Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.19 commit in: /
Date: Thu, 03 Sep 2020 11:37:27
Message-Id: 1599133027.9780c46f4fc87bbda21ddef0d0f91e988ef7eae5.mpagano@gentoo
1 commit: 9780c46f4fc87bbda21ddef0d0f91e988ef7eae5
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Thu Sep 3 11:37:07 2020 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Thu Sep 3 11:37:07 2020 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9780c46f
7
8 Linux patch 4.19.143
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1142_linux-4.19.143.patch | 4522 +++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 4526 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index 4adb8c6..f31a3e5 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -607,6 +607,10 @@ Patch: 1141_linux-4.19.142.patch
21 From: https://www.kernel.org
22 Desc: Linux 4.19.142
23
24 +Patch: 1142_linux-4.19.143.patch
25 +From: https://www.kernel.org
26 +Desc: Linux 4.19.143
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1142_linux-4.19.143.patch b/1142_linux-4.19.143.patch
33 new file mode 100644
34 index 0000000..8f19ed2
35 --- /dev/null
36 +++ b/1142_linux-4.19.143.patch
37 @@ -0,0 +1,4522 @@
38 +diff --git a/Makefile b/Makefile
39 +index e5e46aecf357f..6fa3278df77c9 100644
40 +--- a/Makefile
41 ++++ b/Makefile
42 +@@ -1,7 +1,7 @@
43 + # SPDX-License-Identifier: GPL-2.0
44 + VERSION = 4
45 + PATCHLEVEL = 19
46 +-SUBLEVEL = 142
47 ++SUBLEVEL = 143
48 + EXTRAVERSION =
49 + NAME = "People's Front"
50 +
51 +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
52 +index 074b4ec520c63..d18c043264440 100644
53 +--- a/arch/arm/boot/dts/ls1021a.dtsi
54 ++++ b/arch/arm/boot/dts/ls1021a.dtsi
55 +@@ -609,7 +609,7 @@
56 + fsl,tmr-prsc = <2>;
57 + fsl,tmr-add = <0xaaaaaaab>;
58 + fsl,tmr-fiper1 = <999999995>;
59 +- fsl,tmr-fiper2 = <99990>;
60 ++ fsl,tmr-fiper2 = <999999995>;
61 + fsl,max-adj = <499999999>;
62 + };
63 +
64 +diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
65 +index 60d218c5275c1..6754817658fa4 100644
66 +--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
67 ++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
68 +@@ -529,7 +529,7 @@
69 + pins = "gpio63", "gpio64", "gpio65", "gpio66",
70 + "gpio67", "gpio68";
71 + drive-strength = <2>;
72 +- bias-disable;
73 ++ bias-pull-down;
74 + };
75 + };
76 + };
77 +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
78 +index f3978931aaf40..3cdefd84af545 100644
79 +--- a/arch/arm64/kvm/hyp/switch.c
80 ++++ b/arch/arm64/kvm/hyp/switch.c
81 +@@ -626,7 +626,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par,
82 + * making sure it is a kernel address and not a PC-relative
83 + * reference.
84 + */
85 +- asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va));
86 ++ asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string));
87 +
88 + __hyp_do_panic(str_va,
89 + spsr, elr,
90 +diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
91 +index 530a36f465ced..afcc86726448e 100644
92 +--- a/arch/mips/vdso/genvdso.c
93 ++++ b/arch/mips/vdso/genvdso.c
94 +@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size)
95 + if (fstat(fd, &stat) != 0) {
96 + fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
97 + path, strerror(errno));
98 ++ close(fd);
99 + return NULL;
100 + }
101 +
102 +@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size)
103 + if (addr == MAP_FAILED) {
104 + fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
105 + path, strerror(errno));
106 ++ close(fd);
107 + return NULL;
108 + }
109 +
110 +@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size)
111 + if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
112 + fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
113 + path);
114 ++ close(fd);
115 + return NULL;
116 + }
117 +
118 +@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size)
119 + default:
120 + fprintf(stderr, "%s: '%s' has invalid ELF class\n",
121 + program_name, path);
122 ++ close(fd);
123 + return NULL;
124 + }
125 +
126 +@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size)
127 + default:
128 + fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
129 + program_name, path);
130 ++ close(fd);
131 + return NULL;
132 + }
133 +
134 +@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size)
135 + fprintf(stderr,
136 + "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
137 + program_name, path);
138 ++ close(fd);
139 + return NULL;
140 + } else if (swap_uint16(ehdr->e_type) != ET_DYN) {
141 + fprintf(stderr,
142 + "%s: '%s' has invalid ELF type (expected ET_DYN)\n",
143 + program_name, path);
144 ++ close(fd);
145 + return NULL;
146 + }
147 +
148 + *_size = stat.st_size;
149 ++ close(fd);
150 + return addr;
151 + }
152 +
153 +@@ -284,10 +292,12 @@ int main(int argc, char **argv)
154 + /* Calculate and write symbol offsets to <output file> */
155 + if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
156 + unlink(out_path);
157 ++ fclose(out_file);
158 + return EXIT_FAILURE;
159 + }
160 +
161 + fprintf(out_file, "};\n");
162 ++ fclose(out_file);
163 +
164 + return EXIT_SUCCESS;
165 + }
166 +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
167 +index 458b928dbd844..5bef78e2b4c14 100644
168 +--- a/arch/powerpc/kernel/cpu_setup_power.S
169 ++++ b/arch/powerpc/kernel/cpu_setup_power.S
170 +@@ -183,7 +183,7 @@ __init_LPCR_ISA300:
171 +
172 + __init_FSCR:
173 + mfspr r3,SPRN_FSCR
174 +- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB
175 ++ ori r3,r3,FSCR_TAR|FSCR_EBB
176 + mtspr SPRN_FSCR,r3
177 + blr
178 +
179 +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
180 +index 4004dbdab9c7b..d407b73298171 100644
181 +--- a/arch/powerpc/perf/core-book3s.c
182 ++++ b/arch/powerpc/perf/core-book3s.c
183 +@@ -2087,6 +2087,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
184 +
185 + if (perf_event_overflow(event, &data, regs))
186 + power_pmu_stop(event, 0);
187 ++ } else if (period) {
188 ++ /* Account for interrupt in case of invalid SIAR */
189 ++ if (perf_event_account_interrupt(event))
190 ++ power_pmu_stop(event, 0);
191 + }
192 + }
193 +
194 +diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
195 +index 9f5958f169234..741a8fa8a3e6b 100644
196 +--- a/arch/powerpc/platforms/cell/Kconfig
197 ++++ b/arch/powerpc/platforms/cell/Kconfig
198 +@@ -46,6 +46,7 @@ config SPU_FS
199 + tristate "SPU file system"
200 + default m
201 + depends on PPC_CELL
202 ++ depends on COREDUMP
203 + select SPU_BASE
204 + help
205 + The SPU file system is used to access Synergistic Processing
206 +diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
207 +index cb1f51ad48e40..411f785cdfb51 100644
208 +--- a/arch/powerpc/sysdev/xive/native.c
209 ++++ b/arch/powerpc/sysdev/xive/native.c
210 +@@ -22,6 +22,7 @@
211 + #include <linux/delay.h>
212 + #include <linux/cpumask.h>
213 + #include <linux/mm.h>
214 ++#include <linux/kmemleak.h>
215 +
216 + #include <asm/prom.h>
217 + #include <asm/io.h>
218 +@@ -627,6 +628,7 @@ static bool xive_native_provision_pages(void)
219 + pr_err("Failed to allocate provisioning page\n");
220 + return false;
221 + }
222 ++ kmemleak_ignore(p);
223 + opal_xive_donate_page(chip, __pa(p));
224 + }
225 + return true;
226 +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
227 +index da1de190a3b13..d89a757cbde0f 100644
228 +--- a/block/blk-mq-sched.c
229 ++++ b/block/blk-mq-sched.c
230 +@@ -69,6 +69,15 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
231 + return;
232 + clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
233 +
234 ++ /*
235 ++ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch)
236 ++ * in blk_mq_run_hw_queue(). Its pair is the barrier in
237 ++ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART,
238 ++ * meantime new request added to hctx->dispatch is missed to check in
239 ++ * blk_mq_run_hw_queue().
240 ++ */
241 ++ smp_mb();
242 ++
243 + blk_mq_run_hw_queue(hctx, true);
244 + }
245 +
246 +diff --git a/block/blk-mq.c b/block/blk-mq.c
247 +index 684acaa96db7e..db2db0b70d34f 100644
248 +--- a/block/blk-mq.c
249 ++++ b/block/blk-mq.c
250 +@@ -1221,6 +1221,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
251 + list_splice_init(list, &hctx->dispatch);
252 + spin_unlock(&hctx->lock);
253 +
254 ++ /*
255 ++ * Order adding requests to hctx->dispatch and checking
256 ++ * SCHED_RESTART flag. The pair of this smp_mb() is the one
257 ++ * in blk_mq_sched_restart(). Avoid restart code path to
258 ++ * miss the new added requests to hctx->dispatch, meantime
259 ++ * SCHED_RESTART is observed here.
260 ++ */
261 ++ smp_mb();
262 ++
263 + /*
264 + * If SCHED_RESTART was set by the caller of this function and
265 + * it is no longer set that means that it was cleared by another
266 +diff --git a/drivers/base/core.c b/drivers/base/core.c
267 +index 928fc1532a706..b911c38ad18ca 100644
268 +--- a/drivers/base/core.c
269 ++++ b/drivers/base/core.c
270 +@@ -3333,9 +3333,9 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
271 + */
272 + void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
273 + {
274 +- if (fwnode) {
275 +- struct fwnode_handle *fn = dev->fwnode;
276 ++ struct fwnode_handle *fn = dev->fwnode;
277 +
278 ++ if (fwnode) {
279 + if (fwnode_is_primary(fn))
280 + fn = fn->secondary;
281 +
282 +@@ -3345,8 +3345,12 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
283 + }
284 + dev->fwnode = fwnode;
285 + } else {
286 +- dev->fwnode = fwnode_is_primary(dev->fwnode) ?
287 +- dev->fwnode->secondary : NULL;
288 ++ if (fwnode_is_primary(fn)) {
289 ++ dev->fwnode = fn->secondary;
290 ++ fn->secondary = NULL;
291 ++ } else {
292 ++ dev->fwnode = NULL;
293 ++ }
294 + }
295 + }
296 + EXPORT_SYMBOL_GPL(set_primary_fwnode);
297 +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
298 +index 3b382a7e07b20..da413b95afabf 100644
299 +--- a/drivers/base/power/main.c
300 ++++ b/drivers/base/power/main.c
301 +@@ -1751,13 +1751,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
302 + }
303 +
304 + /*
305 +- * If a device configured to wake up the system from sleep states
306 +- * has been suspended at run time and there's a resume request pending
307 +- * for it, this is equivalent to the device signaling wakeup, so the
308 +- * system suspend operation should be aborted.
309 ++ * Wait for possible runtime PM transitions of the device in progress
310 ++ * to complete and if there's a runtime resume request pending for it,
311 ++ * resume it before proceeding with invoking the system-wide suspend
312 ++ * callbacks for it.
313 ++ *
314 ++ * If the system-wide suspend callbacks below change the configuration
315 ++ * of the device, they must disable runtime PM for it or otherwise
316 ++ * ensure that its runtime-resume callbacks will not be confused by that
317 ++ * change in case they are invoked going forward.
318 + */
319 +- if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
320 +- pm_wakeup_event(dev, 0);
321 ++ pm_runtime_barrier(dev);
322 +
323 + if (pm_wakeup_pending()) {
324 + dev->power.direct_complete = false;
325 +diff --git a/drivers/block/loop.c b/drivers/block/loop.c
326 +index da68c42aed682..19042b42a8baf 100644
327 +--- a/drivers/block/loop.c
328 ++++ b/drivers/block/loop.c
329 +@@ -864,6 +864,7 @@ static void loop_config_discard(struct loop_device *lo)
330 + struct file *file = lo->lo_backing_file;
331 + struct inode *inode = file->f_mapping->host;
332 + struct request_queue *q = lo->lo_queue;
333 ++ u32 granularity, max_discard_sectors;
334 +
335 + /*
336 + * If the backing device is a block device, mirror its zeroing
337 +@@ -876,11 +877,10 @@ static void loop_config_discard(struct loop_device *lo)
338 + struct request_queue *backingq;
339 +
340 + backingq = bdev_get_queue(inode->i_bdev);
341 +- blk_queue_max_discard_sectors(q,
342 +- backingq->limits.max_write_zeroes_sectors);
343 +
344 +- blk_queue_max_write_zeroes_sectors(q,
345 +- backingq->limits.max_write_zeroes_sectors);
346 ++ max_discard_sectors = backingq->limits.max_write_zeroes_sectors;
347 ++ granularity = backingq->limits.discard_granularity ?:
348 ++ queue_physical_block_size(backingq);
349 +
350 + /*
351 + * We use punch hole to reclaim the free space used by the
352 +@@ -889,23 +889,26 @@ static void loop_config_discard(struct loop_device *lo)
353 + * useful information.
354 + */
355 + } else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) {
356 +- q->limits.discard_granularity = 0;
357 +- q->limits.discard_alignment = 0;
358 +- blk_queue_max_discard_sectors(q, 0);
359 +- blk_queue_max_write_zeroes_sectors(q, 0);
360 ++ max_discard_sectors = 0;
361 ++ granularity = 0;
362 +
363 + } else {
364 +- q->limits.discard_granularity = inode->i_sb->s_blocksize;
365 +- q->limits.discard_alignment = 0;
366 +-
367 +- blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
368 +- blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
369 ++ max_discard_sectors = UINT_MAX >> 9;
370 ++ granularity = inode->i_sb->s_blocksize;
371 + }
372 +
373 +- if (q->limits.max_write_zeroes_sectors)
374 ++ if (max_discard_sectors) {
375 ++ q->limits.discard_granularity = granularity;
376 ++ blk_queue_max_discard_sectors(q, max_discard_sectors);
377 ++ blk_queue_max_write_zeroes_sectors(q, max_discard_sectors);
378 + blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
379 +- else
380 ++ } else {
381 ++ q->limits.discard_granularity = 0;
382 ++ blk_queue_max_discard_sectors(q, 0);
383 ++ blk_queue_max_write_zeroes_sectors(q, 0);
384 + blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q);
385 ++ }
386 ++ q->limits.discard_alignment = 0;
387 + }
388 +
389 + static void loop_unprepare_queue(struct loop_device *lo)
390 +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
391 +index d2d7dc9cd58d2..4fef1fb918ece 100644
392 +--- a/drivers/block/null_blk_main.c
393 ++++ b/drivers/block/null_blk_main.c
394 +@@ -1086,7 +1086,7 @@ static int null_handle_rq(struct nullb_cmd *cmd)
395 + len = bvec.bv_len;
396 + err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
397 + op_is_write(req_op(rq)), sector,
398 +- req_op(rq) & REQ_FUA);
399 ++ rq->cmd_flags & REQ_FUA);
400 + if (err) {
401 + spin_unlock_irq(&nullb->lock);
402 + return err;
403 +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
404 +index 4946c5b37d04d..f79f877942733 100644
405 +--- a/drivers/char/tpm/tpm-chip.c
406 ++++ b/drivers/char/tpm/tpm-chip.c
407 +@@ -276,13 +276,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
408 + chip->cdev.owner = THIS_MODULE;
409 + chip->cdevs.owner = THIS_MODULE;
410 +
411 +- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
412 +- if (!chip->work_space.context_buf) {
413 +- rc = -ENOMEM;
414 +- goto out;
415 +- }
416 +- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
417 +- if (!chip->work_space.session_buf) {
418 ++ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE);
419 ++ if (rc) {
420 + rc = -ENOMEM;
421 + goto out;
422 + }
423 +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
424 +index 289221d653cb2..b9a30f0b88257 100644
425 +--- a/drivers/char/tpm/tpm.h
426 ++++ b/drivers/char/tpm/tpm.h
427 +@@ -188,6 +188,7 @@ struct tpm_space {
428 + u8 *context_buf;
429 + u32 session_tbl[3];
430 + u8 *session_buf;
431 ++ u32 buf_size;
432 + };
433 +
434 + enum tpm_chip_flags {
435 +@@ -278,6 +279,9 @@ struct tpm_output_header {
436 +
437 + #define TPM_TAG_RQU_COMMAND 193
438 +
439 ++/* TPM2 specific constants. */
440 ++#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */
441 ++
442 + struct stclear_flags_t {
443 + __be16 tag;
444 + u8 deactivated;
445 +@@ -595,7 +599,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
446 + unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
447 + int tpm2_probe(struct tpm_chip *chip);
448 + int tpm2_find_cc(struct tpm_chip *chip, u32 cc);
449 +-int tpm2_init_space(struct tpm_space *space);
450 ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size);
451 + void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space);
452 + int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
453 + u8 *cmd);
454 +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
455 +index d2e101b32482f..9f4e22dcde270 100644
456 +--- a/drivers/char/tpm/tpm2-space.c
457 ++++ b/drivers/char/tpm/tpm2-space.c
458 +@@ -43,18 +43,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
459 + }
460 + }
461 +
462 +-int tpm2_init_space(struct tpm_space *space)
463 ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
464 + {
465 +- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
466 ++ space->context_buf = kzalloc(buf_size, GFP_KERNEL);
467 + if (!space->context_buf)
468 + return -ENOMEM;
469 +
470 +- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
471 ++ space->session_buf = kzalloc(buf_size, GFP_KERNEL);
472 + if (space->session_buf == NULL) {
473 + kfree(space->context_buf);
474 ++ /* Prevent caller getting a dangling pointer. */
475 ++ space->context_buf = NULL;
476 + return -ENOMEM;
477 + }
478 +
479 ++ space->buf_size = buf_size;
480 + return 0;
481 + }
482 +
483 +@@ -276,8 +279,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
484 + sizeof(space->context_tbl));
485 + memcpy(&chip->work_space.session_tbl, &space->session_tbl,
486 + sizeof(space->session_tbl));
487 +- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE);
488 +- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE);
489 ++ memcpy(chip->work_space.context_buf, space->context_buf,
490 ++ space->buf_size);
491 ++ memcpy(chip->work_space.session_buf, space->session_buf,
492 ++ space->buf_size);
493 +
494 + rc = tpm2_load_space(chip);
495 + if (rc) {
496 +@@ -456,7 +461,7 @@ static int tpm2_save_space(struct tpm_chip *chip)
497 + continue;
498 +
499 + rc = tpm2_save_context(chip, space->context_tbl[i],
500 +- space->context_buf, PAGE_SIZE,
501 ++ space->context_buf, space->buf_size,
502 + &offset);
503 + if (rc == -ENOENT) {
504 + space->context_tbl[i] = 0;
505 +@@ -474,9 +479,8 @@ static int tpm2_save_space(struct tpm_chip *chip)
506 + continue;
507 +
508 + rc = tpm2_save_context(chip, space->session_tbl[i],
509 +- space->session_buf, PAGE_SIZE,
510 ++ space->session_buf, space->buf_size,
511 + &offset);
512 +-
513 + if (rc == -ENOENT) {
514 + /* handle error saving session, just forget it */
515 + space->session_tbl[i] = 0;
516 +@@ -522,8 +526,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
517 + sizeof(space->context_tbl));
518 + memcpy(&space->session_tbl, &chip->work_space.session_tbl,
519 + sizeof(space->session_tbl));
520 +- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE);
521 +- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE);
522 ++ memcpy(space->context_buf, chip->work_space.context_buf,
523 ++ space->buf_size);
524 ++ memcpy(space->session_buf, chip->work_space.session_buf,
525 ++ space->buf_size);
526 +
527 + return 0;
528 + }
529 +diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c
530 +index 1a0e97a5da5a4..162fb16243d03 100644
531 +--- a/drivers/char/tpm/tpmrm-dev.c
532 ++++ b/drivers/char/tpm/tpmrm-dev.c
533 +@@ -22,7 +22,7 @@ static int tpmrm_open(struct inode *inode, struct file *file)
534 + if (priv == NULL)
535 + return -ENOMEM;
536 +
537 +- rc = tpm2_init_space(&priv->space);
538 ++ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE);
539 + if (rc) {
540 + kfree(priv);
541 + return -ENOMEM;
542 +diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
543 +index aac9b9b360b80..9e4781a807cfa 100644
544 +--- a/drivers/edac/ie31200_edac.c
545 ++++ b/drivers/edac/ie31200_edac.c
546 +@@ -147,6 +147,8 @@
547 + (n << (28 + (2 * skl) - PAGE_SHIFT))
548 +
549 + static int nr_channels;
550 ++static struct pci_dev *mci_pdev;
551 ++static int ie31200_registered = 1;
552 +
553 + struct ie31200_priv {
554 + void __iomem *window;
555 +@@ -518,12 +520,16 @@ fail_free:
556 + static int ie31200_init_one(struct pci_dev *pdev,
557 + const struct pci_device_id *ent)
558 + {
559 +- edac_dbg(0, "MC:\n");
560 ++ int rc;
561 +
562 ++ edac_dbg(0, "MC:\n");
563 + if (pci_enable_device(pdev) < 0)
564 + return -EIO;
565 ++ rc = ie31200_probe1(pdev, ent->driver_data);
566 ++ if (rc == 0 && !mci_pdev)
567 ++ mci_pdev = pci_dev_get(pdev);
568 +
569 +- return ie31200_probe1(pdev, ent->driver_data);
570 ++ return rc;
571 + }
572 +
573 + static void ie31200_remove_one(struct pci_dev *pdev)
574 +@@ -532,6 +538,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
575 + struct ie31200_priv *priv;
576 +
577 + edac_dbg(0, "\n");
578 ++ pci_dev_put(mci_pdev);
579 ++ mci_pdev = NULL;
580 + mci = edac_mc_del_mc(&pdev->dev);
581 + if (!mci)
582 + return;
583 +@@ -583,17 +591,53 @@ static struct pci_driver ie31200_driver = {
584 +
585 + static int __init ie31200_init(void)
586 + {
587 ++ int pci_rc, i;
588 ++
589 + edac_dbg(3, "MC:\n");
590 + /* Ensure that the OPSTATE is set correctly for POLL or NMI */
591 + opstate_init();
592 +
593 +- return pci_register_driver(&ie31200_driver);
594 ++ pci_rc = pci_register_driver(&ie31200_driver);
595 ++ if (pci_rc < 0)
596 ++ goto fail0;
597 ++
598 ++ if (!mci_pdev) {
599 ++ ie31200_registered = 0;
600 ++ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
601 ++ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
602 ++ ie31200_pci_tbl[i].device,
603 ++ NULL);
604 ++ if (mci_pdev)
605 ++ break;
606 ++ }
607 ++ if (!mci_pdev) {
608 ++ edac_dbg(0, "ie31200 pci_get_device fail\n");
609 ++ pci_rc = -ENODEV;
610 ++ goto fail1;
611 ++ }
612 ++ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
613 ++ if (pci_rc < 0) {
614 ++ edac_dbg(0, "ie31200 init fail\n");
615 ++ pci_rc = -ENODEV;
616 ++ goto fail1;
617 ++ }
618 ++ }
619 ++ return 0;
620 ++
621 ++fail1:
622 ++ pci_unregister_driver(&ie31200_driver);
623 ++fail0:
624 ++ pci_dev_put(mci_pdev);
625 ++
626 ++ return pci_rc;
627 + }
628 +
629 + static void __exit ie31200_exit(void)
630 + {
631 + edac_dbg(3, "MC:\n");
632 + pci_unregister_driver(&ie31200_driver);
633 ++ if (!ie31200_registered)
634 ++ ie31200_remove_one(mci_pdev);
635 + }
636 +
637 + module_init(ie31200_init);
638 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
639 +index c770d73352a79..c15286858f0bf 100644
640 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
641 ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
642 +@@ -718,8 +718,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
643 +
644 + if (!drm_kms_helper_is_poll_worker()) {
645 + r = pm_runtime_get_sync(connector->dev->dev);
646 +- if (r < 0)
647 ++ if (r < 0) {
648 ++ pm_runtime_put_autosuspend(connector->dev->dev);
649 + return connector_status_disconnected;
650 ++ }
651 + }
652 +
653 + if (encoder) {
654 +@@ -856,8 +858,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
655 +
656 + if (!drm_kms_helper_is_poll_worker()) {
