name, "pci"))
1325 +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
1326 +index f38d596efa05..021e28ff1194 100644
1327 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
1328 ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
1329 +@@ -196,7 +196,6 @@ struct byt_gpio {
1330 + struct platform_device *pdev;
1331 + struct pinctrl_dev *pctl_dev;
1332 + struct pinctrl_desc pctl_desc;
1333 +- raw_spinlock_t lock;
1334 + const struct byt_pinctrl_soc_data *soc_data;
1335 + struct byt_community *communities_copy;
1336 + struct byt_gpio_pin_context *saved_context;
1337 +@@ -707,6 +706,8 @@ static const struct byt_pinctrl_soc_data *byt_soc_data[] = {
1338 + NULL,
1339 + };
1340 +
1341 ++static DEFINE_RAW_SPINLOCK(byt_lock);
1342 ++
1343 + static struct byt_community *byt_get_community(struct byt_gpio *vg,
1344 + unsigned int pin)
1345 + {
1346 +@@ -848,7 +849,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg,
1347 + unsigned long flags;
1348 + int i;
1349 +
1350 +- raw_spin_lock_irqsave(&vg->lock, flags);
1351 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1352 +
1353 + for (i = 0; i < group.npins; i++) {
1354 + void __iomem *padcfg0;
1355 +@@ -868,7 +869,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg,
1356 + writel(value, padcfg0);
1357 + }
1358 +
1359 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1360 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1361 + }
1362 +
1363 + static void byt_set_group_mixed_mux(struct byt_gpio *vg,
1364 +@@ -878,7 +879,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg,
1365 + unsigned long flags;
1366 + int i;
1367 +
1368 +- raw_spin_lock_irqsave(&vg->lock, flags);
1369 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1370 +
1371 + for (i = 0; i < group.npins; i++) {
1372 + void __iomem *padcfg0;
1373 +@@ -898,7 +899,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg,
1374 + writel(value, padcfg0);
1375 + }
1376 +
1377 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1378 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1379 + }
1380 +
1381 + static int byt_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
1382 +@@ -947,11 +948,11 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
1383 + unsigned long flags;
1384 + u32 value;
1385 +
1386 +- raw_spin_lock_irqsave(&vg->lock, flags);
1387 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1388 + value = readl(reg);
1389 + value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
1390 + writel(value, reg);
1391 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1392 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1393 + }
1394 +
1395 + static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
1396 +@@ -963,7 +964,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
1397 + u32 value, gpio_mux;
1398 + unsigned long flags;
1399 +
1400 +- raw_spin_lock_irqsave(&vg->lock, flags);
1401 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1402 +
1403 + /*
1404 + * In most cases, func pin mux 000 means GPIO function.
1405 +@@ -985,7 +986,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
1406 + "pin %u forcibly re-configured as GPIO\n", offset);
1407 + }
1408 +
1409 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1410 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1411 +
1412 + pm_runtime_get(&vg->pdev->dev);
1413 +
1414 +@@ -1013,7 +1014,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
1415 + unsigned long flags;
1416 + u32 value;
1417 +
1418 +- raw_spin_lock_irqsave(&vg->lock, flags);
1419 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1420 +
1421 + value = readl(val_reg);
1422 + value &= ~BYT_DIR_MASK;
1423 +@@ -1030,7 +1031,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
1424 + "Potential Error: Setting GPIO with direct_irq_en to output");
1425 + writel(value, val_reg);
1426 +
1427 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1428 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1429 +
1430 + return 0;
1431 + }
1432 +@@ -1099,11 +1100,11 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
1433 + u32 conf, pull, val, debounce;
1434 + u16 arg = 0;
1435 +
1436 +- raw_spin_lock_irqsave(&vg->lock, flags);
1437 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1438 + conf = readl(conf_reg);
1439 + pull = conf & BYT_PULL_ASSIGN_MASK;
1440 + val = readl(val_reg);
1441 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1442 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1443 +
1444 + switch (param) {
1445 + case PIN_CONFIG_BIAS_DISABLE:
1446 +@@ -1130,9 +1131,9 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
1447 + if (!(conf & BYT_DEBOUNCE_EN))
1448 + return -EINVAL;
1449 +
1450 +- raw_spin_lock_irqsave(&vg->lock, flags);
1451 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1452 + debounce = readl(db_reg);
1453 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1454 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1455 +
1456 + switch (debounce & BYT_DEBOUNCE_PULSE_MASK) {
1457 + case BYT_DEBOUNCE_PULSE_375US:
1458 +@@ -1184,7 +1185,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
1459 + u32 conf, val, debounce;
1460 + int i, ret = 0;
1461 +
1462 +- raw_spin_lock_irqsave(&vg->lock, flags);
1463 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1464 +
1465 + conf = readl(conf_reg);
1466 + val = readl(val_reg);
1467 +@@ -1292,7 +1293,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
1468 + if (!ret)
1469 + writel(conf, conf_reg);
1470 +
1471 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1472 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1473 +
1474 + return ret;
1475 + }
1476 +@@ -1317,9 +1318,9 @@ static int byt_gpio_get(struct gpio_chip *chip, unsigned offset)
1477 + unsigned long flags;
1478 + u32 val;
1479 +
1480 +- raw_spin_lock_irqsave(&vg->lock, flags);
1481 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1482 + val = readl(reg);
1483 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1484 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1485 +
1486 + return !!(val & BYT_LEVEL);
1487 + }
1488 +@@ -1334,13 +1335,13 @@ static void byt_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
1489 + if (!reg)
1490 + return;
1491 +
1492 +- raw_spin_lock_irqsave(&vg->lock, flags);
1493 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1494 + old_val = readl(reg);
1495 + if (value)
1496 + writel(old_val | BYT_LEVEL, reg);
1497 + else
1498 + writel(old_val & ~BYT_LEVEL, reg);
1499 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1500 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1501 + }
1502 +
1503 + static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
1504 +@@ -1353,9 +1354,9 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
1505 + if (!reg)
1506 + return -EINVAL;
1507 +
1508 +- raw_spin_lock_irqsave(&vg->lock, flags);
1509 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1510 + value = readl(reg);
1511 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1512 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1513 +
1514 + if (!(value & BYT_OUTPUT_EN))
1515 + return GPIOF_DIR_OUT;
1516 +@@ -1398,14 +1399,14 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
1517 + const char *label;
1518 + unsigned int pin;
1519 +
1520 +- raw_spin_lock_irqsave(&vg->lock, flags);
1521 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1522 + pin = vg->soc_data->pins[i].number;
1523 + reg = byt_gpio_reg(vg, pin, BYT_CONF0_REG);
1524 + if (!reg) {
1525 + seq_printf(s,
1526 + "Could not retrieve pin %i conf0 reg\n",
1527 + pin);
1528 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1529 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1530 + continue;
1531 + }
1532 + conf0 = readl(reg);
1533 +@@ -1414,11 +1415,11 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
1534 + if (!reg) {
1535 + seq_printf(s,
1536 + "Could not retrieve pin %i val reg\n", pin);
1537 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1538 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1539 + continue;
1540 + }
1541 + val = readl(reg);
1542 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1543 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1544 +
1545 + comm = byt_get_community(vg, pin);
1546 + if (!comm) {
1547 +@@ -1502,9 +1503,9 @@ static void byt_irq_ack(struct irq_data *d)
1548 + if (!reg)
1549 + return;
1550 +
1551 +- raw_spin_lock(&vg->lock);
1552 ++ raw_spin_lock(&byt_lock);
1553 + writel(BIT(offset % 32), reg);
1554 +- raw_spin_unlock(&vg->lock);
1555 ++ raw_spin_unlock(&byt_lock);
1556 + }
1557 +
1558 + static void byt_irq_mask(struct irq_data *d)
1559 +@@ -1528,7 +1529,7 @@ static void byt_irq_unmask(struct irq_data *d)
1560 + if (!reg)
1561 + return;
1562 +
1563 +- raw_spin_lock_irqsave(&vg->lock, flags);
1564 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1565 + value = readl(reg);
1566 +
1567 + switch (irqd_get_trigger_type(d)) {
1568 +@@ -1551,7 +1552,7 @@ static void byt_irq_unmask(struct irq_data *d)
1569 +
1570 + writel(value, reg);
1571 +
1572 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1573 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1574 + }
1575 +
1576 + static int byt_irq_type(struct irq_data *d, unsigned int type)
1577 +@@ -1565,7 +1566,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type)
1578 + if (!reg || offset >= vg->chip.ngpio)
1579 + return -EINVAL;
1580 +
1581 +- raw_spin_lock_irqsave(&vg->lock, flags);
1582 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1583 + value = readl(reg);
1584 +
1585 + WARN(value & BYT_DIRECT_IRQ_EN,
1586 +@@ -1587,7 +1588,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type)
1587 + else if (type & IRQ_TYPE_LEVEL_MASK)
1588 + irq_set_handler_locked(d, handle_level_irq);
1589 +
1590 +- raw_spin_unlock_irqrestore(&vg->lock, flags);
1591 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1592 +
1593 + return 0;
1594 + }
1595 +@@ -1623,9 +1624,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
1596 + continue;
1597 + }
1598 +
1599 +- raw_spin_lock(&vg->lock);
1600 ++ raw_spin_lock(&byt_lock);
1601 + pending = readl(reg);
1602 +- raw_spin_unlock(&vg->lock);
1603 ++ raw_spin_unlock(&byt_lock);
1604 + for_each_set_bit(pin, &pending, 32) {
1605 + virq = irq_find_mapping(vg->chip.irq.domain, base + pin);
1606 + generic_handle_irq(virq);
1607 +@@ -1828,8 +1829,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
1608 + return PTR_ERR(vg->pctl_dev);
1609 + }
1610 +
1611 +- raw_spin_lock_init(&vg->lock);
1612 +-
1613 + ret = byt_gpio_probe(vg);
1614 + if (ret)
1615 + return ret;
1616 +@@ -1845,8 +1844,11 @@ static int byt_gpio_suspend(struct device *dev)
1617 + {
1618 + struct platform_device *pdev = to_platform_device(dev);
1619 + struct byt_gpio *vg = platform_get_drvdata(pdev);
1620 ++ unsigned long flags;
1621 + int i;
1622 +
1623 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1624 ++
1625 + for (i = 0; i < vg->soc_data->npins; i++) {
1626 + void __iomem *reg;
1627 + u32 value;
1628 +@@ -1867,6 +1869,7 @@ static int byt_gpio_suspend(struct device *dev)
1629 + vg->saved_context[i].val = value;
1630 + }
1631 +
1632 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1633 + return 0;
1634 + }
1635 +
1636 +@@ -1874,8 +1877,11 @@ static int byt_gpio_resume(struct device *dev)
1637 + {
1638 + struct platform_device *pdev = to_platform_device(dev);
1639 + struct byt_gpio *vg = platform_get_drvdata(pdev);
1640 ++ unsigned long flags;
1641 + int i;
1642 +
1643 ++ raw_spin_lock_irqsave(&byt_lock, flags);
1644 ++
1645 + for (i = 0; i < vg->soc_data->npins; i++) {
1646 + void __iomem *reg;
1647 + u32 value;
1648 +@@ -1913,6 +1919,7 @@ static int byt_gpio_resume(struct device *dev)
1649 + }
1650 + }
1651 +
1652 ++ raw_spin_unlock_irqrestore(&byt_lock, flags);
1653 + return 0;
1654 + }
1655 + #endif
1656 +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
1657 +index c64903a5978f..b818f65480c1 100644
1658 +--- a/drivers/ptp/ptp_clock.c
1659 ++++ b/drivers/ptp/ptp_clock.c
1660 +@@ -175,9 +175,9 @@ static struct posix_clock_operations ptp_clock_ops = {
1661 + .read = ptp_read,
1662 + };
1663 +
1664 +-static void delete_ptp_clock(struct posix_clock *pc)
1665 ++static void ptp_clock_release(struct device *dev)
1666 + {
1667 +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
1668 ++ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev);
1669 +
1670 + mutex_destroy(&ptp->tsevq_mux);
1671 + mutex_destroy(&ptp->pincfg_mux);
1672 +@@ -222,7 +222,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
1673 + }
1674 +
1675 + ptp->clock.ops = ptp_clock_ops;
1676 +- ptp->clock.release = delete_ptp_clock;
1677 + ptp->info = info;
1678 + ptp->devid = MKDEV(major, index);
1679 + ptp->index = index;
1680 +@@ -249,15 +248,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
1681 + if (err)
1682 + goto no_pin_groups;
1683 +
1684 +- /* Create a new device in our class. */
1685 +- ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid,
1686 +- ptp, ptp->pin_attr_groups,
1687 +- "ptp%d", ptp->index);
1688 +- if (IS_ERR(ptp->dev)) {
1689 +- err = PTR_ERR(ptp->dev);
1690 +- goto no_device;
1691 +- }
1692 +-
1693 + /* Register a new PPS source. */
1694 + if (info->pps) {
1695 + struct pps_source_info pps;
1696 +@@ -273,8 +263,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
1697 + }
1698 + }
1699 +
1700 +- /* Create a posix clock. */
1701 +- err = posix_clock_register(&ptp->clock, ptp->devid);
1702 ++ /* Initialize a new device of our class in our clock structure. */
1703 ++ device_initialize(&ptp->dev);
1704 ++ ptp->dev.devt = ptp->devid;
1705 ++ ptp->dev.class = ptp_class;
1706 ++ ptp->dev.parent = parent;
1707 ++ ptp->dev.groups = ptp->pin_attr_groups;
1708 ++ ptp->dev.release = ptp_clock_release;
1709 ++ dev_set_drvdata(&ptp->dev, ptp);
1710 ++ dev_set_name(&ptp->dev, "ptp%d", ptp->index);
1711 ++
1712 ++ /* Create a posix clock and link it to the device. */
1713 ++ err = posix_clock_register(&ptp->clock, &ptp->dev);
1714 + if (err) {
1715 + pr_err("failed to create posix clock\n");
1716 + goto no_clock;
1717 +@@ -286,8 +286,6 @@ no_clock:
1718 + if (ptp->pps_source)
1719 + pps_unregister_source(ptp->pps_source);
1720 + no_pps:
1721 +- device_destroy(ptp_class, ptp->devid);
1722 +-no_device:
1723 + ptp_cleanup_pin_groups(ptp);
1724 + no_pin_groups:
1725 + if (ptp->kworker)
1726 +@@ -317,7 +315,6 @@ int ptp_clock_unregister(struct ptp_clock *ptp)
1727 + if (ptp->pps_source)
1728 + pps_unregister_source(ptp->pps_source);
1729 +
1730 +- device_destroy(ptp_class, ptp->devid);
1731 + ptp_cleanup_pin_groups(ptp);
1732 +
1733 + posix_clock_unregister(&ptp->clock);
1734 +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
1735 +index c7c62b782cb9..05f6b6a9bbd5 100644
1736 +--- a/drivers/ptp/ptp_private.h