657 + r = pm_runtime_get_sync(connector->dev->dev);
658 +- if (r < 0)
659 ++ if (r < 0) {
660 ++ pm_runtime_put_autosuspend(connector->dev->dev);
661 + return connector_status_disconnected;
662 ++ }
663 + }
664 +
665 + encoder = amdgpu_connector_best_single_encoder(connector);
666 +@@ -979,8 +983,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
667 +
668 + if (!drm_kms_helper_is_poll_worker()) {
669 + r = pm_runtime_get_sync(connector->dev->dev);
670 +- if (r < 0)
671 ++ if (r < 0) {
672 ++ pm_runtime_put_autosuspend(connector->dev->dev);
673 + return connector_status_disconnected;
674 ++ }
675 + }
676 +
677 + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
678 +@@ -1329,8 +1335,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
679 +
680 + if (!drm_kms_helper_is_poll_worker()) {
681 + r = pm_runtime_get_sync(connector->dev->dev);
682 +- if (r < 0)
683 ++ if (r < 0) {
684 ++ pm_runtime_put_autosuspend(connector->dev->dev);
685 + return connector_status_disconnected;
686 ++ }
687 + }
688 +
689 + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
690 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
691 +index 686a26de50f91..049a1961c3fa5 100644
692 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
693 ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
694 +@@ -275,7 +275,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
695 +
696 + ret = pm_runtime_get_sync(dev->dev);
697 + if (ret < 0)
698 +- return ret;
699 ++ goto out;
700 +
701 + ret = drm_crtc_helper_set_config(set, ctx);
702 +
703 +@@ -290,7 +290,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
704 + take the current one */
705 + if (active && !adev->have_disp_power_ref) {
706 + adev->have_disp_power_ref = true;
707 +- return ret;
708 ++ goto out;
709 + }
710 + /* if we have no active crtcs, then drop the power ref
711 + we got before */
712 +@@ -299,6 +299,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
713 + adev->have_disp_power_ref = false;
714 + }
715 +
716 ++out:
717 + /* drop the power reference we got coming in here */
718 + pm_runtime_put_autosuspend(dev->dev);
719 + return ret;
720 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
721 +index 5e29f14f4b301..63b1e325b45c5 100644
722 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
723 ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
724 +@@ -1085,11 +1085,12 @@ long amdgpu_drm_ioctl(struct file *filp,
725 + dev = file_priv->minor->dev;
726 + ret = pm_runtime_get_sync(dev->dev);
727 + if (ret < 0)
728 +- return ret;
729 ++ goto out;
730 +
731 + ret = drm_ioctl(filp, cmd, arg);
732 +
733 + pm_runtime_mark_last_busy(dev->dev);
734 ++out:
735 + pm_runtime_put_autosuspend(dev->dev);
736 + return ret;
737 + }
738 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
739 +index bb41936df0d97..dd9b8feb3a666 100644
740 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
741 ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
742 +@@ -524,8 +524,12 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
743 + * in the bitfields */
744 + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
745 + se_num = 0xffffffff;
746 ++ else if (se_num >= AMDGPU_GFX_MAX_SE)
747 ++ return -EINVAL;
748 + if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
749 + sh_num = 0xffffffff;
750 ++ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
751 ++ return -EINVAL;
752 +
753 + if (info->read_mmr_reg.count > 128)
754 + return -EINVAL;
755 +@@ -835,7 +839,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
756 +
757 + r = pm_runtime_get_sync(dev->dev);
758 + if (r < 0)
759 +- return r;
760 ++ goto pm_put;
761 +
762 + fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
763 + if (unlikely(!fpriv)) {
764 +@@ -883,6 +887,7 @@ error_pasid:
765 +
766 + out_suspend:
767 + pm_runtime_mark_last_busy(dev->dev);
768 ++pm_put:
769 + pm_runtime_put_autosuspend(dev->dev);
770 +
771 + return r;
772 +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
773 +index 0805c423a5ce0..5cf499a07806a 100644
774 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
775 ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
776 +@@ -592,8 +592,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
777 +
778 + ret = kobject_init_and_add(dev->kobj_node, &node_type,
779 + sys_props.kobj_nodes, "%d", id);
780 +- if (ret < 0)
781 ++ if (ret < 0) {
782 ++ kobject_put(dev->kobj_node);
783 + return ret;
784 ++ }
785 +
786 + dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
787 + if (!dev->kobj_mem)
788 +@@ -640,8 +642,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
789 + return -ENOMEM;
790 + ret = kobject_init_and_add(mem->kobj, &mem_type,
791 + dev->kobj_mem, "%d", i);
792 +- if (ret < 0)
793 ++ if (ret < 0) {
794 ++ kobject_put(mem->kobj);
795 + return ret;
796 ++ }
797 +
798 + mem->attr.name = "properties";
799 + mem->attr.mode = KFD_SYSFS_FILE_MODE;
800 +@@ -659,8 +663,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
801 + return -ENOMEM;
802 + ret = kobject_init_and_add(cache->kobj, &cache_type,
803 + dev->kobj_cache, "%d", i);
804 +- if (ret < 0)
805 ++ if (ret < 0) {
806 ++ kobject_put(cache->kobj);
807 + return ret;
808 ++ }
809 +
810 + cache->attr.name = "properties";
811 + cache->attr.mode = KFD_SYSFS_FILE_MODE;
812 +@@ -678,8 +684,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
813 + return -ENOMEM;
814 + ret = kobject_init_and_add(iolink->kobj, &iolink_type,
815 + dev->kobj_iolink, "%d", i);
816 +- if (ret < 0)
817 ++ if (ret < 0) {
818 ++ kobject_put(iolink->kobj);
819 + return ret;
820 ++ }
821 +
822 + iolink->attr.name = "properties";
823 + iolink->attr.mode = KFD_SYSFS_FILE_MODE;
824 +@@ -759,8 +767,10 @@ static int kfd_topology_update_sysfs(void)
825 + ret = kobject_init_and_add(sys_props.kobj_topology,
826 + &sysprops_type, &kfd_device->kobj,
827 + "topology");
828 +- if (ret < 0)
829 ++ if (ret < 0) {
830 ++ kobject_put(sys_props.kobj_topology);
831 + return ret;
832 ++ }
833 +
834 + sys_props.kobj_nodes = kobject_create_and_add("nodes",
835 + sys_props.kobj_topology);
836 +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
837 +index aa044c1955fe0..a2b2a6c67cda1 100644
838 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
839 ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
840 +@@ -362,6 +362,9 @@ int vega10_thermal_get_temperature(struct pp_hwmgr *hwmgr)
841 + static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
842 + struct PP_TemperatureRange *range)
843 + {
844 ++ struct phm_ppt_v2_information *pp_table_info =
845 ++ (struct phm_ppt_v2_information *)(hwmgr->pptable);
846 ++ struct phm_tdp_table *tdp_table = pp_table_info->tdp_table;
847 + struct amdgpu_device *adev = hwmgr->adev;
848 + int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP *
849 + PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
850 +@@ -371,8 +374,8 @@ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
851 +
852 + if (low < range->min)
853 + low = range->min;
854 +- if (high > range->max)
855 +- high = range->max;
856 ++ if (high > tdp_table->usSoftwareShutdownTemp)
857 ++ high = tdp_table->usSoftwareShutdownTemp;
858 +
859 + if (low > high)
860 + return -EINVAL;
861 +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
862 +index 904eb2c9155b4..601a596e94f02 100644
863 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
864 ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
865 +@@ -170,6 +170,8 @@ int vega12_thermal_get_temperature(struct pp_hwmgr *hwmgr)
866 + static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
867 + struct PP_TemperatureRange *range)
868 + {
869 ++ struct phm_ppt_v3_information *pptable_information =
870 ++ (struct phm_ppt_v3_information *)hwmgr->pptable;
871 + struct amdgpu_device *adev = hwmgr->adev;
872 + int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP *
873 + PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
874 +@@ -179,8 +181,8 @@ static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
875 +
876 + if (low < range->min)
877 + low = range->min;
878 +- if (high > range->max)
879 +- high = range->max;
880 ++ if (high > pptable_information->us_software_shutdown_temp)
881 ++ high = pptable_information->us_software_shutdown_temp;
882 +
883 + if (low > high)
884 + return -EINVAL;
885 +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
886 +index 93d70f4a2154e..c9f831604558f 100644
887 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
888 ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
889 +@@ -221,7 +221,7 @@ int adreno_hw_init(struct msm_gpu *gpu)
890 + ring->next = ring->start;
891 +
892 + /* reset completed fence seqno: */
893 +- ring->memptrs->fence = ring->seqno;
894 ++ ring->memptrs->fence = ring->fctx->completed_fence;
895 + ring->memptrs->rptr = 0;
896 + }
897 +
898 +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
899 +index 10107e551fac3..e06ea8c8184cb 100644
900 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
901 ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
902 +@@ -1920,8 +1920,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,
903 + int ret, i;
904 +
905 + ret = pm_runtime_get_sync(dev->dev);
906 +- if (ret < 0 && ret != -EACCES)
907 ++ if (ret < 0 && ret != -EACCES) {
908 ++ pm_runtime_put_autosuspend(dev->dev);
909 + return ret;
910 ++ }
911 +
912 + ret = drm_atomic_helper_setup_commit(state, nonblock);
913 + if (ret)
914 +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
915 +index fb0094fc55834..b71afde8f115a 100644
916 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
917 ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
918 +@@ -551,8 +551,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
919 + pm_runtime_get_noresume(dev->dev);
920 + } else {
921 + ret = pm_runtime_get_sync(dev->dev);
922 +- if (ret < 0 && ret != -EACCES)
923 ++ if (ret < 0 && ret != -EACCES) {
924 ++ pm_runtime_put_autosuspend(dev->dev);
925 + return conn_status;
926 ++ }
927 + }
928 +
929 + nv_encoder = nouveau_connector_ddc_detect(connector);
930 +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
931 +index 406cb99af7f21..d4fe52ec4c966 100644
932 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
933 ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
934 +@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
935 + struct nouveau_fbdev *fbcon = info->par;
936 + struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev);
937 + int ret = pm_runtime_get_sync(drm->dev->dev);
938 +- if (ret < 0 && ret != -EACCES)
939 ++ if (ret < 0 && ret != -EACCES) {
940 ++ pm_runtime_put(drm->dev->dev);
941 + return ret;
942 ++ }
943 + return 0;
944 + }
945 +
946 +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
947 +index de656f5553839..b9927101e8450 100644
948 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c
949 ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
950 +@@ -882,8 +882,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
951 +
952 + if (!drm_kms_helper_is_poll_worker()) {
953 + r = pm_runtime_get_sync(connector->dev->dev);
954 +- if (r < 0)
955 ++ if (r < 0) {
956 ++ pm_runtime_put_autosuspend(connector->dev->dev);
957 + return connector_status_disconnected;
958 ++ }
959 + }
960 +
961 + if (encoder) {
962 +@@ -1028,8 +1030,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
963 +
964 + if (!drm_kms_helper_is_poll_worker()) {
965 + r = pm_runtime_get_sync(connector->dev->dev);
966 +- if (r < 0)
967 ++ if (r < 0) {
968 ++ pm_runtime_put_autosuspend(connector->dev->dev);
969 + return connector_status_disconnected;
970 ++ }
971 + }
972 +
973 + encoder = radeon_best_single_encoder(connector);
974 +@@ -1166,8 +1170,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
975 +
976 + if (!drm_kms_helper_is_poll_worker()) {
977 + r = pm_runtime_get_sync(connector->dev->dev);
978 +- if (r < 0)
979 ++ if (r < 0) {
980 ++ pm_runtime_put_autosuspend(connector->dev->dev);
981 + return connector_status_disconnected;
982 ++ }
983 + }
984 +
985 + encoder = radeon_best_single_encoder(connector);
986 +@@ -1250,8 +1256,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
987 +
988 + if (!drm_kms_helper_is_poll_worker()) {
989 + r = pm_runtime_get_sync(connector->dev->dev);
990 +- if (r < 0)
991 ++ if (r < 0) {
992 ++ pm_runtime_put_autosuspend(connector->dev->dev);
993 + return connector_status_disconnected;
994 ++ }
995 + }
996 +
997 + if (radeon_connector->detected_hpd_without_ddc) {
998 +@@ -1665,8 +1673,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
999 +
1000 + if (!drm_kms_helper_is_poll_worker()) {
1001 + r = pm_runtime_get_sync(connector->dev->dev);
1002 +- if (r < 0)
1003 ++ if (r < 0) {
1004 ++ pm_runtime_put_autosuspend(connector->dev->dev);
1005 + return connector_status_disconnected;
1006 ++ }
1007 + }
1008 +
1009 + if (!force && radeon_check_hpd_status_unchanged(connector)) {
1010 +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
1011 +index 20530d8adfbb8..2c100b73d3fc1 100644
1012 +--- a/drivers/hid/hid-ids.h
1013 ++++ b/drivers/hid/hid-ids.h
1014 +@@ -756,6 +756,7 @@
1015 + #define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b
1016 + #define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c
1017 + #define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a
1018 ++#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882
1019 + #define USB_DEVICE_ID_S510_RECEIVER 0xc50c
1020 + #define USB_DEVICE_ID_S510_RECEIVER_2 0xc517
1021 + #define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512
1022 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
1023 +index bdde16395b2ce..62f87f8bd9720 100644
1024 +--- a/drivers/hid/hid-quirks.c
1025 ++++ b/drivers/hid/hid-quirks.c
1026 +@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = {
1027 + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
1028 + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
1029 + { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
1030 ++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
1031 +
1032 + { 0 }
1033 + };
1034 +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
1035 +index f17ebbe53abf0..1f8d403d3db4d 100644
1036 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c
1037 ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
1038 +@@ -444,6 +444,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
1039 + dev_err(&client->dev, "failed to change power setting.\n");
1040 +
1041 + set_pwr_exit:
1042 ++
1043 ++ /*
1044 ++ * The HID over I2C specification states that if a DEVICE needs time
1045 ++ * after the PWR_ON request, it should utilise CLOCK stretching.
1046 ++ * However, it has been observered that the Windows driver provides a
1047 ++ * 1ms sleep between the PWR_ON and RESET requests.
1048 ++ * According to Goodix Windows even waits 60 ms after (other?)
1049 ++ * PWR_ON requests. Testing has confirmed that several devices
1050 ++ * will not work properly without a delay after a PWR_ON request.
1051 ++ */
1052 ++ if (!ret && power_state == I2C_HID_PWR_ON)
1053 ++ msleep(60);
1054 ++
1055 + return ret;
1056 + }
1057 +
1058 +@@ -465,15 +478,6 @@ static int i2c_hid_hwreset(struct i2c_client *client)
1059 + if (ret)
1060 + goto out_unlock;
1061 +
1062 +- /*
1063 +- * The HID over I2C specification states that if a DEVICE needs time
1064 +- * after the PWR_ON request, it should utilise CLOCK stretching.
1065 +- * However, it has been observered that the Windows driver provides a
1066 +- * 1ms sleep between the PWR_ON and RESET requests and that some devices
1067 +- * rely on this.
1068 +- */
1069 +- usleep_range(1000, 5000);
1070 +-
1071 + i2c_hid_dbg(ihid, "resetting...\n");
1072 +
1073 + ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
1074 +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
1075 +index c34ef95d7cef3..2dff663847c69 100644
1076 +--- a/drivers/hid/usbhid/hiddev.c
1077 ++++ b/drivers/hid/usbhid/hiddev.c
1078 +@@ -532,12 +532,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
1079 +
1080 + switch (cmd) {
1081 + case HIDIOCGUSAGE:
1082 ++ if (uref->usage_index >= field->report_count)
1083 ++ goto inval;
1084 + uref->value = field->value[uref->usage_index];
1085 + if (copy_to_user(user_arg, uref, sizeof(*uref)))
1086 + goto fault;
1087 + goto goodreturn;
1088 +
1089 + case HIDIOCSUSAGE:
1090 ++ if (uref->usage_index >= field->report_count)
1091 ++ goto inval;
1092 + field->value[uref->usage_index] = uref->value;
1093 + goto goodreturn;
1094 +
1095 +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
1096 +index dcdce18fc7062..f9029800d3996 100644
1097 +--- a/drivers/i2c/busses/i2c-rcar.c
1098 ++++ b/drivers/i2c/busses/i2c-rcar.c
1099 +@@ -594,6 +594,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
1100 + /* master sent stop */
1101 + if (ssr_filtered & SSR) {
1102 + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
1103 ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
1104 + rcar_i2c_write(priv, ICSIER, SAR);
1105 + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
1106 + }
1107 +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
1108 +index 34c058c24b9d2..ce5cd05253db9 100644
1109 +--- a/drivers/iommu/iova.c
1110 ++++ b/drivers/iommu/iova.c
1111 +@@ -814,7 +814,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad)
1112 + for (i = 0 ; i < mag->size; ++i) {
1113 + struct iova *iova = private_find_iova(iovad, mag->pfns[i]);
1114 +
1115 +- BUG_ON(!iova);
1116 ++ if (WARN_ON(!iova))
1117 ++ continue;
1118 ++
1119 + private_free_iova(iovad, iova);
1120 + }
1121 +
1122 +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
1123 +index 97b27f338c305..f605470855f19 100644
1124 +--- a/drivers/irqchip/irq-stm32-exti.c
1125 ++++ b/drivers/irqchip/irq-stm32-exti.c
1126 +@@ -382,6 +382,16 @@ static void stm32_irq_ack(struct irq_data *d)
1127 + irq_gc_unlock(gc);
1128 + }
1129 +
1130 ++/* directly set the target bit without reading first. */
1131 ++static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg)
1132 ++{
1133 ++ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
1134 ++ void __iomem *base = chip_data->host_data->base;
1135 ++ u32 val = BIT(d->hwirq % IRQS_PER_BANK);
1136 ++
1137 ++ writel_relaxed(val, base + reg);
1138 ++}
1139 ++
1140 + static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg)
1141 + {
1142 + struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
1143 +@@ -415,9 +425,9 @@ static void stm32_exti_h_eoi(struct irq_data *d)
1144 +
1145 + raw_spin_lock(&chip_data->rlock);
1146 +
1147 +- stm32_exti_set_bit(d, stm32_bank->rpr_ofst);
1148 ++ stm32_exti_write_bit(d, stm32_bank->rpr_ofst);
1149 + if (stm32_bank->fpr_ofst != UNDEF_REG)
1150 +- stm32_exti_set_bit(d, stm32_bank->fpr_ofst);
1151 ++ stm32_exti_write_bit(d, stm32_bank->fpr_ofst);
1152 +
1153 + raw_spin_unlock(&chip_data->rlock);
1154 +
1155 +diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
1156 +index 4961573850d54..b2b3f779592fd 100644
1157 +--- a/drivers/media/cec/cec-api.c
1158 ++++ b/drivers/media/cec/cec-api.c
1159 +@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
1160 + struct cec_log_addrs log_addrs;
1161 +
1162 + mutex_lock(&adap->lock);
1163 +- log_addrs = adap->log_addrs;
1164 ++ /*
1165 ++ * We use memcpy here instead of assignment since there is a
1166 ++ * hole at the end of struct cec_log_addrs that an assignment
1167 ++ * might ignore. So when we do copy_to_user() we could leak
1168 ++ * one byte of memory.
1169 ++ */
1170 ++ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
1171 + if (!adap->is_configured)
1172 + memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
1173 + sizeof(log_addrs.log_addr));
1174 +diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
1175 +index d6816effb8786..d02b5fd940c12 100644
1176 +--- a/drivers/media/pci/ttpci/av7110.c
1177 ++++ b/drivers/media/pci/ttpci/av7110.c
1178 +@@ -424,14 +424,15 @@ static void debiirq(unsigned long cookie)
1179 + case DATA_CI_GET:
1180 + {
1181 + u8 *data = av7110->debi_virt;
1182 ++ u8 data_0 = data[0];
1183 +
1184 +- if ((data[0] < 2) && data[2] == 0xff) {
1185 ++ if (data_0 < 2 && data[2] == 0xff) {
1186 + int flags = 0;
1187 + if (data[5] > 0)
1188 + flags |= CA_CI_MODULE_PRESENT;
1189 + if (data[5] > 5)
1190 + flags |= CA_CI_MODULE_READY;
1191 +- av7110->ci_slot[data[0]].flags = flags;
1192 ++ av7110->ci_slot[data_0].flags = flags;
1193 + } else
1194 + ci_get_data(&av7110->ci_rbuffer,
1195 + av7110->debi_virt,
1196 +diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
1197 +index cd476cab97820..4e70b67ccd181 100644
1198 +--- a/drivers/media/rc/gpio-ir-tx.c
1199 ++++ b/drivers/media/rc/gpio-ir-tx.c
1200 +@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
1201 + // space
1202 + edge = ktime_add_us(edge, txbuf[i]);
1203 + delta = ktime_us_delta(edge, ktime_get());
1204 +- if (delta > 10) {
1205 +- spin_unlock_irqrestore(&gpio_ir->lock, flags);
1206 +- usleep_range(delta, delta + 10);
1207 +- spin_lock_irqsave(&gpio_ir->lock, flags);
1208 +- } else if (delta > 0) {
1209 ++ if (delta > 0)
1210 + udelay(delta);
1211 +- }
1212 + } else {
1213 + // pulse
1214 + ktime_t last = ktime_add_us(edge, txbuf[i]);
1215 +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
1216 +index 742d6c1973f4f..adea7ff63132f 100644
1217 +--- a/drivers/mfd/intel-lpss-pci.c
1218 ++++ b/drivers/mfd/intel-lpss-pci.c
1219 +@@ -176,6 +176,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
1220 + { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info },
1221 + { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
1222 + { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
1223 ++ /* EBG */
1224 ++ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info },
1225 ++ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info },
1226 + /* GLK */
1227 + { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
1228 + { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
1229 +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
1230 +index 55cc70ba5b093..3c3222e2dcfcf 100644
1231 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
1232 ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
1233 +@@ -2736,7 +2736,7 @@ static int check_missing_comp_in_tx_queue(struct ena_adapter *adapter,
1234 + }
1235 +
1236 + u64_stats_update_begin(&tx_ring->syncp);
1237 +- tx_ring->tx_stats.missed_tx = missed_tx;
1238 ++ tx_ring->tx_stats.missed_tx += missed_tx;
1239 + u64_stats_update_end(&tx_ring->syncp);
1240 +
1241 + return rc;
1242 +@@ -3544,6 +3544,9 @@ static void ena_keep_alive_wd(void *adapter_data,
1243 + rx_drops = ((u64)desc->rx_drops_high << 32) | desc->rx_drops_low;
1244 +
1245 + u64_stats_update_begin(&adapter->syncp);
1246 ++ /* These stats are accumulated by the device, so the counters indicate
1247 ++ * all drops since last reset.
1248 ++ */
1249 + adapter->dev_stats.rx_drops = rx_drops;
1250 + u64_stats_update_end(&adapter->syncp);
1251 + }
1252 +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
1253 +index cf2d1e846a692..8243501c37574 100644
1254 +--- a/drivers/net/ethernet/freescale/gianfar.c
1255 ++++ b/drivers/net/ethernet/freescale/gianfar.c
1256 +@@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
1257 + continue;
1258 +
1259 + err = gfar_parse_group(child, priv, model);
1260 +- if (err)
1261 ++ if (err) {
1262 ++ of_node_put(child);
1263 + goto err_grp_init;
1264 ++ }
1265 + }
1266 + } else { /* SQ_SG_MODE */
1267 + err = gfar_parse_group(np, priv, model);
1268 +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
1269 +index ccd852ad62a4b..d50c5b55da180 100644
1270 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
1271 ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
1272 +@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
1273 + }
1274 +
1275 + /* alloc the udl from per cpu ddp pool */
1276 +- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
1277 ++ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
1278 + if (!ddp->udl) {
1279 + e_err(drv, "failed allocated ddp context\n");
1280 + goto out_noddp_unmap;
1281 +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
1282 +index 87f605a33c37a..9fa3c0bd6ec78 100644
1283 +--- a/drivers/net/ipvlan/ipvlan_main.c
1284 ++++ b/drivers/net/ipvlan/ipvlan_main.c
1285 +@@ -177,12 +177,21 @@ static void ipvlan_port_destroy(struct net_device *dev)
1286 + kfree(port);
1287 + }
1288 +
1289 ++#define IPVLAN_ALWAYS_ON_OFLOADS \
1290 ++ (NETIF_F_SG | NETIF_F_HW_CSUM | \
1291 ++ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
1292 ++
1293 ++#define IPVLAN_ALWAYS_ON \
1294 ++ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
1295 ++
1296 + #define IPVLAN_FEATURES \
1297 +- (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
1298 ++ (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
1299 + NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
1300 + NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
1301 + NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
1302 +
1303 ++ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
1304 ++
1305 + #define IPVLAN_STATE_MASK \
1306 + ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
1307 +
1308 +@@ -196,7 +205,9 @@ static int ipvlan_init(struct net_device *dev)
1309 + dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
1310 + (phy_dev->state & IPVLAN_STATE_MASK);
1311 + dev->features = phy_dev->features & IPVLAN_FEATURES;
1312 +- dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED;
1313 ++ dev->features |= IPVLAN_ALWAYS_ON;
1314 ++ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
1315 ++ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
1316 + dev->gso_max_size = phy_dev->gso_max_size;
1317 + dev->gso_max_segs = phy_dev->gso_max_segs;
1318 + dev->hard_header_len = phy_dev->hard_header_len;
1319 +@@ -297,7 +308,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev,
1320 + {
1321 + struct ipvl_dev *ipvlan = netdev_priv(dev);
1322 +
1323 +- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
1324 ++ features |= NETIF_F_ALL_FOR_ALL;
1325 ++ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
1326 ++ features = netdev_increment_features(ipvlan->phy_dev->features,
1327 ++ features, features);
1328 ++ features |= IPVLAN_ALWAYS_ON;
1329 ++ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
1330 ++
1331 ++ return features;
1332 + }
1333 +
1334 + static void ipvlan_change_rx_flags(struct net_device *dev, int change)
1335 +@@ -802,10 +820,9 @@ static int ipvlan_device_event(struct notifier_block *unused,
1336 +
1337 + case NETDEV_FEAT_CHANGE:
1338 + list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
1339 +- ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
1340 + ipvlan->dev->gso_max_size = dev->gso_max_size;
1341 + ipvlan->dev->gso_max_segs = dev->gso_max_segs;
1342 +- netdev_features_change(ipvlan->dev);
1343 ++ netdev_update_features(ipvlan->dev);
1344 + }
1345 + break;
1346 +
1347 +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
1348 +index 349123592af0f..e226a96da3a39 100644
1349 +--- a/drivers/net/macvlan.c
1350 ++++ b/drivers/net/macvlan.c
1351 +@@ -1230,6 +1230,9 @@ static void macvlan_port_destroy(struct net_device *dev)
1352 + static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
1353 + struct netlink_ext_ack *extack)
1354 + {
1355 ++ struct nlattr *nla, *head;
1356 ++ int rem, len;
1357 ++
1358 + if (tb[IFLA_ADDRESS]) {
1359 + if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
1360 + return -EINVAL;
1361 +@@ -1277,6 +1280,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
1362 + return -EADDRNOTAVAIL;
1363 + }
1364 +
1365 ++ if (data[IFLA_MACVLAN_MACADDR_DATA]) {
1366 ++ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
1367 ++ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
1368 ++
1369 ++ nla_for_each_attr(nla, head, len, rem) {
1370 ++ if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
1371 ++ nla_len(nla) != ETH_ALEN)
1372 ++ return -EINVAL;
1373 ++
1374 ++ if (!is_valid_ether_addr(nla_data(nla)))
1375 ++ return -EADDRNOTAVAIL;
1376 ++ }
1377 ++ }
1378 ++
1379 + if (data[IFLA_MACVLAN_MACADDR_COUNT])
1380 + return -EINVAL;
1381 +
1382 +@@ -1333,10 +1350,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode,
1383 + len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
1384 +
1385 + nla_for_each_attr(nla, head, len, rem) {
1386 +- if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
1387 +- nla_len(nla) != ETH_ALEN)
1388 +- continue;
1389 +-
1390 + addr = nla_data(nla);
1391 + ret = macvlan_hash_add_source(vlan, addr);
1392 + if (ret)
1393 +diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
1394 +index fac58c3c576a2..3ff65a0a834a2 100644
1395 +--- a/drivers/net/wireless/ath/ath10k/hw.h
1396 ++++ b/drivers/net/wireless/ath/ath10k/hw.h
1397 +@@ -753,7 +753,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
1398 +
1399 + #define TARGET_10_4_TX_DBG_LOG_SIZE 1024
1400 + #define TARGET_10_4_NUM_WDS_ENTRIES 32
1401 +-#define TARGET_10_4_DMA_BURST_SIZE 0
1402 ++#define TARGET_10_4_DMA_BURST_SIZE 1
1403 + #define TARGET_10_4_MAC_AGGR_DELIM 0
1404 + #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
1405 + #define TARGET_10_4_VOW_CONFIG 0
1406 +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
1407 +index 1893640555c1e..3d6c0d8c71d7e 100644
1408 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
1409 ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
1410 +@@ -739,8 +739,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
1411 +
1412 + usb_anchor_urb(urb, &rtlusb->rx_submitted);
1413 + err = usb_submit_urb(urb, GFP_KERNEL);
1414 +- if (err)
1415 ++ if (err) {
1416 ++ usb_unanchor_urb(urb);
1417 ++ usb_free_urb(urb);
1418 + goto err_out;
1419 ++ }
1420 + usb_free_urb(urb);
1421 + }
1422 + return 0;
1423 +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
1424 +index ed43b06353a39..bb3b447c56468 100644
1425 +--- a/drivers/nvme/host/fc.c
1426 ++++ b/drivers/nvme/host/fc.c
1427 +@@ -1716,7 +1716,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
1428 + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) {
1429 + dev_err(ctrl->dev,
1430 + "FCP Op failed - cmdiu dma mapping failed.\n");
1431 +- ret = EFAULT;
1432 ++ ret = -EFAULT;
1433 + goto out_on_error;
1434 + }
1435 +
1436 +@@ -1726,7 +1726,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
1437 + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) {
1438 + dev_err(ctrl->dev,
1439 + "FCP Op failed - rspiu dma mapping failed.\n");
1440 +- ret = EFAULT;
1441 ++ ret = -EFAULT;
1442 + }
1443 +
1444 + atomic_set(&op->state, FCPOP_STATE_IDLE);
1445 +diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
1446 +index a32897f83ee51..fb7478b6c4f9d 100644
1447 +--- a/drivers/pci/slot.c
1448 ++++ b/drivers/pci/slot.c
1449 +@@ -303,13 +303,16 @@ placeholder:
1450 + slot_name = make_slot_name(name);
1451 + if (!slot_name) {
1452 + err = -ENOMEM;
1453 ++ kfree(slot);
1454 + goto err;
1455 + }
1456 +
1457 + err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
1458 + "%s", slot_name);
1459 +- if (err)
1460 ++ if (err) {
1461 ++ kobject_put(&slot->kobj);
1462 + goto err;
1463 ++ }
1464 +
1465 + INIT_LIST_HEAD(&slot->list);
1466 + list_add(&slot->list, &parent->slots);
1467 +@@ -328,7 +331,6 @@ out:
1468 + mutex_unlock(&pci_slot_mutex);
1469 + return slot;
1470 + err:
1471 +- kfree(slot);
1472 + slot = ERR_PTR(err);
1473 + goto out;
1474 + }
1475 +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
1476 +index df09ed53ab459..825a8f2703b4f 100644
1477 +--- a/drivers/s390/cio/css.c
1478 ++++ b/drivers/s390/cio/css.c
1479 +@@ -615,6 +615,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
1480 + rc = css_evaluate_known_subchannel(sch, 1);
1481 + if (rc == -EAGAIN)
1482 + css_schedule_eval(sch->schid);
1483 ++ /*
1484 ++ * The loop might take long time for platforms with lots of
1485 ++ * known devices. Allow scheduling here.
1486 ++ */
1487 ++ cond_resched();
1488 + }
1489 + return 0;
1490 + }
1491 +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
1492 +index 24cbd0a2cc69f..658c0726581f9 100644
1493 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c
1494 ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
1495 +@@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
1496 + WARN_ON(!fcf_dev);
1497 + new->fcf_dev = NULL;
1498 + fcoe_fcf_device_delete(fcf_dev);
1499 +- kfree(new);
1500 + mutex_unlock(&cdev->lock);
1501 + }
1502 ++ kfree(new);
1503 + }
1504 +
1505 + /**
1506 +diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
1507 +index 1ff0f7de91058..64545b300dfc7 100644
1508 +--- a/drivers/scsi/lpfc/lpfc_vport.c
1509 ++++ b/drivers/scsi/lpfc/lpfc_vport.c
1510 +@@ -653,27 +653,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
1511 + vport->port_state < LPFC_VPORT_READY)
1512 + return -EAGAIN;
1513 + }
1514 ++
1515 + /*
1516 +- * This is a bit of a mess. We want to ensure the shost doesn't get
1517 +- * torn down until we're done with the embedded lpfc_vport structure.
1518 +- *
1519 +- * Beyond holding a reference for this function, we also need a
1520 +- * reference for outstanding I/O requests we schedule during delete
1521 +- * processing. But once we scsi_remove_host() we can no longer obtain
1522 +- * a reference through scsi_host_get().
1523 +- *
1524 +- * So we take two references here. We release one reference at the
1525 +- * bottom of the function -- after delinking the vport. And we
1526 +- * release the other at the completion of the unreg_vpi that get's
1527 +- * initiated after we've disposed of all other resources associated
1528 +- * with the port.
1529 ++ * Take early refcount for outstanding I/O requests we schedule during
1530 ++ * delete processing for unreg_vpi. Always keep this before
1531 ++ * scsi_remove_host() as we can no longer obtain a reference through
1532 ++ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
1533 + */
1534 + if (!scsi_host_get(shost))
1535 + return VPORT_INVAL;
1536 +- if (!scsi_host_get(shost)) {
1537 +- scsi_host_put(shost);
1538 +- return VPORT_INVAL;
1539 +- }
1540 ++
1541 + lpfc_free_sysfs_attr(vport);
1542 +
1543 + lpfc_debugfs_terminate(vport);
1544 +@@ -820,8 +809,9 @@ skip_logo:
1545 + if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
1546 + lpfc_mbx_unreg_vpi(vport))
1547 + scsi_host_put(shost);
1548 +- } else
1549 ++ } else {
1550 + scsi_host_put(shost);
1551 ++ }
1552 +
1553 + lpfc_free_vpi(phba, vport->vpi);
1554 + vport->work_port_events = 0;
1555 +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
1556 +index ac5d2d34aeeae..07c5d7397d425 100644
1557 +--- a/drivers/scsi/qla2xxx/qla_mbx.c
1558 ++++ b/drivers/scsi/qla2xxx/qla_mbx.c
1559 +@@ -329,14 +329,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
1560 + if (time_after(jiffies, wait_time))
1561 + break;
1562 +
1563 +- /*
1564 +- * Check if it's UNLOADING, cause we cannot poll in
1565 +- * this case, or else a NULL pointer dereference
1566 +- * is triggered.
1567 +- */
1568 +- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags)))
1569 +- return QLA_FUNCTION_TIMEOUT;
1570 +-
1571 + /* Check for pending interrupts. */
1572 + qla2x00_poll(ha->rsp_q_map[0]);
1573 +
1574 +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
1575 +index 5590d6e8b5762..3e2f8ce1d9a97 100644
1576 +--- a/drivers/scsi/qla2xxx/qla_nvme.c
1577 ++++ b/drivers/scsi/qla2xxx/qla_nvme.c
1578 +@@ -477,6 +477,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
1579 + struct nvme_private *priv = fd->private;
1580 + struct qla_nvme_rport *qla_rport = rport->private;
1581 +
1582 ++ if (!priv) {
1583 ++ /* nvme association has been torn down */
1584 ++ return rval;
1585 ++ }
1586 ++
1587 + fcport = qla_rport->fcport;
1588 +
1589 + vha = fcport->vha;
1590 +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
1591 +index b56cf790587e5..e17ca7df8d0e4 100644
1592 +--- a/drivers/scsi/qla2xxx/qla_os.c
1593 ++++ b/drivers/scsi/qla2xxx/qla_os.c
1594 +@@ -1997,6 +1997,11 @@ skip_pio:
1595 + /* Determine queue resources */
1596 + ha->max_req_queues = ha->max_rsp_queues = 1;
1597 + ha->msix_count = QLA_BASE_VECTORS;
1598 ++
1599 ++ /* Check if FW supports MQ or not */
1600 ++ if (!(ha->fw_attributes & BIT_6))
1601 ++ goto mqiobase_exit;
1602 ++
1603 + if (!ql2xmqsupport || !ql2xnvmeenable ||
1604 + (!IS_QLA25XX(ha) && !IS_QLA81XX(ha)))
1605 + goto mqiobase_exit;
1606 +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
1607 +index 04d095488c764..6983473011980 100644
1608 +--- a/drivers/scsi/scsi_transport_iscsi.c
1609 ++++ b/drivers/scsi/scsi_transport_iscsi.c
1610 +@@ -3172,7 +3172,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
1611 + pr_err("%s could not find host no %u\n",
1612 + __func__, ev->u.set_flashnode.host_no);
1613 + err = -ENODEV;
1614 +- goto put_host;
1615 ++ goto exit_set_fnode;
1616 + }
1617 +
1618 + idx = ev->u.set_flashnode.flashnode_idx;
1619 +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
1620 +index ab628fd37e026..eb10a5cacd90c 100644
1621 +--- a/drivers/scsi/ufs/ufshcd.c
1622 ++++ b/drivers/scsi/ufs/ufshcd.c
1623 +@@ -1540,6 +1540,7 @@ unblock_reqs:
1624 + int ufshcd_hold(struct ufs_hba *hba, bool async)
1625 + {
1626 + int rc = 0;
1627 ++ bool flush_result;
1628 + unsigned long flags;
1629 +
1630 + if (!ufshcd_is_clkgating_allowed(hba))
1631 +@@ -1571,7 +1572,9 @@ start:
1632 + break;
1633 + }
1634 + spin_unlock_irqrestore(hba->host->host_lock, flags);
1635 +- flush_work(&hba->clk_gating.ungate_work);
1636 ++ flush_result = flush_work(&hba->clk_gating.ungate_work);
1637 ++ if (hba->clk_gating.is_suspended && !flush_result)
1638 ++ goto out;
1639 + spin_lock_irqsave(hba->host->host_lock, flags);
1640 + goto start;
1641 + }
1642 +@@ -5602,7 +5605,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
1643 + */
1644 + static irqreturn_t ufshcd_intr(int irq, void *__hba)
1645 + {
1646 +- u32 intr_status, enabled_intr_status;
1647 ++ u32 intr_status, enabled_intr_status = 0;
1648 + irqreturn_t retval = IRQ_NONE;
1649 + struct ufs_hba *hba = __hba;
1650 + int retries = hba->nutrs;
1651 +@@ -5616,7 +5619,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
1652 + * read, make sure we handle them by checking the interrupt status
1653 + * again in a loop until we process all of the reqs before returning.
1654 + */
1655 +- do {
1656 ++ while (intr_status && retries--) {
1657 + enabled_intr_status =
1658 + intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
1659 + if (intr_status)
1660 +@@ -5627,7 +5630,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
1661 + }
1662 +
1663 + intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
1664 +- } while (intr_status && --retries);
1665 ++ }
1666 +
1667 + spin_unlock(hba->host->host_lock);
1668 + return retval;
1669 +@@ -5927,7 +5930,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
1670 + /* command completed already */
1671 + dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n",
1672 + __func__, tag);
1673 +- goto out;
1674 ++ goto cleanup;
1675 + } else {
1676 + dev_err(hba->dev,
1677 + "%s: no response from device. tag = %d, err %d\n",
1678 +@@ -5961,6 +5964,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
1679 + goto out;
1680 + }
1681 +
1682 ++cleanup:
1683 + scsi_dma_unmap(cmd);
1684 +
1685 + spin_lock_irqsave(host->host_lock, flags);
1686 +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
1687 +index ad1e55d3d5d59..391a20b3d2fda 100644
1688 +--- a/drivers/spi/spi-stm32.c
1689 ++++ b/drivers/spi/spi-stm32.c
1690 +@@ -254,7 +254,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz)
1691 + {
1692 + u32 div, mbrdiv;
1693 +
1694 +- div = DIV_ROUND_UP(spi->clk_rate, speed_hz);
1695 ++ /* Ensure spi->clk_rate is even */
1696 ++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz);
1697 +
1698 + /*
1699 + * SPI framework set xfer->speed_hz to master->max_speed_hz if
1700 +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
1701 +index 9c05e820857aa..91dbac7446a47 100644
1702 +--- a/drivers/target/target_core_user.c
1703 ++++ b/drivers/target/target_core_user.c
1704 +@@ -1231,7 +1231,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
1705 +
1706 + struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
1707 +
1708 +- tcmu_flush_dcache_range(entry, sizeof(*entry));
1709 ++ /*
1710 ++ * Flush max. up to end of cmd ring since current entry might
1711 ++ * be a padding that is shorter than sizeof(*entry)
1712 ++ */
1713 ++ size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
1714 ++ udev->cmdr_size);
1715 ++ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
1716 ++ ring_left : sizeof(*entry));
1717 +
1718 + if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
1719 + UPDATE_HEAD(udev->cmdr_last_cleaned,
1720 +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
1721 +index d39162e71f59d..195f58c5b477f 100644
1722 +--- a/drivers/tty/serial/8250/8250_exar.c
1723 ++++ b/drivers/tty/serial/8250/8250_exar.c
1724 +@@ -638,6 +638,24 @@ static const struct exar8250_board pbn_exar_XR17V35x = {
1725 + .exit = pci_xr17v35x_exit,
1726 + };
1727 +
1728 ++static const struct exar8250_board pbn_fastcom35x_2 = {
1729 ++ .num_ports = 2,
1730 ++ .setup = pci_xr17v35x_setup,
1731 ++ .exit = pci_xr17v35x_exit,
1732 ++};
1733 ++
1734 ++static const struct exar8250_board pbn_fastcom35x_4 = {
1735 ++ .num_ports = 4,
1736 ++ .setup = pci_xr17v35x_setup,
1737 ++ .exit = pci_xr17v35x_exit,
1738 ++};
1739 ++
1740 ++static const struct exar8250_board pbn_fastcom35x_8 = {
1741 ++ .num_ports = 8,
1742 ++ .setup = pci_xr17v35x_setup,
1743 ++ .exit = pci_xr17v35x_exit,
1744 ++};
1745 ++
1746 + static const struct exar8250_board pbn_exar_XR17V4358 = {
1747 + .num_ports = 12,
1748 + .setup = pci_xr17v35x_setup,
1749 +@@ -708,9 +726,9 @@ static const struct pci_device_id exar_pci_tbl[] = {
1750 + EXAR_DEVICE(EXAR, EXAR_XR17V358, pbn_exar_XR17V35x),
1751 + EXAR_DEVICE(EXAR, EXAR_XR17V4358, pbn_exar_XR17V4358),
1752 + EXAR_DEVICE(EXAR, EXAR_XR17V8358, pbn_exar_XR17V8358),
1753 +- EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_exar_XR17V35x),
1754 +- EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_exar_XR17V35x),
1755 +- EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_exar_XR17V35x),
1756 ++ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_fastcom35x_2),
1757 ++ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_fastcom35x_4),
1758 ++ EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_fastcom35x_8),
1759 +
1760 + EXAR_DEVICE(COMMTECH, COMMTECH_4222PCI335, pbn_fastcom335_2),
1761 + EXAR_DEVICE(COMMTECH, COMMTECH_4224PCI335, pbn_fastcom335_4),
1762 +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
1763 +index 20b799219826e..09f0dc3b967b1 100644
1764 +--- a/drivers/tty/serial/8250/8250_port.c
1765 ++++ b/drivers/tty/serial/8250/8250_port.c
1766 +@@ -2259,6 +2259,10 @@ int serial8250_do_startup(struct uart_port *port)
1767 +
1768 + if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) {
1769 + unsigned char iir1;
1770 ++
1771 ++ if (port->irqflags & IRQF_SHARED)
1772 ++ disable_irq_nosync(port->irq);
1773 ++
1774 + /*
1775 + * Test for UARTs that do not reassert THRE when the
1776 + * transmitter is idle and the interrupt has already
1777 +@@ -2268,8 +2272,6 @@ int serial8250_do_startup(struct uart_port *port)
1778 + * allow register changes to become visible.