1737 ++++ b/drivers/ptp/ptp_private.h
1738 +@@ -41,7 +41,7 @@ struct timestamp_event_queue {
1739 +
1740 + struct ptp_clock {
1741 + struct posix_clock clock;
1742 +- struct device *dev;
1743 ++ struct device dev;
1744 + struct ptp_clock_info *info;
1745 + dev_t devid;
1746 + int index; /* index into clocks.map */
1747 +diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
1748 +index 2e1a27bd97d1..2126f4cc6d37 100644
1749 +--- a/drivers/s390/crypto/zcrypt_error.h
1750 ++++ b/drivers/s390/crypto/zcrypt_error.h
1751 +@@ -62,6 +62,7 @@ struct error_hdr {
1752 + #define REP82_ERROR_EVEN_MOD_IN_OPND 0x85
1753 + #define REP82_ERROR_RESERVED_FIELD 0x88
1754 + #define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A
1755 ++#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B
1756 + #define REP82_ERROR_TRANSPORT_FAIL 0x90
1757 + #define REP82_ERROR_PACKET_TRUNCATED 0xA0
1758 + #define REP82_ERROR_ZERO_BUFFER_LEN 0xB0
1759 +@@ -92,6 +93,7 @@ static inline int convert_error(struct zcrypt_queue *zq,
1760 + case REP82_ERROR_INVALID_DOMAIN_PRECHECK:
1761 + case REP82_ERROR_INVALID_DOMAIN_PENDING:
1762 + case REP82_ERROR_INVALID_SPECIAL_CMD:
1763 ++ case REP82_ERROR_FILTERED_BY_HYPERVISOR:
1764 + // REP88_ERROR_INVALID_KEY // '82' CEX2A
1765 + // REP88_ERROR_OPERAND // '84' CEX2A
1766 + // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A
1767 +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
1768 +index 8ec68dcc0cc4..95a3e3bf2b43 100644
1769 +--- a/drivers/scsi/NCR5380.c
1770 ++++ b/drivers/scsi/NCR5380.c
1771 +@@ -129,6 +129,9 @@
1772 + #define NCR5380_release_dma_irq(x)
1773 + #endif
1774 +
1775 ++static unsigned int disconnect_mask = ~0;
1776 ++module_param(disconnect_mask, int, 0444);
1777 ++
1778 + static int do_abort(struct Scsi_Host *);
1779 + static void do_reset(struct Scsi_Host *);
1780 + static void bus_reset_cleanup(struct Scsi_Host *);
1781 +@@ -946,7 +949,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
1782 + int err;
1783 + bool ret = true;
1784 + bool can_disconnect = instance->irq != NO_IRQ &&
1785 +- cmd->cmnd[0] != REQUEST_SENSE;
1786 ++ cmd->cmnd[0] != REQUEST_SENSE &&
1787 ++ (disconnect_mask & BIT(scmd_id(cmd)));
1788 +
1789 + NCR5380_dprint(NDEBUG_ARBITRATION, instance);
1790 + dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
1791 +diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c
1792 +index 89f5154c40b6..764c46d7333e 100644
1793 +--- a/drivers/scsi/atari_scsi.c
1794 ++++ b/drivers/scsi/atari_scsi.c
1795 +@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev)
1796 + atari_scsi_template.sg_tablesize = SG_ALL;
1797 + } else {
1798 + atari_scsi_template.can_queue = 1;
1799 +- atari_scsi_template.sg_tablesize = SG_NONE;
1800 ++ atari_scsi_template.sg_tablesize = 1;
1801 + }
1802 +
1803 + if (setup_can_queue > 0)
1804 +@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev)
1805 + if (setup_cmd_per_lun > 0)
1806 + atari_scsi_template.cmd_per_lun = setup_cmd_per_lun;
1807 +
1808 +- /* Leave sg_tablesize at 0 on a Falcon! */
1809 +- if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize >= 0)
1810 ++ /* Don't increase sg_tablesize on Falcon! */
1811 ++ if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize > 0)
1812 + atari_scsi_template.sg_tablesize = setup_sg_tablesize;
1813 +
1814 + if (setup_hostid >= 0) {
1815 +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
1816 +index cc5611efc7a9..a8e29e3d3572 100644
1817 +--- a/drivers/scsi/csiostor/csio_lnode.c
1818 ++++ b/drivers/scsi/csiostor/csio_lnode.c
1819 +@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1820 + struct fc_fdmi_port_name *port_name;
1821 + uint8_t buf[64];
1822 + uint8_t *fc4_type;
1823 ++ unsigned long flags;
1824 +
1825 + if (fdmi_req->wr_status != FW_SUCCESS) {
1826 + csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n",
1827 +@@ -385,13 +386,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1828 + len = (uint32_t)(pld - (uint8_t *)cmd);
1829 +
1830 + /* Submit FDMI RPA request */
1831 +- spin_lock_irq(&hw->lock);
1832 ++ spin_lock_irqsave(&hw->lock, flags);
1833 + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done,
1834 + FCOE_CT, &fdmi_req->dma_buf, len)) {
1835 + CSIO_INC_STATS(ln, n_fdmi_err);
1836 + csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n");
1837 + }
1838 +- spin_unlock_irq(&hw->lock);
1839 ++ spin_unlock_irqrestore(&hw->lock, flags);
1840 + }
1841 +
1842 + /*
1843 +@@ -412,6 +413,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1844 + struct fc_fdmi_rpl *reg_pl;
1845 + struct fs_fdmi_attrs *attrib_blk;
1846 + uint8_t buf[64];
1847 ++ unsigned long flags;
1848 +
1849 + if (fdmi_req->wr_status != FW_SUCCESS) {
1850 + csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n",
1851 +@@ -491,13 +493,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1852 + attrib_blk->numattrs = htonl(numattrs);
1853 +
1854 + /* Submit FDMI RHBA request */
1855 +- spin_lock_irq(&hw->lock);
1856 ++ spin_lock_irqsave(&hw->lock, flags);
1857 + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn,
1858 + FCOE_CT, &fdmi_req->dma_buf, len)) {
1859 + CSIO_INC_STATS(ln, n_fdmi_err);
1860 + csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n");
1861 + }
1862 +- spin_unlock_irq(&hw->lock);
1863 ++ spin_unlock_irqrestore(&hw->lock, flags);
1864 + }
1865 +
1866 + /*
1867 +@@ -512,6 +514,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1868 + void *cmd;
1869 + struct fc_fdmi_port_name *port_name;
1870 + uint32_t len;
1871 ++ unsigned long flags;
1872 +
1873 + if (fdmi_req->wr_status != FW_SUCCESS) {
1874 + csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n",
1875 +@@ -542,13 +545,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
1876 + len += sizeof(*port_name);
1877 +
1878 + /* Submit FDMI request */
1879 +- spin_lock_irq(&hw->lock);
1880 ++ spin_lock_irqsave(&hw->lock, flags);
1881 + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn,
1882 + FCOE_CT, &fdmi_req->dma_buf, len)) {
1883 + CSIO_INC_STATS(ln, n_fdmi_err);
1884 + csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n");
1885 + }
1886 +- spin_unlock_irq(&hw->lock);
1887 ++ spin_unlock_irqrestore(&hw->lock, flags);
1888 + }
1889 +
1890 + /**
1891 +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
1892 +index f35c56217694..33191673249c 100644
1893 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
1894 ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
1895 +@@ -485,7 +485,13 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags,
1896 + struct hisi_sas_dq *dq = NULL;
1897 +
1898 + if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) {
1899 +- if (in_softirq())
1900 ++ /*
1901 ++ * For IOs from upper layer, it may already disable preempt
1902 ++ * in the IO path, if disable preempt again in down(),
1903 ++ * function schedule() will report schedule_bug(), so check
1904 ++ * preemptible() before goto down().
1905 ++ */
1906 ++ if (!preemptible())
1907 + return -EINVAL;
1908 +
1909 + down(&hisi_hba->sem);
1910 +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
1911 +index 23354f206533..55181d28291e 100644
1912 +--- a/drivers/scsi/iscsi_tcp.c
1913 ++++ b/drivers/scsi/iscsi_tcp.c
1914 +@@ -374,8 +374,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task)
1915 + {
1916 + struct iscsi_conn *conn = task->conn;
1917 + unsigned int noreclaim_flag;
1918 ++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
1919 ++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data;
1920 + int rc = 0;
1921 +
1922 ++ if (!tcp_sw_conn->sock) {
1923 ++ iscsi_conn_printk(KERN_ERR, conn,
1924 ++ "Transport not bound to socket!\n");
1925 ++ return -EINVAL;
1926 ++ }
1927 ++
1928 + noreclaim_flag = memalloc_noreclaim_save();
1929 +
1930 + while (iscsi_sw_tcp_xmit_qlen(conn)) {
1931 +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
1932 +index 4f4d1b3b3bbc..7398350b08b4 100644
1933 +--- a/drivers/scsi/lpfc/lpfc_els.c
1934 ++++ b/drivers/scsi/lpfc/lpfc_els.c
1935 +@@ -4110,7 +4110,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
1936 + mempool_free(mbox, phba->mbox_mem_pool);
1937 + }
1938 + out:
1939 +- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) {
1940 ++ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) {
1941 + spin_lock_irq(shost->host_lock);
1942 + ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI);
1943 + spin_unlock_irq(shost->host_lock);
1944 +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
1945 +index b36b3da323a0..5d657178c2b9 100644
1946 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
1947 ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
1948 +@@ -5231,9 +5231,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did)
1949 + /* If we've already received a PLOGI from this NPort
1950 + * we don't need to try to discover it again.
1951 + */
1952 +- if (ndlp->nlp_flag & NLP_RCV_PLOGI)
1953 ++ if (ndlp->nlp_flag & NLP_RCV_PLOGI &&
1954 ++ !(ndlp->nlp_type &
1955 ++ (NLP_FCP_TARGET | NLP_NVME_TARGET)))
1956 + return NULL;
1957 +
1958 ++ ndlp->nlp_prev_state = ndlp->nlp_state;
1959 ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
1960 ++
1961 + spin_lock_irq(shost->host_lock);
1962 + ndlp->nlp_flag |= NLP_NPR_2B_DISC;
1963 + spin_unlock_irq(shost->host_lock);
1964 +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
1965 +index bd8dc6a2243c..3dfed191252c 100644
1966 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
1967 ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
1968 +@@ -483,8 +483,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
1969 + * single discovery thread, this will cause a huge delay in
1970 + * discovery. Also this will cause multiple state machines
1971 + * running in parallel for this node.
1972 ++ * This only applies to a fabric environment.
1973 + */
1974 +- if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) {
1975 ++ if ((ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) &&
1976 ++ (vport->fc_flag & FC_FABRIC)) {
1977 + /* software abort outstanding PLOGI */
1978 + lpfc_els_abort(phba, ndlp);
1979 + }
1980 +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
1981 +index f459fd62e493..a801917d3c19 100644
1982 +--- a/drivers/scsi/lpfc/lpfc_sli.c
1983 ++++ b/drivers/scsi/lpfc/lpfc_sli.c
1984 +@@ -12928,13 +12928,19 @@ send_current_mbox:
1985 + phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE;
1986 + /* Setting active mailbox pointer need to be in sync to flag clear */
1987 + phba->sli.mbox_active = NULL;
1988 ++ if (bf_get(lpfc_trailer_consumed, mcqe))
1989 ++ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq);
1990 + spin_unlock_irqrestore(&phba->hbalock, iflags);
1991 + /* Wake up worker thread to post the next pending mailbox command */
1992 + lpfc_worker_wake_up(phba);
1993 ++ return workposted;
1994 ++
1995 + out_no_mqe_complete:
1996 ++ spin_lock_irqsave(&phba->hbalock, iflags);
1997 + if (bf_get(lpfc_trailer_consumed, mcqe))
1998 + lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq);
1999 +- return workposted;
2000 ++ spin_unlock_irqrestore(&phba->hbalock, iflags);
2001 ++ return false;
2002 + }
2003 +
2004 + /**
2005 +@@ -17861,6 +17867,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba)
2006 + static void
2007 + __lpfc_sli4_free_rpi(struct lpfc_hba *phba, int rpi)
2008 + {
2009 ++ /*
2010 ++ * if the rpi value indicates a prior unreg has already
2011 ++ * been done, skip the unreg.
2012 ++ */
2013 ++ if (rpi == LPFC_RPI_ALLOC_ERROR)
2014 ++ return;
2015 ++
2016 + if (test_and_clear_bit(rpi, phba->sli4_hba.rpi_bmask)) {
2017 + phba->sli4_hba.rpi_count--;
2018 + phba->sli4_hba.max_cfg_param.rpi_used--;
2019 +diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
2020 +index 643321fc152d..b5050c2ede00 100644
2021 +--- a/drivers/scsi/mac_scsi.c
2022 ++++ b/drivers/scsi/mac_scsi.c
2023 +@@ -429,7 +429,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev)
2024 + mac_scsi_template.can_queue = setup_can_queue;
2025 + if (setup_cmd_per_lun > 0)
2026 + mac_scsi_template.cmd_per_lun = setup_cmd_per_lun;
2027 +- if (setup_sg_tablesize >= 0)
2028 ++ if (setup_sg_tablesize > 0)
2029 + mac_scsi_template.sg_tablesize = setup_sg_tablesize;
2030 + if (setup_hostid >= 0)
2031 + mac_scsi_template.this_id = setup_hostid & 7;
2032 +diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
2033 +index 5e8c059ce2c9..07345016fd9c 100644
2034 +--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
2035 ++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
2036 +@@ -1597,7 +1597,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc,
2037 + " for diag buffers, requested size(%d)\n",
2038 + ioc->name, __func__, request_data_sz);
2039 + mpt3sas_base_free_smid(ioc, smid);
2040 +- return -ENOMEM;
2041 ++ rc = -ENOMEM;
2042 ++ goto out;
2043 + }
2044 + ioc->diag_buffer[buffer_type] = request_data;
2045 + ioc->diag_buffer_sz[buffer_type] = request_data_sz;
2046 +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
2047 +index 5021aed87f33..8627feb80261 100644
2048 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c
2049 ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
2050 +@@ -2382,6 +2382,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
2051 + pm8001_printk("task 0x%p done with io_status 0x%x"
2052 + " resp 0x%x stat 0x%x but aborted by upper layer!\n",
2053 + t, status, ts->resp, ts->stat));
2054 ++ if (t->slow_task)
2055 ++ complete(&t->slow_task->completion);
2056 + pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
2057 + } else {
2058 + spin_unlock_irqrestore(&t->task_state_lock, flags);
2059 +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
2060 +index 65305b3848bc..a1dbae806fde 100644
2061 +--- a/drivers/scsi/scsi_debug.c
2062 ++++ b/drivers/scsi/scsi_debug.c
2063 +@@ -5351,6 +5351,11 @@ static int __init scsi_debug_init(void)
2064 + return -EINVAL;
2065 + }
2066 +
2067 ++ if (sdebug_num_tgts < 0) {
2068 ++ pr_err("num_tgts must be >= 0\n");
2069 ++ return -EINVAL;
2070 ++ }
2071 ++
2072 + if (sdebug_guard > 1) {
2073 + pr_err("guard must be 0 or 1\n");
2074 + return -EINVAL;
2075 +diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c
2076 +index 0ff083bbf5b1..617a60737590 100644
2077 +--- a/drivers/scsi/scsi_trace.c
2078 ++++ b/drivers/scsi/scsi_trace.c
2079 +@@ -30,15 +30,18 @@ static const char *
2080 + scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len)
2081 + {
2082 + const char *ret = trace_seq_buffer_ptr(p);
2083 +- sector_t lba = 0, txlen = 0;
2084 ++ u32 lba = 0, txlen;
2085 +
2086 + lba |= ((cdb[1] & 0x1F) << 16);
2087 + lba |= (cdb[2] << 8);
2088 + lba |= cdb[3];
2089 +- txlen = cdb[4];
2090 ++ /*
2091 ++ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256
2092 ++ * logical blocks shall be read (READ(6)) or written (WRITE(6)).