1779 + */
1780 + spin_lock_irqsave(&port->lock, flags);
1781 +- if (up->port.irqflags & IRQF_SHARED)
1782 +- disable_irq_nosync(port->irq);
1783 +
1784 + wait_for_xmitr(up, UART_LSR_THRE);
1785 + serial_port_out_sync(port, UART_IER, UART_IER_THRI);
1786 +@@ -2281,9 +2283,10 @@ int serial8250_do_startup(struct uart_port *port)
1787 + iir = serial_port_in(port, UART_IIR);
1788 + serial_port_out(port, UART_IER, 0);
1789 +
1790 ++ spin_unlock_irqrestore(&port->lock, flags);
1791 ++
1792 + if (port->irqflags & IRQF_SHARED)
1793 + enable_irq(port->irq);
1794 +- spin_unlock_irqrestore(&port->lock, flags);
1795 +
1796 + /*
1797 + * If the interrupt is not reasserted, or we otherwise
1798 +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
1799 +index 1d501154e9f78..45e4f29521430 100644
1800 +--- a/drivers/tty/serial/amba-pl011.c
1801 ++++ b/drivers/tty/serial/amba-pl011.c
1802 +@@ -2252,9 +2252,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
1803 + clk_disable(uap->clk);
1804 + }
1805 +
1806 +-static void __init
1807 +-pl011_console_get_options(struct uart_amba_port *uap, int *baud,
1808 +- int *parity, int *bits)
1809 ++static void pl011_console_get_options(struct uart_amba_port *uap, int *baud,
1810 ++ int *parity, int *bits)
1811 + {
1812 + if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) {
1813 + unsigned int lcr_h, ibrd, fbrd;
1814 +@@ -2287,7 +2286,7 @@ pl011_console_get_options(struct uart_amba_port *uap, int *baud,
1815 + }
1816 + }
1817 +
1818 +-static int __init pl011_console_setup(struct console *co, char *options)
1819 ++static int pl011_console_setup(struct console *co, char *options)
1820 + {
1821 + struct uart_amba_port *uap;
1822 + int baud = 38400;
1823 +@@ -2355,8 +2354,8 @@ static int __init pl011_console_setup(struct console *co, char *options)
1824 + *
1825 + * Returns 0 if console matches; otherwise non-zero to use default matching
1826 + */
1827 +-static int __init pl011_console_match(struct console *co, char *name, int idx,
1828 +- char *options)
1829 ++static int pl011_console_match(struct console *co, char *name, int idx,
1830 ++ char *options)
1831 + {
1832 + unsigned char iotype;
1833 + resource_size_t addr;
1834 +@@ -2594,7 +2593,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
1835 +
1836 + static int pl011_register_port(struct uart_amba_port *uap)
1837 + {
1838 +- int ret;
1839 ++ int ret, i;
1840 +
1841 + /* Ensure interrupts from this UART are masked and cleared */
1842 + pl011_write(0, uap, REG_IMSC);
1843 +@@ -2605,6 +2604,9 @@ static int pl011_register_port(struct uart_amba_port *uap)
1844 + if (ret < 0) {
1845 + dev_err(uap->port.dev,
1846 + "Failed to register AMBA-PL011 driver\n");
1847 ++ for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
1848 ++ if (amba_ports[i] == uap)
1849 ++ amba_ports[i] = NULL;
1850 + return ret;
1851 + }
1852 + }
1853 +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
1854 +index 2a49b6d876b87..fcb89bf2524d1 100644
1855 +--- a/drivers/tty/serial/samsung.c
1856 ++++ b/drivers/tty/serial/samsung.c
1857 +@@ -1755,9 +1755,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
1858 + ourport->tx_irq = ret + 1;
1859 + }
1860 +
1861 +- ret = platform_get_irq(platdev, 1);
1862 +- if (ret > 0)
1863 +- ourport->tx_irq = ret;
1864 ++ if (!s3c24xx_serial_has_interrupt_mask(port)) {
1865 ++ ret = platform_get_irq(platdev, 1);
1866 ++ if (ret > 0)
1867 ++ ourport->tx_irq = ret;
1868 ++ }
1869 + /*
1870 + * DMA is currently supported only on DT platforms, if DMA properties
1871 + * are specified.
1872 +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
1873 +index 982d9684c65e3..758f522f331e4 100644
1874 +--- a/drivers/tty/vt/vt.c
1875 ++++ b/drivers/tty/vt/vt.c
1876 +@@ -1199,7 +1199,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
1877 + unsigned int old_rows, old_row_size, first_copied_row;
1878 + unsigned int new_cols, new_rows, new_row_size, new_screen_size;
1879 + unsigned int user;
1880 +- unsigned short *newscreen;
1881 ++ unsigned short *oldscreen, *newscreen;
1882 + struct uni_screen *new_uniscr = NULL;
1883 +
1884 + WARN_CONSOLE_UNLOCKED();
1885 +@@ -1297,10 +1297,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
1886 + if (new_scr_end > new_origin)
1887 + scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
1888 + new_scr_end - new_origin);
1889 +- kfree(vc->vc_screenbuf);
1890 ++ oldscreen = vc->vc_screenbuf;
1891 + vc->vc_screenbuf = newscreen;
1892 + vc->vc_screenbuf_size = new_screen_size;
1893 + set_origin(vc);
1894 ++ kfree(oldscreen);
1895 +
1896 + /* do part of a reset_terminal() */
1897 + vc->vc_top = 0;
1898 +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
1899 +index 5de81431c8351..6a82030cf1efb 100644
1900 +--- a/drivers/tty/vt/vt_ioctl.c
1901 ++++ b/drivers/tty/vt/vt_ioctl.c
1902 +@@ -893,12 +893,22 @@ int vt_ioctl(struct tty_struct *tty,
1903 + console_lock();
1904 + vcp = vc_cons[i].d;
1905 + if (vcp) {
1906 ++ int ret;
1907 ++ int save_scan_lines = vcp->vc_scan_lines;
1908 ++ int save_font_height = vcp->vc_font.height;
1909 ++
1910 + if (v.v_vlin)
1911 + vcp->vc_scan_lines = v.v_vlin;
1912 + if (v.v_clin)
1913 + vcp->vc_font.height = v.v_clin;
1914 + vcp->vc_resize_user = 1;
1915 +- vc_resize(vcp, v.v_cols, v.v_rows);
1916 ++ ret = vc_resize(vcp, v.v_cols, v.v_rows);
1917 ++ if (ret) {
1918 ++ vcp->vc_scan_lines = save_scan_lines;
1919 ++ vcp->vc_font.height = save_font_height;
1920 ++ console_unlock();
1921 ++ return ret;
1922 ++ }
1923 + }
1924 + console_unlock();
1925 + }
1926 +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
1927 +index ea7883e1fbe28..41453bf6fc0bd 100644
1928 +--- a/drivers/usb/class/cdc-acm.c
1929 ++++ b/drivers/usb/class/cdc-acm.c
1930 +@@ -378,21 +378,19 @@ static void acm_ctrl_irq(struct urb *urb)
1931 + if (current_size < expected_size) {
1932 + /* notification is transmitted fragmented, reassemble */
1933 + if (acm->nb_size < expected_size) {
1934 +- if (acm->nb_size) {
1935 +- kfree(acm->notification_buffer);
1936 +- acm->nb_size = 0;
1937 +- }
1938 ++ u8 *new_buffer;
1939 + alloc_size = roundup_pow_of_two(expected_size);
1940 +- /*
1941 +- * kmalloc ensures a valid notification_buffer after a
1942 +- * use of kfree in case the previous allocation was too
1943 +- * small. Final freeing is done on disconnect.
1944 +- */
1945 +- acm->notification_buffer =
1946 +- kmalloc(alloc_size, GFP_ATOMIC);
1947 +- if (!acm->notification_buffer)
1948 ++ /* Final freeing is done on disconnect. */
1949 ++ new_buffer = krealloc(acm->notification_buffer,
1950 ++ alloc_size, GFP_ATOMIC);
1951 ++ if (!new_buffer) {
1952 ++ acm->nb_index = 0;
1953 + goto exit;
1954 ++ }
1955 ++
1956 ++ acm->notification_buffer = new_buffer;
1957 + acm->nb_size = alloc_size;
1958 ++ dr = (struct usb_cdc_notification *)acm->notification_buffer;
1959 + }
1960 +
1961 + copy_size = min(current_size,
1962 +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
1963 +index c96c50faccf72..2f068e525a374 100644
1964 +--- a/drivers/usb/core/quirks.c
1965 ++++ b/drivers/usb/core/quirks.c
1966 +@@ -370,6 +370,10 @@ static const struct usb_device_id usb_quirk_list[] = {
1967 + { USB_DEVICE(0x0926, 0x0202), .driver_info =
1968 + USB_QUIRK_ENDPOINT_BLACKLIST },
1969 +
1970 ++ /* Sound Devices MixPre-D */
1971 ++ { USB_DEVICE(0x0926, 0x0208), .driver_info =
1972 ++ USB_QUIRK_ENDPOINT_BLACKLIST },
1973 ++
1974 + /* Keytouch QWERTY Panel keyboard */
1975 + { USB_DEVICE(0x0926, 0x3333), .driver_info =
1976 + USB_QUIRK_CONFIG_INTF_STRINGS },
1977 +@@ -465,6 +469,8 @@ static const struct usb_device_id usb_quirk_list[] = {
1978 +
1979 + { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
1980 +
1981 ++ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
1982 ++
1983 + /* DJI CineSSD */
1984 + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
1985 +
1986 +@@ -509,6 +515,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
1987 + */
1988 + static const struct usb_device_id usb_endpoint_blacklist[] = {
1989 + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
1990 ++ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
1991 + { }
1992 + };
1993 +
1994 +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
1995 +index 2f5f4ca5c0d04..7bf2573dd459e 100644
1996 +--- a/drivers/usb/dwc3/gadget.c
1997 ++++ b/drivers/usb/dwc3/gadget.c
1998 +@@ -1017,26 +1017,24 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
1999 + * dwc3_prepare_one_trb - setup one TRB from one request
2000 + * @dep: endpoint for which this request is prepared
2001 + * @req: dwc3_request pointer
2002 ++ * @trb_length: buffer size of the TRB
2003 + * @chain: should this TRB be chained to the next?
2004 + * @node: only for isochronous endpoints. First TRB needs different type.
2005 + */
2006 + static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
2007 +- struct dwc3_request *req, unsigned chain, unsigned node)
2008 ++ struct dwc3_request *req, unsigned int trb_length,
2009 ++ unsigned chain, unsigned node)
2010 + {
2011 + struct dwc3_trb *trb;
2012 +- unsigned int length;
2013 + dma_addr_t dma;
2014 + unsigned stream_id = req->request.stream_id;
2015 + unsigned short_not_ok = req->request.short_not_ok;
2016 + unsigned no_interrupt = req->request.no_interrupt;
2017 +
2018 +- if (req->request.num_sgs > 0) {
2019 +- length = sg_dma_len(req->start_sg);
2020 ++ if (req->request.num_sgs > 0)
2021 + dma = sg_dma_address(req->start_sg);
2022 +- } else {
2023 +- length = req->request.length;
2024 ++ else
2025 + dma = req->request.dma;
2026 +- }
2027 +
2028 + trb = &dep->trb_pool[dep->trb_enqueue];
2029 +
2030 +@@ -1048,7 +1046,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
2031 +
2032 + req->num_trbs++;
2033 +
2034 +- __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node,
2035 ++ __dwc3_prepare_one_trb(dep, trb, dma, trb_length, chain, node,
2036 + stream_id, short_not_ok, no_interrupt);
2037 + }
2038 +
2039 +@@ -1058,16 +1056,27 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
2040 + struct scatterlist *sg = req->start_sg;
2041 + struct scatterlist *s;
2042 + int i;
2043 +-
2044 ++ unsigned int length = req->request.length;
2045 + unsigned int remaining = req->request.num_mapped_sgs
2046 + - req->num_queued_sgs;
2047 +
2048 ++ /*
2049 ++ * If we resume preparing the request, then get the remaining length of
2050 ++ * the request and resume where we left off.
2051 ++ */
2052 ++ for_each_sg(req->request.sg, s, req->num_queued_sgs, i)
2053 ++ length -= sg_dma_len(s);
2054 ++
2055 + for_each_sg(sg, s, remaining, i) {
2056 +- unsigned int length = req->request.length;
2057 + unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
2058 + unsigned int rem = length % maxp;
2059 ++ unsigned int trb_length;
2060 + unsigned chain = true;
2061 +
2062 ++ trb_length = min_t(unsigned int, length, sg_dma_len(s));
2063 ++
2064 ++ length -= trb_length;
2065 ++
2066 + /*
2067 + * IOMMU driver is coalescing the list of sgs which shares a
2068 + * page boundary into one and giving it to USB driver. With
2069 +@@ -1075,7 +1084,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
2070 + * sgs passed. So mark the chain bit to false if it isthe last
2071 + * mapped sg.
2072 + */
2073 +- if (i == remaining - 1)
2074 ++ if ((i == remaining - 1) || !length)
2075 + chain = false;
2076 +
2077 + if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) {
2078 +@@ -1085,7 +1094,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
2079 + req->needs_extra_trb = true;
2080 +
2081 + /* prepare normal TRB */
2082 +- dwc3_prepare_one_trb(dep, req, true, i);
2083 ++ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
2084 +
2085 + /* Now prepare one extra TRB to align transfer size */
2086 + trb = &dep->trb_pool[dep->trb_enqueue];
2087 +@@ -1095,8 +1104,37 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
2088 + req->request.stream_id,
2089 + req->request.short_not_ok,
2090 + req->request.no_interrupt);
2091 ++ } else if (req->request.zero && req->request.length &&
2092 ++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
2093 ++ !rem && !chain) {
2094 ++ struct dwc3 *dwc = dep->dwc;
2095 ++ struct dwc3_trb *trb;
2096 ++
2097 ++ req->needs_extra_trb = true;
2098 ++
2099 ++ /* Prepare normal TRB */
2100 ++ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
2101 ++
2102 ++ /* Prepare one extra TRB to handle ZLP */
2103 ++ trb = &dep->trb_pool[dep->trb_enqueue];
2104 ++ req->num_trbs++;
2105 ++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
2106 ++ !req->direction, 1,
2107 ++ req->request.stream_id,
2108 ++ req->request.short_not_ok,
2109 ++ req->request.no_interrupt);
2110 ++
2111 ++ /* Prepare one more TRB to handle MPS alignment */
2112 ++ if (!req->direction) {
2113 ++ trb = &dep->trb_pool[dep->trb_enqueue];
2114 ++ req->num_trbs++;
2115 ++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
2116 ++ false, 1, req->request.stream_id,
2117 ++ req->request.short_not_ok,
2118 ++ req->request.no_interrupt);
2119 ++ }
2120 + } else {
2121 +- dwc3_prepare_one_trb(dep, req, chain, i);
2122 ++ dwc3_prepare_one_trb(dep, req, trb_length, chain, i);
2123 + }
2124 +
2125 + /*
2126 +@@ -1111,6 +1149,16 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
2127 +
2128 + req->num_queued_sgs++;
2129 +
2130 ++ /*
2131 ++ * The number of pending SG entries may not correspond to the
2132 ++ * number of mapped SG entries. If all the data are queued, then
2133 ++ * don't include unused SG entries.
2134 ++ */
2135 ++ if (length == 0) {
2136 ++ req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;
2137 ++ break;
2138 ++ }
2139 ++
2140 + if (!dwc3_calc_trbs_left(dep))
2141 + break;
2142 + }
2143 +@@ -1130,7 +1178,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
2144 + req->needs_extra_trb = true;
2145 +
2146 + /* prepare normal TRB */
2147 +- dwc3_prepare_one_trb(dep, req, true, 0);
2148 ++ dwc3_prepare_one_trb(dep, req, length, true, 0);
2149 +
2150 + /* Now prepare one extra TRB to align transfer size */
2151 + trb = &dep->trb_pool[dep->trb_enqueue];
2152 +@@ -1140,6 +1188,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
2153 + req->request.short_not_ok,
2154 + req->request.no_interrupt);
2155 + } else if (req->request.zero && req->request.length &&
2156 ++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
2157 + (IS_ALIGNED(req->request.length, maxp))) {
2158 + struct dwc3 *dwc = dep->dwc;
2159 + struct dwc3_trb *trb;
2160 +@@ -1147,17 +1196,27 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
2161 + req->needs_extra_trb = true;
2162 +
2163 + /* prepare normal TRB */
2164 +- dwc3_prepare_one_trb(dep, req, true, 0);
2165 ++ dwc3_prepare_one_trb(dep, req, length, true, 0);
2166 +
2167 +- /* Now prepare one extra TRB to handle ZLP */
2168 ++ /* Prepare one extra TRB to handle ZLP */
2169 + trb = &dep->trb_pool[dep->trb_enqueue];
2170 + req->num_trbs++;
2171 + __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
2172 +- false, 1, req->request.stream_id,
2173 ++ !req->direction, 1, req->request.stream_id,
2174 + req->request.short_not_ok,
2175 + req->request.no_interrupt);
2176 ++
2177 ++ /* Prepare one more TRB to handle MPS alignment for OUT */
2178 ++ if (!req->direction) {
2179 ++ trb = &dep->trb_pool[dep->trb_enqueue];
2180 ++ req->num_trbs++;
2181 ++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
2182 ++ false, 1, req->request.stream_id,
2183 ++ req->request.short_not_ok,
2184 ++ req->request.no_interrupt);
2185 ++ }
2186 + } else {
2187 +- dwc3_prepare_one_trb(dep, req, false, 0);
2188 ++ dwc3_prepare_one_trb(dep, req, length, false, 0);
2189 + }
2190 + }
2191 +
2192 +@@ -2328,8 +2387,17 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
2193 + status);
2194 +
2195 + if (req->needs_extra_trb) {
2196 ++ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
2197 ++
2198 + ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
2199 + status);
2200 ++
2201 ++ /* Reclaim MPS padding TRB for ZLP */
2202 ++ if (!req->direction && req->request.zero && req->request.length &&
2203 ++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
2204 ++ (IS_ALIGNED(req->request.length, maxp)))
2205 ++ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event, status);
2206 ++
2207 + req->needs_extra_trb = false;
2208 + }
2209 +
2210 +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
2211 +index cfca4584ae135..8d8c81d430694 100644
2212 +--- a/drivers/usb/gadget/function/f_ncm.c
2213 ++++ b/drivers/usb/gadget/function/f_ncm.c
2214 +@@ -1184,12 +1184,15 @@ static int ncm_unwrap_ntb(struct gether *port,
2215 + int ndp_index;
2216 + unsigned dg_len, dg_len2;
2217 + unsigned ndp_len;
2218 ++ unsigned block_len;
2219 + struct sk_buff *skb2;
2220 + int ret = -EINVAL;
2221 +- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
2222 ++ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
2223 ++ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize);
2224 + const struct ndp_parser_opts *opts = ncm->parser_opts;
2225 + unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
2226 + int dgram_counter;
2227 ++ bool ndp_after_header;
2228 +
2229 + /* dwSignature */
2230 + if (get_unaligned_le32(tmp) != opts->nth_sign) {
2231 +@@ -1208,25 +1211,37 @@ static int ncm_unwrap_ntb(struct gether *port,
2232 + }
2233 + tmp++; /* skip wSequence */
2234 +
2235 ++ block_len = get_ncm(&tmp, opts->block_length);
2236 + /* (d)wBlockLength */
2237 +- if (get_ncm(&tmp, opts->block_length) > max_size) {
2238 ++ if (block_len > ntb_max) {
2239 + INFO(port->func.config->cdev, "OUT size exceeded\n");
2240 + goto err;
2241 + }
2242 +
2243 + ndp_index = get_ncm(&tmp, opts->ndp_index);
2244 ++ ndp_after_header = false;
2245 +
2246 + /* Run through all the NDP's in the NTB */
2247 + do {
2248 +- /* NCM 3.2 */
2249 +- if (((ndp_index % 4) != 0) &&
2250 +- (ndp_index < opts->nth_size)) {
2251 ++ /*
2252 ++ * NCM 3.2
2253 ++ * dwNdpIndex
2254 ++ */
2255 ++ if (((ndp_index % 4) != 0) ||
2256 ++ (ndp_index < opts->nth_size) ||
2257 ++ (ndp_index > (block_len -
2258 ++ opts->ndp_size))) {
2259 + INFO(port->func.config->cdev, "Bad index: %#X\n",
2260 + ndp_index);
2261 + goto err;
2262 + }
2263 ++ if (ndp_index == opts->nth_size)
2264 ++ ndp_after_header = true;
2265 +
2266 +- /* walk through NDP */
2267 ++ /*
2268 ++ * walk through NDP
2269 ++ * dwSignature
2270 ++ */
2271 + tmp = (void *)(skb->data + ndp_index);
2272 + if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
2273 + INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
2274 +@@ -1237,14 +1252,15 @@ static int ncm_unwrap_ntb(struct gether *port,
2275 + ndp_len = get_unaligned_le16(tmp++);
2276 + /*
2277 + * NCM 3.3.1
2278 ++ * wLength
2279 + * entry is 2 items
2280 + * item size is 16/32 bits, opts->dgram_item_len * 2 bytes
2281 + * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
2282 + * Each entry is a dgram index and a dgram length.
2283 + */
2284 + if ((ndp_len < opts->ndp_size
2285 +- + 2 * 2 * (opts->dgram_item_len * 2))
2286 +- || (ndp_len % opts->ndplen_align != 0)) {
2287 ++ + 2 * 2 * (opts->dgram_item_len * 2)) ||
2288 ++ (ndp_len % opts->ndplen_align != 0)) {
2289 + INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
2290 + ndp_len);
2291 + goto err;
2292 +@@ -1261,8 +1277,21 @@ static int ncm_unwrap_ntb(struct gether *port,
2293 +
2294 + do {
2295 + index = index2;
2296 ++ /* wDatagramIndex[0] */
2297 ++ if ((index < opts->nth_size) ||
2298 ++ (index > block_len - opts->dpe_size)) {
2299 ++ INFO(port->func.config->cdev,
2300 ++ "Bad index: %#X\n", index);
2301 ++ goto err;
2302 ++ }
2303 ++
2304 + dg_len = dg_len2;
2305 +- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */
2306 ++ /*
2307 ++ * wDatagramLength[0]
2308 ++ * ethernet hdr + crc or larger than max frame size
2309 ++ */
2310 ++ if ((dg_len < 14 + crc_len) ||
2311 ++ (dg_len > frame_max)) {
2312 + INFO(port->func.config->cdev,
2313 + "Bad dgram length: %#X\n", dg_len);
2314 + goto err;
2315 +@@ -1286,6 +1315,37 @@ static int ncm_unwrap_ntb(struct gether *port,
2316 + index2 = get_ncm(&tmp, opts->dgram_item_len);
2317 + dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
2318 +
2319 ++ if (index2 == 0 || dg_len2 == 0)
2320 ++ break;
2321 ++
2322 ++ /* wDatagramIndex[1] */
2323 ++ if (ndp_after_header) {
2324 ++ if (index2 < opts->nth_size + opts->ndp_size) {
2325 ++ INFO(port->func.config->cdev,
2326 ++ "Bad index: %#X\n", index2);
2327 ++ goto err;
2328 ++ }
2329 ++ } else {
2330 ++ if (index2 < opts->nth_size + opts->dpe_size) {
2331 ++ INFO(port->func.config->cdev,
2332 ++ "Bad index: %#X\n", index2);
2333 ++ goto err;
2334 ++ }
2335 ++ }
2336 ++ if (index2 > block_len - opts->dpe_size) {
2337 ++ INFO(port->func.config->cdev,
2338 ++ "Bad index: %#X\n", index2);
2339 ++ goto err;
2340 ++ }
2341 ++
2342 ++ /* wDatagramLength[1] */
2343 ++ if ((dg_len2 < 14 + crc_len) ||
2344 ++ (dg_len2 > frame_max)) {
2345 ++ INFO(port->func.config->cdev,
2346 ++ "Bad dgram length: %#X\n", dg_len);
2347 ++ goto err;
2348 ++ }
2349 ++
2350 + /*
2351 + * Copy the data into a new skb.