2093 ++ */
2094 ++ txlen = cdb[4] ? cdb[4] : 256;
2095 +
2096 +- trace_seq_printf(p, "lba=%llu txlen=%llu",
2097 +- (unsigned long long)lba, (unsigned long long)txlen);
2098 ++ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen);
2099 + trace_seq_putc(p, 0);
2100 +
2101 + return ret;
2102 +diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c
2103 +index 9492638296c8..af8a7ef9c858 100644
2104 +--- a/drivers/scsi/sun3_scsi.c
2105 ++++ b/drivers/scsi/sun3_scsi.c
2106 +@@ -498,7 +498,7 @@ static struct scsi_host_template sun3_scsi_template = {
2107 + .eh_host_reset_handler = sun3scsi_host_reset,
2108 + .can_queue = 16,
2109 + .this_id = 7,
2110 +- .sg_tablesize = SG_NONE,
2111 ++ .sg_tablesize = 1,
2112 + .cmd_per_lun = 2,
2113 + .use_clustering = DISABLE_CLUSTERING,
2114 + .cmd_size = NCR5380_CMD_SIZE,
2115 +@@ -520,7 +520,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev)
2116 + sun3_scsi_template.can_queue = setup_can_queue;
2117 + if (setup_cmd_per_lun > 0)
2118 + sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun;
2119 +- if (setup_sg_tablesize >= 0)
2120 ++ if (setup_sg_tablesize > 0)
2121 + sun3_scsi_template.sg_tablesize = setup_sg_tablesize;
2122 + if (setup_hostid >= 0)
2123 + sun3_scsi_template.this_id = setup_hostid & 7;
2124 +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
2125 +index 8bce755e0f5b..3601e770da16 100644
2126 +--- a/drivers/scsi/ufs/ufshcd.c
2127 ++++ b/drivers/scsi/ufs/ufshcd.c
2128 +@@ -3011,10 +3011,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
2129 + goto out_unlock;
2130 + }
2131 +
2132 +- hba->dev_cmd.query.descriptor = NULL;
2133 + *buf_len = be16_to_cpu(response->upiu_res.length);
2134 +
2135 + out_unlock:
2136 ++ hba->dev_cmd.query.descriptor = NULL;
2137 + mutex_unlock(&hba->dev_cmd.lock);
2138 + out:
2139 + ufshcd_release(hba);
2140 +@@ -3875,15 +3875,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba)
2141 + ktime_to_us(ktime_sub(ktime_get(), start)), ret);
2142 +
2143 + if (ret) {
2144 ++ int err;
2145 ++
2146 + dev_err(hba->dev, "%s: hibern8 enter failed. ret = %d\n",
2147 + __func__, ret);
2148 +
2149 + /*
2150 +- * If link recovery fails then return error so that caller
2151 +- * don't retry the hibern8 enter again.
2152 ++ * If link recovery fails then return error code returned from
2153 ++ * ufshcd_link_recovery().
2154 ++ * If link recovery succeeds then return -EAGAIN to attempt
2155 ++ * hibern8 enter retry again.
2156 + */
2157 +- if (ufshcd_link_recovery(hba))
2158 +- ret = -ENOLINK;
2159 ++ err = ufshcd_link_recovery(hba);
2160 ++ if (err) {
2161 ++ dev_err(hba->dev, "%s: link recovery failed", __func__);
2162 ++ ret = err;
2163 ++ } else {
2164 ++ ret = -EAGAIN;
2165 ++ }
2166 + } else
2167 + ufshcd_vops_hibern8_notify(hba, UIC_CMD_DME_HIBER_ENTER,
2168 + POST_CHANGE);
2169 +@@ -3897,7 +3906,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba)
2170 +
2171 + for (retries = UIC_HIBERN8_ENTER_RETRIES; retries > 0; retries--) {
2172 + ret = __ufshcd_uic_hibern8_enter(hba);
2173 +- if (!ret || ret == -ENOLINK)
2174 ++ if (!ret)
2175 + goto out;
2176 + }
2177 + out:
2178 +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
2179 +index 8f2e97857e8b..8b79e36fab21 100644
2180 +--- a/drivers/spi/spi-fsl-spi.c
2181 ++++ b/drivers/spi/spi-fsl-spi.c
2182 +@@ -832,9 +832,9 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
2183 + if (ret)
2184 + goto err;
2185 +
2186 +- irq = irq_of_parse_and_map(np, 0);
2187 +- if (!irq) {
2188 +- ret = -EINVAL;
2189 ++ irq = platform_get_irq(ofdev, 0);
2190 ++ if (irq < 0) {
2191 ++ ret = irq;
2192 + goto err;
2193 + }
2194 +
2195 +@@ -847,7 +847,6 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
2196 + return 0;
2197 +
2198 + err:
2199 +- irq_dispose_mapping(irq);
2200 + if (type == TYPE_FSL)
2201 + of_fsl_spi_free_chipselects(dev);
2202 + return ret;
2203 +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
2204 +index 03e9cb156df9..317d0f3f7a14 100644
2205 +--- a/drivers/target/iscsi/iscsi_target.c
2206 ++++ b/drivers/target/iscsi/iscsi_target.c
2207 +@@ -1157,7 +1157,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
2208 + hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
2209 + conn->cid);
2210 +
2211 +- target_get_sess_cmd(&cmd->se_cmd, true);
2212 ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
2213 ++ return iscsit_add_reject_cmd(cmd,
2214 ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
2215 +
2216 + cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
2217 + scsilun_to_int(&hdr->lun));
2218 +@@ -1998,7 +2000,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
2219 + conn->sess->se_sess, 0, DMA_NONE,
2220 + TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
2221 +
2222 +- target_get_sess_cmd(&cmd->se_cmd, true);
2223 ++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
2224 ++ return iscsit_add_reject_cmd(cmd,
2225 ++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
2226 +
2227 + /*
2228 + * TASK_REASSIGN for ERL=2 / connection stays inside of
2229 +@@ -4204,6 +4208,8 @@ int iscsit_close_connection(
2230 + * must wait until they have completed.
2231 + */
2232 + iscsit_check_conn_usage_count(conn);
2233 ++ target_sess_cmd_list_set_waiting(sess->se_sess);
2234 ++ target_wait_for_sess_cmds(sess->se_sess);
2235 +
2236 + ahash_request_free(conn->conn_tx_hash);
2237 + if (conn->conn_rx_hash) {
2238 +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
2239 +index e2fa3a3bc81d..b6bf605fa5c1 100644
2240 +--- a/drivers/target/iscsi/iscsi_target_auth.c
2241 ++++ b/drivers/target/iscsi/iscsi_target_auth.c
2242 +@@ -78,7 +78,7 @@ static int chap_check_algorithm(const char *a_str)
2243 + if (!token)
2244 + goto out;
2245 +
2246 +- if (!strncmp(token, "5", 1)) {
2247 ++ if (!strcmp(token, "5")) {
2248 + pr_debug("Selected MD5 Algorithm\n");
2249 + kfree(orig);
2250 + return CHAP_DIGEST_MD5;
2251 +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
2252 +index dd8949e8fcd7..f34520e9ad6e 100644
2253 +--- a/drivers/tty/serial/atmel_serial.c
2254 ++++ b/drivers/tty/serial/atmel_serial.c
2255 +@@ -2154,27 +2154,6 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
2256 + mode |= ATMEL_US_USMODE_NORMAL;
2257 + }
2258 +
2259 +- /* set the mode, clock divisor, parity, stop bits and data size */
2260 +- atmel_uart_writel(port, ATMEL_US_MR, mode);
2261 +-
2262 +- /*
2263 +- * when switching the mode, set the RTS line state according to the
2264 +- * new mode, otherwise keep the former state
2265 +- */
2266 +- if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) {
2267 +- unsigned int rts_state;
2268 +-
2269 +- if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) {
2270 +- /* let the hardware control the RTS line */
2271 +- rts_state = ATMEL_US_RTSDIS;
2272 +- } else {
2273 +- /* force RTS line to low level */
2274 +- rts_state = ATMEL_US_RTSEN;
2275 +- }
2276 +-
2277 +- atmel_uart_writel(port, ATMEL_US_CR, rts_state);
2278 +- }
2279 +-
2280 + /*
2281 + * Set the baud rate:
2282 + * Fractional baudrate allows to setup output frequency more
2283 +@@ -2200,6 +2179,28 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
2284 + quot = cd | fp << ATMEL_US_FP_OFFSET;
2285 +
2286 + atmel_uart_writel(port, ATMEL_US_BRGR, quot);
2287 ++
2288 ++ /* set the mode, clock divisor, parity, stop bits and data size */
2289 ++ atmel_uart_writel(port, ATMEL_US_MR, mode);
2290 ++
2291 ++ /*
2292 ++ * when switching the mode, set the RTS line state according to the
2293 ++ * new mode, otherwise keep the former state
2294 ++ */
2295 ++ if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) {
2296 ++ unsigned int rts_state;
2297 ++
2298 ++ if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) {
2299 ++ /* let the hardware control the RTS line */
2300 ++ rts_state = ATMEL_US_RTSDIS;
2301 ++ } else {
2302 ++ /* force RTS line to low level */
2303 ++ rts_state = ATMEL_US_RTSEN;
2304 ++ }
2305 ++
2306 ++ atmel_uart_writel(port, ATMEL_US_CR, rts_state);
2307 ++ }
2308 ++
2309 + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX);
2310 + atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN);
2311 + atmel_port->tx_stopped = false;
2312 +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
2313 +index 8dcee4faf701..5f5c5de31f10 100644
2314 +--- a/drivers/vhost/vsock.c
2315 ++++ b/drivers/vhost/vsock.c
2316 +@@ -436,7 +436,9 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
2317 + virtio_transport_deliver_tap_pkt(pkt);
2318 +
2319 + /* Only accept correctly addressed packets */
2320 +- if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
2321 ++ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid &&
2322 ++ le64_to_cpu(pkt->hdr.dst_cid) ==
2323 ++ vhost_transport_get_local_cid())
2324 + virtio_transport_recv_pkt(pkt);
2325 + else
2326 + virtio_transport_free_pkt(pkt);
2327 +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
2328 +index f6c24b22b37c..4b89333e8eb4 100644
2329 +--- a/drivers/watchdog/watchdog_dev.c
2330 ++++ b/drivers/watchdog/watchdog_dev.c
2331 +@@ -38,7 +38,6 @@
2332 + #include <linux/init.h> /* For __init/__exit/... */
2333 + #include <linux/hrtimer.h> /* For hrtimers */
2334 + #include <linux/kernel.h> /* For printk/panic/... */
2335 +-#include <linux/kref.h> /* For data references */
2336 + #include <linux/kthread.h> /* For kthread_work */
2337 + #include <linux/miscdevice.h> /* For handling misc devices */
2338 + #include <linux/module.h> /* For module stuff/... */
2339 +@@ -56,14 +55,14 @@
2340 +
2341 + /*
2342 + * struct watchdog_core_data - watchdog core internal data
2343 +- * @kref: Reference count.
2344 ++ * @dev: The watchdog's internal device
2345 + * @cdev: The watchdog's Character device.
2346 + * @wdd: Pointer to watchdog device.
2347 + * @lock: Lock for watchdog core.
2348 + * @status: Watchdog core internal status bits.
2349 + */
2350 + struct watchdog_core_data {
2351 +- struct kref kref;
2352 ++ struct device dev;
2353 + struct cdev cdev;
2354 + struct watchdog_device *wdd;
2355 + struct mutex lock;
2356 +@@ -822,7 +821,7 @@ static int watchdog_open(struct inode *inode, struct file *file)
2357 + file->private_data = wd_data;
2358 +
2359 + if (!hw_running)
2360 +- kref_get(&wd_data->kref);
2361 ++ get_device(&wd_data->dev);
2362 +
2363 + /* dev/watchdog is a virtual (and thus non-seekable) filesystem */
2364 + return nonseekable_open(inode, file);
2365 +@@ -834,11 +833,11 @@ out_clear:
2366 + return err;
2367 + }
2368 +
2369 +-static void watchdog_core_data_release(struct kref *kref)
2370 ++static void watchdog_core_data_release(struct device *dev)
2371 + {
2372 + struct watchdog_core_data *wd_data;
2373 +
2374 +- wd_data = container_of(kref, struct watchdog_core_data, kref);
2375 ++ wd_data = container_of(dev, struct watchdog_core_data, dev);
2376 +
2377 + kfree(wd_data);
2378 + }
2379 +@@ -898,7 +897,7 @@ done:
2380 + */
2381 + if (!running) {
2382 + module_put(wd_data->cdev.owner);
2383 +- kref_put(&wd_data->kref, watchdog_core_data_release);
2384 ++ put_device(&wd_data->dev);
2385 + }
2386 + return 0;
2387 + }
2388 +@@ -917,17 +916,22 @@ static struct miscdevice watchdog_miscdev = {
2389 + .fops = &watchdog_fops,
2390 + };
2391 +
2392 ++static struct class watchdog_class = {
2393 ++ .name = "watchdog",
2394 ++ .owner = THIS_MODULE,
2395 ++ .dev_groups = wdt_groups,
2396 ++};
2397 ++
2398 + /*
2399 + * watchdog_cdev_register: register watchdog character device
2400 + * @wdd: watchdog device
2401 +- * @devno: character device number
2402 + *
2403 + * Register a watchdog character device including handling the legacy
2404 + * /dev/watchdog node. /dev/watchdog is actually a miscdevice and
2405 + * thus we set it up like that.
2406 + */
2407 +
2408 +-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
2409 ++static int watchdog_cdev_register(struct watchdog_device *wdd)
2410 + {
2411 + struct watchdog_core_data *wd_data;
2412 + int err;
2413 +@@ -935,7 +939,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
2414 + wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL);
2415 + if (!wd_data)
2416 + return -ENOMEM;
2417 +- kref_init(&wd_data->kref);
2418 + mutex_init(&wd_data->lock);
2419 +
2420 + wd_data->wdd = wdd;
2421 +@@ -964,23 +967,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
2422 + }
2423 + }
2424 +
2425 ++ device_initialize(&wd_data->dev);
2426 ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
2427 ++ wd_data->dev.class = &watchdog_class;
2428 ++ wd_data->dev.parent = wdd->parent;
2429 ++ wd_data->dev.groups = wdd->groups;
2430 ++ wd_data->dev.release = watchdog_core_data_release;
2431 ++ dev_set_drvdata(&wd_data->dev, wdd);
2432 ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
2433 ++
2434 + /* Fill in the data structures */
2435 + cdev_init(&wd_data->cdev, &watchdog_fops);
2436 +- wd_data->cdev.owner = wdd->ops->owner;
2437 +
2438 + /* Add the device */
2439 +- err = cdev_add(&wd_data->cdev, devno, 1);
2440 ++ err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
2441 + if (err) {
2442 + pr_err("watchdog%d unable to add device %d:%d\n",
2443 + wdd->id, MAJOR(watchdog_devt), wdd->id);
2444 + if (wdd->id == 0) {
2445 + misc_deregister(&watchdog_miscdev);
2446 + old_wd_data = NULL;
2447 +- kref_put(&wd_data->kref, watchdog_core_data_release);
2448 ++ put_device(&wd_data->dev);
2449 + }
2450 + return err;
2451 + }
2452 +
2453 ++ wd_data->cdev.owner = wdd->ops->owner;
2454 ++
2455 + /* Record time of most recent heartbeat as 'just before now'. */
2456 + wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1);
2457 +
2458 +@@ -990,7 +1003,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
2459 + */
2460 + if (watchdog_hw_running(wdd)) {
2461 + __module_get(wdd->ops->owner);
2462 +- kref_get(&wd_data->kref);
2463 ++ get_device(&wd_data->dev);
2464 + if (handle_boot_enabled)
2465 + hrtimer_start(&wd_data->timer, 0, HRTIMER_MODE_REL);
2466 + else
2467 +@@ -1013,7 +1026,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
2468 + {
2469 + struct watchdog_core_data *wd_data = wdd->wd_data;
2470 +
2471 +- cdev_del(&wd_data->cdev);
2472 ++ cdev_device_del(&wd_data->cdev, &wd_data->dev);
2473 + if (wdd->id == 0) {
2474 + misc_deregister(&watchdog_miscdev);
2475 + old_wd_data = NULL;
2476 +@@ -1032,15 +1045,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
2477 + hrtimer_cancel(&wd_data->timer);
2478 + kthread_cancel_work_sync(&wd_data->work);
2479 +
2480 +- kref_put(&wd_data->kref, watchdog_core_data_release);
2481 ++ put_device(&wd_data->dev);
2482 + }
2483 +
2484 +-static struct class watchdog_class = {
2485 +- .name = "watchdog",
2486 +- .owner = THIS_MODULE,
2487 +- .dev_groups = wdt_groups,
2488 +-};
2489 +-
2490 + static int watchdog_reboot_notifier(struct notifier_block *nb,
2491 + unsigned long code, void *data)
2492 + {
2493 +@@ -1071,27 +1078,14 @@ static int watchdog_reboot_notifier(struct notifier_block *nb,
2494 +
2495 + int watchdog_dev_register(struct watchdog_device *wdd)
2496 + {
2497 +- struct device *dev;
2498 +- dev_t devno;
2499 + int ret;
2500 +
2501 +- devno = MKDEV(MAJOR(watchdog_devt), wdd->id);
2502 +-
2503 +- ret = watchdog_cdev_register(wdd, devno);
2504 ++ ret = watchdog_cdev_register(wdd);
2505 + if (ret)
2506 + return ret;
2507 +
2508 +- dev = device_create_with_groups(&watchdog_class, wdd->parent,
2509 +- devno, wdd, wdd->groups,
2510 +- "watchdog%d", wdd->id);
2511 +- if (IS_ERR(dev)) {
2512 +- watchdog_cdev_unregister(wdd);
2513 +- return PTR_ERR(dev);
2514 +- }
2515 +-
2516 + ret = watchdog_register_pretimeout(wdd);
2517 + if (ret) {
2518 +- device_destroy(&watchdog_class, devno);
2519 + watchdog_cdev_unregister(wdd);
2520 + return ret;
2521 + }
2522 +@@ -1099,7 +1093,8 @@ int watchdog_dev_register(struct watchdog_device *wdd)
2523 + if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
2524 + wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
2525 +
2526 +- ret = devm_register_reboot_notifier(dev, &wdd->reboot_nb);
2527 ++ ret = devm_register_reboot_notifier(&wdd->wd_data->dev,
2528 ++ &wdd->reboot_nb);
2529 + if (ret) {
2530 + pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
2531 + wdd->id, ret);
2532 +@@ -1121,7 +1116,6 @@ int watchdog_dev_register(struct watchdog_device *wdd)
2533 + void watchdog_dev_unregister(struct watchdog_device *wdd)
2534 + {
2535 + watchdog_unregister_pretimeout(wdd);
2536 +- device_destroy(&watchdog_class, wdd->wd_data->cdev.dev);
2537 + watchdog_cdev_unregister(wdd);
2538 + }
2539 +
2540 +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
2541 +index 215802cbc42b..950e3dcff7b0 100644
2542 +--- a/fs/ext4/inode.c
2543 ++++ b/fs/ext4/inode.c
2544 +@@ -3544,8 +3544,14 @@ retry:
2545 + return ret;
2546 + }
2547 +
2548 ++ /*
2549 ++ * Writes that span EOF might trigger an I/O size update on completion,
2550 ++ * so consider them to be dirty for the purposes of O_DSYNC, even if
2551 ++ * there is no other metadata changes being made or are pending here.
2552 ++ */
2553 + iomap->flags = 0;
2554 +- if (ext4_inode_datasync_dirty(inode))
2555 ++ if (ext4_inode_datasync_dirty(inode) ||
2556 ++ offset + length > i_size_read(inode))
2557 + iomap->flags |= IOMAP_F_DIRTY;
2558 + iomap->bdev = inode->i_sb->s_bdev;
2559 + iomap->dax_dev = sbi->s_daxdev;
2560 +@@ -3848,7 +3854,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
2561 + * writes & truncates and since we take care of writing back page cache,
2562 + * we are protected against page writeback as well.
2563 + */
2564 +- inode_lock_shared(inode);
2565 ++ if (iocb->ki_flags & IOCB_NOWAIT) {
2566 ++ if (!inode_trylock_shared(inode))
2567 ++ return -EAGAIN;
2568 ++ } else {
2569 ++ inode_lock_shared(inode);
2570 ++ }
2571 ++
2572 + ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
2573 + iocb->ki_pos + count - 1);
2574 + if (ret)
2575 +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
2576 +index 34e48bcf5087..72d154e71bb5 100644
2577 +--- a/fs/f2fs/f2fs.h
2578 ++++ b/fs/f2fs/f2fs.h
2579 +@@ -2578,6 +2578,20 @@ static inline void clear_file(struct inode *inode, int type)
2580 + f2fs_mark_inode_dirty_sync(inode, true);
2581 + }
2582 +
2583 ++static inline bool f2fs_is_time_consistent(struct inode *inode)
2584 ++{
2585 ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime))
2586 ++ return false;
2587 ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime))
2588 ++ return false;
2589 ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime))
2590 ++ return false;
2591 ++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3,
2592 ++ &F2FS_I(inode)->i_crtime))
2593 ++ return false;
2594 ++ return true;
2595 ++}
2596 ++
2597 + static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
2598 + {
2599 + bool ret;
2600 +@@ -2595,14 +2609,7 @@ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
2601 + i_size_read(inode) & ~PAGE_MASK)
2602 + return false;
2603 +
2604 +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime))
2605 +- return false;
2606 +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime))
2607 +- return false;
2608 +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime))
2609 +- return false;
2610 +- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3,
2611 +- &F2FS_I(inode)->i_crtime))
2612 ++ if (!f2fs_is_time_consistent(inode))
2613 + return false;
2614 +
2615 + down_read(&F2FS_I(inode)->i_sem);
2616 +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
2617 +index 540d45759621..a01be7d8db86 100644
2618 +--- a/fs/f2fs/inode.c
2619 ++++ b/fs/f2fs/inode.c
2620 +@@ -614,7 +614,11 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
2621 + inode->i_ino == F2FS_META_INO(sbi))
2622 + return 0;
2623 +
2624 +- if (!is_inode_flag_set(inode, FI_DIRTY_INODE))
2625 ++ /*
2626 ++ * atime could be updated without dirtying f2fs inode in lazytime mode
2627 ++ */
2628 ++ if (f2fs_is_time_consistent(inode) &&
2629 ++ !is_inode_flag_set(inode, FI_DIRTY_INODE))
2630 + return 0;
2631 +
2632 + /*
2633 +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
2634 +index 6b23dcbf52f4..0ace2c2e3de9 100644
2635 +--- a/fs/f2fs/namei.c
2636 ++++ b/fs/f2fs/namei.c
2637 +@@ -948,7 +948,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
2638 + if (!old_dir_entry || whiteout)
2639 + file_lost_pino(old_inode);
2640 + else
2641 +- F2FS_I(old_inode)->i_pino = new_dir->i_ino;
2642 ++ /* adjust dir's i_pino to pass fsck check */
2643 ++ f2fs_i_pino_write(old_inode, new_dir->i_ino);
2644 + up_write(&F2FS_I(old_inode)->i_sem);
2645 +
2646 + old_inode->i_ctime = current_time(old_inode);
2647 +@@ -1103,7 +1104,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
2648 + f2fs_set_link(old_dir, old_entry, old_page, new_inode);
2649 +
2650 + down_write(&F2FS_I(old_inode)->i_sem);
2651 +- file_lost_pino(old_inode);
2652 ++ if (!old_dir_entry)
2653 ++ file_lost_pino(old_inode);
2654 ++ else
2655 ++ /* adjust dir's i_pino to pass fsck check */
2656 ++ f2fs_i_pino_write(old_inode, new_dir->i_ino);
2657 + up_write(&F2FS_I(old_inode)->i_sem);
2658 +
2659 + old_dir->i_ctime = current_time(old_dir);
2660 +@@ -1118,7 +1123,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
2661 + f2fs_set_link(new_dir, new_entry, new_page, old_inode);
2662 +
2663 + down_write(&F2FS_I(new_inode)->i_sem);
2664 +- file_lost_pino(new_inode);
2665 ++ if (!new_dir_entry)
2666 ++ file_lost_pino(new_inode);
2667 ++ else
2668 ++ /* adjust dir's i_pino to pass fsck check */
2669 ++ f2fs_i_pino_write(new_inode, old_dir->i_ino);
2670 + up_write(&F2FS_I(new_inode)->i_sem);
2671 +
2672 + new_dir->i_ctime = current_time(new_dir);
2673 +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
2674 +index 24f86ffe11d7..020bd7a0d8e0 100644
2675 +--- a/fs/jbd2/commit.c
2676 ++++ b/fs/jbd2/commit.c
2677 +@@ -724,7 +724,6 @@ start_journal_io:
2678 + submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
2679 + }
2680 + cond_resched();
2681 +- stats.run.rs_blocks_logged += bufs;
2682 +
2683 + /* Force a new descriptor to be generated next
2684 + time round the loop. */
2685 +@@ -811,6 +810,7 @@ start_journal_io:
2686 + if (unlikely(!buffer_uptodate(bh)))
2687 + err = -EIO;
2688 + jbd2_unfile_log_bh(bh);
2689 ++ stats.run.rs_blocks_logged++;
2690 +
2691 + /*
2692 + * The list contains temporary buffer heads created by
2693 +@@ -856,6 +856,7 @@ start_journal_io:
2694 + BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile");
2695 + clear_buffer_jwrite(bh);
2696 + jbd2_unfile_log_bh(bh);
2697 ++ stats.run.rs_blocks_logged++;
2698 + __brelse(bh); /* One for getblk */
2699 + /* AKPM: bforget here */
2700 + }
2701 +@@ -877,6 +878,7 @@ start_journal_io:
2702 + }
2703 + if (cbh)
2704 + err = journal_wait_on_commit_record(journal, cbh);
2705 ++ stats.run.rs_blocks_logged++;
2706 + if (jbd2_has_feature_async_commit(journal) &&
2707 + journal->j_flags & JBD2_BARRIER) {
2708 + blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
2709 +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
2710 +index 917fadca8a7b..b73b78771915 100644
2711 +--- a/fs/ocfs2/acl.c
2712 ++++ b/fs/ocfs2/acl.c
2713 +@@ -335,8 +335,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
2714 + down_read(&OCFS2_I(inode)->ip_xattr_sem);
2715 + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
2716 + up_read(&OCFS2_I(inode)->ip_xattr_sem);
2717 +- if (IS_ERR(acl) || !acl)
2718 +- return PTR_ERR(acl);
2719 ++ if (IS_ERR_OR_NULL(acl))
2720 ++ return PTR_ERR_OR_ZERO(acl);
2721 + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
2722 + if (ret)
2723 + return ret;
2724 +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
2725 +index 59b00d8db22c..154f175066b3 100644
2726 +--- a/fs/quota/dquot.c
2727 ++++ b/fs/quota/dquot.c
2728 +@@ -2853,68 +2853,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops);
2729 + static int do_proc_dqstats(struct ctl_table *table, int write,
2730 + void __user *buffer, size_t *lenp, loff_t *ppos)
2731 + {
2732 +- unsigned int type = (int *)table->data - dqstats.stat;
2733 ++ unsigned int type = (unsigned long *)table->data - dqstats.stat;
2734 ++ s64 value = percpu_counter_sum(&dqstats.counter[type]);
2735 ++
2736 ++ /* Filter negative values for non-monotonic counters */
2737 ++ if (value < 0 && (type == DQST_ALLOC_DQUOTS ||
2738 ++ type == DQST_FREE_DQUOTS))
2739 ++ value = 0;
2740 +
2741 + /* Update global table */
2742 +- dqstats.stat[type] =
2743 +- percpu_counter_sum_positive(&dqstats.counter[type]);
2744 +- return proc_dointvec(table, write, buffer, lenp, ppos);
2745 ++ dqstats.stat[type] = value;
2746 ++ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
2747 + }
2748 +
2749 + static struct ctl_table fs_dqstats_table[] = {
2750 + {
2751 + .procname = "lookups",
2752 + .data = &dqstats.stat[DQST_LOOKUPS],
2753 +- .maxlen = sizeof(int),
2754 ++ .maxlen = sizeof(unsigned long),
2755 + .mode = 0444,
2756 + .proc_handler = do_proc_dqstats,
2757 + },
2758 + {
2759 + .procname = "drops",
2760 + .data = &dqstats.stat[DQST_DROPS],
2761 +- .maxlen = sizeof(int),
2762 ++ .maxlen = sizeof(unsigned long),
2763 + .mode = 0444,
2764 + .proc_handler = do_proc_dqstats,
2765 + },
2766 + {
2767 + .procname = "reads",
2768 + .data = &dqstats.stat[DQST_READS],
2769 +- .maxlen = sizeof(int),
2770 ++ .maxlen = sizeof(unsigned long),
2771 + .mode = 0444,
2772 + .proc_handler = do_proc_dqstats,
2773 + },
2774 + {
2775 + .procname = "writes",
2776 + .data = &dqstats.stat[DQST_WRITES],
2777 +- .maxlen = sizeof(int),
2778 ++ .maxlen = sizeof(unsigned long),
2779 + .mode = 0444,
2780 + .proc_handler = do_proc_dqstats,
2781 + },
2782 + {
2783 + .procname = "cache_hits",
2784 + .data = &dqstats.stat[DQST_CACHE_HITS],
2785 +- .maxlen = sizeof(int),
2786 ++ .maxlen = sizeof(unsigned long),
2787 + .mode = 0444,
2788 + .proc_handler = do_proc_dqstats,
2789 + },
2790 + {
2791 + .procname = "allocated_dquots",
2792 + .data = &dqstats.stat[DQST_ALLOC_DQUOTS],
2793 +- .maxlen = sizeof(int),
2794 ++ .maxlen = sizeof(unsigned long),
2795 + .mode = 0444,
2796 + .proc_handler = do_proc_dqstats,
2797 + },
2798 + {
2799 + .procname = "free_dquots",
2800 + .data = &dqstats.stat[DQST_FREE_DQUOTS],
2801 +- .maxlen = sizeof(int),
2802 ++ .maxlen = sizeof(unsigned long),
2803 + .mode = 0444,
2804 + .proc_handler = do_proc_dqstats,
2805 + },
2806 + {
2807 + .procname = "syncs",
2808 + .data = &dqstats.stat[DQST_SYNCS],
2809 +- .maxlen = sizeof(int),
2810 ++ .maxlen = sizeof(unsigned long),
2811 + .mode = 0444,
2812 + .proc_handler = do_proc_dqstats,
2813 + },
2814 +diff --git a/fs/readdir.c b/fs/readdir.c
2815 +index d97f548e6323..443270f635f4 100644
2816 +--- a/fs/readdir.c
2817 ++++ b/fs/readdir.c
2818 +@@ -64,6 +64,40 @@ out:
2819 + }
2820 + EXPORT_SYMBOL(iterate_dir);
2821 +
2822 ++/*
2823 ++ * POSIX says that a dirent name cannot contain NULL or a '/'.