2352 + * This ensures the truesize is correct
2353 +@@ -1302,9 +1362,6 @@ static int ncm_unwrap_ntb(struct gether *port,
2354 + ndp_len -= 2 * (opts->dgram_item_len * 2);
2355 +
2356 + dgram_counter++;
2357 +-
2358 +- if (index2 == 0 || dg_len2 == 0)
2359 +- break;
2360 + } while (ndp_len > 2 * (opts->dgram_item_len * 2));
2361 + } while (ndp_index);
2362 +
2363 +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
2364 +index 106988a6661ab..785826ab5348e 100644
2365 +--- a/drivers/usb/gadget/function/f_tcm.c
2366 ++++ b/drivers/usb/gadget/function/f_tcm.c
2367 +@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
2368 + goto err_sts;
2369 +
2370 + return 0;
2371 ++
2372 + err_sts:
2373 +- usb_ep_free_request(fu->ep_status, stream->req_status);
2374 +- stream->req_status = NULL;
2375 +-err_out:
2376 + usb_ep_free_request(fu->ep_out, stream->req_out);
2377 + stream->req_out = NULL;
2378 ++err_out:
2379 ++ usb_ep_free_request(fu->ep_in, stream->req_in);
2380 ++ stream->req_in = NULL;
2381 + out:
2382 + return -ENOMEM;
2383 + }
2384 +diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h
2385 +index 09f90447fed5d..cfa6426553375 100644
2386 +--- a/drivers/usb/gadget/u_f.h
2387 ++++ b/drivers/usb/gadget/u_f.h
2388 +@@ -14,6 +14,7 @@
2389 + #define __U_F_H__
2390 +
2391 + #include <linux/usb/gadget.h>
2392 ++#include <linux/overflow.h>
2393 +
2394 + /* Variable Length Array Macros **********************************************/
2395 + #define vla_group(groupname) size_t groupname##__next = 0
2396 +@@ -21,21 +22,36 @@
2397 +
2398 + #define vla_item(groupname, type, name, n) \
2399 + size_t groupname##_##name##__offset = ({ \
2400 +- size_t align_mask = __alignof__(type) - 1; \
2401 +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
2402 +- size_t size = (n) * sizeof(type); \
2403 +- groupname##__next = offset + size; \
2404 ++ size_t offset = 0; \
2405 ++ if (groupname##__next != SIZE_MAX) { \
2406 ++ size_t align_mask = __alignof__(type) - 1; \
2407 ++ size_t size = array_size(n, sizeof(type)); \
2408 ++ offset = (groupname##__next + align_mask) & \
2409 ++ ~align_mask; \
2410 ++ if (check_add_overflow(offset, size, \
2411 ++ &groupname##__next)) { \
2412 ++ groupname##__next = SIZE_MAX; \
2413 ++ offset = 0; \
2414 ++ } \
2415 ++ } \
2416 + offset; \
2417 + })
2418 +
2419 + #define vla_item_with_sz(groupname, type, name, n) \
2420 +- size_t groupname##_##name##__sz = (n) * sizeof(type); \
2421 +- size_t groupname##_##name##__offset = ({ \
2422 +- size_t align_mask = __alignof__(type) - 1; \
2423 +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
2424 +- size_t size = groupname##_##name##__sz; \
2425 +- groupname##__next = offset + size; \
2426 +- offset; \
2427 ++ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \
2428 ++ size_t groupname##_##name##__offset = ({ \
2429 ++ size_t offset = 0; \
2430 ++ if (groupname##__next != SIZE_MAX) { \
2431 ++ size_t align_mask = __alignof__(type) - 1; \
2432 ++ offset = (groupname##__next + align_mask) & \
2433 ++ ~align_mask; \
2434 ++ if (check_add_overflow(offset, groupname##_##name##__sz,\
2435 ++ &groupname##__next)) { \
2436 ++ groupname##__next = SIZE_MAX; \
2437 ++ offset = 0; \
2438 ++ } \
2439 ++ } \
2440 ++ offset; \
2441 + })
2442 +
2443 + #define vla_ptr(ptr, groupname, name) \
2444 +diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
2445 +index c0c4dcca6f3cb..a4a88b6de3c48 100644
2446 +--- a/drivers/usb/host/ohci-exynos.c
2447 ++++ b/drivers/usb/host/ohci-exynos.c
2448 +@@ -156,9 +156,8 @@ static int exynos_ohci_probe(struct platform_device *pdev)
2449 + hcd->rsrc_len = resource_size(res);
2450 +
2451 + irq = platform_get_irq(pdev, 0);
2452 +- if (!irq) {
2453 +- dev_err(&pdev->dev, "Failed to get IRQ\n");
2454 +- err = -ENODEV;
2455 ++ if (irq < 0) {
2456 ++ err = irq;
2457 + goto fail_io;
2458 + }
2459 +
2460 +diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
2461 +index 76c3f29562d2b..448d7b11dec4c 100644
2462 +--- a/drivers/usb/host/xhci-debugfs.c
2463 ++++ b/drivers/usb/host/xhci-debugfs.c
2464 +@@ -273,7 +273,7 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused)
2465 +
2466 + static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
2467 + {
2468 +- int dci;
2469 ++ int ep_index;
2470 + dma_addr_t dma;
2471 + struct xhci_hcd *xhci;
2472 + struct xhci_ep_ctx *ep_ctx;
2473 +@@ -282,9 +282,9 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
2474 +
2475 + xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
2476 +
2477 +- for (dci = 1; dci < 32; dci++) {
2478 +- ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci);
2479 +- dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params);
2480 ++ for (ep_index = 0; ep_index < 31; ep_index++) {
2481 ++ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
2482 ++ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params);
2483 + seq_printf(s, "%pad: %s\n", &dma,
2484 + xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
2485 + le32_to_cpu(ep_ctx->ep_info2),
2486 +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
2487 +index a58ef53e4ae1d..64dc94853b8b5 100644
2488 +--- a/drivers/usb/host/xhci-hub.c
2489 ++++ b/drivers/usb/host/xhci-hub.c
2490 +@@ -736,15 +736,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
2491 + {
2492 + u32 pls = status_reg & PORT_PLS_MASK;
2493 +
2494 +- /* resume state is a xHCI internal state.
2495 +- * Do not report it to usb core, instead, pretend to be U3,
2496 +- * thus usb core knows it's not ready for transfer
2497 +- */
2498 +- if (pls == XDEV_RESUME) {
2499 +- *status |= USB_SS_PORT_LS_U3;
2500 +- return;
2501 +- }
2502 +-
2503 + /* When the CAS bit is set then warm reset
2504 + * should be performed on port
2505 + */
2506 +@@ -766,6 +757,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
2507 + */
2508 + pls |= USB_PORT_STAT_CONNECTION;
2509 + } else {
2510 ++ /*
2511 ++ * Resume state is an xHCI internal state. Do not report it to
2512 ++ * usb core, instead, pretend to be U3, thus usb core knows
2513 ++ * it's not ready for transfer.
2514 ++ */
2515 ++ if (pls == XDEV_RESUME) {
2516 ++ *status |= USB_SS_PORT_LS_U3;
2517 ++ return;
2518 ++ }
2519 ++
2520 + /*
2521 + * If CAS bit isn't set but the Port is already at
2522 + * Compliance Mode, fake a connection so the USB core
2523 +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
2524 +index f8e71c7aba6e6..6f976c4cccdae 100644
2525 +--- a/drivers/usb/host/xhci.c
2526 ++++ b/drivers/usb/host/xhci.c
2527 +@@ -3154,10 +3154,11 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
2528 +
2529 + wait_for_completion(cfg_cmd->completion);
2530 +
2531 +- ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
2532 + xhci_free_command(xhci, cfg_cmd);
2533 + cleanup:
2534 + xhci_free_command(xhci, stop_cmd);
2535 ++ if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
2536 ++ ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
2537 + }
2538 +
2539 + static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
2540 +diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
2541 +index e5c03c6d16e9e..d3b161bdef749 100644
2542 +--- a/drivers/usb/misc/lvstest.c
2543 ++++ b/drivers/usb/misc/lvstest.c
2544 +@@ -429,7 +429,7 @@ static int lvs_rh_probe(struct usb_interface *intf,
2545 + USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT);
2546 + if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) {
2547 + dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret);
2548 +- return ret;
2549 ++ return ret < 0 ? ret : -EINVAL;
2550 + }
2551 +
2552 + /* submit urb to poll interrupt endpoint */
2553 +diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
2554 +index 6376be1f5fd22..4877bf82ad395 100644
2555 +--- a/drivers/usb/misc/sisusbvga/sisusb.c
2556 ++++ b/drivers/usb/misc/sisusbvga/sisusb.c
2557 +@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
2558 + u8 swap8, fromkern = kernbuffer ? 1 : 0;
2559 + u16 swap16;
2560 + u32 swap32, flag = (length >> 28) & 1;
2561 +- char buf[4];
2562 ++ u8 buf[4];
2563 +
2564 + /* if neither kernbuffer not userbuffer are given, assume
2565 + * data in obuf
2566 +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
2567 +index be0505b8b5d4e..785080f790738 100644
2568 +--- a/drivers/usb/misc/yurex.c
2569 ++++ b/drivers/usb/misc/yurex.c
2570 +@@ -492,7 +492,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
2571 + prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
2572 + dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
2573 + dev->cntl_buffer[0]);
2574 +- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
2575 ++ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
2576 + if (retval >= 0)
2577 + timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
2578 + finish_wait(&dev->waitq, &wait);
2579 +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
2580 +index f6c3681fa2e9e..88275842219ef 100644
2581 +--- a/drivers/usb/storage/unusual_devs.h
2582 ++++ b/drivers/usb/storage/unusual_devs.h
2583 +@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114,
2584 + "JMicron",
2585 + "USB to ATA/ATAPI Bridge",
2586 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2587 +- US_FL_BROKEN_FUA ),
2588 ++ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
2589 +
2590 + /* Reported by Andrey Rahmatullin <wrar@××××××××.org> */
2591 + UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
2592 +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
2593 +index 37157ed9a881a..dcdfcdfd2ad13 100644
2594 +--- a/drivers/usb/storage/unusual_uas.h
2595 ++++ b/drivers/usb/storage/unusual_uas.h
2596 +@@ -28,6 +28,13 @@
2597 + * and don't forget to CC: the USB development list <linux-usb@×××××××××××.org>
2598 + */
2599 +
2600 ++/* Reported-by: Till Dörges <doerges@×××××××××.de> */
2601 ++UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
2602 ++ "Sony",
2603 ++ "PSZ-HA*",
2604 ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2605 ++ US_FL_NO_REPORT_OPCODES),
2606 ++
2607 + /* Reported-by: Julian Groß <julian.g@××××××.de> */
2608 + UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
2609 + "LaCie",
2610 +@@ -80,6 +87,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
2611 + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2612 + US_FL_BROKEN_FUA),
2613 +
2614 ++/* Reported-by: Thinh Nguyen <thinhn@××××××××.com> */
2615 ++UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
2616 ++ "PNY",
2617 ++ "Pro Elite SSD",
2618 ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2619 ++ US_FL_NO_ATA_1X),
2620 ++
2621 + /* Reported-by: Hans de Goede <hdegoede@××××××.com> */
2622 + UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
2623 + "VIA",
2624 +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
2625 +index cb93a6b381609..f75557b39a61d 100644
2626 +--- a/drivers/video/fbdev/core/fbcon.c
2627 ++++ b/drivers/video/fbdev/core/fbcon.c
2628 +@@ -2152,6 +2152,9 @@ static void updatescrollmode(struct display *p,
2629 + }
2630 + }
2631 +
2632 ++#define PITCH(w) (((w) + 7) >> 3)
2633 ++#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
2634 ++
2635 + static int fbcon_resize(struct vc_data *vc, unsigned int width,
2636 + unsigned int height, unsigned int user)
2637 + {
2638 +@@ -2161,6 +2164,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
2639 + struct fb_var_screeninfo var = info->var;
2640 + int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
2641 +
2642 ++ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
2643 ++ int size;
2644 ++ int pitch = PITCH(vc->vc_font.width);
2645 ++
2646 ++ /*
2647 ++ * If user font, ensure that a possible change to user font
2648 ++ * height or width will not allow a font data out-of-bounds access.
2649 ++ * NOTE: must use original charcount in calculation as font
2650 ++ * charcount can change and cannot be used to determine the
2651 ++ * font data allocated size.
2652 ++ */
2653 ++ if (pitch <= 0)
2654 ++ return -EINVAL;
2655 ++ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
2656 ++ if (size > FNTSIZE(vc->vc_font.data))
2657 ++ return -EINVAL;
2658 ++ }
2659 ++
2660 + virt_w = FBCON_SWAP(ops->rotate, width, height);
2661 + virt_h = FBCON_SWAP(ops->rotate, height, width);
2662 + virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
2663 +@@ -2623,7 +2644,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
2664 + int size;
2665 + int i, csum;
2666 + u8 *new_data, *data = font->data;
2667 +- int pitch = (font->width+7) >> 3;
2668 ++ int pitch = PITCH(font->width);
2669 +
2670 + /* Is there a reason why fbconsole couldn't handle any charcount >256?
2671 + * If not this check should be changed to charcount < 256 */
2672 +@@ -2639,7 +2660,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
2673 + if (fbcon_invalid_charcount(info, charcount))
2674 + return -EINVAL;
2675 +
2676 +- size = h * pitch * charcount;
2677 ++ size = CALC_FONTSZ(h, pitch, charcount);
2678 +
2679 + new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
2680 +
2681 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
2682 +index a06d9c25765c5..0bd582e845f31 100644
2683 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
2684 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
2685 +@@ -531,8 +531,11 @@ int dispc_runtime_get(void)
2686 + DSSDBG("dispc_runtime_get\n");
2687 +
2688 + r = pm_runtime_get_sync(&dispc.pdev->dev);
2689 +- WARN_ON(r < 0);
2690 +- return r < 0 ? r : 0;
2691 ++ if (WARN_ON(r < 0)) {
2692 ++ pm_runtime_put_sync(&dispc.pdev->dev);
2693 ++ return r;
2694 ++ }
2695 ++ return 0;
2696 + }
2697 + EXPORT_SYMBOL(dispc_runtime_get);
2698 +
2699 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
2700 +index 8e1d60d48dbb0..50792d31533bf 100644
2701 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
2702 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
2703 +@@ -1148,8 +1148,11 @@ static int dsi_runtime_get(struct platform_device *dsidev)
2704 + DSSDBG("dsi_runtime_get\n");
2705 +
2706 + r = pm_runtime_get_sync(&dsi->pdev->dev);
2707 +- WARN_ON(r < 0);
2708 +- return r < 0 ? r : 0;
2709 ++ if (WARN_ON(r < 0)) {
2710 ++ pm_runtime_put_sync(&dsi->pdev->dev);
2711 ++ return r;
2712 ++ }
2713 ++ return 0;
2714 + }
2715 +
2716 + static void dsi_runtime_put(struct platform_device *dsidev)
2717 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
2718 +index b6c6c24979dd6..faebf9a773ba5 100644
2719 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
2720 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
2721 +@@ -779,8 +779,11 @@ int dss_runtime_get(void)
2722 + DSSDBG("dss_runtime_get\n");
2723 +
2724 + r = pm_runtime_get_sync(&dss.pdev->dev);
2725 +- WARN_ON(r < 0);
2726 +- return r < 0 ? r : 0;
2727 ++ if (WARN_ON(r < 0)) {
2728 ++ pm_runtime_put_sync(&dss.pdev->dev);
2729 ++ return r;
2730 ++ }
2731 ++ return 0;
2732 + }
2733 +
2734 + void dss_runtime_put(void)
2735 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
2736 +index 28de56e21c74b..9fd9a02bb871d 100644
2737 +--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
2738 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
2739 +@@ -50,9 +50,10 @@ static int hdmi_runtime_get(void)
2740 + DSSDBG("hdmi_runtime_get\n");
2741 +
2742 + r = pm_runtime_get_sync(&hdmi.pdev->dev);
2743 +- WARN_ON(r < 0);
2744 +- if (r < 0)
2745 ++ if (WARN_ON(r < 0)) {
2746 ++ pm_runtime_put_sync(&hdmi.pdev->dev);
2747 + return r;
2748 ++ }
2749 +
2750 + return 0;
2751 + }
2752 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
2753 +index 2e2fcc3d6d4f7..13f3a5ce55294 100644
2754 +--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
2755 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
2756 +@@ -54,9 +54,10 @@ static int hdmi_runtime_get(void)
2757 + DSSDBG("hdmi_runtime_get\n");
2758 +
2759 + r = pm_runtime_get_sync(&hdmi.pdev->dev);
2760 +- WARN_ON(r < 0);
2761 +- if (r < 0)
2762 ++ if (WARN_ON(r < 0)) {
2763 ++ pm_runtime_put_sync(&hdmi.pdev->dev);
2764 + return r;
2765 ++ }
2766 +
2767 + return 0;
2768 + }
2769 +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
2770 +index 392464da12e41..96714b4596d2d 100644
2771 +--- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c
2772 ++++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
2773 +@@ -402,8 +402,11 @@ static int venc_runtime_get(void)
2774 + DSSDBG("venc_runtime_get\n");
2775 +
2776 + r = pm_runtime_get_sync(&venc.pdev->dev);
2777 +- WARN_ON(r < 0);
2778 +- return r < 0 ? r : 0;
2779 ++ if (WARN_ON(r < 0)) {
2780 ++ pm_runtime_put_sync(&venc.pdev->dev);
2781 ++ return r;
2782 ++ }
2783 ++ return 0;
2784 + }
2785 +
2786 + static void venc_runtime_put(void)
2787 +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
2788 +index 8d49b91d92cd3..95e5a9300ff04 100644
2789 +--- a/drivers/xen/events/events_base.c
2790 ++++ b/drivers/xen/events/events_base.c
2791 +@@ -154,7 +154,7 @@ int get_evtchn_to_irq(unsigned evtchn)
2792 + /* Get info for IRQ */
2793 + struct irq_info *info_for_irq(unsigned irq)
2794 + {
2795 +- return irq_get_handler_data(irq);
2796 ++ return irq_get_chip_data(irq);
2797 + }
2798 +
2799 + /* Constructors for packed IRQ information. */
2800 +@@ -375,7 +375,7 @@ static void xen_irq_init(unsigned irq)
2801 + info->type = IRQT_UNBOUND;
2802 + info->refcnt = -1;
2803 +
2804 +- irq_set_handler_data(irq, info);
2805 ++ irq_set_chip_data(irq, info);
2806 +
2807 + list_add_tail(&info->list, &xen_irq_list_head);
2808 + }
2809 +@@ -424,14 +424,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
2810 +
2811 + static void xen_free_irq(unsigned irq)
2812 + {
2813 +- struct irq_info *info = irq_get_handler_data(irq);
2814 ++ struct irq_info *info = irq_get_chip_data(irq);
2815 +
2816 + if (WARN_ON(!info))
2817 + return;
2818 +
2819 + list_del(&info->list);
2820 +
2821 +- irq_set_handler_data(irq, NULL);
2822 ++ irq_set_chip_data(irq, NULL);
2823 +
2824 + WARN_ON(info->refcnt > 0);
2825 +
2826 +@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
2827 + static void __unbind_from_irq(unsigned int irq)
2828 + {
2829 + int evtchn = evtchn_from_irq(irq);
2830 +- struct irq_info *info = irq_get_handler_data(irq);
2831 ++ struct irq_info *info = irq_get_chip_data(irq);
2832 +
2833 + if (info->refcnt > 0) {
2834 + info->refcnt--;
2835 +@@ -1105,7 +1105,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
2836 +
2837 + void unbind_from_irqhandler(unsigned int irq, void *dev_id)
2838 + {
2839 +- struct irq_info *info = irq_get_handler_data(irq);
2840 ++ struct irq_info *info = irq_get_chip_data(irq);
2841 +
2842 + if (WARN_ON(!info))
2843 + return;
2844 +@@ -1139,7 +1139,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
2845 + if (irq == -1)
2846 + return -ENOENT;
2847 +
2848 +- info = irq_get_handler_data(irq);
2849 ++ info = irq_get_chip_data(irq);
2850 +
2851 + if (!info)
2852 + return -ENOENT;
2853 +@@ -1167,7 +1167,7 @@ int evtchn_get(unsigned int evtchn)
2854 + if (irq == -1)
2855 + goto done;
2856 +
2857 +- info = irq_get_handler_data(irq);
2858 ++ info = irq_get_chip_data(irq);
2859 +
2860 + if (!info)
2861 + goto done;
2862 +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
2863 +index 3130844e219cf..cb21ffd3bba7c 100644
2864 +--- a/fs/btrfs/disk-io.c
2865 ++++ b/fs/btrfs/disk-io.c
2866 +@@ -4444,6 +4444,7 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache)
2867 + cache->io_ctl.inode = NULL;
2868 + iput(inode);
2869 + }
2870 ++ ASSERT(cache->io_ctl.pages == NULL);
2871 + btrfs_put_block_group(cache);
2872 + }
2873 +
2874 +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
2875 +index dc1841855a69a..646152f305843 100644
2876 +--- a/fs/btrfs/file.c
2877 ++++ b/fs/btrfs/file.c
2878 +@@ -3010,14 +3010,14 @@ reserve_space:
2879 + if (ret < 0)
2880 + goto out;
2881 + space_reserved = true;
2882 +- ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
2883 +- alloc_start, bytes_to_reserve);
2884 +- if (ret)
2885 +- goto out;
2886 + ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend,
2887 + &cached_state);
2888 + if (ret)
2889 + goto out;
2890 ++ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
2891 ++ alloc_start, bytes_to_reserve);
2892 ++ if (ret)
2893 ++ goto out;
2894 + ret = btrfs_prealloc_file_range(inode, mode, alloc_start,
2895 + alloc_end - alloc_start,
2896 + i_blocksize(inode),
2897 +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
2898 +index 4c65305fd4180..652b0b16e93e2 100644
2899 +--- a/fs/btrfs/free-space-cache.c
2900 ++++ b/fs/btrfs/free-space-cache.c
2901 +@@ -1167,7 +1167,6 @@ static int __btrfs_wait_cache_io(struct btrfs_root *root,
2902 + ret = update_cache_item(trans, root, inode, path, offset,
2903 + io_ctl->entries, io_ctl->bitmaps);
2904 + out:
2905 +- io_ctl_free(io_ctl);
2906 + if (ret) {
2907 + invalidate_inode_pages2(inode->i_mapping);
2908 + BTRFS_I(inode)->generation = 0;
2909 +@@ -1332,6 +1331,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
2910 + * them out later
2911 + */
2912 + io_ctl_drop_pages(io_ctl);
2913 ++ io_ctl_free(io_ctl);
2914 +
2915 + unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
2916 + i_size_read(inode) - 1, &cached_state);
2917 +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
2918 +index 4d2810a32b4a9..40f5b4dcb9276 100644
2919 +--- a/fs/btrfs/super.c
2920 ++++ b/fs/btrfs/super.c
2921 +@@ -539,6 +539,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
2922 + } else if (strncmp(args[0].from, "lzo", 3) == 0) {
2923 + compress_type = "lzo";
2924 + info->compress_type = BTRFS_COMPRESS_LZO;
2925 ++ info->compress_level = 0;
2926 + btrfs_set_opt(info->mount_opt, COMPRESS);
2927 + btrfs_clear_opt(info->mount_opt, NODATACOW);
2928 + btrfs_clear_opt(info->mount_opt, NODATASUM);
2929 +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
2930 +index 090315f4ac78f..3e903e6a33870 100644
2931 +--- a/fs/btrfs/tree-log.c
2932 ++++ b/fs/btrfs/tree-log.c
2933 +@@ -3422,11 +3422,13 @@ fail:
2934 + btrfs_free_path(path);
2935 + out_unlock:
2936 + mutex_unlock(&dir->log_mutex);
2937 +- if (ret == -ENOSPC) {
2938 ++ if (err == -ENOSPC) {
2939 + btrfs_set_log_full_commit(root->fs_info, trans);
2940 +- ret = 0;
2941 +- } else if (ret < 0)
2942 +- btrfs_abort_transaction(trans, ret);
2943 ++ err = 0;
2944 ++ } else if (err < 0 && err != -ENOENT) {
2945 ++ /* ENOENT can be returned if the entry hasn't been fsynced yet */
2946 ++ btrfs_abort_transaction(trans, err);
2947 ++ }
2948 +
2949 + btrfs_end_log_trans(root);
2950 +
2951 +diff --git a/fs/buffer.c b/fs/buffer.c
2952 +index c49fdab5cb36e..362a868764599 100644
2953 +--- a/fs/buffer.c
2954 ++++ b/fs/buffer.c
2955 +@@ -3193,6 +3193,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags)
2956 + WARN_ON(atomic_read(&bh->b_count) < 1);
2957 + lock_buffer(bh);
2958 + if (test_clear_buffer_dirty(bh)) {
2959 ++ /*
2960 ++ * The bh should be mapped, but it might not be if the
2961 ++ * device was hot-removed. Not much we can do but fail the I/O.
2962 ++ */
2963 ++ if (!buffer_mapped(bh)) {
2964 ++ unlock_buffer(bh);
2965 ++ return -EIO;
2966 ++ }
2967 ++
2968 + get_bh(bh);
2969 + bh->b_end_io = end_buffer_write_sync;
2970 + ret = submit_bh(REQ_OP_WRITE, op_flags, bh);
2971 +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
2972 +index 0fa14d8b9c64c..5f3707a90e7f7 100644
2973 +--- a/fs/ceph/mds_client.c
2974 ++++ b/fs/ceph/mds_client.c
2975 +@@ -3615,6 +3615,9 @@ static void delayed_work(struct work_struct *work)
2976 + dout("mdsc delayed_work\n");
2977 + ceph_check_delayed_caps(mdsc);
2978 +
2979 ++ if (mdsc->stopping)
2980 ++ return;
2981 ++
2982 + mutex_lock(&mdsc->mutex);
2983 + renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
2984 + renew_caps = time_after_eq(jiffies, HZ*renew_interval +
2985 +@@ -3950,7 +3953,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
2986 + static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
2987 + {
2988 + dout("stop\n");
2989 +- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
2990 ++ /*
2991 ++ * Make sure the delayed work stopped before releasing
2992 ++ * the resources.
2993 ++ *
2994 ++ * Because the cancel_delayed_work_sync() will only
2995 ++ * guarantee that the work finishes executing. But the
2996 ++ * delayed work will re-arm itself again after that.
2997 ++ */
2998 ++ flush_delayed_work(&mdsc->delayed_work);
2999 ++
3000 + if (mdsc->mdsmap)
3001 + ceph_mdsmap_destroy(mdsc->mdsmap);
3002 + kfree(mdsc->sessions);
3003 +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
3004 +index 552164034d340..f22a89cdb4072 100644
3005 +--- a/fs/ext4/block_validity.c
3006 ++++ b/fs/ext4/block_validity.c
3007 +@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb)
3008 + int flex_size = ext4_flex_bg_size(sbi);
3009 + int ret;
3010 +
3011 +- if (!test_opt(sb, BLOCK_VALIDITY)) {
3012 +- if (sbi->system_blks)
3013 +- ext4_release_system_zone(sb);
3014 +- return 0;
3015 +- }
3016 +- if (sbi->system_blks)
3017 +- return 0;
3018 +-
3019 + system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
3020 + if (!system_blks)
3021 + return -ENOMEM;
3022 +diff --git a/fs/ext4/super.c b/fs/ext4/super.c
3023 +index 1428dab2afff8..0c15ff19acbd4 100644
3024 +--- a/fs/ext4/super.c
3025 ++++ b/fs/ext4/super.c
3026 +@@ -65,10 +65,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *,
3027 + unsigned long journal_devnum);
3028 + static int ext4_show_options(struct seq_file *seq, struct dentry *root);
3029 + static int ext4_commit_super(struct super_block *sb, int sync);
3030 +-static void ext4_mark_recovery_complete(struct super_block *sb,
3031 ++static int ext4_mark_recovery_complete(struct super_block *sb,
3032 + struct ext4_super_block *es);
3033 +-static void ext4_clear_journal_err(struct super_block *sb,
3034 +- struct ext4_super_block *es);
3035 ++static int ext4_clear_journal_err(struct super_block *sb,
3036 ++ struct ext4_super_block *es);
3037 + static int ext4_sync_fs(struct super_block *sb, int wait);
3038 + static int ext4_remount(struct super_block *sb, int *flags, char *data);
3039 + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
3040 +@@ -4473,11 +4473,13 @@ no_journal:
3041 +
3042 + ext4_set_resv_clusters(sb);
3043 +
3044 +- err = ext4_setup_system_zone(sb);
3045 +- if (err) {
3046 +- ext4_msg(sb, KERN_ERR, "failed to initialize system "
3047 +- "zone (%d)", err);
3048 +- goto failed_mount4a;
3049 ++ if (test_opt(sb, BLOCK_VALIDITY)) {
3050 ++ err = ext4_setup_system_zone(sb);
3051 ++ if (err) {
3052 ++ ext4_msg(sb, KERN_ERR, "failed to initialize system "
3053 ++ "zone (%d)", err);
3054 ++ goto failed_mount4a;
3055 ++ }
3056 + }
3057 +
3058 + ext4_ext_init(sb);
3059 +@@ -4545,7 +4547,9 @@ no_journal:
3060 + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
3061 + if (needs_recovery) {
3062 + ext4_msg(sb, KERN_INFO, "recovery complete");
3063 +- ext4_mark_recovery_complete(sb, es);
3064 ++ err = ext4_mark_recovery_complete(sb, es);
3065 ++ if (err)
3066 ++ goto failed_mount8;
3067 + }
3068 + if (EXT4_SB(sb)->s_journal) {
3069 + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
3070 +@@ -4588,10 +4592,8 @@ cantfind_ext4:
3071 + ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem");
3072 + goto failed_mount;
3073 +
3074 +-#ifdef CONFIG_QUOTA
3075 + failed_mount8:
3076 + ext4_unregister_sysfs(sb);
3077 +-#endif
3078 + failed_mount7:
3079 + ext4_unregister_li_request(sb);
3080 + failed_mount6:
3081 +@@ -4727,7 +4729,8 @@ static journal_t *ext4_get_journal(struct super_block *sb,
3082 + struct inode *journal_inode;
3083 + journal_t *journal;
3084 +
3085 +- BUG_ON(!ext4_has_feature_journal(sb));
3086 ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
3087 ++ return NULL;
3088 +
3089 + journal_inode = ext4_get_journal_inode(sb, journal_inum);
3090 + if (!journal_inode)
3091 +@@ -4757,7 +4760,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
3092 + struct ext4_super_block *es;
3093 + struct block_device *bdev;
3094 +
3095 +- BUG_ON(!ext4_has_feature_journal(sb));
3096 ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
3097 ++ return NULL;
3098 +
3099 + bdev = ext4_blkdev_get(j_dev, sb);
3100 + if (bdev == NULL)
3101 +@@ -4848,8 +4852,10 @@ static int ext4_load_journal(struct super_block *sb,
3102 + dev_t journal_dev;
3103 + int err = 0;
3104 + int really_read_only;
3105 ++ int journal_dev_ro;
3106 +
3107 +- BUG_ON(!ext4_has_feature_journal(sb));
3108 ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
3109 ++ return -EFSCORRUPTED;
3110 +
3111 + if (journal_devnum &&
3112 + journal_devnum != le32_to_cpu(es->s_journal_dev)) {
3113 +@@ -4859,7 +4865,31 @@ static int ext4_load_journal(struct super_block *sb,
3114 + } else
3115 + journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev));
3116 +
3117 +- really_read_only = bdev_read_only(sb->s_bdev);
3118 ++ if (journal_inum && journal_dev) {
3119 ++ ext4_msg(sb, KERN_ERR,
3120 ++ "filesystem has both journal inode and journal device!");
3121 ++ return -EINVAL;
3122 ++ }
3123 ++
3124 ++ if (journal_inum) {
3125 ++ journal = ext4_get_journal(sb, journal_inum);
3126 ++ if (!journal)
3127 ++ return -EINVAL;
3128 ++ } else {
3129 ++ journal = ext4_get_dev_journal(sb, journal_dev);
3130 ++ if (!journal)
3131 ++ return -EINVAL;
3132 ++ }
3133 ++
3134 ++ journal_dev_ro = bdev_read_only(journal->j_dev);
3135 ++ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro;
3136 ++
3137 ++ if (journal_dev_ro && !sb_rdonly(sb)) {
3138 ++ ext4_msg(sb, KERN_ERR,
3139 ++ "journal device read-only, try mounting with '-o ro'");
3140 ++ err = -EROFS;
3141 ++ goto err_out;
3142 ++ }
3143 +
3144 + /*
3145 + * Are we loading a blank journal or performing recovery after a
3146 +@@ -4874,27 +4904,14 @@ static int ext4_load_journal(struct super_block *sb,
3147 + ext4_msg(sb, KERN_ERR, "write access "
3148 + "unavailable, cannot proceed "
3149 + "(try mounting with noload)");
3150 +- return -EROFS;
3151 ++ err = -EROFS;
3152 ++ goto err_out;
3153 + }
3154 + ext4_msg(sb, KERN_INFO, "write access will "
3155 + "be enabled during recovery");
3156 + }
3157 + }
3158 +
3159 +- if (journal_inum && journal_dev) {
3160 +- ext4_msg(sb, KERN_ERR, "filesystem has both journal "
3161 +- "and inode journals!");
3162 +- return -EINVAL;
3163 +- }
3164 +-
3165 +- if (journal_inum) {
3166 +- if (!(journal = ext4_get_journal(sb, journal_inum)))
3167 +- return -EINVAL;
3168 +- } else {
3169 +- if (!(journal = ext4_get_dev_journal(sb, journal_dev)))
3170 +- return -EINVAL;
3171 +- }
3172 +-
3173 + if (!(journal->j_flags & JBD2_BARRIER))
3174 + ext4_msg(sb, KERN_INFO, "barriers disabled");
3175 +
3176 +@@ -4914,12 +4931,16 @@ static int ext4_load_journal(struct super_block *sb,
3177 +
3178 + if (err) {
3179 + ext4_msg(sb, KERN_ERR, "error loading journal");
3180 +- jbd2_journal_destroy(journal);
3181 +- return err;
3182 ++ goto err_out;
3183 + }
3184 +
3185 + EXT4_SB(sb)->s_journal = journal;
3186 +- ext4_clear_journal_err(sb, es);
3187 ++ err = ext4_clear_journal_err(sb, es);
3188 ++ if (err) {
3189 ++ EXT4_SB(sb)->s_journal = NULL;
3190 ++ jbd2_journal_destroy(journal);
3191 ++ return err;
3192 ++ }
3193 +
3194 + if (!really_read_only && journal_devnum &&
3195 + journal_devnum != le32_to_cpu(es->s_journal_dev)) {
3196 +@@ -4930,6 +4951,10 @@ static int ext4_load_journal(struct super_block *sb,
3197 + }
3198 +
3199 + return 0;
3200 ++
3201 ++err_out:
3202 ++ jbd2_journal_destroy(journal);
3203 ++ return err;
3204 + }
3205 +
3206 + static int ext4_commit_super(struct super_block *sb, int sync)
3207 +@@ -4941,13 +4966,6 @@ static int ext4_commit_super(struct super_block *sb, int sync)
3208 + if (!sbh || block_device_ejected(sb))
3209 + return error;
3210 +
3211 +- /*
3212 +- * The superblock bh should be mapped, but it might not be if the
3213 +- * device was hot-removed. Not much we can do but fail the I/O.
3214 +- */
3215 +- if (!buffer_mapped(sbh))
3216 +- return error;
3217 +-
3218 + /*
3219 + * If the file system is mounted read-only, don't update the
3220 + * superblock write time. This avoids updating the superblock
3221 +@@ -5015,26 +5033,32 @@ static int ext4_commit_super(struct super_block *sb, int sync)
3222 + * remounting) the filesystem readonly, then we will end up with a
3223 + * consistent fs on disk. Record that fact.
3224 + */
3225 +-static void ext4_mark_recovery_complete(struct super_block *sb,
3226 +- struct ext4_super_block *es)
3227 ++static int ext4_mark_recovery_complete(struct super_block *sb,
3228 ++ struct ext4_super_block *es)
3229 + {
3230 ++ int err;
3231 + journal_t *journal = EXT4_SB(sb)->s_journal;
3232 +
3233 + if (!ext4_has_feature_journal(sb)) {
3234 +- BUG_ON(journal != NULL);
3235 +- return;
3236 ++ if (journal != NULL) {
3237 ++ ext4_error(sb, "Journal got removed while the fs was "
3238 ++ "mounted!");
3239 ++ return -EFSCORRUPTED;
3240 ++ }
3241 ++ return 0;
3242 + }
3243 + jbd2_journal_lock_updates(journal);
3244 +- if (jbd2_journal_flush(journal) < 0)
3245 ++ err = jbd2_journal_flush(journal);
3246 ++ if (err < 0)
3247 + goto out;
3248 +
3249 + if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) {
3250 + ext4_clear_feature_journal_needs_recovery(sb);
3251 + ext4_commit_super(sb, 1);
3252 + }
3253 +-
3254 + out:
3255 + jbd2_journal_unlock_updates(journal);
3256 ++ return err;
3257 + }
3258 +
3259 + /*
3260 +@@ -5042,14 +5066,17 @@ out:
3261 + * has recorded an error from a previous lifetime, move that error to the
3262 + * main filesystem now.
3263 + */
3264 +-static void ext4_clear_journal_err(struct super_block *sb,
3265 ++static int ext4_clear_journal_err(struct super_block *sb,
3266 + struct ext4_super_block *es)
3267 + {
3268 + journal_t *journal;
3269 + int j_errno;
3270 + const char *errstr;
3271 +
3272 +- BUG_ON(!ext4_has_feature_journal(sb));
3273 ++ if (!ext4_has_feature_journal(sb)) {
3274 ++ ext4_error(sb, "Journal got removed while the fs was mounted!");
3275 ++ return -EFSCORRUPTED;
3276 ++ }
3277 +
3278 + journal = EXT4_SB(sb)->s_journal;
3279 +
3280 +@@ -5074,6 +5101,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
3281 + jbd2_journal_clear_err(journal);
3282 + jbd2_journal_update_sb_errno(journal);
3283 + }
3284 ++ return 0;
3285 + }
3286 +
3287 + /*
3288 +@@ -5216,7 +5244,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3289 + {
3290 + struct ext4_super_block *es;
3291 + struct ext4_sb_info *sbi = EXT4_SB(sb);
3292 +- unsigned long old_sb_flags;
3293 ++ unsigned long old_sb_flags, vfs_flags;
3294 + struct ext4_mount_options old_opts;
3295 + int enable_quota = 0;
3296 + ext4_group_t g;
3297 +@@ -5259,6 +5287,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3298 + if (sbi->s_journal && sbi->s_journal->j_task->io_context)
3299 + journal_ioprio = sbi->s_journal->j_task->io_context->ioprio;
3300 +
3301 ++ /*
3302 ++ * Some options can be enabled by ext4 and/or by VFS mount flag
3303 ++ * either way we need to make sure it matches in both *flags and
3304 ++ * s_flags. Copy those selected flags from *flags to s_flags
3305 ++ */
3306 ++ vfs_flags = SB_LAZYTIME | SB_I_VERSION;
3307 ++ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags);
3308 ++
3309 + if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) {
3310 + err = -EINVAL;
3311 + goto restore_opts;
3312 +@@ -5312,9 +5348,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3313 + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
3314 + }
3315 +
3316 +- if (*flags & SB_LAZYTIME)
3317 +- sb->s_flags |= SB_LAZYTIME;
3318 +-
3319 + if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) {
3320 + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
3321 + err = -EROFS;
3322 +@@ -5344,8 +5377,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3323 + (sbi->s_mount_state & EXT4_VALID_FS))
3324 + es->s_state = cpu_to_le16(sbi->s_mount_state);
3325 +
3326 +- if (sbi->s_journal)
3327 ++ if (sbi->s_journal) {
3328 ++ /*
3329 ++ * We let remount-ro finish even if marking fs
3330 ++ * as clean failed...
3331 ++ */
3332 + ext4_mark_recovery_complete(sb, es);
3333 ++ }
3334 + if (sbi->s_mmp_tsk)
3335 + kthread_stop(sbi->s_mmp_tsk);
3336 + } else {
3337 +@@ -5393,8 +5431,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3338 + * been changed by e2fsck since we originally mounted
3339 + * the partition.)
3340 + */
3341 +- if (sbi->s_journal)
3342 +- ext4_clear_journal_err(sb, es);
3343 ++ if (sbi->s_journal) {
3344 ++ err = ext4_clear_journal_err(sb, es);
3345 ++ if (err)
3346 ++ goto restore_opts;
3347 ++ }
3348 + sbi->s_mount_state = le16_to_cpu(es->s_state);
3349 +
3350 + err = ext4_setup_super(sb, es, 0);
3351 +@@ -5424,7 +5465,17 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3352 + ext4_register_li_request(sb, first_not_zeroed);
3353 + }
3354 +
3355 +- ext4_setup_system_zone(sb);
3356 ++ /*
3357 ++ * Handle creation of system zone data early because it can fail.
3358 ++ * Releasing of existing data is done when we are sure remount will
3359 ++ * succeed.