2824 ++ *
2825 ++ * It's not 100% clear what we should really do in this case.
2826 ++ * The filesystem is clearly corrupted, but returning a hard
2827 ++ * error means that you now don't see any of the other names
2828 ++ * either, so that isn't a perfect alternative.
2829 ++ *
2830 ++ * And if you return an error, what error do you use? Several
2831 ++ * filesystems seem to have decided on EUCLEAN being the error
2832 ++ * code for EFSCORRUPTED, and that may be the error to use. Or
2833 ++ * just EIO, which is perhaps more obvious to users.
2834 ++ *
2835 ++ * In order to see the other file names in the directory, the
2836 ++ * caller might want to make this a "soft" error: skip the
2837 ++ * entry, and return the error at the end instead.
2838 ++ *
2839 ++ * Note that this should likely do a "memchr(name, 0, len)"
2840 ++ * check too, since that would be filesystem corruption as
2841 ++ * well. However, that case can't actually confuse user space,
2842 ++ * which has to do a strlen() on the name anyway to find the
2843 ++ * filename length, and the above "soft error" worry means
2844 ++ * that it's probably better left alone until we have that
2845 ++ * issue clarified.
2846 ++ */
2847 ++static int verify_dirent_name(const char *name, int len)
2848 ++{
2849 ++ if (!len)
2850 ++ return -EIO;
2851 ++ if (memchr(name, '/', len))
2852 ++ return -EIO;
2853 ++ return 0;
2854 ++}
2855 ++
2856 + /*
2857 + * Traditional linux readdir() handling..
2858 + *
2859 +@@ -173,6 +207,9 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen,
2860 + int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2,
2861 + sizeof(long));
2862 +
2863 ++ buf->error = verify_dirent_name(name, namlen);
2864 ++ if (unlikely(buf->error))
2865 ++ return buf->error;
2866 + buf->error = -EINVAL; /* only used if we fail.. */
2867 + if (reclen > buf->count)
2868 + return -EINVAL;
2869 +@@ -259,6 +296,9 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen,
2870 + int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
2871 + sizeof(u64));
2872 +
2873 ++ buf->error = verify_dirent_name(name, namlen);
2874 ++ if (unlikely(buf->error))
2875 ++ return buf->error;
2876 + buf->error = -EINVAL; /* only used if we fail.. */
2877 + if (reclen > buf->count)
2878 + return -EINVAL;
2879 +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
2880 +index 9c2955f67f70..d269d1139f7f 100644
2881 +--- a/fs/userfaultfd.c
2882 ++++ b/fs/userfaultfd.c
2883 +@@ -1833,13 +1833,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
2884 + if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
2885 + goto out;
2886 + features = uffdio_api.features;
2887 +- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) {
2888 +- memset(&uffdio_api, 0, sizeof(uffdio_api));
2889 +- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
2890 +- goto out;
2891 +- ret = -EINVAL;
2892 +- goto out;
2893 +- }
2894 ++ ret = -EINVAL;
2895 ++ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))
2896 ++ goto err_out;
2897 ++ ret = -EPERM;
2898 ++ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))
2899 ++ goto err_out;
2900 + /* report all available features and ioctls to userland */
2901 + uffdio_api.features = UFFD_API_FEATURES;
2902 + uffdio_api.ioctls = UFFD_API_IOCTLS;
2903 +@@ -1852,6 +1851,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
2904 + ret = 0;
2905 + out:
2906 + return ret;
2907 ++err_out:
2908 ++ memset(&uffdio_api, 0, sizeof(uffdio_api));
2909 ++ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
2910 ++ ret = -EFAULT;
2911 ++ goto out;
2912 + }
2913 +
2914 + static long userfaultfd_ioctl(struct file *file, unsigned cmd,
2915 +diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
2916 +index 3892e9c8b2de..542b4fa2cda9 100644
2917 +--- a/include/linux/hrtimer.h
2918 ++++ b/include/linux/hrtimer.h
2919 +@@ -430,12 +430,18 @@ extern u64 hrtimer_next_event_without(const struct hrtimer *exclude);
2920 +
2921 + extern bool hrtimer_active(const struct hrtimer *timer);
2922 +
2923 +-/*
2924 +- * Helper function to check, whether the timer is on one of the queues
2925 ++/**
2926 ++ * hrtimer_is_queued = check, whether the timer is on one of the queues
2927 ++ * @timer: Timer to check
2928 ++ *
2929 ++ * Returns: True if the timer is queued, false otherwise
2930 ++ *
2931 ++ * The function can be used lockless, but it gives only a current snapshot.
2932 + */
2933 +-static inline int hrtimer_is_queued(struct hrtimer *timer)
2934 ++static inline bool hrtimer_is_queued(struct hrtimer *timer)
2935 + {
2936 +- return timer->state & HRTIMER_STATE_ENQUEUED;
2937 ++ /* The READ_ONCE pairs with the update functions of timer->state */
2938 ++ return !!(READ_ONCE(timer->state) & HRTIMER_STATE_ENQUEUED);
2939 + }
2940 +
2941 + /*
2942 +diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
2943 +index edb0f0c30904..1adf54aad2df 100644
2944 +--- a/include/linux/libfdt_env.h
2945 ++++ b/include/linux/libfdt_env.h
2946 +@@ -7,6 +7,9 @@
2947 +
2948 + #include <asm/byteorder.h>
2949 +
2950 ++#define INT32_MAX S32_MAX
2951 ++#define UINT32_MAX U32_MAX
2952 ++
2953 + typedef __be16 fdt16_t;
2954 + typedef __be32 fdt32_t;
2955 + typedef __be64 fdt64_t;
2956 +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h
2957 +index 3a3bc71017d5..03cb1f21b0e0 100644
2958 +--- a/include/linux/posix-clock.h
2959 ++++ b/include/linux/posix-clock.h
2960 +@@ -82,29 +82,32 @@ struct posix_clock_operations {
2961 + *
2962 + * @ops: Functional interface to the clock
2963 + * @cdev: Character device instance for this clock
2964 +- * @kref: Reference count.
2965 ++ * @dev: Pointer to the clock's device.
2966 + * @rwsem: Protects the 'zombie' field from concurrent access.
2967 + * @zombie: If 'zombie' is true, then the hardware has disappeared.
2968 +- * @release: A function to free the structure when the reference count reaches
2969 +- * zero. May be NULL if structure is statically allocated.
2970 + *
2971 + * Drivers should embed their struct posix_clock within a private
2972 + * structure, obtaining a reference to it during callbacks using
2973 + * container_of().
2974 ++ *
2975 ++ * Drivers should supply an initialized but not exposed struct device
2976 ++ * to posix_clock_register(). It is used to manage lifetime of the
2977 ++ * driver's private structure. It's 'release' field should be set to
2978 ++ * a release function for this private structure.
2979 + */
2980 + struct posix_clock {
2981 + struct posix_clock_operations ops;
2982 + struct cdev cdev;
2983 +- struct kref kref;
2984 ++ struct device *dev;
2985 + struct rw_semaphore rwsem;
2986 + bool zombie;
2987 +- void (*release)(struct posix_clock *clk);
2988 + };
2989 +
2990 + /**
2991 + * posix_clock_register() - register a new clock
2992 +- * @clk: Pointer to the clock. Caller must provide 'ops' and 'release'
2993 +- * @devid: Allocated device id
2994 ++ * @clk: Pointer to the clock. Caller must provide 'ops' field
2995 ++ * @dev: Pointer to the initialized device. Caller must provide
2996 ++ * 'release' field
2997 + *
2998 + * A clock driver calls this function to register itself with the
2999 + * clock device subsystem. If 'clk' points to dynamically allocated
3000 +@@ -113,7 +116,7 @@ struct posix_clock {
3001 + *
3002 + * Returns zero on success, non-zero otherwise.
3003 + */
3004 +-int posix_clock_register(struct posix_clock *clk, dev_t devid);
3005 ++int posix_clock_register(struct posix_clock *clk, struct device *dev);
3006 +
3007 + /**
3008 + * posix_clock_unregister() - unregister a clock
3009 +diff --git a/include/linux/quota.h b/include/linux/quota.h
3010 +index f32dd270b8e3..27aab84fcbaa 100644
3011 +--- a/include/linux/quota.h
3012 ++++ b/include/linux/quota.h
3013 +@@ -263,7 +263,7 @@ enum {
3014 + };
3015 +
3016 + struct dqstats {
3017 +- int stat[_DQST_DQSTAT_LAST];
3018 ++ unsigned long stat[_DQST_DQSTAT_LAST];
3019 + struct percpu_counter counter[_DQST_DQSTAT_LAST];
3020 + };
3021 +
3022 +diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
3023 +index bc8206a8f30e..61974c4c566b 100644
3024 +--- a/include/linux/rculist_nulls.h
3025 ++++ b/include/linux/rculist_nulls.h
3026 +@@ -100,6 +100,43 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
3027 + first->pprev = &n->next;
3028 + }
3029 +
3030 ++/**
3031 ++ * hlist_nulls_add_tail_rcu
3032 ++ * @n: the element to add to the hash list.
3033 ++ * @h: the list to add to.
3034 ++ *
3035 ++ * Description:
3036 ++ * Adds the specified element to the specified hlist_nulls,
3037 ++ * while permitting racing traversals.
3038 ++ *
3039 ++ * The caller must take whatever precautions are necessary
3040 ++ * (such as holding appropriate locks) to avoid racing
3041 ++ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu()
3042 ++ * or hlist_nulls_del_rcu(), running on this same list.
3043 ++ * However, it is perfectly legal to run concurrently with
3044 ++ * the _rcu list-traversal primitives, such as
3045 ++ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency
3046 ++ * problems on Alpha CPUs. Regardless of the type of CPU, the
3047 ++ * list-traversal primitive must be guarded by rcu_read_lock().
3048 ++ */
3049 ++static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
3050 ++ struct hlist_nulls_head *h)
3051 ++{
3052 ++ struct hlist_nulls_node *i, *last = NULL;
3053 ++
3054 ++ /* Note: write side code, so rcu accessors are not needed. */
3055 ++ for (i = h->first; !is_a_nulls(i); i = i->next)
3056 ++ last = i;
3057 ++
3058 ++ if (last) {
3059 ++ n->next = last->next;
3060 ++ n->pprev = &last->next;
3061 ++ rcu_assign_pointer(hlist_next_rcu(last), n);
3062 ++ } else {
3063 ++ hlist_nulls_add_head_rcu(n, h);
3064 ++ }
3065 ++}
3066 ++
3067 + /**
3068 + * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type
3069 + * @tpos: the type * to use as a loop cursor.