3360 ++ */
3361 ++ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) {
3362 ++ err = ext4_setup_system_zone(sb);
3363 ++ if (err)
3364 ++ goto restore_opts;
3365 ++ }
3366 ++
3367 + if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
3368 + err = ext4_commit_super(sb, 1);
3369 + if (err)
3370 +@@ -5445,8 +5496,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
3371 + }
3372 + }
3373 + #endif
3374 ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
3375 ++ ext4_release_system_zone(sb);
3376 ++
3377 ++ /*
3378 ++ * Some options can be enabled by ext4 and/or by VFS mount flag
3379 ++ * either way we need to make sure it matches in both *flags and
3380 ++ * s_flags. Copy those selected flags from s_flags to *flags
3381 ++ */
3382 ++ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags);
3383 +
3384 +- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
3385 + ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data);
3386 + kfree(orig_data);
3387 + return 0;
3388 +@@ -5460,6 +5519,8 @@ restore_opts:
3389 + sbi->s_commit_interval = old_opts.s_commit_interval;
3390 + sbi->s_min_batch_time = old_opts.s_min_batch_time;
3391 + sbi->s_max_batch_time = old_opts.s_max_batch_time;
3392 ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
3393 ++ ext4_release_system_zone(sb);
3394 + #ifdef CONFIG_QUOTA
3395 + sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
3396 + for (i = 0; i < EXT4_MAXQUOTAS; i++) {
3397 +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
3398 +index 6b5b685af5990..53ffa6fe207a3 100644
3399 +--- a/fs/f2fs/f2fs.h
3400 ++++ b/fs/f2fs/f2fs.h
3401 +@@ -2921,7 +2921,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
3402 + void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
3403 + void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
3404 + int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
3405 +-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
3406 ++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
3407 + int f2fs_recover_xattr_data(struct inode *inode, struct page *page);
3408 + int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page);
3409 + int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
3410 +@@ -3314,7 +3314,7 @@ int f2fs_read_inline_data(struct inode *inode, struct page *page);
3411 + int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page);
3412 + int f2fs_convert_inline_inode(struct inode *inode);
3413 + int f2fs_write_inline_data(struct inode *inode, struct page *page);
3414 +-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage);
3415 ++int f2fs_recover_inline_data(struct inode *inode, struct page *npage);
3416 + struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
3417 + struct fscrypt_name *fname, struct page **res_page);
3418 + int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent,
3419 +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
3420 +index c1ba29d10789d..2fabeb0bb28fd 100644
3421 +--- a/fs/f2fs/inline.c
3422 ++++ b/fs/f2fs/inline.c
3423 +@@ -256,7 +256,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)
3424 + return 0;
3425 + }
3426 +
3427 +-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
3428 ++int f2fs_recover_inline_data(struct inode *inode, struct page *npage)
3429 + {
3430 + struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
3431 + struct f2fs_inode *ri = NULL;
3432 +@@ -278,7 +278,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
3433 + ri && (ri->i_inline & F2FS_INLINE_DATA)) {
3434 + process_inline:
3435 + ipage = f2fs_get_node_page(sbi, inode->i_ino);
3436 +- f2fs_bug_on(sbi, IS_ERR(ipage));
3437 ++ if (IS_ERR(ipage))
3438 ++ return PTR_ERR(ipage);
3439 +
3440 + f2fs_wait_on_page_writeback(ipage, NODE, true);
3441 +
3442 +@@ -291,21 +292,25 @@ process_inline:
3443 +
3444 + set_page_dirty(ipage);
3445 + f2fs_put_page(ipage, 1);
3446 +- return true;
3447 ++ return 1;
3448 + }
3449 +
3450 + if (f2fs_has_inline_data(inode)) {
3451 + ipage = f2fs_get_node_page(sbi, inode->i_ino);
3452 +- f2fs_bug_on(sbi, IS_ERR(ipage));
3453 ++ if (IS_ERR(ipage))
3454 ++ return PTR_ERR(ipage);
3455 + f2fs_truncate_inline_inode(inode, ipage, 0);
3456 + clear_inode_flag(inode, FI_INLINE_DATA);
3457 + f2fs_put_page(ipage, 1);
3458 + } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
3459 +- if (f2fs_truncate_blocks(inode, 0, false))
3460 +- return false;
3461 ++ int ret;
3462 ++
3463 ++ ret = f2fs_truncate_blocks(inode, 0, false);
3464 ++ if (ret)
3465 ++ return ret;
3466 + goto process_inline;
3467 + }
3468 +- return false;
3469 ++ return 0;
3470 + }
3471 +
3472 + struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
3473 +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
3474 +index f0714c1258c79..2ff02541c53d5 100644
3475 +--- a/fs/f2fs/node.c
3476 ++++ b/fs/f2fs/node.c
3477 +@@ -2451,7 +2451,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink)
3478 + return nr - nr_shrink;
3479 + }
3480 +
3481 +-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
3482 ++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
3483 + {
3484 + void *src_addr, *dst_addr;
3485 + size_t inline_size;
3486 +@@ -2459,7 +2459,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
3487 + struct f2fs_inode *ri;
3488 +
3489 + ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino);
3490 +- f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(ipage));
3491 ++ if (IS_ERR(ipage))
3492 ++ return PTR_ERR(ipage);
3493 +
3494 + ri = F2FS_INODE(page);
3495 + if (ri->i_inline & F2FS_INLINE_XATTR) {
3496 +@@ -2478,6 +2479,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
3497 + update_inode:
3498 + f2fs_update_inode(inode, ipage);
3499 + f2fs_put_page(ipage, 1);
3500 ++ return 0;
3501 + }
3502 +
3503 + int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
3504 +diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
3505 +index 733f005b85d65..ad0486beee2c0 100644
3506 +--- a/fs/f2fs/recovery.c
3507 ++++ b/fs/f2fs/recovery.c
3508 +@@ -471,7 +471,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
3509 +
3510 + /* step 1: recover xattr */
3511 + if (IS_INODE(page)) {
3512 +- f2fs_recover_inline_xattr(inode, page);
3513 ++ err = f2fs_recover_inline_xattr(inode, page);
3514 ++ if (err)
3515 ++ goto out;
3516 + } else if (f2fs_has_xattr_block(ofs_of_node(page))) {
3517 + err = f2fs_recover_xattr_data(inode, page);
3518 + if (!err)
3519 +@@ -480,8 +482,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
3520 + }
3521 +
3522 + /* step 2: recover inline data */
3523 +- if (f2fs_recover_inline_data(inode, page))
3524 ++ err = f2fs_recover_inline_data(inode, page);
3525 ++ if (err) {
3526 ++ if (err == 1)
3527 ++ err = 0;
3528 + goto out;
3529 ++ }
3530 +
3531 + /* step 3: recover data indices */
3532 + start = f2fs_start_bidx_of_node(ofs_of_node(page), inode);
3533 +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
3534 +index 9782250c98156..161ce0eb8891a 100644
3535 +--- a/fs/f2fs/super.c
3536 ++++ b/fs/f2fs/super.c
3537 +@@ -1004,6 +1004,9 @@ static void f2fs_put_super(struct super_block *sb)
3538 + int i;
3539 + bool dropped;
3540 +
3541 ++ /* unregister procfs/sysfs entries in advance to avoid race case */
3542 ++ f2fs_unregister_sysfs(sbi);
3543 ++
3544 + f2fs_quota_off_umount(sb);
3545 +
3546 + /* prevent remaining shrinker jobs */
3547 +@@ -1067,8 +1070,6 @@ static void f2fs_put_super(struct super_block *sb)
3548 +
3549 + kfree(sbi->ckpt);
3550 +
3551 +- f2fs_unregister_sysfs(sbi);
3552 +-
3553 + sb->s_fs_info = NULL;
3554 + if (sbi->s_chksum_driver)
3555 + crypto_free_shash(sbi->s_chksum_driver);
3556 +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
3557 +index 7bfeb1643c1f4..15216b440880a 100644
3558 +--- a/fs/fs-writeback.c
3559 ++++ b/fs/fs-writeback.c
3560 +@@ -45,7 +45,6 @@ struct wb_completion {
3561 + struct wb_writeback_work {
3562 + long nr_pages;
3563 + struct super_block *sb;
3564 +- unsigned long *older_than_this;
3565 + enum writeback_sync_modes sync_mode;
3566 + unsigned int tagged_writepages:1;
3567 + unsigned int for_kupdate:1;
3568 +@@ -160,7 +159,9 @@ static void inode_io_list_del_locked(struct inode *inode,
3569 + struct bdi_writeback *wb)
3570 + {
3571 + assert_spin_locked(&wb->list_lock);
3572 ++ assert_spin_locked(&inode->i_lock);
3573 +
3574 ++ inode->i_state &= ~I_SYNC_QUEUED;
3575 + list_del_init(&inode->i_io_list);
3576 + wb_io_lists_depopulated(wb);
3577 + }
3578 +@@ -1042,7 +1043,9 @@ void inode_io_list_del(struct inode *inode)
3579 + struct bdi_writeback *wb;
3580 +
3581 + wb = inode_to_wb_and_lock_list(inode);
3582 ++ spin_lock(&inode->i_lock);
3583 + inode_io_list_del_locked(inode, wb);
3584 ++ spin_unlock(&inode->i_lock);
3585 + spin_unlock(&wb->list_lock);
3586 + }
3587 +
3588 +@@ -1091,8 +1094,10 @@ void sb_clear_inode_writeback(struct inode *inode)
3589 + * the case then the inode must have been redirtied while it was being written
3590 + * out and we don't reset its dirtied_when.
3591 + */
3592 +-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
3593 ++static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
3594 + {
3595 ++ assert_spin_locked(&inode->i_lock);
3596 ++
3597 + if (!list_empty(&wb->b_dirty)) {
3598 + struct inode *tail;
3599 +
3600 +@@ -1101,6 +1106,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
3601 + inode->dirtied_when = jiffies;
3602 + }
3603 + inode_io_list_move_locked(inode, wb, &wb->b_dirty);
3604 ++ inode->i_state &= ~I_SYNC_QUEUED;
3605 ++}
3606 ++
3607 ++static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
3608 ++{
3609 ++ spin_lock(&inode->i_lock);
3610 ++ redirty_tail_locked(inode, wb);
3611 ++ spin_unlock(&inode->i_lock);
3612 + }
3613 +
3614 + /*
3615 +@@ -1139,16 +1152,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t)
3616 + #define EXPIRE_DIRTY_ATIME 0x0001
3617 +
3618 + /*
3619 +- * Move expired (dirtied before work->older_than_this) dirty inodes from
3620 ++ * Move expired (dirtied before dirtied_before) dirty inodes from
3621 + * @delaying_queue to @dispatch_queue.
3622 + */
3623 + static int move_expired_inodes(struct list_head *delaying_queue,
3624 + struct list_head *dispatch_queue,
3625 +- int flags,
3626 +- struct wb_writeback_work *work)
3627 ++ int flags, unsigned long dirtied_before)
3628 + {
3629 +- unsigned long *older_than_this = NULL;
3630 +- unsigned long expire_time;
3631 + LIST_HEAD(tmp);
3632 + struct list_head *pos, *node;
3633 + struct super_block *sb = NULL;
3634 +@@ -1156,21 +1166,17 @@ static int move_expired_inodes(struct list_head *delaying_queue,
3635 + int do_sb_sort = 0;
3636 + int moved = 0;
3637 +
3638 +- if ((flags & EXPIRE_DIRTY_ATIME) == 0)
3639 +- older_than_this = work->older_than_this;
3640 +- else if (!work->for_sync) {
3641 +- expire_time = jiffies - (dirtytime_expire_interval * HZ);
3642 +- older_than_this = &expire_time;
3643 +- }
3644 + while (!list_empty(delaying_queue)) {
3645 + inode = wb_inode(delaying_queue->prev);
3646 +- if (older_than_this &&
3647 +- inode_dirtied_after(inode, *older_than_this))
3648 ++ if (inode_dirtied_after(inode, dirtied_before))
3649 + break;
3650 + list_move(&inode->i_io_list, &tmp);
3651 + moved++;
3652 ++ spin_lock(&inode->i_lock);
3653 + if (flags & EXPIRE_DIRTY_ATIME)
3654 +- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state);
3655 ++ inode->i_state |= I_DIRTY_TIME_EXPIRED;
3656 ++ inode->i_state |= I_SYNC_QUEUED;
3657 ++ spin_unlock(&inode->i_lock);
3658 + if (sb_is_blkdev_sb(inode->i_sb))
3659 + continue;
3660 + if (sb && sb != inode->i_sb)
3661 +@@ -1208,18 +1214,22 @@ out:
3662 + * |
3663 + * +--> dequeue for IO
3664 + */
3665 +-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
3666 ++static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
3667 ++ unsigned long dirtied_before)
3668 + {
3669 + int moved;
3670 ++ unsigned long time_expire_jif = dirtied_before;
3671 +
3672 + assert_spin_locked(&wb->list_lock);
3673 + list_splice_init(&wb->b_more_io, &wb->b_io);
3674 +- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work);
3675 ++ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
3676 ++ if (!work->for_sync)
3677 ++ time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
3678 + moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
3679 +- EXPIRE_DIRTY_ATIME, work);
3680 ++ EXPIRE_DIRTY_ATIME, time_expire_jif);
3681 + if (moved)
3682 + wb_io_lists_populated(wb);
3683 +- trace_writeback_queue_io(wb, work, moved);
3684 ++ trace_writeback_queue_io(wb, work, dirtied_before, moved);
3685 + }
3686 +
3687 + static int write_inode(struct inode *inode, struct writeback_control *wbc)
3688 +@@ -1313,7 +1323,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
3689 + * writeback is not making progress due to locked
3690 + * buffers. Skip this inode for now.
3691 + */
3692 +- redirty_tail(inode, wb);
3693 ++ redirty_tail_locked(inode, wb);
3694 + return;
3695 + }
3696 +
3697 +@@ -1333,7 +1343,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
3698 + * retrying writeback of the dirty page/inode
3699 + * that cannot be performed immediately.
3700 + */
3701 +- redirty_tail(inode, wb);
3702 ++ redirty_tail_locked(inode, wb);
3703 + }
3704 + } else if (inode->i_state & I_DIRTY) {
3705 + /*
3706 +@@ -1341,10 +1351,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
3707 + * such as delayed allocation during submission or metadata
3708 + * updates after data IO completion.
3709 + */
3710 +- redirty_tail(inode, wb);
3711 ++ redirty_tail_locked(inode, wb);
3712 + } else if (inode->i_state & I_DIRTY_TIME) {
3713 + inode->dirtied_when = jiffies;
3714 + inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
3715 ++ inode->i_state &= ~I_SYNC_QUEUED;
3716 + } else {
3717 + /* The inode is clean. Remove from writeback lists. */
3718 + inode_io_list_del_locked(inode, wb);
3719 +@@ -1588,8 +1599,8 @@ static long writeback_sb_inodes(struct super_block *sb,
3720 + */
3721 + spin_lock(&inode->i_lock);
3722 + if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
3723 ++ redirty_tail_locked(inode, wb);
3724 + spin_unlock(&inode->i_lock);
3725 +- redirty_tail(inode, wb);
3726 + continue;
3727 + }
3728 + if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) {
3729 +@@ -1730,7 +1741,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
3730 + blk_start_plug(&plug);
3731 + spin_lock(&wb->list_lock);
3732 + if (list_empty(&wb->b_io))
3733 +- queue_io(wb, &work);
3734 ++ queue_io(wb, &work, jiffies);
3735 + __writeback_inodes_wb(wb, &work);
3736 + spin_unlock(&wb->list_lock);
3737 + blk_finish_plug(&plug);
3738 +@@ -1750,7 +1761,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
3739 + * takes longer than a dirty_writeback_interval interval, then leave a
3740 + * one-second gap.
3741 + *
3742 +- * older_than_this takes precedence over nr_to_write. So we'll only write back
3743 ++ * dirtied_before takes precedence over nr_to_write. So we'll only write back
3744 + * all dirty pages if they are all attached to "old" mappings.
3745 + */
3746 + static long wb_writeback(struct bdi_writeback *wb,
3747 +@@ -1758,14 +1769,11 @@ static long wb_writeback(struct bdi_writeback *wb,
3748 + {
3749 + unsigned long wb_start = jiffies;
3750 + long nr_pages = work->nr_pages;
3751 +- unsigned long oldest_jif;
3752 ++ unsigned long dirtied_before = jiffies;
3753 + struct inode *inode;
3754 + long progress;
3755 + struct blk_plug plug;
3756 +
3757 +- oldest_jif = jiffies;
3758 +- work->older_than_this = &oldest_jif;
3759 +-
3760 + blk_start_plug(&plug);
3761 + spin_lock(&wb->list_lock);
3762 + for (;;) {
3763 +@@ -1799,14 +1807,14 @@ static long wb_writeback(struct bdi_writeback *wb,
3764 + * safe.
3765 + */
3766 + if (work->for_kupdate) {
3767 +- oldest_jif = jiffies -
3768 ++ dirtied_before = jiffies -
3769 + msecs_to_jiffies(dirty_expire_interval * 10);
3770 + } else if (work->for_background)
3771 +- oldest_jif = jiffies;
3772 ++ dirtied_before = jiffies;
3773 +
3774 + trace_writeback_start(wb, work);
3775 + if (list_empty(&wb->b_io))
3776 +- queue_io(wb, work);
3777 ++ queue_io(wb, work, dirtied_before);
3778 + if (work->sb)
3779 + progress = writeback_sb_inodes(work->sb, wb, work);
3780 + else
3781 +@@ -2208,11 +2216,12 @@ void __mark_inode_dirty(struct inode *inode, int flags)
3782 + inode->i_state |= flags;
3783 +
3784 + /*
3785 +- * If the inode is being synced, just update its dirty state.
3786 +- * The unlocker will place the inode on the appropriate
3787 +- * superblock list, based upon its state.
3788 ++ * If the inode is queued for writeback by flush worker, just
3789 ++ * update its dirty state. Once the flush worker is done with
3790 ++ * the inode it will place it on the appropriate superblock
3791 ++ * list, based upon its state.
3792 + */
3793 +- if (inode->i_state & I_SYNC)
3794 ++ if (inode->i_state & I_SYNC_QUEUED)
3795 + goto out_unlock_inode;
3796 +
3797 + /*
3798 +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
3799 +index 43693b6797105..8c305593fb51f 100644
3800 +--- a/fs/jbd2/transaction.c
3801 ++++ b/fs/jbd2/transaction.c
3802 +@@ -1915,6 +1915,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
3803 + */
3804 + static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
3805 + {
3806 ++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
3807 ++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
3808 ++
3809 + __jbd2_journal_temp_unlink_buffer(jh);
3810 + jh->b_transaction = NULL;
3811 + jbd2_journal_put_journal_head(jh);
3812 +@@ -2006,6 +2009,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
3813 + {
3814 + struct buffer_head *head;
3815 + struct buffer_head *bh;
3816 ++ bool has_write_io_error = false;
3817 + int ret = 0;
3818 +
3819 + J_ASSERT(PageLocked(page));
3820 +@@ -2030,11 +2034,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
3821 + jbd_unlock_bh_state(bh);
3822 + if (buffer_jbd(bh))
3823 + goto busy;
3824 ++
3825 ++ /*
3826 ++ * If we free a metadata buffer which has been failed to
3827 ++ * write out, the jbd2 checkpoint procedure will not detect
3828 ++ * this failure and may lead to filesystem inconsistency
3829 ++ * after cleanup journal tail.
3830 ++ */
3831 ++ if (buffer_write_io_error(bh)) {
3832 ++ pr_err("JBD2: Error while async write back metadata bh %llu.",
3833 ++ (unsigned long long)bh->b_blocknr);
3834 ++ has_write_io_error = true;
3835 ++ }
3836 + } while ((bh = bh->b_this_page) != head);
3837 +
3838 + ret = try_to_free_buffers(page);
3839 +
3840 + busy:
3841 ++ if (has_write_io_error)
3842 ++ jbd2_journal_abort(journal, -EIO);
3843 ++
3844 + return ret;
3845 + }
3846 +
3847 +@@ -2462,6 +2481,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
3848 +
3849 + was_dirty = test_clear_buffer_jbddirty(bh);
3850 + __jbd2_journal_temp_unlink_buffer(jh);
3851 ++
3852 ++ /*
3853 ++ * b_transaction must be set, otherwise the new b_transaction won't
3854 ++ * be holding jh reference
3855 ++ */
3856 ++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
3857 ++
3858 + /*
3859 + * We set b_transaction here because b_next_transaction will inherit
3860 + * our jh reference and thus __jbd2_journal_file_buffer() must not
3861 +diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
3862 +index 901f27ac94abc..56e9043bddc71 100644
3863 +--- a/fs/xfs/xfs_icache.c
3864 ++++ b/fs/xfs/xfs_icache.c
3865 +@@ -1127,7 +1127,7 @@ restart:
3866 + goto out_ifunlock;
3867 + xfs_iunpin_wait(ip);
3868 + }
3869 +- if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) {
3870 ++ if (xfs_inode_clean(ip)) {
3871 + xfs_ifunlock(ip);
3872 + goto reclaim;
3873 + }
3874 +@@ -1214,6 +1214,7 @@ reclaim:
3875 + xfs_ilock(ip, XFS_ILOCK_EXCL);
3876 + xfs_qm_dqdetach(ip);
3877 + xfs_iunlock(ip, XFS_ILOCK_EXCL);
3878 ++ ASSERT(xfs_inode_clean(ip));
3879 +
3880 + __xfs_inode_free(ip);
3881 + return error;
3882 +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
3883 +index f2d06e1e49066..cd81d6d9848d1 100644
3884 +--- a/fs/xfs/xfs_inode.c
3885 ++++ b/fs/xfs/xfs_inode.c
3886 +@@ -1772,10 +1772,31 @@ xfs_inactive_ifree(
3887 + return error;
3888 + }
3889 +
3890 ++ /*
3891 ++ * We do not hold the inode locked across the entire rolling transaction
3892 ++ * here. We only need to hold it for the first transaction that
3893 ++ * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the
3894 ++ * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode
3895 ++ * here breaks the relationship between cluster buffer invalidation and
3896 ++ * stale inode invalidation on cluster buffer item journal commit
3897 ++ * completion, and can result in leaving dirty stale inodes hanging
3898 ++ * around in memory.
3899 ++ *
3900 ++ * We have no need for serialising this inode operation against other
3901 ++ * operations - we freed the inode and hence reallocation is required
3902 ++ * and that will serialise on reallocating the space the deferops need
3903 ++ * to free. Hence we can unlock the inode on the first commit of
3904 ++ * the transaction rather than roll it right through the deferops. This
3905 ++ * avoids relogging the XFS_ISTALE inode.
3906 ++ *
3907 ++ * We check that xfs_ifree() hasn't grown an internal transaction roll
3908 ++ * by asserting that the inode is still locked when it returns.
3909 ++ */
3910 + xfs_ilock(ip, XFS_ILOCK_EXCL);
3911 +- xfs_trans_ijoin(tp, ip, 0);
3912 ++ xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
3913 +
3914 + error = xfs_ifree(tp, ip);
3915 ++ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
3916 + if (error) {
3917 + /*
3918 + * If we fail to free the inode, shut down. The cancel
3919 +@@ -1788,7 +1809,6 @@ xfs_inactive_ifree(
3920 + xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
3921 + }
3922 + xfs_trans_cancel(tp);
3923 +- xfs_iunlock(ip, XFS_ILOCK_EXCL);
3924 + return error;
3925 + }
3926 +
3927 +@@ -1806,7 +1826,6 @@ xfs_inactive_ifree(
3928 + xfs_notice(mp, "%s: xfs_trans_commit returned error %d",
3929 + __func__, error);
3930 +
3931 +- xfs_iunlock(ip, XFS_ILOCK_EXCL);
3932 + return 0;
3933 + }
3934 +
3935 +diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
3936 +index 542927321a61b..ae453dd236a69 100644
3937 +--- a/fs/xfs/xfs_trans_inode.c
3938 ++++ b/fs/xfs/xfs_trans_inode.c
3939 +@@ -39,6 +39,7 @@ xfs_trans_ijoin(
3940 +
3941 + ASSERT(iip->ili_lock_flags == 0);
3942 + iip->ili_lock_flags = lock_flags;
3943 ++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
3944 +
3945 + /*
3946 + * Get a log_item_desc to point at the new item.
3947 +@@ -90,6 +91,7 @@ xfs_trans_log_inode(
3948 +
3949 + ASSERT(ip->i_itemp != NULL);
3950 + ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
3951 ++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
3952 +
3953 + /*
3954 + * Don't bother with i_lock for the I_DIRTY_TIME check here, as races
3955 +diff --git a/include/linux/efi.h b/include/linux/efi.h
3956 +index 6797811bf1e6c..9a5d4b4992716 100644
3957 +--- a/include/linux/efi.h
3958 ++++ b/include/linux/efi.h
3959 +@@ -996,7 +996,11 @@ extern void *efi_get_pal_addr (void);
3960 + extern void efi_map_pal_code (void);
3961 + extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg);
3962 + extern void efi_gettimeofday (struct timespec64 *ts);
3963 ++#ifdef CONFIG_EFI
3964 + extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */
3965 ++#else
3966 ++static inline void efi_enter_virtual_mode (void) {}
3967 ++#endif
3968 + #ifdef CONFIG_X86
3969 + extern void efi_free_boot_services(void);
3970 + extern efi_status_t efi_query_variable_store(u32 attributes,
3971 +diff --git a/include/linux/fs.h b/include/linux/fs.h
3972 +index 8d568b51778ba..876bfb6df06a9 100644
3973 +--- a/include/linux/fs.h
3974 ++++ b/include/linux/fs.h
3975 +@@ -2050,6 +2050,10 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
3976 + *
3977 + * I_CREATING New object's inode in the middle of setting up.
3978 + *
3979 ++ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists.
3980 ++ * Used to detect that mark_inode_dirty() should not move
3981 ++ * inode between dirty lists.
3982 ++ *
3983 + * Q: What is the difference between I_WILL_FREE and I_FREEING?
3984 + */
3985 + #define I_DIRTY_SYNC (1 << 0)
3986 +@@ -2067,11 +2071,11 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
3987 + #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP)
3988 + #define I_LINKABLE (1 << 10)
3989 + #define I_DIRTY_TIME (1 << 11)
3990 +-#define __I_DIRTY_TIME_EXPIRED 12
3991 +-#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED)
3992 ++#define I_DIRTY_TIME_EXPIRED (1 << 12)
3993 + #define I_WB_SWITCH (1 << 13)
3994 + #define I_OVL_INUSE (1 << 14)
3995 + #define I_CREATING (1 << 15)
3996 ++#define I_SYNC_QUEUED (1 << 17)
3997 +
3998 + #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
3999 + #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES)
4000 +diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
4001 +index 32db72c7c055f..29d09755e5cfc 100644
4002 +--- a/include/trace/events/writeback.h
4003 ++++ b/include/trace/events/writeback.h
4004 +@@ -360,8 +360,9 @@ DEFINE_WBC_EVENT(wbc_writepage);
4005 + TRACE_EVENT(writeback_queue_io,
4006 + TP_PROTO(struct bdi_writeback *wb,
4007 + struct wb_writeback_work *work,
4008 ++ unsigned long dirtied_before,
4009 + int moved),
4010 +- TP_ARGS(wb, work, moved),
4011 ++ TP_ARGS(wb, work, dirtied_before, moved),
4012 + TP_STRUCT__entry(
4013 + __array(char, name, 32)
4014 + __field(unsigned long, older)
4015 +@@ -371,19 +372,17 @@ TRACE_EVENT(writeback_queue_io,
4016 + __field(unsigned int, cgroup_ino)
4017 + ),
4018 + TP_fast_assign(
4019 +- unsigned long *older_than_this = work->older_than_this;
4020 + strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
4021 +- __entry->older = older_than_this ? *older_than_this : 0;
4022 +- __entry->age = older_than_this ?
4023 +- (jiffies - *older_than_this) * 1000 / HZ : -1;
4024 ++ __entry->older = dirtied_before;
4025 ++ __entry->age = (jiffies - dirtied_before) * 1000 / HZ;
4026 + __entry->moved = moved;
4027 + __entry->reason = work->reason;
4028 + __entry->cgroup_ino = __trace_wb_assign_cgroup(wb);
4029 + ),
4030 + TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u",
4031 + __entry->name,
4032 +- __entry->older, /* older_than_this in jiffies */
4033 +- __entry->age, /* older_than_this in relative milliseconds */
4034 ++ __entry->older, /* dirtied_before in jiffies */
4035 ++ __entry->age, /* dirtied_before in relative milliseconds */
4036 + __entry->moved,
4037 + __print_symbolic(__entry->reason, WB_WORK_REASON),
4038 + __entry->cgroup_ino
4039 +diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
4040 +index 30cc217b86318..651a4ad6d711f 100644
4041 +--- a/kernel/irq/matrix.c
4042 ++++ b/kernel/irq/matrix.c
4043 +@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
4044 + unsigned int cpu, bit;
4045 + struct cpumap *cm;
4046 +
4047 ++ /*
4048 ++ * Not required in theory, but matrix_find_best_cpu() uses
4049 ++ * for_each_cpu() which ignores the cpumask on UP .
4050 ++ */
4051 ++ if (cpumask_empty(msk))
4052 ++ return -EINVAL;
4053 ++
4054 + cpu = matrix_find_best_cpu(m, msk);
4055 + if (cpu == UINT_MAX)
4056 + return -ENOSPC;
4057 +diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
4058 +index 6fcc4650f0c48..53cc3bb7025a5 100644
4059 +--- a/kernel/locking/lockdep_proc.c
4060 ++++ b/kernel/locking/lockdep_proc.c
4061 +@@ -394,7 +394,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
4062 + seq_time(m, lt->min);
4063 + seq_time(m, lt->max);
4064 + seq_time(m, lt->total);
4065 +- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
4066 ++ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
4067 + }
4068 +
4069 + static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
4070 +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
4071 +index 7a4ca2deb39bc..1442f6152abc2 100644
4072 +--- a/kernel/trace/blktrace.c
4073 ++++ b/kernel/trace/blktrace.c
4074 +@@ -529,6 +529,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
4075 + if (!dir)
4076 + goto err;
4077 +
4078 ++ /*
4079 ++ * As blktrace relies on debugfs for its interface the debugfs directory
4080 ++ * is required, contrary to the usual mantra of not checking for debugfs
4081 ++ * files or directories.
4082 ++ */
4083 ++ if (IS_ERR_OR_NULL(dir)) {
4084 ++ pr_warn("debugfs_dir not present for %s so skipping\n",
4085 ++ buts->name);
4086 ++ ret = -ENOENT;
4087 ++ goto err;
4088 ++ }
4089 ++
4090 + bt->dev = dev;
4091 + atomic_set(&bt->dropped, 0);
4092 + INIT_LIST_HEAD(&bt->running_list);
4093 +diff --git a/net/core/skbuff.c b/net/core/skbuff.c
4094 +index 0629ca89ab74f..af6e9028716d1 100644
4095 +--- a/net/core/skbuff.c
4096 ++++ b/net/core/skbuff.c
4097 +@@ -5128,8 +5128,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb)
4098 + skb = skb_share_check(skb, GFP_ATOMIC);
4099 + if (unlikely(!skb))
4100 + goto err_free;
4101 +-
4102 +- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
4103 ++ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
4104 ++ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
4105 + goto err_free;
4106 +
4107 + vhdr = (struct vlan_hdr *)skb->data;
4108 +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
4109 +index 8e70a015c7928..b825ac025d5bd 100644
4110 +--- a/net/ipv6/ip6_tunnel.c
4111 ++++ b/net/ipv6/ip6_tunnel.c
4112 +@@ -865,7 +865,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb,
4113 + struct metadata_dst *tun_dst,
4114 + bool log_ecn_err)
4115 + {
4116 +- return __ip6_tnl_rcv(t, skb, tpi, tun_dst, ip6ip6_dscp_ecn_decapsulate,
4117 ++ int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
4118 ++ const struct ipv6hdr *ipv6h,
4119 ++ struct sk_buff *skb);
4120 ++
4121 ++ dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate;
4122 ++ if (tpi->proto == htons(ETH_P_IP))
4123 ++ dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate;
4124 ++
4125 ++ return __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
4126 + log_ecn_err);
4127 + }
4128 + EXPORT_SYMBOL(ip6_tnl_rcv);
4129 +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
4130 +index b5671966fa037..42bd1e74f78c1 100644
4131 +--- a/net/qrtr/qrtr.c
4132 ++++ b/net/qrtr/qrtr.c
4133 +@@ -554,23 +554,25 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
4134 + */
4135 + static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
4136 + {
4137 ++ u32 min_port;
4138 + int rc;
4139 +
4140 + mutex_lock(&qrtr_port_lock);
4141 + if (!*port) {
4142 +- rc = idr_alloc(&qrtr_ports, ipc,
4143 +- QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
4144 +- GFP_ATOMIC);
4145 +- if (rc >= 0)
4146 +- *port = rc;
4147 ++ min_port = QRTR_MIN_EPH_SOCKET;
4148 ++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
4149 ++ if (!rc)
4150 ++ *port = min_port;
4151 + } else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
4152 + rc = -EACCES;
4153 + } else if (*port == QRTR_PORT_CTRL) {
4154 +- rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
4155 ++ min_port = 0;
4156 ++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
4157 + } else {
4158 +- rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC);
4159 +- if (rc >= 0)
4160 +- *port = rc;
4161 ++ min_port = *port;
4162 ++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
4163 ++ if (!rc)
4164 ++ *port = min_port;
4165 + }
4166 + mutex_unlock(&qrtr_port_lock);
4167 +
4168 +diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
4169 +index 2379a02c319d7..6c4a7a5938b7a 100644
4170 +--- a/net/smc/smc_diag.c
4171 ++++ b/net/smc/smc_diag.c
4172 +@@ -169,13 +169,15 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb,
4173 + (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) &&
4174 + !list_empty(&smc->conn.lgr->list)) {
4175 + struct smc_connection *conn = &smc->conn;
4176 +- struct smcd_diag_dmbinfo dinfo = {
4177 +- .linkid = *((u32 *)conn->lgr->id),
4178 +- .peer_gid = conn->lgr->peer_gid,
4179 +- .my_gid = conn->lgr->smcd->local_gid,
4180 +- .token = conn->rmb_desc->token,
4181 +- .peer_token = conn->peer_token
4182 +- };
4183 ++ struct smcd_diag_dmbinfo dinfo;
4184 ++
4185 ++ memset(&dinfo, 0, sizeof(dinfo));
4186 ++
4187 ++ dinfo.linkid = *((u32 *)conn->lgr->id);
4188 ++ dinfo.peer_gid = conn->lgr->peer_gid;
4189 ++ dinfo.my_gid = conn->lgr->smcd->local_gid;
4190 ++ dinfo.token = conn->rmb_desc->token;
4191 ++ dinfo.peer_token = conn->peer_token;
4192 +
4193 + if (nla_put(skb, SMC_DIAG_DMBINFO, sizeof(dinfo), &dinfo) < 0)
4194 + goto errout;
4195 +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
4196 +index 29e684054abe3..f8e111218a0ec 100644
4197 +--- a/net/tipc/netlink_compat.c
4198 ++++ b/net/tipc/netlink_compat.c
4199 +@@ -255,8 +255,9 @@ err_out:
4200 + static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
4201 + struct tipc_nl_compat_msg *msg)
4202 + {
4203 +- int err;
4204 ++ struct nlmsghdr *nlh;
4205 + struct sk_buff *arg;
4206 ++ int err;
4207 +
4208 + if (msg->req_type && (!msg->req_size ||
4209 + !TLV_CHECK_TYPE(msg->req, msg->req_type)))
4210 +@@ -285,6 +286,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
4211 + return -ENOMEM;
4212 + }
4213 +
4214 ++ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI);
4215 ++ if (!nlh) {
4216 ++ kfree_skb(arg);
4217 ++ kfree_skb(msg->rep);
4218 ++ msg->rep = NULL;
4219 ++ return -EMSGSIZE;
4220 ++ }
4221 ++ nlmsg_end(arg, nlh);
4222 ++
4223 + err = __tipc_nl_compat_dumpit(cmd, msg, arg);
4224 + if (err) {
4225 + kfree_skb(msg->rep);
4226 +diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
4227 +index 146e1a3498c73..419da70cd942a 100644
4228 +--- a/sound/pci/cs46xx/cs46xx_lib.c
4229 ++++ b/sound/pci/cs46xx/cs46xx_lib.c
4230 +@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
4231 + rate = 48000 / 9;
4232 +
4233 + /*
4234 +- * We can not capture at at rate greater than the Input Rate (48000).
4235 ++ * We can not capture at a rate greater than the Input Rate (48000).
4236 + * Return an error if an attempt is made to stray outside that limit.
4237 + */
4238 + if (rate > 48000)
4239 +diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
4240 +index 8d0a3d3573457..8ef51a29380af 100644
4241 +--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
4242 ++++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
4243 +@@ -1739,7 +1739,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
4244 + struct dsp_spos_instance * ins = chip->dsp_spos_instance;
4245 +
4246 + if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
4247 +- /* remove AsynchFGTxSCB and and PCMSerialInput_II */
4248 ++ /* remove AsynchFGTxSCB and PCMSerialInput_II */
4249 + cs46xx_dsp_disable_spdif_out (chip);
4250 +
4251 + /* save state */
4252 +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
4253 +index f3a6b1d869d8a..dbeb62362f1c3 100644
4254 +--- a/sound/pci/hda/hda_codec.c
4255 ++++ b/sound/pci/hda/hda_codec.c
4256 +@@ -3410,7 +3410,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
4257 + * @nid: NID to check / update
4258 + *
4259 + * Check whether the given NID is in the amp list. If it's in the list,
4260 +- * check the current AMP status, and update the the power-status according
4261 ++ * check the current AMP status, and update the power-status according
4262 + * to the mute status.
4263 + *
4264 + * This function is supposed to be set or called from the check_power_status
4265 +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
4266 +index 2609161707a41..97adb7e340f99 100644
4267 +--- a/sound/pci/hda/hda_generic.c
4268 ++++ b/sound/pci/hda/hda_generic.c
4269 +@@ -825,7 +825,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
4270 + }
4271 + }
4272 +
4273 +-/* sync power of each widget in the the given path */
4274 ++/* sync power of each widget in the given path */
4275 + static hda_nid_t path_power_update(struct hda_codec *codec,
4276 + struct nid_path *path,
4277 + bool allow_powerdown)
4278 +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
4279 +index d8168aa2cef38..85c33f528d7b3 100644
4280 +--- a/sound/pci/hda/patch_sigmatel.c
4281 ++++ b/sound/pci/hda/patch_sigmatel.c
4282 +@@ -845,7 +845,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
4283 + static struct snd_kcontrol_new beep_vol_ctl =
4284 + HDA_CODEC_VOLUME(NULL, 0, 0, 0);
4285 +
4286 +- /* check for mute support for the the amp */
4287 ++ /* check for mute support for the amp */
4288 + if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
4289 + const struct snd_kcontrol_new *temp;
4290 + if (spec->anabeep_nid == nid)
4291 +diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
4292 +index 3919aed39ca03..5e52086d7b986 100644
4293 +--- a/sound/pci/ice1712/prodigy192.c
4294 ++++ b/sound/pci/ice1712/prodigy192.c
4295 +@@ -31,7 +31,7 @@
4296 + * Experimentally I found out that only a combination of
4297 + * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
4298 + * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
4299 +- * sampling rate. That means the the FPGA doubles the
4300 ++ * sampling rate. That means that the FPGA doubles the
4301 + * MCK01 rate.
4302 + *
4303 + * Copyright (c) 2003 Takashi Iwai <tiwai@××××.de>
4304 +diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
4305 +index 4cf3200e988b0..df44135e1b0c9 100644
4306 +--- a/sound/pci/oxygen/xonar_dg.c
4307 ++++ b/sound/pci/oxygen/xonar_dg.c
4308 +@@ -39,7 +39,7 @@
4309 + * GPIO 4 <- headphone detect
4310 + * GPIO 5 -> enable ADC analog circuit for the left channel
4311 + * GPIO 6 -> enable ADC analog circuit for the right channel
4312 +- * GPIO 7 -> switch green rear output jack between CS4245 and and the first
4313 ++ * GPIO 7 -> switch green rear output jack between CS4245 and the first
4314 + * channel of CS4361 (mechanical relay)
4315 + * GPIO 8 -> enable output to speakers
4316 + *
4317 +diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
4318 +index 108e8bf42a346..f0a409504a13b 100644
4319 +--- a/sound/soc/codecs/wm8958-dsp2.c
4320 ++++ b/sound/soc/codecs/wm8958-dsp2.c
4321 +@@ -419,8 +419,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w,
4322 + struct snd_kcontrol *kcontrol, int event)
4323 + {
4324 + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
4325 ++ struct wm8994 *control = dev_get_drvdata(component->dev->parent);
4326 + int i;
4327 +
4328 ++ if (control->type != WM8958)
4329 ++ return 0;
4330 ++
4331 + switch (event) {
4332 + case SND_SOC_DAPM_POST_PMU:
4333 + case SND_SOC_DAPM_PRE_PMU:
4334 +diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
4335 +index c22880aea82a2..7e48c740bf550 100644
4336 +--- a/sound/soc/img/img-i2s-in.c
4337 ++++ b/sound/soc/img/img-i2s-in.c
4338 +@@ -346,8 +346,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
4339 + chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
4340 +
4341 + ret = pm_runtime_get_sync(i2s->dev);
4342 +- if (ret < 0)
4343 ++ if (ret < 0) {
4344 ++ pm_runtime_put_noidle(i2s->dev);
4345 + return ret;
4346 ++ }
4347 +
4348 + for (i = 0; i < i2s->active_channels; i++)
4349 + img_i2s_in_ch_disable(i2s, i);
4350 +diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
4351 +index acc005217be06..f56752662b199 100644
4352 +--- a/sound/soc/img/img-parallel-out.c
4353 ++++ b/sound/soc/img/img-parallel-out.c
4354 +@@ -166,8 +166,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
4355 + }
4356 +
4357 + ret = pm_runtime_get_sync(prl->dev);
4358 +- if (ret < 0)
4359 ++ if (ret < 0) {
4360 ++ pm_runtime_put_noidle(prl->dev);
4361 + return ret;
4362 ++ }
4363 +
4364 + reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
4365 + reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
4366 +diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
4367 +index 43679aeeb12be..88e838ac937dc 100644
4368 +--- a/sound/soc/tegra/tegra30_ahub.c
4369 ++++ b/sound/soc/tegra/tegra30_ahub.c
4370 +@@ -655,8 +655,10 @@ static int tegra30_ahub_resume(struct device *dev)
4371 + int ret;
4372 +
4373 + ret = pm_runtime_get_sync(dev);
4374 +- if (ret < 0)
4375 ++ if (ret < 0) {
4376 ++ pm_runtime_put(dev);
4377 + return ret;
4378 ++ }
4379 + ret = regcache_sync(ahub->regmap_ahub);
4380 + ret |= regcache_sync(ahub->regmap_apbif);
4381 + pm_runtime_put(dev);
4382 +diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
4383 +index 0b176ea24914b..bf155c5092f06 100644
4384 +--- a/sound/soc/tegra/tegra30_i2s.c
4385 ++++ b/sound/soc/tegra/tegra30_i2s.c
4386 +@@ -551,8 +551,10 @@ static int tegra30_i2s_resume(struct device *dev)
4387 + int ret;
4388 +
4389 + ret = pm_runtime_get_sync(dev);
4390 +- if (ret < 0)
4391 ++ if (ret < 0) {
4392 ++ pm_runtime_put(dev);
4393 + return ret;
4394 ++ }
4395 + ret = regcache_sync(i2s->regmap);
4396 + pm_runtime_put(dev);
4397 +
4398 +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
4399 +index 89b70308b5513..83f72ddf4fda6 100644
4400 +--- a/sound/usb/quirks-table.h
4401 ++++ b/sound/usb/quirks-table.h
4402 +@@ -3524,8 +3524,8 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
4403 + * they pretend to be 96kHz mono as a workaround for stereo being broken
4404 + * by that...
4405 + *
4406 +- * They also have swapped L-R channels, but that's for userspace to deal
4407 +- * with.
4408 ++ * They also have an issue with initial stream alignment that causes the
4409 ++ * channels to be swapped and out of phase, which is dealt with in quirks.c.
4410 + */
4411 + {
4412 + .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
4413 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
4414 +index 94110b1dcd3d8..031baa43646fb 100644
4415 +--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
4416 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
4417 +@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
4418 + ebb_global_disable();
4419 + ebb_freeze_pmcs();
4420 +
4421 +- count_pmc(1, sample_period);
4422 +-
4423 + dump_ebb_state();
4424 +
4425 + event_close(&event);
4426 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
4427 +index 7c57a8d79535d..361e0be9df9ae 100644
4428 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
4429 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
4430 +@@ -42,8 +42,6 @@ int cycles(void)
4431 + ebb_global_disable();
4432 + ebb_freeze_pmcs();
4433 +
4434 +- count_pmc(1, sample_period);
4435 +-
4436 + dump_ebb_state();
4437 +
4438 + event_close(&event);
4439 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
4440 +index ecf5ee3283a3e..fe7d0dc2a1a26 100644
4441 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
4442 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
4443 +@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
4444 + ebb_global_disable();
4445 + ebb_freeze_pmcs();
4446 +
4447 +- count_pmc(1, sample_period);
4448 +-
4449 + dump_ebb_state();
4450 +
4451 + printf("EBBs while frozen %d\n", ebbs_while_frozen);
4452 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
4453 +index c0faba520b35c..b9b30f974b5ea 100644
4454 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
4455 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
4456 +@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
4457 + ebb_global_disable();
4458 + ebb_freeze_pmcs();
4459 +
4460 +- count_pmc(1, sample_period);
4461 +-
4462 + dump_ebb_state();
4463 +
4464 + event_close(&event);
4465 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
4466 +index 46681fec549b8..2694ae161a84a 100644
4467 +--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
4468 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
4469 +@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
4470 + ebb_global_disable();
4471 + ebb_freeze_pmcs();
4472 +
4473 +- count_pmc(1, sample_period);
4474 +-
4475 + dump_ebb_state();
4476 +
4477 + event_close(&event);
4478 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
4479 +index a991d2ea8d0a1..174e4f4dae6c0 100644
4480 +--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
4481 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
4482 +@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
4483 + ebb_global_disable();
4484 + ebb_freeze_pmcs();
4485 +
4486 +- count_pmc(1, sample_period);
4487 +-
4488 + dump_ebb_state();
4489 +
4490 + FAIL_IF(ebb_state.stats.ebb_count == 0);
4491 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
4492 +index 2ed7ad33f7a3b..dddb95938304e 100644
4493 +--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
4494 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
4495 +@@ -75,7 +75,6 @@ static int test_body(void)
4496 + ebb_freeze_pmcs();
4497 + ebb_global_disable();
4498 +
4499 +- count_pmc(4, sample_period);
4500 + mtspr(SPRN_PMC4, 0xdead);
4501 +
4502 + dump_summary_ebb_state();
4503 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
4504 +index 6ff8c8ff27d66..035c02273cd49 100644
4505 +--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
4506 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
4507 +@@ -70,13 +70,6 @@ int multi_counter(void)
4508 + ebb_global_disable();
4509 + ebb_freeze_pmcs();
4510 +
4511 +- count_pmc(1, sample_period);
4512 +- count_pmc(2, sample_period);
4513 +- count_pmc(3, sample_period);
4514 +- count_pmc(4, sample_period);
4515 +- count_pmc(5, sample_period);
4516 +- count_pmc(6, sample_period);
4517 +-
4518 + dump_ebb_state();
4519 +
4520 + for (i = 0; i < 6; i++)
4521 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
4522 +index 037cb6154f360..3e9d4ac965c85 100644
4523 +--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
4524 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
4525 +@@ -61,8 +61,6 @@ static int cycles_child(void)
4526 + ebb_global_disable();
4527 + ebb_freeze_pmcs();
4528 +
4529 +- count_pmc(1, sample_period);
4530 +-
4531 + dump_summary_ebb_state();
4532 +
4533 + event_close(&event);
4534 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
4535 +index c5fa64790c22e..d90891fe96a32 100644
4536 +--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
4537 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
4538 +@@ -82,8 +82,6 @@ static int test_body(void)
4539 + ebb_global_disable();
4540 + ebb_freeze_pmcs();
4541 +
4542 +- count_pmc(1, sample_period);
4543 +-
4544 + dump_ebb_state();
4545 +
4546 + if (mmcr0_mismatch)
4547 +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
4548 +index 30e1ac62e8cb4..8ca92b9ee5b01 100644
4549 +--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
4550 ++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
4551 +@@ -76,8 +76,6 @@ int pmc56_overflow(void)
4552 + ebb_global_disable();
4553 + ebb_freeze_pmcs();
4554 +
4555 +- count_pmc(2, sample_period);
4556 +-
4557 + dump_ebb_state();
4558 +
4559 + printf("PMC5/6 overflow %d\n", pmc56_overflowed);