3070 +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
3071 +index 80c3da1aa8b1..25407c206e73 100644
3072 +--- a/include/linux/skbuff.h
3073 ++++ b/include/linux/skbuff.h
3074 +@@ -1669,7 +1669,7 @@ static inline struct sk_buff *skb_peek_next(struct sk_buff *skb,
3075 + */
3076 + static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_)
3077 + {
3078 +- struct sk_buff *skb = list_->prev;
3079 ++ struct sk_buff *skb = READ_ONCE(list_->prev);
3080 +
3081 + if (skb == (struct sk_buff *)list_)
3082 + skb = NULL;
3083 +@@ -1737,7 +1737,9 @@ static inline void __skb_insert(struct sk_buff *newsk,
3084 + struct sk_buff *prev, struct sk_buff *next,
3085 + struct sk_buff_head *list)
3086 + {
3087 +- /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */
3088 ++ /* See skb_queue_empty_lockless() and skb_peek_tail()
3089 ++ * for the opposite READ_ONCE()
3090 ++ */
3091 + WRITE_ONCE(newsk->next, next);
3092 + WRITE_ONCE(newsk->prev, prev);
3093 + WRITE_ONCE(next->prev, newsk);
3094 +diff --git a/include/net/dst.h b/include/net/dst.h
3095 +index 851cf1124240..35ae45fa0758 100644
3096 +--- a/include/net/dst.h
3097 ++++ b/include/net/dst.h
3098 +@@ -527,7 +527,16 @@ static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu)
3099 + struct dst_entry *dst = skb_dst(skb);
3100 +
3101 + if (dst && dst->ops->update_pmtu)
3102 +- dst->ops->update_pmtu(dst, NULL, skb, mtu);
3103 ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, true);
3104 ++}
3105 ++
3106 ++/* update dst pmtu but not do neighbor confirm */
3107 ++static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu)
3108 ++{
3109 ++ struct dst_entry *dst = skb_dst(skb);
3110 ++
3111 ++ if (dst && dst->ops->update_pmtu)
3112 ++ dst->ops->update_pmtu(dst, NULL, skb, mtu, false);
3113 + }
3114 +
3115 + static inline void skb_tunnel_check_pmtu(struct sk_buff *skb,
3116 +@@ -537,7 +546,7 @@ static inline void skb_tunnel_check_pmtu(struct sk_buff *skb,
3117 + u32 encap_mtu = dst_mtu(encap_dst);
3118 +
3119 + if (skb->len > encap_mtu - headroom)
3120 +- skb_dst_update_pmtu(skb, encap_mtu - headroom);
3121 ++ skb_dst_update_pmtu_no_confirm(skb, encap_mtu - headroom);
3122 + }
3123 +
3124 + #endif /* _NET_DST_H */
3125 +diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
3126 +index 5ec645f27ee3..443863c7b8da 100644
3127 +--- a/include/net/dst_ops.h
3128 ++++ b/include/net/dst_ops.h
3129 +@@ -27,7 +27,8 @@ struct dst_ops {
3130 + struct dst_entry * (*negative_advice)(struct dst_entry *);
3131 + void (*link_failure)(struct sk_buff *);
3132 + void (*update_pmtu)(struct dst_entry *dst, struct sock *sk,
3133 +- struct sk_buff *skb, u32 mtu);
3134 ++ struct sk_buff *skb, u32 mtu,
3135 ++ bool confirm_neigh);
3136 + void (*redirect)(struct dst_entry *dst, struct sock *sk,
3137 + struct sk_buff *skb);
3138 + int (*local_out)(struct net *net, struct sock *sk, struct sk_buff *skb);
3139 +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
3140 +index 9141e95529e7..b875dcef173c 100644
3141 +--- a/include/net/inet_hashtables.h
3142 ++++ b/include/net/inet_hashtables.h
3143 +@@ -106,13 +106,19 @@ struct inet_bind_hashbucket {
3144 + struct hlist_head chain;
3145 + };
3146 +
3147 +-/*
3148 +- * Sockets can be hashed in established or listening table
3149 ++/* Sockets can be hashed in established or listening table.
3150 ++ * We must use different 'nulls' end-of-chain value for all hash buckets :
3151 ++ * A socket might transition from ESTABLISH to LISTEN state without
3152 ++ * RCU grace period. A lookup in ehash table needs to handle this case.
3153 + */
3154 ++#define LISTENING_NULLS_BASE (1U << 29)
3155 + struct inet_listen_hashbucket {
3156 + spinlock_t lock;
3157 + unsigned int count;
3158 +- struct hlist_head head;
3159 ++ union {
3160 ++ struct hlist_head head;
3161 ++ struct hlist_nulls_head nulls_head;
3162 ++ };
3163 + };
3164 +
3165 + /* This is for listening sockets, thus all sockets which possess wildcards. */
3166 +diff --git a/include/net/sock.h b/include/net/sock.h
3167 +index 4545a9ecc219..f359e5c94762 100644
3168 +--- a/include/net/sock.h
3169 ++++ b/include/net/sock.h
3170 +@@ -721,6 +721,11 @@ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_h
3171 + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
3172 + }
3173 +
3174 ++static inline void __sk_nulls_add_node_tail_rcu(struct sock *sk, struct hlist_nulls_head *list)
3175 ++{
3176 ++ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
3177 ++}
3178 ++
3179 + static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
3180 + {
3181 + sock_hold(sk);
3182 +diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h
3183 +index df156f1d50b2..f0a01a54bd15 100644
3184 +--- a/include/scsi/iscsi_proto.h
3185 ++++ b/include/scsi/iscsi_proto.h
3186 +@@ -638,6 +638,7 @@ struct iscsi_reject {
3187 + #define ISCSI_REASON_BOOKMARK_INVALID 9
3188 + #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10
3189 + #define ISCSI_REASON_NEGOTIATION_RESET 11
3190 ++#define ISCSI_REASON_WAITING_FOR_LOGOUT 12
3191 +
3192 + /* Max. number of Key=Value pairs in a text message */
3193 + #define MAX_KEY_VALUE_PAIRS 8192
3194 +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
3195 +index c007d25bee09..3a2397444076 100644
3196 +--- a/kernel/dma/debug.c
3197 ++++ b/kernel/dma/debug.c
3198 +@@ -442,6 +442,7 @@ void debug_dma_dump_mappings(struct device *dev)
3199 + }
3200 +
3201 + spin_unlock_irqrestore(&bucket->lock, flags);
3202 ++ cond_resched();
3203 + }
3204 + }
3205 +
3206 +diff --git a/kernel/sysctl.c b/kernel/sysctl.c
3207 +index f8576509c7be..4c4fd4339d33 100644
3208 +--- a/kernel/sysctl.c
3209 ++++ b/kernel/sysctl.c
3210 +@@ -1411,7 +1411,7 @@ static struct ctl_table vm_table[] = {
3211 + .procname = "drop_caches",
3212 + .data = &sysctl_drop_caches,
3213 + .maxlen = sizeof(int),
3214 +- .mode = 0644,
3215 ++ .mode = 0200,
3216 + .proc_handler = drop_caches_sysctl_handler,
3217 + .extra1 = &one,
3218 + .extra2 = &four,
3219 +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
3220 +index e1a549c9e399..7362554416fd 100644
3221 +--- a/kernel/time/hrtimer.c
3222 ++++ b/kernel/time/hrtimer.c
3223 +@@ -955,7 +955,8 @@ static int enqueue_hrtimer(struct hrtimer *timer,
3224 +
3225 + base->cpu_base->active_bases |= 1 << base->index;
3226 +
3227 +- timer->state = HRTIMER_STATE_ENQUEUED;
3228 ++ /* Pairs with the lockless read in hrtimer_is_queued() */
3229 ++ WRITE_ONCE(timer->state, HRTIMER_STATE_ENQUEUED);
3230 +
3231 + return timerqueue_add(&base->active, &timer->node);
3232 + }
3233 +@@ -977,7 +978,8 @@ static void __remove_hrtimer(struct hrtimer *timer,
3234 + struct hrtimer_cpu_base *cpu_base = base->cpu_base;
3235 + u8 state = timer->state;
3236 +
3237 +- timer->state = newstate;
3238 ++ /* Pairs with the lockless read in hrtimer_is_queued() */
3239 ++ WRITE_ONCE(timer->state, newstate);
3240 + if (!(state & HRTIMER_STATE_ENQUEUED))
3241 + return;
3242 +
3243 +@@ -1002,8 +1004,9 @@ static void __remove_hrtimer(struct hrtimer *timer,
3244 + static inline int
3245 + remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
3246 + {
3247 +- if (hrtimer_is_queued(timer)) {
3248 +- u8 state = timer->state;
3249 ++ u8 state = timer->state;
3250 ++
3251 ++ if (state & HRTIMER_STATE_ENQUEUED) {
3252 + int reprogram;
3253 +
3254 + /*
3255 +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
3256 +index fe56c4e06c51..c8a8501fae5b 100644
3257 +--- a/kernel/time/posix-clock.c
3258 ++++ b/kernel/time/posix-clock.c
3259 +@@ -27,8 +27,6 @@
3260 +
3261 + #include "posix-timers.h"
3262 +
3263 +-static void delete_clock(struct kref *kref);
3264 +-
3265 + /*
3266 + * Returns NULL if the posix_clock instance attached to 'fp' is old and stale.
3267 + */
3268 +@@ -138,7 +136,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
3269 + err = 0;
3270 +
3271 + if (!err) {
3272 +- kref_get(&clk->kref);
3273 ++ get_device(clk->dev);
3274 + fp->private_data = clk;
3275 + }
3276 + out:
3277 +@@ -154,7 +152,7 @@ static int posix_clock_release(struct inode *inode, struct file *fp)
3278 + if (clk->ops.release)
3279 + err = clk->ops.release(clk);
3280 +
3281 +- kref_put(&clk->kref, delete_clock);
3282 ++ put_device(clk->dev);
3283 +
3284 + fp->private_data = NULL;
3285 +
3286 +@@ -174,38 +172,35 @@ static const struct file_operations posix_clock_file_operations = {
3287 + #endif
3288 + };
3289 +
3290 +-int posix_clock_register(struct posix_clock *clk, dev_t devid)
3291 ++int posix_clock_register(struct posix_clock *clk, struct device *dev)
3292 + {
3293 + int err;
3294 +
3295 +- kref_init(&clk->kref);
3296 + init_rwsem(&clk->rwsem);
3297 +
3298 + cdev_init(&clk->cdev, &posix_clock_file_operations);
3299 ++ err = cdev_device_add(&clk->cdev, dev);
3300 ++ if (err) {
3301 ++ pr_err("%s unable to add device %d:%d\n",
3302 ++ dev_name(dev), MAJOR(dev->devt), MINOR(dev->devt));
3303 ++ return err;
3304 ++ }
3305 + clk->cdev.owner = clk->ops.owner;
3306 +- err = cdev_add(&clk->cdev, devid, 1);
3307 ++ clk->dev = dev;
3308 +
3309 +- return err;
3310 ++ return 0;
3311 + }
3312 + EXPORT_SYMBOL_GPL(posix_clock_register);
3313 +
3314 +-static void delete_clock(struct kref *kref)
3315 +-{
3316 +- struct posix_clock *clk = container_of(kref, struct posix_clock, kref);
3317 +-
3318 +- if (clk->release)
3319 +- clk->release(clk);
3320 +-}
3321 +-
3322 + void posix_clock_unregister(struct posix_clock *clk)
3323 + {
3324 +- cdev_del(&clk->cdev);
3325 ++ cdev_device_del(&clk->cdev, clk->dev);
3326 +
3327 + down_write(&clk->rwsem);
3328 + clk->zombie = true;
3329 + up_write(&clk->rwsem);
3330 +
3331 +- kref_put(&clk->kref, delete_clock);
3332 ++ put_device(clk->dev);
3333 + }
3334 + EXPORT_SYMBOL_GPL(posix_clock_unregister);
3335 +
3336 +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
3337 +index 212c184c1eee..ccab290c14d4 100644
3338 +--- a/net/bridge/br_netfilter_hooks.c
3339 ++++ b/net/bridge/br_netfilter_hooks.c
3340 +@@ -646,6 +646,9 @@ static unsigned int br_nf_forward_arp(void *priv,
3341 + nf_bridge_pull_encap_header(skb);
3342 + }
3343 +
3344 ++ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
3345 ++ return NF_DROP;
3346 ++
3347 + if (arp_hdr(skb)->ar_pln != 4) {
3348 + if (IS_VLAN_ARP(skb))
3349 + nf_bridge_push_encap_header(skb);
3350 +diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c
3351 +index 8e2d7cfa4e16..d88e724d5755 100644
3352 +--- a/net/bridge/br_nf_core.c
3353 ++++ b/net/bridge/br_nf_core.c
3354 +@@ -26,7 +26,8 @@
3355 + #endif
3356 +
3357 + static void fake_update_pmtu(struct dst_entry *dst, struct sock *sk,
3358 +- struct sk_buff *skb, u32 mtu)
3359 ++ struct sk_buff *skb, u32 mtu,
3360 ++ bool confirm_neigh)
3361 + {
3362 + }
3363 +
3364 +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
3365 +index 7d249afa1466..785e19afd6aa 100644
3366 +--- a/net/bridge/netfilter/ebtables.c
3367 ++++ b/net/bridge/netfilter/ebtables.c
3368 +@@ -1876,7 +1876,7 @@ static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
3369 + }
3370 +
3371 + static int ebt_buf_add(struct ebt_entries_buf_state *state,
3372 +- void *data, unsigned int sz)
3373 ++ const void *data, unsigned int sz)
3374 + {
3375 + if (state->buf_kern_start == NULL)
3376 + goto count_only;
3377 +@@ -1910,7 +1910,7 @@ enum compat_mwt {
3378 + EBT_COMPAT_TARGET,
3379 + };
3380 +
3381 +-static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
3382 ++static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,
3383 + enum compat_mwt compat_mwt,
3384 + struct ebt_entries_buf_state *state,
3385 + const unsigned char *base)
3386 +@@ -1988,22 +1988,23 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
3387 + /* return size of all matches, watchers or target, including necessary
3388 + * alignment and padding.
3389 + */
3390 +-static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
3391 ++static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32,
3392 + unsigned int size_left, enum compat_mwt type,
3393 + struct ebt_entries_buf_state *state, const void *base)
3394 + {
3395 ++ const char *buf = (const char *)match32;
3396 + int growth = 0;
3397 +- char *buf;
3398 +
3399 + if (size_left == 0)
3400 + return 0;
3401 +
3402 +- buf = (char *) match32;
3403 +-
3404 +- while (size_left >= sizeof(*match32)) {
3405 ++ do {
3406 + struct ebt_entry_match *match_kern;
3407 + int ret;
3408 +
3409 ++ if (size_left < sizeof(*match32))
3410 ++ return -EINVAL;
3411 ++
3412 + match_kern = (struct ebt_entry_match *) state->buf_kern_start;
3413 + if (match_kern) {
3414 + char *tmp;
3415 +@@ -2040,22 +2041,18 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
3416 + if (match_kern)
3417 + match_kern->match_size = ret;
3418 +
3419 +- /* rule should have no remaining data after target */
3420 +- if (type == EBT_COMPAT_TARGET && size_left)
3421 +- return -EINVAL;
3422 +-
3423 + match32 = (struct compat_ebt_entry_mwt *) buf;
3424 +- }
3425 ++ } while (size_left);
3426 +
3427 + return growth;
3428 + }
3429 +
3430 + /* called for all ebt_entry structures. */
3431 +-static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
3432 ++static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base,
3433 + unsigned int *total,
3434 + struct ebt_entries_buf_state *state)
3435 + {
3436 +- unsigned int i, j, startoff, new_offset = 0;
3437 ++ unsigned int i, j, startoff, next_expected_off, new_offset = 0;
3438 + /* stores match/watchers/targets & offset of next struct ebt_entry: */
3439 + unsigned int offsets[4];
3440 + unsigned int *offsets_update = NULL;
3441 +@@ -2141,11 +2138,13 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
3442 + return ret;
3443 + }
3444 +
3445 +- startoff = state->buf_user_offset - startoff;
3446 ++ next_expected_off = state->buf_user_offset - startoff;
3447 ++ if (next_expected_off != entry->next_offset)
3448 ++ return -EINVAL;
3449 +
3450 +- if (WARN_ON(*total < startoff))
3451 ++ if (*total < entry->next_offset)
3452 + return -EINVAL;
3453 +- *total -= startoff;
3454 ++ *total -= entry->next_offset;
3455 + return 0;
3456 + }
3457 +
3458 +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
3459 +index d67ec17f2cc8..6cec08cd0bb9 100644
3460 +--- a/net/core/sysctl_net_core.c
3461 ++++ b/net/core/sysctl_net_core.c
3462 +@@ -281,6 +281,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write,
3463 + return ret;
3464 + }
3465 +
3466 ++# ifdef CONFIG_HAVE_EBPF_JIT
3467 + static int
3468 + proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
3469 + void __user *buffer, size_t *lenp,
3470 +@@ -291,6 +292,7 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
3471 +
3472 + return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
3473 + }
3474 ++# endif /* CONFIG_HAVE_EBPF_JIT */
3475 +
3476 + static int
3477 + proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write,
3478 +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
3479 +index 1c002c0fb712..658191fba94e 100644
3480 +--- a/net/decnet/dn_route.c
3481 ++++ b/net/decnet/dn_route.c
3482 +@@ -118,7 +118,8 @@ static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how);
3483 + static struct dst_entry *dn_dst_negative_advice(struct dst_entry *);
3484 + static void dn_dst_link_failure(struct sk_buff *);
3485 + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
3486 +- struct sk_buff *skb , u32 mtu);
3487 ++ struct sk_buff *skb , u32 mtu,
3488 ++ bool confirm_neigh);
3489 + static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
3490 + struct sk_buff *skb);
3491 + static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
3492 +@@ -259,7 +260,8 @@ static int dn_dst_gc(struct dst_ops *ops)
3493 + * advertise to the other end).
3494 + */
3495 + static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
3496 +- struct sk_buff *skb, u32 mtu)
3497 ++ struct sk_buff *skb, u32 mtu,
3498 ++ bool confirm_neigh)
3499 + {
3500 + struct dn_route *rt = (struct dn_route *) dst;
3501 + struct neighbour *n = rt->n;
3502 +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
3503 +index 0167e23d1c8f..4efa5e33513e 100644
3504 +--- a/net/ipv4/icmp.c
3505 ++++ b/net/ipv4/icmp.c
3506 +@@ -254,10 +254,11 @@ bool icmp_global_allow(void)
3507 + bool rc = false;
3508 +
3509 + /* Check if token bucket is empty and cannot be refilled
3510 +- * without taking the spinlock.
3511 ++ * without taking the spinlock. The READ_ONCE() are paired
3512 ++ * with the following WRITE_ONCE() in this same function.
3513 + */
3514 +- if (!icmp_global.credit) {
3515 +- delta = min_t(u32, now - icmp_global.stamp, HZ);
3516 ++ if (!READ_ONCE(icmp_global.credit)) {
3517 ++ delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ);
3518 + if (delta < HZ / 50)
3519 + return false;
3520 + }
3521 +@@ -267,14 +268,14 @@ bool icmp_global_allow(void)
3522 + if (delta >= HZ / 50) {
3523 + incr = sysctl_icmp_msgs_per_sec * delta / HZ ;
3524 + if (incr)
3525 +- icmp_global.stamp = now;
3526 ++ WRITE_ONCE(icmp_global.stamp, now);
3527 + }
3528 + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
3529 + if (credit) {
3530 + credit--;
3531 + rc = true;
3532 + }
3533 +- icmp_global.credit = credit;
3534 ++ WRITE_ONCE(icmp_global.credit, credit);
3535 + spin_unlock(&icmp_global.lock);
3536 + return rc;
3537 + }
3538 +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
3539 +index 15e7f7915a21..636a11c56cf5 100644
3540 +--- a/net/ipv4/inet_connection_sock.c
3541 ++++ b/net/ipv4/inet_connection_sock.c
3542 +@@ -1089,7 +1089,7 @@ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu)
3543 + if (!dst)
3544 + goto out;
3545 + }
3546 +- dst->ops->update_pmtu(dst, sk, NULL, mtu);
3547 ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true);
3548 +
3549 + dst = __sk_dst_check(sk, 0);
3550 + if (!dst)
3551 +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
3552 +index 5731670c560b..9742b37afe1d 100644
3553 +--- a/net/ipv4/inet_diag.c
3554 ++++ b/net/ipv4/inet_diag.c
3555 +@@ -918,11 +918,12 @@ void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb,
3556 +
3557 + for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
3558 + struct inet_listen_hashbucket *ilb;
3559 ++ struct hlist_nulls_node *node;
3560 +
3561 + num = 0;
3562 + ilb = &hashinfo->listening_hash[i];
3563 + spin_lock(&ilb->lock);
3564 +- sk_for_each(sk, &ilb->head) {
3565 ++ sk_nulls_for_each(sk, node, &ilb->nulls_head) {
3566 + struct inet_sock *inet = inet_sk(sk);
3567 +
3568 + if (!net_eq(sock_net(sk), net))
3569 +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
3570 +index 7be966a60801..b53da2691adb 100644
3571 +--- a/net/ipv4/inet_hashtables.c
3572 ++++ b/net/ipv4/inet_hashtables.c
3573 +@@ -308,6 +308,7 @@ struct sock *__inet_lookup_listener(struct net *net,
3574 + bool exact_dif = inet_exact_dif_match(net, skb);
3575 + struct inet_listen_hashbucket *ilb2;
3576 + struct sock *sk, *result = NULL;
3577 ++ struct hlist_nulls_node *node;
3578 + int score, hiscore = 0;
3579 + unsigned int hash2;
3580 + u32 phash = 0;
3581 +@@ -343,7 +344,7 @@ struct sock *__inet_lookup_listener(struct net *net,
3582 + goto done;
3583 +
3584 + port_lookup:
3585 +- sk_for_each_rcu(sk, &ilb->head) {
3586 ++ sk_nulls_for_each_rcu(sk, node, &ilb->nulls_head) {
3587 + score = compute_score(sk, net, hnum, daddr,
3588 + dif, sdif, exact_dif);
3589 + if (score > hiscore) {
3590 +@@ -560,10 +561,11 @@ static int inet_reuseport_add_sock(struct sock *sk,
3591 + struct inet_listen_hashbucket *ilb)
3592 + {
3593 + struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash;
3594 ++ const struct hlist_nulls_node *node;
3595 + struct sock *sk2;
3596 + kuid_t uid = sock_i_uid(sk);
3597 +
3598 +- sk_for_each_rcu(sk2, &ilb->head) {
3599 ++ sk_nulls_for_each_rcu(sk2, node, &ilb->nulls_head) {
3600 + if (sk2 != sk &&
3601 + sk2->sk_family == sk->sk_family &&
3602 + ipv6_only_sock(sk2) == ipv6_only_sock(sk) &&
3603 +@@ -599,9 +601,9 @@ int __inet_hash(struct sock *sk, struct sock *osk)
3604 + }
3605 + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
3606 + sk->sk_family == AF_INET6)
3607 +- hlist_add_tail_rcu(&sk->sk_node, &ilb->head);
3608 ++ __sk_nulls_add_node_tail_rcu(sk, &ilb->nulls_head);
3609 + else
3610 +- hlist_add_head_rcu(&sk->sk_node, &ilb->head);
3611 ++ __sk_nulls_add_node_rcu(sk, &ilb->nulls_head);
3612 + inet_hash2(hashinfo, sk);
3613 + ilb->count++;
3614 + sock_set_flag(sk, SOCK_RCU_FREE);
3615 +@@ -650,11 +652,9 @@ void inet_unhash(struct sock *sk)
3616 + reuseport_detach_sock(sk);
3617 + if (ilb) {
3618 + inet_unhash2(hashinfo, sk);
3619 +- __sk_del_node_init(sk);
3620 +- ilb->count--;
3621 +- } else {
3622 +- __sk_nulls_del_node_init_rcu(sk);
3623 ++ ilb->count--;
3624 + }
3625 ++ __sk_nulls_del_node_init_rcu(sk);
3626 + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
3627 + unlock:
3628 + spin_unlock_bh(lock);
3629 +@@ -790,7 +790,8 @@ void inet_hashinfo_init(struct inet_hashinfo *h)
3630 +
3631 + for (i = 0; i < INET_LHTABLE_SIZE; i++) {
3632 + spin_lock_init(&h->listening_hash[i].lock);
3633 +- INIT_HLIST_HEAD(&h->listening_hash[i].head);
3634 ++ INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].nulls_head,
3635 ++ i + LISTENING_NULLS_BASE);
3636 + h->listening_hash[i].count = 0;
3637 + }
3638 +
3639 +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
3640 +index be778599bfed..ff327a62c9ce 100644
3641 +--- a/net/ipv4/inetpeer.c
3642 ++++ b/net/ipv4/inetpeer.c
3643 +@@ -160,7 +160,12 @@ static void inet_peer_gc(struct inet_peer_base *base,
3644 + base->total / inet_peer_threshold * HZ;
3645 + for (i = 0; i < gc_cnt; i++) {
3646 + p = gc_stack[i];
3647 +- delta = (__u32)jiffies - p->dtime;
3648 ++
3649 ++ /* The READ_ONCE() pairs with the WRITE_ONCE()
3650 ++ * in inet_putpeer()
3651 ++ */
3652 ++ delta = (__u32)jiffies - READ_ONCE(p->dtime);
3653 ++
3654 + if (delta < ttl || !refcount_dec_if_one(&p->refcnt))
3655 + gc_stack[i] = NULL;
3656 + }
3657 +@@ -237,7 +242,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer);
3658 +
3659 + void inet_putpeer(struct inet_peer *p)
3660 + {
3661 +- p->dtime = (__u32)jiffies;
3662 ++ /* The WRITE_ONCE() pairs with itself (we run lockless)
3663 ++ * and the READ_ONCE() in inet_peer_gc()
3664 ++ */
3665 ++ WRITE_ONCE(p->dtime, (__u32)jiffies);
3666 +
3667 + if (refcount_dec_and_test(&p->refcnt))
3668 + call_rcu(&p->rcu, inetpeer_free_rcu);
3669 +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
3670 +index 054d01c16dc6..420e891ac59d 100644
3671 +--- a/net/ipv4/ip_tunnel.c
3672 ++++ b/net/ipv4/ip_tunnel.c
3673 +@@ -513,7 +513,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
3674 + else
3675 + mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
3676 +
3677 +- skb_dst_update_pmtu(skb, mtu);
3678 ++ skb_dst_update_pmtu_no_confirm(skb, mtu);
3679 +
3680 + if (skb->protocol == htons(ETH_P_IP)) {
3681 + if (!skb_is_gso(skb) &&
3682 +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
3683 +index 808f8d15c519..960f4faaf294 100644
3684 +--- a/net/ipv4/ip_vti.c
3685 ++++ b/net/ipv4/ip_vti.c
3686 +@@ -235,7 +235,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
3687 +
3688 + mtu = dst_mtu(dst);
3689 + if (skb->len > mtu) {
3690 +- skb_dst_update_pmtu(skb, mtu);
3691 ++ skb_dst_update_pmtu_no_confirm(skb, mtu);
3692 + if (skb->protocol == htons(ETH_P_IP)) {
3693 + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
3694 + htonl(mtu));
3695 +diff --git a/net/ipv4/route.c b/net/ipv4/route.c
3696 +index 69127f6039b2..4590af506244 100644
3697 +--- a/net/ipv4/route.c
3698 ++++ b/net/ipv4/route.c
3699 +@@ -142,7 +142,8 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst);
3700 + static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
3701 + static void ipv4_link_failure(struct sk_buff *skb);
3702 + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
3703 +- struct sk_buff *skb, u32 mtu);
3704 ++ struct sk_buff *skb, u32 mtu,
3705 ++ bool confirm_neigh);
3706 + static void ip_do_redirect(struct dst_entry *dst, struct sock *sk,
3707 + struct sk_buff *skb);
3708 + static void ipv4_dst_destroy(struct dst_entry *dst);
3709 +@@ -1035,7 +1036,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
3710 + }
3711 +
3712 + static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
3713 +- struct sk_buff *skb, u32 mtu)
3714 ++ struct sk_buff *skb, u32 mtu,
3715 ++ bool confirm_neigh)
3716 + {
3717 + struct rtable *rt = (struct rtable *) dst;
3718 + struct flowi4 fl4;
3719 +@@ -2559,7 +2561,8 @@ static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
3720 + }
3721 +
3722 + static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
3723 +- struct sk_buff *skb, u32 mtu)
3724 ++ struct sk_buff *skb, u32 mtu,
3725 ++ bool confirm_neigh)
3726 + {
3727 + }
3728 +
3729 +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
3730 +index bfec48849735..5553f6a833f3 100644
3731 +--- a/net/ipv4/tcp_ipv4.c
3732 ++++ b/net/ipv4/tcp_ipv4.c
3733 +@@ -2020,13 +2020,14 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
3734 + struct tcp_iter_state *st = seq->private;
3735 + struct net *net = seq_file_net(seq);
3736 + struct inet_listen_hashbucket *ilb;
3737 ++ struct hlist_nulls_node *node;
3738 + struct sock *sk = cur;
3739 +
3740 + if (!sk) {
3741 + get_head:
3742 + ilb = &tcp_hashinfo.listening_hash[st->bucket];
3743 + spin_lock(&ilb->lock);
3744 +- sk = sk_head(&ilb->head);
3745 ++ sk = sk_nulls_head(&ilb->nulls_head);
3746 + st->offset = 0;
3747 + goto get_sk;
3748 + }
3749 +@@ -2034,9 +2035,9 @@ get_head:
3750 + ++st->num;
3751 + ++st->offset;
3752 +
3753 +- sk = sk_next(sk);
3754 ++ sk = sk_nulls_next(sk);
3755 + get_sk:
3756 +- sk_for_each_from(sk) {
3757 ++ sk_nulls_for_each_from(sk, node) {
3758 + if (!net_eq(sock_net(sk), net))
3759 + continue;
3760 + if (sk->sk_family == afinfo->family)
3761 +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
3762 +index ad787e7882f7..1cc20edf4762 100644
3763 +--- a/net/ipv4/tcp_output.c
3764 ++++ b/net/ipv4/tcp_output.c
3765 +@@ -60,6 +60,9 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
3766 + __skb_unlink(skb, &sk->sk_write_queue);
3767 + tcp_rbtree_insert(&sk->tcp_rtx_queue, skb);
3768 +
3769 ++ if (tp->highest_sack == NULL)
3770 ++ tp->highest_sack = skb;
3771 ++
3772 + tp->packets_out += tcp_skb_pcount(skb);
3773 + if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
3774 + tcp_rearm_rto(sk);
3775 +@@ -2373,6 +2376,14 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
3776 + if (tcp_small_queue_check(sk, skb, 0))
3777 + break;
3778 +
3779 ++ /* Argh, we hit an empty skb(), presumably a thread
3780 ++ * is sleeping in sendmsg()/sk_stream_wait_memory().
3781 ++ * We do not want to send a pure-ack packet and have
3782 ++ * a strange looking rtx queue with empty packet(s).
3783 ++ */
3784 ++ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq)
3785 ++ break;
3786 ++
3787 + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
3788 + break;
3789 +
3790 +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
3791 +index 8877bd140a0d..2eeae0455b14 100644
3792 +--- a/net/ipv4/udp.c
3793 ++++ b/net/ipv4/udp.c
3794 +@@ -1412,7 +1412,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb)
3795 + * queue contains some other skb
3796 + */
3797 + rmem = atomic_add_return(size, &sk->sk_rmem_alloc);
3798 +- if (rmem > (size + sk->sk_rcvbuf))
3799 ++ if (rmem > (size + (unsigned int)sk->sk_rcvbuf))
3800 + goto uncharge_drop;
3801 +
3802 + spin_lock(&list->lock);
3803 +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
3804 +index 2b144b92ae46..1e5e2e4be0b2 100644
3805 +--- a/net/ipv4/xfrm4_policy.c
3806 ++++ b/net/ipv4/xfrm4_policy.c
3807 +@@ -222,12 +222,13 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
3808 + }
3809 +
3810 + static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk,
3811 +- struct sk_buff *skb, u32 mtu)
3812 ++ struct sk_buff *skb, u32 mtu,
3813 ++ bool confirm_neigh)
3814 + {
3815 + struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
3816 + struct dst_entry *path = xdst->route;
3817 +
3818 +- path->ops->update_pmtu(path, sk, skb, mtu);
3819 ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh);
3820 + }
3821 +
3822 + static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk,
3823 +diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
3824 +index 9a31d13bf180..890adadcda16 100644
3825 +--- a/net/ipv6/inet6_connection_sock.c
3826 ++++ b/net/ipv6/inet6_connection_sock.c
3827 +@@ -150,7 +150,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu)
3828 +
3829 + if (IS_ERR(dst))
3830 + return NULL;
3831 +- dst->ops->update_pmtu(dst, sk, NULL, mtu);
3832 ++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true);
3833 +
3834 + dst = inet6_csk_route_socket(sk, &fl6);
3835 + return IS_ERR(dst) ? NULL : dst;
3836 +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
3837 +index 91d6ea937ffb..d9e2575dad94 100644
3838 +--- a/net/ipv6/inet6_hashtables.c
3839 ++++ b/net/ipv6/inet6_hashtables.c
3840 +@@ -171,6 +171,7 @@ struct sock *inet6_lookup_listener(struct net *net,
3841 + bool exact_dif = inet6_exact_dif_match(net, skb);
3842 + struct inet_listen_hashbucket *ilb2;
3843 + struct sock *sk, *result = NULL;
3844 ++ struct hlist_nulls_node *node;
3845 + int score, hiscore = 0;
3846 + unsigned int hash2;
3847 + u32 phash = 0;
3848 +@@ -206,7 +207,7 @@ struct sock *inet6_lookup_listener(struct net *net,
3849 + goto done;
3850 +
3851 + port_lookup:
3852 +- sk_for_each(sk, &ilb->head) {
3853 ++ sk_nulls_for_each(sk, node, &ilb->nulls_head) {
3854 + score = compute_score(sk, net, hnum, daddr, dif, sdif, exact_dif);
3855 + if (score > hiscore) {
3856 + if (sk->sk_reuseport) {
3857 +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
3858 +index 8fd28edd6ac5..b3515a4f1303 100644
3859 +--- a/net/ipv6/ip6_gre.c
3860 ++++ b/net/ipv6/ip6_gre.c
3861 +@@ -1060,7 +1060,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
3862 +
3863 + /* TooBig packet may have updated dst->dev's mtu */
3864 + if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
3865 +- dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu);
3866 ++ dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu, false);
3867 +
3868 + err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
3869 + NEXTHDR_GRE);
3870 +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
3871 +index d0ad85b8650d..e3b4237b2832 100644
3872 +--- a/net/ipv6/ip6_tunnel.c
3873 ++++ b/net/ipv6/ip6_tunnel.c
3874 +@@ -645,7 +645,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
3875 + if (rel_info > dst_mtu(skb_dst(skb2)))
3876 + goto out;
3877 +
3878 +- skb_dst_update_pmtu(skb2, rel_info);
3879 ++ skb_dst_update_pmtu_no_confirm(skb2, rel_info);
3880 + }
3881 +
3882 + icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
3883 +@@ -1137,7 +1137,7 @@ route_lookup:
3884 + mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ?
3885 + IPV6_MIN_MTU : IPV4_MIN_MTU);
3886 +
3887 +- skb_dst_update_pmtu(skb, mtu);
3888 ++ skb_dst_update_pmtu_no_confirm(skb, mtu);
3889 + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
3890 + *pmtu = mtu;
3891 + err = -EMSGSIZE;
3892 +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
3893 +index 8b6eefff2f7e..bfd39db3398a 100644
3894 +--- a/net/ipv6/ip6_vti.c
3895 ++++ b/net/ipv6/ip6_vti.c
3896 +@@ -483,7 +483,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
3897 +
3898 + mtu = dst_mtu(dst);
3899 + if (skb->len > mtu) {
3900 +- skb_dst_update_pmtu(skb, mtu);
3901 ++ skb_dst_update_pmtu_no_confirm(skb, mtu);
3902 +
3903 + if (skb->protocol == htons(ETH_P_IPV6)) {
3904 + if (mtu < IPV6_MIN_MTU)
3905 +diff --git a/net/ipv6/route.c b/net/ipv6/route.c
3906 +index 076c21f6a645..f8fe4c9ead4d 100644
3907 +--- a/net/ipv6/route.c
3908 ++++ b/net/ipv6/route.c
3909 +@@ -99,7 +99,8 @@ static int ip6_pkt_prohibit(struct sk_buff *skb);
3910 + static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
3911 + static void ip6_link_failure(struct sk_buff *skb);
3912 + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
3913 +- struct sk_buff *skb, u32 mtu);
3914 ++ struct sk_buff *skb, u32 mtu,
3915 ++ bool confirm_neigh);
3916 + static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
3917 + struct sk_buff *skb);
3918 + static int rt6_score_route(struct fib6_info *rt, int oif, int strict);
3919 +@@ -266,7 +267,8 @@ static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
3920 + }
3921 +
3922 + static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
3923 +- struct sk_buff *skb, u32 mtu)
3924 ++ struct sk_buff *skb, u32 mtu,
3925 ++ bool confirm_neigh)
3926 + {
3927 + }
3928 +
3929 +@@ -2352,7 +2354,8 @@ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
3930 + }
3931 +
3932 + static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
3933 +- const struct ipv6hdr *iph, u32 mtu)
3934 ++ const struct ipv6hdr *iph, u32 mtu,
3935 ++ bool confirm_neigh)
3936 + {
3937 + const struct in6_addr *daddr, *saddr;
3938 + struct rt6_info *rt6 = (struct rt6_info *)dst;
3939 +@@ -2370,7 +2373,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
3940 + daddr = NULL;
3941 + saddr = NULL;
3942 + }
3943 +- dst_confirm_neigh(dst, daddr);
3944 ++
3945 ++ if (confirm_neigh)
3946 ++ dst_confirm_neigh(dst, daddr);
3947 ++
3948 + mtu = max_t(u32, mtu, IPV6_MIN_MTU);
3949 + if (mtu >= dst_mtu(dst))
3950 + return;
3951 +@@ -2401,9 +2407,11 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
3952 + }
3953 +
3954 + static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
3955 +- struct sk_buff *skb, u32 mtu)
3956 ++ struct sk_buff *skb, u32 mtu,
3957 ++ bool confirm_neigh)
3958 + {
3959 +- __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu);
3960 ++ __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu,
3961 ++ confirm_neigh);
3962 + }
3963 +
3964 + void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
3965 +@@ -2423,7 +2431,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
3966 +
3967 + dst = ip6_route_output(net, NULL, &fl6);
3968 + if (!dst->error)
3969 +- __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu));
3970 ++ __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu), true);
3971 + dst_release(dst);
3972 + }
3973 + EXPORT_SYMBOL_GPL(ip6_update_pmtu);
3974 +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
3975 +index 41b3fe8ac3bc..bfed7508ba19 100644
3976 +--- a/net/ipv6/sit.c
3977 ++++ b/net/ipv6/sit.c
3978 +@@ -943,7 +943,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
3979 + }
3980 +
3981 + if (tunnel->parms.iph.daddr)
3982 +- skb_dst_update_pmtu(skb, mtu);
3983 ++ skb_dst_update_pmtu_no_confirm(skb, mtu);
3984 +
3985 + if (skb->len > mtu && !skb_is_gso(skb)) {
3986 + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
3987 +diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
3988 +index d35bcf92969c..30232591cf2b 100644
3989 +--- a/net/ipv6/xfrm6_policy.c
3990 ++++ b/net/ipv6/xfrm6_policy.c
3991 +@@ -221,12 +221,13 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
3992 + }
3993 +
3994 + static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
3995 +- struct sk_buff *skb, u32 mtu)
3996 ++ struct sk_buff *skb, u32 mtu,
3997 ++ bool confirm_neigh)
3998 + {
3999 + struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
4000 + struct dst_entry *path = xdst->route;
4001 +
4002 +- path->ops->update_pmtu(path, sk, skb, mtu);
4003 ++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh);
4004 + }
4005 +
4006 + static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
4007 +diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
4008 +index 473cce2a5231..3f75cd947045 100644
4009 +--- a/net/netfilter/ipvs/ip_vs_xmit.c
4010 ++++ b/net/netfilter/ipvs/ip_vs_xmit.c
4011 +@@ -209,7 +209,7 @@ static inline void maybe_update_pmtu(int skb_af, struct sk_buff *skb, int mtu)
4012 + struct rtable *ort = skb_rtable(skb);
4013 +
4014 + if (!skb->dev && sk && sk_fullsock(sk))
4015 +- ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu);
4016 ++ ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu, true);
4017 + }
4018 +
4019 + static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af,
4020 +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
4021 +index a96a8c16baf9..ee6d98355081 100644
4022 +--- a/net/netfilter/nf_queue.c
4023 ++++ b/net/netfilter/nf_queue.c
4024 +@@ -174,7 +174,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
4025 + goto err;
4026 + }
4027 +
4028 +- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
4029 ++ if (skb_dst(skb) && !skb_dst_force(skb)) {
4030 + status = -ENETDOWN;
4031 + goto err;
4032 + }
4033 +diff --git a/net/sctp/transport.c b/net/sctp/transport.c
4034 +index ad158d311ffa..c0d55ed62d2e 100644
4035 +--- a/net/sctp/transport.c
4036 ++++ b/net/sctp/transport.c
4037 +@@ -278,7 +278,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
4038 +
4039 + pf->af->from_sk(&addr, sk);
4040 + pf->to_sk_daddr(&t->ipaddr, sk);
4041 +- dst->ops->update_pmtu(dst, sk, NULL, pmtu);
4042 ++ dst->ops->update_pmtu(dst, sk, NULL, pmtu, true);
4043 + pf->to_sk_daddr(&addr, sk);
4044 +
4045 + dst = sctp_transport_dst_check(t);
4046 +diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
4047 +index 31ed7f3f0e15..4b2711c23f4e 100644
4048 +--- a/scripts/kallsyms.c
4049 ++++ b/scripts/kallsyms.c
4050 +@@ -491,6 +491,8 @@ static void build_initial_tok_table(void)
4051 + table[pos] = table[i];
4052 + learn_symbol(table[pos].sym, table[pos].len);
4053 + pos++;
4054 ++ } else {
4055 ++ free(table[i].sym);
4056 + }
4057 + }
4058 + table_cnt = pos;
4059 +diff --git a/security/apparmor/label.c b/security/apparmor/label.c
4060 +index ba11bdf9043a..2469549842d2 100644
4061 +--- a/security/apparmor/label.c
4062 ++++ b/security/apparmor/label.c
4063 +@@ -1462,11 +1462,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
4064 + /* helper macro for snprint routines */
4065 + #define update_for_len(total, len, size, str) \
4066 + do { \
4067 ++ size_t ulen = len; \
4068 ++ \
4069 + AA_BUG(len < 0); \
4070 +- total += len; \
4071 +- len = min(len, size); \
4072 +- size -= len; \
4073 +- str += len; \
4074 ++ total += ulen; \
4075 ++ ulen = min(ulen, size); \
4076 ++ size -= ulen; \
4077 ++ str += ulen; \
4078 + } while (0)
4079 +
4080 + /**
4081 +@@ -1601,7 +1603,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
4082 + struct aa_ns *prev_ns = NULL;
4083 + struct label_it i;
4084 + int count = 0, total = 0;
4085 +- size_t len;
4086 ++ ssize_t len;
4087 +
4088 + AA_BUG(!str && size != 0);
4089 + AA_BUG(!label);
4090 +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
4091 +index 8fcb421193e0..fa261b27d858 100644
4092 +--- a/sound/pci/hda/hda_controller.c
4093 ++++ b/sound/pci/hda/hda_controller.c
4094 +@@ -883,7 +883,7 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr,
4095 + return -EAGAIN; /* give a chance to retry */
4096 + }
4097 +
4098 +- dev_WARN(chip->card->dev,
4099 ++ dev_err(chip->card->dev,
4100 + "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n",
4101 + bus->last_cmd[addr]);
4102 + chip->single_cmd = 1;
4103 +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
4104 +index a4c78499c838..1200973c77cb 100644
4105 +--- a/tools/perf/builtin-script.c
4106 ++++ b/tools/perf/builtin-script.c
4107 +@@ -428,7 +428,7 @@ static int perf_evsel__check_attr(struct perf_evsel *evsel,
4108 + "selected. Hence, no address to lookup the source line number.\n");
4109 + return -EINVAL;
4110 + }
4111 +- if (PRINT_FIELD(BRSTACKINSN) &&
4112 ++ if (PRINT_FIELD(BRSTACKINSN) && !allow_user_set &&
4113 + !(perf_evlist__combined_branch_type(session->evlist) &
4114 + PERF_SAMPLE_BRANCH_ANY)) {
4115 + pr_err("Display of branch stack assembler requested, but non all-branch filter set\n"
4116 +diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h
4117 +index c9319f8d17a6..f732e3af2bd4 100644
4118 +--- a/tools/perf/util/perf_regs.h
4119 ++++ b/tools/perf/util/perf_regs.h
4120 +@@ -34,7 +34,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id);
4121 +
4122 + static inline const char *perf_reg_name(int id __maybe_unused)
4123 + {
4124 +- return NULL;
4125 ++ return "unknown";
4126 + }
4127 +
4128 + static inline int perf_reg_value(u64 *valp __maybe_unused,
4129 +diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
4130 +index 9005fbe0780e..23092fd6451d 100644
4131 +--- a/tools/perf/util/strbuf.c
4132 ++++ b/tools/perf/util/strbuf.c
4133 +@@ -109,7 +109,6 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap)
4134 + return ret;
4135 + }
4136 + len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
4137 +- va_end(ap_saved);
4138 + if (len > strbuf_avail(sb)) {
4139 + pr_debug("this should not happen, your vsnprintf is broken");
4140 + va_end(ap_saved);